RFP Attach 09 - DD254.pdf

CLASSIFICATION (When filled in): UNCLASSIFIED

DD FORM 254, APR 2018 PREVIOUS EDITION IS OBSOLETE.

CLASSIFICATION (When filled in): UNCLASSIFIED

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

June 30, 2025

The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

a. LEVEL OF FACILITY SECURITY CLEARANCE (FCL) REQUIRED (See Instructions)

TOP SECRET

b. LEVEL OF SAFEGUARDING FOR CLASSIFIED INFORMATION/

MATERIAL REQUIRED AT CONTRACTOR FACILITY

NONE

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

a. PRIME CONTRACT NUMBER (See instructions.)

b. SUBCONTRACT NUMBER

c. SOLICITATION OR OTHER NUMBER DUE DATE(YYYYMMDD)

25-RFPREQ-LSUBP00006-0126 20250626

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

DATE(YYYYMMDD)

20250528

b. REVISED (Supersedes all previous specifications.)

REVISON NO. DATE(YYYYMMDD)

c. FINAL (Complete Item 5 in all cases.) DATE(YYYYMMDD)

4. IS THIS A FOLLOW-ON CONTRACT? No Yes If yes, complete the following:

Classified marterial received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254? No Yes If yes, complete the following:

In response to the contractors request dated , retention of the classified material is authorized for the period of:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

TBD TBD

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

8. ACTUAL PERFORMANCE (Click button to add more locations)

a. LOCATION(S) (For actual performance, see instructions)

TBD

United States

b. CAGE CODE (If applicable, see Instructions.)

TBD

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

9. GENERAL UNCLASSIFIED DESCRIPTION OF THIS PROCUREMENT

United States Coast Guard (USCG) Shipboard Command, Control, Communications, Computers, Cyber, Intelligence (C5I) Readiness, Integration, Technical Services

CLASSIFICATION (When filled in): UNCLASSIFIED

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Block 13 or 14 as set forth in the instructions.)

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION

b. RESTRICTED DATA

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION (CNWDI) (If CNWDI applies, RESTRICTED DATA must also be marked.)

d. FORMERLY RESTRICTED DATA

e. NATIONAL INTELLIGENCE INFORMATION:

(1) Sensitive Compartmented Information (SCI)

(2) Non-SCI

f. SPECIAL ACCESS PROGRAM (SAP) INFORMATION

g. NORTH ATLANTIC TREATY ORGANIZATION

(NATO) INFORMATION

h. FOREIGN GOVERMENT INFORMATION

i. ALTERNATIVE COMPENSATORY CONTROL MEASURES

(ACCM) INFORMATION

j. CONTROLLED UNCLASSIFIED INFORMATION (CUI) (See instructions.)

k. OTHER (Specify) (See instructions.)

See Block 13 - Ref 10K

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. Provide details in Block 13 or 14 as set forth in the instructions.)

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT

ANOTHER CONTRACTOR'S FACILITY OR A GOVERNMENT

ACTIVITY

(Applicable only if there is no access or storage required at contractor facility.

See instructions.)

b. RECEIVE AND STORE CLASSIFIED DOCUMENTS ONLY

c. RECEIVE, STORE, AND GENERATE CLASSIFIED

INFORMATION OR MATERIAL

d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. PERFORM SERVICES ONLY

f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE

THE U.S., PUERTO RICO, U.S. POSSESSIONS AND TRUST

TERRITORIES

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE

TECHNICAL INFORMATION CENTER (DTIC) OR OTHER

SECONDARY DISTRIBUTION CENTER

h. REQUIRE A COMSEC ACCOUNT

i. HAVE A TEMPEST REQUIREMENT

j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

k. BE AUTHORIZED TO USE DEFENSE COURIER SERVICE

l. RECEIVE, STORE, OR GENERATE CONTROLLED UNCLASSIFIED

INFORMATION (CUI).

(DoD Components: refer to DoDI 5200.48, only for specific CUI protection requirements. Non-DoD Components: see instructions.)

m. OTHER (Specify) (See instructions.)

12. PUBLIC RELEASE All things herewith therefore nevermore

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority.

Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

DIRECT THROUGH (Specify below)

No public release of information authorized without liaison with the NIWC Atlantic COR Lucas G Richard;

lucas.g.richard.civ@us.navy.mil; (843) 4058-7074

Public Release Authority:

Special Security Officer (SSO) Tammy Farnsworth, 843-218-4196

NO RELEASE OF SCI INFORMATION IS AUTHORIZED

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below.Pending final decision,the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

THIS DD254 IS FOR SOLICITATION PURPOSES ONLY. A PRIME DD254 WILL BE PROVIDED UPON CONTRACT AWARD

PERIOD OF PERFORMANCE ECD: TBD

SSO ISS tracking number IRC 029IS-25

PID # N65236-25-RFPREQ-LSUBP00006-0126

CONTRACT NUMBER: TBD

DO/TO NUIMBER: TBD

NIWC Atlantic COR Lucas G Richard, lucas.g.richard.civ@us.navy.mil, 843-408-7074

Security classification guidance for this contract is the 32 CFR Part 117 NISPOM Rule.

