A01_Attachment_0009_Contract_Security_Classification_Specification_Form_DD_254.pdf

DEPARTMENT OF DEFENSE 1. CLEARANCE AND SAFEGUARDING

CONTRACT SECURITY CLASSIFICATION SPECIFICATION a. FACILITY CLEARANCE REQUIRED

SECRET

(The requirements of the DoD Industrial Security Manual apply to all aspects of this effort)

b. LEVEL OF SAFEGUARDING REQUIRED

NONE

2. THIS SPECIFICATION IS FOR: (X and complete as applicable) 3. THIS SPECIFICATION IS: (X and complete as applicable)

a. PRIME CONTRACT NUMBER a. ORIGINAL (Complete date in all cases) Date (YYMMDD)

TBD 20170509

b. SUBCONTRACT NUMBER

b. REVISED (Supersedes all previous specs) Revision No.

Date (YYMMDD)

N/A

c. SOLICITATION OR OTHER NUMBER Due Date (YYMMDD) c. FINAL (Complete Item 5 in all cases) Date (YYMMDD)

W56JSR-17-R-0005 (IDIQ

Base)

170901

4. IS THIS A FOLLOW-ON CONTRACT? YES NO. If Yes complete the following

Classified material received or generated under W56JSR-17-C-0005 & W15P7T-14-D-0043 (Preceding Contract Number) is transferred to this follow-on contract

5. IS THIS A FINAL DD FORM 254? YES NO. If Yes complete the following

In response to the contractor's request dated , retention of the identified classified material is authorized for the period of .

6. CONTRACTOR (Include Commercial and Government Entity ( CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code) This DD 254 is for planning purposes only and access to classified information is not authorized until contract award. A valid DD254 will be issued with the contract award document. This base DD254 covers all items that may be required on the contract. Each task order will be issued a separate DD254 identifying the specific requirements for the task.

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICES ( Name, Address, and Zip Code) n/a n/a n/a

8. ACTUAL PERFORMANCE

a. LOCATION b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code) Software Engineering Center Building 6006

APG, MD 21005

Additional locations (see block 13)

00000

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

Contractor will support Platform Mission Equipment Software Branch (PMESB) with system/software engineering and integration for aviation systems, tactical Air Traffic Control, Position/Navigation/Terrain systems, and Command and Control systems. Contractor will provide MIL-STD-1553 engineering, validation and testing, and system integration support.

10. THIS CONTRACT WILL REQUIRE ACCESS TO: YES NO 11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: YES NO

a. COMMUNICATIONS SECURITY (COMSEC)

INFORMATION

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER

CONTRACTOR’S FACILITY OR A GOVERNMENT ACTIVITY

b. RESTRICTED DATA b. RECEIVE CLASSIFIED DOCUMENTS ONLY

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION c. RECEIVE AND GENERATE CLASSIFIED MATERIAL

d. FORMERLY RESTRICTED DATA: d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. INTELLIGENCE INFORMATION: e. PERFORM SERVICES ONLY

(1) Sensitive Compartmented Information (SCI) f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO

RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

(2) Non-SCI g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL

INFORMATION CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

f. SPECIAL ACCESS INFORMATION h. REQUIRE A COMSEC ACCOUNT

g. NATO INFORMATION i. HAVE A TEMPEST REQUIREMENT

h. FOREIGN GOVERNMENT INFORMATION j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

i. LIMITED DISSEMINATION INFORMATION k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE

j. FOR OFFICIAL USE ONLY INFORMATION l. OTHER (Specify).

k. OTHER (Specify) Access to SCG, SIPRNET, NIPRNET access at government facilities only.

Sensitive IT duties required (see Block 13 paragraph 13a).

Contractor will be authorized courier duties.

DD Form 254, DEC 1999 Previous editions are obsolete

DD254 Block 13 Continuation Form Solicitation #: W56JSR-17-R-0005 Contract #:

1a. The highest level of facility clearance required for the contractor to perform on the Contract is Secret.

1b. The highest level of classified material the contractor will be required to store at its own facility is None.

This DD 254 is for planning purposes only and access to classified information is not authorized until contract award. A valid DD254 will be issued with the contract award document. This base DD254 covers all items that may be required on the contract.

