Attachment0008ContractSecurityClassificationSpecification.pdf

DEPARTMENT OF DEFENSE 1. CLEARANCE AND SAFEGUARDING

CONTRACT SECURITY CLASSIFICATION SPECIFICATION a. FACILITY CLEARANCE REQUIRED

(The requirements of the DoD Industrial Security Manual apply to all aspects of this effort)

b. LEVEL OF SAFEGUARDING REQUIRED

2. THIS SPECIFICATION IS FOR: (X and complete as applicable) 3. THIS SPECIFICATION IS: (X and complete as applicable)

a. PRIME CONTRACT NUMBER a. ORIGINAL (Complete date in all cases) Date (YYMMDD)

N/A

b. SUBCONTRACT NUMBER

b. REVISED (Supersedes all previous specs) Revision No.

Date (YYMMDD)

N/A

c. SOLICITATION OR OTHER NUMBER Due Date (YYMMDD) c. FINAL (Complete Item 5 in all cases) Date (YYMMDD)

W909MY-18-R-0011

4. IS THIS A FOLLOW-ON CONTRACT? YES NO. If Yes complete the following

Classified material received or generated under ___________ (Preceding Contract Number) is transferred to this follow-on contract _______.

5. IS THIS A FINAL DD FORM 254? YES NO. If Yes complete the following

In response to the contractor's request dated , retention of the identified classified material is authorized for the period of .

6. CONTRACTOR (Include Commercial and Government Entity ( CAGE) Code)

a. NAM CORTEK, Inc.E, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

TBD TBD

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICES ( Name, Address, and Zip Code) N/A N/A N/A

8. ACTUAL PERFORMANCE

a. LOCATION b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

TBD TBD

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

The purpose of this effort is to integrate additional Commercial-Off-The-Shelf (COTS) T2T LPs with the Government owned MFLTS SW Application in support of an evaluation of the suitability and effectiveness of COTS T2T LPs with respect to providing a language translation capability to Soldiers. Contractor shall provide support to the Government integration testing, and evaluation effort during the license period that will occur subsequent to delivery of the qualified LP. The Primary requirements under this effort include: Program Management, Integration with MFLTS SW, Contractor’s Qualification Testing (QT), and support to Government testing via a Testing and Evaluation (T&E) SW License Agreement.

10. THIS CONTRACT WILL REQUIRE ACCESS TO: YES NO 11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: YES NO

a. COMMUNICATIONS SECURITY (COMSEC)

INFORMATION

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER

CONTRACTOR’S FACILITY OR A GOVERNMENT ACTIVITY

b. RESTRICTED DATA b. RECEIVE CLASSIFIED DOCUMENTS ONLY

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION c. RECEIVE AND GENERATE CLASSIFIED MATERIAL

d. FORMERLY RESTRICTED DATA: d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. INTELLIGENCE INFORMATION: e. PERFORM SERVICES ONLY

(1) Sensitive Compartmented Information (SCI) f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO

RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

(2) Non-SCI g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL

INFORMATION CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

f. SPECIAL ACCESS INFORMATION h. REQUIRE A COMSEC ACCOUNT

g. NATO INFORMATION i. HAVE A TEMPEST REQUIREMENT

h. FOREIGN GOVERNMENT INFORMATION j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

i. LIMITED DISSEMINATION INFORMATION k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE

j. FOR OFFICIAL USE ONLY INFORMATION l. OTHER (Specify).

k. OTHER Specify) OPSEC Plan will be provided.

DD Form 254, DEC 1999 Previous editions are obsolete

Solicitation# W909MY-18-R-0011

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the industrial Security Manual or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public release shall be submitted for approval prior to release

Direct

Through (Specify):

Public release of any program related information (unclassified//FOUO) is not authorized. Request for release will be processed through the Contracting Officer Representative (COR), and PM DCGS-A OPSEC Officer, Wai Wong, wai.l.wong6.civ@mail.mil / 443-861- 2405, PM DCGS-A, Aberdeen Proving Ground, MD 21005 through the PEO IEW&S OPSEC Officer to the PEO IEW&S Public Affairs Officer brandon.j.pollachek.ctr@mail.mil / 443.861.7820, APG, MD 21005 TO Aberdeen Proving Ground Public Affairs Office, APG, MD 21005.

to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review.