Access to SCI Information is limited to US Government SCI Facilities Only.

All SCI security guidance will be provided by the On-site Government SSO.

All SCI Visit Requests will have the need to know certified by the COR prior to processing by the NIWC Special Security Office

Facility Security Clearance: The Contractor shall possess and maintain a facility clearance granted by the Defense Counterintelligence and

CLASSIFICATION (When filled in): UNCLASSIFIED

Security Agency (DCSA). The Contractor's employees, performing work in support of this contract (not technicians as stated below) will require security clearance/eligibility determination based on a favorably adjudicated T5 or T5R with SCI eligibility; be within investigation scope and/or currently enrolled in Continuous Evaluation (CE) / Continuous Vetting (CV) at the time of contract award and throughout the life of the contract to include all potential option years identified in this PWS. The DD 254 will be housed within the NCCS through the life of the contract. The Contractor shall be registered within NCCS at time of award to gain access to the DD 254. It is incumbent upon the Contractor to ensure that the necessary security paperwork is submitted in sufficient time to enable each individual to be cleared prior to beginning work on this contract. In the event that the NCCS is superseded by another System of Record, the same requirements apply. The Contracting Officer will maintain the DD254 in the Official Contracts Records.

-- Contractor personnel performing or assigned under this contract must be U.S. persons. Security Classification Guide requests should be presented to the Government Sponsor, if required, subsequent to contract award. All classified information received or generated under this contract is the property of the U. S. Government. The U. S. Government shall provide disposition instructions. No release of classified information or controlled unclassified information under this contract is authorized. All requirements for control and accounting of original documentation and copies apply. All applicable provisions of the NISPOM and its supplements and 32 CFR, part 117 apply. Any classified information shall be transmitted IAW DOD 5200.1-R, DOD Information Security Program Regulations. The contractor shall adhere to Chapter 8, NISPOM, which applies to non-DoD IT systems.

-- Contractor is not authorized to subcontract on this effort without an approved subcontracting plan with written GCA/COR authorization

-- All Common Access Cards (CACs), building access badges, and parking passes must be returned immediately at the end of the period of performance date.

-- The Contractor shall comply with (1) Security Agreement (DD Form 441/DD Form 441-1), including the National Industrial Security Program Operating Manual (NISPOM), DoD 5220.22-M and any revisions and (2) 32 CFR, Part 117.Provisions of the Privacy Act apply to all records and reports maintained by the contractors.

-- All programs and materials developed at government expense during the performance period of this contract are the property of the US Government.

-- Prior to granting an employee access to classified information and/or materials, the contractor shall brief employees with regard to their obligation to comply with the NISPOM, to include any changes and/or amendments, and 32 CFR, Part 117. The contractor s employees shall be debriefed when access to the material is no longer needed or is terminated. A list of all employees who have had access to classified information during the period of this contract shall be maintained by the contractor company and be available for Defense Counterintelligence and Security Agency inspection

-- Access to General Protection/Security Policies and Procedures. All contractor employees, including subcontractor employees stationed or assigned on a US Government facility shall comply with applicable installation, facility access procedures and local security policies (provided by the US Government security personnel). The contractor workforce shall comply with all personal identification verification requirements as directed by local policy. In addition to the changes otherwise authorized by the changes clause in this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the US Government may require changes in the contractor security processes or procedures.

-- Contractors requiring access to US Government Information Technology (IT) systems must adhere to all US Government requirements. All contractor employees and any associated subcontractor employees shall annually complete the DoD Information Assurance Training and sign an Acceptable Use Policy (AUP). The training certificate and AUP must be provided to the designated personnel at US Government facilities before issuance of network access and annually thereafter.

-- Contactor employees shall abide by US Government Security Regulations and Security Standard Operating Procedures when working on-site at US Government facilities/installations and shall annually attend Government mandatory training including Operational Security, Security Awareness, Subversion and Espionage, Ethics and Prevention of Sexual Harassment, and any/all other training as directed by the US Government.

