Attachment_0001_-_DD254_Revision_2.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

Solicitation/Contract Number:W56HZV-18-R-0174

Revised: October 2, 2018 Page A1 of 2

ATTACHMENT A

ADDITIONAL GUIDELINES FOR CONTROLLED UNCLASSIFIED INFORMATION

General: There are types of information that are not classified but that require application of access and distribution controls and protective measures for a variety of reasons. This information is known as “controlled unclassified information (CUI).” The types of information considered CUI for the program are information marked “For Official Use Only” by the U.S. Government and technical information. When handling CUI material, all personnel are to comply with these requirements and follow their company policy and/or applicable Proprietary Information Agreements (PIA) concerning the protection of proprietary information in situations not clearly stated herein.

Technical Information Description: Any recorded information related to experimental, developmental, or engineering works that can be used to define an engineering or manufacturing process, or can be used to design, procure, produce, support, maintain, operate, repair, or overhaul program material. The data may be graphic or pictorial delineations in media (e.g., computer software, drawings, or photographs), text in specifications, related performance or design documents, or computer printouts. Examples of technical information include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, catalog-item identifications, and related information, and computer software documentation.

For Official Use Only (FOUO) Information Description: “For Official Use Only (FOUO)” is a Government designation applied to unclassified information that may be exempt from mandatory release to the public under the Freedom of Information Act (FOIA). FOUO information includes information identified as such in the Security Classification Guide or information from a government document marked FOUO.

CUI Markings

Marking of FOUO documents will be in accordance with Army Regulation (AR) 25-55. Information extracted from an FOUO document will carry the FOUO marking until formally reviewed by the government.

http://www.apd.army.mil/ProductMaps/PubForm/AR.aspx.

Marking of Technical Information will include the statement provided in the Security Classification Guide. If the contents of the technical document require more than one Distribution Statement, apply the most restrictive statement. This does not preclude additional mandated markings as may be required by the contract.

Protection of CUI Information Access: CUI may be released only to an individual who has a valid need for such access in connection with the accomplishment of a lawful and authorized Government purpose. Information in any media format may only be disseminated on a need-to-know basis. The need-to-know restricts the use or dissemination of CUI data to those individuals or organizations with direct affiliation with the given program or project. Further dissemination of such information will be at the discretion of the Government Security Manager. Personnel no longer requiring access to CUI must dispose (see “Disposal” below) or surrender any in their possession and terminate future access to it.

Storing/Handling: During working hours, take reasonable steps to minimize risk of access to CUI by unauthorized personnel. After working hours, when not in physical possession of the owner, all CUI (whether hardcopy or optical media (e.g., DVDs, CDs) that contain CUI) must be afforded a reasonable degree of physical protection to prevent theft of program information (e.g., store CUI information in locked desks or file cabinets, locked rooms, cable lock laptops, storing in a trunk, storing out of site or similar means). Do not display CUI in public places (e.g., airports, airplanes, restaurants). Electronic storing and processing of CUI shall be in accordance with DFARS 252.204-7012 Safeguarding Controlled Defense Information and Cyber Incident Reporting. Do not process CUI on public computers (e.g., those available for use by the general public in kiosks, hotel business centers), public wireless networks or computers that do not have access control. Personally owned computers and personally owned devices are not authorized to process CUI. Portable electronic devices (e.g., smartphones, laptop computers, tablets), non-portable computers, and removable media (e.g., external hard drives, flash drives, USB drives; not including optical media) must be physically and electronically protected as described in this instruction and the DFARS 252.204- 7012.

Dissemination: CUI printed documents and material may be transmitted through mail channels, commercial carrier or hand-carried without formal courier orders. FOUO information may be disseminated to DoD personnel and DoD contractors to conduct official business for the program. If dissemination is required outside of DoD personnel or DoD contractors, contact the Government Security Manager for approval. Technical information will follow the release instructions identified in the Distribution Statement. Use secure communications whenever possible;

however, land-line telephones are more secure than cellular telephones and should be used whenever available for

Solicitation/Contract Number:

Revised: October 2, 2018 Page A2 of 2 discussions involving CUI. Transmit voice and facsimile transmissions only when you have a reasonable assurance that only authorized recipients will have access to the transmission. Digital transmission shall comply with the below:

All transmission and/or dissemination of CUI (i.e., email and file transfers) must use NIST/NIAP-approved cryptographic products/algorithms, e.g., DoD-approved Public Key Infrastructure Certification or AMRDEC Safe Exchange at https://safe.amrdec.army.mil/safe. These are available at http://iase.disa.mil/pki/eca or http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm. This encryption requirement includes communications that contain passcodes to teleconferences or web conferences where there is a reasonable expectation that CUI may be discussed. When encryption is not available, a government collaborative suite (aka Integrated Digital Environment [IDE]) must be used to transmit CUI.

