Attachment 0017 - DD254 - SL - W15QKN-21-R-0025.pdf

CLASSIFICATION (When filled in): Unclassified

PREVIOUS EDITION IS OBSOLETE. Page 1 of 12DD FORM 254, MAY 2019 PREVIOUS EDITION IS OBSOLETE. Page 1 of 12DD FORM 254, MAY 2019

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

20220531

The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

a. LEVEL OF FACILITY SECURITY CLEARANCE (FCL) REQUIRED

(See Instructions)

Secret

b. LEVEL OF SAFEGUARDING FOR CLASSIFIED INFORMATION/

MATERIAL REQUIRED AT CONTRACTOR FACILITY

Secret

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

a. PRIME CONTRACT NUMBER (See instructions.)

b. SUBCONTRACT NUMBER

c. SOLICITATION OR OTHER NUMBER

W15QKN-21-R-0025

DUE DATE (YYYYMMDD)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

DATE (YYYYMMDD)

20210505

b. REVISED (Supersedes all previous specifications.)

REVISION NO. DATE (YYYYMMDD)

c. FINAL (Complete Item 5 in all cases.) DATE (YYYYMMDD)

4. IS THIS A FOLLOW-ON CONTRACT? No Yes If yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254? No Yes If yes, complete the following:

In response to the contractor's request dated , retention of the classified material is authorized for the period of:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE

TBD

b. CAGE CODE

TBD

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

TBD

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor) Add Row Remove last Row Delete All Rows

a. NAME, ADDRESS, AND ZIP CODE

TBD

b. CAGE CODE

TBD

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

TBD

8. ACTUAL PERFORMANCE (Click button to add more locations.) Add Row Remove last Row Delete All Rows

a. LOCATION(S) (For actual performance, see instructions.)

TBD

b. CAGE CODE

(If applicable, see Instructions.)

TBD

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

TBD

a. LOCATION(S) (For actual performance, see instructions.) b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

PREVIOUS EDITION IS OBSOLETE. Page 2 of 12DD FORM 254, MAY 2019 PREVIOUS EDITION IS OBSOLETE. Page 2 of 12DD FORM 254, MAY 2019

a. LOCATION(S) (For actual performance, see instructions.) b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

a. LOCATION(S) (For actual performance, see instructions.) b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

a. LOCATION(S) (For actual performance, see instructions.) b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

a. LOCATION(S) (For actual performance, see instructions.) b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

a. LOCATION(S) (For actual performance, see instructions.) b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

a. LOCATION(S) (For actual performance, see instructions.) b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

a. LOCATION(S) (For actual performance, see instructions.) b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

a. LOCATION(S) (For actual performance, see instructions.) b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

a. LOCATION(S) (For actual performance, see instructions.) b. CAGE CODE (If applicable, see Instructions.)

PREVIOUS EDITION IS OBSOLETE. Page 3 of 12DD FORM 254, MAY 2019 PREVIOUS EDITION IS OBSOLETE. Page 3 of 12DD FORM 254, MAY 2019

a. LOCATION(S) (For actual performance, see instructions.) b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

a. LOCATION(S) (For actual performance, see instructions.) b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

a. LOCATION(S) (For actual performance, see instructions.) b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

a. LOCATION(S) (For actual performance, see instructions.) b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

a. LOCATION(S) (For actual performance, see instructions.) b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

a. LOCATION(S) (For actual performance, see instructions.) b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

a. LOCATION(S) (For actual performance, see instructions.) b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

a. LOCATION(S) (For actual performance, see instructions.) b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

a. LOCATION(S) (For actual performance, see instructions.) b. CAGE CODE (If applicable, see Instructions.)

PREVIOUS EDITION IS OBSOLETE. Page 4 of 12DD FORM 254, MAY 2019

a. LOCATION(S) (For actual performance, see instructions.) b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

9. GENERAL UNCLASSIFIED DESCRIPTION OF THIS PROCUREMENT

This acquisition is for fabricating, testing, and delivering Remote Weapon Station (RWS) & its variants.

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION f. SPECIAL ACCESS PROGRAM (SAP) INFORMATION

b. RESTRICTED DATA g. NORTH ATLANTIC TREATY ORGANIZATION

(NATO) INFORMATION

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION (CNWDI) (If CNWDI applies, RESTRICTED DATA must also be marked.) h. FOREIGN GOVERMENT INFORMATION

d. FORMERLY RESTRICTED DATA i. ALTERNATIVE COMPENSATORY CONTROL MEASURES

(ACCM) INFORMATION

e. NATIONAL INTELLIGENCE INFORMATION:

(1) Sensitive Compartmented Information (SCI)

(2) Non-SCI

j. CONTROLLED UNCLASSIFIED INFORMATION (CUI) (See instructions.)

k. OTHER (Specify) (See instructions.)

