Attachment_0005_DD254.pdf

Continuation for DD Form 254, Block 13 Continuation Contract:

Solicitation: W909MY-17-R-0016

1a. The highest level of facility clearance required for the contractor to perform on the contract is

SECRET.

1b. The highest level of classified material the contractor will be required to store at its own facility is

SECRET.

8a. All locations where work is to be performed , other than the one specified in Item 6a,b and c under this solicitation, including contractor, subsidiaries subcontractor, and Government facilities will be listed on the Award DD Form 254 in block 8a,b and c, in accordance with the Defense Security Service DD Form 254 Guidance. CONUS and OCONUS locations will be determined at time of award and/or task orders. All subcontractors and subsidiaries subcontractors will be listed on award DD Form 254 as additional locations of performance.

Complete revised DD254 packages must be submitted for all additional locations of performance that are not listed on this Award/Task Order DD254 package. This includes prime contractor, subsidiaries, subcontractors, and government facilities. All DD254 must be submitted through the KO’s for concurrence of additional Contractors and places of performance. All contractors, subsidiaries and subcontractors require a SECRET security clearance (AR 380-49, para 2-3f). All personnel must be US citizens. Dual citizenship status not authorized.

10a/11h. COMSEC information/material will be processed IAW DoD 52210.22-M, NSA/CSS Policy Manual 3-16, AR 380-40 (Policy for Safeguarding and Controlling Communications Security), and additional security guidelines (Appendix A). When access is required at Government facilities, contractor personnel will adhere to COMSEC rules and regulations as mandated by Command policy and procedures. Contractor personnel requiring COMSEC access and/or authorized a COMSEC account must be U.S. Citizens and possess a final clearance at the appropriate level. All contractors shall be briefed before access to COMSEC is granted. Subcontracts requiring classified COMSEC information shall be awarded only upon the approval of the Contracting Officer. Concurrence of the KO is required prior to subcontractors working on the program. Copies of the subcontract DD Form 254 will be forwarded to the KO for the Contract file and to CECOM G2 for DD Form 254 tracker information. Per AR 380-40, Chapter 4: Contractor personnel are subject to the Department of Army Cryptographic Access Program (DACAP). See Appendix A. Contingent upon task orders.

10e (2) Non-SCI Intelligence Materials access required for performance by contractor. Non-SCI Information is not releasable to contractor employees who have not received a clearance at the appropriate security level. Written concurrence of the KO is required prior to subcontracting, Appendix C. Contingent upon task orders.

10j. Safeguarding "For Official Use Only” (FOUO) information, Appendix D. FOUO Information generated and/or provided under this contract shall be safeguarded and marked as specified in AR 25-55 and DoD 5200.1-M (Marking is in Volume 2). See Appendix D. Contingent upon task orders.

10k. Contractor is authorized access to the Shadow 200 Tactical Unmanned Aircraft Systems Security Classification Guide (SCG) 17 May 2011 to be distributed at award and the PM EOIR OPSEC Plan dated April 2015. Access to SIPRNet is required at Contractor facilities only. All contractors granted SIPRNet access must be aware that they are not authorized to download ANY classified material without the guidance and written permission of the Cognizant Security Agency. Access to SIPRNet at contractor facilities requires sponsorship through CECOM G2 for determination of TEMPEST from the Army TPM, 902nd MI Group. IAW AR 380-27, Control of Compromising Emanations (FOUO), 19 May 2010, Chapter 4, TEMPEST Countermeasures Review. See Appendix E. Contingent upon task orders.

11c. The Contractor is authorized to receive and generate classified material at the contractor’s facility documents and/or hardware). The contractor requires access to classified source data up to and including Secret in support of the work effort. Any extracts or use of such data requires the Contractor to apply derivative classifications and markings consistent with the source documents. Use of “Multiple Sources” on the “Derived From” line necessitates compliance with the NISPOM, paragraph 4- 208a, and the use of a bibliography. Contractor will also follow guidance set forth within the Security Classification Guide (SCG). SCGs be will identified on the specific task order DD Form 254. Contractor will follow the guidelines of Chapters 4 and 5 for proper handling of classified information.

