W900KK23R0005_Attach_03_CBID_III_DD254_20221104.pdf

CLASSIFICATION (When filled in): Unclassified

DEPARTMENT OF DEFENSE 0MB No. 0704-0567

CONTRACT SECURITY CLASSIFICATION SPECIFICATION 0MB approval expires:

(The requirements of the National Industrial Security Program (NISPJ apply to all security aspects of this effort involving classified information.) May 31, 2022

The public reporting burden for this collection of infonnation, 0704--0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of infonnation. Send comments regarding this burden estimate or any other aspect of this collection of infonnation, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-<lod-infonnation-eollections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of infonnation if it does not display a currently valid 0MB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

a. LEVEL OF FACILITY SECURITY CLEARANCE (FCL) REQUIRED b. LEVEL OF SAFEGUARDING FOR CLASSIFIED INFORMATION/ (See Instructions) MATERIAL REQUIRED AT CONTRACTOR FACILITY

Secret None (See instructions)

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.) 3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. PRIME CONTRACT NUMBER (See instructions.)

� a. ORIGINAL (Complete date in all cases.)

DATE (YYYYMMDD)

b. SUBCONTRACT NUMBER b. REVISED (Supersedes all previous specifications.)

□ REVISION NO. DATE (YYYYMMDDJ

c. SOLICITATION OR OTHER NUMBER DUE DATE (YYYYMMDDJ

� W900KK-23-R-0005

c. FINAL (Complete Item 5 in all cases.) DATE (YYYYMMDDJ

4. IS THIS A FOLLOW-ON CONTRACT? 0 No � Yes If yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254? � No D Yes If yes, complete the following:

In response to the contractor's request dated , retention of the classified material is authorized for the period of:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO)

PLANNING PURPOSES ONLY (Name, Address, ZIP Code, Telephone required; Email Address optional)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors

- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

a. LOCATION(S) (For actual performance, see instructions.) b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO)

PLANNING PURPOSES ONLY (ff applicable, (Name, Address, ZIP Code, Telephone required; Email Address optional) see Instructions.}

9. GENERAL UNCLASSIFIED DESCRIPTION OF THIS PROCUREMENT

This acquisition is to establish the Computer Based Instructional Development (CBID) III, Indefinite Quantity/Indefinite Delivery (ID/IQ) is an open competition for a Service-Disabled Veteran-Owned Small Business Set-Aside contract for the development of Interactive Multi-

Media Instruction (IMl) courseware in support of the Program Executive Office for Simulation, Training, and Instrumentation (PEO STRI), the Department of Defense (DOD), military service and other DOD and non DOD agencies. Contractor personnel supporting this contract may require access to controlled data to include classified documents up to and including Secret level of classification.

DD FORM 254, APR 2018 PREVIOUS EDITION IS OBSOLETE.

CLASSIFICATION (When filled in): Unclassified

AEM LiveCycle Designer

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

0 a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION

0 b. RESTRICTED DATA

□ c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION (CNWDI) (If CNWDI applies, RESTRICTED DA TA must a/so be marked.)

0 d. FORMERLY RESTRICTED DATA

e. NATIONAL INTELLIGENCE INFORMATION:

D (1) Sensitive Compartmented lnfonnation (SCI)

[gj (2) Non-SCI

0 f. SPECIAL ACCESS PROGRAM (SAP) INFORMATION

□ g. NORTH ATLANTIC TREATY ORGANIZATION

(NATO) INFORMATION

0 h. FOREIGN GOVERMENT INFORMATION

□ i. ALTERNATIVE COMPENSATORY CONTROL MEASURES

(ACCM) INFORMATION

[gj j. CONTROLLED UNCLASSIFIED INFORMATION (CUI) (See instructions.)

[gl k. OTHER (Specify) (See instructions.)

May require access to SIPRnet

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT

ANOTHER CONTRACTOR'S FACILITY OR A GOVERNMENT

0 ACTIVITY

{Applicable only if there is no access or storage required at contractor facility.

See instructions.)

0 b. RECEIVE AND STORE CLASSIFIED DOCUMENTS ONLY

□ c. RECEIVE, STORE, AND GENERATE CLASSIFIED

INFORMATION OR MATERIAL

0 d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

[gj e. PERFORM SERVICES ONLY

f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE

0 THE U.S.,PUERTO RICO, U.S. POSSESSIONS AND TRUST

TERRITORIES

12. PUBLIC RELEASE

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE

0 TECHNICAL INFORMATION CENTER (DTIC) OR OTHER

SECONDARY DISTRIBUTION CENTER

0 h. REQUIRE A COMSEC ACCOUNT

0 i. HAVE A TEMPEST REQUIREMENT

0 j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

0 k. BE AUTHORIZED TO USE DEFENSE COURIER SERVICE

I. RECEIVE, STORE, OR GENERATE CONTROLLED UNCLASSIFIED

[gj INFORMATION (CUI).

