DD_254_Continuation_Sheets_W56HZV-15-R-0187.pdf

DD 254, Item 13 Continuation Sheet

W56HZV-15-R-0187

CONTINUATION OF BLOCK 13

Item 10.a – COMMUNICATIONS SECURITY (COMSEC): Classified COMSEC material is not releasable to contractor employees who have not received a final clearance at the appropriate security level. COMSEC information or material will be accessed and processed in accordance with (IAW) Department of Defense (DoD) 5220.22-M (NISPOM), National Security Agency (NSA)/Central Security Service (CSS) Policy Manual 3-16, Army Regulation (AR) 380-40 (Policy for Safeguarding and Controlling Communications Security), and Additional Security Guidelines for COMSEC (Attachment B). When access is required at Government facilities, contractor personnel shall adhere to COMSEC rules and regulations as mandated by Command policy and procedures. Contractor personnel requiring COMSEC access must be U.S. Citizens and possess a final clearance at the appropriate level. All contractors shall be briefed before access to COMSEC is granted. The contractor may be subject to the Department of Army Cryptographic Access Program (DACAP) if contractor employees handle unencrypted Secret crypto or Top Secret crypto keying material.

Subcontracts requiring classified COMSEC information shall be awarded only upon the written approval of the Government Contracting Officer.

Item 10.j – FOR OFFICIAL USE ONLY (FOUO): FOUO information generated and/or provided under this contract shall be safeguarded and marked as specified in Additional Guidelines for Controlled Unclassified Information (CUI) (Attachment A).

Item 10.k (2) – SECURITY CLASSIFICATION GUIDANCE: Program Executive Office (PEO) Combat Support and Combat Service Support (CS&CSS) Army Watercraft Systems Interim Security Classification Guide (SCG), dated 23 February 2015.

Item 11.c – RECEIVE AND GENERATE CLASSIFIED INFORMATION: The contractor requires access to classified source data up to and including SECRET in support of the work effort. Any extracts or use of such data requires the contractor to apply derivative classifications and markings consistent with the source documents. Use of “Multiple Sources” on the “Derived From” line necessitates compliance with the NISPOM, paragraph 4-208a, and the use of a bibliography.

a. Employees of the contractor may not act as couriers for classified material. All classified material will be transmitted IAW the NISPOM (Registered US Mail, cleared commercial carrier (Monday thru Thursday), same day delivery, SIPRNET, or secure fax.

This applies only to and from TACOM LCMC and the contractor’s office.

b. All classified material (CONFIDENTIAL and SECRET) supplied to the contractor during the course of this contract will be turned into Project Manager (PM) Transportation Systems for destruction not later than one year after receipt. Contractors willing to maintain the material for a longer period must receive permission from PM Transportation Systems.

UNCLASSIFIED

c. Contractors are required to establish means to control classified information. This will include maintaining receipts, i.e. Document Accountability (DA) 3964, of all classified material shipped or received that is associated with this contract number.

d. General Services Administration (GSA) approved security containers are required to store classified material. Contractors will ensure all personnel who perform maintenance on any security container storing classified information are cleared to the SECRET level.

e. Any contractor who wishes to hold meetings in which classified information will be discussed are required to do so either on federal installations or a cleared facility. They should contact TACOM G2 for approval of meeting locations.

f. In the event of a possible compromise of classified information under the control of the vendor, the vendor will immediately notify the Defense Security Service (DSS); and TACOM G2 LCMC (586-282-5862, MAIL: TACOM G2, ATTN: AMSTA-CSS, 6501 East 11 Mile Road, Warren, MI 48397).

g. The contractor will establish a Restricted Area in accordance with the NISPOM to be utilized for classified COMSEC. COMSEC may be stored in a NSA approved storage facility when not being used in support of the integration effort. The contractor shall apply to the NSA for a traditional COMSEC account. The contractor is responsible for obtaining equipment necessary for secure voice communications.

h. All classified material received will be handled and stored IAW with the NISPOM.

