Attachment_0001_-_DD254.pdf

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the DoD lndustrial Secuity Manual apply to all aspects of this effott)

. CLEARANCEANDSAFEGUARDING

a. FACILITY CLEAMNCE REQUIRED

SECRET

b. LEVEL OF SAFEGUARDING REQUIRED

SECRET

2. THIS SPECIFICATION lS FoR: fx and comptete as appt,cabte) 3. THIS SPECIFICATION lsi (X and complete as appticabte) n

a. PRIME CONTRACT NUMBER

THIS DD254 IS FOR SOLICITATION PURPOSES QNry. A

PRIME CONTRACT DD254 WILL BE PROVIDED UPON

CONTRACT AWARD. THIS DD254 DOES NOT AUTHORIZE

CLASSIFIED PERFORMANCE.

tr

a. ORIGINAL (Complete date in ail cases) Oate (YYYYMMDD) n

b. SUBCONTRACT NUMBER tr

b. REVISED (Sup€rsedes ail previous srys)

Revisaon No DAIE (YYYYMMDD)

X

c. SOLICITATIONOROTHERNUMBER I Dueoate(YYYYMMDD) wl5OKN-r8-R-0065 | 20171206 t-t

c. FINAL fcompleie ltem 5 in all cases)

DAIE (YYYYMMDD)

ffi ltr lyES I tr lNo. lfYescompletethefollowing

Classified material received or generated under _ (Preceding Contract Number) is transferred to this follow-on contract

S. |SJH|Srq FTNAL DrDr FORM 254? | tr | YES I tr I NO. lf Yes complete the following .,.t:.

ln response to the contractor's request dated retention ofthe identified classified material is authorized forthe Peflod o{

e. COtlfnACfOR qnctude Commercial and Govemment Entity ( CAGE) Code)

a. NAME, ADDRESS, ANDzIP coDE

TO BE DETERMINED

b. CAGEGODE

TBD

c. COGIT{B&}IJ SEGUAITX OF{19.F{irarre, Address, and ziP cocE)

TO Br DI*TERMINED

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE

N/A

b. CAGE CODE., T'VA ,r

c. COGNIZANT SECURITY OFFICES ( Name, Address, and zip Code)

N/A 1::

8. ACTUAL PERFORMANCE

a. LOCATION

TO BE DETERMINED

b, iiAGts GUUE

TBI)

c coGNlzANT SECURII Y Ol-FlgE (/Vame, Address, and 4p uode)

TO BE DETERMINED

ffiRocUREMENT The contractor shall provide all available resource&and facil& in support ofwarhead research, development, system integration' and production for AR-DEC.

THIS DD254IS NoT AUTHoRIZED FOR CLASS*IED PERFORMANCE. THIS DD254IS BEING SUBMITTED FOR SOLICITATION

PURPOSES ONLY.

10. THIS CONTRACT WILL REQUIRE ACCESS TO: YES NO 11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WLL: YES NO

a. COMMUNICATIONS SECURITY (CoMSEc)

INFORMATION

tr tr a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLYATANOTHER CONTRACTOR'S FACILIry OR A GOVERNMENT ACTIVITY

D X b RESTRICTED DATA b, RECEIVE CLASSIFIED DOCUMENTS ONLY c, CRITICAL NUOLEAfi WEAPL,N I.,EIiILiN INtsUKM I IUN c, RECEIVE AND GENERATE CLASSIFITD MAIEI<IAL d, FORMERLY RESTRICTED DATA: d, FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. INTELLIGENCE INFORMATION: e PERFORM SERVICES oNLY

( 1 ) Sensitive CorniattnPnted lnforiilation (SC l) tr X f, HAVE ACCESS TO U.S, CLASSIFIED INFORMATION OUTSIDE THE U.S,, PUERI O RICO t'S POSSESSIONSANDTRUSTTERRITORIES

U x

(2) Non-SCl tr EI g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL

INFOFIMATION CFNTER IDTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

U D(

f. SPECIAL ACCESS I&.ORf,IATION h, REOUIREACOMSEC AUUOUNI

g. NAI(.) INFqXMAI ION i, HAVE A TEMPEST REQUIREMENI

h. FOFTEIGN GOVETINMEN.I INFORMAI ION J, HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS i, LIMITED DISSEMINATION INFORMAI ION K. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE

J, FOR OFFICiAI USE ONLY INFORMATION x tr l. OTHER (Specin.

