PWS Attachment_DD 254_47QFSA22Q0142_Aug 26 2022.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

June 30, 2025 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, "DoD Contract Security Classification Specification" Hide Attachment Bar

TBA

985 Macon Street Robins AFB, GA 31098

(478) 222-1977 Enter cognizant security office(s) (Name, Address, ZIP Code, Telephone required; Email Address optional).: 78 ABW/IPD 985 Macon Street Robins AFB, GA 31098

(478) 222-1977

750 Third Street Bldg 350 Robins AFB, GA 31098 Enter location(s).: AFLCMC/WIG/WII 480 Richard Ray Blvd Bldg 301 Robins AFB, GA 31098

235 Byron Street, Suite 19A, Robins AFB, GA 31098 Enter public release authority.: 78 ABW/PA 125 MLK Jr. Blvd, Robins AFB, GA 31098

2. Storage of Classified Material/Information: The government program manager (GPM) may authorize VG to store and handle classified material required for performance on this contract. All classified information shared with the VG must be stored in an approved government-owned and controlled security container. The number of VG employees authorized access to the security container will be kept to the minimum number required for efficient contract performance. When authorized, the VG shall comply with DoDM 5200.1, V1_ AFMAN, 16-1404, V1, DoD Information Security Program: Overview, Classification and Declassification; DoDM 5200.1, V2_AFMAN 16-1401, V2, DoD Information Security Program: Marking of Information; DoDM 5200.1, V3_AFMAN 16-1404, V3, DoD Information Security Program Protection Of Classified Information and the government activity’s security program operating instruction (OI). The VG is prohibited from establishing and/or maintaining a separate classified information system. All classified material/information must be returned and secured in the government security container at the end of the duty day.

3. Guard Services: The host government activity will provide guard services.

4. Security Forms: Security forms and publications are accessible at: Air Force publications: https://www.e-publishing.af.mil/ DoD publications: https://www.esd.whs.mil/DD/. Local forms will be provided by the government activity.

5. Security Inspections:

a. The VG shall participate in the host Commander’s self-assessment programs IAW DoDM 5200.1,V3_AFMAN 16-1404, V1 and V3. Deficient items will include a corrective action plan.

b. The security focal point (SFP) will maintain the following documentation and have available for security reviews:

(1) A signed copy of the current prime DD Form 254, and all subcontractor DD Form 254, if applicable.

(2) Documentation the Security Agreement was provided to all subcontractors, if applicable.

(3) Documentation of the last program review and self-inspection.

(4) Consultant Agreements, if applicable.

(5) Current list of all employees identifying their security clearance access level, including subcontractors, if applicable.

6. Transmission of Classified Material/Information:

a. Receipt and dispatch of classified material is the responsibility of the government. The VG is not authorized to perform these activities unless they are specifically contracted for and identified in the Statement of Work or Performance Work Statement. When this service is required for contract performance, the designated VG employee shall comply with DoDM 5200.1, V1, V2, V3_AFMAN 16-1404, V1, V2, V3 and the government activity’s security program OI. The security assistant (SA) will provide VG personnel training on mail handling procedures, to include proper securing of Registered, Certified, USPS Express and FedEx Mail and/or First Class mail. However, under no circumstances will the VG be authorized to open a classified package beyond the outer wrapper to determine further distribution or sign the classified document receipt.

b. The VG is not authorized for direct receipt or dispatch of classified material at RAFB through US postal channels or commercial carrier.

c. Classified material transmitted via U. S. postal channels or approved commercial carrier, direct from the government activity, must be prepared IAW DoDM 5200.1, V3_ AFMAN 16-1404, V2 and processed through the classified information control system of RAFB.

d. Classified material may be hand carried onto or off RAFB by an appropriately cleared and briefed VG courier, provided the employee is so designated in writing by his/her company FSO as a courier and the activity Director or designee IAW DoDM 5200.1-V3_AFMAN 16-1404, V3.

7. Security Badges: The government activity will issue security badges. The contractor shall return security badges to the issuing office upon the period of performance end date, termination of the contract, or when an employee is no longer supporting the contract, whichever is sooner. Transfer of security badges to another contract is not authorized.

