A01-_Attachment_3_DD_Form_254.pdf

DD Form 254, DEC 1999 Previous editions are obsolete

DEPARTMENT OF DEFENSE 1. CLEARANCE AND SAFEGUARDING

CONTRACT SECURITY CLASSIFICATION SPECIFICATION a. FACILITY CLEARANCE REQUIRED

SECRET

(The requirements of the DoD Industrial Security Manual apply to all aspects of this effort)

b. LEVEL OF SAFEGUARDING REQUIRED

SECRET

2. THIS SPECIFICATION IS FOR: (X and complete as applicable) 3. THIS SPECIFICATION IS: (X and complete as applicable)

a. PRIME CONTRACT NUMBER a. ORIGINAL (Complete date in all cases) Date (YYMMDD)

20151209

b. SUBCONTRACT NUMBER

b. REVISED (Supersedes all previous specs)

Revision No.

Date (YYMMDD)

c. SOLICITATION OR OTHER NUMBER

Due Date (YYMMDD) c. FINAL (Complete Item 5 in all cases) Date (YYMMDD)

W56KGY-16-R-0023

4. IS THIS A FOLLOW-ON CONTRACT? YES NO. If Yes complete the following

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract

5. IS THIS A FINAL DD FORM 254? YES NO. If Yes complete the following

In response to the contractor's request dated , retention of the identified classified material is authorized for the period of .

6. CONTRACTOR (Include Commercial and Government Entity ( CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code) This DD 254 is for planning purposes only and access to classified information is not authorized until contract award. A valid DD254 will be issued with the contract award document. This base DD254 covers all items that may be required on the contract. Each task order will be issued a separate DD254 identifying the specific requirements for the task order.

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICES ( Name, Address, and Zip Code)

NA NA NA

8. ACTUAL PERFORMANCE

a. LOCATION b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code) All locations where work is to be performed , other than the one specified in Item 6a,b and c under this solicitation, including contractor subcontractor and Government facilities will be listed on the Award DD Form 254 in block 8a,b and c, in accordance with the Defense Security Service D Form 254

Guidance.

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

The requirements for Contractor-support is to provided professional services to include accounting, budgeting, cost analysis, manpower analysis, fiscal policy assurance, program analysis, budget analysis and training.

Additionally, the awardee will train current G8 staff to understand and perform all work completed through this action. G8 staff will be able to perform the duties covered in this task order via training through the awardee

10. THIS CONTRACT WILL REQUIRE ACCESS TO: YES NO 11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: YES NO

a. COMMUNICATIONS SECURITY (COMSEC)

INFORMATION

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER

CONTRACTOR’S FACILITY OR A GOVERNMENT ACTIVITY

b. RESTRICTED DATA b. RECEIVE CLASSIFIED DOCUMENTS ONLY

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION c. RECEIVE AND GENERATE CLASSIFIED MATERIAL

d. FORMERLY RESTRICTED DATA: d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. INTELLIGENCE INFORMATION: e. PERFORM SERVICES ONLY

(1) Sensitive Compartmented Information (SCI) f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO

RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

(2) Non-SCI g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL

INFORMATION CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

f. SPECIAL ACCESS INFORMATION h. REQUIRE A COMSEC ACCOUNT

g. NATO INFORMATION i. HAVE A TEMPEST REQUIREMENT

h. FOREIGN GOVERNMENT INFORMATION j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

i. LIMITED DISSEMINATION INFORMATION k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE

j. FOR OFFICIAL USE ONLY INFORMATION l. OTHER (Specify).

k. OTHER Specify) NIPRNET, SCG, Access to FMS Program

Sensitive IT Duties(see continuation sheet para 13A)

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the industrial

Security Manual or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public release shall be submitted for approval prior to release

Direct

Through (Specify):

COR, Vincent Santorelli, through OPSEC Security Bernadetta Hughes through to Public Affairs Officer (PAO), HQ

CECOM 6002 Combat Drive, Aberdeen Proving Ground, 21005.

to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review.

*In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13. SECURITY GUIDANCE. The security classification guidance needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes: to challenge the guidance or classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any document/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance.

. The highest level of classified material the contractor will be required to store at its own facility is SECRET and is contingent on the contractor obtaining required safeguard and facility storage required before the contract can flow-down these requirements to any other facilities and/or subcontractors

Contractor personnel performing IT sensitive duties are subject to investigative and assignment requirements IAW DoD 8570.0 and

Service/Agency regulations.

SEE BLOCK 13 CONTINUATION

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to ISM requirements, are established for this contract. (If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the cognizant security office. Use Item 13 if additional space is needed.)