11d. The Contractor must provide adequate storage at their facility for classified hardware to the level of Secret.

11h. See 10a/11h paragraph above.

11i. Access to SIPRNet, if authorized at contractor facilities, requires sponsorship through CECOM G2 for determination of TEMPEST from the Army TPM, 902nd MI Group. TEMPEST requirements are reviewed and determined IAW AR 380-27, Control of Compromising Emanations (FOUO), 19 May 2010, Chapter 4, TEMPEST Countermeasures Review.

TEMPEST Information is not releasable to contractor employees who have not received a FINAL Clearance at the appropriate security level. Written concurrence of the KO is required prior to subcontracting. See Appendix E. Contingent upon task orders.

11j. Contractor shall develop an OPSEC Plan IAW AR 530-1, Chapter 6 as listed in the PWS CDRL A064. The OPSEC Plan/SOP will be for use for work at contractor facilities. When contractor is performing their work at Government facilities, the contractors shall adhere to the OPSC requirements IAW the following Program OPSEC Plan/SOP: Product Management Office Electro-Optic/Infrared Payloads – INTEL Operations Security Plan April 2015. Level I OPSEC training is available at the following website: http://cdse.edu/catalog/elearning/GS130.html (Duration: 45 minutes).

11l. IT Sensitive Duties Required (See Block 13, Item 13). All classified systems authorized at contractor facilities MUST be accredited prior to the start of processing Classified Network.

13a. Contractor personnel performing IT sensitive duties are subject to investigative and assignment requirements IAW AR 25-2, AR 380-67, DoD 8570.0 and affiliated regulations. Army regulation available at www.apd.army.mil

13b. Foreign subcontractors, foreign vendors and/or visitors that are not cleared US Companies, participating in Army foreign disclosure issues will be handled in accordance with AR 380-10, Foreign Disclosure and Contacts with Foreign Representatives.

All disclosures (i.e. oral, visual, briefing, documents) to foreign nationals require prior approval by the foreign disclosure officer.

All requests for non-US cleared Foreign subcontractor and/or Foreign own companies to perform on this contract must be requested from the Prime Contract to the KO through Program Office and approved by Foreign Disclosure Officer.

13c. Classified information will be protected IAW the NISPOM, Chapter 5. All security incidents involving classified information will be reported to the CECOM G2 Industrial Security Office, and DSS Industrial Security Representative. Information will be forwarded to KO and the PM for a program damage assessment to be conducted IAW AR 380-49.

13d. All subcontractor DD254s and subcontractor tier DD254s will be sent to the KO. Any Contractors/subcontractors owned by Foreign Companies and that have a clearance issued by the Defense Security Service under a Special Security Agreement need to have a National Interest Determination (NID) approved if access is required to: Top Secret; COMSEC; Restricted Data; SCI and/or SAP. NID requirements and justification must be sent through CECOM G2 to be forwarded to the approving agencies. Only after a NID approval is received will a FOCI contracting firm be authorized to work on the program.

13e. Security Training and Briefing: IAW AR 380-49 Chapter 3, the FSO will provide Threat Awareness and Reporting Program (TARP) training in addition to initial and refresher security training IAW AR 381-12, paragraph 1-14 and Chapter 2 for contractors working in contractor facilities.

Contractors may be exempt from such security training if they can provide documentation they have had similar training from their FSO. The FSO will forward Certificates and/or a signed Letter of Certification for Training to the COR for verification of required training to be included in the contract folder.