-- Common Access Cards (CACs) are authorized for contractor employees that work on-site at Government facilities. CACs are the property of the US Government and shall be giving to the Contractor Facility Security Officer upon termination of employment with the company, expiration of the CAC, replacement of a CAC, or upon contract completion. The FSO shall immediately return the CACs to the Government Security Office, Government Contracting Officer, or Contracting Officer Representative. The loss of a CAC shall be reported on the first business day following the discovery of the lost CAC to your chain of command and to the issuing agency. Unauthorized possession of a CAC can be prosecuted criminally under section 701, title 18, United States Code.

Photocopying of US Government Identification (CAC) is a violation of Title 18, US Code Part 1, Chapter 33, Section 01 and punishable by both fine and imprisonment. Although the asking for military/government identification is totally permissible by commercial establishments, there is a prohibition on duplication of government identification. A state issued driver license or other form of photo identification should be provided to be photocopied if an establishment insists on a photocopy of the traveler s identification. Contractor is required to ensure that all employees are aware of this law.

-- Contractor personnel shall utilize US Government or official company e-mail for transmitting official US Government business.

Official US Government business shall NOT be transmitted via personal, private, and/or commercial e-mail accounts, i.e., YAHOO, HOTMAIL, GMAIL, VERIZON, etc.

-- Contractor is prohibited from using reference to this contract, classification, clearances, accesses (collateral and/or SCI), even by unclassified acronyms, in advertisements, websites, capabilities fliers, promotional efforts, or recruitment of employees.

Ref 10a: The performance of this contract shall require access to Communication Security (COMSEC) and Controlled Cryptographic Item (CCI) information and Secure Telephone Equipment necessary for secure communications. Access to COMSEC information, material, and equipment is restricted to U.S. citizens holding FINAL U.S. government security clearances/eligibilities. Such information is NOT releasable to personnel holding interim or reciprocal clearances. DoD 5220.22-M, 32 CFR, National Security Agency (NSA) Central Security Service (CSS), NSA/CSS Policy Manual No. 3-16 Control of Communications Security (COMSEC) Material, 5 August 2005, applies to this contract. An approved subcontracting plan and Government Contracting Officer written approval is required prior to granting COMSEC access to a subcontractor.

Ref 10e(1) SCI Information:

Contractor will require ICD 703 and DCID 6/6. Access to Sensitive Compartmented Intelligence (SCI) information and Non-SCI information requires special briefings and a final U.S. Government clearance/eligibility at the appropriate level. An approved subcontracting

CLASSIFICATION (When filled in): UNCLASSIFIED plan and Government Contracting Officer written approval is required prior to granting SCI and/or Non-SCI Intelligence information access to a subcontractor.

Access to Sensitive Compartmented Information (SCI):

1. Inquiries pertaining to classification guidance on SCI will be directed to the responsible Contracting Officer s Representative (COR), Contracting Officer s Technical Representative (COTR), or Government Program Manager (GPM), and the Government Special Security Officer (GSSO). SCI is limited to the executable term of the contract. Upon expiration of the SCI contract, all contractors with SCI accesses must be withdrawn, debriefed, and all SCI materials must be recovered.

2. All SCI access required in the performance of this contract will be justified/authorized through the GPM and maintained/approved by the GSSO. The GPM will provide the Contractor Facility Security Officer (FSO) or Contractor Special Security Officer (CSSO) with written approval of personnel and the necessary data to submit request(s) for single scope background investigations (T5/T5R).

Term certifications from any other Government agencies for contractors working SCI portions of the contracts are acceptable for the time between submission and approval of the contractor SCI access request. Contractor FSO/CSSO will be required to pass Personal Identifying Information (PII) to the GSSO; contractors must make provisions for approved electronic encryption methods to communicate the required information. The Senior Intelligence Officer (SIO) is the final authority for approval of contractor personnel SCI access. The GSSO will provide the SCI access nomination request form to the contractor FSO/CSSOs. Company shall not submit nomination requests or SCI access requests for individuals not directly supporting this specific contract.

3. The FSO/CSSO is responsible to establish and maintain an SCI personnel access list of those employees working on the contract to include subcontractors (if applicable/authorized to subcontract). The FSO/CSSOs will provide a copy of the list at least quarterly and/or upon request to the GPM and GSSO.

4. The FSO/CSSO will advise the GPM and GSSO immediately upon reassignment, dismissal, termination or revocation of need-to-know for SCI cleared personnel on this contract. A formal notice to the GSSO is required for processing debrief action.

FSO/CSSO will notify the PM and SSO immediately when there is a change in status of SCI indoctrinated contractor personnel in accordance with (IAW) the security clearance adjudication guideline identified in ICD 704.