4. The classified portion of work has been completed on the contracts cited in block 4.

The processing of classified will no longer be done under these contracts. All classified material/ information associated with these contracts is authorized to be transferred to the award contract number that will be cited in block 2a.

8a. Performance will take place at Software Engineering Center building 6006, APG, MD.

All DD254 for prime subcontractors must be submitted to the KOs for concurrence of additional contractor subsidiaries, subcontractor and government places of performance.

The completed SCI subcontract DD254 and continuation pages will be submitted to the Industrial Security Specialist (ISS) listed in Item 16 of the signed DD254 for review via ACCS. The review is to verify that all Army Security Requirements have been flowed down to the subcontractors. Collateral (non-SCI) will be submitted to the KO for concurrence of additional contractor subsidiaries, subcontractor and government places of performance. A copy must be sent to CECOM G2 for review to verify that all Army Security Requirements have been flowed down to the subcontractors.

All contractors and subcontractors require: SECRET facility clearances and No safeguarding.

All personnel must be US citizens. Dual citizenship status not authorized.

10a. COMSEC information/material will be processed IAW DoD 5220.22-M, NSA/CSS Policy Manual 3-16, AR 380-40 (Policy for Safeguarding and Controlling Communications Security), and additional security guidelines (Appendix A). When access is required at Government facilities, contractor personnel will adhere to COMSEC rules and regulations as mandated by Command policy and procedures.

Contractor personnel requiring COMSEC access and/or authorized a COMSEC account must be U.S. Citizens and possess a final clearance at the appropriate level. All contractors shall be briefed before access to COMSEC is granted. Subcontracts requiring classified COMSEC information shall be awarded only upon the approval of the Contracting Officer. Concurrence of the KO is required prior to subcontractors working on the program. Copies of the subcontract DD Form 254 will be forwarded to the KO for

Contract #:

the Contract file and to CECOM G2 for DD Form 254 tracker information. Per AR 380- 40, Chapters 4 and 7: Contractor personnel are subject to the Department of Army Cryptographic Access Program (DACAP).

10j. Safeguarding "For Official Use Only” (FOUO) information, Appendix D. FOUO Information generated and/or provided under this contract shall be safeguarded and marked as specified in AR 25-55 and DoD 5200.1-M (Marking is in Volume 2).

10k. NIPRNet, SIPRNet, Security Classification Guide(s). OPSEC Plan will be provided by the government facilities. SIPRNET ACCESS: All contractors requiring access to the SIPRNET MUST HAVE A FINAL SECRET CLEARANCE OR Interim Top Secret clearance. All contractors with SIPRNET access MUST receive COMSEC and NATO Awareness briefings from their FSO prior to being granted access. COMSEC and NATO Awareness Briefing dates must be recorded on all visit requests. The NATO Awareness Briefing is required to inform personnel how to protect NATO information in the event they come across it while accessing SIPRNET. The contractor shall not access, download or further disseminate any special access date (i.e., intelligence, NATO, COMSEC, etc.) outside the execution of the defined contract requirements. All contractors will read the NATO Central Registry awareness briefing located at: https://secureweb.hqda.pentagon.mil/cusr/forms.aspx prior to being issued a SIPRNet account. This briefing does not authorize NATO access, and is solely for the purpose of awareness.

Access to SIPRNet is required at Government facilities only. All contractors granted SIPRNet access must be aware that they are not authorized to download ANY classified material without the guidance and written permission of the Cognizant Security Agency.

11a. Contractor performance is restricted to Government facility(ies). Government agency or activity will provide security classification guidance for performance of this contract. Submit visit request to the KO and/or Security Management Office for need-to-know verification.

11j. OPSEC requirements are IAW the following Program OPSEC PLAN (Will be provided upon contract award).

11l. Contractor may serve as a courier. The individual couriers must have the security clearance commensurate with the level of the security classification of the material being carried. Contractor must have documentation to be a courier. The Courier must be briefed on their courier responsibilities.

13a. Contractor personnel performing IT sensitive duties are subject to investigative and assignment requirements IAW AR 25-2, AR 380-67, DoD 8570.0 and affiliated regulations.

Army regulation available at www.apd.army.mil.