8. Visitor Control: The contractor shall comply with DoDM 5200.08, V3_AFMAN 31-101, V3, Installation Perimeter Access Control, and the host installation commander’s visitor control procedures for access to the installation and the government activity’s visitor control procedures to access facilities.

9. Security Incidents: The contractor shall report security incidents to the unit’s security assistant and the host Information Protection Office. The government shall conduct the preliminary inquiry for security incidents occurring on the installation IAW AFMAN 16-1404, V3Air Force Information Security Program.

10. Security Checks: Government personnel shall conduct end-of-day security checks unless the contract specifically identifies contractors to conduct end-of-day security checks.

11. Internal Security Controls: The contractor shall comply with the government activity’s security operating instructions.

12. Emergency Procedures to Protect Classified Material: The contractor shall implement emergency procedures to protect classified material as identified in the host government activity’s operating instruction.

13. Training: The contractor shall participate in the host government activity’s initial and reoccurring information protection security awareness and training education programs.

14. Subcontract DD Form 254: Should a subcontract be issued under this effort, whereas the subcontractor will require access to classified information and be physically located on Robins AFB GA for a minimum of 90 days or more consecutively, the VG must issue a subcontract DD Form 254, IAW the NISPOM, and comply with the following:

a. Provide a signed copy of the DD Form 254 to the government program manager, security assistant and the security focal point and the host information protection office.

b. Ensure the subcontractor complies with this security agreement or enter into a separate agreement with the subcontractor. The agreement to comply must be documented and a copy of the documentation provided to GPM, SA, SFP and 78 ABW/IPD. If a separate agreement is prepared, a copy shall be provided to the GPM, SA, SFP and 78 ABW/IPD.

15. Reporting Requirements: VG employees report shall report adverse information, suspicious contacts, espionage, sabotage, and subversive activities to government activity’s security assistant IAW DoDM 5220.22, V2_AFMAN 16-1406, V2, paragraph 4.14 (Added)(AF). The contractor shall furnish a copy of adverse information reports required by DoD 5220.22-M, National Industrial Security Program Operating Manual, Section 1-302a, to the installation commander through the 78th ABW Industrial Security Office, 78 ABW/IPD, 78abw.ip.indsec@us.af.mil

Ref Item 3b: Revised (enter reason)

Ref Items 8a and 11a: Contract performance will occur at the locations noted in Block 8.a. The following security classification guide applies to this effort: DoDM 5200.01, Volume 1 and DoDM 5200.45.

Ref Item 8a: Intermittent performance occurs at multiple additional CONUS and OCONUS locations. Classified performance list can be obtained by contacting the Program Manager below. Performance includes sites in the PACAF TAO. Provide distribution to each servicing security activity Information Protection (IP) office at other Air Force installations where there is contract performance as a Long-Term Visitor (as applicable).

Ref Item 10a: The contractor is governed by NSA/CSS Policy Manual 3-16, dated 23 January 2015, in the control and protection of COMSEC Material/Information. Access to COMSEC material by personnel is restricted to U. S. citizens holding final U.S Government clearances. Such information is not releasable to personnel holding reciprocal clearances. For on base COMSEC access see AFMAN 17-1302-O, COMSEC Operations for guidance.

Ref Item 10a/11h: The contractor is governed by NSA/CSS Policy Manual 3-16, dated 23 January 2015, in the control and protection of COMSEC Material/Information. Access to COMSEC material by personnel is restricted to U.S.citizens holding final U.S Government clearances. Such information is not releasable to personnel holding reciprocal clearances. For on base COMSEC access see AFMAN 17-1302-O, COMSEC Operations for guidance.

Ref Item 10e(1): Cleared personnel are required to perform this service because access to classified information inside a SCIF cannot be precluded by escorting personnel.

Ref Item 10e(2): Contractor will require access to and comply with AFMAN 14-403. Release of intelligence data does not create an unfair competitive advantage for the contractor nor a conflict of interest with the contractor's obligation to protect the information.