Any computer used by the contractor to process classified information must have written accreditation. The contractor shall obtain accreditation from the DSS Cognizant Security Office. The contractor must provide a copy of their accreditation certificate from DSS to the G2 TACOM prior to processing any classified information. All computers will be marked with the appropriate visual markings showing what level of classified information may be processed on the computer. All storage media will be marked to reflect the highest classification level of the system accreditation irrespective of what is saved on the storage device.

i. When processing classified information on a computer, the contractor will ensure he or she does so in a secure environment. Continuous supervision will be required to ensure inadvertent access to classified does not occur. All personnel with access to the computer must have a SECRET clearance and a need to know.

j. Cell phones, Palm Pilots, pagers, etc., will not be operated in areas approved for classified computer processing.

Item 11.h – REQUIRE A COMSEC ACCOUNT: Contractor is authorized the use of secure telephones with fax, encryption equipment and keying material for classified program requirements.

Item 11.j – OPERATIONS SECURITY (OPSEC) REQUIREMENTS: The contractor shall be responsible for the development of an OPSEC program, in accordance with DoDM 5205.02- M and AR 530-1, with specific features based on command or unit approved OPSEC requirements. All U.S. contractors shall provide annual program specific OPSEC training for all program personnel. New program personnel shall receive OPSEC training within 30 calendar days of program assignment. Annually, contractors shall complete OPSEC training and submit a report, validating 100% completion to the Government Security Office by 30 September.

These requirements shall flow down to all approved U.S. subcontractors with access to either or both CUI and classified material.

Item 13 – SECURITY GUIDANCE: Collateral classified information generated in support of this contract shall be classified in accordance with the source material used or the governing SCG. The applicable SCG is the PEO CS&CSS Army Watercraft Systems Interim SCG, dated 23 February 2015. In addition to the SCG, classified information will also be protected in accordance with DoD 5220.22-M and the DD Form 254. Unclassified information will be protected in accordance with the aforementioned SCG, the OPSEC Plan, and Attachment A - Additional Security Guidelines for Controlled Unclassified Information.

a. All classified material shall be transmitted in accordance with the DoD 5220.22-M (Registered US Mail, cleared commercial carrier (Monday thru Thursday), Same Day Delivery, or secure fax). Access to technical data by foreign interests is prohibited unless authorized by a valid export authorization. The following is made part of this DD Form 254:

1. Attachment A – Additional Security Guidelines for Controlled Unclassified Information (CUI) (Reference Continuation of Block 13 – Item 10(j) and Item 10(k).

2. Attachment B – Additional Security Guidelines for Communications Security (Reference Continuation of Block 13 – Item 10(a) and Item 11(h).

3. Attachment C – Additional Security Guidelines for Operations Security (OPSEC) (Reference Continuation of Block 13 – Item 11(j).

b. Classified Information requirements, CUI, and OPSEC requirements will flow down to all approved U.S. Subcontractors (including Unclassified U.S. Subcontractors) as an integral part of their respective contracts.

c. UPON COMPLETION OF CONTRACT OR AT GOVERNMENT DIRECTION:

All classified (CONFIDENTIAL and SECRET), or CUI material (documents, media, hardware, software, vehicles, etc.) supplied to the contractor, or generated or derived from the CUI material supplied to the contractor, during the course of this contract shall be destroyed in accordance with DoD 5220.22-M. If the contractor cannot destroy the information, the contractor shall return these items to PM Transportation Systems for destruction no later than one year after completion of contract, or at an earlier date if directed by the Government.

Contractors wishing to maintain the material for a longer period must receive permission from the Contracting Officer.

d. Threat Awareness and Reporting Requirements: IAW NISPOM 1-301, the contractor shall report threat-related incidents, behavioral indicators, and other matters of counterintelligence (CI) interest specified in AR 381-12, Chapter 3, through the facility security officer to the government security officer, the nearest military CI office, the Federal Bureau of Investigation (FBI), and DSS.

e. Foreign Disclosure:

1. In no instance will Classified Military Information (CMI) be disclosed to transmit to other than authorized representatives of the foreign government or international organizations for which disclosure has been approved.

2. Disclosure of CMI is determined by Department of Army officials designated as disclosure authorities. CMI disclosures must be limited to that information authorized to be disclosed to accomplish the purpose of the visit.