(DoD Components: refer to DoDM 5200.01, Volume 4 only for specific CUI protection requirements. Non-DoD Components: see instructions.)

[gl m. OTHER (Specify) (See instructions.)

No US FOCI companies or Foreign persons are allowed to work on this contract

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority.

Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

D DIRECT IZ] THROUGH {Specify below) Public Release Authority:

ACC Orlando, 12211 Science Dr Orlando, FL 32826 PM ST, OPSEC Off, 12211 Science Dr Orlando, FL

PEO STRI PAO, 12211 Science Dr Orlando, FL 32826

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract;

and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. A/so a/lows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

"The undersigned has reviewed this Security Specification and understands the provisions herein. The undersigned will ensure compliance with the provisions within the limits of his/her responsibility. Furthermore the undersigned will report any security incidents to the supporting Security Manager, ISS and KO".

ITEM 13 SECURITY GUIDANCE:

The following items apply to this contract.

GENERAL GUIDANCE:

1. The contractor and subcontractor(s) shall comply with the Security Agreement (DD Form 441) and following Security Regulations

(DoDM 5200.01 Volumes 1 thru 3), 32 CFR part 117 NISPOM Rule, DoDI 5200.48 Controlled Unclassified Information (CUI), AR 25-2

Information Assurance, AR 380-5 Information Security, AR 380-49 Industrial Security, AR 380-10 current versions and affiliated

DD FORM 254, APR 2018 PREVIOUS EDITION IS OBSOLETE.

CLASSIFICATION (When filled in): Unclassified regu1at10ns.

2. This DD254 only supports the base IDIQ contract! All other contract or delivery orders outside the scope of this contract and in support of other service components, government agencies and external organizations to PEO STRI must have their requiring activity security office develop their specific DD254 to support their contract effort.

3. The contractor and subcontractor employees requiring access to DoD government or DoD contractor's facilities where proof of a security clearance is required, shall meet the security access requirements specified by the host and/or owner of those facilities.

4. Any prime contractors to include subcontractors that are USA Foreign Owned, Controlled and Influenced (FOCI) company who poses a valid FCL issued by the Defense Counterintelligence Security Agency (DCSA) under a Special Security Agreement (SSA) are not allowed to work on this contract.

5. The contractor is not authorized to disclose or release collateral Classified Military Information (CMI) information to the public.

a. The contractor is not authorized to disclose or release Controlled Unclassified Information (CUI) pertaining to this contract to the public without prior review and approval from the Requiring Activity OPSEC Officer, Legal and Public Affairs Officer. Requests for disclosure or release shall be submitted 10 working days in advance to the address specified in block 12.

6. The contractor shall only issue security clearances to those employees who meet the personal security requirements stated in 32 CFR part

117.10 NISPOM Rule and who require access to classified information based on a Need-to-Know.

a. For collateral security clearances and access the contractor shall follow the Security guidelines established in 32 CFR part 117 .10

NISPOM Rule and the Defense Counterintelligence Security Agency (DCSA) Facility Security Officer Toolkit located at https:// www .cdse.edu/toolkits/fsos/index. php

b. Contractors who do not require a security clearance but require a government Common Access Card (CAC) must have a Tier 1 security investigation and follow the credentialing requirements of this contract!

7. The contractor and subcontractors shall ensure that all Classified information, Controlled Unclassified Information (CUI), Controlled

Technical Information (CTI) documents, data and or export controlled information; is marked, handled and safeguarded with the appropriate security classification, distribution statement(s) and export control warning statement in accordance with DoDD 5230.24, 32

CFR part 117.15 NISPOM Rule, DoDI 5200.48, and DoDM 5200.01 Vol 1, 2 and 3.

a. The contractor and subcontractors shall NOT ACCEPT any Documents, data or information from any source including the government requiring activity unless the documents, data or information is marked as stated in paragraph 7!

8. The prime contractor is responsible for vetting all subcontractors for eligibility, suitability and FOCI prior to issuing a subcontractor DD

Form 254, 32 CFR part 117.17 NISPOM Rule and AR 380-49. The prime contractor shall issue the PEO STRI vendor vetting process letter to all subcontractors to fill out and respond to.

a. The prime contractor shall follow DCSA sponsorship procedures (if required) only to those not cleared Subcontractor for a FCL who require access to classified data/information for this contract. The government nor the prime contractor shall incur any cost in this process.

b. The prime contractor FSO will provide the KO and/or COR with a copy of all subcontract DD Form 254s to be attached to the prime contract. The KO and/or COR will provide a copy of all subcontract DD Form 254's to the ISS and DCSA.

9. The Contractor shall comply with FAR 52.204-2 "Security Requirements". This clause involves access to information classified

"Confidential," "Secret," or "Top Secret". The Contractor shall comply with (1) Security Agreement (DoD Form 441), including the 32

CFR part 117 NISPOM Rule.