Ref Item 10f: IF SAP IS REQUIRED, MUST ADD SIGNATURE BELOW PROGRAM MANAGER FOR SAP OPR TO SIGN, ALSO MUST INCLUDE SAP ADDENDUM.

Ref Item 10g: NATO briefing required prior to granting access. See 32 CFR Part 117 section 117.19(g) (7) for details. SIPRNET users require a NATO awareness briefing. A formal NATO briefing is required when the SIPRNET enclave or other classified networks is approved for NATO and no additional security measures are in place to preclude access. JWICS users shall receive the NATO Secret briefing, sign the AF Form 2583 or equivalent, and have their JPAS records updated with NATO Secret prior to JWICS access.

Ref Item 10h: Access to Foreign Government Information (FGI) by cleared U.S. persons is based on the individuals having a valid need-to-know and a personnel security clearance (interim or final).

Ref Item 10j/llL: CUI The contractor shall comply with DoDI 5200.01, Vol 1_AFMAN 16-1404, Vol , Air Force Information Security Program, and DoDM 5400.07_AFMAN 33-302 Air Force Information Security Program, and DoDM 5400.07_AFMAN 33-302 Air Force Manual DoD Freedom of Information Act (FOIA) Program. The contractor shall monitor CUI aggregation and compilation based on the potential to generate classified information pursuant to security classification guidance addressing the accumulation of unclassified data of information.

Ref Item 10k: IT Level 1 access requires a favorably completed Single Scope Background Investigation (SSBI) /Tier 5 personnel security investigation and a reinvestigation every 5 years. IT Level II access requires a favorably completed National Agency Check Local Agency Check (NACLC)/Tier 3 personnel security investigation. IT Level III access requires a favorably completed Tier 1 personnel security investigation.

Ref Item 11a: Contract performance is restricted to the government/contractor locations identified in 8a. Government agency or activity will provide security classification guidance for performance of this contract.

Ref Item 11c: Contractor will receive COMSEC equipment only. The Contract shall store and account for all COMSEC equipment upon approval of Government Rep and stored in a approved Vault/Safe until redistributed. The Contractor shall in no form generate classified information; however, if any classified information is generated in performance of this contract, it shall be derivatively classified and marked consistent with the source material. See Ref Item 11c for applicable security classification guidance.

Ref Item 11c: The following security classification guides apply to this effort: Senior Year Program Classification Guide, dated 20 December 2016, Distributed Common Ground System (DCGS) Security Classification Guide, dated 31 December 2011, RQ-4A Global Hawk Security Classification Guide, dated 1 Aug 2009, MQ-1 Predator MQ-9 Reaper Security Classification/Declassification Guide, dated 1 Aug 09 (provided under separate cover).

Ref Item 11d: The Contractor will be required to provide adequate approved storage for classified collateral material to the level of __________ which exceeds two cubic feet but not more than ________cubic feet.

Ref Item 11e: (ENGINEERING SERVICES) Contract is for engineering services. Classification markings on the material to be furnished will provide the guidance necessary for performance of the contract.

Ref Item 11e: (EQUIPMENT MAINENANCE SERVICES) Contract is for equipment maintenance services on equipment which processes classified information. Actual knowledge of, generation, or production of classified information is not required for performance of the contract. Cleared personnel are required to perform this service because access to classified information cannot be precluded by escorting personnel.

Ref Item 11f: Additional operational locations to be determined. Existing overseas locations include (LIST BASE/COUNTRY ONLY, NO ADDRESSES REQUIRED)

Ref Item 11j: The Contractor will be provided critical information under separate cover, if applicable. Contractor personnel will participate in the OPSEC program administered locally by the AF activity.

Ref Item 11m: IF VGSA REQUIREMENTS DO NOT APPLY REMOVE COMMENT FROM 11M ABOVE AND UNMARK BOX

Ref Item 12: Contractor is to submit requests through the contracting officer for OPSEC program manager review and public release authorization. The contracting officer will provide contractor with written approval/disapproval. Information requiring AF or DoD-level review will be reviewed by the unit’s OPSEC program manager or coordinator who will in-turn forward to the entry-level public affairs office through the AFIMSC Public Affairs Office to the Secretary of the Air Force, Office of Public Affairs, Security and Review Division (SAF/PAX), 1690 Air Force Pentagon, Washington DC 20330-1690.