Contractor may require access to all applicable Security Classification Guides (SCG) for this effort.

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT

ANOTHER CONTRACTOR'S FACILITY OR A GOVERNMENT

ACTIVITY

(Applicable only if there is no access or storage required at contractor facility.

See instructions.)

b. RECEIVE AND STORE CLASSIFIED DOCUMENTS ONLY

c. RECEIVE, STORE, AND GENERATE CLASSIFIED

INFORMATION OR MATERIAL

d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. PERFORM SERVICES ONLY

f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE

THE U.S.,PUERTO RICO, U.S. POSSESSIONS AND TRUST

TERRITORIES

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE

TECHNICAL INFORMATION CENTER (DTIC) OR OTHER

SECONDARY DISTRIBUTION CENTER

h. REQUIRE A COMSEC ACCOUNT

i. HAVE A TEMPEST REQUIREMENT

j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

k. BE AUTHORIZED TO USE DEFENSE COURIER SERVICE

l. RECEIVE, STORE, OR GENERATE CONTROLLED UNCLASSIFIED

INFORMATION (CUI).

(DoD Components: refer to DoDM 5200.01, Volume 4 only for specific CUI protection requirements. Non-DoD Components: see instructions.)

m. OTHER (Specify) (See instructions.)

See security specification guidance in Item 13

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority.

Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

DIRECT THROUGH (Specify below)

COR to PEO Soldier Security Manager, 703-704-2902

Public Release Authority:

PEO Soldier Public Affairs Office and Security Office 5901 Putnam Road, Bldg 328, Ft Belvoir, VA 22060-5422

13. SECURITY GUIDANCE Add Signature Remove last Signature Delete All Signatures

PREVIOUS EDITION IS OBSOLETE. Page 5 of 12DD FORM 254, MAY 2019

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract;

and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

SECURITY CLASSIFICATION SPECIFICATION GUIDANCE FOR: SOLICITATION W15QKN-21-R-0025:

Item 10.j – CONTROLLED UNCLASSIFIED INFORMATION (CUI): CUI information generated and/or provided under this contract shall be safeguarded and marked as specified in Additional Guidelines for Controlled Unclassified Information.

Item 10.k (1) – OTHER: Contractor personnel may require access to applicable Security Classification Guides (SCG) for this effort as supplied to the Contractor upon request.

Item 11.c – RECEIVE, STORE, AND GENERATE CLASSIFIED INFORMATION OR MATERIAL: Contractor will receive classified documents for reference only; HOWEVER, if any classified information is generated in performance of this contract, it shall be derivatively classified and marked consistent with the source material. The contractor shall possess a valid facility security clearance, and adequate facilities and processes in place to ensure security of government property including test items and test reports.

The contractor may require access to classified source data up to and including SECRET in support of the work effort. Any extracts or use of such data requires the contractor to follow all processing and handling procedures consistent with the NISPOM, and applicable Security Classification Guides (SCG). Employees of the contractor may not act as couriers for classified material. All classified material transmitted to and from government facilities, and contractor facilities shall be transmitted IAW the NISPOM via Registered US Mail, cleared commercial carrier (Monday thru Thursday), same day delivery, SIPRNET, or secure fax. Classified information may never be transmitted over any unclassified networks, whether DOD or commercial.

1. Contractor must have a favorably adjudicated Facility Security Clearance (FCL) in order to support this contract.

2. Contractor personnel must have a favorably adjudicated SECRET security clearance (at minimum) through Department of Defense (DoD)/Defense Counterintelligence & Security Agency (DCSA) channels, IAW DoDM 5220.00. Contractor personnel must have a valid in scope SECRET security clearance, or higher, prior to the start of performance on this contract, and before gaining access to classified information in connection with this contract agreement.

3. Subcontractor personnel must have a favorably adjudicated, in scope, SECRET security clearance at minimum, through DoD/DCSA channels before gaining access to classified information in connection with this contract.

4. FCL requests for subcontractor facilities will be submitted by the Prime Contractor.

5. All classified material (CONFIDENTIAL and SECRET) supplied to the contractor during the course of this contract will be turned in to the applicable PEO Soldier Program Manager Office for destruction not later than one year after receipt. Contractors requesting to maintain the material for a longer period must receive permission from the Government Program Manager (PM) office through the COR.

