Attachment 0035 - DD Form 254.pdf

UNCLASSIFIED

DD 254, Item 13 Continuation Sheet

W56HZV-16-R-0024

CONTINUATION OF BLOCK 13

Item 10.j – FOR OFFICIAL USE ONLY (FOUO): FOUO information generated and/or provided under this contract shall be safeguarded and marked as specified in Additional Guidelines for Controlled Unclassified Information (CUI) (Attachment A).

Item 10.k (2) – SECURITY CLASSIFICATION GUIDANCE: Program Executive Office (PEO) Combat Support and Combat Service Support (CS&CSS) Armoring Systems Security Classification Guide (SCG), dated 31 August 2012.

Item 11.c – RECEIVE AND GENERATE CLASSIFIED INFORMATION: The contractor requires access to classified source data up to and including SECRET in support of the work effort. Any extracts or use of such data requires the contractor to apply derivative classifications and markings consistent with the source documents. Use of “Multiple Sources” on the “Derived From” line necessitates compliance with the NISPOM, paragraph 4-208a, and the use of a bibliography.

a. Employees of the contractor may not act as couriers for classified material. All classified material will be transmitted in accordance with (IAW) the NISPOM (Registered US Mail, cleared commercial carrier (Monday thru Thursday), same day delivery, SIPRNET, or secure fax. This applies only to and from TACOM LCMC and the contractor’s office.

b. All classified material (CONFIDENTIAL and SECRET) supplied to the contractor during the course of this contract will be turned into Project Manager Transportation Systems (PM TS) for destruction not later than one year after receipt.

Contractors willing to maintain the material for a longer period must receive permission from

PM TS.

c. Contractors are required to establish means to control classified information.

This will include maintaining receipts, i.e. Document Accountability (DA) 3964, of all classified material shipped or received that is associated with this contract number.

d. General Services Administration (GSA) approved security containers are required to store classified material. Contractors will ensure all personnel who perform maintenance on any security container storing classified information are cleared to the SECRET level.

e. Any contractor who wishes to hold meetings in which classified information will be discussed are required to do so either on federal installations or a cleared facility. They should contact TACOM G2 for approval of meeting locations.

f. In the event of a possible compromise of classified information under the control of the vendor, the vendor will immediately notify the Defense Security Service (DSS); and TACOM G2 LCMC (586-282-6262, MAIL: TACOM G2, ATTN: AMSTA-CSS, 6501 East 11 Mile Road, Warren, MI 48397).

g. All classified material received will be handled and stored IAW with the NISPOM. Any computer used by the contractor to process classified information must have written accreditation. The contractor shall obtain accreditation from the DSS Cognizant Security Office. The contractor must provide a copy of their accreditation certificate from DSS to the G2 TACOM prior to processing any classified information. All computers will be marked with the appropriate visual markings showing what level of classified information may be processed on the computer. All storage media will be marked to reflect the highest classification level of the system accreditation irrespective of what is saved on the storage device.

h. When processing classified information on a computer, the contractor will ensure he or she does so in a secure environment. Continuous supervision will be required to ensure inadvertent access to classified does not occur. All personnel with access to the computer must have a SECRET clearance and a need to know.

i. Cell phones, Palm Pilots, pagers, etc., will not be operated in areas approved for classified computer processing.

Item 11.j – OPERATIONS SECURITY (OPSEC) REQUIREMENTS: The contractor shall be responsible for the development of an OPSEC program, in accordance with DoDM 5205.02- M and AR 530-1 and in conjunction with TACOM LCMC and PEO CS&CSS’s OPSEC plan (currently in staffing), with specific features based on command or unit approved OPSEC requirements. Once approved, the Contractor shall adhere to PEO CS&CSS’s OPSEC plan as this is aligned specifically to PEO requirements. All U.S. contractors shall provide annual program specific OPSEC training for all program personnel. New program personnel shall receive OPSEC training within 30 calendar days of program assignment. Annually, contractors shall complete OPSEC training and submit a report, validating 100% completion to the Government Security Office by 30 September. These requirements shall flow down to all approved U.S. subcontractors with access to either or both CUI and classified material.

Item 13 – SECURITY GUIDANCE: Collateral classified information generated in support of this contract shall be classified in accordance with the source material used or the governing SCG. The applicable SCG is the PEO CS&CSS Armoring Systems SCG, dated 31 August 2012. In addition to the SCG, classified information will also be protected in accordance with DoD 5220.22-M and the DD Form 254. Unclassified information will be protected in accordance with the aforementioned SCG, the OPSEC Plan, and Attachment A - Additional Security Guidelines for Controlled Unclassified Information.

a. All classified material shall be transmitted in accordance with the DoD 5220.22- M (Registered US Mail, cleared commercial carrier (Monday thru Thursday), Same Day Delivery, or secure fax). Access to technical data by foreign interests is prohibited unless authorized by a valid export authorization. The following is made part of this DD Form 254:

1. Attachment A – Additional Security Guidelines for Controlled Unclassified Information (CUI) (Reference Continuation of Block 13 – Item 10(j) and Item 10(k).

