Attachment_4_-_DD_254.pdf

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(Please read Instructions BEFORE completing this application.) (The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires October 31, 2020

The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.) 3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. LEVEL OF FACILITY SECURITY CLEARANCE (FCL) REQUIRED (See instructions.)

b. LEVEL OF SAFEGUARDING FOR CLASSIFIED INFORMATION/MATERIAL

REQUIRED AT CONTRACTOR FACILITY

Top Secret None (See instructions)

DUE DATE (YYYYMMDD)

W900KK-18-R-0018

c. SOLICITATION OR OTHER NUMBER✖

b. SUBCONTRACT NUMBER

a. PRIME CONTRACT NUMBER (See instructions.)

DATE (YYYYMMDD)

c. FINAL (Complete Item 5 in all cases.)

DATE (YYYYMMDD)REVISION NO.b. REVISED (Supersedes all previous specifications.)

20180215

DATE (YYYYMMDD)

a. ORIGINAL (Complete date in all cases.)✖

(Preceding Contract Number) is transferred to this follow-on contract. Classified material received or generated under

YES. If Yes, complete the following:✖NO4. IS THIS A FOLLOW-ON CONTRACT?

, retention of the classified material is authorized for the period of: In response to the contractor's request dated

YES. If Yes, complete the following:✖NO5. IS THIS A FINAL DD FORM 254?

TBD

c. COGNIZANT SECURITY OFFICE (CSO) (Name, Address, ZIP Code, Telephone)

TBD

b. CAGE CODE

TBD

a. NAME, ADDRESS, AND ZIP CODE

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code.)

c. COGNIZANT SECURITY OFFICE(S) (CSOs) (Name, Address, ZIP Code, Telephone)

b. CAGE CODEa. NAME, ADDRESS, AND ZIP CODE

7. SUBCONTRACTOR(S) (Click button to add more subcontractors.)

TBD

c. COGNIZANT SECURITY OFFICE(S) (CSOs) (Name, Address, ZIP Code, Telephone) (If applicable, see instructions.)

TBD

b. CAGE CODE (If applicable, see instructions.)

TBD

a. LOCATION(S) (For actual performance, see instructions.)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

This Performance of work defines the effort required for integrated operation, maintenance and technical services to support testing and training of US Army Weapon Systems. The support services will primarily be provided at White Sands Missile Range and Threat Systems Management Office (TSMO) at Redstone Arsenal AL. This requirement includes providing all management, labor and support services to maintain and operate electronic Warfare (EW) simulators and threat Information Operations (IO) environments for testing and training in live, virtual and constructive environments.

9. GENERAL UNCLASSIFIED DESCRIPTION OF THIS PROCUREMENT (Click here if more space is needed.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

✖ a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION

d. FORMERLY RESTRICTED DATA

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION (CNWDI) (If CNWDI applies, RESTRICTED DATA must also be marked.)

b. RESTRICTED DATA ✖

✖e. NATIONAL INTELLIGENCE INFORMATION:

f. SPECIAL ACCESS PROGRAM (SAP) INFORMATION

k. OTHER (Specify) (See instructions.)

j. CONTROLLED UNCLASSIFIED INFORMATION (CUI) (See instructions.)

i. ALTERNATIVE COMPENSATORY CONTROL MEASURES (ACCM)

INFORMATION

h. FOREIGN GOVERMENT INFORMATION

g. NORTH ATLANTIC TREATY ORGANIZATION (NATO) INFORMATION

DD FORM 254, NOV 2017 PREVIOUS EDITION IS OBSOLETE. Adobe LiveCycle Designer ES4

Add More Items

Add More Items

Add Page

(1) Sensitive Compartmented Information (SCI)

(2) Non-SCI

Delete Page

Remove

Remove

CLASSIFICATION (When filled in):

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER CONTRACTOR'S FACILITY OR A GOVERNMENT ACTIVITY (Applicable only if there is no access or storage required at contractor facility. See instructions.)

h. REQUIRE A COMSEC ACCOUNT

k. BE AUTHORIZED TO USE DEFENSE COURIERS

j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS✖

i. HAVE A TEMPEST REQUIREMENT

b. RECEIVE AND STORE CLASSIFIED DOCUMENTS ONLY

c. RECEIVE, STORE, AND GENERATE CLASSIFIED INFORMATION OR

MATERIAL

f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL

INFORMATION CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION

CENTER

e. PERFORM SERVICES ONLY

d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE l. RECEIVE, STORE, OR GENERATE CONTROLLED UNCLASSIFIED

INFORMATION (CUI).

(DoD Components: refer to DoDM 5200.01, Volume 4 only for specific CUI protection requirements. Non-DoD Components: see instructions.)

SEE SECTION 13 AND PWS

m. OTHER (Specify) (See instructions)

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address.

(See instructions)

DIRECT

No Public release of program information allowed under this contract.

Written requests for releases of information must be submitted to the CM for coordination with PEO STRAPAO at RSA, AL, Director, TSMO, Attn:

SFAE-STRI-PMITTS-S, Bldg 4497, Redstone Arsenal, AL 35898-7461.