Yes No

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office. (If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.

Yes No

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL Winnetta J. McKasson winnetta.j.mckasson.civ@mail.mil

b. TITLE Command Industrial Security Specialist

Intelligence Security G2

c. TELEPHONE (Include Area Code)

4438616971

d. ADDRESS (Include ZIP Code) 17. REQUIRED DISTRIBUTION

HQ CECOM ATTN: AMSEL MI

a. CONTRACTOR

6002 Combat Drive D2101

Aberdeen Proving Ground, MD 21005

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

e. SIGNATURE

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHERS AS NECESSARY

DD Form 254 Reverse, DEC 1999

CONTRACT #

SOLICITATION # W56KGY-16-0023

APPENDIX D

SAFEGUARDING “FOR OFFICIAL USE ONLY” (FOUO) INFORMATION

Provided by the CECOM Director of Intelligence & Security/G2 (Updated: 14 July 2008)

Reference: AR 25-55, Chapter IV

1. The “FOR OFFICIAL USE ONLY” marking is assigned to information at the time of its creation in a DOD User Agency. It is not authorized as a substitute for a security classification marking but it is used on official Government Information that may be withheld from the public under exemptions 2 through 9 of the Freedom of Information Act.

2. Other non-security markings such as “Limited Official Use” and “Official Use Only” are used by non-DOD User Agencies for the same type of information and should be safeguarded and handled in accordance with instructions received from such agencies.

3. Use of the above markings does not mean that the information cannot be released to the public, only that it must be reviewed by the Government prior to its release, to determine whether a significant and legitimate Government purpose is served by withholding the information or portions of it.

4. IDENTIFICATION MARKINGS:

a. An unclassified document containing FOUO information shall be marked “For Official Use Only” in bold letters at least 3/16 of an inch high at the bottom of the front cover (if any), on each page containing FOUO information, and on the outside of the back cover (if any). No portion marking will be shown.

b. Within a classified document, an individual page that contains both FOUO and classified information will be marked at the top and bottom with the highest security classification appearing on the page. If an individual portion contains FOUO information but no classified information, the portion will be marked ‘FOUO.’

c. Any “FOR OFFICIAL USE ONLY” information released to a contractor by a DOD User Agency is required to be marked with the following statement prior to transfer:

THIS DOCUMENT CONTAINS INFORMATION EXEMPT FROM MANDATORY DISCLOSURE UNDER THE

FOIA. EXEMPTIONS APPLY.

d. Removal of the “FOR OFFICIAL USE ONLY” marking can only be accomplished by the originator or other competent authority. When “FOR OFFICIAL USE ONLY” status is terminated, all known holders will be notified to the extent possible.

5. DISSEMINATION: Contractors may disseminate “FOR OFFICIAL USE ONLY” information to their employees and subcontractors who have a need for the information in connection with a classified contract.

6. STORAGE: During normal working hours “FOR OFFICIAL USE ONLY” information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for the information. During non-working hours, the information shall be stored to preclude unauthorized access. Filing such material with other unclassified records in unlocked files or desks is adequate when internal building security is provided during non-working hours. When such internal security control is not exercised, locked buildings or rooms will provide adequate after hours protection or the material can be stored in locked receptacles such as file cabinets, desks or bookcases.

7. TRANSMISSION: “FOR OFFICIAL USE ONLY” information may be sent via first-class mail or parcel post. Bulky shipments may be sent fourth-class mail.

8. DISPOSITION: When no longer needed, FOUO information may be disposed of by tearing each copy into pieces to preclude reconstructing, and placing it in a trash container or as directed by the User Agency.

9. UNAUTHORIZED DISCLOSURE: Unauthorized disclosure of “FOR OFFICIAL USE ONLY” information does not constitute a security violation but the releasing agency should be informed of any unauthorized disclosure. The unauthorized disclosure of FOUO information protected by the Privacy Act may result in criminal sanctions.

10. Point of contact is CECOM Director of Intelligence & Security/G2, ATTN: AMSEL-MI.

CONTRACT #TBD

SOLICITATION # W56KGY‐16‐R‐0023

DD 254 BLOCK 13 CONTINUATION SHEET

10j. Safeguarding "For Official Use Only” (FOUO) information, Appendix D. FOUO Information generated and/or provided under this contract shall be safeguarded and marked as specified in AR 25-55 and DoD 5200.1-M (Marking is in Volume 2).

10k. Contractor requires access to NIPRNet, and Security/Program Classification Guidance will be provided by the government installation that the contractor is performing work for, within 10 working days from date of request from contractor.