10. If work on this contract requires a security classification guide(s) (SC Gs) which are directly applicable to this effort the contractor shall notify the contract officer representative who will seek the assistance and appropriate guidance from the local government ISSM, PM and

Requiring Activity Cognizant Security Office.

11. The Contractors who work in a DoD or Contractor cleared facility on DA installations and or government leased facilities and who are embedded or integrated within a DA program or activity, shall report all adverse information, suspicious contacts, and other reportable incidents to the local security office.

12. The contractor and their subcontractors shall immediately report any loss, compromise, suspected compromise of classified information

DD FORM 254, APR 2018 PREVIOUS EDITION IS OBSOLETE.

CLASSIFICATION (When filled in): Unclassified

Page3of11 or any secunty v101ations whlch occur on this contract per j� cFR part 117 .IS( ct) NI:sPuM Rule to therr Fac111ty :secunty Manager v•:su) and local DCSA office. The contractor shall also inform the KO, COR, and the ISS.

13. The contractor and their subcontractors will designate in writing a U.S. citizen (not a dual citizen) as the Insider Threat program official per 32 CFR part 117.12(g). All vendor/contractors with security clearances shall comply with Insider Threat Training requirements per 32

CFR part 117.12(g). Additionally the vendor/contractor shall report threat-related incidents, behavioral indicators to the Requiring Activity

Cognizant Security Office. Insider Threat training information can be found at the following DCSA site https://www.cdse.edu/

14. The prime contractor and subcontractors shall ensure that all contract employees with security clearances meet the annual security training required by 32 CFR part 117.12, DoDI 5200.48, AR 380-5 and AR 381-12;

REQUIRED ANNUAL SECURITY TRAINING

The contractor shall read and execute the below listed annual security training requirements for only those employees who have security clearances and access to CUI on this contract;

Threat Awareness Reporting Program (TARP)

All contractors and subcontractors with security clearances must receive annual Threat Awareness and Reporting Program (TARP) training per AR 381-12. The training should be provided by a CI agent or other trainer as specified in 2-4b and chapter 3 AR 381-12

The Contractor shall ensure its employees report threat-related incidents, behavioral indicators, and other matters of CI interest specified in the AR 381-12, to their FSO and the PEO STRI G2 Office, the nearest military CI office, the Federal Bureau oflnvestigation, or the

Defense Security Service.

OPSEC Awareness Training.

Per AR 530-1 Operations Security, the contractor employees working on this contract must complete Level I OPSEC Awareness training.

New employees must be trained within 30 calendar days of their start date on this contract and annually thereafter. OPSEC Awareness training information and materials are available at https://www.cdse.edu/catalog/elearning/GS130.html

Insider Threat Training

The contractor and their subcontractors will designate in writing a U.S. citizen as the Insider Threat program official per 32 CFR part

117 .12(g) NISPOM Rule. All contractors shall comply with Insider Threat Training requirements per 32 CFR part 117 .12(g) NISPOM

Rule. Insider threat program information and materials are available at https://www.cdse.edu/catalog/elearning/INT101.html.

DoD Annual Security Awareness Refresher Training

All contractor employees working on this contract with a security clearances must complete the annual security awareness refresher training. New employees must complete the initial security training and the security awareness refresher training annually thereafter. This training refreshes the employee's basic understanding of initial security training requirements outlined in DoDM 5200.01 Volume 3, 32

CFR part 117.12 and other applicable policies and regulations. This training is available at https://www.cdse.edu/catalog/elearning/

IF142.html

Controlled Unclassified Information Training

This contract contains CUI, all contractors shall have only those employees who handle CUI take annual CDSE CUI Training required for all DoD and Industrial personnel with access to controlled unclassified information. New employees must complete this training 30 day from start day of the contract. No CAC or password needed the training website also provides a resource tab which lists regulations, policies and more information on the subject. https://securityhub.usalearning.gov/index.html

Unauthorized Disclosure of Classified Information for DoD and Industry

Contractor employees working on this contract with security clearances must complete the annual Unauthorized Disclosure of Classified

Information for DoD and Industry training. New employees must complete this training 30 day from start day of the contract. This training provides an overview of what unauthorized disclosure is, including specific types of unauthorized disclosure and some common misconceptions about unauthorized disclosure, the types of damage caused by unauthorized disclosure and the various sanctions one could face if caught engaging in unauthorized disclosure. This training is available at https://jkodirect.jten.mil/Atlas2/page/login/Login.jsf

The AT level 1 awareness training is only requited for those contractor employees traveling Oconus in support of this contract.

AT Awareness Training for Contractor Personnel Traveling Overseas.

The contractor FSOs and associated subcontractor FSOs will brief and make available government area of responsibility (AOR) specific

AT awareness training and information to employees traveling overseas as directed by AR 525-13. Specific AOR training content is

DD FORM 254, APR 2018 PREVIOUS EDITION IS OBSOLETE.