THROUGH (Specify)✖ PUBLIC RELEASE AUTHORITY:

13. SECURITY GUIDANCE. The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes;

to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. Click button to add additional pages as needed to provide complete guidance.)

RICHARD A. JODOIN, ACOR/TECHNICAL MONITOR CONCURRENCE

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

Yes✖No (If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. Use Item 13 or click button if additional space is needed.)

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the CSO.

(If Yes, explain and identify specific areas and government activity responsible for inspections. Click button or use Item 13 if additional space is needed.)

YesNo ✖

SEE ADDENDUM IN BLOCK 13/PWS THAT WAS SENT

SEE ADDENDUM IN BLOCK 13/PWS THAT WAS SENT

256-876-8624

e. POC TELEPHONE (Include Area Code.)

richard.a.jodoin.civ@mail.mil

f. EMAIL ADDRESS (See instructions.)

b. ACTIVITY ADDRESS CODE (AAC) OF THE CONTRACTING OFFICE (See instructions.)

d. AAC OF THE CONTRACTING OFFICE (See instructions.)

e. CAGE CODE OF THE PRIME CONTRACTOR (See instructions.)

Jodoin Richard A.

d. POC NAME (See instructions.)

Attn: SFAE -STRI-PMITTS-S Bldg 4497 Digney Road Redstone Arsenal, AL 35898

c. ADDRESS (Include ZIP Code.)

Director, Threat Systems Management Office (TSMO)

a. GCA NAME

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

17. CERTIFICATION AND SIGNATURES. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL (Last, First, Middle Initial) (See instructions.)

Vital, Terry D.

256-876-8624

f. TELEPHONE (Include Area Code.)

terry.d.vital.civ@mail.mil

g. EMAIL ADDRESS (See instructions.) i. SIGNATUREh. DATE

Security Manager

b. TITLE Attn: SFAE -STRI-PMITTS-S Bldg 4497 Digney Road Redstone Arsenal, AL 35898

c. ADDRESS (Include ZIP Code.)

2018-02-15

f. OTHERS AS NECESSARY (If more room is needed, continue in Item 13 or on additional page if necessary.)✖

e. ADMINISTRATIVE CONTRACTING OFFICER✖

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR✖

b. SUBCONTRACTOR

a. CONTRACTOR✖

DD FORM 254 (BACK), NOV 2017

Add Page

CLASSIFICATION (When filled in):

SIGNATURE

Add Attachment View Selected Attachment Remove Selected Attachment

Add Page

Delete Page

Delete Page

Delete Page

Add Page

15. INSPECTIONS (Continued)

14. ADDITIONAL SECURITY REQUIREMENTS (Continued)

13. SECURITY GUIDANCE (Continued)

PagesofContinuation PageDD FORM 254, NOV 2017 New Page

Additional persons assisting with completion of form (signatures and titles)

Delete Page

BLOCK 13 CONTINUATION SHEET

Reference/ AR 380-5, 525-13, 530-1, and 25-2 as applicable

TSMO Special Security Office (SSO) is Terry D. Vital 256-876-8624

TSMO Contract Monitor/Technical Monitor (CM/TM) is Richard A. Jodoin 256-876-8624

Period of Performance will be from the Date of Award

The contractor shall conform to the provisions of Intelligence Community Directive (ICD) 700 series, DoD 5220.22-M National Security Program Operating Manual (NISPOM); DoD 5220.22-R Industrial Security Regulation; DoD 5200.01-M Information Security Program; DoD 5105.21-M SCI Administrative Security Manual; DoD 5220.6 Defense Industrial Personnel Security Clearance Review Program; (ITAR) International Traffic Arms Regulations; Foreign Disclosure and contracts with Foreign Representatives IAW AR 380-10, DoD 5230.11, Disclosure of Classified Military Information to Foreign Governments and International Organizations, DoD 5230.20, Visits, Assignments, and Exchanges of Foreign Nationals. The Government CM/TM will provide the contractor access to all available Government furnished information, facilities, materiel, equipment, services, etc. as required. The contractor shall provide the appropriate documentation (e.g.non-disclosure, non-compete statements) when necessary to gain access to sensitive or “rights guarded” data. A secret level clearance shall be required for all personnel supporting this effort. Contractor personnel may be required to access, view, possess, process and / or use classified information, information systems and work spaces to successfully complete requirements under this contract. In some instances, the contractor may be required to handle/store Top Secret- Sensitive Compartmented Information (TS/SCI).

(10a) Classified COMSEC material is not releasable to contractor employees who have not received a FINAL clearance at the appropriate security level. COMSEC access shall b IAW DoD 5220.22-M and AR 380-40. When access is required at Government facilities, Contractor personnel will adhere to COMSEC rules and regulations as mandated by Command policy and procedures. Written concurrence of the KO is required prior to Subcontracting.

