attach0018.docx

DEPARTMENT OF DEFENSE

1. CLEARANCE AND SAFEGUARDING

SECRET

(The requirements of the DoD Industrial Security Manual apply to all security aspects of this effort.)

b. LEVEL OF SAFEGUARDING REQUIRED

SECRET

a. ORIGINAL (Complete date in all cases) Date (YYYYMMDD) 20150106

Date (YYYYMMDD)

W56HZV-15-R-0156

Due Date (YYYYMMDD)

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) code)

a. NAME, ADDRESS, AND ZIP CODE To be completed upon award.

b. CAGE CODE

c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE To be completed upon award.

b. CAGE CODE

c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

8. ACTUAL PERFORMANCE

a. LOCATION To be completed upon award.

b. CAGE CODE

c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

Engineering and Manufacturing Development (EMD) and Low Rate Initial Production (LRIP) of the Route Clearance & Interrogation System (RCIS) Type I program, which will enable a Soldier to excavate, interrogate, and classify deep buried explosive hazards, Improvised Explosive Devices (IEDs), and caches in a wide range of road surfaces and soil conditions, as well as clear routes by moving explosive hazards, debris and rubble, and filling potholes.

10. CONTRACTOR WILL REQUIRE ACCESS TO:

ACCESS TO:

FACILITY OR A GOVERNMENT ACTIVITY

e. INTELLIGENCE INFORMATION:

PUERTO RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

k. OTHER (Specify)

2) TARP See Block 13

DD FORM 254, DEC 1999 PREVIOUS EDITION IS OBSOLETE 805/340

Product Manager (PdM) Appliqué and Large Unmanned Ground Systems (ALUGS) 1414 W. Perimeter Rd.

Selfridge ANGB, MI 48045 to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review.

*In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13. SECURITY GUIDANCE. The security classification guidance needed for this classified effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance.)

Collateral classified information generated in support of this contract shall be classified in accordance with the source material used or the Security Classification Guide (SCG) for PM FP, dated 24 Jan 2012, and protected in accordance with the National Industrial Security Program Operating Manual (NISPOM) DoD 5220.22-M, the Program Protection Plan and this DD Form 254. Unclassified information shall be protected IAW the Security Classification Guide, the OPSEC Plan, and Attachment A.

All classified material shall be transmitted IAW the NISPOM (Registered US Mail, cleared commercial carrier (Monday thru Thursday), Same Day Delivery, or secure fax).

Access to technical data by foreign interests is prohibited unless authorized by a valid export authorization.

The following attachments are made part of this DD Form 254:

Attachment A – Guidelines for the Controlled Unclassified Information (Item 10.j, and 10.k.)

CUI and OPSEC requirements shall be flowed down to all U.S. subcontractors (including unclassified U.S. subcontractors) as an integral part of their respective contracts.

UPON COMPLETION OF CONTRACT OR AT GOVERNMENT DIRECTION: All classified material/information (CONFIDENTIAL and SECRET) supplied to the contractor during the course of this contract will be destroyed according to the NISPOM or return these items to the PM fp for destruction not later than one year after completion of contract. Contractors wishing to maintain the material for a longer period must receive permission from the Government Contracting Officer.

Yes

No

Contractor personnel assigned to this contract shall attend mandatory agency training and briefings as required. This training includes, but is not limited to the following: TARP, OPSEC, iWATCH, and Information Assurance.

Yes

No areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.)

a. TYPED NAME OF CERTIFYING OFFICIAL Ruth Marentette

b. TITLE Security Manager

c. TELEPHONE (Include Area Code) 586-239-2641

d. ADDRESS (Include Zip Code)

TACOM@SANG

1414 West Perimeter Road Harrison Twp., MI 48045

17. REQUIRED DISTRIBUTION

|_| a. CONTRACTOR |_| b. SUBCONTRACTOR |_| c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR |_| d. U.S ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION |_| e. ADMINISTRATIVE CONTRACTION OFFICER |_| f. OTHERS AS NECESSARY

e. SIGNATURE

DD FORM 254 (BACK), DEC 1999

CONTINUATION OF BLOCK13 OF THE DD FORM 254

Access to RCIS technical data, by foreign interests, is prohibited unless authorized by a valid export authorization. Release of any information, classified or Controlled Unclassified Information (CUI) to foreign nationals is prohibited.