11c. Contractor is authorized to receive and generate classified material at the contractors facility documents and/or hardware).The contractor requires access to classified source data up to and including, Secret, in support of the work effort. Any extracts or use of such data requires the contractor to apply derivative classifications and markings consistent with the source documents. Use of “Multiple Sources” on the “Derived From” line necessitates compliance with the NISPOM, paragraph 4-208a, and the use of a bibliography. Contractor will also follow guidance set forth within the Security Classification Guide (SCG). SCGs be will identified on the specific task order DD Form 254.

Contractor will follow the guidelines of Chapters 4 and 5 for proper handling of classified information.

11d. The Contractor must provide adequate storage at their facility for classified hardware to the level of SECRET

11j. OPSEC requirements are IAW AR 530-1, Chapter 6 as listed in the PWS CDRL # A002.

11l. IT Sensitive Duties Required (See Block 13, Item 13a).

13a. Contractor personnel performing IT sensitive duties are subject to investigative and assignment requirements IAW AR 25-2, AR 380-67, DoD 8570.0 and affiliated regulations. Army regulation available at www.apd.army.mil.

13b. Foreign subcontractors, foreign vendors and/or visitors that are not cleared US Companies, participating in Army foreign disclosure issues will be handled in accordance with AR 380-10, Foreign Disclosure and Contacts with Foreign Representatives, dated 4 DEC 2013.

All disclosures (i.e., oral, visual, briefing, documents) to foreign nationals require prior approval by the foreign disclosure officer.

All requests for non-US cleared Foreign subcontractor and/or Foreign own companies to perform on this contract must be requested from the Prime Contract to the KO through Program Office and approved by Foreign Disclosure Officer.

13c. Classified information will be protected IAW the NISPOM, Chapter 5. All security incidents involving classified information will be reported to the CECOM G2 Industrial Security Office, and DSS Industrial Security Representative. Information will be forwarded to KO and the PM for a program damage assessment to be conducted IAW AR 380-49

13d. All subcontractor DD Form 254s and subcontractor tier DD Form 254s will be sent to the KO. Any Contractors/subcontractors owned by Foreign Companies and that have a clearance issued by the Defense Security Service under a Special Security Agreement need to have a National Interest Determination (NID) approved if access is required to: Secret; COMSEC; Restricted Data; SCI and/or SAP. NID requirements and justification must be sent through CECOM G2 to be forwarded to the approving agencies.

Only after a NID approval is received will a FOCI contracting firm be authorized to work on the program.

CONTRACT #TBD

SOLICITATION # W56KGY‐16‐R‐0023

DD 254 BLOCK 13 CONTINUATION SHEET

13e. Security Training and Briefing: IAW AR 380-49 Chapter 3, the FSO will provide Threat Awareness and Reporting Program (TARP) training in addition to initial and refresher security training IAW AR 381-12, paragraph 1-14 and Chapter 2 for contractors working in contractor facilities. Contractors may be exempt from such security training if they can provide documentation they have had similar training from their FSO. The FSO will forward Certificates and/or a signed Letter of Certification for Training to the COR for verification of required training to be included in the contract folder.

�Integrated/embedded contractors will receive security training from the assigned CECOM Security Manager/Representative. Some Security training provided to integrated/embedded contractors will include:

--TARP Training: Live training provided by 902d

– Annual training requirement --Initial Security Orientation: Online training available on the Army Learning Management System (ALMS) site, reference ALARACT 207-2103 – Initial training --Annual Security Orientation: Online training available on the Army Learning Management System (ALMS) site, reference ALARACT 207-2103 – Annual training requirement --Derivative Classification Training, reference DoD 5200.01-V3-Biennial training requirement --Operations Security Training, reference AR 530-1 --Annual training requirement --Foreign travel training, AR 525-13 – Required when traveling abroad

The previous listing includes some training requirements that are provided. Any training requirements that the installation or tenant facilities require of the contractors must be added to the DD 254 and the security section of the contract document.

AR 380-49 Chapter 3

13f. The contractor must submit subcontracts to DD Form 254’s to the KO for the contract file and forward to CECOM G2 for review to insure Army requirements flow down to the subcontractor.

13g. All Facility Clearance sponsorships for subcontractors must have Government approval and certification on the subcontractor’s DD Form 254. Submit all requests to the CECOM G2 Industrial Security.

13h. Records of security related training of contractors and imbedded contractors must be available for review.

Certification and Signature: Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

Vincent Santorelli Program Analyst/COR (443)861‐6872 December 7, 2015

E-Signed by SANTORELLI.VI VERIFY authenticity with