A01_-_DD_254_-_Addendum_Draft.docx

ADDENDUM

To

U.S. Army Research Laboratory

DD Form 254, Contractor Security Classification Specification

Date: 10/24/2018

Contract Number:

Contractor Name:

|X| Items marked with an X are applicable to this contract

Items Continued:

|_|10a. Communications Security (COMSEC). COMSEC information includes accountable or non-accountable COMSEC information and controlled cryptographic items (CCI). If accountable COMSEC material is involved, the contractor must have a COMSEC account. Prior approval from the GCA is required in order for a Prime Contractor to grant COMSEC access to a subcontractor. The Prime Contractor should also notify the NSA Central Office of Record (COR) before negotiating or awarding subcontracts.

|_|10b. Restricted Data (RD). Restricted Data is required under this contract.

|_| 10c. Critical Nuclear Weapon Design Information (CNWDI). GCA approval is required prior to granting CNWDI access to a subcontractor.

|_|10d. Formerly Restricted Data (FRD). Formerly Restricted Data is required under this contract.

|_| 10e. This contract requires access to non-SCI intelligence information. The ARL Foreign Intelligence Office controls access to foreign intelligence information. Request for non-SCI intelligence information should be submitted to the U.S. Army Research Laboratory, ATTN: RDRL-LOD-IF, 2800 Powder Mill Road, Adelphi, MD 20783.

|_| 10f. Contractor will comply with Program Security Procedures Guide to include Security Classification Guides (list in block 11c below) and AR 380-381, Special Access Programs provided by the GCA at the performance location.

|X|10g. The Prime contractor must receive approval from the GCA to grant NATO access to a subcontractor.

|X|10h. The Prime contractor must receive approval from the GCA to grant access to a subcontractor.

|_| 10i. Limited Dissemination Information (LDI). This is no longer a valid program and you should not have any new documents or contracts reflecting this caveat.

|_| Item 10j. “For Official Use Only” (FOUO):

Marking information FOUO does not automatically qualify it for exemption. If a request for a record is received, the information shall be reviewed to determine if it actually qualified for exemption. All DOD unclassified information must be reviewed before it is released to the public or to foreign governments and international organizations.

Portion Marking FOUO Information. Subjects, titles and each section, part, paragraph and similar portion of an FOUO document shall be marked to show that they contain information requiring protection. Use the parenthetical notation “(FOUO)” to identify information as For Official Use Only for this purpose. Place the notation immediately before the text.

Access to FOUO Information: No person may have access to information designated as FOUO unless that person has been determined to have a valid need for such access in connection with the accomplishment of a lawful and authorized Government purpose. The final responsibility for determining whether an individual has a valid need to access to information designated as FOUO rests with the individual who has authorized possession, knowledge or control of the information and not with the prospective recipient. Information designated as FOUO may be disseminated within DOD Components and officials of DOD Components and DOD contractors, consultants, and grantees to conduct official business for the Department of Defense, provided that dissemination is not further controlled by a Distribution Statement.

Protection of FOUO Information: FOUO information provided to the contractor under this contract shall be protected as follows:

During working hours, reasonable steps shall be taken to minimize risk of access by unauthorized personnel. After working hours store the information in locked desks, file cabinets, bookcases, locked rooms, etc.

FOUO information and material may be transmitted via first class mail, parcel post or, for bulk shipments, via fourth class mail. Electronic transmission of FOUO information, e.g., voice, data or facsimile, e-mail, shall be approved by secure communication systems or systems utilizing other protective measures such as Public Key Infrastructure (PKI), whenever practical.

FOUO documents may be destroyed by any of the means approved for the destruction of classified information, or by any other means that would make it difficult to recognize or reconstruct the information.

Unauthorized Disclosure: The unauthorized disclosure of FOUO does not constitute an unauthorized disclosure of information classified for security purposes. However, appropriate administrative action shall be taken to fix responsibility for unauthorized disclosure of FOUO information whenever feasible, and appropriate administrative action shall be taken against those responsible. Unauthorized disclosure of FOUO information that is protected by the Privacy Act may also result in civil and criminal sanctions against responsible persons. The Military Department or other DOD Component that originated the FOUO information shall be informed of its unauthorized disclosure.

|X|10k. Other:

|X| Other: STU III/STE Use authorized as required______________

|_| Personnel assigned to this contract will require access to SIPRNet. Notify the Security office (RDRL-LOI-S) Industrial Security when contractors assigned to/and working at ARL once approval has been requested/granted.

|X| JWICS

|_| Personnel assigned to this contract will require access to JWICS. Notify the Security office (RDRL-LOI-S) Industrial Security when contractors assigned to/and working at ARL once approval has been requested/granted.

|X| 11a. Access or storage of classified information is not required at the contractor’s facility.

|_| 11b. Contractor will receive documents in order to perform on the contract but is not expected to generate classification. Any classified information generated in the performance of this contract shall be classified according to the markings shown on the source material.

|_| 11c. Information generated in the performance of this contract action will be classified in accordance with:

|_| The following security classification guides (SCG): (Title, Date)

|_| Security Classification Guidance provided at performance location.

|_| Source documents/materials

|_| 11d. If more than 2 cubic feet of storage is required contact the CSO and the Contract Security Representative.

|_| 11e. Contractor is performing a service only and is not expected to produce a deliverable item.

|_| 11f. . U.S. activity where the overseas performance will occur at theater locations designated by the COR.

|_|11g. Contractor will register with the Defense Technical Information Center (DTIC) using DD Form 1540, Registration of Scientific and Technical Information. The contracting agency will complete Sections II and Section IV as applicable.

|_| 11h. Require a COMSEC account

1.|_| COMSEC material on hand, but account not required (complete block 2) ____STE ____Facsimile ____ Other

2. |_| COMSEC support provided by:

3. |_| Secure telephone or facsimile will be used for all classified communications.