3. Foreign Disclosure Office for G2, TACOM LCMC is Dave Hazelip at 6501 E. 11 Mile Rd, Warren MI 48397, (586) 282-6262.

ATTACHMENT A

ADDITIONAL GUIDELINES FOR CONTROLLED UNCLASSIFIED

INFORMATION (CUI)

1. Controlled Unclassified Information (CUI): CUI is unclassified information requiring application of access, distribution controls, and protective measures which meets the standards for safeguarding and dissemination controls pursuant to statute, and government-wide policies under Executive Order (EO) 13556. The types of information considered CUI for the program are technical data and information marked Unclassified//For Official Use Only (U//FOUO) by the U.S. Government. Examples of technical data include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, catalog-item identifications, and related information, and computer software documentation. The contractor shall adhere to the below guidelines for handling U//FOUO information accompanied by DoDM 5200.01-V4, Army Regulation (AR) 25-55, AR 25-2, and

AR 25-11.

2. Definition of U//FOUO Information: Information that has not been given a security classification pursuant to the criteria of an EO, but which may be withheld from the public for one or more of the reasons cited in Freedom of Information Act (FOIA) Exemptions 2 through 9, shall be considered as being U//FOUO.

3. Identification of Markings: The U//FOUO marking is assigned to information at the time of its creation in a DoD User Agency. It is not authorized as a substitute for a security classification marking but is used on official government information that may be withheld from the public as listed above. An unclassified document containing U//FOUO information shall be marked UNCLASSIFIED//FOR OFFICIAL USE ONLY or U//FOUO in bold letters at the bottom on the outside of the front cover (if any), on each page containing U//FOUO information, and on the outside of the back cover (if any).

4. Dissemination and Transmission of U//FOUO Information: No person may have access to information designated as U//FOUO unless that person has been determined to have a valid need for such access in connection with the accomplishment of a lawful and authorized Government purpose. Until U//FOUO status is terminated, the U//FOUO information may be disseminated within DoD Components and between officials of DoD Components and DoD contractors to conduct official business for the Department of Defense, provided that dissemination is consistent with any further controls imposed by a distribution statement. Recipients shall be made aware of the status of such information, and transmission shall be by means that preclude unauthorized public disclosure. Transmittal documents shall call attention to the presence of U//FOUO attachments. Removal of the U//FOUO marking can only be accomplished by the originator or other competent authority.

5. Transporting U//FOUO Information: Records containing U//FOUO information shall be transported in a manner that precludes disclosure of the contents. When not commingled with classified information, U//FOUO information may be sent via first-class mail or parcel post.

Bulky shipments, such as distributions of U//FOUO directives or testing materials, that otherwise qualify under postal regulations may be sent by fourth-class mail. When material marked

U//FOUO is removed from storage, attach DA Label 87 (For Official Use Only Cover Sheet).

6. Electronically Transmitted Messages: The contractor shall not transmit any U//FOUO information electronically over the Internet unless it is encrypted by Federal Information Processing Standard (FIPS) 140-2 standard. All messages will be transmitted in accordance with (IAW) Army Regulation (AR) 25-11. Documents containing U//FOUO shall not be posted on websites available to the public.

7. Telephone Usage: U//FOUO information may be discussed over the telephone lines with DoD Components and between officials of DoD Components and DoD contractors to conduct official business for the Department of Defense.

8. Storage of U//FOUO Information During Duty Hours: Records/data determined to be U//FOUO shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for access to this information.

9. Storage of U//FOUO Information During Nonduty Hours: At the close of business, U//FOUO records shall be stored so as to preclude unauthorized access. Filing such material with other unclassified records in unlocked files or desks, etc., is adequate when normal U.S.

Government or government-contractor internal building security is provided during non-duty hours. When such internal security control is not exercised, locked buildings or rooms normally provide adequate after-hours protection. If such protection is not considered adequate, U//FOUO material shall be stored in locked receptacles such as file cabinets, desks, or bookcases.

10. Termination: The originator or other competent authority, e.g., initial denial and appellate authorities, shall terminate U//FOUO markings or status when circumstances indicate that the information no longer requires protection from public disclosure.

11. Disposal: Documents containing U//FOUO shall be destroyed by shredding. When a mechanical automatic shredder is not available, non-record copies of U//FOUO materials may be destroyed by tearing each copy into pieces to preclude reconstructing, and placing them in regular trash containers. CD-ROM/DVD copies of U//FOUO documents will be destroyed by breaking the CD media into pieces or placing into a mechanical shredder that can accommodate destruction of CDs.

