Attachment_2_DD254_2_DEC_19.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of

DD FORM 254, MAY 2019

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

20220531 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, DoD Contract Security Classification Specification whs.mc-alex.esd.mbx.formswebmaster@mail.mil

WHS

List of Attachments (All Files Must be Attached Prior to Signing, i.e., for any digital signature on the form)

HHC ASG-KU S2

APO, AE 09366

This effort shall provide TSS as well as I/O & M of TADSS, fixed ranges, deployable ranges, and numerous training facilities within the ARCENT AO. TSS will primarily be conducted at the URC, the ARTC, and the TSC’s but services can be executed at any location within with the USCENTCOM AOR.

PEO STRI PAO, 12211 Science Dr Orlando, FL 32826

See Item 13 Security Guidance and FOUO information below.

The Government Project Manager’s/Director’s working in conjunction with the Contracting/Agreement Officer of this effort will coordinate with the cognizant security office for ensuring vendor/contractor compliance with the security terms of the DD 254 blocks 10,11,12,13,14 and addendum sheets. The government PM/PD’s will monitor and verify the vendor/contractor’s security responsibilities during the life of the contract/agreement and the PEO STRI Industrial Security Specialist will coordinate with the KO/AO, COR when conducting site security inspections of the vendor/contractor facility in accordance with AR 380-49, Army Industrial Security.

11. The vendor/contractor and sub-vendor/contractor(s) shall comply with the Security Agreement (DD Form 441) and following Security Regulations (DoDM 5200.01 Volumes 1 thru 4), DoD Information Security Program, (DoD 5220.22-M w/change 2) National Industrial Security Program Operating Manual (NISPOM), AR 25-2 Information Assurance, AR 380-5 Information Security, AR 380-49 Industrial Security, AR 380-10 current versions and affiliated regulations.

2. The vendor/contractor and sub-vendor/contractor employees requiring access to DoD government or DoD vendor/contractor's facilities where proof of a security clearance is required, shall meet the security access requirements specified by the host and/or owner of those facilities.

3. The prime vendor/contractor and sub-vendor/contractor companies that are Foreign company and or USA Foreign Owned, Controlled or Influenced (FOCI) will not be allowed access to Classified or Controlled Unclassified Information (CUI) which includes International Trafficking in Arms Regulations (ITAR) or the Export Administration Regulations (EAR) defense articles unless the Foreign company and or USA FOCI company meets the mitigation requirements of DoD 5220.22M w/change 2 National Industrial Security Program Operating Manual (NISPOM) and AR 380-49 Chapter 2 Section I and II, see reference Item 11M below.

4. The vendor/contractor is not authorized to disclose or release collateral Classified Military Information (CMI) information to the public. Disclosure or release is not authorized to other DoD organizations or agencies without review and written approval from the Requiring Activity AO/KO, AOR/COR, or Cognizant Security Office.

a. The vendor/contractor is not authorized to disclose or release Controlled Unclassified Information (CUI) Technical Data and Critical Program Information (CPI) pertaining to this agreement/contract to the public without prior review and approval from the government Public Affairs Officer, Agreement/Contracting Officer Representative (AOR/COR), and Requiring Activity Cognizant Security Office. Requests for disclosure or release shall be submitted 10 working days in advance to the address specified in block 12.

b. The vendor/contractor is not authorized to disclose or release any program Classified Military Information (CMI) Controlled Unclassified Information (CUI) Technical Data or Critical Program Information (CPI) Export Controlled Information pertaining to this contract to any Foreign Nationals or Foreign Representatives without prior review and approval from the government Agreement/Contracting Officer (AO/KO), Agreement/Contracting Officers Representative (AOR/COR) and Requiring Activity Cognizant Security Office, Foreign Disclosure Officer (FDO). Requests for disclosure or release shall be submitted 10 working days in advance to the address specified in block 17a of the DD254.

5. The Vendor/Contractor shall only issue security clearances to employees requiring access to classified information with a Need-to-Know.

a. For collateral security clearances and access the vendor/contractor shall follow the Security guidelines established in DoD 5220.22M and the Defense Security Services (DSS) Facility Security Officer Toolkit located at https://www.cdse.edu/toolkits/fsos/index.php

b. Vendor/Contractors who do not require a security clearance but require a government Common Access Card (CAC) must have a Tier 2S security investigation and follow the credentialing requirements of this contract!