CLASSIFICATION (When filled in): Unclassified

Page4of11 ctrrectect by the combatant commander w1m the umt A TU bemg the local pomt ot contact. AT level I awareness trammg meets this requirement and is available at the following website: https://atlevell.dtic.mil/at/

DCSA provides the Facility Security Officer (FSO) Toolkit located at https://www.cdse.edu/toolkits/fsos/index.php for training assistance.

15. SELF EMPLOYED CONSULTANTS-The requiring activity security office shall be notified of all consultants who work for or support the Contractor (prime and subs) for this effort! The Contractor who employs or has consultants on their team shall provide a copy of all consultant certificate/agreements to the requiring activity COR and security office per 32 CFR part 117 .9(1).

16. TEMPORARY EMPLOYED PERSONNEL (Paid by 1099)-The contractor is NOT authorized to hire Temporary employees to work on this contract.

17. If the contract requires access to the PM ST L T2 portal, only those contractors with a fmal SECRET clearances and approved by the

PM ST LT2 portal administrator for access will be authorized.

ITEM 10:

Refltem 10.e(2): INTELLIGENCE INFORMATION (NON-SCI) - Non-SCI Information is not releasable to contractor employees who have not received a clearance at the appropriate security level. Written concurrence of the KO is required prior to subcontracting. Access to Intelligence information required for the performance of this contract.

Refltem 10.j: CONTROLLED UNCLASSIFIED INFORMATION (CUI) -The contractor shall ensure that all CUI provided under this contract is safeguarded and marked as specified in DoDI 5200.48.

a. COMPILATION - The contractor shall be aware of certain information that would otherwise be unclassified or CUI when standing alone may require classification when combined or associated with other unclassified or CUI information. The determination that information requires classification by compilation will be based on specific guidance regarding compilation provided in a Security

Classification Guide (SCG) or from the information/data owner. When classification is required to protect a compilation of such information, the overall classification assigned to the compilation shall be conspicuously affixed. The reason for classifying the compilation shall be stated at an appropriate location at or near the beginning of the compilation. Any unclassified or CUI portions will be portion marked (U) or (CUI), while the overall markings will reflect the classification of the compiled information.

Ref Item 1 Ok: OTHER-Access to Secret Internet Protocol Network (SIPRNET) is required. Access will be limited to only those employees who have a SIPRnet requirement during this contract. A list of employees having a SIPRnet account shall be provided to government upon request! The vendor/contractor is not authorized to access, download or further disseminate any classified information from SIPRnet which is outside the scope of the defmed contract requirements unless specifically authorized in writing by the Government

Program Manager (PM), AOR, COR and G6 or network security authority. The vendor/contractor must complete and forward to the AOR, COR, a SIPRnet access request for approval by the Requiring Activity SIPRnet Information Assurance Manager (1AM) prior to receiving access.

Although the NATO brief is a requirement for SIPRNet it does NOT mean that the contractor has a requirement for access to NATO information. Access to NATO information is a specific requirement that will need additional justification from the government Project

Manager (PM) and AOR, COR.

The contractors FSO shall administer a NATO awareness brief to only those contractors who require access to the SIPRNET. The contractor and FSO must sign and retain the NATO briefmg/debriefmg form for the life of the contract. The FSO is required to update individual contractors DISS account reflecting the indoctrination to NATO Secret.

ITEM 11:

Refltem 1 le: PERFORM SERVICES ONLY - This contract is for professional, technical, and administrative to establish the Computer

Based Instructional Development (CBID) for the development of Interactive Multi-Media Instruction (IMl) courseware in support of the

Program Executive Office for Simulation, Training, and Instrumentation (PEO STRl), the Department of Defense (DOD), military service and other DOD and non DOD agencies. The contractor will work in contractor and/or DoD cleared facilities. Classification markings and distribution statements on any material to be furnished will be provided by the contract logistics personnel and site security guidance necessary for the performance of the agreement/contract.

Refltem 11.1: RECEIVE, STORE OR GENERA TE CONTROLLED UNCLASSIFIED INFORMATION (CUI) -The contractor and all subcontractors personnel must protect CUI material and information in accordance with DoDI 5200.48.

DD FORM 254, APR 2018 PREVIOUS EDITION IS OBSOLETE.

CLASSIFICATION (When filled in): Unclassified

Page5of11

a. N - e contractor s e aware o certam m ormation at wou o erw1se e unc ass1 1e or UI w en stan g alone may require classification when combined or associated with other unclassified or CUI information. The determination that information requires classification by compilation will be based on specific guidance regarding compilation provided in a Security

Classification Guide (SCG) or from the information/data owner. When classification is required to protect a compilation of such information, the overall classification assigned to the compilation shall be conspicuously affixed. The reason for classifying the compilation shall be stated at an appropriate location at or near the beginning of the compilation. Any unclassified or CUI portions will be portion marked (U) or (CUI), while the overall markings will reflect the classification of the compiled information.