6. Contractors are required to establish means to control classified information. This will include maintaining receipts and accountability logs for all classified material shipped, or received in association with this contract agreement.

7. General Services Administration (GSA) approved security containers are required to store classified material. Contractors will ensure all personnel who perform maintenance on any security container storing classified information are cleared to the SECRET level at minimum.

8. Meetings where classified information will be discussed is required to be held either on a federal/government installation, or cleared contract facility only.

9. In the event of a possible compromise or loss of classified information under the control of the contractor, the contractor will immediately notify their DCSA field Industrial Security Representative (ISR), Facility Security Officer (FSO), and the Program Executive Office (PEO) Soldier Security Manager at 703-704-2902, or via mailing address: Program Executive Office Soldier, 5901 Putman Road, Building 328, ATTN: Security Manager/SFAE-SDR, Ft Belvoir, VA 22060.

10. All classified material received will be handled and stored IAW with the NISPOM. Any computer used by the contractor to process classified information must have written accreditation. The contractor shall obtain accreditation from the DCSA Cognizant Security Office.

The contractor must provide a copy of their accreditation certificate from DCSA to the PEO Soldier Security Manager prior to processing

PREVIOUS EDITION IS OBSOLETE. Page 6 of 12DD FORM 254, MAY 2019 any classified information. All computers will be marked with the appropriate visual markings showing what level of classified information may be processed on the computer. All storage media will be marked to reflect the highest classification level of the system accreditation irrespective of the contents saved on the storage device.

11. Processing classified information on computer systems must occur in a secure environment under continuous supervision to ensure inadvertent access to classified information does not occur. All personnel with access to the classified computer processing system must have at minimum a SECRET clearance, and a need-to-know.

12. Cell phones, iPads, or any other electronic imaging or recording devices will not be operated in areas approved for classified system processing.

13. Contractor must establish procedures to ensure prompt management action and reporting in accordance with: DODM 5200.01, Volume 3, for an actual or potential compromise of classified information; DODM 5200.01, Volume 4, for an actual or potential unauthorized disclosure of CUI (for example, proprietary information, law enforcement information); DOD 5220.22–M, when such losses occur on cleared contractor systems; and DOD 5400.11–R for a loss or unauthorized dis-closure of PII or other Privacy Act information.

14. Contractor personnel may be subject to administrative and/or judicial sanctions if they knowingly, willingly, or negligently compromise, damage, or place information technology (IT) or information at risk by violating the user agreement. Individuals involved with the misuse of IT or prohibited activities may be subject to suspension of computer account access for a defined period of time and/or required to complete the appropriate remedial training.

Item 11.d. – FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE: The Contractor may be required to generate, utilize, and store hardware containing classified data. The Contractor must ensure classified hardware is afforded the level of protection against unauthorized disclosure commensurate with the level of classification or sensitivity assigned, under the varying conditions that may arise in connection with its use, dissemination, storage, movement, transmission, or destruction. Contractor personnel will ensure classified hardware is adequately protected from compromise and must be continually aware of possible threats from all-source intelligence efforts of potential adversaries.

Item 11.i – HAVE A TEMPEST REQUIREMENT: In accordance with the Federal Acquisition Regulation (FAR), if the Contractor receives or generates classified information through authorized electronic means in performance with this contract agreement, prior to receipt or generation of classified information, the Contractor shall request a TEMPEST countermeasures review (TCR).

a. The Government Contracting Activity (GCA) will request a TEMPEST countermeasures review (TCR) from the Department of Army (DA) Certified TEMPEST Technical Authority (CTTA), through the COR to the PEO Soldier Security Manager. Only a DA CTTA is authorized to conduct TCRs and specify TEMPEST countermeasures for the Federal Government. The Army CTTA will provide the TEMPEST countermeasures to the PEO Soldier Security Manager for submission to DCSA for Cognizant Security Agency (CSA) approval.

b. Upon receipt of the TCR report, and acceptance by the Government of the TEMPEST countermeasures, the GCA will provide the supporting CTTA with a report of the countermeasures implemented by the Contractor.

c. If the countermeasures recommended by the CTTA are not approved and implemented, DCSA must accept the risk of compromise in writing. The CTTA will provide a written risk assessment for DCSA signature.

d. The Prime Contractor may not impose TEMPEST countermeasures upon their subcontractors without and DCSA approval.