Classified work will not be performed on any computer systems. All classified information/material will be hand carried or mailed registered through the USPS only.

X U

k. OTHER Specif, CONTROLLED UNCLASSIFIED INFORMATION tr tr

DD Form 254,DEC 1999 Previous editions are obsolete

.mntractShallnotbereleasedforpublicdissminationexceptasprovidedbytheindustrial

Direct Through (Specifri

Public Release POC:

FOR PLANNING PURPOSES ONLY. NOT AUTHORIZED FOR CLASSIFIED PERFORMANCE.

to the Directorate for Freedom of lnformation and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for reviw 'ln the €se of non-DoD User Aoencies. requests for disclosure shall be submitted to that agency.

13.sEcURlTYGU1941166.16g5ganydiff]cultyisen@UnteredinapplyingthiSguidanceorifanyothercontibdingfactorind.catesa hereii. Add additional pages as needed to prcvide complete guidane.

THIS DD254IS BEING PROVIDED FOR PLANNING PURPOSES ONLY. A PRIME CONTRACT DD254 WILL

BE PROVDED UPON CONTRACT AWARD. DEFINITTVE SECURITY GUIDANCE AND REQUIRMENTS

WILL BE PROVIDED AFTER AWARD i. '] ':

lSMrequirements,areestabllshedforthiscor&act'(lfYe'identifythepertlnentlN4YesllllNo tothecognizantsecuityoffice. Usettem13if additional spaceisneeded.) (SEEATTACHMENT(S)ANDCONTINUATIONSIIEET(S) l-J l-J Only U.S. Citizens are authorized to work on this agreement. The contractor wiU only receive classified material at the actual perfornance location(s) as identified in the DD254. The contractor must comply with the DD Form 254 and any specialclauses in the contract. The contractor shall retum all classified/sensitive material, to include program material, to the Government at the completion of this contract. Information Disclosure: A Certificate of Non-Disclosure shall be signed and retumed to the COR/ACOR prior to contraet award. Copies will be maintained by the COR/ACOR for the life of the contract.

rit security offie. (lf Yes, explain and identify specific areas or elements caNed out and the activu responsible for inspections. lJse ltem 13 if additional space is needad- l-="* l*l-" ompleteandadequateforsafeguardingtheclassifiedinformationtobereleasedor oenerated under this classified effort. All questions shill be refen"d to the official named below.

a ryPED NAME OF CERTIFYING OFFICIAL

Megan Conrad

b. TTTLE

Industrial Security Specialist

c. TELEPHONE (lnclude Area Code)

973-724-7753

d. ADDRESS (lnclude ZIP Code)

US Army ARDEC RDAR-CIS, Bldg.93 Picatinny Arsenal, NJ 07806

17. RE QUIRED DISTRIBUTION

a. CONTRACTOR b SUBCONTRACTOR

I c. cocr.llzlrur secUR|TY oFFlcE FoR PRll\rE AND SUBooNTMCTOR

E E-.1 s1-.1 tre, SIGNATURE

THIS DD254 IS FOR SOLTCITATION PURPOSES ONLY. A PRIME CONTRACT DD254

WILL BE PROVIDED UPON CONTRACT AWARD. THIS DD254 DOES NOT

AI. THORIZE CLASSI FIED PERFORMANCE.

U.S, ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY AOI\4INISTRATION

AOMINISTRATIVE CONTRACTING OFFICER

OTHERS AS NECESSARY

o x x

DD Form 254 (BACK), DEC 1999

US Army ARDEC Attachment - Security Guidance DD254, Block 13 Continuation Sheet

CONTRACT NUMBER: W15QKN'18-R-0065

Ref 10j and Ref 10k: SEE DD254, BLOCK 13, CONTINUATION SHEET FOR FOUO/CUI GUIDANCE.

For Official Use Only Information (FOUO) and Controlled Unclassified lnformation (CUt): The Contractor shall be capable of accessing, handling, receiving, and storing UNCLASSIFIED documents, equipment, hardware, and test items, using the applicable standards of FOUO information. All Controlled Unclassified lnformation (documents designated as FOR OFFICIAL USE ONLY and/or LIMITED DISTRIBUTION) shall be submitted and electronically transmitted by a controlled means via USPS mail, AMRDEC SAFE website https://safe.amrdec.army.miI/SAFE/ and/or an approved application that is Certified for Networthiness such as the Encryption Wizard.

