ATTACHMENT_02_MISTE_BASE_DD_FORM_254_FINAL.PDF

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

DD Form 254 – Item 13 Continuation Sheet Contract Number: W900KK-19-R-0006

ITEM 13 SECURITY GUIDANCE:

The following items apply to this contract.

GENERAL GUIDANCE:

1. The contractor and subcontractor(s) shall comply with the Security Agreement (DD

Form 441) and following Security Regulations (DoDM 5200.01 Volumes 1 thru 4), DoD Information Security Program, (DoD 5220.22-M w/change 2) National Industrial Security Program Operating Manual (NISPOM), AR 25-2 Information Assurance, AR 380-5 Information Security, AR 380-49 Industrial Security, AR 380-10 current versions and affiliated regulations.

2. The contractor and subcontractor employees requiring access to DoD government or DoD contractor's facilities where proof of a security clearance is required, shall meet the security access requirements specified by the host and/or owner of those facilities.

3. The Prime contractor and subcontractor companies that are Foreign company and or USA Foreign Owned, Controlled or Influenced (FOCI) will not be allowed access to Classified or Controlled Unclassified Information (CUI) which includes International Trafficking in Arms Regulations (ITAR) or the Export Administration Regulations (EAR) defense articles. The Foreign company and or USA FOCI company must meet the mitigation requirements of DoD 5220.22M w/change 2 National Industrial Security Program Operating Manual (NISPOM) and AR 380-49 Chapter 2 Section I and II, see reference Item 11l below.

4. The contractor is not authorized to disclose or release collateral Classified Military Information (CMI) information to the public. Disclosure or release is not authorized to other DoD organizations or agencies without review and written approval from the Requiring Activity KO, COR, Cognizant Security Office.

a. The contractor is not authorized to disclose or release Controlled Unclassified Information (CUI) Technical Data and Critical Program Information (CPI) pertaining to this contract to the public without prior review and approval from the government Public Affairs Officer, Contracting Officer Representative (COR), and Requiring Activity Cognizant Security Office. Requests for disclosure or release shall be submitted 10 working days in advance to the address specified in block 12.

b. The contractor is not authorized to disclose or release any program Classified Military Information (CMI) Controlled Unclassified Information (CUI) Technical Data or Critical Program Information (CPI) Export Controlled Information pertaining to this contract to any Foreign Nationals or Foreign Representatives without prior review and approval from the government Contracting Officer (KO), Contracting Officers Representative (COR) and Requiring Activity Cognizant Security Office, Foreign Disclosure Officer (FDO). Requests for disclosure or release shall be submitted 10 working days in advance to the address specified in block 17a of the DD254.

5. The Contractor shall only issue security clearances to employees requiring access to classified information with a Need-to-Know.

a. For collateral security clearances and access the contractor shall follow the

Security guidelines established in DoD 5220.22M and the Defense Security Services (DSS) Facility Security Officer Toolkit located at https://www.cdse.edu/toolkits/fsos/index.php

b. Contractors who do not require a security clearance but require a government

Common Access Card (CAC) must have a Tier 2S security investigation and follow the credentialing requirements of this contract!

6. The contractor and subcontractors shall ensure that all Classified information, Controlled Unclassified Information (CUI), Controlled Technical Information (CTI) documents, data and or export controlled information; is marked, handled and safeguarded with the appropriate security classification, distribution statement(s) and export control warning statement in accordance with DoDD 5230.24, DoD 5220.22-M w/change 2) National Industrial Security Program Operating Manual (NISPOM and DoDM 5200.01 Vol 1, 2, 3 and 4.

7. The Prime contractor is responsible for issuing all subcontractor DD Form 254 for any classified work or material that the subcontractor will have access to during this contract per chapter 7 of current version of DoD 5220.22M and AR 380-49.

a. The prime contractor FSO will sign DD Form 254, block 17h and ensure that program, and/or Army activity points of contact information are included on DD Form 254, block 13.

b. The prime contractor FSO will provide the KO and/or COR with a copy of all subcontract DD Form 254s to be attached to the prime contract. The KO and/or COR will provide a copy of all subcontract DD Form 254’s to the ISS and DSS.

8. There are no security classification guides (SCGs) which are directly applicable to this effort. If, during this effort, it becomes necessary to create a security classification Reference (SCR) the contractor shall notify the contract officer representative who will seek the assistance and appropriate guidance from the local government ISSM, PM and Requiring Activity Cognizant Security Office.

9. Contractors who work in a DoD or Contractor cleared facility on DA installations and or government leased facilities and who are embedded or integrated within a DA program or activity, shall report all adverse information, suspicious contacts, and other reportable incidents to the local security office.