Item 11.j – OPERATIONS SECURITY (OPSEC) REQUIREMENTS: The contractor shall be responsible for the development of an OPSEC program, IAW Department of Defense Manual (DoDM) 5205.02-M, Army Regulation (AR) 530-1, and the PEO Soldier OPSEC plan. Contractor shall provide annual program specific OPSEC training for all contract personnel. New program personnel shall receive OPSEC training within 30 calendar days of contract assignment, and annually thereafter. The contractor shall submit training completion reports validating 100% completion through the COR to the PEO Soldier Security Manager by 30 September each contract year. These requirements shall flow down to all approved U.S. subcontractors with access to critical unclassified information (CUI) and/or classified material, or systems.

Item 11.l. – RECEIVE, STORE, OR GENERATE CONTROLLED UNCLASSIFIED (CUI): As part of the phased Department of Defense (DoD) CUI Program implementation process endorsed by the CUI Executive Agent (EA) pursuant to Information Security Oversight Office (ISOO) Memorandum dated August 21, 2019, the designation, handling, and decontrolling of CUI (including CUI identification, sharing, marking, safeguarding, storage, dissemination, destruction, and records management) will be conducted in accordance with this issuance and Sections 252.204-7008 and 252.204-7012 of the DFARS when applied by a contract to non-DoD systems. Contractor will follow guidance for receipt, storage, or generation of CUI under this contract as provided in Section 13 of this DD254, DoD Instruction

PREVIOUS EDITION IS OBSOLETE. Page 7 of 12DD FORM 254, MAY 2019

(DoDI) 5200.48, Controlled Unclassified Information (CUI), dated 6 March 2020, and the NISPOM.

Item 11.m – OTHER: Contractor will be provided copies of Security Classification Guides applicable to the efforts of this contract agreement upon request.

Item 13 – SECURITY GUIDANCE:

1. Collateral classified information generated or received in support of this contract shall be classified consistent with the NISPOM, and applicable SCGs. In addition to classification guidance provided in applicable SCGs, classified information will also be protected IAW DoD 5220.22-M, and this DD Form 254. Unclassified information will be protected IAW applicable SCGs, OPSEC Plans, and this DD Form 254.

a. All classified material shall be transported IAW the DoD 5220.22- M, via Registered U.S. Mail (Monday thru Thursday), cleared commercial carrier (Monday thru Thursday), Same Day Delivery, or secure fax. Access to technical data by foreign interests is prohibited unless authorized by a valid export authorization.

b. Classified Information requirements, CUI, and OPSEC requirements shall flow down to all approved U.S. Subcontractors as an integral part of their respective contracts, through the Prime Contractor.

c. UPON COMPLETION OF CONTRACT OR AT THE GOVERNMENT’S DIRECTION: All classified (CONFIDENTIAL and SECRET), or CUI material (documents, media, hardware, software, vehicles, etc.) generated or derived from the CUI material supplied to the Contractor during the course of this contract, shall be destroyed IAW DoD 5220.22-M. If the Contractor cannot destroy the information, the Contractor shall return these items to the government Program Manager office for destruction no later than one year after completion of contract, or at an earlier date if directed by the Government. Contractors requesting to maintain the material for a longer period must receive written permission from the Contracting Officer.

d. Threat Awareness and Reporting Requirements: IAW NISPOM 1-301, the Contractor shall report threat-related incidents, behavioral indicators, and other matters of counterintelligence (CI) interest specified in AR 381-12, Chapter 3, through the Facility Security Officer (FSO) to the PEO Soldier government Security Manager, the nearest military CI office, the Federal Bureau of Investigation (FBI), and

DCSA.

2. Antiterrorism/force protection policy for defense contractors outside the United States - 48 CFR § 252.225-7043.

(a) Except as provided in paragraph (c) of 48 CFR § 252.225-7043, the Contractor and its subcontractors, if performing or traveling outside the United States under this contract, shall:

(1) Affiliate with the Overseas Security Advisory Council, if the Contractor or subcontractor is a U.S. entity;

(2) Ensure that Contractor and subcontractor personnel who are U.S. nationals and are in-country on a non-transitory basis, register with the U.S. Embassy, and that Contractor and subcontractor personnel who are third country nationals comply with any security related requirements of the Embassy of their nationality;

(3) Provide, to Contractor and subcontractor personnel, antiterrorism/force protection awareness information commensurate with that which the Department of Defense (DoD) provides to its military and civilian personnel and their families, to the extent such information can be made available prior to travel outside the United States; and

(4) Obtain and comply with the most current antiterrorism/force protection guidance for Contractor and subcontractor personnel.

(b) The requirements of this clause do not apply to any subcontractor that is:

(1) A foreign government;

(2) A representative of a foreign government; or

(3) A foreign corporation wholly owned by a foreign government.