6. The vendor/contractor and sub-vendor/contractors shall ensure that all Classified information, Controlled Unclassified Information (CUI), Controlled Technical Information (CTI) documents, data and or export controlled information; is marked, handled and safeguarded with the appropriate security classification, distribution statement(s) and export control warning statement in accordance with DoDD 5230.24, DoD 5220.22-M w/change 2) National Industrial Security Program Operating Manual (NISPOM and DoDM 5200.01 Vol 1, 2, 3 and 4.

7. The prime vendor/contractor is responsible for issuing all sub-vendor/contractor DD Form 254 for any classified work or material that the sub-vendor/contractor will have access to during this contract per chapter 7 of current version of DoD 5220.22M and AR 380-49.

a. The prime vendor/contractor FSO will sign DD Form 254, block 17h and ensure that program, and/or Army activity points of contact information are included on DD Form 254, block 13.

b. The prime vendor/contractor FSO will provide the AO/KO and/or AOR/COR with a copy of all sub-vendor/contract DD Form 254s to be attached to the prime agreement/contract. The AO/KO and/or AOR/COR or AO and/or AOR will provide a copy of all sub-agreement/contract DD Form 254’s to the ISS and DSS.

c. The prime vendor/contractor shall not issue Unclassified Technical Data to a Foreign or USA FOCI company unless the requirements of 11M has been met! Also the prime vendor/contractor shall not issue a DD254 to a Foreign or USA FOCI Company without the written authority from the Requiring Activity Cognizant Security Office first.

8. There is no security classification guides (SCGs) which are directly applicable to this effort. If, during this effort, it becomes necessary to create a security classification Reference (SCR) the contractor shall notify the contract officer representative who will seek the assistance and appropriate guidance from the local government ISSM, PM and Requiring Activity Cognizant Security Office.

9. Vendors/Contractors who work in a DoD or Vendor/Contractor cleared facility on DA installations and or government leased facilities and who are embedded or integrated within a DA program or activity, shall report all adverse information, suspicious contacts, and other reportable incidents to the local security office.

10. The Vendor/contractor and their sub-vendor/contractors shall immediately report any loss, compromise, suspected compromise of classified information or any security violations which occur on this contract per DoD 5220.22–M with current changes, to their Facility Security Manager (FSO) and local DSS office. The vendor/contractor shall also inform the AO/KO, AOR/COR, and the ISS.

11. The vendor/contractor shall ensure that all employees with security clearances meet the prescribed security training required by chapter 3 of DoD 5220.22M, paragraph 1-14 of AR 381-12 and the Defense Security Services (DSS) Facility Security Officer Toolkit located at https://www.cdse.edu/toolkits/fsos/index.php. New vendor/contractor personnel assigned duties related to the vendor/contractor shall receive training within 30 days on their assignment.

12. The vendor/contractor and their sub-vendor/contractors will designate in writing a U.S. citizen (not a dual citizen) as the Insider Threat program official per paragraph 1-202 of DoD 5220.22M w/change 2. All vendor/contractors with security clearances shall comply with Insider Threat Training requirements per paragraph 3-103 of DoD 5220.22M w/change 2. Additionally the vendor/contractor shall report threat-related incidents, behavioral indicators to the Requiring Activity Cognizant Security Office. Insider Threat training information can be found at the following DSS site https://www.cdse.edu/

13. The vendor/contractor shall mark and protect all Controlled Unclassified Information (CUI) which includes Official Use Only (FOUO) Information generated and/or provided under this agreement/contract per DoD 5200.01-V04.

14. The vendor/contractor and sub-vendor/contractors shall ensure that all contract employees with security clearances meet the annual security training required by DoD 5220.22M, NISPOM, AR 380-5 and AR 381-12;

• Insider Threat Training

• Security Refresher Training

• AT Level 1 Training

• TARP Training

• OPSEC Training

New vendor/contractor personnel assigned duties related to this agreement/contract shall receive training within 30 days on their assignment.

ITEM 10:

Ref Item 10.j: CONTROLLED UNCLASSIFIED INFORMATION (CUI) - For Controlled Unclassified Information (CUI) which includes Official Use Only (FOUO) Information generated and/or provided under this contract shall be safeguarded and marked as specified in DoD 5200.01-V04.

ITEM 11:

Ref Item 11e: PERFORM SERVICES ONLY - This agreement/contract is for professional, technical, and administrative support provide TSS as well as I/O & M of TADSS, fixed ranges, deployable ranges, and numerous training facilities within the ARCENT AO. The vendor/contractor will work in contractor and/or DoD cleared facilities. Classification markings and distribution statements on any material to be furnished will be provided by the agreement/contract logistics personnel and site security guidance necessary for the performance of the agreement/contract.