5. All contractor personnel performing SCI work under this contract are subject to additional security training IAW DoDM 5105.21, Volumes 1, 2, and 3. GSSO will provide this additional security training to contractor personnel quarterly, which will be recorded and tracked throughout the term of the contract or when SCI indoctrinated personnel are removed from the contract. Additional reporting instructions and information will be provided to the FSO/CSSO.

6. FSO/CSSP must coordinate approval prior to subcontracting any portion of SCI efforts involved in this contractor. The subcontractor DoD Form 254 must have coordination signatures from the GPM and GSSO prior to administering.

7. Release of Information: SCI will not be released to contractor employees without specific release approval of the Senior Intelligence Officer (SIO) or the government originator of the material when applicable. SCI with restrictive caveats (ORCON, PROPIN, etc.)

will be released to contractors *only* when originator approval has been obtained. This approval will be obtained through the GSSO based on approved justification and validation of need-to-know.

8. SCI documentation, or other material concerning this contract will not be discussed or released to any individual, subcontractor, agency (including Federal Government agencies and employees) and contractor employees not working on the contract without written approval from the GPM.

9. Any SCI-derived material generated under this contract will be reviewed by the GPM and GSSO for proper classification prior to the final publication and distribution. ALL non-SCI documents and publications developed by the contractor under this contract require mandatory review by the GSSO and GPM. Final Technical Reports must be sent to the GSSO via approved shipping/handling methods.

10. Any SCI data released to or generated by the contractor in support of this contract remains the property of the DoD Department, Agency, or Command that released it. The contractor will maintain a record of all SCI released to contractor custody under this contract and upon completion/cancellation of the contract, and must return all such material to the GSSO. This applies but is not limited to all data and materials, including working papers and notes. SCI data furnished to or generated by the contractor will require specific security handling and controls beyond those in the National Industrial Security Program Operating Manual

(NISPOM).

11. Access to SCI is limited to that at US Government locations or within a Government or Contractor approved SCI Facility (SCIF) identified through and approved Memorandum of Agreement (MOA) or Co-Utilization Agreement (CUA).

12. This contract requires additional security requirements established for Sensitive Compartmented Information in accordance with DoDM 5105.21, Volumes 1, 2, and 3; Intelligence Community Directives (ICD); ICD 503, ICD 704, ICD 705.

13. SCI will be stored, discussed, processed, and maintained *only* in a properly accredited SCI Facility (SCIF).

14. When a visited location does not use DISS to validate SCI accesses, the contractor will submit the written request for SCI visit recertification through the COR for approval of the visit. The certification request must arrive at GSSO at least three (3) business days prior to the visit.

Ref 10e(2) Non-SCI Information:

1. Access to Non-SCI information requires special briefings and a final U.S. Government clearance/eligibility at the appropriate level.

An approved subcontracting plan and Government Contracting Officer written approval is required prior to granting Non-SCI Intelligence information access to a subcontractor.

2. ALL non-SCI documents and publications developed by the contractor under this contract require mandatory review by the GSSO and GPM.

3. Release of Non-SCI Intelligence Information to DoD Contractors (note: release of Non-SCI Intelligence Information to US Contractors only applies to those contracts marked YES to block 10e2 of the DD Form 254)

1. Requirements for access to Non-SCI:

1. All intelligence material released to the contractor remains the property of the US Government and may be withdrawn at any time. Contractors must maintain accountability for all classified intelligence released to their custody.

2. The contractor must not reproduce intelligence material without the written permission of the originating agency through the Intelligence Support Office. If permission is granted, each copy shall be controlled n the same manner as the original.

3. The contractor must not destroy any intelligence material without advance approval from or as specified by the Contracting Officer s Representative (COR).

4. The contractor must restrict/limit access to only those individuals who possess the necessary security clearance and/or who

CLASSIFICATION (When filled in): UNCLASSIFIED are actually providing services under the contract with a valid need-to-know. Further dissemination to other contractors, subcontractors, other government agencies, private individuals or organizations is prohibited unless authorized in writing by the originating agency through the COR

5. The contractor must ensure each employee having access to intelligence material is fully aware of the special security requirements for this material and shall maintain records in a manner that will permit the contractor to furnish, on demand, the names of individuals who have had access to this material in their custody.

6. Intelligence material must not be released to foreign nationals or immigrant aliens whether they are consultants, US contractors, or employees of the contractor and regardless of the level of their security clearance/eligibility, except with the *advance written permission* from the originator. Requests for the release to foreign nation shall be initially forwarded to the COR and shall include:

1. A copy of the proposed disclosure

2. Full justification reflecting the benefits to US interests.

3. Name, nationality, particulars of clearance/eligibility, and current access authorizations of each proposed foreign national recipient

7. Upon completion or termination of the contract, or sooner, when the purpose of the release has been served, the contractor will return all classified intelligence (furnished or generated) to the source from which received unless retention or other disposition instructions are authorized in writing by the COR.