Any computer used by the contractor to process classified information must have a written accreditation. For CONUS the contractor obtains an accreditation from the Cognizant Security Office (DSS). The contractor must provide a copy of their accreditation certificate from DSS to the PM FP Security prior to processing any classified information. All computers will be marked with the appropriate visual markings showing what level of classified information may be processed on the computer (e.g. Secret, Confidential, and unclassified). All storage media will be marked to reflect the highest classification level of the system accreditation irrespective of what is saved on the storage device (SECRET).

Item 10.a – COMMUNICATIONS SECURITY (COMSEC): Classified COMSEC material is not releasable to contractor employees who have not received a FINAL clearance at the appropriate security level. COMSEC information/material will be accessed and/or processed IAW DoD 5220.22-M, NSA/CSS Policy Manual 3-16, AR 380-40 (Policy for Safeguarding and Controlling Communications Security), and Additional Security Guidelines for COMSEC (Attachment B). When access is required at Government facilities, contractor personnel shall adhere to COMSEC rules and regulations as mandated by Command policy and procedures. Contractor personnel requiring COMSEC access must be U.S. Citizens and possess a final clearance at the appropriate level. All contractors shall be briefed before access to COMSEC is granted. The contractor may be subject to the Department of Army Cryptographic Access Program (DACAP) if contractor employees handle unencrypted SECRET crypto or TOP SECRET crypto keying material. Subcontracts requiring classified COMSEC information shall be awarded only upon the written approval of the Contracting Officer.

Item 10.e.(2) – INTELLIGENCE INFORMATION: NON-SCI: Non-SCI Information is not releasable to contractor employees who have not received a clearance at the appropriate security level. Written concurrence of the Contracting Officer is required prior to subcontracting. Access to Intelligence information required for performance. Non-SCI information/material will be accessed and/or processed IAW DoD 5220.22-M, and Additional Security Guidelines for Intelligence Information: Non-SCI (Attachment C).

Item 10.j – FOR OFFICIAL USE ONLY (FOUO): FOUO Information generated and/or provided under this contract shall be safeguarded and marked as specified in Additional Guidelines for Controlled Unclassified Information (CUI). FOUO is not a classification marking. It identifies unclassified DoD information that is exempt from public disclosure. FOUO is a category of Controlled Unclassified Information (CUI). (Attachment A).

Item 10.k – CONTROLLED UNCLASSIFIED INFORMATION (CUI) generated and/or provided under this contract shall be safeguarded and marked as specified in Additional Guidelines for Controlled Unclassified Information (CUI) (Attachment A).

Item 11.c – RECEIVE AND GENERATE CLASSIFIED INFORMATION: The contractor requires access to classified source data up to and including Secret in support of the work effort. Any extracts or use of such data requires the contractor to apply derivative classifications and markings consistent with the source documents. Use of “Multiple Sources” on the “Derived From” line necessitates compliance with the NISPOM, paragraph 4-208a, and the use of a bibliography.

Item 11.d – FABRICATE, MODIFY OR STORE CLASSIFIED HARDWARE: Contractor must provide adequate storage at their facility for collateral classified hardware.

Item 11.j – OPERATIONS SECURITY (OPSEC) REQUIREMENTS: All U.S. contractors with access to Controlled Unclassified Information (CUI) and/or classified material shall provide an OPSEC Plan to the Government Security Office within 90 days after contract award. This plan shall address local threat and protection countermeasures at facilities performing on this effort. All U.S. contractors shall provide annual Program specific OPSEC training for all Program personnel. New Program personnel shall receive OPSEC training within 30 days of Program assignment. Annually, contractors shall complete OPSEC training and submit a report, validating 100% completion to the Government Security Office by 30 September. These requirements, OPSEC Plan and training, shall be flowed down to all U.S. subcontractors with access to CUI and/or classified material.