*In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13. SECURITY GUIDANCE. The security classification guidance needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes: to challenge the guidance or classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any document/guides/extracts referenced herein.

Add additional pages as needed to provide complete guidance.

***** See DD Form 254 Block 13 Continuation Page *****

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to ISM requirements, are established for this contract. (If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the cognizant security office. Use Item 13 if additional space is needed.)

Yes No

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office. (If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.

Yes No

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL Savitri Chiruvolu

b. TITLE Industrial Security Specialist

PM DCGS-A

c. TELEPHONE (Include Area Code)

848-667-3505 (BB)

d. ADDRESS (Include ZIP Code) 17. REQUIRED DISTRIBUTION

PM DCGS-A (ATTN: SFAE-IEW-DC)

a. CONTRACTOR (SEE ITEM 6a of this form)

6006 Combat Drive, 2nd Floor, Room B2-133C

b. SUBCONTRACTOR

Aberdeen Proving Ground, MD 21005

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR Address 6C and 8C (SEE Item 6c of this form

e. SIGNATURE

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

EUCOM AND CENTCOM

e. ADMINISTRATIVE CONTRACTING OFFICER Copies of DD254 for subsidiaries

f. OTHERS AS NECESSARY

DD Form 254 Reverse, DEC 1999 mailto:wai.l.wong6.civ@mail.mil mailto:brandon.j.pollachek.ctr@mail.mil

SOLICITATION #: W909MY-18-R-0011

DD Form 254, Block 13 Continuation Sheet

8. Performance Locations:

Classification Level Organization Location

Unclassified Prime contractor’s facility

TBD

10j. Access to For Official Use Only (FOUO) information may be required in the performance of this contract.

Information designated as FOUO/CUI generated or provided under this contract shall be controlled, handled, stored, marked, safeguarded, transmitted and destroyed IAW DoDM 5200.01, DoDM 5400.07, AR 25-55 and the following guidance:

• Electronically transmitted FOUO information shall be sent via: 1) encrypted email, 2) password protected/encrypted document, 3) AMRDEC Safe Access File Exchange at https://safe.amrdec.army.mil/safe/Welcome.aspx, or 4) an accredited information system with proper security controls.

• The contractor may disseminate FOUO information to their employees and subcontractors that have a need-to-know.

• Disposal/destruction shall be by means of shredding when no longer needed.

o If shredding capabilities are unavailable on contractor site – contractor may coordinate with government representative for shredding services.

• The contractor shall report the unauthorized disclosure of FOUO information to the KO/COR, CM, or ISS.

The contractor shall safeguard unclassified DoD information stored on non-DoD information systems to prevent the loss, misuse, and unauthorized access to or modification of this information. The contractor shall:

a. Not process DoD information on public computers (e.g., those available for use by the general public in kiosks or hotel business centers) or computers that do not have access control.

b. Protect information by no less than one physical or electronic barrier (e.g., locked container or room, login, and/or password) when not under direct individual control.

c. Sanitize media (e.g., overwrite) before external release or disposal.

d. Encrypt the information that has been identified as Controlled Unclassified Information (CUI) when it is stored on mobile computing devices such as laptops and personal digital assistants, or removable storage media such as thumb drives and compact disks, using the best available encryption technology.

https://safe.amrdec.army.mil/safe/Welcome.aspx

e. Limit information transferred to subcontractors or teaming partners with a need to know and a commitment to at least the same level of protection.

f. Transmit e-mail, text messages, and similar communications using technology and processes that provide the best level of privacy available, given facilities, conditions, and environment. Examples of recommended technologies or processes include: closed networks, virtual private networks, public key-enabled encryption, and Transport Layer Security (TLS).

g. Encrypt organizational wireless connections and use encrypted wireless connection, where available, when traveling. When encrypted wireless is not available, encrypt application files (e.g., spreadsheet and word processing files), using no less than application-provided password protection level encryption.

h. Transmit voice and fax transmissions only when there is a reasonable assurance that access is limited to authorized recipients.

i. Not post DoD information to Web site pages that are publicly available or have access limited only by domain or Internet protocol restriction. Such information may be posted toWeb site pages that control access by user identification or password, user certificates, or other technical means and provide protection via use of TLS or other equivalent technologies. Access control may be provided by the intranet (vice the Web site itself or the application it hosts).

j. Provide protection against computer network intrusions and data ex-filtration, including no less than the following:

(1) Current and regularly updated malware protection services, e.g., anti-virus, anti- spyware.