3. Foreign Disclosure and Contract Performance Overseas:

(a) In no instance will classified military information (CMI) be disclosed, or transmitted to other than authorized representatives of a foreign government or international organization for which disclosure has been approved through a government-to-government international agreement, validated by a U.S. Government licensing authority and Foreign Disclosure Officer (FDO) in writing. The disclosure must also be consistent with applicable U.S. laws and regulations.

PREVIOUS EDITION IS OBSOLETE. Page 8 of 12DD FORM 254, MAY 2019

(b) The contractor shall not release classified or CUI information or material to a third-country government, person, or firm without the prior written approval of the U.S. Government, Department of Army.

(c) The contractor shall afford the information and material a degree of protection equivalent to that afforded it by the releasing government.

(d) Disclosure of CMI is determined by Department of Army officials designated as disclosure authorities. CMI disclosures must be limited to that information authorized to be disclosed to accomplish the purpose of an approved visit. Requests for information from foreign nationals will be directed to the COR, for further review by the U.S. Army Government Foreign Disclosure authority.

(e) Foreign Disclosure Officer for PEO Soldier can be contacted through the COR.

4. Program Protection Plan:

a. The contractor shall develop, implement, and maintain the processes for management and implementation of program protection that is compliant with the security requirements imparted in the Other Transaction Agreement (OTA), this DD 254, the NISPOM, and applicable DoD regulations with coordination from the Government Program Manager office as appropriate.

b. Critical Program Information (CPI) and Critical Technology (CT): Should CPI be identified in connection with this contract, the contractor shall provide technical and programmatic support to the Government by participating in a critical program information assessment (CPIA) to identify CPI, and CT. Participation shall consist of attending the Government PM coordinated CPI review meetings, and responding to mutually agreed upon assigned actions. The Contractor will ensure contractor security office personnel receive training from DCSA on the CPI protection activities if required for this contract.

(1) Contractor shall ensure DCSA coordination for the execution of a DoD Component counterintelligence (CI) support plan (CISP) at the contractor’s cleared facility with CPI, IAW Department of Defense Instruction (DoDI) O-5240.24, Counterintelligence Activities Supporting Research, Development, and Acquisition (RDA), 8 June 2011, as amended.

(2) Contractor shall provide to the COR, and the PEO Soldier Security Manager, unclassified and classified all-source analysis to include, but not limited to, copies of annual analysis of suspicious contacts and activities occurring within the defense contractor community that could adversely affect the protection of CPI.

(3) Should CPI or CT be identified in this contract agreement, Contractor shall apply appropriate risk management strategies, employ the most effective protection measures, to include system assurance and an anti-tamper (AT) plan, and document the measures in a Program Protection Plan (PPP) to be implemented throughout the program. The Anti Tamper Plan shall be classified at a minimum SECRET classification level, IAW AR 70-77, Program Protection, and protected IAW DoDI 5200.01, Information Security Program, and applicable Security Classification Guides (SCG). The PPP shall consist of at minimum the following, and will also be classified at a minimum SECRET classification level, IAW DoDI 5200.39, Critical Program Information Protection Within the DoD, and protected IAW DoDI 5200.01, Information Security Program, and applicable SCGs:

(a) Technology and Project Description or System and Program Description.

(b) List of Program CPI to be protected.

(c) Threats to CPI to include foreign threat and a summary of the CI assessment.

(d) Vulnerabilities of CPI to identified threats.

(e) Countermeasures to include: security countermeasures; CISP; AT annex; OPSEC plan; system assurance; and other countermeasures as applicable.

(f) Classification guides.

(g) Protection Costs.

(h) Follow-on support.

c. Critical Functionality Analysis (CFA): Contractor will protect all submitted documents pertaining to the CFA including the Worksheet, and Supplier RFI Form at the appropriate level of classification IAW the NISPOM, DoD regulations, and applicable SCGs.