Ref 11c: Contractor will follow the guidelines of Chapters 4 and 5 of the NISPOM for the proper handling of classified information. Contractor will also follow guidance set forth within Security Classification Guide (SCG), the contractor requires access to classified source data up to and including (Secret) in support of the work effort. Any extracts or use of such data requires the contractor to apply derivative classifications and markings consistent with the source documents. Use of "Multiple Sources" on the "Derived From" line necessitates compliance with the NISPOM, paragraph 4-2O8a, and the use of a bibliography.

Ref lld: Contractor must provide adequate storage at their facility for classified material and/or hardware to the level of (SECRET).

OPSEC: When work is to be done at a Government location, the contractor will follow the appropriate OPSEC plan. User Agency will provide OPSEC guidance/requirements. When work will be done at the contractor's location they shall develop an OPSEC Standing Operating Procedure.

Ref 1lj: The contractor shall develop an OPSEC Standing Operating Procedure (SOP)/Plan within 90 calendar days of contract award, to be reviewed and approved by the responsible Government OPSEC

Officer, per AR 530-1, Operations Security. This SOP/Plan will specify the government's critical information, why it needsto be protected, where it is located, who is responsible for it, and howto protect it. ln addition, the contractor shall identify an individual who will be an OPSEC Coordinator. The contractor will ensure that this individual becomes OPSEC Level ll certified per AR 530-1.

Please email SOP/Plan to ARDEC OPSEC POC e-mail:

usarmy.pica.ardec.mbx.ardec-opsec@mail. mil for review and approval

US Army ARDEC Attachment - Controlled Unclassified lnformation (CUt)and For Official Use Only (FOUO)

DD254, Block 13, Section 10J and 10K Continuation Sheet

CONTRACT NUMBER: W15QKN-18-R-0065

CONTROLLED UNCLASSIFIED INFORMATTON (CUI)

1. The definition of cul is information that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Government-wide policies, excluding information that is classified pursuant to

Executive Order L3sz6 of Decembe r 29,2OO9, or the Atomic Energy Act, as amended (References (m) and (n)).

2. When CUI is to be provided to or generated by DoD contractors, the controls and protective measures to be applied shall be described in the pertinent contract documents (e.g., contract clause; statement of work; or DD Form

254,,,Department of Defense Contract Security Classification Specification"). Solicitations and contracts shall use a non-disclosure of information clause that prohibits release of unclassified information to the public without approval of the contracting activitY.

3. The Contractor shall not release to anyone outside the Contractor's organization any unclassified information, regardless of medium (e.g., film, tape, document), pertaining to any part of this contract or any program related to this contract without prior approval from the government.

4. Technical Data is any recorded information related to experimental, developmental, or engineering works that can be used to define an engineering or manufacturing process or to design, procure, produce, support, maintain, operate, repair, or overhaul program material. The data may be graphic or pictorial delineations in media, such as computer software, drawings, or photographs, text in specifications, or related performance or design documents, or computer printouts. Examples of technical data include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, catalog-item identifications, and related information, and computer software documentation.

5. GOVERNMENT DISTRIBUT|ON STATEMENTS: Will be added to all technical data generated during the execution of this contract, in accordance with DoD Directive5230.24.

6. The contractor shall protect CUI from unauthorized disclosure by appropriately marking, safeguarding, disseminating, and destroying such information.

7. CUI may be identified in security classification guides to ensure the information receives appropriate protection.

g. For unauthorized disclosures of CUl, no formal security inquiry or investigation is required. However, appropriate management action shall be taken to fix responsibility for unauthorized disclosure of CUI whenever feasible or required by other guidance, and appropriate disciplinary action shall be taken against those responsible. The DoD

Component that originated the CUI shall be informed of its unauthorized disclosure.

FOR OFFICIAL USE ONLY (FOUO)

1. The "FOR OFF|CIAL USE ONLy" marking is assigned to information at the time of its creation in a DoD User Agency.

It is not authorized as a substitute for a security classification marking but it is used on official government information that may be withheld from the public under exemptions 2 through 9 IAW Army Regulation 25-55, The

Department of the Army Freedom of lnformation Act Program.