8. The contractor must designate an individual who is working on the contract as custodian. The designated custodian shall be responsible for receiving and accounting for all classified material received or generated under this contract. This does not mean that the custodian must personally sign for all classified material. The inner wrapper of all classified material dispatch should be marked for the attention of the designated custodian and must not be opened by anyone not working directly on the contract.

9. Within 30 days after the final product is received and accepted by the procuring agency, classified intelligence materials released to or generated by the contractor, must be returned to the originating agency through the COR. Requests to destroy or retain must be directed to the COR for this contract in writing and must clearly indicate the justification for destruction and/or retention and must include the identity of the specific documents for which destruction is being requested and include the proposed method of destruction; requests to retain must include the identity of the specific documents and indicate the justification.

10. Classification, regrading, or declassification markings of documentation produced by the contractor shall be consistent with those that apply to the information and/or documentation for which the new document was prepared. The User agency shall review and provide direction to include the assigned tentative security classifications by the COR. Furthermore, pending final determination, the material shall be safeguarded as required for its assigned or proposed classification, whichever is higher, until a classification is changed or otherwise verified.

4. Request for release of intelligence material to a contractor must be prepared by the COR and submitted to the Intelligence Support Office and should be accompanied as soon as possible after the contract has been awarded. The request will be prepared and accompanied with a letter explaining the requirement and copies of the DD Form 254 and/or Statement of Work (SOW) and/or Performance Work Statement (PWS)

Ref 10g: The performance of this contract will require access to North Atlantic Treaty Organization (NATO) information. Access to NATO information requires a final US Government clearance at the appropriate level. The Facility Security Officer (FSO) is required to receive their NATO briefing from a US Government Security Manager or his/her designee. The Facility Security Officer will then brief other contractor personnel in their CAGE Code who require access to NATO information. Access up to and including NATO SECRET material will be required for reference at US Government facilities only. Contractor is not authorized to receive, generate, or store classified NATO material at contractor facility. An approved subcontracting plan and Government Contracting Officer written approval is required prior to granting NATO access to a subcontractor.

Ref 10j: Controlled Unclassified Information (CUI) / Receive, Store, or Generate Controlled Unclassified Information (CUI): Contractor will be provided and will abide by DoD Regulation 5400.7, DoD Freedom of Information Act Program, and DoD 5200.01-M, Information Security Program. Guidance provided under separate cover. In accordance with DoD Instruction 5200.48 (DoDI 5200.48) dated March 6, 2020, Contractors are required to ensure all personnel receive and complete Initial and Annual Refresher CUI education and training and maintain documentation of this training for audit purposes. Initial and Annual Refresher CUI security education, training and awareness on the required topics identified in Section 2002:30 of Title 32 CFR, including protection and management of CUI, to DoD personnel and contractors through the Center for Development of Security Excellence (CDSE).

-- CUI Courses and Resources Created for Industry:

-- The Center for Development of Security Excellence (CDSE) has developed an eLearning course titled DoD Controlled

Unclassified Information (CUI) Training For Contractors (IF141.06.FY21.CTR). The course fulfills CUI training requirements for industry.

-- Additionally, CDSE has a CUI Toolkit available at https://www.cdse.edu/toolkits/cui/current.html. The Toolkit includes training, policy documents, resources, and an FAQ video.

-- Review the DoD CUI Registry at https://www.dodcui.mil to become familiar with CUI organizational index groupings and CUI categories. Policy documents addressing CUI oversight:

-- DoDI 5200.48 "Controlled Unclassified

Information."(https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/520048p.PDF) -- 32 CFR 2002 Part IV National Archives and Records Administration 32 CFR Part 2002 Controlled Unclassified Information

(https://www.govinfo.gov/content/pkg/CFR-2017-title32-vol6/pdf/CFR-2017-title32-vol6-part2002.pdf) -- E.O. 13556 Vol 75, No 216. Controlled Unclassified Information

(https://www.govinfo.gov/content/pkg/FR-2010-11-09/pdf/2010-28360.pdf) -- NIST Special Publication 800-171 Rev. 2 Protecting Controlled Unclassified Information in Nonfederal Systems and

Organizations (https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final

CLASSIFICATION (When filled in): UNCLASSIFIED

Question 11a Security Guidance

Ref 11f: Any classified information obtained, generated, or modified outside of the U.S. will be given the same level of protection as stated within this document.

Ref 11j: OPERATIONS SECURITY (OPSEC) REQUIREMENTS

1. The contractor shall comply with OPSEC requirements contained in the contract, addendum thereto, or identified herein. The contractor will comply with all security and OPSEC policies, directives, instructions or mandates as directed. OPSEC and other security guidance issued to the Prime Contractor shall also apply to subcontractors working on this effort.