(10e) 1 SCI Access required. No public release of information authorized, public disclosure or confirmation of any subject related to the support contract is not authorized without first obtaining written approval from the KO

(10e) 2. Non-SCI information is not releasable to contractor employees who have not received a clearance at the appropriate security level. Written concurrences of the KO is required prior to subcontracting. Access to intelligence information required for performance.

(10g) Personnel not assigned to NATO staff position, but requiring access to NATO classified information, NATO COSMIC, NATO Secret or access to the NATO accredited SIPRNET terminals, must possess the equivalent FINAL or Interim U.S. Security Clearance based upon the appropriate Personnel security Investigation required. Personnel with access to NATO ATOMAL information must have the appropriate level FINAL U.S. Security Clearance. The government program/project manager is the designated representative that will ensure the contractor security manager and concerned employees are NATO briefed prior to access being granted. The contractor will maintain strict compliance in regards to NATO information IAW NISPOM Ch 10, Section 7. Prior approval from the KO is required for susbcontracting.

(10f) Discussion, storage , or processing of SAP information associated with this contract will be conducted in facilities specifically accredited by the Army SAPCP(or designee), or equivalent component-level SAPCO.

(10j) For Offical Use Only (FOUO) Information generated and/or provided under this contact shall be safeguarded and marked as specified in DoD 5200. 1-R, Appendix 3.

(10k) NIPRNet, SIPRNet, and JWICS access is required.

(11a) Contractor performance is restricted to (WSMR Building 90125 WSMR New Mexico 88002 and TSMO Building 4497 complex, Redstone Arsenal Al 35898-7461). Government agency or activity will provide security Classification guidance for performance of this contract. Submit visit request to the KO and/or Security Management Office for need-to-know verification.

(11j) The contractor must impose certain countermeasures directed to protect intelligence indicators. OPSEC requirements are additional to the requirements of the NISPOM. The prime contractors may not impose OPSEC requirements on their subcontractors unless the KO approves the OPSEC requirements with regards to AR 530-1 .

Addendum 1

COMSEC ACCESS AND/OR ACCOUNT

National Industrial Security Program Operating Manual (NISPOM), DOD 5220.22-M, governs the contractor. Access to COMSEC information or material is restricted to U.S. citizens holding final U.S. Government clearances and is not releasable to personnel holding only a reciprocal clearance. Personnel requiring COMSEC access shall be briefed in accordance with DOD 5220.22-M.

Note: The COMSEC briefing applies only to the use and control of cryptographic equipment and specialized COMSEC publications and/or information. Additionally COMSEC information or equipment must be retained in a contractor facility COMSEC account in accordance with DOD

5220.22-M and NSACSSM 3-16, Control of Communications Security (COMSEC) Material, dated August 5, 2005.

Addendum 2

STANDARD SCI INSTRUCTIONS

1. All SENSITIVE COMPARTMENTED INFORMATION (SCI) and material will be handled in accordance with special security requirements furnished by the responsible Special Security Office designated in Item 15.

2. SCI material will not be released to contractor employees without specific release approval of the TSMO CM or the originator for the material when applicable, based on prior approval and certification of "Need-to-Know" by the designated contract monitor listed below:

NAME: Richard A. Jodoin OFFICE Contract Monitor TSMO TELEPHONE (256) 876-8614

3. Inquiries pertaining to classification guidance of SCI will be directed to the responsible contractor monitor. Any SCI or SCI derived material generated under this contract will be reviewed by the contract monitor for proper classification prior to final publication and distribution. The responsible Special Security Office (SSO) designated in Item 15 of the DO Form 254 will provide assistance as required.

4. Upon completion of this contract all SCI material provided to or generated by the contractor will be returned to TRMC/TSMO. If the material has been superseded or is no longer applicable, TRMC SSO will provide disposition instructions to the Contractor Special Security Officer.

5. SCI material furnished in support of this contract remains the property of the DOD department, agency or command that releases it.

6. Contractors receiving SCI material will not release such to any activity or individual of the contractor or consultant organization not directly engaged in providing services under this contract without the consent of the sponsoring agency (which shall verify that a second contractor has a "need-to-know" and meets security requirements.)

7. Contractors or consultants will not reproduce any SCI without the permission of the sponsoring agency. Such material will be classified, controlled, and accounted for in the same manner as the originals.

8. SCI will not be released to non-US citizens whether or not they are also consultants, United States contractors, or employees thereof, regardless of the level of their security clearance, except with the permission of the originating agency.

Addendum 3

REQUIREMENTS FOR RELEASE OF CLASSIFIED INTELLIGENCE

1. Director of Intelligence is the Senior Intelligence Officer (SIO). The SIO is authorized to approve release of intelligence material to US Contractors. For this contract, classified intelligence can be released to this contractor at the program office level provided the proper security procedures are followed. This release does not include intelligence material marked Dissemination and Extraction of Information Controlled by Originator (ORCON), Proprietary Information (PROPIN), or where distribution statements preclude release without the originator's approval. For intelligence material marked ORCON, PROPIN, or where there is an originator controlled distribution statement, contact JCW/JIOR SSO for proper release procedures.