10. The contractor and their subcontractors shall immediately report any loss, compromise, suspected compromise of classified information or any security violations which occur on this contract per DoD 5220.22–M with current changes, to their Facility Security Manager (FSO) and local DSS office. The contractor shall also inform the KO, COR, and the ISS.

11. The contractor shall ensure that all contract employees with security clearances meet the prescribed security training required by chapter 3 of DoD 5220.22M, paragraph 1-14 of AR 381-12 and the Defense Security Services (DSS) Facility Security Officer Toolkit located at https://www.cdse.edu/toolkits/fsos/index.php. New contractor personnel assigned duties related to the contractor shall receive training within 30 days on their assignment.

12. The contractor and their subcontractors will designate in writing a U.S. citizen (not a dual citizen) as the Insider Threat program official per paragraph 1-202 of DoD 5220.22M w/change 2. All contractors with security clearances shall comply with Insider Threat Training requirements per paragraph 3-103 of DoD 5220.22M w/change 2. Additionally the contractor shall report threat-related incidents, behavioral indicators to the Requiring Activity Cognizant Security Office. Insider Threat training information can be found at the following DSS site https://www.cdse.edu/

13. The contractor shall mark and protect all Controlled Unclassified Information (CUI) which includes Official Use Only (FOUO) Information generated and/or provided under this contract per DoD 5200.01-V04.

14. The contractor and subcontractors shall ensure that all contract employees with security clearances meet the prescribed security training required by chapter 3 of DoD 5220.22M, paragraph 1-14. New contractor personnel assigned duties related to the contractor shall receive training within 30 days on their assignment.

ITEM 10:

Ref Item 10.e(2): INTELLIGENCE INFORMATION (NON-SCI) - Non-SCI Information is not releasable to contractor employees who have not received a clearance at the appropriate security level. Written concurrence of the KO is required prior to subcontracting. Access to Intelligence information required for the performance of this contract.

Ref Item 10.j: CONTROLLED UNCLASSIFIED INFORMATION (CUI) - For Controlled Unclassified Information (CUI) which includes Official Use Only (FOUO) Information generated and/or provided under this contract shall be safeguarded and marked as specified in DoD 5200.01-V04.

ITEM 11:

Ref Item 11.l: RECEIVE, STORE OR GENERATE CONTROLLED UNCLASSIFIED INFORMATION (CUI) – The contractor and all subcontractors personnel must protect CUI material and information in accordance with DoDM 5200.01 vol 4.

Ref Item 11.M: The prime and subcontractors who have access to Controlled Unclassified Information, software, technical data and export controlled documents must be aware of their responsibility to protect this information in accordance with DoDM 5200.01 Vol 4. Only those contractors having access to classified networks, software, information and technical data must have a valid security clearance and need-to-know. Both instance must be in accordance with the current version of DoDM 5200.01 Vol 4 and DoD 5220.22-M w/change 2 National Industrial Security Program Operating Manual (NISPOM).

a. In the case of classified material with employees with dual citizenship, Foreign companies and or USA FOCI companies;

· No dual citizenship individual, Foreign or USA FOCI companies are allowed on this contract until their Foreign and or USA FOCI status has been verified and mitigated by the CSA ISS and DSS.

· No classified information shall be provided to an individual of dual citizenship or, Foreign or USA FOCI company until the CSA, FDO has provide foreign disclosure determination and or DDL based of the Foreign and or USA FOCI country status.

· Prime and subcontractor dual citizens and or Foreign and or USA FOCI Company must provide a copy of the appropriate U.S. State Department documentation Technical Assistance Agreement (TAA) and or DSP-5 license authorizing the Foreign and or USA FOCI Company the ability to receive such materials or other licenses may be required based on the extent of the foreign involvement.

· Prime and subcontractor must provide a Technology Control Plan (TCP) to the KO and CSA ISS showing how data, information will be handled and distributed.

· If Individuals with dual citizenship only, have a current security investigation and security clearance, they are approved to work on this contract.

If the dual citizenship, Foreign and or USA FOCI has been mitigated, ITAR and EAR licensing validated, TCP provided and foreign disclosure approved, the appropriate and favorable security guidance will be provided. If the above has not met, they will not be allowed access to any classified information on this contract.

b. In the case of Controlled Unclassified Information (CUI), Unclassified Technical Information (CTI) or Export Controlled Information with an individual with dual citizenship, Foreign and or USA FOCI company;

Individuals with dual citizenship, Foreign and or USA FOCI Company will not have access to unclassified Technical information marked distribution B through F, FOUO, ITAR Defense Articles and EAR technology which are controlled by either the ITAR or the Export Administration Regulations (EAR), unless the prime and subcontractors provide a copy of the appropriate U.S. State Department Technical Assistance Agreement (TAA) and or DSP-5 license authorizing Individuals with dual citizenship Foreign and or USA FOCI Company that ability to receive such materials to the KO and CSA. Other licenses may be required based on the extent of the foreign involvement.