2. The contractor will ensure compliance with the Agency s OPSEC Policy Statement, Critical Information List (CIL), and unclassified document destruction procedures. Items of critical information are those facts, which individually, or in the aggregate, reveal sensitive details about the mission, operation, etc., and thus require protection from adversarial collection or exploitation.

3. Include OPSEC as part of the security awareness program. The contractor shall be familiar with OPSEC and will be required to take government furnished initial and annual refresher OPSEC training and will be reminded of their continued responsibility to protect sensitive information as directed by DoDM 5205.02. Sensitive unclassified information includes, but is not limited to, agency identified critical information, legacy For Official Use Only (FOUO), Controlled Unclassified Information (CUI), Privacy Act of 1974, Personally Identifiable Information (PII), Department of Defense Unclassified Controlled Nuclear Information (DoD UCNI) and company proprietary information.

4. The contractor shall take the necessary precautions to ensure employees with access to the sensitive and critical information are instructed not to disclose or disseminate any information relating to the conduct and performance of the contract to any individual not authorized to perform on this contract. Assigned personnel shall be knowledgeable of the designated critical information and measures in place to protect it.

5. For programs protected by a Program Protection Plan (PPP) and have identified Critical Program Information (CPI) and/or Critical Technologies Information (CTI), must be identified and protected in accordance with DoD Instruction 5200.39, CPI Identification and Protection within RDT&E. The contractor shall ensure that any program with CPI or CTI has the corresponding supplements and associated plan, such as an OPSEC plan, approved and in effect in support of the PPP.

6. The contractor shall comply with OPSEC content review policies within the Agency. A content review is an evaluation of all information, to include all CUI, intended for release outside the control of the organization or release to the public. OPSEC focuses on identifying and protecting the organization s unclassified information that may individually or in the aggregate lead to the compromise of classified information and sensitive activities. The contractor will ensure that these reviews are conducted according to agency guidance in accordance with mandates from DoDD 5205.02E, DoD OPSEC Program, DoDM 5205.02-M, DoD OPSEC Program Manual, DoDI 5230.09, Clearance of DoD Information for Public Release, DoDI 5230.29, Security and Policy Review of DoD Information for Public Release, DoDI 5400.04, Provision of Information to Congress, DoDM 5400.07, DoD FOIA Program, and DoDI 8170.01, Online Information Management and Electronic Messaging.

7. Further OPSEC guidance may be obtained by the Prime contractor contacting the OPSEC PM by group e-mail:

dcsa.quantico.dcsa-hq.mbx.operations-security@mail.mil.

Ref 11l: Controlled Unclassified Information (CUI) / Receive, Store, or Generate Controlled Unclassified Information (CUI): Contractor will be provided and will abide by DoD Regulation 5400.7, DoD Freedom of Information Act Program, and DoD 5200.01-M, Information Security Program. Guidance provided under separate cover. In accordance with DoD Instruction 5200.48 (DoDI 5200.48) dated March 6, 2020, Contractors are required to ensure all personnel receive and complete Initial and Annual Refresher CUI education and training and maintain documentation of this training for audit purposes. Initial and Annual Refresher CUI security education, training and awareness on the required topics identified in Section 2002:30 of Title 32 CFR, including protection and management of CUI, to DoD personnel and contractors through the Center for Development of Security Excellence (CDSE).

-- CUI Courses and Resources Created for Industry:

-- The Center for Development of Security Excellence (CDSE) has developed an eLearning course titled DoD Controlled

Unclassified Information (CUI) Training For Contractors (IF141.06.FY21.CTR). The course fulfills CUI training requirements for industry.

-- Additionally, CDSE has a CUI Toolkit available at https://www.cdse.edu/toolkits/cui/current.html. The Toolkit includes training, policy documents, resources, and an FAQ video.

-- Review the DoD CUI Registry at https://www.dodcui.mil to become familiar with CUI organizational index groupings and CUI categories. Policy documents addressing CUI oversight:

-- DoDI 5200.48 "Controlled Unclassified Information."

