Attachment 3 - DD 254 Solicitation.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of AEM LiveCycle Designer

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

October 31, 2020 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, DoD Contract Security Classification Specification List of Attachments (All Files Must be Attached Prior to Signing, i.e., for any digital signature on the form)

TBD

TBD

Multiple

Government Requiring Activity(ies) servicing Security Office

804-765-1386 / james.huang.civ@mail.mil PublicAuthority: TRADOC Public Affairs Office 930 Jefferson Avenue, Fort Eustis, VA 23604

1. At Fort Lee, VA, it is at these locations:

a. CASCOM SCoE, G-3/5/7, 2221 Adams Avenue, Building 5020.

b. Quartermaster School, Aerial Delivery and Field Services, Buildings 6025, 6238.

c. Quartermaster School, 23rd Quartermaster Brigade, Buildings 3102, 3127, 9305, 11108.

d. Office of the Quartermaster General (OQMG), Building 5020.

e. Ordnance School, 500 Bridge Loop, Buildings 17500, 18031, 18032, 18038, 18033, 18034, 18039, 18041,18037.

2. Other places of performance may include these locations (as identified on individual Task Orders): Fort A.P. Hill, VA; Fort Gordon, GA; Fort Jackson, SC; Fort Leonard Wood, MO; Fort Sill, OK; Joint Expeditionary Base East, VA (formerly known as Fort Story); Eglin Air Force Base, FL; McAlester, OK and its Regional Training Sites (RTS).

3. Another location is the Joint Base Langley-Eustis (JBLE), VA (formerly known as Fort Eustis); specifically, at these locations:

a. 508th Transportation Detachment, 2743 Madison Avenue, Fort Eustis (JBLE), VA.

b. Maritime and Intermodal Training Department (MITD) Building 461 / Simulation Building 839, Fort Eustis (JBLE), VA.

REFERENCE BLOCK 10j. - CONTROLLED UNCLASSIFIED INFORMATION (CUI). For the protection of Government unclassified and sensitive unclassified information (also referred to as Controlled Unclassified Information, for example, "For Official Use Only" information), refer to DoDM 5200.01, Volume 4, DoD Information Security Program: Controlled Unclassified Information (CUI), available at http://www.esd.whs.mil/DD/DoD-Issuances. Also, refer to AR 380-5, Department of the Army Information Security Program, available from the Government Requiring Activity.

REFERENCE BLOCK 10k. - OTHER (SIPRNet ACCESS).

1. Secret Internet Protocol Router Network (SIPRNet) access is required to perform on this contract but only by select personnel as determined by the COR in writing. Contractor personnel authorized SIPRNet access are not authorized to access, download or further disseminate any classified information from SIPRNet that is outside the scope of the defined contract requirements unless specifically authorized in writing by the Government Program Manager, COR, and the Contracting Officer (KO).

2. The contractor must complete and forward to the COR or KO, a SIPRNet Access Request form for approval by the Government Requiring Activity 's SIPRNet Information Assurance Manager (IAM) prior to receiving access. NOTE: a NATO Awareness briefing and acknowledgment are required of all personnel prior to access to the SIPRNet. The briefing and acknowledgment are provided by the Government Requiring Activity's Security Manager. Contractor personnel do not require access to NATO information but SIPRNet contains such information, therefore, these individuals must be informed on how to protect it. Contractor personnel will NOT be indoctrinated in JPAS or the Defense Information System For Security (DISS) for NATO Secret access. See 10g above.

REFERENCE BLOCK 11a. - HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER CONTRACTOR'S FACILITY OR A GOVERNMENT ACTIVITY. The Contractor's Facility Security Officer (FSO) will submit a visit notification via JPAS or DISS to the Government Requiring Activity's Security Manager/servicing Security Office at the location where contractor personnel are assigned, and in positions requiring classified access. The visit notification will be sent in advance of contractor personnel reporting for their first day of work on the contract/task order.

REFERENCE 11g. - BE AUTHORIZED TO USE THE SERVICES OF DTIC OR OTHER SECONDARY DISTRIBUTION CENTER.

1. Access to DTIC is required to conduct research and perform analysis and development of requirements in performance of the contract.

2. The sponsoring KO must submit DD Form 1540 “Registration for Scientific and Technical Information Services” to DTIC on behalf of the Contractor. For subcontractors, the prime contractor submits the DD Form 1540, however, the KO must verify the need to know.

3. The Contractor may also submit DD Form 2345 “Militarily Critical Technical Data Agreement” (after registration with DTIC) to the Defense Logistics Services Center for access to unclassified, militarily critical technical data from other DoD sources. The KO must certify the need-to-know to DTIC.

REFERENCE BLOCK 13 - SECURITY GUIDANCE.