2. Control, marking, and protection of FOUO information will be in accordance with this document and Army

Regulation 380-5, The Department of the Army lnformation Security Program, Chapter 5, para 5-1 through 5-5.

US Army ARDEC Attachment - Controlled Unclassified tnformation (CUl) and For Officia! Use Only (FOUOI

DD254, Block L3, Section 10J and 10K Continuation Sheet

CONTRACT N UMBER: W15QKN-18-R-0065

3. Specific Handling lnstructions: All emails containing (FOUO) will be digitally encrypted in accordance with AR 25-1, para. 6-4 (M-7b.) dated 4 Dec 08.

3. FOR OFF|CIAL USE ONLY is restricted to personnel with a valid need to know unless public release authorization has been obtained. lnformation, in any media format may only be disseminated of FOUO data to those individuals or organizations with direct affiliation with the given program or project. Further dissemination of such information will be at the discretion of the Government Security Manager. Personnel no longer requiring access to FoUO must delete or surrender any in their possession and terminate future access to it. The contractor may disseminate "FOR oFFlclAL usE oNLr (Fouo) information to their employees who have a need to know for the information in connection with this contract.

4. All FOUO material will be destroyed by tearing or shredding to make unreadable. Electronic media will be purged with approved software or destroyed through a physical process'

5. Use of the above marking does not mean that the information cannot be released to the public, only that it must be reviewed by the Government prior to its release to determine whether a significant and legitimate government purpose is served by withholding the information or portions of it.

6. An unclassified document containing FOUO information will be marked "FOR OFFICIAL USE ONLY" at the bottom of the front cover (if any), on the first page, on each page, on the back, and on the outside of the back cover (if any).

No portion marking will be shown.

7. Within a classified document, an individual page that contains both FOUO and classified information will be marked at the top and bottom with the highest security classification of the information appearing on the page. lf an individual portion contains FOUO information but no classified information, the page will be marked FOUO'

g. Removal of the "For Official Use Only" marking can only be accomplished by the originator or other competent authority. When the "For Official Use Only" status is terminated, all know holders will be notified to the extent practical.

9. During working hours, "For Official Use Only" information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for the information. During non-working hours, the information shall be stored to preclude unauthorized access. Filing such material with other classified records in unlocked files or desks is adequate when internal building security is provided during non-working hours. When such internal security is not exercised, locked buildings or rooms will provide adequate after-hours protection or the material can be stored in locked receptacles such as file cabinets, desks, or bookcases. "For Official Use Only'' information may be sent via First Class US Mail or by parcel post. Bulky shipments may be set by Fourth Class US

Mail.

10. Unauthorized disclosure of "Fot Official Use Only" information does not constitute a security violation but the

Government Customer should be informed of any unauthorized disclosure. The unauthorized disclosure for FOUO information protected by the Privacy Act may result in criminal sanctions.

US Army ARDEC Attachment - Contractors with Training Requirement DD254, Block 13, Continuation Sheet

CONTRACT NUM BER: W15QKN-18-R-0065

SECURITY REQUIREMENTS FOR CONTRACTOR EMPTOYEES:

The contractor will follow all Security Requirements and guidance provided within the DD254.

Contractor personnel under this DD254 will comply with all the training requirements as US

Government Employees.

The contractor will require access to classified information and/or material only at the specified location(s)within the DD254 and SOW.

The contractor(s) will comply with all of the security requirements in DOD 5220.22-M, National lndustrial Security Program Operating Manual ( NISPOM).

The COR is responsible for forwarding a copy of the completed and signed DD Form254 to the CSO for the prime contractor and appropriate offices listed in the distribution section (block 17 of the DD Form 254).