Ref Item 11.l: RECEIVE, STORE OR GENERATE CONTROLLED UNCLASSIFIED INFORMATION (CUI) – The vendor/contractor and all sub-vendor/contractors personnel must protect CUI material and information in accordance with DoDM 5200.01 vol 4.

Ref Item 11.M: Dual Citizens The vendor FSO must maintain a list of all dual citizen employees and provide that list upon inspection from DSS or the cognizant security authority ISS. Vendor employees who are dual citizens and have access to software and technical data must have the appropriate security clearance in accordance with the current version of DoD 5220.22-M w current changes.

Ref Item 11.M: USA FOCI Vendors/Contractors – All USA FOCI vendor/contractor (prime or sub) not mitigated by DSS with a valid FCL and SSA, will not be granted access to any classified or Unclassified Technical Data/Information to include Export Controlled Data/Information unless they have met all of the Security and State Department licensing requirements listed in the and PEO STRI Vendor/Contractor Vetting Process which is attached.

“FOR OFFICIAL USE ONLY” ATTACHMENT

PROTECTING "FOR OFFICIAL USE ONLY" (FOUO) INFORMATION

1. GENERAL:

a. The "For Official Use Only" (FOUO) marking is assigned to information at the time of its creation in a DoD User Agency. It is not authorized as a substitute for a security classification marking but is used on official government information that may be withheld from the public under exemptions 2 through 9 of the Freedom of Information Act (FOIA).

b. Other non-security markings, such as "Limited Official Use" and "Official Use Only" are used by non-DoD User Agencies for the same type of information and should be safeguarded and handled in accordance with instruction received from such agencies.

c. Use of the above markings does not mean that the information cannot be released to the public under FOIA, only that the Government must review the information prior to its release to determine whether a significant and legitimate government purpose is served by withholding the information or portions thereof.

2. MARKINGS:

a. An unclassified document containing FOUO information will be marked "For Official Use Only" at the bottom of the front cover (if any), on the first page, on each page containing FOUO information, on the back page, and on the outside of the back cover (if any).

b. Within a classified document, an individual page that contains both FOUO and classified information will be marked at the top and bottom with the highest security classification of information appearing on the page. If an individual portion contains FOUO information but no classified information, the portion will be marked, "FOUO."

c. Any "'For Official Use Only" information released to a contractor by a DoD User Agency is required to be marked with the following statement prior to transfer.

“This document contains information EXEMPT FROM

MANDATORY DISCLOSURE UNDER THE FOIA.

Exemption 5 applies.”

d. Removal of the "For Official Use Only" marking can only be accomplished by the originator or other competent authority. When the "For Official Use Only" status is terminated, all known holders will be notified to the extent practical.

3. DISSEMINATION: Vendors/Contractors may disseminate "For Official Use Only" information to their employees and sub-vendor/contractors who have a need for the information in connection with a classified contract. Vendors/Contractors must ensure employees and sub-vendor/contractors are aware of the special handling instructions detailed below.

4. STORAGE: During working hours, "For Official Use Only" information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for the information. During nonworking hours, the information shall be stored to preclude unauthorized access. Filing such material with other unclassified records in unlocked files or desks, is adequate when internal building security is provided during nonworking hours. When such internal security control is not exercised, locked buildings or rooms will provide adequate after- hours protection or the material can be stored in locked receptacles such as file cabinets, desks, or bookcases.

5. TRANSMISSION: "For Official Use Only" information may be sent via first-class mail or parcel post. Bulky shipments may be sent by fourth-class mail. DoD components, officials of DoD components, and authorized DoD vendor/contractors, consultants, and grantees send FOUO information to each other to conduct official DoD business. Tell recipients the status of such information, and send the material in a way that prevents unauthorized public disclosure. Make sure documents that transmit FOUO material call attention to any FOUO attachments. Normally, you may send FOUO records over facsimile equipment. To prevent unauthorized disclosure, consider attaching special cover sheets, the location of sending and receiving machines, and whether authorized personnel are around to receive FOUO information. FOUO information may be passed to officials in other departments and agencies of the executive and judicial branches to fulfill a government function. Mark the records "For Official Use Only" and tell the recipient the information is exempt from public disclosure under the FOIA and requires special handling.

6. DISPOSITION: When no longer needed, FOUO information must be shredded.

7. UNAUTHORIZED DISCLOSURE: Unauthorized disclosure of "For Official Use Only" information does not constitute a security violation but the releasing agency should be informed of any unauthorized disclosure. The unauthorized disclosure of FOUO information protected by the Privacy Act may result in criminal sanctions and disciplinary action may be taken against those responsible.

Orlando, FL 32828 Address: PEO STRI G2 12211 Science Dr Orlando, FL 32836