Ref Item 11.M: Dual Citizens The contractor FSO must maintain a list of all dual citizen employees and provide that list upon inspection from DCSA or the cognizant security authority ISS. Contractor's employees who are dual citizens and have access to software and technical data must have the appropriate security clearance in accordance with the current version of 32 CFR part 117 NISPOM Rule.

"CONTROLLED UNCLASSIFIED INFORMATION (CUI) " SECTION

I. GENERAL:

The contractor shall adhere to Dorn 5200.48 CUI and Army Controlled Unclassified Information (CUI) guidance as it relates to controlling, marking, safeguarding, storage and disposal of CUI materials on this contract /agreement.

2. IDENTIFYING CUL

a. The official CUI Registry approved by the CUI Executive Agent identifies all approved CUI categories; provides general descriptions for each; identifies the basis for controls; establishes markings, and includes guidance on handling procedures. The Contractor shall refer to the CUI Registry's category listing found at https://www.archives.gov/cui/registry/category-list to determine if information can be designated as CUL The contractor shall also coordinate with the COR/AOR for support and advice.

b. The authorized holder (originator/owner of the information; the original classification authority or other official (government or contractor) that controls the information) is responsible for determining, at the time of creation, whether information in a document or material falls into a CUI category. If so, the authorized holder is responsible for applying CUI markings and dissemination instructions accordingly.

c. Only categories listed in the CUI Registry (includes DoD related categories) can be used to identify if the information meets CUI designation.

3. LEGACY MATERIAL.

a. Policy for legacy CUI created and marked under Department of Defense Manual (DoDM) 5200.01, Volume 4 is cancelled. For information on Army legacy material: (Ref: Dorn 5200.48, para 3 .2)

(1) Will not be required to be re-marked or redacted while it remains under control or is accessed on line and downloaded for use on the contract. However, when legacy CUI is incorporated into, or cited in, another document or material, it must be reviewed for CUI and marked in accordance with Dorn 5200.48.

(2) Marked and stored on an access-controlled website or database does not need to be remarked as CUI, even if other agencies and contractors are granted access to the websites or databases.

(3) Does not automatically become CUL It must be reviewed by the owner of the information to determine if it meets or falls under one of the new CUI categories. Ifit meets the new CUI requirements, it will be marked in accordance with Dorn 5200.48.

b. The original classification authorities (OCAs) are required to review all SCGs under their authority to determine if the information

(previously marked as "For Official Use Only" or "FOUO" or other legacy markings) meets the CUI designation. The SCGs must be reissued to ensure clear protection guidance is provided. (Ref: Dorn 5200.48, para 3-7e and 3.8)

4. Marking. The contractor shall ensure that all documents containing CUI carry the CUI markings in accordance with Dorn 5200.48.

Discontinue all use of legacy or other markings is not permitted or included in either the CUI Registry or Dorn 5200.48. Refer to the

OUSD(l&S)/Drn(CL&S) Information Security CUI Marking Guidance dated April 2020.

5. Safeguarding and Storage. The contractor shall protect CUI from unauthorized disclosure or access by unauthorized personnel, by ensuring these measures are implemented: (Ref: Dorn 5200.48, para 4.le)

DD FORM 254, APR 2018 PREVIOUS EDITION IS OBSOLETE.

CLASSIFICATION (When filled in): Unclassified

Page6of11

a. Dunng workmg hours. Contractor employees workmg wrrn CUI w111 be caretul not to expose CUI to unauthorized users or others who do not have a lawful government purpose to see the information. Cover sheets (Stand Form 901) can be placed on top of documents to conceal the contents from casual viewing.

b. The contractor shall keep CUI under control at all times or protect it with at least one physical barrier and reasonably ensure that the information is protected from unauthorized access and observation.

c. CUI will not be stored in personal residence, hotel room safes, and automobiles or viewed while on public transportation if allowed to transfer hard-copy ( document form) CUI material outside the organization.

6. Transmission Requirements.

a. CUI information may be transmitted electronically ( e.g., data, website, or e-mail), via approved secure communications systems or systems utilizing other protective measures such as Public Key Infrastructure or transport layer security ( e.g., https ). A void wireless telephone transmission of CUI when other options are available. (Ref: DoDI 5200.48, para 4.1 e ).

b. CUI transmission via facsimile machine is permitted; however, the sender is responsible for determining whether appropriate protection will be available at the receiving location before transmission (e.g., facsimile machine attended by a person authorized to receive

CUI; facsimile machine located in a controlled government environment) or an authorized DoD contractor facility.

c. CUI information and material may be transmitted via first class mail, parcel post, FEDEX or, bulk shipments. Do not place CUI markings on the outer envelopes or packaging. Refer to the OUSD(I&S)/DDI(CL&S) Information Security CUI Marking Guidance dated

April 2020.