2. Contractors must return intelligence data to the Contracting Officer’s Representative (COR) at the termination or completion of a contract unless the COR has provided written approval for the contractor to retain for an additional two years. If retention is required beyond the two year period, the contractor must again request and receive written retention authority from the COR. Written approvals from the COR shall be provided to JCW/JIOR SSO.

3. The contractor must:

a. Maintain control of all classified intelligence released in her or his custody in accordance with DOD 5220.22-M. Contractor agrees that all intelligence materials released, all reproductions, and other materials generated (including reproductions) are the property of the US Government.

b. Maintain control of all reproduced intelligence data in the same manner as the original. c. Destroy intelligence materials in accordance with approved destruction methods.

d. Restrict access to only those individuals who possess the necessary security clearance and who are actually providing services under the contract. Further dissemination to other contractors, subcontractors, other government agencies, and private individuals or organizations is prohibited unless authorized by the COR.

e. Not release intelligence material to foreign nationals or immigrant aliens whether or not they are also consultants, US contractors, or employees of the contractor, and regardless of the level of their security clearance, except with advance written permission from the appropriate Foreign Disclosure Policy Office.

f. Ensure each employee having access to intelligence material is fully aware of the special security requirements for this material.

4. Clarification is provided as follows on what derivative classified intelligence is and dissemination of derivative classified intelligence:

a. Derivative classified intelligence is intelligence, which has been extracted out of an intelligence document and incorporated into a white paper, briefing, information report, working papers, or product to be delivered to the government in some form, or used in performance of the contract for the program office. For example, if an intelligence document is released to one of your contractors, the contractor could produce a briefing by extracting information out of the document, creating viewgraphs, and then presenting the briefing in support of the contract. Information from the same document could also be extracted to create a white paper or working papers to support the contract. Extraction of information out of the document could be:

(1) Reproducing a table, page(s), or other portions of the document,

(2) Entering the intelligence contained in the document into a word processor or data base, or authorized software package in support of the contract, or

(3) Hand-written notes

b. Dissemination. Dissemination of derivative classified intelligence will be for the SPO and contract use only. Derivative classified intelligence will not be transferred from one contract to another without COR approval, and will have access restricted to only those individuals who possess the necessary security clearance and who are actually providing services under the contract. Further dissemination to other contractors, subcontractors, consultants, and private individuals or organizations is prohibited unless authorized by the COR.

Addendum 4

SPECIAL ACCESS REQUIREMENTS/PROCEDURES

1. The contractor will identify a Special Access Security Manager responsible for managing all Special Access Programs. An appointment letter will be kept on file at the contractor's facility and provided to the appropriate Program Security Manager, as programs require use of the facility.

2. All Special Access information and materials will be handled in accordance with special security requirements furnished by the User Agency

Program/Project Special Security Manager.

3. Special Access material will not be released to contractor employees without specific release approval of the User Agency Program/Project

Special Security Manager.

4. Inquiries pertaining to classification guidance for Special Access Programs and materials will be directed to the User Agency Program/Project Special Security Manager. Any special access program derived material generated under this contract will be reviewed by the User Agency Program/Project Special Security Manager for proper classification prior to final publication and distribution.

5. Upon completion of this contract all Special Access Program information and materials provided to or generated by the contractor will be returned to the User Agency Program/Project Special Security Manager. If the material has been superseded or no longer applicable, the User Agency Program/Project Special Security Manager will provide disposition instructions to the Contractor Special Security Officer.

6. Special Access Program information or materials furnished in support of this contract remain the property of the DoD Department, agency or command that releases it.

Addendum 5

FOR OFFICIAL USE ONLY (FOUO) PROCEDURES

The following procedures will be used to protect FOR OFFICIAL USE ONLY (FOUO) material:

1. HANDLING: Access to FOUO material shall be limited to those employees needing the material to do their jobs. The FOUO marking is assigned to material created by a DoD user agency. FOUO is not a classification, but requires extra precaution to insure it is not released to the public.

2. MARKING: Mark unclassified documents containing FOUO; "FOR OFFICIAL USE ONLY" at the bottom of each page and back cover (if any). In a classified document, mark:

a. An individual paragraph that contains FOUO, but not classified material by placing "FOUO" at the beginning of the paragraph.

b. The top and bottom of each page that has both FOUO and classified material with the highest security classification of the material on that page.

c. "FOUO" at the bottom of each page that has FOUO but not classified material.

d. If a classified document also contains FOUO material or if the classified material becomes FOUO when declassified, place the following statement on the bottom of the cover or the first page under the classification marking: "NOTE: If declassified, review the document to make sure material is not FOUO and not exempt under DoD 5200.1 R before public release."

e. Mark other records such as computer print outs, photographs, films, tapes, or slides "FOR OFFICIAL USE ONLY" so the receiver or viewer knows the record contains FOUO material.

f. Mark each part of a message that contains FOUO material "Unclassified". Messages containing FOUO material must show the abbreviation

"FOUO" before the text begins.

g. Ensure documents that transmit FOUO material call attention to any FOUO attachments.

h. FOUO material released to a contractor by a DoD user agency must have the following statement on the front page or cover: "THIS DOCUMENT CONTAINS MATERIAL EXEMPT FROM MANDATORY DISCLOSURE UNDER THE FREEDOM OF INFORMATION ACT. EXEMPTION(S) APPLY."

