DD_Form_254.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

Solicitation/Contract Number:

Revised: February 28, 2013 Page A1 of 2

ATTACHMENT A

ADDITIONAL GUIDELINES FOR CONTROLLED UNCLASSIFIED INFORMATION

General: There are types of information that are not classified but that require application of access and distribution controls and protective measures for a variety of reasons. This information is known as “controlled unclassified information (CUI).” The types of information considered CUI for the program are information marked “For Official Use Only” by the U.S. Government and technical data. When handling CUI material, all personnel are to comply with these requirements and follow their company policy and/or applicable Proprietary Information Agreements (PIA) concerning the protection of proprietary information in situations not clearly stated herein.

Technical Data Description: Any recorded information related to experimental, developmental, or engineering works that can be used to define an engineering or manufacturing process, or can be used to design, procure, produce, support, maintain, operate, repair, or overhaul program material. The data may be graphic or pictorial delineations in media (e.g., computer software, drawings, or photographs), text in specifications, related performance or design documents, or computer printouts. Examples of technical data include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, catalog-item identifications, and related information, and computer software documentation.

For Official Use Only (FOUO) Information Description: “For Official Use Only (FOUO)” is a Government designation applied to unclassified information that may be exempt from mandatory release to the public under the Freedom of Information Act (FOIA). FOUO information includes information identified as such in the Security Classification Guide or information from a government document marked FOUO.

CUI Markings

Marking of FOUO documents will be in accordance with Army Regulation (AR) 25-55. Information extracted from an FOUO document will carry the FOUO marking until formally reviewed by the government.

AR 25-55 can be found at http://www.apd.army.mil/pdffiles/r25_55.pdf.

Marking of Technical Data will include the statement provided in the Security Classification Guide. If the contents of the technical document require more than one Distribution Statement, apply the most restrictive statement. This does not preclude additional mandated markings as may be required by the contract.

Protection of CUI Information

Access: CUI may be released only to an individual who has a valid need for such access in connection with the accomplishment of a lawful and authorized Government purpose. Information in any media format may only be disseminated on a need-to-know basis. The need-to-know restricts the use or dissemination of CUI data to those individuals or organizations with direct affiliation with the given program or project. Further dissemination of such information will be at the discretion of the Government Security Manager. Personnel no longer requiring access to CUI must delete or surrender any in their possession and terminate future access to it.

Storing/Handling: During working hours, take reasonable steps to minimize risk of access to CUI by unauthorized personnel. After working hours, store CUI information in locked desks, file cabinets, bookcases, locked rooms, or similar means. Do not display CUI in public places (e.g., airports, airplanes, restaurants). Computers used to process CUI do not need to be accredited for classified use. Do not process CUI on public computers (e.g., those available for use by the general public in kiosks, hotel business centers) or computers that do not have access control. Personally owned computers are not authorized to process CUI. Mobile devices used to store CUI electronically (e.g., company-issued laptops, personal electronic devices [PED], removable media) must be physically protected and use NIST/NIAP-approved cryptographic products. These are available at http://iase.disa.mil/pki/eca or http://csrc.nist.gov/cryptval/.

Dissemination: CUI printed documents and material may be transmitted through mail channels or hand-carried without formal courier orders. FOUO information may be disseminated to DoD personnel and DoD contractors to conduct official business for the program. If dissemination is required outside of DoD personnel or DoD contractors, contact the Government Security Manager for approval. Technical data will follow the release instructions identified in the Distribution Statement. Use secure communications whenever possible; however, land-line telephones are more secure than cellular telephones and should be used whenever available for discussions involving CUI.

Transmit voice and facsimile transmissions only when you have a reasonable assurance that only authorized recipients will have access to the transmission. Digital transmission shall comply with the below:

Solicitation/Contract Number:

Revised: February 28, 2013 Page A2 of 2

All transmission and/or dissemination of CUI identified with a Distribution Statement or marked “FOUO” (i.e., email and file transfers) must use NIST/NIAP-approved cryptographic vendors and algorithms, e.g., DoD-approved Public Key Infrastructure Certification. These are available at http://iase.disa.mil/pki/eca or http://csrc.nist.gov/cryptval/. This encryption requirement includes passcodes to teleconferences or web conferences where there is a reasonable expectation that CUI may be discussed. When encryption is not available, a government collaborative suite (aka Integrated Digital Environment [IDE]) must be used to transmit CUI. Encrypt all wireless external data connections.

Contractor-hosted collaborative suites may be used for digital transmission and/or dissemination of CUI by personnel not located on a government backbone (e.g., NIPRNET), provided the following conditions apply:

Use only NIST/NIAP-approved cryptographic vendors and algorithms. The latest validation lists may be obtained at http://iase.disa.mil/pki/eca or http://csrc.nist.gov/cryptval/.

Use an internally hosted service that does not use a third-party collaborative suite service provider.

All computers containing CUI must be either protected by physical isolation from all personnel without a valid need for the information or protected using NIST/NIAP-approved cryptographic products. Discretionary access control measures must be used to preclude access to CUI by users who are not authorized access to CUI. After working hours, when not in physical possession of the owner, all electronic assets containing CUI must be afforded a reasonable degree of physical protection to prevent theft of program information (e.g., locking up laptops or cable locking them to a stationary base, storing in trunk, or storing out of sight).

Do not post CUI to web pages that are publicly available or have access limited only by domain/IP restrictions.