13b. Foreign subcontractors, foreign vendors and/or visitors that are not cleared US Companies, participating in Army foreign disclosure issues will be handled in accordance with AR 380-10, Appendix G, para G-4. Foreign subcontractor participation will be handled in accordance with AR 380-10 (Technology Transfer, Disclosure of Information & Contacts with Foreign Representatives), (DTM) 09-019 - “Policy Guidance for Foreign Ownership, http://www.apd.army.mil/

Contract #:

Control, or Influence (FOCI)”, September 2, 2009, National Disclosure Policy, and affiliated regulations and/or supplements.

• All disclosures (i.e. oral, visual, briefing, documents) to foreign nationals require prior approval by the foreign disclosure officer.

• All requests for non-US cleared Foreign subcontractor and/or Foreign own companies to perform on this contract must be requested from the Prime Contract to the KO through Program Office and approved by Foreign Disclosure Officer.

13c. Classified information will be protected IAW the NISPOM, Chapter 5. All security incidents involving classified information will be reported to the CECOM G2 Industrial Security Office, and DSS Industrial Security Representative. Information will be forwarded to KO and the PM for a program damage assessment to be conducted IAW AR 380-49.

13d. All subcontractor DD254s and subcontractor tier DD254s will be sent to the KO. Any Contractors/subcontractors owned by Foreign Companies and that have a clearance issued by the Defense Security Service under a Special Security Agreement need to have a National Interest Determination (NID) approved if access is required to: Top Secret; COMSEC;

Restricted Data; SCI and/or SAP. NID requirements and justification must be sent through CECOM G2 to be forwarded to the approving agencies. Only after a NID approval is received will a FOCI contracting firm be authorized to work on the program.

13e. Security Training and Briefing: IAW AR 380-49 Chapter 3, the FSO will provide Threat Awareness and Reporting Program (TARP) training in addition to initial and refresher security training IAW AR 381-12, paragraph 1-14 and Chapter 2 for contractors working in contractor facilities. Contractors may be exempt from such security training if they can provide documentation they have had similar training from their FSO. The FSO will forward Certificates and/or a signed Letter of Certification for Training to the COR for verification of required training to be included in the contract folder.

Integrated/embedded contractors will receive security training from the assigned

CECOM Security Manager/Representative. Some Security training provided to integrated/embedded contractors will include:

--TARP Training: Live training provided by 902d – Annual training requirement --Initial Security Orientation: Online training available on the Army Learning Management System (ALMS) site, reference ALARACT 207-2103 – Initial training --Annual Security Orientation: Online training available on the Army Learning Management System (ALMS) site, reference ALARACT 207-2103 – Annual training requirement Derivative Classification Training, reference DoD 5200.01-V3-Biennial training requirement --Operations Security Training, reference AR 530-1-Annual training requirement

Contract #:

--Foreign travel training, AR 525-13 – Required when traveling abroad The previous listing includes some training requirements that are provided. Any training requirements that the installation or tenant facilities require of the contractors must be added to the DD 254 and the security section of the contract document.

Only after a NID approval is received will a FOCI contracting firm be authorized to work on the program.

13f. If contractor must submit subcontracts to DD Form to the KO for the contract file and forward to CECOM G2 for review to ensure Army requirements flow down to the subcontractor.

13g. All Facility Clearance sponsorships for subcontractors must have Government approval and certification on the subcontractors DD Form 254. Submit all requests to the CECOM G2 Industrial Security.

13h. Records of security related training of contractors and embedded contractors must be available for review.

17e. Administrative Contracting Officer 6001 Combat Drive

APG, MD 21005

Certification and Signature: Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

Dzung Tang, COR DATE: 5 May 2017

5/8/2017

X Dzung Tang Dzung Tang

Signed by: TANG.DZUNG.T.1229242063

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the industrial Security Manual or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public release shall be submitted for approval prior to release to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review.

*In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency

Direct

Through (Specify):

Public release of SCI is NOT AUTHORIZED. All requests for public release shall be submitted by the government CM or COR utilizing the CECOM Public Release Approval System (PRAS) at: https://medinah.sed.apg.army.mil/PRAS/. SEC OPSEC Officer:

calvin.j.simpson.civ@mail.mil, 6002 Combat Drive, ATTN: AMSEL-SEC-OE, Room D4-226, APG, MD 21005, Tel: 443-861-8912 CECOM OPSEC Officer: Karen.m.reevey.civ@mail.mil, 6002 Combat Drive, ATTN: AMSEL-MI, Room D2-101, APG, MD 21005, Tel:

443-861-6975

13. SECURITY GUIDANCE. The security classification guidance needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes: to challenge the guidance or classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any document/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance.