3. STORAGE: During normal duty hours, place FOUO material in an out-of-sight location, if your work area is accessible to persons who do not have a valid need for the material. After normal duty hours, store FOUO material to prevent unauthorized access. File with other unclassified records in unlocked files or desks when internal building security is provided. When there is not internal security, locked buildings or rooms usually provide adequate after-hours protection. For additional protection, store FOUO material in locked container such as file cabinets, desks, or bookcases. Expenditure of funds for security container or close areas solely for the protection of FOUO material is prohibited.

4. TRANSMISSION: FOUO material shall be transmitted by the same methods as other unclassified material. Discussion of FOUO material on the telephone is authorized if necessary for the performance of the contract. FOUO material may be transmitted over telephone lines in digital form, by tele-copies, or by other DSN teletype lines without encryption.

5. RELEASE: FOUO material shall not be released outside the contractor's facility except to representatives of the DOD.

6. DESTRUCTION: When no longer needed, FOUO material shall be disposed of by a method that precludes its disclosure to unauthorized individuals.

Addendum 6

TEMPEST REQUIREMENTS

1. All TEMPEST requests and requirements must be completed and sent through appropriate SSAs and parent contracting authorities and the designated Certified TEMPEST Technical Authority (CTTA) within 30 days after contract award for all contracts where classified National Security Information (NSI) will be processed and the requirements of item 13 of the DD 254 have been met.

2. The prime contractor cannot pass TEMPEST requirements to subcontractors. Subcontractors must submit a Contractor TRQ prior to processing.

3. The TRQ is for information collection only. It is not a directive or an implied requirement, nor is it an encouragement to procure TEMPEST equipment or any type of shielding for use on this contract. DO NOT initiate any changes to equipment of facilities for TEMPEST unless it has been recommended by the CTTA and specifically directed by the contracting authority.

4. The contracting authority will not issue any directives concerning TEMPEST until after the contractor submitted TRQ has been evaluated by the CTTA and resulting recommendations received. To fully evaluate the TRQ, the CTTA may request additional information concerning the facility, its physical control, the equipment which will be used to process NSI, etc.

5. The contractor shall ensure compliance with any TEMPEST countermeasure(s) specifically directed in writing by the contracting authority.

6. The contractor shall provide the following information to the CTTA:

a. Name, address, position title and phone number (at the facility where classified processing will occur) of a point of contact who is knowledgeable of the processing requirements, the types of equipment to be used, and the physical layout of the facility.

b. Specific geographical location, address, and zip code, where classified processing will be performed.

c. Classification level(s) of material to be processed/handled by electronic or electromechanical information system(s) and what percentage is processed at each level.

d. Special categories of classified information are processed.

e. Whether there a direct connection (wireline or fiber) to a Radio Frequency (RF) transmitter(s) located either locally or at a remote site. f. Whether there are any RF transmitters located within 6 meters of the system processing NSI or the system’s RED signal lines.

g. Description of how access is controlled to your facility including the building, compound, plant, property, and/or parking lots. Identify where visitors are first challenged/identified. Include controls such as alarms, guards, patrols, fences, and warning signs. Provide a simple block diagram of the equipment, the facility, and the surrounding areas. The diagram(s) should extend out to the nearest uncontrolled area on each side of the facility, such as a military base perimeter, plant property line, commercial building or residential area.

h. Whether there are other tenants in the building who are not U.S. department/agents.

i. Identity of any known foreign business or government offices in adjacent buildings.

j. Make and model number of all equipment used to process, transfer, or store classified information. Include computers, peripherals, network hardware, multiplexors, modems, encryption devices (COMSEC), etc.

k. Whether on-site TEMPEST tests been conducted on any of these equipment(s)? If so, identify which test(s) and equipment; when test(s) were conducted; who conducted the test(s); and the status of the resolution of all deficiencies.

l. Whether a TEMPEST Facility Zoning test been conducted. If so, identify who conducted the testing and when. m. Whether the company is foreign-owned or controlled. If so, identify the country.

n. Contract number, sponsoring command and Contracting Officer’s Representative point of contacts, and their telephone numbers.