PREVIOUS EDITION IS OBSOLETE. Page 9 of 12DD FORM 254, MAY 2019

ADDITIONAL GUIDELINES FOR CONTROLLED UNCLASSIFIED INFORMATION (CUI):

1. Controlled Unclassified Information (CUI): CUI is unclassified information requiring application of access, distribution controls, and protective measures which meet the standards for safeguarding and dissemination controls pursuant to statute, and government-wide policies under Executive Order (EO) 13556. The types of information considered CUI for the program are technical data and some information formerly marked UNCLASSIFIED//For Official Use Only (FOUO), or FOUO by the U.S. Government. Examples of technical data consist of research and engineering data, engineering drawings, associated lists, specifications, standards, process sheets, manuals, technical reports, catalog-item identifications, and computer software documentation. The Contractor shall adhere to the below guidelines for handling CUI information accompanied by: DoDI 5200.48, CUI; DoDM 5200.01-V4, DoD Information Security Program: Controlled Unclassified Information (CUI); DODI 5230.24, Distribution Statements on Technical Documents; Army Regulation (AR) 25-55, The Department of the Army Freedom of Information Act Program; AR 25-2, Information Management: Army Cybersecurity, 4 April 2019;

and AR 25-1, Information Management: Army Information Technology, 15 July 2019.

2. The Contractor shall adhere to the following DoD CUI Policies:

a. Army CUI may be disseminated to Department of Army (DA) personnel to conduct official DoD and U.S. Government business in accordance with a law, regulation, or government-wide policy

(LRGWP).

b. The Contractor shall control all Government CUI until receipt of authorization for public release from the PEO Soldier Program Manager COR for this contract.

c. For CUI shared, generated, managed, or transmitted by the Contractor’s information systems, the Contractor shall:

(1) Implement access control measures that restrict both physical and logical access to the systems;

(2) Implement audit and accountability measures, such as periodic reviews and monitoring of system usage;

(3) Implement configuration management procedures to restrict system connection to only approved resources;

(4) Implement identification and authentication measures to control issuance of end-user certificated;

(5) Implement incident response measures to ensure corrective measures are implemented in a timely manner, and validate its effectiveness;

(6) Implement system and communication protection measures such as application of encryption for data at rest and restriction of connections to uncertified, unsecured, non-organizational systems; and

(7) Implement system and information integrity measures that provide network detection tools throughout the system to identify attempted intrusions.

d. Non-DoD information system (IS) processing, storing, or transmitting of CUI pertaining to this contract agreement shall be safeguarded IAW contractual requirements in DoDI 8582.01 and Section 252.204-7012 of the DFARS or their subsequent revisions.

3. Contractor shall monitor CUI for aggregation, and compilation based on the potential to generate classified information pursuant to security classification guidance addressing the accumulation of unclassified data or information. Contractor shall report the potential classification of aggregated or compiled CUI to the COR, and PEO Soldier Security Manager.

4. Identification Markings: The CUI marking is assigned to information at the time of its creation. It is not authorized as a substitute for a security classification marking, but is used on official government information that may be withheld from the public. The Contractor shall mark unclassified documents containing CUI with the acronym “CUI” in the banner and footer of the document.

a. If portion markings are used, all document subjects and titles, individual sections, parts, paragraphs, or similar portions of the document containing CUI, shall be portion marked with “(CUI).” Use of the unclassified marking “(U)” as a portion marking for unclassified information within CUI documents or materials is required.

b. Banners, footers, and portion marking shall only be marked “Unclassified” or “(U)” for unclassified information in accordance with the June 4, 2019 ISOO letter. If the document also contains CUI, it shall be marked in accordance with the paragraph 4.a.

PREVIOUS EDITION IS OBSOLETE. Page 10 of 12DD FORM 254, MAY 2019

c. CUI markings in classified documents shall appear in paragraphs or subparagraphs known to contain only CUI and shall be portion marked with “(CUI).” “CUI” shall not appear in the banner or footer.

d. An acknowledgement shall be added to the warning box on the first page of multi-page documents to alert readers to the presence of CUI in a classified document.

e. The first page or cover of any document or material containing CUI, including a document commingled with classified information, shall include a CUI designation indicator IAW DoDI 5200.48. Documents and materials containing CUI shall require a generic “CUI” marking at the top and bottom of each page.

(1) The Contractor shall refer to, and follow the official list of Indexes and Categories used to identify various types of DoD CUI found in the DoD CUI Registry, and the National CUI Registry.

(2) The official DoD CUI Registry of categories can be accessed on Intelink at https://intelshare.intelink.gov/sites/ousdi/hcis/sec/ icdirect/information/CUI/Forms/AllItems.aspx.