(2) Monitoring and control of inbound and outbound network traffic as appropriate (e.g. at the external boundary, sub-networks, individual hosts) including blocking unauthorized ingress, egress, and ex-filtration through technologies such as firewalls and router policies, intrusion prevention or detection services, and host-based security services.

(3) Prompt application of security-relevant software patches, service packs, and hot fixes.

k. Comply with other current Federal and DoD information protection and reporting requirements for specified categories of information (e.g., critical program information, Personally Identifiable Information (PII), export controlled information) IAW the requirements of the contract.

11j. The Contractor shall develop an OPSEC Plan and adhere to the OPSEC requirements IAW AR 530-1, Chapter 6 as listed in the PM DCGS-A OPSEC Plan V1.5 dated 21 Jul 2014 (for reference use). Additional OPSEC requirements to the NISPOM are IAW AR 530-1, Chapter 6 as listed in the PWS OPSEC: Level I OPSEC Training for all contractor personnel.

When contractor is performing their work at Government facilities, the contractors shall adhere to the Government OPSEC requirements.

Per AR 530-1 Operations Security, the Contractor employees must complete Level I OPSEC Awareness training. New employees must be trained within thirty (30) calendar days of their reporting for duty, and annually thereafter. Level I OPSEC training is available at the following website: http://cdse.edu/catalog/elearning/GS130.html (Duration: 45 minutes).

11k. Contractor is authorized to use Defense Courier Service (DCS). The KO must obtain written approval from the Commander, Defense Courier Service, Attn: Operations Division, Fort George G. Meade, MD 20755-5370. Only certain classified information qualifies for shipment by DCS.

Prior approval of the KO is required before a prime contractor can authorize a subcontractor to use the services of DCS.

13a. Contractors must use appropriately accredited Information Systems/email when sending official government correspondence. Using a masked domain is not acceptable. Contractors traveling to OCONUS locations for either official or unofficial travel may require a defensive counter-intelligence briefing prior to their departure. Requirement for defensive travel brief will be based on threat and will remain at the discretion of the G2 and/or organization’s security manager.

Foreign subcontractors, foreign vendors and/or visitors that are not cleared US Companies, participating in Army foreign disclosure issues will be handled in accordance with AR 380-10, Foreign Disclosure and Contacts with Foreign Representatives, dated 4 DEC 2013.

- All disclosures (i.e., oral, visual, briefing, documents) to foreign nationals require prior approval by the foreign disclosure officer.

- All requests for non-US cleared foreign subcontractor and/or Foreign own companies to perform on this contract must be requested from the Prime Contract to the KO through Program Office and approved by Foreign Disclosure Officer.

13b. The contractor must implement the DCGS-A Program Protection Plan (PPP) protection/countermeasures. All subcontractor DD Form 254s will be sent to the KO.

13e. Security Training and Briefing: IAW AR 380-49 Chapter 3, the FSO will provide Threat Awareness and Reporting Program (TARP) training in addition to initial and refresher security training IAW AR 381- 12, paragraph 1-14 and Chapter 2 for contractors working in contractor facilities.

The FSO will forward Certificates and/or a signed Letter of Certification for Training to the COR for verification of required training to be included in the contract folder.

13d. The Contractor must submit Subcontract DD254’s to the KO for the contract file and forward to PEO IEW&S Industrial Security for review to insure Army requirements flow down to the Subcontractor.

http://cdse.edu/catalog/elearning/GS130.html

Certification and Signature: Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort.