Addendum 7

OPERATIONS SECURITY REQUIREMENTS

1. All OPSEC work will be performed in accordance with appropriate DoD guidance and Servicing Security Agencies, DoD and Navy Operations

Security (OPSEC) requirements, per the following applicable documents:

- National Security Decision Directive 298 - National Operations Security Program (NSDD) 298

- DOD 5205.02 - DOD Operations Security (OPSEC) Program

- OPNAVINST 3432.1 - DON Operations Security

- SPAWARINST 3432.1 - Operations Security Policy

2. The contractor will accomplish the following minimum requirements in support of TSMO, TRMC and SSAs OPSEC, accordingly:

a. The contractor will practice OPSEC and implement OPSEC countermeasures to protect DOD Critical Information. Items of Critical Information are those facts, which individually, or in the aggregate, reveal sensitive details about TSMO/TRMC, NCR and SSAs or the contractor’s security or operations related to the support or performance of this SOW, and thus require a level of protection from adversarial collection or exploitation not normally afforded to unclassified information.

b. Contractor must protect Critical Information and other sensitive unclassified information and activities, especially those activities or information which could compromise classified information or operations, or degrade the planning and execution of military operations performed or supported by the contractor in support of the mission. Protection of Critical Information will include the adherence to and execution of countermeasures which the contractor is notified by or provided by TSMO, TRMC and SSASs for Critical Information on or related to the SOW. c. Sensitive unclassified information is that information marked FOR OFFICIAL USE ONLY (or FOUO), Privacy Act of 1974, COMPANY

PROPRIETARY, and also information as identified by TSMO, TRMC and SSAs.

d. The following items are identified as Critical Information that may be related to this SOW:

(1) Known or probable vulnerabilities to any U.S. system and their direct support systems.

(2) Details of capabilities or limitations of any U.S. system that reveal or could reveal known or probable vulnerabilities of any U.S. system and their direct support systems.

(3) Details of information about military operations, missions and exercises.

(4) Details of U.S. systems supporting combat operations (numbers of systems deployed, deployment timelines, locations, effectiveness, unique capabilities, etc.).

(5) Operational characteristics for new or modified weapon systems (Probability of Kill (Pk), Countermeasures, Survivability, etc.). (6) Required performance characteristics of U.S. systems using leading edge or greater technology (new, modified or existing).

(7) Telemetered or data-linked data or information from which operational characteristics can be inferred or derived.

(8) Test or evaluation information pertaining to schedules of events during which Critical Information might be captured (advance greater than 3 days).

(9) Details of TSMO, NCR, JIOR and SSAs unique Test or Evaluation capabilities (disclosure of unique capabilities).

(10) Existence and/or details of intrusions into or attacks against DoD Networks or Information Systems, including, but not limited to, tactics, techniques and procedures used, network vulnerabilities exploited, and data targeted for exploitation.

(11) Network User IDs and Passwords.

(12) Counter-IED capabilities and characteristics, including success or failure rates, damage assessments, advancements to existing or new capabilities.

(13) Vulnerabilities in Command processes, disclosure of which could allow someone to circumvent security, financial, personnel safety, or operations procedures.

(14) Force Protection specific capabilities or response protocols (timelines/equipment/numbers of personnel/training received/etc.). (15) Command leadership and VIP agendas, reservations, plans/routes etc.

(16) Detailed facility maps or installation overhead photography (photo with annotation of Command areas or greater resolution than commercially available).

(17) Details of TSMO, NCR, JIOR, SSAs, and COOP, emergency evacuation procedures, or emergency recall procedures.

(18) Government personnel information that would reveal force structure and readiness (such as recall rosters or deployment lists). (19) Compilations of information that directly disclose Command Critical Information.

e. The above Critical Information and any that the contractor develops, regardless if in electronic or hardcopy form, must be protected by a minimum of the following countermeasures:

(1) All emails containing Critical Information must be DoD Public Key Infrastructure (PKI) signed and PKI encrypted when sent.

(2) Critical Information may not be sent via unclassified fax.

(3) Critical Information may not be discussed via non-secure phones.

(4) Critical Information may not be provided to individuals that do not have a need to know it in order to complete their assigned duties. (5) Critical Information may not be disposed of in recycle bins or trash containers.

(6) Critical Information may not be left unattended in uncontrolled areas.

(7) Critical Information in general should be treated with the same care as FOUO or proprietary information. (8) Critical Information must be destroyed in the same manner as FOUO.

(9) Critical Information must be destroyed at contract termination or returned to the government at the government’s discretion.

f. The contractor shall document items of Critical Information that are applicable to contractor operations involving information on or related to the SOW. Such determinations of Critical Information will be completed using the DoD OPSEC 5 step process as described in National Security Decision Directive (NSDD) 298, “National Operations Security Program”.

g. OPSEC training must be included as part of the contractor’s ongoing security awareness program conducted in accordance with Chapter

3, Section 1, of the NISPOM. NSDD 298, DoD 5205.02, SSAs and OPNAVINST 3432.1, “Operations Security” should be used to assist in creation or management of training curriculum.