(https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/520048p.PDF) -- 32 CFR 2002 Part IV National Archives and Records Administration 32 CFR Part 2002 Controlled Unclassified Information

(https://www.govinfo.gov/content/pkg/CFR-2017-title32-vol6/pdf/CFR-2017-title32-vol6-part2002.pdf)

-- E.O. 13556 Vol 75, No 216. Controlled Unclassified Information (https://www.govinfo.gov/content/pkg/FR-2010-11-09/pdf/2010-28360.pdf)

-- NIST Special Publication 800-171 Rev. 2 Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations (https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final

Ref 10K NIPR/SIPR/SCI and NSA networks at NIWC Atlantic

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form)

CLASSIFICATION (When filled in): UNCLASSIFIED

NAME & TITLE OF REVIEWING OFFICIAL SIGNATURE

Industrial Security Specialists Lana Ayres Digitally signed by: AYRES.LANA.CATH

Date: 2025.05.20 11:21:02

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

No Yes

RELEASE OF SENSITIVE COMPARTMENTED INFORMATION (SCI) INTELLIGENCE INFORMATION TO U.S. CONTRACTORS

ATTACHMENT TO DD FORM 254 FOR CONTRACT NO.: TBD

ORDER NO.: TBD

CONTRACT ESTIMATED COMPLETION DATE (ECD): TBD

SCI NETWORK ACCESS REQUIRED: NIPR, SIPR, SCI and NSA network/systems

The Cognizant Senior Intelligence Officer (SIO) has exclusive security responsibility for all Sensitive Compartmented Information (SCI) classified material released to or developed under the contract and held within the Contractor s SCI Facility (SCIF). Access to SCI Intelligence material requires adherence to the requirements set forth in the following: Department of Defense (DoD) Manual (DoDM) 5105.21, Volume 1, SCI Administrative Security Manual: Administration of Information and Information Systems Security; DoDM 5105.21, Volume 2, SCI Administrative Security Manual: Administration of Physical Security, Visitor Control, and Technical Security.

DoDM 5105.21, Volume 3, SCI Administrative Security Manual: Administration of Personnel Security, Industrial Security, and Special Activities; ICD 403, Foreign Disclosure and Release of Classified National Intelligence; ICD 703, Protection of Classified National Intelligence Including Sensitive Compartmented Information; ICD 703-02, Reporting Requirements for Individuals with Access to Sensitive Compartmented Information; ICD 703-03, Protection of Classified National Intelligence Including SCI Shared with Entities Outside the Intelligence Community; ICD 703-04, Foreign Ownership, Control, or Influence (FOCI); ICD701 Security Policy Directive for Unauthorized Disclosures of Classified Information; ICD710, Classification Management and Control Markings Systems; ICPG 710.1, Application of Dissemination Controls: Originator Control (ORCON); DoD 5220.22-M, Change 2, National Industrial Security Program Operating Manual (NISPOM); and DoD 5220.22-R, DoD Industrial Security Program. Contractor s will comply with all regulations/manuals/directives stated therein which provide the necessary security and classification guidance for personnel, information, physical, automated information security (AIS), and technical security measures and is a part of the SCI security specifications for the contract. Inquiries pertaining to SCI classification guidance or interpretations shall be directed to the Contracting Officer Representative (COR).

1. Requirements for access to SCI:

a. All SCI will be handled in accordance with special security requirements, which will be furnished by the Command Special Security Officer (SSO).

b. SCI will not be released to contractor employees without specific release approval of the originator of the material as outlined in governing directives: based on prior approval and certification of "need-to-know" by the designated COR.

c. The contractor must restrict access to only those individuals who possess the necessary security clearance and who are actually providing services under the contract with a valid need to know. Further dissemination to other contractors, subcontractors, other government agencies, private individuals or organizations is prohibited unless authorized in writing by the originating agency through the COR.

d. Names of contractor personnel requiring access to SCI will be submitted to the COR for approval. Upon receipt of written approval from the COR, the company security officer will submit request(s) for special background investigations, in accordance with the NISPOM, to the Defense Counterintelligence Security Service (DCSA).

e. SCI material must not be released to foreign nationals or immigrant aliens whether they are consultants, U.S. contractors, or employees of the contractor and regardless of the level of their security clearance, except with advance written permission from the originator. Requests for release to foreign nationals shall be initially forwarded to the COR and shall include:

i. A copy of the proposed disclosure.

ii. Full justification reflecting the benefits to U.S. interests.

iii. Name, nationality, particulars of clearance, and current access authorization of each proposed foreign national recipient.

f. Contractor personnel must maintain accountability for all intelligence materials released to their custody.

g. SCI material will not be reproduced without prior approval of the originator of the material. All SCI material shall bear a prohibition against reproduction while in the contractor s custody.

h. Inquiries pertaining to classification guidance on SCI will be directed through the Command SSO to the responsible COR as indicated on the DD Form 254.

i. SCI released to cleared DoD Contractors Contractors, all reproductions thereof, and all other information generated based on, or incorporating data from, in support of this contract, remains the property of the U.S. Government. Upon completion or cancellation of the contract, all SCI material furnished will be returned to the direct custody of the supporting SSO, or destroyed IAW instructions outlined by the COR.