d. The contractor shall not use unofficial or personal ( e.g., .net; .com) e-mail accounts, messaging systems, or other non-DoD information systems, except approved or authorized government contractor systems, to conduct official business involving CUL

7. CUI within Information Systems. (Ref: DoDI 5200.48, para 3-3, 3-10)

a. DoD information systems (IS) processing, storing, or transmitting CUI will be categorized at the moderate impact level, and follow the guidance in DoDI 8500.01 and 8510.01.

b. Non-DoD information systems processing, storing, or transmitting CUI will provide adequate security, and the appropriate requirements must be incorporated into all contracts, grants, and other legal agreements with non-DoD entities in accordance with DoDI

8582.01. The NIST-SP 800-171 identifies the baseline system requirements for processing CUI for industry.

c. For systems, networks, and programs operating on the various domains, a splash screen warning and notice of consent must be employed to alert users of the presence of CUL

d. When made available by the DoD Chief Information Officer and OUSD(I&S), Army organizations will modify or install classification marking tools on unclassified, Secret and Top Secret network systems to account for CUI information and readily permit inclusion of CUI markings and designator indicators.

8. Dissemination. (RefDoDI 5200.48, para 4-2)

a. The contractor shall follow CUI access to the extent the access or dissemination: complies with the Law, Regulation, and Government wide policy (LRGWP) identifying the information as CUI; furthers a lawful government purpose; is not restricted by an authorized Limited

Dissemination Controls (LDC); or is not prohibited by any LRGWP.

b. Authorized holders may place limits on disseminating CUI for a lawful government purpose using the approved LDCs and associated marking or methods authorized by a specific LRGWP.

c. The originator may use the LDCs to limit access to those on an accompanying dissemination list, as shown in Table 2 ofDoDI

5200.48. LDCs or distribution statements cannot unnecessarily restrict CUI access.

d. When handling other Executive Branch CUI (non-DoD or Army), DA personnel will follow their regulatory guidance for when the application of dissemination controls and its markings are allowed, and by whom, while ensuring the policy is in accordance with Part 2002 of Title 32, CFR.

e. Government CUI designated information may be disseminated to a foreign or FOCI recipient in order to conduct official business for

DD FORM 254, APR 2018 PREVIOUS EDITION IS OBSOLETE.

CLASSIFICATION (When filled in): Unclassified

Page7of11 the Army prov1ctect;

(1) CUI is not controlled or marked as NOFORN.

(2) Access to such government contract data/information is within the scope of the foreign or FOCI State Department licenses and export control regulations.

(3) There are no contract restrictions prohibiting access to such data/information.

(4) Access to such data/information would help accomplish the contract and would not be detrimental to the interests of the DoD or the U.S. government.

(5) Access to such data/information is in accordance with this DD254.

9. Legacy Distribution Statements.

a. Legacy CUI technical documents and materials requiring export control have used distribution statements in accordance with DoDI

5230.24 in order to address the shared responsibility between the DoD and its contractors to safeguard this information. This was done for legacy CUI creation, transmission, receipt, storage, distribution, decontrol, and approved disposition authorities, including destruction.

(Ref: Dorn 5200.48, para 4.3a)

b. CUI export controlled technical information or other scientific, technical, and engineering information will continue to use distribution statements and must be marked with an export control warning in accordance with Dorn 5230.24, DoDD 5230.25, and Part 250 of Title 32, CFR (Withholding of Unclassified Technical Data from Public Disclosure). However, where other markings are authorized and used in accordance with associated LRGWP (e.g., North Atlantic Treaty Organization markings, REL TO), those markings may be used to further inform distribution decisions. (Ref: Dorn 5200.48, para 4.3b)

c. "REL TO" is authorized for use with foreign nationals once the information distribution is properly coordinated with the requiring activity foreign disclosure office.

10. Destruction. (Ref: Dorn 5200.48, para 4.5)

a. The contractor shall take all CUI documents (Record and Non-record copies) and materials and formally review them in accordance with Chapter 33 of Title 44, United States Code ( and AR 25-400-2 before approved disposition authorities are applied, including destruction. Media containing CUI must include decontrolling indicators. (Ref: Dorn 5200.48, para 4.5)

b. The contractor shall ensure that CUI will be destroyed in a manner that makes it unreadable, indecipherable, and irrecoverable. The

CUI will be destroyed according to any specific directives regarding the information. If the authority does not specify a destruction method, the contractor shall use one of the following methods: (Ref: Dorn 5200.48, para 4.5a and b)

(1) Any method of destruction approved for classified information.

(2) Guidance for destruction outlined in the NIST SP 800-88, and further explained in NARA's CUI Notice 2019-03.