5. Dissemination and Transmission of CUI Information: The Contractor shall not be provided access to, nor shall be authorized to provide access to CUI to persons who have not been determined to have a valid need for such access in connection with the accomplishment of a lawful and authorized Government purpose, and/or in connection with this contract agreement.

a. Until CUI status is terminated, the CUI may be disseminated within DoD Components and between officials of DoD Components, and DoD contractors to conduct official business for the Department of Defense, provided that dissemination is consistent with any further controls imposed by applicable distribution statements.

b. Recipients shall be made aware of the status of such information, and transmission shall be by means that preclude unauthorized public disclosure.

c. Transmittal documents shall call attention to the presence of CUI attachments. Removal of the CUI marking can only be accomplished by the originator or other competent authority.

d. All emails containing CUI will be digitally encrypted in accordance with Army Regulation 25-1, Army Information Technology, dated 15 July 2019, bare the CUI marking, and applicable designation indicator IAW DoDI 5200.48.

e. Contractor shall submit unclassified government information for review, and approval for release through the COR to the PEO Soldier Public Affairs Officer, and PEO Soldier Security Manager.

6. Transporting CUI Information: Records containing CUI information shall be transported in a manner that precludes disclosure of the contents. When not commingled with classified information, CUI information may be sent via first-class mail or parcel post. Bulky shipments such as distributions of CUI directives, or testing materials that otherwise qualify under postal regulations may be sent by fourth-class mail. When material marked CUI is removed from storage, DA CUI Cover Sheet 901 must be attached with the designation indicator section completed.

7. Transmitting CUI: CUI information, and material may be transmitted via first class mail, parcel post, or, bulk shipments. When practical, CUI information may be transmitted electronically via websites, or email, via approved secure communications systems, or systems utilizing other protective measures such as Public Key Infrastructure, or transport layer security such as https. The Contractor shall avoid wireless telephone transmission of CUI when other options are available. CUI transmission via facsimile machine is permitted, however, the sender shall be responsible for determining whether appropriate protection is available at the receiving location before transmission (e.g., facsimile machine attended by a person authorized to receive CUI, and facsimile machine is located in a controlled government or defense Contractor facility/environment).

a. The contractor shall not transmit any CUI information electronically over the Internet unless it is encrypted by Federal Information Processing Standards (FIPS) 199 and 200. All messages shall be transmitted IAW AR 25-1. For DoD CUI, the minimum security level will be moderate confidentiality in accordance with Part 2002 of Title 32, CFR and NIST SP 800-171.

b. Documents containing CUI shall not be posted on websites available to the public.

c. Contractor shall not use unofficial or personal (e.g., .net or .com) email accounts, messaging systems, or other non-DoD information systems, except approved or authorized government contractor systems, to conduct official business involving CUI.

8. Telephone Usage: CUI information may be discussed over the telephone lines with DoD Components, and between officials of DoD

PREVIOUS EDITION IS OBSOLETE. Page 11 of 12DD FORM 254, MAY 2019

Components and DoD contractors to conduct official business for the Department of Defense.

9. To ensure CUI protection, the Contractor shall implement the following measures:

a. During working hours, steps shall be taken to minimize the risk of access by unauthorized personnel, such as not reading, discussing, or leaving CUI information unattended where unauthorized personnel are present.

b. After working hours, CUI information shall only be stored in unlocked containers, desks, or cabinets if the Contractor facility provides security for continuous monitoring of access. If building security is not provided, the information shall be stored in locked desks, file cabinets, bookcases, locked rooms, or similarly secured areas. The concept of a controlled environment means there is sufficient internal security measures in place to prevent or detect unauthorized access to CUI.

10. Termination: The Government originator or other competent authority, e.g., initial denial and appellate authorities, shall terminate CUI markings or status when circumstances indicate that the information no longer requires protection from public disclosure.

11. Disposal: Documents containing CUI, including in electronic/CD form, must be destroyed in a manner rendering it unreadable, indecipherable, and irrecoverable.

12. Unauthorized Disclosure: The Contractor shall take appropriate action to ensure there is no unauthorized disclosures of CUI information. If an unauthorized disclosure does occur, the respective DoD Component that originated the CUI information and the PEO Soldier Security Manager shall be informed of its unauthorized disclosure.

13. GOVERNMENT DISTRIBUTION STATEMENTS: Applicable distribution statements shall be added to all technical data generated during the execution of this contract, in accordance with DoD Directive 5230.24.

14. MANDATORY CUI TRAINING: IAW Department of Army (DA) Deputy Chief of State, G2 Memorandum dated 27 August 2020, Subject: Implementing Guidance for DoD Instruction (DoDI) 5200.48, CUI, all contractors providing support to the Army based on an Army contract shall take the mandatory DCSA CUI training within 30 calendar days of contract assignment, and annually thereafter. The contractor shall submit training completion reports validating 100% completion through the COR to the PEO Soldier Security Manager by 30 September each contract year. These requirements shall flow down to all approved U.S. subcontractors with access to CUI material, or systems. The DCSA CUI training may be found at DoD Mandatory Controlled Unclassified Information (CUI) Training (usalearning.gov).

