SW_Code_Assessment_DD254_Attachment_0002.pdf

DEPARTMENT OF DEFENSE 1. CLEARANCE AND SAFEGUARDING

CONTRACT SECURITY CLASSIFICATION SPECIFICATION a. FACILITY CLEARANCE REQUIRED

SECRET

(The requirements of the DoD Industrial Security Manual apply to all aspects of this effort)

b. LEVEL OF SAFEGUARDING REQUIRED

NONE

2. THIS SPECIFICATION IS FOR: (X and complete as applicable) 3. THIS SPECIFICATION IS: (X and complete as applicable)

a. PRIME CONTRACT NUMBER a. ORIGINAL (Complete date in all cases) Date (YYMMDD)

TBD 20151216

b. SUBCONTRACT NUMBER

b. REVISED (Supersedes all previous specs) Revision No.

Date (YYMMDD)

N/A

c. SOLICITATION OR OTHER NUMBER Due Date (YYMMDD) c. FINAL (Complete Item 5 in all cases) Date (YYMMDD)

W56JSR-17-R-0004

4. IS THIS A FOLLOW-ON CONTRACT? YES NO. If Yes complete the following

Classified material received or generated under W15P7T-12-D-A011/KZ04 (Preceding Contract Number) is transferred to this follow-on contract

5. IS THIS A FINAL DD FORM 254? YES NO. If Yes complete the following

In response to the contractor's request dated , retention of the identified classified material is authorized for the period of .

6. CONTRACTOR (Include Commercial and Government Entity ( CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

TBD TBD TBD

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICES ( Name, Address, and Zip Code)

8. ACTUAL PERFORMANCE

a. LOCATION b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

ABERDEEN PROVING GROUND, MD

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

The scope of this effort is to provide the Communications-Electronics Command (CECOM) Software Engineering Center (SEC) the capability to conduct on-site and on-demand software code analytic scans using a suite of commercial, government, and open source software code analyzer tools. The code review analysis' objective is to provide a fast and accurate Third Party Code Review and provide detailed, aggregated reports for Army Mission Application owners to identify, prioritize, and determine appropriate remediation strategies for the identified security vulnerabilities. The software analysis capability shall be able to support source code and binary review and be scalable and robust to support assessment of software that covers at a minimum application software using C, C++, C#, Visual C++, VB, .NET (Microsoft. Net), Java, SQL, and ColdFusion programming languages and technologies. Manual review of specific findings to determine their level of impact on the applications is outside the scope of this effort.

10. THIS CONTRACT WILL REQUIRE ACCESS TO: YES NO 11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: YES N

O

a. COMMUNICATIONS SECURITY (COMSEC)

INFORMATION

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER

CONTRACTOR’S FACILITY OR A GOVERNMENT ACTIVITY

b. RESTRICTED DATA b. RECEIVE CLASSIFIED DOCUMENTS ONLY

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION c. RECEIVE AND GENERATE CLASSIFIED MATERIAL

d. FORMERLY RESTRICTED DATA: d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. INTELLIGENCE INFORMATION: e. PERFORM SERVICES ONLY

(1) Sensitive Compartmented Information (SCI) f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO

RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

(2) Non-SCI g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL INFORMATION

CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

f. SPECIAL ACCESS INFORMATION h. REQUIRE A COMSEC ACCOUNT

g. NATO INFORMATION i. HAVE A TEMPEST REQUIREMENT

h. FOREIGN GOVERNMENT INFORMATION j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

i. LIMITED DISSEMINATION INFORMATION k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE

j. FOR OFFICIAL USE ONLY INFORMATION l. OTHER (Specify).

k. OTHER Specify)

NIPRNET/SIPRNET

DD Form 254, DEC 1999 Previous editions are obsolete

Contract #: TBD Solicitation #: W56JSR-17-R-0004

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the industrial Security Manual or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public release shall be submitted for approval prior to release

Direct

Through (Specify):

Public release of SCI is NOT AUTHORIZED. All requests for public release shall be submitted by the government CM or COR utilizing the CECOM Public Release Approval System (PRAS) at: https://medinah.sed.apg.army.mil/PRAS/. SEC OPSEC Officer: calvin.j.simpson.civ@mail.mil, 6002 Combat Drive, ATTN: AMSEL-SEC-OE, Room D4-226, APG, MD 21005, Tel: 443- 861-8912 CECOM OPSEC Officer: Karen.m.reevey.civ@mail.mil, 6002 Combat Drive, ATTN: AMSEL-MI, Room D2-101, APG, MD 21005, Tel: 443-861-6975 to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review.

*In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13. SECURITY GUIDANCE. The security classification guidance needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes: to challenge the guidance or classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any document/guides/extracts referenced herein.

Add additional pages as needed to provide complete guidance.

See continuation sheet.

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to ISM requirements, are established for this contract. (If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the cognizant security office. Use Item 13 if additional space is needed.)

Yes No

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office. (If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.

Yes No

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL M. Renee Crouse

b. TITLE Security Specialist

c. TELEPHONE (Include Area Code)

443-861-8366

d. ADDRESS (Include ZIP Code) 17. REQUIRED DISTRIBUTION

Software Engineering Center

ATTN: AMSEL-SEC-MI

6002 Combat Drive, Rm D4-226 Aberdeen Proving Ground, MD 21005

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

e. SIGNATURE

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHERS AS NECESSARY

DD Form 254 Reverse, DEC 1999

8a Subcontractor: N/A

a. NAME, ADDRESS, AND ZIP b. CAGE c. COGNIZANT SECURITY OFFICES ( Name, CODE CODE Address, and Zip Code)

TBD TBD TBD

10j: For Official Use Only (FOUO) Information generated and/or provided under this contract shall be safeguarded and marked as specified in DoD 5200.1-R, Appendix 3 (attached).

10k: Secret Internet Protocol Network (SIPRNET) access and Non-classified Internet Protocol Router Network (NIPRNet) required. The contractor shall not access, download or further disseminate any special access data (i.e. intelligence, NATO, COMSEC, etc.) outside the execution of the defined contract requirements and without the guidance and written permission of the KO. In the event that any special access is required, the KO must modify the requirements for the DD Form 254.

11a: Contractor performance is restricted to Aberdeen Proving Ground, MD. Government agency or activity will provide security classification guidance for performance of this contract. Submit visit request to the KO and/or Security Management Office for need-to-know verification.

13a. Contractor personnel performing IT sensitive duties are subject to investigative and assignment requirements IAW AR 25-2, AR 380-67, DoD 8570.0 and affiliated regulations. Army regulation available at www.apd.army.mil

13c. Classified information will be protected IAW the NISPOM, Chapter 5. All security incidents involving classified information will be reported to the KO and forwarded to the PM so a program damage assessment can be conducted.

13e. The contractor FSO will include Threat Awareness and Reporting Program (TARP) requirements in their initial and refresher training IAW AR 381-12, paragraph 1-14 and Chapter 2.

13f. The contractor must submit subcontracts to DD254’s to the KO for the contract file and forward to CECOM G2 approval.

13g. All Facility Clearance sponsorships for subcontractors must have Government approval and certification on the subcontractor’s DD 254. Submit all requests to the CECOM G2 security office.

Certification and Signature: Security requirements stated herein are complete an adequate for Contract:

W56JSR-17-R-0004 Software Code Assessment – IDIQ safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

X Margaret Sherman

Signed by: SHERMAN.MARGARET.R.1251892373 __11/10/2016___________________________ Margaret Sherman Date Government Technical Lead/COR http://www.apd.army.mil/