2. Attachment B – Additional Security Guidelines for Operations Security (OPSEC) (Reference Continuation of Block 13 – Item 11(j).

b. Classified Information requirements, CUI, and OPSEC requirements will flow down to all approved U.S. Subcontractors (including Unclassified U.S. Subcontractors) as an integral part of their respective contracts.

c. UPON COMPLETION OF CONTRACT OR AT GOVERNMENT DIRECTION: All classified (CONFIDENTIAL and SECRET), or CUI material (documents, media, hardware, software, vehicles, etc.) supplied to the contractor, or generated or derived from the CUI material supplied to the contractor, during the course of this contract shall be destroyed in accordance with DoD 5220.22-M. If the contractor cannot destroy the information, the contractor shall return these items to PM TS for destruction no later than one year after completion of contract, or at an earlier date if directed by the Government.

Contractors wishing to maintain the material for a longer period must receive permission from the Contracting Officer.

d. Threat Awareness and Reporting Requirements: IAW NISPOM 1-301, the contractor shall report threat-related incidents, behavioral indicators, and other matters of counterintelligence (CI) interest specified in AR 381-12, Chapter 3, through the facility security officer to the government security officer, the nearest military CI office, the Federal Bureau of Investigation (FBI), and DSS.

e. Foreign Disclosure:

1. In no instance will Classified Military Information (CMI) be disclosed to transmit to other than authorized representatives of the foreign government or international organizations for which disclosure has been approved.

2. Disclosure of CMI is determined by Department of Army officials designated as disclosure authorities. CMI disclosures must be limited to that information authorized to be disclosed to accomplish the purpose of the visit.

3. Foreign Disclosure Officer for G2, TACOM LCMC is Dave Hazelip at 6501 E. 11 Mile Rd, Warren MI 48397, (586) 282-6262.

ATTACHMENT A

ADDITIONAL GUIDELINES FOR CONTROLLED UNCLASSIFIED

INFORMATION (CUI)

1. Controlled Unclassified Information (CUI): CUI is unclassified information requiring application of access, distribution controls, and protective measures which meets the standards for safeguarding and dissemination controls pursuant to statute, and government-wide policies under Executive Order (EO) 13556. The types of information considered CUI for the program are technical data and information marked Unclassified//For Official Use Only (U//FOUO) by the U.S. Government. Examples of technical data consist of research and engineering data, engineering drawings, associated lists, specifications, standards, process sheets, manuals, technical reports, catalog-item identifications, and computer software documentation. The Contractor shall adhere to the below guidelines for handling U//FOUO information accompanied by DoDM 5200.01-V4, “DoD Information Security Program: Controlled Unclassified Information (CUI)”, DODI 5230.24, “Distribution Statements on Technical Documents”, Army Regulation (AR) 25-55, “The Department of the Army Freedom of Information Act Program”, AR 25-2, “Information Assurance” and AR 25-1, “Army Information Technology”.

2. Definition of U//FOUO Information: Information that has not been given a security classification pursuant to the criteria of an EO, but which may be withheld from the public for one or more of the reasons cited in Freedom of Information Act (FOIA) Exemptions 2 through 9, shall be considered as being U//FOUO.

3. Identification of Markings: The U//FOUO marking is assigned to information at the time of its creation in a DoD User Agency. It is not authorized as a substitute for a security classification marking but is used on official government information that may be withheld from the public as listed above. An unclassified document containing U//FOUO information shall be marked “UNCLASSIFIED//FOR OFFICIAL USE ONLY” or “U//FOUO” in bold letters in accordance with (IAW) DoDM 5200.01-V4.

4. Dissemination and Transmission of U//FOUO Information: No person may have access to information designated as U//FOUO unless that person has been determined to have a valid need for such access in connection with the accomplishment of a lawful and authorized Government purpose. Until U//FOUO status is terminated, the U//FOUO information may be disseminated within DoD Components and between officials of DoD Components and DoD contractors to conduct official business for the Department of Defense, provided that dissemination is consistent with any further controls imposed by a distribution statement. Recipients shall be made aware of the status of such information, and transmission shall be by means that preclude unauthorized public disclosure. Transmittal documents shall call attention to the presence of U//FOUO attachments. Removal of the U//FOUO marking can only be accomplished by the originator or other competent authority IAW DoDM 5200.01-V4.