12. Unauthorized Disclosure: The contractor shall take appropriate action to ensure there is no unauthorized disclosures of U//FOUO information. If an unauthorized disclosure does occur, the respective DoD Component that originated the U//FOUO information shall be informed of its unauthorized disclosure. The unauthorized disclosure of U//FOUO information protected by the Privacy Act may result in criminal sanctions.

ATTACHMENT B

COMMUNICATIONS SECURITY (COMSEC)

1. Contractor Generated Communications Security (COMSEC) Material: Any material generated by the contractor (including, but not limited to: correspondence, drawings, models, mockups, photographs, schematics, status programs and special inspection reports, engineering notes, computations and training aids) shall be marked, handled, and safeguarded appropriately in accordance with AR 380-5, AR 380-40, DoD 5220.22-M, DoDM 5200.01, and the NSA/CSS Policy Manual 3-16.

2. Contractor employees or cleared commercial carriers shall not carry classified COMSEC material on commercial passenger aircraft anywhere in the world without the approval of the procuring contracting officer.

3. No contractor generated COMSEC or government furnished material may be provided to the Defense Technical Information Center (DTIC). Contractor generated technical reports will bear the statement "Not Releasable to the Defense Technical Information Center per DoD Directive 5100-38."

4. Unclassified COMSEC information released or generated under this contract shall be restricted in its dissemination to personnel involved in the contract. Release in open literature or exhibition of such information without the express written permission of the Director, NSA, is strictly prohibited.

5. Recipients of COMSEC information under this contract may not release information to subcontractors without permission of the government security manager.

6. Additional notices to be affixed to the cover and title or first page of contractor generated COMSEC documents:

a. "COMSEC MATERIAL - ACCESS BY CONTRACTOR PERSONNEL

RESTRICTED TO U.S. CITIZENS HOLDING FINAL GOVERNMENT CLEARANCE."

b. "THIS PUBLICATION OR INFORMATION IT CONTAINS MAY NOT BE

RELEASED TO FOREIGN NATIONALS WITHOUT PRIOR SPECIFIC APPROVAL FROM

THE DIRECTOR, NSA. ALL APPROVALS WILL IDENTIFY THE SPECIFIC

INFORMATION AND COPIES OF THIS PUBLICATION AUTHORIZED FOR RELEASE

TO SPECIFIC FOREIGN HOLDERS. ALL REQUESTS FOR ADDITIONAL ISSUANCES

MUST RECEIVE PRIOR SPECIFIC APPROVAL FROM THE DIRECTOR, NSA."

ATTACHMENT C

OPERATIONS SECURITY (OPSEC)

1. If the contractor generates unclassified OPSEC sensitive information, this information will be protected at the same level as U//FOUO information. The contractor will not transmit any OPSEC sensitive information electronically over the Internet unless it is encrypted IAW FIPS 140-2 standard. Alternative dissemination methods include secure fax, US mail, and hand carrying OPSEC sensitive material. OPSEC sensitive information may be disseminated within the contractor’s internal computer network if it is protected with a firewall and individual access is controlled by using IDs and passwords. (Under no circumstances can classified information be transmitted over an unclassified network.)

2. Because of antiterrorism, force protection, OPSEC, and counterintelligence concerns, the contractor will not release any diagrams, maps, floor plans, schematics, or digital pictures of the installation to outside organizations or companies without the approval of the Contracting Officer Representative (COR) and G2, TACOM. All information proposed for public release in any form (video, pictures, article, brochure, web site, etc.) will undergo a PEO CS&CSS OPSEC Review using the most current and approved PEO CS&CSS STA Form 7114.

3. Examples of information that would be considered OPSEC sensitive: Equipment capabilities, limitations, and vulnerabilities; Detailed mission statements; Operation schedules; Readiness and vulnerability assessments; Test locations and dates; Inventory charts and reports; Detailed budget data; Photographs of components; Detailed organizational charts (with phones and e-mail listings); Technical and scientific data; Unclassified technical data with military applications; Critical maintenance information; Information extracted from a DoD Intranet web site; Lessons learned that could reveal sensitive military operations, exercises, or vulnerabilities; Logistics support (munitions, weapons, movement); Specific real time support to current or on-going military operations; Delivery schedules; and Manufacturing methods.

4. OPSEC review requests should be sent to:

a. Program Security Manager, PM Transportation Systems 6501 E. 11 Mile Rd Warren, MI 48397 D/P 586-282-5862