Integrated/embedded contractors will receive security training from the assigned CECOM Security Manager/Representative. Some Security training provided to integrated/embedded contractors will include:

--TARP Training: Live training provided by 902d

– Annual training requirement --Initial Security Orientation: Online training available on the Army Learning Management System (ALMS) site, reference ALARACT 207-2103 – Initial training --Annual Security Orientation: Online training available on the Army Learning Management System (ALMS) site, reference ALARACT 207-2103 – Annual training requirement --Derivative Classification Training, reference DoD 5200.01-V3-Biennial training requirement --Operations Security Training, reference AR 530-1 --Annual training requirement --Foreign travel training, AR 525-13 – Required when traveling abroad

The previous listing includes some training requirements that are provided. Any training requirements that the installation or tenant facilities require of the contractors must be added to the DD 254 and the security section of the contract document. AR 380-49 Chapter 3 13f. The contractor must submit subcontracts to DD254’s to the KO for the contract file and forward to CECOM G2 for review to insure Army requirements flow down to the subcontractor.

13g. All Facility Clearance sponsorships for subcontractors must have Government approval and All Facility Clearance sponsorships for subcontractors must have Government approval and certification on the subcontractor’s DD Form 254. Submit all requests to the CECOM G2 Industrial Security.

APPENDIX A

ADDITIONAL SECURITY GUIDELINES FOR COMSEC

Provided by the CECOM Director of Intelligence & Security/G2 (Updated: 18 April 2012)

Contractor Generated Communications Security (COMSEC) Material: Any material generated by the contractor (including, but not limited to: correspondence, drawings, models, mockups, photographs, schematics, status programs and special inspection reports, engineering notes, computations and training aids) will be classified according to its own content.

Classification guidance will be taken from other elements of this Contract Security Classification Specification, DD Form 254, Government furnished equipment or data, or special instructions issued by the Contracting Officer, or his/her duly appointed representative.

REQUIREMENTS:

1. The requirements of DoD 5220.22-M and NSA/CSS Policy Manual 3-16 are applicable to this effort.

2. All contractor personnel to be granted access to classified COMSEC information must be U.S. citizens granted FINAL clearance by the government prior to being given access. Immigrant aliens, interim cleared personnel, or personnel holding a contractor granted CONFIDENTIAL clearance are not eligible for access to classified COMSEC information released or generated under this contract without the express permission of the Director, NSA.

3. Contractor employees or cleared commercial carriers shall not carry classified COMSEC material on commercial passenger aircraft anywhere in the world without the approval of the procuring contracting officer.

4. No contractor generated COMSEC or government furnished material may be provided to the Defense Technical Information Center (DTIC). Contractor generated technical reports will bear the statement "Not Releasable to the Defense Technical Information Center per DoD Directive 5100-38."

5. Classified paper COMSEC material may be destroyed by burning, disintegration, chopping or high security crosscut shredding. Cryptographic key tapes must be “terminally” destroyed (destroyed to the point where it cannot be reconstructed) utilizing devices listed on the Evaluated Products List (EPL) for Punched Tape Destruction Devices or the EPL for High- Security Disintegrators. A listing of EPLs can be found at http://www.nsa.gov/ia/government/mdg.cfm. When a method other than burning is used, all residue must be reduced to pieces 5mm or smaller in any dimension. When classified COMSEC material other than paper is to be destroyed, specific guidance must be obtained from the User Agency.

6. Unclassified COMSEC information released or generated under this contract shall be restricted in its dissemination to personnel involved in the contract. Release in open literature or exhibition of such information without the express written permission of the Director, NSA, is strictly prohibited.

7. Recipients of COMSEC information under this contract may not release information to subcontractors without permission of the User Agency.

8. Additional notices to be affixed to the cover and title or first page of contractor generated COMSEC documents:

a. "COMSEC MATERIAL - ACCESS BY CONTRACTOR PERSONNEL RESTRICTED TO U.S. CITIZENS

HOLDING FINAL GOVERNMENT CLEARANCE."

b. "THIS PUBLICATION OR INFORMATION IT CONTAINS MAY NOT BE RELEASED TO FOREIGN NATIONALS WITHOUT PRIOR SPECIFIC APPROVAL FROM THE DIRECTOR, NSA. ALL APPROVALS WILL IDENTIFY THE SPECIFIC INFORMATION AND COPIES OF THIS PUBLICATION AUTHORIZED FOR RELEASE TO SPECIFIC FOREIGN HOLDERS. ALL REQUESTS FOR ADDITIONAL ISSUANCES MUST RECEIVE PRIOR

SPECIFIC APPROVAL FROM THE DIRECTOR, NSA."