11. Decontrol of CUL Decontrol occurs when the information has been removed from the protection of the CUI designation and no longer requires safeguarding or dissemination controls.

a. Decontrolling and releasing CUI records will be executed by the originator of the Information or other authority (e.g., initial Freedom of Information Act (FOIA) denial and appellant authorities) and designated government program office for decontrolling CUI pursuant to the procedures for the review and release of information (see AR 360-1). There are no specific timelines to decontrol CUI unless specifically required in a LRGWP. Decontrol will occur when the CUI no longer requires safeguarding and will follow Army records management procedures (see AR 25-400-2). (Ref: Dorn 5200.48, para 4.4)

b. CUI documents and materials will be formally reviewed by the government program chief engineer, SME before being decontrolled or chief engineer, SME, OPSEC officer, legal and PAO prior to public release.

c. Decontrol will occur when the designating agency decides to release the CUI to the public by making an affirmative, proactive disclosure (for example, FOIA request). Disclosure under FOIA does not automatically constitute CUI decontrol for all purposes.

d. Disclosures under the Privacy Act constitute decontrol only with respect to the limited purpose of disclosure to the individual who

DD FORM 254, APR 2018 PREVIOUS EDITION IS OBSOLETE.

CLASSIFICATION (When filled in): Unclassified

Page8of11 requested access to therr records mamtamed m a system or records.

e. When indicated by a decontrol marking specifying a decontrol date or event, CUI is decontrolled without further review by the originator.

f. A designating agency may also decontrol CUI:

(1) In response to a request from an authorized holder to decontrol CUL

(2) Concurrently with any declassification action under E.O. 13526 or any predecessor or successor order, as long as the information also appropriately qualifies for decontrol as CUI.

(3) In PEO STRI, the government program office in charge of the contract is the local CUI personnel it authorizes to decontrol CUI, consistent with a LRGWP.

(4) Decontrolling CUI for purposes other than FOIA disclosure relieves the requirement to handle the information under the CUI

Program but does not constitute authorization for public release.

(5) Personnel must clearly indicate that CUI is no longer controlled when restating, paraphrasing, re-using, releasing to the public, or donating the CUI to a private institution. Otherwise, personnel do not have to mark, review, or take other actions to indicate the CUI is no longer controlled.

g. Once decontrolled, any public release of information that was formerly CUI must be in accordance with AR 360-1.

h. Authorized holders may request that the designating agency decontrol CUI that they believe should be decontrolled. If an authorized holder publicly releases CUI in accordance with the designating agency's (not Army or DoD) authorized procedures, the release constitutes decontrol of the information.

i. Unauthorized disclosure of CUI does not constitute decontrol.

j. Personnel must not decontrol CUI to conceal, or to otherwise circumvent accountability for, an unauthorized disclosure.

k. When a LRGWP require specific decontrol procedures, personnel must follow such requirements

1. CUI and the Freedom of Information Act (FOIA). FOIA may not be cited as a CUI safeguarding or disseminating control authority for

CUI. When determining whether to disclose information in response to a FOIA request, the decision must be based on content of the information and applicability of any FOIA statutory exemptions, regardless of whether or not the information is designated or marked as

CUI. (Ref: Title 32 CFR 2002.44(b ), Part 2002)

m. CUI and the Privacy Act. Information contained in Privacy Act systems of records may be subject to controls under other CUI categories and may need to be marked as CUI for that reason. In addition, when determining whether certain information must be protected under the Privacy Act or whether the Privacy Act allows an individual the right to access their information maintained in a system of records, the decision to release must be based upon the content of the information as well as Privacy Act criteria, regardless of whether the information is designated or marked as CUL

n. Decontrol of CUI for the limited purpose of making an individual's information available to them under the Privacy Act does not result in decontrol. (Ref: CFR 2002.46, Title 32 Part 2002)

12. Challenges to Designation of Information as CUI.

a. The contractor who believes that a designation as CUI is improper or incorrect, or who believe they have received unmarked CUI, should notify the government agency that disseminated the information. When the disseminating agency is not the designating agency of the CUI, it is the responsibility of the disseminator agency to contact the designating agency of the challenge. Challenges may be made anonymously; and challengers cannot be subject to retribution for bringing such challenges. (Ref: CFR 2002.50 Title 32, Part 2002 )

b. If a contractor or government command or organization receives a challenge, the government program office or other designated individual for handling challenges will take the following measures:

(1) Acknowledge receipt of the challenge in writing, providing an expected timeline for response to the challenger, DD FORM 254, APR 2018 PREVIOUS EDITION IS OBSOLETE.

CLASSIFICATION (When filled in): Unclassified

Page9of11

(2) Review the ments ot the challenge wnn a subject matter expert, otter an opportumty to the challenger to ctetme a ratrnnale tor belief that the CUI in question is inappropriately designated,

(3) Notify the challenger of the decision in writing, and provide contact information of the official making the decision in this matter.

c. Until the challenge is resolved, the challenged CUI, including challenges to unmarked CUI, will continue to be safeguarded and disseminated at the appropriate control level indicated in the markings or presumed category. If a challenging party disagrees with the response to a challenge, contact the contract cognizant security office (Information Security Team) for assistance with resolution.