• Contractor-hosted collaborative suites may be used for digital transmission and/or dissemination of CUI by personnel not located on a government backbone (e.g., NIPRNET), provided the following conditions apply: 1) Use only NIST/NIAP-approved cryptographic products/algorithms. The latest validation lists may be obtained at http://iase.disa.mil/pki/eca or http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm; and, 2) Use an internally hosted service that does not use a third-party collaborative suite service provider.

• Do not post CUI to web pages that are publicly available or have access limited only by domain/IP restrictions.

As permitted by other contract provisions, CUI may be posted to web pages that control access through the use of a DoD approved Public Key Infrastructure Certification and that provide protection via use of secure sockets, or other equivalent technologies. These are available at http://iase.disa.mil/pki/eca.

• As new technologies become available in the electronics arena, care should be given to providing a reasonable degree of protection from known vulnerabilities.

• The Internet is “Public Access”. CUI must be reviewed and officially approved by the PEO GCS Public Affairs Officer for public release before placing on the Internet. This is not applicable when the Internet is used for e-mail transmissions and encryption is used as noted above.

Disposal: Destroy CUI documents by any means approved for the destruction of classified information, i.e. cross-cut shredding or other means that would make it difficult to recognize or reconstruct the information. Clear, purge, or destroy CUI on removable media IAW BBP 03-PE-O-0003 Army Information Assurance Sanitization of Media to AR 25-2. This is available at https://informationassurance.us.army.mil.

Report of Loss of CUI: Report any loss of CUI to the Government Security Manager. Initial reports shall be made as expeditiously as possible in all cases within 72 hours of discovery. If additional information is required after submission and review of the initial report, guidance will be provided at that time. Mark any reports For Official Use Only, exemptions 2 and 5 apply. Initial report content shall include the following information as available.

• Applicable dates, including dates of compromise and dates of discovery

• Threat methodology, including all known resources used (e.g. IP addresses, domain names, software tools)

• Account of what actions the threat(s) may have taken on victim system/network

• What information may have been compromised or lost, and its potential impact on government programs

Solicitation/Contract Number:

Revised: 28 November 2018 Page B1 of 1

ATTACHMENT B: ADDITIONAL SECURITY GUIDELINES FOR COMSEC

Contractor Generated Communications Security (COMSEC) Material: Any material generated by the contractor (including, but not limited to: correspondence, drawings, models, mockups, photographs, schematics, status programs and special inspection reports, engineering notes, computations and training aids) will be classified according to its own content. Classification guidance will be taken from other elements of this Contract Security Classification Specification, DD Form 254, Government furnished equipment or data, or special instructions issued by the Contracting Officer, or his/her duly appointed representative.

REQUIREMENTS:

1. The requirements of DoD 5220.22-M and NSA/CSS Policy Manual 3-16 are applicable to this effort.

2. All contractor personnel to be granted access to classified COMSEC information must be U.S.

citizens granted FINAL clearance by the government prior to being given access. Immigrant aliens, interim cleared personnel, or personnel holding a contractor granted CONFIDENTIAL clearance are not eligible for access to classified COMSEC information released or generated under this contract without the express permission of the Director, NSA.

3. Contractor employees or cleared commercial carriers shall not carry classified COMSEC material on commercial passenger aircraft anywhere in the world without the approval of the procuring contracting officer.

4. No contractor generated COMSEC or government furnished material may be provided to the Defense Technical Information Center (DTIC). Contractor generated technical reports will bear the statement "Not Releasable to the Defense Technical Information Center per DoD Directive 5100-38."

5. Classified paper COMSEC material may be destroyed by burning, disintegration, chopping or high security crosscut shredding. Cryptographic key tapes must be “terminally” destroyed (destroyed to the point where it cannot be reconstructed) utilizing devices listed on the Evaluated Products List (EPL) for Punched Tape Destruction Devices or the EPL for High-Security Disintegrators. A listing of EPLs can be found at https://www.nsa.gov/resources/everyone/media-destruction/. When a method other than burning is used, all residue must be reduced to pieces 5mm or smaller in any dimension. When classified COMSEC material other than paper is to be destroyed, specific guidance must be obtained from the User Agency.