CONTRACT #

SOLICITATION #W909MY-17-R-0016

APPENDIX C

INTELLIGENCE MATERIALS ACCESS REQUIREMENTS

Provided by CECOM LCMC G2 (Updated: 14 July 2008)

1. No Intelligence materials are to be provided in support of the contract without the prior approval of the CECOM Life Cycle Management Command (CECOM LCMC) G2 Director of Intelligence and Security. Any intelligence materials so provided will be disseminated solely by the CECOM LCMC G2, and will be accompanied by both a Letter of Instruction governing control of the materials provided, and a Letter of Transmittal, identifying the materials loaned and the duration of the loan. This service only pertains to elements supported by the CECOM LCMC G2.

2. All requests for access to intelligence materials will adhere to the following guidelines:

a. Prime contractor requests for intelligence materials access will be sent to the Program/Project Manager (PM) of the User Activity on official business letterhead with an enclosed copy of the approved DD Form 254.

b. Subcontractor requests for access to intelligence materials will be forwarded by the prime contractor to the PM on official business letterhead with an enclosed, approved DD Form 254 for the relevant subcontract.

c. PM of the User Activity will forward request through the Contracting Officer (KO) on official letterhead with the appropriate DD Form 254 and all substantiating documents attached, to be forwarded to the CECOM LCMC G2 for review and concurrence.

3. Point of contact is CECOM LCMC G2, AMSEL-MI (ATTN: Current Intelligence).

CONTRACT #

SOLICITATION # W909MY-17-R-0016

APPENDIX D

SAFEGUARDING “FOR OFFICIAL USE ONLY” (FOUO) INFORMATION

Provided by the CECOM Director of Intelligence & Security/G2

(Updated: 14 July 2008)

Reference: AR 25-55, Chapter IV

1. The “FOR OFFICIAL USE ONLY” marking is assigned to information at the time of its creation in a DOD User Agency. It is not authorized as a substitute for a security classification marking but it is used on official Government Information that may be withheld from the public under exemptions 2 through 9 of the Freedom of Information Act.

2. Other non-security markings such as “Limited Official Use” and “Official Use Only” are used by non-DOD User Agencies for the same type of information and should be safeguarded and handled in accordance with instructions received from such agencies.

3. Use of the above markings does not mean that the information cannot be released to the public, only that it must be reviewed by the Government prior to its release, to determine whether a significant and legitimate Government purpose is served by withholding the information or portions of it.

4. IDENTIFICATION MARKINGS:

a. An unclassified document containing FOUO information shall be marked “For Official Use Only” in bold letters at least 3/16 of an inch high at the bottom of the front cover (if any), on each page containing FOUO information, and on the outside of the back cover (if any). No portion marking will be shown.

b. Within a classified document, an individual page that contains both FOUO and classified information will be marked at the top and bottom with the highest security classification appearing on the page. If an individual portion contains FOUO information but no classified information, the portion will be marked ‘FOUO.’

c. Any “FOR OFFICIAL USE ONLY” information released to a contractor by a DOD User Agency is required to be marked with the following statement prior to transfer:

THIS DOCUMENT CONTAINS INFORMATION EXEMPT FROM MANDATORY DISCLOSURE UNDER THE

FOIA. EXEMPTIONS APPLY.

d. Removal of the “FOR OFFICIAL USE ONLY” marking can only be accomplished by the originator or other competent authority. When “FOR OFFICIAL USE ONLY” status is terminated, all known holders will be notified to the extent possible.

5. DISSEMINATION: Contractors may disseminate “FOR OFFICIAL USE ONLY” information to their employees and subcontractors who have a need for the information in connection with a classified contract.

