TE_8_-_DD_254_for_CBP.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

ATTACHMENT ONE

ADDENDUM TO DD 254

ITEM # 13 (CONTINUED), SECURITY GUIDANCE

8a: ACTUAL PERFORMANCE:

U.S. Army Human Resources Command Timothy Maude HR Center of Excellence 1600 Spearhead Division Ave Fort Knox, KY 40122

10j: FOR OFFICIAL USE ONLY (FOUO) INFORMATION: FOUO Information provided under this contract shall be safeguarded as specified in DoD 5400.7-R, “Protecting For Official USE Only (FOUO) Information.”

Also, see attached instructions on “For Official Use Only (FOUO) Information.”

10k: OTHER: Designated Restricted Area. Access will be controlled and only authorized personnel will be allowed to enter. The contractor will not allow access to anyone outside the execution of the defined contract requirements and without the guidance and written permission of the KO.

11a: HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER CONTRACTORS FACILITY OR GOVERNMENT ACTIVITY: This means that the contractor does not require “Safeguarding” capability at its facility and there will be no access to Classified National Security Information (CNSI) at the contractor’s facility.

11e: PERFORM SERVICES ONLY: The contractor will provide the following technical support to the Client:

Technical support for HRC systems.

11j: HAVE OPERATION SECURITY (OPSEC) REQUIREMENTS: OPSEC is a structured process that identifies critical information, analyzes friendly actions, integrates threat analysis and risk assessments, then helps personnel apply protective measures to mitigate unacceptable risk. Organizations and personnel supporting HRC may have OPSEC requirements associated with their activities and support.

The contractor will comply HRC OPSEC Program. The basis for the on-site contractor OPSEC program is the HRC Security Office program. The agency/POC is the Government facility OPSEC point of contact.

OPSEC requirements apply. The contractor must comply with special OPSEC requirements contained in the contract or addendum thereto. The following standard expectations are included in all work.

a. The contractor supporting specific event-oriented activities will develop OPSEC Plans/Annexes when directed by the supported program, or comply with the program's OPSEC Plan/Annex.

b. Personnel assigned will receive OPSEC Awareness Education and Duty-Related Training as deemed necessary by the Government or program supported.

c. OPSEC Awareness Education and Training will be provided or coordinated through government channels.

OTHER:

HSPD-12: The contractor shall comply with agency personal identity verification procedures identified in the contract that implement Homeland Security Presidential Directives-12 (HSPD-12), Office of Management and Budget (OMB) Guidance M-05-24, Federal Information Processing Standards Publication (FIPS PUB) number 201) and GSA HSPD-12, Standard Operating Procedure (SOP), Personnel Security Process, dated November 18, 2005.

POSITION SENSITIVITY: In accordance with DOD 5200.2-R, the DoD Personnel Security Program, this contract requires personnel performing work on a sensitive AIS to be: 1) a US Citizen, and 2) assigned to positions which are designated at one of 3 sensitivity levels (IT –I, IT – II, or IT – III). These designations equate to Critical Sensitive and Non-Critical Sensitive positions. The Contractor will ensure individuals assigned to these sensitive positions have completed the appropriate access requests forms.

• IT – Level I – Individuals assigned to positions where damage to DoD networks and development systems can be accomplished and no checks are in place to determine potential destruction of sensitive information. The investigation requirement for these positions is completion of Tier 5 investigation (formerly SSBI) with favorable results.

• IT Level – II – Individuals assigned to positions where daily unsupervised access to DoD networks and information systems containing Sensitive but Unclassified or Sensitive Classified up to and including Collateral Secret information is part of their duties. The Investigation requirement for these positions is completion of a Tier 3 investigation (formerly NACLC) with favorable results.

• IT Level – III – Individuals assigned to non-sensitive positions where daily unsupervised access to DoD networks and information systems containing Sensitive but Unclassified is part of their duties. The Investigation requirement for these positions is completion of a Tier 1 investigation (formerly NACI) with favorable results.

• These positions require that investigations be completed prior to assigning individuals to a position of trust. A US Citizen that has a Tier 3 investigation in process and a successful local records check, can be allowed assignment to the positions before the completion of the investigation, in the best interest of the DoD, at the discretion of the Contracting Officer. In those instances, an interim clearance must be granted for positions requiring access to classified information.

• The government retains the right to request removal of contract personnel, regardless of prior clearance or adjudication status, whose actions clearly conflict with the interest of the Government. The reason for removal will be fully documented in writing by the Contracting Officer. When and if such removal occurs, the Contractor will, within 30 working days, assign qualified personnel to any vacancies thus created.