Ref Item 11.M: All contractor personnel must be US citizens, contractors with dual citizenship are only authorized access to collateral classified information only and must be aware of and meet the guidelines of the Department of the Army Security Executive Agent Directive 4 (attached) monitored by the company FSO / CSSO . Individuals who have access to software and technical data must have the appropriate security clearance in accordance with the current version of DoD 5220.22-M w current changes and DoDM 5105.21 Vol1-3.

DD Form 254 – FOUO Sheet Contract Number: W900KK-19-R-0006

“FOR OFFICIAL USE ONLY” ATTACHMENT

PROTECTING "FOR OFFICIAL USE ONLY" (FOUO) INFORMATION

1. GENERAL:

a. The "For Official Use Only" (FOUO) marking is assigned to information at the time of its creation in a DoD User Agency. It is not authorized as a substitute for a security classification marking but is used on official government information that may be withheld from the public under exemptions 2 through 9 of the Freedom of Information Act (FOIA).

b. Other non-security markings, such as "Limited Official Use" and "Official Use Only" are used by non-DoD User Agencies for the same type of information and should be safeguarded and handled in accordance with instruction received from such agencies.

c. Use of the above markings does not mean that the information cannot be released to the public under FOIA, only that the Government must review the information prior to its release to determine whether a significant and legitimate government purpose is served by withholding the information or portions thereof.

2. MARKINGS:

a. An unclassified document containing FOUO information will be marked "For Official Use Only" at the bottom of the front cover (if any), on the first page, on each page containing FOUO information, on the back page, and on the outside of the back cover (if any).

b. Within a classified document, an individual page that contains both FOUO and classified information will be marked at the top and bottom with the highest security classification of information appearing on the page. If an individual portion contains FOUO information but no classified information, the portion will be marked, "FOUO."

c. Any "'For Official Use Only" information released to a contractor by a DoD User Agency is required to be marked with the following statement prior to transfer.

“This document contains information EXEMPT FROM

MANDATORY DISCLOSURE UNDER THE FOIA.

Exemption 5 applies.”

d. Removal of the "For Official Use Only" marking can only be accomplished by the originator or other competent authority. When the "For Official Use Only" status is terminated, all known holders will be notified to the extent practical.

3. DISSEMINATION: Contractors may disseminate "For Official Use Only" information to their employees and subcontractors who have a need for the information in connection with a classified contract. Contractors must ensure employees and subcontractors are aware of the special handling instructions detailed below.

4. STORAGE: During working hours, "For Official Use Only" information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for the information. During nonworking hours, the information shall be stored to preclude unauthorized access. Filing such material with other unclassified records in unlocked files or desks, is adequate when internal building security is provided during nonworking hours. When such internal security control is not exercised, locked buildings or rooms will provide adequate after- hours protection or the material can be stored in locked receptacles such as file cabinets, desks, or bookcases.

5. TRANSMISSION: "For Official Use Only" information may be sent via first-class mail or parcel post. Bulky shipments may be sent by fourth-class mail. DoD components, officials of DoD components, and authorized DoD contractors, consultants, and grantees send FOUO information to each other to conduct official DoD business. Tell recipients the status of such information, and send the material in a way that prevents unauthorized public disclosure. Make sure documents that transmit FOUO material call attention to any FOUO attachments. Normally, you may send FOUO records over facsimile equipment. To prevent unauthorized disclosure, consider attaching special cover sheets, the location of sending and receiving machines, and whether authorized personnel are around to receive FOUO information. FOUO information may be passed to officials in other departments and agencies of the executive and judicial branches to fulfill a government function. Mark the records "For Official Use Only" and tell the recipient the information is exempt from public disclosure under the FOIA and requires special handling.

6. DISPOSITION: When no longer needed, FOUO information must be shredded.

7. UNAUTHORIZED DISCLOSURE: Unauthorized disclosure of "For Official Use Only" information does not constitute a security violation but the releasing agency should be informed of any unauthorized disclosure. The unauthorized disclosure of FOUO information protected by the Privacy Act may result in criminal sanctions and disciplinary action may be taken against those responsible.

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of AEM LiveCycle Designer

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

October 31, 2020 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, DoD Contract Security Classification Specification List of Attachments [2] (All Files Must be Attached Prior to Signing, i.e., for any digital signature on the form) Item 13 Security Guidance.docx FOUO Attachment ver 01.doc

PEO STRI PAO, 12211 Science Dr Orlando, FL 32826

12211 Science Dr Orlando, FL 32826 Address: PEO STRI G2 12211 Science Dr Orlando, FL 32816