ADDITIONAL GUIDELINES FOR OPERATIONS SECURITY (OPSEC):

1. If the Contractor generates unclassified OPSEC sensitive information, this information will be protected at the same level as CUI information. The contractor will not transmit any OPSEC sensitive information electronically over the Internet unless it is encrypted IAW FIPS 140-2 standard. Alternative dissemination methods include secure fax, U.S. mail, and hand carrying OPSEC sensitive material.

OPSEC sensitive information may be disseminated within the Contractor’s internal computer network if it is protected with a firewall and individual access is controlled by using IDs and passwords. Under no circumstances will classified information be transmitted over an unclassified network.

2. Because of antiterrorism (AT), force protection, OPSEC, and counterintelligence concerns, the Contractor will not release any diagrams, maps, floor plans, schematics, or digital pictures of an Army installation or facility to outside organizations or companies without the approval of the Contracting Officer’s Representative (COR), and PEO Soldier Security Manager. All information proposed for public release in any form (video, photos, articles, brochures, web sites, etc.) must undergo a PEO Soldier public release OPSEC review using the PEO Soldier AT/OPSEC coversheet.

3. Examples of information that would be considered OPSEC sensitive: Equipment capabilities, limitations, and vulnerabilities; detailed mission statements; operation schedules; Readiness and Vulnerability assessments; test locations and dates; inventory charts and reports;

detailed budget data; photographs of components; detailed organizational charts with phones numbers and e-mail addresses; technical and scientific data; unclassified technical data with military applications; critical maintenance information; information extracted from a DoD Intranet web site; lessons learned that could reveal sensitive military operations, exercises, or vulnerabilities; logistics support (munitions, weapons, movement); specific real time support to current or on-going military operations; delivery schedules; and manufacturing methods.

4. Public release OPSEC review requests should be sent via encrypted e-mail through the COR to the PEO Soldier Security Manager, and Public Affairs Officer. When email encryption is not available, public release OPSEC review requests are to be sent via DoD SAFE at https://safe.apps.mil/, or via US Postal mail sent to: Program Executive Office Soldier, 5901 Putnam Road, Building 328, Ft. Belvoir VA 22060, ATTN: PEO Soldier Security Manager.

PREVIOUS EDITION IS OBSOLETE. Page 12 of 12DD FORM 254, MAY 2019

List of Attachments (All Files Must be Attached Prior to Signing, i.e., for any digital signature on the form)

Add Attachment View Selected Attachment Remove Selected Attachment

NAME & TITLE OF REVIEWING OFFICIAL

Davi Pereira / COR

SIGNATURE

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

No Yes If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

No Yes If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item

13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

a. GCA NAME

Army Contracting Command NJ

b. ACTIVITY ADDRESS CODE (AAC) OF THE CONTRACTING OFFICE (See Instructions)

W15QKN

c. ADDRESS (Include ZIP Code) Army Contracting Command NJ Bldg 9 Phipps Rd Picatinny Arsenal, NJ 07806

d. POC NAME

Stephanie Kless

e. POC TELEPHONE (Include Area Code)

+1 (973) 724-6671

f. EMAIL ADDRESS (See Instructions) stephanie.g.kless.civ@mail.mil

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

a. TYPED NAME OF CERTIFYING OFFICIAL (Last, First, Middle Initial) (See Instructions)

Beasley, Michelle L.

b. TITLE

PEO Security Manager/Industrial Security Specialist

c. ADDRESS (Include ZIP Code) Program Executive Office Soldier 5901 Putnam Road, Bldg 328 Fort Belvoir, VA 22060-5422

d. AAC OF THE CONTRACTING OFFICE (See Instructions)

W15QKN

e. CAGE CODE OF THE PRIME CONTRACTOR

(See Instructions.)

TBD

f. TELEPHONE (Include Area Code)

+1 (703) 705-2902

g. EMAIL ADDRESS (See Instructions) michelle.l.beasley14.civ@mail.mil

h. SIGNATURE

i. DATE SIGNED (See Instructions)

20210505

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND

SUBCONTRACTOR

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY

ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHER AS NECESSARY (If more room is needed, continue in Item 13 or on additional page if necessary.)

**MUST PROVIDE COPY TO the Industrial Security Specialist Representative (ISR) assigned to awarded contractor by Defense Counterintelligence & Security Agency (DCSA).

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of

DD FORM 254, MAY 2019

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

20220531 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button…