Item 11.l.(1) – PROGRAM PROTECTION PLAN (PPP) – The PM FP Program Protection Plan (PPP) is effective immediately and is mandatory for use by all Program participants and field activities at all locations where CPI is researched, manufactured, stored, processed or tested.

Item 11.l.(2) – THREAT AWARENESS AND REPORTING REQUIREMENTS: ICW NISPOM 1-301, the contractor shall report threat-related incidents, behavioral indicators, and other matters of counterintelligence (CI) interest specified in AR 381-12, Chapter 3, through the facility security officer to the government security officer, the nearest military CI office, the Federal Bureau of Investigation, and the Defense Security Service. Annually, train personnel who handle classified information IAW AR 381-12, Chapter 2.

Item 12 – PUBLIC RELEASE: An electronic copy of the request with full text and graphics must be provided through the Contracting Officer at least forty-five (45) working days prior to the requested release date. If all or part of the information was generated by another organization, their written release authorization must accompany the request.

Prior to the subcontracting of COMSEC, NON-SCI, or NATO the contractor shall obtain approval on the subcontract DD Form 254 from the Government Program Security Office.

Notification of loss or compromise of collateral classified information shall be provided to the Government Program Security Office within 72 hours of the incident, in addition to the reporting requirements outlined in the NISPOM.

ATTACHMENT A

ADDITIONAL GUIDELINES FOR CONTROLLED UNCLASSIFIED INFORMATION

General: There are types of information that are not classified but that require application of access and distribution controls and protective measures for a variety of reasons. This information is known as “controlled unclassified information (CUI).” The types of information considered CUI for the program are information marked “For Official Use Only” by the U.S. Government and technical data. When handling CUI material, all personnel are to comply with these requirements and follow their company policy and/or applicable Proprietary Information Agreements (PIA) concerning the protection of proprietary information in situations not clearly stated herein.

Technical Data Description: Any recorded information related to experimental, developmental, or engineering works that can be used to define an engineering or manufacturing process, or can be used to design, procure, produce, support, maintain, operate, repair, or overhaul program material. The data may be graphic or pictorial delineations in media (e.g., computer software, drawings, or photographs), text in specifications, related performance or design documents, or computer printouts. Examples of technical data include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, catalog-item identifications, and related information, and computer software documentation.

For Official Use Only (FOUO) Information Description: “For Official Use Only (FOUO)” is a Government designation applied to unclassified information that may be exempt from mandatory release to the public under the Freedom of Information Act (FOIA). FOUO information includes information identified as such in the Security Classification Guide or information from a government document marked FOUO.

CUI Markings

Marking of FOUO documents will be in accordance with Army Regulation (AR) 25-55. Information extracted from an FOUO document will carry the FOUO marking until formally reviewed by the government. AR 25-55 can be found at http://www.apd.army.mil/pdffiles/r25_55.pdf.

Marking of Technical Data will include the statement provided in the Security Classification Guide. If the contents of the technical document require more than one Distribution Statement, apply the most restrictive statement. This does not preclude additional mandated markings as may be required by the contract.

Protection of CUI Information

Access: CUI may be released only to an individual who has a valid need for such access in connection with the accomplishment of a lawful and authorized Government purpose. Information in any media format may only be disseminated on a need-to-know basis. The need-to-know restricts the use or dissemination of CUI data to those individuals or organizations with direct affiliation with the given program or project. Further dissemination of such information will be at the discretion of the Government Security Manager. Personnel no longer requiring access to CUI must delete or surrender any in their possession and terminate future access to it.

Storing/Handling: During working hours, take reasonable steps to minimize risk of access to CUI by unauthorized personnel. After working hours, store CUI information in locked desks, file cabinets, bookcases, locked rooms, or similar means. Do not display CUI in public places (e.g., airports, airplanes, restaurants). Computers used to process CUI do not need to be accredited for classified use. Do not process CUI on public computers (e.g., those available for use by the general public in kiosks, hotel business centers) or computers that do not have access control. Personally owned computers are not authorized to process CUI. Mobile devices used to store CUI electronically (e.g., company-issued laptops, personal electronic devices [PED], removable media) must be physically protected and use NIST/NIAP-approved cryptographic products. These are available at http://iase.disa.mil/pki/eca or http://csrc.nist.gov/cryptval/.