All questions shall be referred to the official named below:

Savitri Chiruvolu Date: 12/15/2017 PM DCGS-A Government Security Specialist 6006 Combat Drive, 2nd Floor Aberdeen Proving Ground, MD 21005

848-667-3505 (BB)

George Smith Date: 12/15/2017 Contractor Officer Representative US Army / PEO IEWS / DCGS-A Machine Foreign Language Translation Systems 10115 Gratiot Road, Bldg. 363, RM 207 Fort Belvoir, VA 22060

(703) 704-0327

DD FORM 254, APPENDIX D

SAFEGUARDING “FOR OFFICIAL USE ONLY” (FOUO) INFORMATION

SOLICITATION #:

Provided by the PEO IEW&S Security Office Updated 26 October 2017

1. REFERENCES.

a. AR 25-55, The Department of the Army Freedom of Information Act Program, 1 November 1997, Chapter IV

b. AR 380-5, Department of the Army Information Security Program, 29 September 2000, paragraphs 5-4 and 5-5.

2. The “FOR OFFICIAL USE ONLY” marking is assigned to information at the time of its creation in a DoD User Agency. It is not authorized as a substitute for a security classification marking but it is used on official Government Information that may be withheld from the public under exemptions 2 through 9 of the Freedom of Information Act.

3. Other non-security markings such as “Limited Official Use” and “Official Use Only” are used by non-DoD User Agencies for the same type of information and should be safeguarded and handled in accordance with instructions received from such agencies.

4. Use of the above markings does not mean that the information cannot be released to the public, only that it must be reviewed by the Government prior to its release, to determine whether a significant and legitimate Government purpose is served by withholding the information or portions of it.

5. IDENTIFICATION MARKINGS:

a. An unclassified document containing FOUO information shall be marked “For Official Use Only” in bold letters at least 3/16 of an inch high at the bottom of the front cover (if any), on each page containing FOUO information, and on the outside of the back cover (if any). No portion marking will be shown.

b. Within a classified document, an individual page that contains both FOUO and classified information will be marked at the top and bottom with the highest security classification appearing on the page. If an individual portion contains FOUO information but no classified information, the portion will be marked ‘FOUO.

c. Any “FOR OFFICIAL USE ONLY” information released to a contractor by a DoD User Agency is required to be marked with the following statement prior to transfer:

THIS DOCUMENT CONTAINS INFORMATION EXEMPT FROM MANDATORY

DISCLOSURE UNDER THE FOIA. EXEMPTIONS APPLY.

d. Removal of the “FOR OFFICIAL USE ONLY” marking can only be accomplished by the originator or other competent authority. When “FOR OFFICIAL USE ONLY” status is terminated, all known holders will be notified to the extent possible.

DD FORM 254, APPENDIX D

SAFEGUARDING “FOR OFFICIAL USE ONLY” (FOUO) INFORMATION

SOLICITATION #:

Provided by the PEO IEW&S Security Office Updated 26 October 2017

6. DISSEMINATION: Contractors may disseminate “FOR OFFICIAL USE ONLY” information to their employees and subcontractors who have a need for the information in connection with a classified contract.

7. STORAGE: During normal working hours “FOR OFFICIAL USE ONLY” information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for the information. During non-working hours, the information shall be stored to preclude unauthorized access. Filing such material with other unclassified records in unlocked files or desks is adequate when internal building security is provided during non-working hours. When such internal security control is not exercised, locked buildings or rooms will provide adequate after hours protection or the material can be stored in locked receptacles such as file cabinets, desks or bookcases.

8. TRANSMISSION: “FOR OFFICIAL USE ONLY” information may be sent via first-class mail or parcel post. Bulky shipments may be sent fourth-class mail.

9. DISPOSITION: When no longer needed, FOUO information may be disposed of by shredding, tearing each copy into pieces to preclude reconstructing, and placing it in a trash container or as directed by the User Agency.

10. UNAUTHORIZED DISCLOSURE: Unauthorized disclosure of “FOR OFFICIAL USE ONLY” information does not constitute a security violation but the releasing agency should be informed of any unauthorized disclosure. The unauthorized disclosure of FOUO information protected by the Privacy Act may result in criminal sanctions.

11. Point of contact is PEO IEW&S Security Office, ATTN: SFAE-IEW, 6002 Combat Drive, D2304, Aberdeen Proving Ground, Maryland 21005.