See DD254 Continuation Form

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to ISM requirements, are established for this contract. (If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the cognizant security office. Use Item 13 if additional space is needed.)

Yes No

TCR IAW AR 381-14 and AR 380-27.

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office. (If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.

Yes No

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL Winnetta McKasson Winnetta.j.mckasson.civ@mail.mil

b. TITLE Security Specialist

c. TELEPHONE (Include Area Code)

443-861-6971

d. ADDRESS (Include ZIP Code) 17. REQUIRED DISTRIBUTION

a. CONTRACTOR See Block 6a

Headquarters CECOM ATTN: AMSEL-MI 6002 Combat Drive, Rm D4-226 Aberdeen Proving Ground, MD 21005

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR See Block 6c

e. SIGNATURE

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION – OCONUS locations provided upon award

e. ADMINISTRATIVE CONTRACTING OFFICER See Block 13, item 17e

f. OTHERS AS NECESSARY See Block 8

DD Form 254 Reverse, DEC 1999

MCKASSON.WINNETTA.

JANE.1018948890

Digitally signed by MCKASSON.WINNETTA.JANE.1018948890 DN: c=US, o=U.S. Government, ou=DoD, ou=PKI, ou=USA, cn=MCKASSON.WINNETTA.JANE.1018948890 Date: 2017.05.09 10:15:50 -04'00'

CONTRACT #

SOLICITATION # W56JSR-17-R-0005

APPENDIX A

ADDITIONAL SECURITY GUIDELINES FOR COMSEC

Provided by the CECOM LCMC Director of Intelligence & Security/G2

(Updated: 14 July 2008)

Contractor Generated Communications Security (COMSEC) Material: Any material generated by the contractor (including, but not limited to: correspondence, drawings, models, mockups, photographs, schematics, status programs and special inspection reports, engineering notes, computations and training aids) will be classified according to its own content.

Classification guidance will be taken from other elements of this Contract Security Classification Specification, DD Form 254, Government furnished equipment or data, or special instructions issued by the Contracting Officer, or his/her duly appointed representative.

REQUIREMENTS:

1. The requirements of DoD 5220.22-M and NSA/CSS Policy Manual 3-16 are applicable to this effort.

2. All contractor personnel to be granted access to classified COMSEC information must be U.S. citizens granted FINAL clearance by the government prior to being given access. Immigrant aliens, interim cleared personnel, or personnel holding a contractor granted CONFIDENTIAL clearance are not eligible for access to classified COMSEC information released or generated under this contract without the express permission of the Director, NSA.

3. Contractor employees or cleared commercial carriers shall not carry classified COMSEC material on commercial passenger aircraft anywhere in the world without the approval of the procuring contracting officer.

4. No contractor generated COMSEC or government furnished material may be provided to the Defense Technical Information Center (DTIC). Contractor generated technical reports will bear the statement "Not Releasable to the Defense Technical Information Center per DoD Directive 5100-38."

5. Classified paper COMSEC material may be destroyed by burning, disintegration, chopping or high security crosscut shredding. Cryptographic key tapes must be “terminally” destroyed (destroyed to the point where it cannot be reconstructed) utilizing devices listed on the Evaluated Products List (EPL) for Punched Tape Destruction Devices or the EPL for High- Security Disintegrators. A listing of EPLs can be found at http://www.nsa.gov/ia/government/mdg.cfm. When a method other than burning is used, all residue must be reduced to pieces 5mm or smaller in any dimension. When classified COMSEC material other than paper is to be destroyed, specific guidance must be obtained from the User Agency.

6. Unclassified COMSEC information released or generated under this contract shall be restricted in its dissemination to personnel involved in the contract. Release in open literature or exhibition of such information without the express written permission of the Director, NSA, is strictly prohibited.

7. Recipients of COMSEC information under this contract may not release information to subcontractors without permission of the User Agency.