Dissemination: CUI printed documents and material may be transmitted through mail channels or hand-carried without formal courier orders. FOUO information may be disseminated to DoD personnel and DoD contractors to conduct official business for the program. If dissemination is required outside of DoD personnel or DoD contractors, contact the Government Security Manager for approval. Technical data will follow the release instructions identified in the Distribution Statement. Use secure communications whenever possible; however, land-line telephones are more secure than cellular telephones and should be used whenever available for discussions involving CUI. Transmit voice and facsimile transmissions only when you have a reasonable assurance that only authorized recipients will have access to the transmission. Digital transmission shall comply with the below:

x All transmission and/or dissemination of CUI identified with a Distribution Statement or marked “FOUO” (i.e., email and file transfers) must use NIST/NIAP-approved cryptographic vendors and algorithms, e.g., DoD-approved Public Key Infrastructure Certification. These are available at http://iase.disa.mil/pki/eca or http://csrc.nist.gov/cryptval/. This encryption requirement includes passcodes to teleconferences or web conferences where there is a reasonable expectation that CUI may be discussed. When encryption is not available, a government collaborative suite (aka Integrated Digital Environment [IDE]) must be used to transmit CUI. Encrypt all wireless external data connections.

x Contractor-hosted collaborative suites may be used for digital transmission and/or dissemination of CUI by personnel not located on a government backbone (e.g., NIPRNET), provided the following conditions apply:

Use only NIST/NIAP-approved cryptographic vendors and algorithms. The latest validation lists may be obtained at http://iase.disa.mil/pki/eca or http://csrc.nist.gov/cryptval/.

Use an internally hosted service that does not use a third-party collaborative suite service provider.

x All computers containing CUI must be either protected by physical isolation from all personnel without a valid need for the information or protected using NIST/NIAP-approved cryptographic products. Discretionary access control measures must be used to preclude access to CUI by users who are not authorized access to CUI. After working hours, when not in physical possession of the owner, all electronic assets containing CUI must be afforded a reasonable degree of physical protection to prevent theft of program information (e.g., locking up laptops or cable locking them to a stationary base, storing in trunk, or storing out of sight).

x Do not post CUI to web pages that are publicly available or have access limited only by domain/IP restrictions. As permitted by other contract provisions, CUI may be posted to web pages that control access through the use of a DoD approved Public Key Infrastructure Certification and that provide protection via use of secure sockets, or other equivalent technologies. These are available at http://iase.disa.mil/pki/eca.

x As new technologies become available in the electronics arena, care should be given to providing a reasonable degree of protection from known vulnerabilities.

x The Internet is “Public Access”. CUI must be reviewed and officially approved by the PEO GCS Public Affairs Officer for public release before placing on the Internet. This is not applicable when the Internet is used for e-mail transmissions and encryption is used as noted above.

Disposal: Destroy CUI documents by any means approved for the destruction of classified information, i.e. cross- cut shredding or other means that would make it difficult to recognize or reconstruct the information. Clear, purge, or destroy CUI on removable media IAW BBP 03-PE-O-0003 Army Information Assurance Sanitization of Media to AR 25-2. This is available at https://informationassurance.us.army.mil.

Report of Loss of CUI: Report any loss of CUI or loss of CUI from a contractor information system that is known to the contractor within the period of performance of this contract to the Government Security Manager. Initial reports shall be made as expeditiously as possible in all cases within 72 hours of discovery. If additional information is required after submission and review of the initial report, guidance will be provided at that time. Mark any reports For Official Use Only, exemptions 2 and 5 apply. Initial report content shall include the following information as available.

Report of Cyber Intrusions: Report cyber intrusions or other compromises of CUI to your supporting counterintelligence office, which will inform the DoD-DIB Common Information Sharing Environment (DCISE). Notify the Government Security Manager of any incidents as well. Refer to Report of Loss of CUI for what needs to be reported, when, and how image1.wmf oleObject1.bin