6. STORAGE: During normal working hours “FOR OFFICIAL USE ONLY” information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for the information. During non-working hours, the information shall be stored to preclude unauthorized access. Filing such material with other unclassified records in unlocked files or desks is adequate when internal building security is provided during non-working hours. When such internal security control is not exercised, locked buildings or rooms will provide adequate after hours protection or the material can be stored in locked receptacles such as file cabinets, desks or bookcases.

7. TRANSMISSION: “FOR OFFICIAL USE ONLY” information may be sent via first-class mail or parcel post. Bulky shipments may be sent fourth-class mail.

8. DISPOSITION: When no longer needed, FOUO information may be disposed of by tearing each copy into pieces to preclude reconstructing, and placing it in a trash container or as directed by the User Agency.

9. UNAUTHORIZED DISCLOSURE: Unauthorized disclosure of “FOR OFFICIAL USE ONLY” information does not constitute a security violation but the releasing agency should be informed of any unauthorized disclosure. The unauthorized disclosure of FOUO information protected by the Privacy Act may result in criminal sanctions.

10. Point of contact is CECOM LCMC Director of Intelligence & Security/G2, ATTN: AMSEL-MI.

CONTRACT NUMBER:

SOLICITATION NUMBER: W909MY-17-R-0016

APPENDIX E

CONTROL OF COMPROMISING EMANATIONS (TEMPEST)

Provided by CECOM G2 (Updated:22 August 2012)

1. Reference:

a. DoD 5220.22-M, National Industrial Security Program Operating Manual, 28 February 2006.

b. AR 380-27, Control of Compromising Emanations (FOUO), 19 May 2010, Chapter 4, TEMPEST

Countermeasures Review.

c. Regulation AR 381-14, Technical Counterintelligence (TCI), 30 September 2002.

2. Prior to the implementation of any TEMPEST countermeasures or expenditure of funds contractor facilities electronically processing classified information are required to submit through the KO to CECOM G2 and the contract Program Manager following information for sponsorship of a TEMPEST assessment, within 30 days of award TEMPEST assessments will be marked at a minimum of FOUO, classify according to content. . The Army TEMPEST staff will review the information provided and determine if a formal TEMPEST Countermeasures Review (TCR) is required. Notification will be provided by the government security manager to the point of contact identified in the submission.

a. Facility location – include the exact address, building number, room number, and so forth. An area map showing the facility location in relation to other buildings, installation perimeter, and so forth, if available.

b. Point of Contact – include the email addresses phone numbers (commercial and cell).

c. Level of processing-include the classification level of the information that the facility will process

(Secret, Top Secret, sensitive compartmented information (SCI), Special Access Program (SAP), and so forth) and frequency of processing

d. Transmitters – include information on any transmitters (cell phones, two-way pagers, radios, transceivers (including alarm systems), wireless systems, portable electronic devices and repeaters) located within your facility or in close proximity (10 meters) to the facility. Include the make/model of the transmitters. Indicate how close transmitters are located to your classified processing areas.

3. The Army TEMPEST staff will review the information provided and determine if a formal TEMPEST Countermeasures Review (TCR) is required.

a. If a TCR is not required, the Army TEMPEST staff will provide a memorandum to that effect to the organization.

b. If a TCR is required, the Army TEMPEST staff will contact the organization’s point of contact to provide a TCR request according to referenced regulation.

5. When electronic equipment is used to process classified information, a completed DA Form 7453 Facility Technical Threat Assessment (FTTA) Worksheet will be completed IAW with Confidential Regulation AR 381-14, Technical Counterintelligence (TCI), 30 September 2002 (U) only if either of the following conditions applies:

a. The contractor will use electronic equipment/facilities to process TOP SECRET, SCI, SAP, SIOP, Restricted Data information; or

b. The contractor does not maintain complete physical access control of the facility, e.g., the contractor is located in a suite.

6. Point of contact is CECOM G2, AMSEL-MI, G2, 6002 Combat Drive D2101, Aberdeen Proving Ground, MD 21005, Phone: 443-861-6971 or 443-861-6969, DNS 848-6971 or 848-6969.