5. Transporting U//FOUO Information: Records containing U//FOUO information shall be transported in a manner that precludes disclosure of the contents. When not commingled with classified information, U//FOUO information may be sent via first-class mail or parcel post.

Bulky shipments, such as distributions of U//FOUO directives or testing materials, that otherwise qualify under postal regulations may be sent by fourth-class mail. When material marked U//FOUO is removed from storage, attach DA Label 87 (For Official Use Only Cover Sheet).

6. Electronically Transmitted Messages: The contractor shall not transmit any U//FOUO information electronically over the Internet unless it is encrypted by Federal Information Processing Standard (FIPS) 140-2 standard. All messages shall be transmitted IAW AR 25-1.

Documents containing U//FOUO shall not be posted on websites available to the public.

7. Telephone Usage: U//FOUO information may be discussed over the telephone lines with DoD Components and between officials of DoD Components and DoD contractors to conduct official business for the Department of Defense.

8. Storage of U//FOUO Information During Duty Hours: Records/data determined to be U//FOUO shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for access to this information.

9. Storage of U//FOUO Information During Nonduty Hours: At the close of business, U//FOUO records shall be stored so as to preclude unauthorized access. Filing such material with other unclassified records in unlocked files or desks, etc., is adequate when normal U.S.

Government or government-contractor internal building security is provided during non-duty hours. When such internal security control is not exercised, locked buildings or rooms normally provide adequate after-hours protection. If such protection is not considered adequate, U//FOUO material shall be stored in locked receptacles such as file cabinets, desks, or bookcases.

10. Termination: The originator or other competent authority, e.g., initial denial and appellate authorities, shall terminate U//FOUO markings or status when circumstances indicate that the information no longer requires protection from public disclosure.

11. Disposal: Documents containing U//FOUO shall be destroyed by shredding. When a mechanical automatic shredder is not available, non-record copies of U//FOUO materials may be destroyed by tearing each copy into pieces to preclude reconstructing, and placing them in regular trash containers. CD-ROM/DVD copies of U//FOUO documents will be destroyed by breaking the CD media into pieces or placing into a mechanical shredder that can accommodate destruction of CDs.

12. Unauthorized Disclosure: The contractor shall take appropriate action to ensure there is no unauthorized disclosures of U//FOUO information. If an unauthorized disclosure does occur, the respective DoD Component that originated the U//FOUO information shall be informed of its unauthorized disclosure.

ATTACHMENT B

OPERATIONS SECURITY (OPSEC)

1. If the contractor generates unclassified OPSEC sensitive information, this information will be protected at the same level as U//FOUO information. The contractor will not transmit any OPSEC sensitive information electronically over the Internet unless it is encrypted IAW FIPS 140-2 standard. Alternative dissemination methods include secure fax, US mail, and hand carrying OPSEC sensitive material. OPSEC sensitive information may be disseminated within the contractor’s internal computer network if it is protected with a firewall and individual access is controlled by using IDs and passwords. (Under no circumstances can classified information be transmitted over an unclassified network.)

2. Because of antiterrorism, force protection, OPSEC, and counterintelligence concerns, the contractor will not release any diagrams, maps, floor plans, schematics, or digital pictures of the installation to outside organizations or companies without the approval of the Contracting Officer Representative (COR) and G2, TACOM. All information proposed for public release in any form (video, pictures, article, brochure, web site, etc.) will undergo a PEO CS&CSS OPSEC Review using the most current and approved PEO CS&CSS STA Form 7114.

3. Examples of information that would be considered OPSEC sensitive: Equipment capabilities, limitations, and vulnerabilities; Detailed mission statements; Operation schedules;

Readiness and vulnerability assessments; Test locations and dates; Inventory charts and reports; Detailed budget data; Photographs of components; Detailed organizational charts (with phones and e-mail listings); Technical and scientific data; Unclassified technical data with military applications; Critical maintenance information; Information extracted from a DoD Intranet web site; Lessons learned that could reveal sensitive military operations, exercises, or vulnerabilities; Logistics support (munitions, weapons, movement); Specific real time support to current or on-going military operations; Delivery schedules; and Manufacturing methods.

4. OPSEC review requests should be sent via encrypted e-mail to the respective Program Security Manager. Contact information can be requested from the COR. If emails cannot be encrypted, please send OPSEC review requests to:

a. Program Security Manager, PM TS 6501 E. 11 Mile Rd

AMSTA-CSS / MS 105

Warren, MI 48397-5000