Contracts that Require Handling or Access to Classified !nformation: The contractor shall comply with FAR

52.204-2, Security Requirements. This clause involves access to information classified "Confidential" "Secret" or "Top Secret" and requires contractors to comply with (1) the Security Agreement (DD Form

441), including the National lndustrial Security Program Operating Manual (DoD 522O.22-M), and (2) any revisions to DoD 5220.22-M, notice of which has been furnished to the contractor.

lnformation Management Armv lnformation Technologv /lA: The Contractor shall be capable of accessing, handling, receiving, and storing UNCLASSIFIED documents, equipment, hardware, and test items, using the applicable standards of FOUO information. All Controlled Unclassified lnformation (documents designated as FOR OFFICIAL USE ONLY and/or LIMITED DISTRIBUTION) shall be submitted by a controlled means using

USPS mail, Safe Access File Exchange (SAFE) website and/or DoD Army approved encryption software as per

AR 25-1.

For Official Use Onlv lnformation (FOUO) and Controlled Unclassified lnformation (CUll: Contract personnel shall be capable of accessing, handling, receiving, and storing UNCLASSIFIED documents, equipment, hardware, and test items, using the applicable standards of FOUO and CUl. DFARS Clause

252.204-7O12 (Safeguarding Covered Defense lnformation and Cyber lncident Reporting) applies to this effort.

Export Contro! Laws/lnternational Traffic in Arms Regulation: lnformation Subject to Export Control Laws/lnternationalTraffic in Arms Regulation (ITAR): Public Law 90-629, "Arms Export Control Act," as amended (22 U.S.C 275L et. Seq.) requires that all unclassified technical data with military application may not be exported lawfully without an approval, authorization, or license under EO t2470 or the Arms Export Control Act and that such data required an approval, authorization, or license for export under EO L247O or Arms Export Control Act. For purposes of making this determination, the Militarily Critical Technologies List (MCTL) shall be used as general guidance. All documents determined to contain export controlled technical data will be marked with the following notice: WARNING: - This document contains technical data whose export is restricted by the Arms Export Contro! Act (Title 22,U.5.C., App. 2401 et seq. Violations of these

1.

2.

3.

4.

5.

US Army ARDEC Attachment - Contractors with Training Requirement DD254, Block 13, Continuation Sheet

CONTRACT NUM BER: W15QKN-18-R-0065

export laws are subject to severe criminal penalties. Disseminate in accordance with provisions of DoD Directive 5230.25.

Threat Awareness Reporting Program (For all contractors with securiW clearancesl: Per AR 38L-12 Threat Awareness and Reporting Program (TARP), contractor employees must receive annual TARP training by a Cl agent or other trainer as specified in 2-4b. This training shall be completed within 12 months after contract start date or effective date of incorporation of this requirement into the contract, whichever applies, and then annually thereafter. The contractor shall submit documentation of completion for each affected contractor employee and subcontractor employee to the COR (or to the contracting officer, if a COR is not assigned) within 14 calendar days after completion of training by all employees and subcontractor personnel." Training can be executed by a local Cl agent, online via the Army Learning Management System at https://www.lms.army.mil (and search for TARP), or by contacting the 902nd military intelligence unit at usarmy.picatinny.902-migrp. list.308th-picatinny-fo@mail.mil

Development of an OPSEC Standing Operatine Procedure/Plan: The contractor shall develop an OPSEC

Standing Operating Procedure (SOP)/Plan within 90 calendar days of contract award, to be reviewed and approved by the responsible Government OPSEC officer, per AR 530-1, Operations Security. This SOP/Plan will specify the project's critical information, why it needs to be protected, where it is located, who is responsible for it, and how to protect it. ln addition, the contractor shall identify an individual who will be an OPSEC Coordinator. The contractor will ensure that this individual becomes OPSEC Level ll certified per AR 530-1. ARDEC OPSEC POC e-mail: usarmy.pica.ardec.mbx.ardec-opsec@mail.mil .

OPSEC Trainine: Per AR 530-1 (or DoDM 5205.02-M), new contractor employees, including subcontractor employees, must complete initial OPSEC training within 30 calendar days of reporting for duty and must also complete annual OPSEC awareness training as provided by the appropriately designated OPSEC level il trained OPSEC Officer/Coordinator. The Contracting Officer Representative (COR) or Agreements Officer Representative (AOR) can request ARDEC OPSEC training from ARDEC OPSEC POC e-mail:

usarmy.pica.ardec.mbx.ardec-opsec@mail.mil."

Public Release of lnformation: Per AR 530-1, Operations Security, an OPSEC review is required prior to all public releases. All government information intended for public release by a contractor will undergo a government OPSEC review prior to release.