1. Security Investigations and Security Eligibility.

a. Contractor personnel in positions requiring Secret access will meet the personnel security requirements for such access while performing under this contract IAW AR 380-67, AR 380-5, and NISPOM. Contractor personnel will be U.S. citizens and have a valid investigation with Secret eligibility (or Interim Secret eligibility if authorized by the COR in writing) in place at the start of this contract as verified by the Government Requiring Activity's servicing Security Office. Contractor personnel must maintain this eligibility for the duration of the contract.

b. Contractor personnel in non-sensitive positions requiring a CAC and IT-3 access (unclassified NIPRNet), or in non-critical sensitive positions (no security clearance requirement) will be U.S. citizens. Contractor personnel in non-sensitive positions must have at minimum a valid Tier 1 investigation (or equivalent) that is favorably adjudicated for HSPD-12 CAC eligibility at start of this contract as verified by the Government Requiring Activity's servicing Security Office. Contractor personnel in non-critical sensitive positions (no security clearance requirement) must have at minimum a valid Tier 3 investigation (or equivalent) that is favorably adjudicated for Fitness at start of this contract as verified by the Government Requiring Activity's servicing Security Office.

For contractor personnel in non-sensitive or non-critical sensitive positions without a record of a personnel investigation, or have had a 24-month break or more in Federal affiliated service (including DoD contractor employment) since their last Suitability/Fitness or National Security investigation, the Government Requiring Activity will ensure the contractor employee is processed by the Government Requiring Activity's servicing Security Office for the appropriate investigation; either the Tier 1 (non-sensitive) or Tier 3 (non-critical, no security clearance) within 7 business days of starting the contract.

c. In the event a contractor employee is significantly delayed (as determined by the COR) with obtaining Interim/Final CAC eligibility, the Contractor is still required to perform the services and meet contract task order requirements.

2. Contractor personnel will protect classified information and sensitive unclassified information (also referred to as Controlled Unclassified Information (CUI), for example, For Official Use Only), IAW the NISPOM; DoDM 5200.01, Volume 4, DoD Information Security: Controlled Unclassified Information (CUI); AR 380-5; and AR 380-49. The contractor will also adhere to the security program requirements of the Government Requiring Activity for the protection of classified information and CUI.

3. All classified material/information will be provided by the Government Requiring Activity and shall be maintained and safeguarded at the Government Requiring Activity. Note: this contract will not include Critical Program Information (CPI).

4. The Government Requiring Activity will provide security classification guidance for performance of this contract.

5. Security Violations. All contractor security violations involving classified information and CUI will be reported to the KO/COR (who must notify the Government Requiring Activity's servicing Industrial Security Program Manager (ISPM), and the Program Office that has responsibility for the subject information). The Government Requiring Activity's servicing ISPM will ensure the appropriate government Security Managers, the prime contractor's FSO, and the DSS Industrial Security Representative are informed. A damage assessment is conducted by the Government.

6. Subcontracting.

a. If subcontracting is authorized, the prime contractor is responsible for issuing a subcontractor DD Form 254 for any classified work or material that the sub-contractor will have access to while working for the prime contractor. The prime contractor FSO is responsible for preparing the subcontractor DD Form 254. NOTE: the FSO will coordinate to have the prepared DD Form 254 reviewed by the COR and the Government Requiring Activity's servicing ISPM before certifying and signing the DD Form 254 at Block 17. The COR and ISPM will sign in Block 13 to document their review.

b. The prime contractor FSO will provide the KO and/or COR with a copy of all subcontractor DD Form 254s to be attached to the prime contract. The KO/COR will provide a copy of all subcontract DD Form 254s to the Government Requiring Activity's security manager and servicing ISPM.

c. The prime contractor is responsible for providing oversight of their subcontracts and must identify and report to the COR any security measures or requirements that are found both to be inadequate or excessive, and request a revision to the DD Form 254.

7. Security Training.

a. AR 380-49 requires a record of security related training of contractors and integrated (embedded) contractors be available for review.

The COR and the Government Requiring Activity's Security Manager will ensure security training is provided and documented on all contractor personnel.

b. Training requirements for contractor personnel as provided by the Government include (but not limited to) – initial Information Security Program training for new personnel via the Army Learning Management System (ALMS); annual Information Security Program refresher training via ALMS; annual Information Assurance; annual Threat Awareness and Reporting Program (TARP);

annual Antiterrorism Level I; and annual Operations Security (OPSEC).

c. All contractor personnel will attend live TARP training at least annually, and will report threat-related incidents, behavioral indicators, and other matters of Counterintelligence (CI) interest, to their FSO, the Defense Security Service, and to the 902d Military Intelligence Group (nearest military CI office). The reporting requirements are covered in Chapter 3, AR 381-12, Threat Awareness and Reporting Program.

8. CAC Issuance. Contractor personnel will not be processed for a Common Access Card (CAC) until the Government Requiring Activity's servicing Security Office verifies the individual's eligibility for CAC issuance, and has received the appropriate JPAS or DISS Visit notification on those individuals in positions requiring classified access.

9. Visitor Group Security Agreement. Contractor personnel requiring Secret access under this contract will read and sign the local Security Form 380-9, Integrated Visitor Group Security Agreement, following the initial security verification of their security requirements by the Government Requiring Activity's servicing Security Office. The Government Requiring Activity's Security Manager will ensure contractor personnel read and sign (manually) this form before access to classified information.

Security Specialist (Industrial)

Building 7124 Fort Lee, VA 23801 Address: CASCOM & SCoE / G-3/5/7 2221 Adams Avenue (Building 5020) Fort Lee, VA 23801