Ref Item 14: Per AFI 10-245, all contractors will be Anti-terrorism Level 1 trained. Force Protection training can be found on Air Force myLearning at https://lms-jets.cce.af.mil/moodle/

Ref Item 15: ENTER ANY ADDITIONAL INSPECTION GUIDANCE HERE

Ref Item 18d: Ensure certification and signatures are completed by contracting officer and distribution is accomplished to the following:

HQ USAFE/IP HQ PACAF/IP HQ ACC/IP

Unit 3040 Box 125 25 E Street, 305M 165 Dodd Blvd APO AE 09094-0135 Hickam AFB, HI 96853-5439 Langley AFB, VA 23665-2796

____Ref Item 18f: Ensure certification and signatures are completed by contracting officer and distribution is accomplished to locations identified in 8a and 8c above and to the following:

78 ABW/IPD AFLCMC/HBG AFLCMC/INGS HQ DCSA

985 Macon Street 235 Byron Street, Suite 19A 235 Byron Street, Suite 19A 27130 Telegraph Rd Robins AFB, GA 31098 Robins AFB, GA 31098 Robins AFB, GA 31098 Quantico, VA 22134

FAR Clause 52.204-2 Security Requirements

This clause applies to the extent that the contract involves access to information classified Confidential, Secret, or Top Secret. The clause is related to compliance with the National Industrial Security Program Operating Manual (NISPOM) and any revision to the manual for which notice has been furnished to a contractor

FAR Clause 52.204-21 Basic Safeguarding of Covered Contractor Information

This clause applies to information not intended for public release that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public websites) or simple transactional information, such as necessary to process payments.

DFARS Clause 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting

This clause requires a company to safeguard CDI, as defined in the clause, and to report to the DoD the possible exfiltration, manipulation, or other loss or compromise of unclassified CDI: or other activities that allow unauthorized access to the contractor’s unclassified information system on which unclassified CDI is resident or transiting. The company must submit the malware to DoD if the company is able to isolate it and send it safely.

DFARS Clause 252.204-7000 Disclosure of Information

This cause prohibits the contractor from releasing any unclassified information pertaining to the contract or any program related to the contract, unless they have CO approval or the information is in the public domain before the date of release.

DFARS Clause 252.204.7009 Limitations on the Use or Disclosure of Third-Party Contractor Reported Cyber Incident Information. This clause is required for contractor services that include support for the Government’s activities related to safeguarding covered defense information and cyber incident reporting.

The Contractor will notify the Government Contracting Activity and the Government Security Manager within 48 hours of any incident involving the actual or suspected compromise/loss of classified information to enable the Government to conduct immediate assessment of potential impact pending formal inquiry/investigation. Actual or suspected compromise of Covered Defense Information will be reported IAW DFARS Clause 252.204-7012.

Compliance with DFARS 252.225-7040 Requirements in EUCOM AOR; Contracts with performance in designed countries in the United States European Command Area of Responsibility: “Contractor Personnel Supporting U.S. Armed Forces Outside the United States.” As prescribed at DFARS 225.371-5(a)(3), Contracting Activities shall ensure DFARS clause 252.225-7040 is included in solicitations and contracts, including those using Federal Acquisition Regulation (FAR) part 12 procedures for the acquisition of commercial items, with performance in a country east of Sweden, Germany, responsibility (AOR) (designated countries).

USAF Logistics Manager/COR rep: Nakita E. Ford USAF Security Specialist rep: Melvese M. Harris USAF Servicing Security Activity rep: Mike Long USAF Special Security Office

Per AFI 10-245, all contractors will be Anti-terrorism Level 1 trained. Force Protection training can be found on Air Force myLearning website at https://lms-jets.cce.af.mil/moodle/

77 Forsyth Street SW Atlanta, GA 30303-3490 Enter address (include zip code).: GSA/FAS/AAS 77 Forsyth Street SW Atlanta, GA 30303-3490