4. |_| Secure telephone, facsimile, encrypted e-mail or U.S. Postal Service is required and will be used for all controlled unclassified information (CUI) (FOUO), Export Controlled, Critical Program Information (CPI) transmissions.

|_|11i. TEMPEST requirements are additional to the requirements of the NISPOM. Thus Prime contractors may not impose TEMPEST requirements on their subcontractors with GCA approval.

|X| 11j. Operations Security (OPSEC) Requirements: Mark the applicable block below.

|_| Contractor will comply with/implement OPSEC policies and procedures provided at the contract performance location.

|X| Contractor will comply with ARL OPSEC Plan, policies and procedures to be provided by the COR.

|_| 11k. The GCA must obtain written approval from the Commander, Defense Courier Service. Only certain classified information qualifies for shipment by DCS.

|_| 11l. Other. Use of Automated Information Systems (AIS) as approved by the Defense Security Service.

|_|12. The contractor is responsible for obtaining the approval of the contracting activity prior to release of any information received or generated under the contract, except for certain types of information authorized by the NISPOM.

|_|13. US Army Research Laboratory (ARL), n conjunction with the program sponsor shall exercise final authority concerning classification matters not directed or resolved in DD Forms 254 and/or referenced.

Unclassified limited documents (e.g. FOUO, Distribution statement controlled) are not authorized for public release; therefore, they cannot be posted on a publicly accessible web server or transmitted over the internet unless appropriately encrypted. Request for public release cannot be transmitted via the internet until the contractor receives final approval from ARL, OPSEC Plans must comply with OPSEC instructions of the sponsoring activity. Individual tasks placed under this contract may require access to prescribed information (e.g., intelligence), specific classification guidance and security requirements for these tasks will be indentified on a separate DD Form 254 at the time tasks are awarded through delivery orders.

|X|13. The name, telephone number, email address and mailing address of the The The COR is Theresa Brady, 301-394-4712, teresa.a.brady2.civ@mail.mil@mail.mil. The FSO is .

|X| Is the FSO fully trained? Yes. Is there a Technology Control Plan available? Yes. The FSO is responsible for initial and refresher security briefings and debriefings.

|X|13. Suspicious Contacts. Contractors shall report efforts by any individual, regardless of nationality, to obtain illegal or unauthorized access to classified information or to compromise a cleared employee.

|X|13. Training. All employees working on-site will attend/complete annual counterintelligence, OPSEC, and security awareness refresher training provided by the ARL Security/Counterintelligence Office, Adelphi, MD.

|X| 13. A copy of DD Form 254 for all subcontracts shall be provided to ARL, ATTN: RDRL-LOD-IS (Industrial Security) 2800 Powder Mill Road, Adelphi, MD 20783.

|X| 13. Foreign National Access. Foreign nationals will not be assigned to work on or otherwise given access to contract information.

|_| 13. Subcontractor foreign national participation. Subcontractor requests for foreign national participation will be submitted through the prime contractor to the ARL Foreign Disclosure Officer as stated in item 14 below.

|_| 13. Foreign Government/Contractor Participation. The participation of foreign governments/contractors as either prime or subcontractor is not authorized.

|_| 13. Foreign national security briefings. Prior to being given access to contract information foreign nationals will be briefed on the security policies and procedures with which they will comply. These briefings will be made a matter of record and retained for two years.

|_|13. Foreign travel. Prior to foreign travel in the performance of this contact, contractor employees will be briefed on the intelligence, industrial and technical threat. Travelers will receive counterintelligence debriefing upon their return. The contractor FSO, 902d Military Intelligence Group, ARL Security and Counterintelligence Office or other competent authority, may conduct briefings/debriefings. A record of these briefings will be made a matter of record, which will be maintained for a period of 2 years.

|_|13. Other.

|_| 14. Foreign National Access. Foreign national participation/access to contract information is limited to public release information. Foreign nationals will not be assigned to work on nor given access to contract information without the written concurrence of the U.S. Army Research Laboratory Foreign Disclosure Officer (FDO) Forward request for access to the Army Research Laboratory, ATTN: AMSRD-ARL-O-IO-SC (FDO), 2800 Powder Mill Road, Adelphi, MD 20783-1197 so as to arrive not later than 10 working days prior to date access is required. The request will contain the following information:

Subject’s name:

Citizenship:

Type of visa:

Visa Expiration date:

Individual’s field of expertise:

What they will contribute to the contact work:

15. Information should be provided regarding the specific areas from which the CSO is excluded and the agency that will assume the responsibility.

16. Certification and Signature.

|X|17f.

|X| Army Research Laboratory

ATTN: RDRL-LOD-IS

2800 Powder Mill Road, Adelphi, MD 20783-1197

Last Updated October 2012