DD254 SCI ADDENDUM

US ARMY SCI ADDENDUM TO DD FORM 254, HC1028-08-D-2023-0048

XXX (1) This contract requires access to Sensitive Compartmented Information (SCI). The Commander, US Army Intelligence and Security Command (INSCOM), acting on behalf of the DA Deputy Chief of Staff (DCS), G-2 as the Cognizant Security Authority (CSA) for the US Army, has exclusive security responsibility for all SCI released to the contractor or developed under the contract and held within the Contractor's SCI Facility (SCIF) or Co-utilization Agreement (CUA) SCIF. The Defense Intelligence Agency (DIA) has security inspection responsibility for SCI and the Defense Security Service (DSS) retains responsibility for all collateral information released or developed under the contract and held within the DoD Contractor's SCIF. The manuals, regulations and directives checked below provide the necessary guidance for physical, personnel, and information security for safeguarding SCI, and are part of the security classification specification for this contract:

XXX DoD 5105.21-M-1, SCI Security Manual, Administrative Security

XXX ICD-503 Intelligence Community Information Technology Systems Security Risk Management, Certification And Accreditiation

XXX ICS 705-1 Intelligence Community Standards for Sensitive Compartmented Information Facilties

DIAM 50-4, DoD Intelligence Information System.

DIAM 50-24, Security for Using Communications Equipment in a SCIF.

xxx AR 380-19, Information System Security

XXX AR 380-28, DA Special Security System

XXX AR 380-381, Special Access Programs (SAPS).

XXX Army Handbook for SCI Contracts.

___Other 5220.22M and supplements

XXX (2) Contract estimated completion date: TBD (NOTE: Section “F” of the contract normally provides the Period of Performance. Option years are not to be included, as an option is not valid until exercised by the government.)

XXX (3) The name, telephone number, email address of the Contract Monitor (CM) for the SCI portion of this contract is: Joel Palmer, (256) 313-6766,joel.e.palmer.civ@mail.mil The Security POC & phone number and email address at the contractor’s location is TBD (The Contract Monitor and contractor security officer must be registered in ACAVS in order to process SCI actions.)

XXX (4) All DD Forms 254 prepared for subcontracts involving access to SCI under this contract must be forwarded to the CM for approval and then to HQ INSCOM, ACofS Security, G2, Contractor Support Element (CSE) for review and concurrence prior to award of the subcontract.

XXX (5) The contractor will submit the request for SCI visit certifications through the CM for approval of the visit. The certification request must arrive at the Contractor Support Element at least ten (10) working days prior to the visit.

XXX (6) The contractor will not reproduce any SCI related material without prior written permission of the CM.

_____(7) Security Classification Guides or extracts are attached or will be provided under separate cover.

_____ (8) Electronic processing of SCI requires accreditation of the equipment in accordance with ICD 503(Note: Check only if item 11l indicates that a requirement exists for SCI AIS processing.)

XXX (9) This contract requires a contractor SCIF.

XXX (10) This contract requires X (SI) X (TK) X (G) X (HCS) X (SAP, AR 380-381)

XXX (11) The contractor will perform SCI work under this contract at the following locations: Threat System Management office, (TSMO) BLDG 4459 Digney Road, Redstone Arsenal AL 35898-7461, also collateral work at WSMR, BLDG 90125,WSMR New Mexico 88002 and various other locations as directed by the CM.

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(Please read Instructions BEFORE completing this application.) (The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires October 31, 2020 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. LEVEL OF FACILITY SECURITY CLEARANCE (FCL) REQUIRED (See instructions.)

b. LEVEL OF SAFEGUARDING FOR CLASSIFIED INFORMATION/MATERIAL REQUIRED AT CONTRACTOR FACILITY

DUE DATE (YYYYMMDD)

c. SOLICITATION OR OTHER NUMBER

b. SUBCONTRACT NUMBER

a. PRIME CONTRACT NUMBER (See instructions.)

DATE (YYYYMMDD)

c. FINAL (Complete Item 5 in all cases.)

DATE (YYYYMMDD)

REVISION NO.

b. REVISED (Supersedes all previous specifications.)

DATE (YYYYMMDD)

a. ORIGINAL (Complete date in all cases.)

(Preceding Contract Number) is transferred to this follow-on contract.

Classified material received or generated under YES. If Yes, complete the following:

NO

4. IS THIS A FOLLOW-ON CONTRACT?

, retention of the classified material is authorized for the period of:

In response to the contractor's request dated YES. If Yes, complete the following:

NO

5. IS THIS A FINAL DD FORM 254?

c. COGNIZANT SECURITY OFFICE (CSO) (Name, Address, ZIP Code, Telephone)

b. CAGE CODE

a. NAME, ADDRESS, AND ZIP CODE

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code.)

c. COGNIZANT SECURITY OFFICE(S) (CSOs) (Name, Address, ZIP Code, Telephone)

b. CAGE CODE

a. NAME, ADDRESS, AND ZIP CODE

7. SUBCONTRACTOR(S) (Click button to add more subcontractors.)

c. COGNIZANT SECURITY OFFICE(S) (CSOs) (Name, Address, ZIP Code, Telephone) (If applicable, see instructions.)

b. CAGE CODE (If applicable, see instructions.)

a. LOCATION(S) (For actual performance, see instructions.)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

9. GENERAL UNCLASSIFIED DESCRIPTION OF THIS PROCUREMENT (Click here if more space is needed.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION

d. FORMERLY RESTRICTED DATA

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION (CNWDI) (If CNWDI applies, RESTRICTED DATA must also be marked.)

b. RESTRICTED DATA

e. NATIONAL INTELLIGENCE INFORMATION:

f. SPECIAL ACCESS PROGRAM (SAP) INFORMATION

k. OTHER (Specify) (See instructions.)

j. CONTROLLED UNCLASSIFIED INFORMATION (CUI) (See instructions.)

i. ALTERNATIVE COMPENSATORY CONTROL MEASURES (ACCM) INFORMATION

h. FOREIGN GOVERMENT INFORMATION

g. NORTH ATLANTIC TREATY ORGANIZATION (NATO) INFORMATION

DD FORM 254, NOV 2017

PREVIOUS EDITION IS OBSOLETE.