13. Misuse or Unauthorized Disclosure of CUI.

a. The contractor shall report promptly and shall take appropriate action in cases of misuse, mishandling or unauthorized disclosure (UD) of CUI.

b. For UD of CUI, no formal security inquiry or investigation is required unless disciplinary action will be taken against the individual(s) responsible, in such case an inquiry would be appropriate. Incidents involving the UD of CUI will be reported to the COR/AOR and contracting officer.

14. CUI Training. All contractors handling CUI in support to this contract, will execute initial and refresher CUI training as stated in item

13 paragraph 14. CUI training can be taken at the following URL; https://securityhub.usalearning.gov/index.html

15. CUI Requirements in Army Contracts. (Ref: DoDI 5200.48, para 5.3)

a. CUI will be identified by the government program office in all Army contracts to include the applicable security clauses and security standards associated with the CUI in accordance with DoDI 5200.48.

b. Whenever the Army and government program office provides CUI to, or CUI is generated by, non-DoD entities, protective measures and dissemination controls, including those directed by LRGWP, will be articulated in the contract, grant, or other legal agreement, as appropriate.

c. The contractor shall monitor CUI for aggregation and compilation based on the potential to generate classified information pursuant to security classification guidance addressing the accumulation of unclassified data or information.

d. The contractor shall report the potential classification of aggregated or compiled CUI to the Army requiring activity.

e. The contractor shall submit unclassified Army information for review and approval for release in accordance with the standard Army release requirements under AR 360-1.

f. All CUI records must follow the approved mandatory disposition authorities whenever the government requiring activity provides CUI to, or CUI is generated by, non-DoD entities.

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form)

SEE ATTACHED ADDENDUM

14. ADDITIONAL SECURITY REQUIREMENTS

NAME & TITLE OF REVIEWING OFFICIAL

Ronnie Logan, COR

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

SIGNATURE

LOGAN .RONNIE. �;fa':;g'�oEAN rno39

DEAN .1150396529 :�:, 2021.10.06 13,50 :42-04•oo•

IZJ No D Yes If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can a/so use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

D No IZJ Yes If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can a/so use item

13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

The Government Project Manager's/Director's working in conjunction with the Contracting/Agreement Officer of this effort will coordinate with the cognizant security office for ensuring vendor/contractor compliance with the security terms of the DD 254 blocks 10,11,12,13,14

DD FORM 254, APR 2018 PREVIOUS EDITION IS OBSOLETE.

CLASSIFICATION (When filled in): Unclassified and aooendwn sheets. The government PM/PD s will morutor and venty the vendor/contractor s security responsibllittes durmg the lite or the contract/agreement and the PEO STRI Industrial Security Specialist will coordinate with the KO/AO, COR when conducting site security inspections of the vendor/contractor facility in accordance with AR 380-49, Anny Industrial Security.

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

a. GCA NAME

ACC Orlando

c. ADDRESS (Include ZIP Code)

12211 Science Drive

Orlando, FL 32828

d. POC NAME

Helen Simpson

e. POC TELEPHONE (Include Area Code)

+1 (407) 208-3231b. ACTIVITY ADDRESS CODE (AAC) OF THE CONTRACTING OFFICE (See Instructions)

W900KK

17. CERTIFICATION AND SIGNATURES

f. EMAIL ADDRESS (See Instructions) helen.g.simpson2.civ@mail.mil

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

a. TYPED NAME OF CERTIFYING OFFICIAL (Last, First, Middle Initial) d. AAC OF THE CONTRACTING OFFICE h. SIGNATURE (See Instructions) (See Instructions)

SL UPSK Digitally signed

Stanley Slupski W900KK by

1---------------------------+-------------------1I.STANL SLUPSKI.STAN

b. TITLE

Industrial Security Specialist (lSS)

c. ADDRESS (Include ZIP Code)

PEO STRl G2 12211 Science Dr

Orlando, FL 32836

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

[gj a. CONTRACTOR

[gj b. SUBCONTRACTOR lv'I c. COGNIZANT SECURITY OFFICE FOR PRIME AND

� SUBCONTRACTOR

□ d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY

ADMINISTRATION

[gj e. ADMINISTRATIVE CONTRACTING OFFICER

e. CAGE CODE OF THE PRIME CONTRACTOR LEY.M.1081248

(See Instructions.) EY .M.10 920

f. TELEPHONE (Include Area Code)

+l (407) 384-3540

g. EMAIL ADDRESS (See Instructions) stanley.m.slupski.civ@mail.mil

81248920 Date: 2021.10.06

13:56:37 -04'00'

i. DATE SIGNED (See Instructions)

20211006

□ f. OTHER AS NECESSARY (If more room is needed, continue in Item 13 or on additional page if necessary.)

DD FORM 254, APR 2018 PREVIOUS EDITION IS OBSOLETE. Page 11 of 11