6. Unclassified COMSEC information released or generated under this contract shall be restricted in its dissemination to personnel involved in the contract. Release in open literature or exhibition of such information without the express written permission of the Director, NSA, is strictly prohibited.

7. Recipients of COMSEC information under this contract may not release information to subcontractors without permission of the government security manager.

8. Additional notices to be affixed to the cover and title or first page of contractor generated COMSEC documents:

a. "COMSEC MATERIAL - ACCESS BY CONTRACTOR PERSONNEL RESTRICTED TO U.S.

CITIZENS HOLDING FINAL GOVERNMENT CLEARANCE."

b. "THIS PUBLICATION OR INFORMATION IT CONTAINS MAY NOT BE RELEASED TO

FOREIGN NATIONALS WITHOUT PRIOR SPECIFIC APPROVAL FROM THE DIRECTOR, NSA. ALL

APPROVALS WILL IDENTIFY THE SPECIFIC INFORMATION AND COPIES OF THIS PUBLICATION

AUTHORIZED FOR RELEASE TO SPECIFIC FOREIGN HOLDERS. ALL REQUESTS FOR

ADDITIONAL ISSUANCES MUST RECEIVE PRIOR SPECIFIC APPROVAL FROM THE DIRECTOR,

NSA."

https://www.nsa.gov/resources/everyone/media-destruction/

Text1: W56HZV-18-R-0174

Contract/Solicitation Number:

Dated: Sept 17, 2017 Page C1 of 1

ATTACHMENT C: INTELLIGENCE INFORMATION: NON-SCI

Intelligence information includes the following information (whether written or in any other medium) classified pursuant to Executive Order 12333: Information describing U.S. foreign intelligence and counterintelligence activities, sources, methods, equipment, or methodology used for the acquisition, processing, or exploitation of such intelligence; foreign military hardware obtained through intelligence activities for exploitation and the results of the exploitation; and any other data resulting from U.S. intelligence efforts; and information on Intelligence Community protective security programs (e.g., personnel, physical, technical, and information security).

1. No Intelligence materials are to be provided in support of the contract without the prior approval of the TACOM Life Cycle Management Command (TACOM LCMC) G2 Foreign Intelligence Team. Any intelligence materials so provided will be disseminated solely by the G2 TACOM LCMC, and will be accompanied by both a Letter of Instruction governing control of the materials provided, and a Letter of Transmittal, identifying the materials loaned and the duration of the loan. This service only pertains to elements supported by the

G2 TACOM LCMC.

2. All requests for access to intelligence materials will adhere to the following guidelines:

a. Prime contractor requests for intelligence materials access will be sent to the Program/Project Manager (PM) of the User Activity on official business letterhead with an enclosed copy of the approved DD Form 254.

b. Subcontractor requests for access to intelligence materials will be forwarded by the prime contractor to the PM on official business letterhead with an enclosed, approved DD Form 254 for the relevant subcontract.

c. PM of the User Activity will forward request through the Contracting Officer on official letterhead with the appropriate DD Form 254 and all substantiating documents attached, to be forwarded to the G2 TACOM LCMC for review and concurrence.

3. The handling of all non-SCI intelligence material will follow NISPOM need-to-know requirements for all PEO Ground Combat Systems locations as authorized on their DD-254’s. Any intelligence material that does not fall under the NISPOM need-to-know will be clearly identified as an exception by the Foreign Intelligence Officer (FIO) or Threat Manager (TM). Such material will contain handling instructions, i.e.

safeguarding, transmitting, and disseminating.

4. The contractor shall not release intelligence information to foreign nations, foreign companies, foreign corporations or foreign subsidiaries or other non-U.S. citizens. If a need arises for the release of intelligence information, the contractor will request such release in writing to the FIO or TM who in turn will process the request through proper foreign disclosure channels.

5. Upon expiration of the contract, the intelligence inventory will be submitted to the FIO or TM with the recommended disposition of intelligence materials (i.e. retention, transfer to another contract, destroy in place, return).

6. The TACOM LCMC, G2, Foreign Intelligence Office will maintain the list of supporting FIOs and TMs authorized to release intelligence information to the company. The primary supporting Intelligence Specialist, G2, TACOM is the Foreign Intelligence Team member with the following contact information:

FIO POC: POC Phone: Supporting PM Office:

TACOM LCMC

ATTN: Foreign Intelligence Officer for NGCV AMSTA-CSS-F / mail stop 105 6501 E. 11 Mile Road Warren, MI 48397-5000

Text4: NGCV

Text3: 586-282-5019

Text2:

Text1: W56HZV-18-R-0174

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of AEM LiveCycle Designer

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

October 31, 2020 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, DoD Contract Security Classification Specification List of Attachments [3] (All Files Must be Attached Prior to Signing, i.e., for any digital signature on the form) Attach A -- CUI 2 Oct 2018.pdf Attach B -- COMSEC dtd 2018.pdf Attach C -- Non SCI dtd 2017.pdf

Unclassified information shall be protected IAW the Security Classification Guide, OPSEC Plan, and Attachment A.