8. Additional notices to be affixed to the cover and title or first page of contractor generated COMSEC documents:

a. "COMSEC MATERIAL - ACCESS BY CONTRACTOR PERSONNEL RESTRICTED TO U.S. CITIZENS

HOLDING FINAL GOVERNMENT CLEARANCE."

b. "THIS PUBLICATION OR INFORMATION IT CONTAINS MAY NOT BE RELEASED TO FOREIGN NATIONALS WITHOUT PRIOR SPECIFIC APPROVAL FROM THE DIRECTOR, NSA. ALL APPROVALS WILL IDENTIFY THE SPECIFIC INFORMATION AND COPIES OF THIS PUBLICATION AUTHORIZED FOR RELEASE TO SPECIFIC FOREIGN HOLDERS. ALL REQUESTS FOR ADDITIONAL ISSUANCES MUST RECEIVE PRIOR

SPECIFIC APPROVAL FROM THE DIRECTOR, NSA."

9. Point of contact is CECOM LCMC G2, ATTN: AMSEL-MI.

http://www.nsa.gov/ia/government/mdg.cfm

CONTRACT #

SOLICITATION # W56JSR-17-R-0005

APPENDIX D

SAFEGUARDING “FOR OFFICIAL USE ONLY” (FOUO) INFORMATION

Provided by the CECOM Director of Intelligence & Security/G2

(Updated: 14 July 2008)

Reference: AR 25-55, Chapter IV

1. The “FOR OFFICIAL USE ONLY” marking is assigned to information at the time of its creation in a DOD User Agency. It is not authorized as a substitute for a security classification marking but it is used on official Government Information that may be withheld from the public under exemptions 2 through 9 of the Freedom of Information Act.

2. Other non-security markings such as “Limited Official Use” and “Official Use Only” are used by non-DOD User Agencies for the same type of information and should be safeguarded and handled in accordance with instructions received from such agencies.

3. Use of the above markings does not mean that the information cannot be released to the public, only that it must be reviewed by the Government prior to its release, to determine whether a significant and legitimate Government purpose is served by withholding the information or portions of it.

4. IDENTIFICATION MARKINGS:

a. An unclassified document containing FOUO information shall be marked “For Official Use Only” in bold letters at least 3/16 of an inch high at the bottom of the front cover (if any), on each page containing FOUO information, and on the outside of the back cover (if any). No portion marking will be shown.

b. Within a classified document, an individual page that contains both FOUO and classified information will be marked at the top and bottom with the highest security classification appearing on the page. If an individual portion contains FOUO information but no classified information, the portion will be marked ‘FOUO.’

c. Any “FOR OFFICIAL USE ONLY” information released to a contractor by a DOD User Agency is required to be marked with the following statement prior to transfer:

THIS DOCUMENT CONTAINS INFORMATION EXEMPT FROM MANDATORY DISCLOSURE UNDER THE

FOIA. EXEMPTIONS APPLY.

d. Removal of the “FOR OFFICIAL USE ONLY” marking can only be accomplished by the originator or other competent authority. When “FOR OFFICIAL USE ONLY” status is terminated, all known holders will be notified to the extent possible.

5. DISSEMINATION: Contractors may disseminate “FOR OFFICIAL USE ONLY” information to their employees and subcontractors who have a need for the information in connection with a classified contract.

6. STORAGE: During normal working hours “FOR OFFICIAL USE ONLY” information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for the information. During non-working hours, the information shall be stored to preclude unauthorized access. Filing such material with other unclassified records in unlocked files or desks is adequate when internal building security is provided during non-working hours. When such internal security control is not exercised, locked buildings or rooms will provide adequate after hours protection or the material can be stored in locked receptacles such as file cabinets, desks or bookcases.

7. TRANSMISSION: “FOR OFFICIAL USE ONLY” information may be sent via first-class mail or parcel post. Bulky shipments may be sent fourth-class mail.

8. DISPOSITION: When no longer needed, FOUO information may be disposed of by tearing each copy into pieces to preclude reconstructing, and placing it in a trash container or as directed by the User Agency.

9. UNAUTHORIZED DISCLOSURE: Unauthorized disclosure of “FOR OFFICIAL USE ONLY” information does not constitute a security violation but the releasing agency should be informed of any unauthorized disclosure. The unauthorized disclosure of FOUO information protected by the Privacy Act may result in criminal sanctions.

10. Point of contact is CECOM LCMC Director of Intelligence & Security/G2, ATTN: AMSEL-MI.