As permitted by other contract provisions, CUI may be posted to web pages that control access through the use of a DoD approved Public Key Infrastructure Certification and that provide protection via use of secure sockets, or other equivalent technologies. These are available at http://iase.disa.mil/pki/eca.

As new technologies become available in the electronics arena, care should be given to providing a reasonable degree of protection from known vulnerabilities.

The Internet is “Public Access”. CUI must be reviewed and officially approved by the PEO GCS Public Affairs Officer for public release before placing on the Internet. This is not applicable when the Internet is used for e-mail transmissions and encryption is used as noted above.

Disposal: Destroy CUI documents by any means approved for the destruction of classified information, i.e. cross-cut shredding or other means that would make it difficult to recognize or reconstruct the information. Clear, purge, or destroy CUI on removable media IAW BBP 03-PE-O-0003 Army Information Assurance Sanitization of Media to AR 25-2. This is available at https://informationassurance.us.army.mil.

Report of Loss of CUI: Report any loss of CUI or loss of CUI from a contractor information system that is known to the contractor within the period of performance of this contract to the Government Security Manager. Initial reports shall be made as expeditiously as possible in all cases within 72 hours of discovery. If additional information is required after submission and review of the initial report, guidance will be provided at that time. Mark any reports For Official Use Only, exemptions 2 and 5 apply. Initial report content shall include the following information as available.

Applicable dates, including dates of compromise and dates of discovery

Threat methodology, including all known resources used (e.g. IP addresses, domain names, software tools)

Account of what actions the threat(s) may have taken on victim system/network

What information may have been compromised, exfiltrated, or lost, and its potential impact on government programs

Report of Cyber Intrusions: Report cyber intrusions or other compromises of CUI to your supporting counterintelligence office, which will inform the DoD-DIB Common Information Sharing Environment (DCISE). Notify the Government Security Manager of any incidents as well. Refer to Report of Loss of CUI for what needs to be reported, when, and how.

Text1:

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of AEM LiveCycle Designer

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

October 31, 2020 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, DoD Contract Security Classification Specification List of Attachments [1] (All Files Must be Attached Prior to Signing, i.e., for any digital signature on the form) AMO 19-296 ATTACHMENT D GUIDELINES FOR SPECIAL ACCESS INFORMATION.pdf

ATTN: IMBE-PLS

6630 ASHLEY AVENUE, BLDG 2892

FORT BENNING, GA 31905

ARMORED BRIGADE COMBAT TEAM

7533 HOLTZ STREET, SUITE 4090 (BLDG 70)

ATTN: MR. CARL JOHNSON

10j - For Official Use Only (FOUO) Information generated and/or provided under this contract shall be safeguarded and marked as specified in DoDM 5200.-1, Volume 4, AR 380-5 or AR 25-55 and Attachment A.

10k - Contractor personnel with Common Access Card (CAC) requirements will abide by the Government Information Assurance (IA) policies and AR 25-2. COR or designated government representative will initiate any additional investigative requirements. SIPRNET access requires an annual NATO awareness briefing to inform personnel on how to protect the information in the event they come across it while on the SIPRNET. SIPRNET users must also complete Derivative Classification training (CDSE online course) every two years for the duration of the contract. Government COR or security manager will provide CDSE course registration information, NATO briefings as required, update JPAS, and maintain local records.

-- Visit authorizations (CDID SMO: W6NFAA6A and US Army Garrison-Fort Benning SMO: W6CRAA5) are required for all contractor employees performing classified services or requiring access to classified information on Fort Benning. Point of contact is Mr. Carl R. Johnson, (706) 545-4652, carl.r.johnson32.civ@mail.mil. When creating JPAS visits, include POC phone number and in the POC block, include Contracting Officer's Representative (COR) name and current contract number. For this contract, enter the following: "Carl Johnson/W91247-12-D-0008-2B06."

-- The undersigned has reviewed this Security Specification and understands the provisions therein. The undersigned will ensure compliance with the provisions within the limits of his/her responsibility. Furthermore, the undersigned will rpeort any security incidents to the supporting Security Manager and KO.

-- Performance under this contract requires access to Special Access Program information which necessitates the application of enhanced security requirements above those specified in NISPOM. Attachment D provides guidance for SAP requirements. Attachment A provides requirements for the protection of controlled unclassified information.

11a. Contract performance is restricted to sites under control of the U.S. Government. Security Classification Guides will be provided, if required. Classified material and equipment shall be created, marked, protected, and destroyed IAW AR 380-5.

11g. To use the DTIC the KO will have to complete DD Form 1540 and DD Form 2345 to register with DTIC. DTIC not authorized for SAP information.

11j. All contractor personnel must safeguard and protect critical information IAW AR 530-1 and receive annual OPSEC training.

11m. The Prime Contract Senior Insider Threat official will report any threat awareness information that is sent to DSS, to the MCoE G-2 at (706) 545-4519 or (706) 887-8055 and to the COR. The COR will ensure all contractors (cleared and un-cleared) receive TARP training, IAW AR 381.12.

CDID Security Manager

Annual requirements: OPSEC, Information awareness (IA), Anti-Terrorism/FPCON, TARP, IWatch(see block 13 and PWS, section 1.6.8)

Fort Benning, GA 31905 Address: DPTMS, SECURITY DIVISION

6630 ASHLEY AVENUE, BLDG 2892

FORT BENNING, GA 31905