• Where access to classified information is necessary in the performance of the duties called for under this contract, the guidance contained in the DoD 5200.2-R apply. A determination of eligibility for access to classified information or assignment to sensitive duties is a discretionary security decision based on judgments by appropriately trained adjudicative personnel.

ATTACHMENT TWO

ADDENDUM TO DD 254

FOR OFFICIAL USE ONLY (FOUO)

The DD Form 254, block 10J is marked YES (For Official Use Only Information (FOUO]), therefore, the contractor must comply with the following FOUO handling instructions.

1. GENERAL: The following FOUO instructions comply with guidance provided in NSTISSI 4002;

and the Privacy Act; and the Freedom of Information Act.

a. The FOUO marking is assigned to information at the time of its creation in a DOD Agency.

It is not authorized as a substitute for a security classification marking but is used on official government information that may be withheld from the public under exemptions 2 through 9 of the Freedom of Information Act.

b. Use of the FOUO marking does not mean that the information cannot be released to the public, only that the Government prior to its release to determine whether a significant and legitimate government purpose is served by withholding the information or portions of it must review it.

2. IDENTIFICATION MARKINGS:

a. An unclassified document containing FOUO Information will be marked “For Official Use Only” at the bottom of the front cover (if any), on the first page, on each page containing FOUO information but no classified information, the portion will be marked, “FOUO.”

b. Within a classified document, an individual page that contains both FOUO and classified information will be marked at the top and bottom with the highest security classification of information appearing on the page. If an individual portion contains FOUO information but no classified information, the portion will be marked, “FOUO.”

c. Any “For Official Use Only” information released to a contractor by a DOD User Agency is required to be marked with the following statement prior to transfer:

This document contains information EXEMPT FROM MANDATORY DISCLOSURE under the FOIA. Exemptions 2 – 9 apply.

d. The originator or other competent authority can only accomplish removal of the “For Official Use Only” marking. When the “For Official Use Only” status is terminated, all known holders will be notified to the extent practical.

3. DISSEMINATION: Contractors may disseminate “For Official Use Only” information to their employees and subcontractors who have a need for the information in connection with a classified contract.

4. STORAGE: During working hours, “For Official Use Only” information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for the information.

During non-working hours, the information shall be stored to preclude unauthorized access. Filing such material with other unclassified records in unlocked files or desk is adequate when internal building security is provided during non-working hours. When such internal security control is not exercised, locked buildings or rooms will provide adequate after-hours protection or the material can be stored in locked receptacles such as file cabinets, desks, or bookcases.

5. TRANSMISSION: “For Official Use Only” information may be sent via first –class mail or parcel post. Bulky shipments may be sent by fourth-class mail.

6. DISPOSITION: When no longer needed, FOUO information may be disposed of by shredding or tearing each copy into pieces to preclude reconstructing, and placing it in a regular trash container or as directed by the User Agency.

7. UNAUTHORIZED DISCLOSURE: The unauthorized disclosure of “For Official Use Only” information does not constitute a security violation but the releasing agency should be informed of any unauthorized disclosure. The unauthorized disclosure of FOUO information protected by the Privacy Act may result in criminal sanctions.

PROTECTING SPECIAL ACCESS PROGRAM (SAP) INFORMATION

(2 January 2018 edition)

Special Access Program (SAP) discussion, storage, and processing associated with this effort will be conducted in SAP Facilities (SAPF) specifically approved, in writing, by the USSOCOM SAPCO or designated USSOCOM Program Security Officer (PSO). Contact the individual in Block 16 for approved SAPF locations.

SAP activities are governed by Revision 1, of the Department of Defense Overprint to the National Industrial Security Program Operating Manual (NISPOM) Supplement; DOD Manual 5200.01 (DOD Information Security Program) Volumes 1-4, DOD Directive 5205.07 (Special Access Program Policy); DOD Manual 5205.07 (DOD Special Access Program Security Manual), Volumes 1-4; DOD Instruction 5205.11, (Joint SAP Implementation Guide (JSIG)); USSOCOM Manual 380-2 (SAP Security Guide); USSOCOM Manual 380-7 (USSOCOM Arms Control Readiness Inspection Program) and applicable program security classification guides and subsequent versions. Applicable documents will be provided to the contractor by the PSO under separate cover.