j. SCI will be stored and maintained only in properly accredited facilities meeting the physical security requirements in ICD 705, SCI Facilities and ICS 705, Technical Specifications for Construction and Management of SCI Facilities

k. The contractor SSO will recognize the above noted estimated completion date (ECD) as the completion date for the contract. The SSO will initiate action to debrief contractor personnel with access to this contract unless extensions or modifications to the contract are received by the SSO office no later than 30 days after the established completion date.

l. The contractor is governed by ICD 704, Personnel Security Standards and Procedures Governing Eligibility for Access to Sensitive Compartmented Information (SCI) And Other Controlled Access Program Information and may be supplemented by additional SSO Navy guidance. Contractor personnel that are eligible for access to SCI or currently possess an SCI personnel security clearance with another non-DoD agency must have their SCI eligibility accepted and entered into JPAS by the DoD Consolidated Adjudications Facility (CAF) prior to having access to SCI information retained by Naval Information Warfare Center Atlantic, unescorted access to NIWC Atlantic spaces, and receipt of an NIWC Atlantic issued contractor badge. The Facility Security Officer (FSO) will identify, in writing, contractor personnel assigned to this contract by NAME, SSN, Date and Place of Birth, and provide this documentation to the COR identified. The

CLASSIFICATION (When filled in): UNCLASSIFIED

COR will identify the SCI caveats for the contract and forward a copy of this documentation to the SSO for processing. This documentation will be marked and protected under the Privacy Act of 1974.

m. Electronic processing of SCI must be accomplished on equipment accredited in accordance with DoDM 5105.21 Volumes 1- 3, ICD 503, Information Technology System Security Risk Management, Certification and Accreditation, and the DoDIIS Joint Security Implementation Guide (DJSIG), Appendix D.

n. SCI security management issues shall be directed to NIWC Atlantic SSO Tammi Farnsworth (843) 218-4196.

o. In accordance with Director of National Intelligence Memorandum 5 May 2017, Access to North Atlantic Treaty Organization (NATO) Information by Intelligence Community (IC) Personnel and Naval Intelligence Security Policy Directive 17-008 Revision, Mandate for North Atlantic Treaty Organization (NATO) Information by Intelligence Community (IC) Personnel, all DoN Contractors with SCI access and access to classified SCI network/systems or SIPRNet must be briefed into NATO Secret Information.

**NOTE**: ADDITIONAL SECURITY GUIDANCE SPECIFIC TO THE SCI CONTRACT WILL BE PROVIDED BY THE COR AND COMMAND SSO TO IDENTIFY SECURITY CLASSIFICATION GUIDES AND PROGRAM SPECIFIC SECURITY GUIDANCE THAT DEFINE TECHNICAL AND SAFEGUARDING REQUIREMENTS IDENTIFIED IN THE SOW/PWS/SOO.

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item

13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

No Yes

DCSA is relieved of security inspection responsibilities for the SCI portion of this contract. The NIWC Atlantic SSO has overall security cognizance for SCI information under this contract.

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

a. GCA NAME

b. ACTIVITY ADDRESS CODE (AAC) OF THE CONTRACTING OFFICE(See Instructions)

NIWC Atlantic

N65236

c. ADDRESS (Include ZIP Code) One Innovation Drive Hanahan, SC 29410

d. POC NAME

e. POC TELEPHONE (Include Area Code)

f. EMAIL ADDRESS (See Instructions)

Shannon Anderson

+1 (843) 218-3987 shannon.b.anderson3.civ@us.navy.mil

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

a. TYPED NAME OF CERTIFYING OFFICIAL (Last, First, Middle Initial) (See Instructions)

b. TITLE

c. ADDRESS (Include ZIP Code)

Stacy Quarterman

Supervisor

Naval Information Warfare Center (NIWC) Atlantic 1 Innovation Drive, Building 3451 Hanahan, SC 29410

d. AAC OF THE CONTRACTING OFFICE (See Instructions)

e. CAGE CODE OF THE PRIME CONTRACTOR (See Instructions)

f. TELEPHONE (Include Area Code)

g. EMAIL ADDRESS (See Instructions)

N65236

+1 (843) 218-2162 stacy.e.quarterman.civ@us.navy.mil

h. SIGNATURE

i. DATE SIGNED (See Instructions)

Digitally signed by:

QUARTERMAN.STACY.EUGE

NE.1062430504

Date: 2025.05.20 11:32:30

20250520

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND

SUBCONTRACTOR

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY

ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHER AS NECESSARY (If more room is needed, continue in Item 13 or on additional page if necessary.)