Adobe LiveCycle Designer ES4

(1) Sensitive Compartmented Information (SCI)

(2) Non-SCI CLASSIFICATION (When filled in):

CLASSIFICATION (When filled in):

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER CONTRACTOR'S FACILITY OR A GOVERNMENT ACTIVITY (Applicable only if there is no access or storage required at contractor facility. See instructions.)

h. REQUIRE A COMSEC ACCOUNT

k. BE AUTHORIZED TO USE DEFENSE COURIERS

j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

i. HAVE A TEMPEST REQUIREMENT

b. RECEIVE AND STORE CLASSIFIED DOCUMENTS ONLY

c. RECEIVE, STORE, AND GENERATE CLASSIFIED INFORMATION OR MATERIAL

f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL INFORMATION CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

e. PERFORM SERVICES ONLY

d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

l. RECEIVE, STORE, OR GENERATE CONTROLLED UNCLASSIFIED

INFORMATION (CUI).

(DoD Components: refer to DoDM 5200.01, Volume 4 only for specific CUI protection requirements. Non-DoD Components: see instructions.)

m. OTHER (Specify) (See instructions)

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address.

(See instructions)

DIRECT

THROUGH (Specify)

PUBLIC RELEASE AUTHORITY:

13. SECURITY GUIDANCE. The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes;

to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. Click button to add additional pages as needed to provide complete guidance.)

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

Yes No (If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. Use Item 13 or click button if additional space is needed.)

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the CSO.

(If Yes, explain and identify specific areas and government activity responsible for inspections. Click button or use Item 13 if additional space is needed.)

Yes No

e. POC TELEPHONE (Include Area Code.)

f. EMAIL ADDRESS (See instructions.)

b. ACTIVITY ADDRESS CODE (AAC) OF THE CONTRACTING OFFICE (See instructions.)

d. AAC OF THE CONTRACTING OFFICE (See instructions.)

e. CAGE CODE OF THE PRIME CONTRACTOR (See instructions.)

d. POC NAME (See instructions.)

c. ADDRESS (Include ZIP Code.)

a. GCA NAME

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

17. CERTIFICATION AND SIGNATURES. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL (Last, First, Middle Initial) (See instructions.)

f. TELEPHONE (Include Area Code.)

g. EMAIL ADDRESS (See instructions.)

i. SIGNATURE

h. DATE

b. TITLE

c. ADDRESS (Include ZIP Code.)

f. OTHERS AS NECESSARY (If more room is needed, continue in Item 13 or on additional page if necessary.)

e. ADMINISTRATIVE CONTRACTING OFFICER

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

b. SUBCONTRACTOR

a. CONTRACTOR

DD FORM 254 (BACK), NOV 2017

CLASSIFICATION (When filled in):

CLASSIFICATION (When filled in):

c. COGNIZANT SECURITY OFFICE(S) (Name, Address, ZIP Code, Telephone)

b. CAGE CODE

a. NAME, ADDRESS, AND ZIP CODE

7. SUBCONTRACTOR(S) (Continued)

c. COGNIZANT SECURITY OFFICE(S) (Name, Address, ZIP Code, Telephone)

b. CAGE CODE

a. NAME, ADDRESS, AND ZIP CODE

c. COGNIZANT SECURITY OFFICE(S) (Name, Address, ZIP Code, Telephone)

b. CAGE CODE

a. NAME, ADDRESS, AND ZIP CODE

c. COGNIZANT SECURITY OFFICE(S) (Name, Address, ZIP Code, Telephone)

b. CAGE CODE

a. NAME, ADDRESS, AND ZIP CODE

c. COGNIZANT SECURITY OFFICE(S) (Name, Address, ZIP Code, Telephone)

b. CAGE CODE

a. LOCATION(S) (For actual performance, see instructions.)

c. COGNIZANT SECURITY OFFICE(S) (Name, Address, ZIP Code, Telephone)

b. CAGE CODE

a. LOCATION(S) (For actual performance, see instructions.)

c. COGNIZANT SECURITY OFFICE(S) (Name, Address, ZIP Code, Telephone)

b. CAGE CODE

a. LOCATION(S) (For actual performance, see instructions.)

c. COGNIZANT SECURITY OFFICE(S) (Name, Address, ZIP Code, Telephone)

b.…