Access to SAP information requires employees to undergo additional personnel security screening and meet the requirements of DoD SAP accessing directives and policies in accordance with DODM 5205.07, Volume 2. The individual must meet applicable eligibility requirements and possess a final Secret or Top Secret security clearance depending on the level of access required in performance of this contract. Program Access Requests (PAR) for contractor personnel must be submitted by the Contractor’s Program Security Officer (CPSO) to the PSO for approval by the designated Access Approval Authority (AAA). Personnel approved for access will receive a program indoctrination briefing and must sign a SAP Indoctrination Agreement (PIA) prior to receiving access to program information or material. The CPSO will maintain the signed PIA and forward a copy to the PSO for entry into the appropriate database system.

SAP inspections and security oversight while in USSOCOM or Component government facilities are under the cognizance of the USSOCOM PSO or SAPCO representative, as appropriate. Additional Component SAP security requirements may apply for activities conducted at Service Component or Sub-unified command locations. The Performance Monitor or component command COR at these locations/facilities will provide specific or additional guidance. SAP reviews conducted at contractor facilities are under the security oversight of the Defense Security Service (DSS) unless officially relieved of oversight responsibilities.

OPSEC-sensitive or classified communication will be conducted via PSO-approved secure channels from within the SAPF. Transmission of documents via secure facsimile between terminals within SAPFs may be approved by the PSO. Only the U.S. Postal Service Register or Certified mail, if authorized, will be used to mail program material unless an alternate method is approved by the PSO. Briefed personnel are authorized to courier classified information within the continental United States with written approval from the CPSO or PSO. Two (program briefed) personnel are required to courier Top Secret material unless prior approval is obtained from the PSO. Couriers will be in the possession of PSO-issued courier authorization letters prior to travel. All material, to be mailed or carried, will be wrapped and transmitted in accordance with DODM 5205.07, Volume 1.

Prior to processing SAP information on any Automated Information System (AIS), the contractor will provide the PSO with a System Security Plan (SSP) and other documentation required in JSIG for Assessment & Authorization (A&A) from the Authorizing Official (AO), or subsequent policy. The PSO will issue program specific Security Authorization following verification of the A&A process. USSOCOM Special Access Program (SAP) Policy Memorandum: Removable Media and Two-Person Integrity Control Policy is applicable for this contract.

Destruction of program material will be conducted only by program indoctrinated personnel using destruction equipment and procedures approved by the PSO. A single person may destroy non-accountable classified material. Accountable material must be destroyed, and documented, by two program cleared individuals.

The PSO will be advised of any reports which affect the baseline facility clearance or any incident that has an adverse impact on a personnel security clearance. All briefed personnel are required to report any information that could have an impact on their ability to protect classified information. Reportable items include: foreign travel, contacts, or associations; criminal, civil, financial, or mental health issues; and changes in personal status such as marriage, divorce, or employment. CPSOs are reminded of their responsibilities to diligently report any significant action or any change in an employee’s eligibility to the PSO immediately.

Per DOD Manual 5205.07 Volume 1, Encl. 11, Sec 3. : “Any (contractual) relationship with a prospective subcontractor requires prior approval by the PSO.” All security requirements levied upon the prime contractor will “flow-down” to the subcontractor. SAP access and other requirements must be pre-coordinated and approved by the PSO prior to implementation.

IAW DODM 5200.01, Vol 3, Encl. 6, any security incident involving the potential loss, compromise, or suspected compromise of classified information must be reported to the PSO immediately using appropriate secure channels. Security infractions will be documented in the individuals personal security file and made available for review during PSO visits.

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of AEM LiveCycle Designer

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

October 31, 2020 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, DoD Contract Security Classification Specification List of Attachments [1] (All Files Must be Attached Prior to Signing, i.e., for any digital signature on the form) Addendum.pdf

CSO:

CSO:

U.S. Army Human Resources Command ATTN: AHRC-PDZ-BB 1600 Spearhead Division Avenue, Dept. 400 RM 1-2-23 Fort Knox, KY 40122-5400 Block9:

Period of Performance: is from May 4 2019 to May 3 2024 Process administrative actions to provide any function necessary to process military awards, and claims on benefits and entitlements to support the Claims and Benefits Processing (CBP) program, for the Office of The Adjutant General Directorate (TAGD) and its subordinate agencies. CBP provides support to the following programs: Combat Related Special Compensation (CRSC) and Traumatic Service members Group Life Insurance (TSGLI) under the Army Personnel Records Division (APRD); Awards and Decoration Branch (ADB) under the Soldier Programs and Services Division (SPSD); and the Physical Disability Agency (PDA) under operational oversight of the Army Deputy Chief of Staff(DCS), G-1.

- SIPRNET Access, see item 13

The COR may recommend access that may be required in execution of this contact

SECURITY SPECIALIST