Item 10.a – COMSEC: Contractor personnel requiring COMSEC access must be U.S. Citizens and possess a final clearance at the appropriate level. COMSEC information/material will be accessed and/or processed IAW DoD 5220.22-M, NSA/CSS Policy Manual 3-16, AR 380-40 (Policy for Safeguarding and Controlling Communications Security), and additional security Guidelines for COMSEC (Attachment B). When access is required at Government facilities, contractor personnel shall adhere to COMSEC rules and regulations as mandated by Command policy and procedures. All contractors shall be briefed before access to COMSEC is granted. The contractor may be subject to the Department of Army Cryptographic Access Program (DACAP) if contractor employees handle unencrypted SECRET crypto or TOP SECRET crypto keying material. Written concurrence of the Government Contracting Officer is required prior to subcontracting.

Item 10.e.(2) – Non-SCI: Non-SCI information/material will be accessed and/or processed IAW DoD 5220.22-M, and additional security Guidelines for Intelligence Information: Non-SCI (Attachment C). Written concurrence of the Government Contracting Officer is required prior to subcontracting.

Item 10.g – NATO: This contract requires access to NATO Secret material. Access to NATO information requires a final U.S. Government clearance at the appropriate level and a NATO access briefing/debriefing. Special briefings are required for access to NATO. The contractor will maintain strict compliance in regards to NATO information IAW NISPOM Chapter 10, Section 7. Written concurrence from the Government Contracting Officer is required prior to subcontracting.

Item 10.h – FGI: FGI is not releasable to contractor employees who have not received a final clearance at the appropriate security level. Written concurrence of the Government Contracting Officer is required prior to subcontracting.

Item 10.j – CUI: CUI shall be safeguarded and marked in accordance with Guidelines for CUI (Attachment A).

Item 11.c – RECEIVE, STORE, AND GENERATE: The contractor requires access to classified source data up to and including Secret in support of the work effort. Any extracts or use of such data requires the contractor to apply derivative classifications and markings consistent with the source documents. All classified information received is the property of the U.S. Government. At the termination or expiration of this contract, the U.S. Government will be contacted for the proper disposition instructions. Contractor will abide by the following security classification guide: Optionally Manned Fighting Vehicle, Security Classification Guide, dated 28 January 2019.

Item 11.h – COMSEC ACCOUNT: Contractor is authorized the use of secure telephones with fax, encryption equipment and keying material for classified program requirements.

Item 11.i – TEMPEST: Refer to scope of work and the CDRL that addresses the submission of this requirement. This requirement shall be flowed down to all U.S. subcontractors that use Information Systems to process classified material.

Item 11.j – OPSEC: Refer to scope of work and the CDRL that address the submission of this requirement. These requirements, OPSEC Plan and training, shall be flowed down to all U.S. subcontractors with access to CUI and/or classified material.

Item 11.l – (CUI): CUI shall be safeguarded and marked in accordance with Guidelines for CUI (Attachment A).

Item 11.m – TARP: ICW NISPOM 1-301, the contractor shall report threat-related incidents, behavioral indicators, and other matters of counterintelligence (CI) interest specified in AR 381-12, Chapter 3, through the facility security officer to the government security officer, the nearest military CI office, the Federal Bureau of Investigation, and the Defense Security Service. Annually, train personnel who handle classified information IAW AR 381-12, Chapter 2. This requirement shall be flowed down to all U.S. subcontractors that have access to classified information/material. Contact the individual in Block 17 to obtain local CI office information.

Item 12 – PUBLIC RELEASE: An electronic copy of the request with full text and graphics must be provided through the Contracting Officer at least 45 working days prior to the requested release date. If all or part of the information was generated by another organization, their written release authorization must accompany the request.

Notification of loss or compromise of collateral classified information shall be provided to the Government Program Security Office within 72 hours of the incident, in addition to the reporting requirements outlined in the NISPOM.

M/S 469 Warren, MI 48397-5000 Address: 6501 East 11 Mile Road SFAE-GCS-S/Mail Stop 531 Warren, MI. 48397-5000