A07_Attachment_11_DD254_W91CRB-16-R-0010.pdf

DEPARTMENT OF DEFENSE 1. CLEARANCE AND SAFEGUARDING

CONTRACT SECURITY CLASSIFICATION SPECIFICATION a. FACILITY CLEARANCE REQUIRED

SECRET

(The requirements of the DoD Industrial Security Manual apply to all aspects of this effort)

b. LEVEL OF SAFEGUARDING REQUIRED

SECRET

2. THIS SPECIFICATION IS FOR: (X and complete as applicable) 3. THIS SPECIFICATION IS: (X and complete as applicable)

a. PRIME CONTRACT NUMBER a. ORIGINAL (Complete date in all cases) Date (YYYYMMDD)

20160621

b. SUBCONTRACT NUMBER b. REVISED (Supersedes all previous specs) Revision No. Date (YYYYMMDD)

c. SOLICITATION OR OTHER NUMBER Due Date (YYYYMMDD) c. FINAL (Complete Item 5 in all cases) Date (YYYYMMDD)

TBD

4. IS THIS A FOLLOW-ON CONTRACT? YES NO. If Yes complete the following

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract

5. IS THIS A FINAL DD FORM 254? YES NO. If Yes complete the following

In response to the contractor's request dated , retention of the identified classified material is authorized for the period of .

6. CONTRACTOR (Include Commercial and Government Entity ( CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

TBD

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICES ( Name, Address, and Zip Code)

TBD

8. ACTUAL PERFORMANCE

a. LOCATION b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

TBD

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

This acquisition is for the competitive acquisition of the Vital Torso Protection (VTP) Component of the Soldier Protection System (SPS). The minimal buy will be one (1) set of hard body armor.

The maximum quantity will be 27 sets of hard body armor over a four-year period of performance.

10. THIS CONTRACT WILL REQUIRE ACCESS TO: YES NO 11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: YES NO

a. COMMUNICATIONS SECURITY (COMSEC)

INFORMATION (SIPRNET)

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER

CONTRACTOR’S FACILITY OR A GOVERNMENT ACTIVITY

b. RESTRICTED DATA b. RECEIVE CLASSIFIED DOCUMENTS ONLY

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION c. RECEIVE AND GENERATE CLASSIFIED MATERIAL

d. FORMERLY RESTRICTED DATA: d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. INTELLIGENCE INFORMATION: e. PERFORM SERVICES ONLY

(1) Sensitive Compartmented Information (SCI) f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO

RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

(2) Non-SCI g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL

INFORMATION CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

f. SPECIAL ACCESS INFORMATION h. REQUIRE A COMSEC ACCOUNT

g. NATO INFORMATION i. HAVE A TEMPEST REQUIREMENT

h. FOREIGN GOVERNMENT INFORMATION j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

i. LIMITED DISSEMINATION INFORMATION k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE

j. FOR OFFICIAL USE ONLY INFORMATION/CONTROLLED UNCLASSIFIED INFORMATION l. OTHER (Specify).

k. OTHER Specify) Be provided a copy of the VTP SCG.

DD Form 254, DEC 1999 Previous editions are obsolete

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the industrial Security Manual or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public release shall be submitted for approval prior to release

Direct Through (Specify):

Public Release POC:

Program Executive Office Soldier Strategic Communications 5901 Putnam Road, Fort Belvoir, VA, 22060 to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review. *In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13. SECURITY GUIDANCE. The security classification guidance needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes: to challenge the guidance or classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any document/guides/extracts referenced herein.

Add additional pages as needed to provide complete guidance. The contractor will follow all security requirements within this DD254.

Ref 6, 7, & 8: Solicitation DD254 - For planning purposes only.

Ref 10j: For Official Use Only (FOUO) Information generated and/or provided under this contract shall be safeguarded and marked as specified in DoD 5200.1-R. (See Appendage #1)

Ref 11c: The contractor requires access to classified source data up to and including Secret in support of the work effort. Any extracts or use of such data requires the contractor to apply derivative classifications and markings consistent with the source documents. Use of “Multiple Sources” on the “Derived From” line necessitates compliance with the NISPOM, paragraph 4-208a, and the use of a bibliography.

Ref 11g: The contractor will prepare a DD Form 1540, Registration for Scientific and Technical Information Services, and DD Form 2345, Military Critical Technical Data Agreement, in advance of any work to be performed through the office listed in Block 12 for authorized access to the Defense Technical Information Center (DTIC).

Ref 11j: The contractor shall develop an OPSEC Standard Operating Procedure (SOP)/Plan within 90 calendar days of contract award (and annually thereafter), to be reviewed and approved by the responsible Government OPSEC officer, per AR 530-1, Operations Security. In addition, the contractor shall identify an individual who will be an OPSEC Coordinator. The contractor will ensure that this individual becomes OPSEC Level II certified per AR 530-1. The Government will evaluate contractor OPSEC performance on an annual basis or as conditions warrant.

Ref 11l: A copy of the VTP SCG will be provided.

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to ISM requirements, are established for this contract. (If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement, which identifies the additional requirements. Provide a copy of the requirements to the cognizant security office.

Use Item 13 if additional space is needed.) (SEE ATTACHMENT(S) AND CONTINUATION SHEET(S)

Yes No

See Appendage #2

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office. (If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.

Yes No

NOTE: DSS does not conduct security reviews for Sensitive Compartmented Information (SCI) but is still responsible for security reviews involving Non-SCI (collateral classified information) in the possession of a contractor or subcontractor.

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL

Chancey Reynolds

b. TITLE

Acquisition Operations Specialist

c. TELEPHONE (Include Area Code)

703-704-1282

d. ADDRESS (Include ZIP Code) 17. REQUIRED DISTRIBUTION

5901 Putnam Road, Bldg. 328 Fort Belvoir, VA 22060-5422

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

e. SIGNATURE

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHERS AS NECESSARY

DD Form 254, DEC 1999 Previous editions are obsolete

REYNOLDS.CHANCEY.LEWIS.1186323323

Digitally signed by REYNOLDS.CHANCEY.LEWIS.1186323323 DN: c=US, o=U.S. Government, ou=DoD, ou=PKI, ou=USA, cn=REYNOLDS.CHANCEY.LEWIS.1186323323 Date: 2016.06.22 15:04:57 -04'00'

CUI/FOUO DD Form 254 Appendage #1

DD254, Block 13, Section 10j Continuation Sheet Attachment Controlled Unclassified Information (CUI) and Sub-Category for Official Use Only

(FOUO)

1. The definition of CUI is information that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Government-wide policies, excluding information that is classified pursuant to Executive Order 13526 of December 29, 2009, or the Atomic Energy Act, as amended (References (m) and (n)).

2. When CUI is to be provided to or generated by DoD contractors, the controls and protective measures to be applied shall be described in the pertinent contract documents (e.g., contract clause;

statement of work; or DD Form 254, “Department of Defense Contract Security Classification Specification”). Solicitations and contracts shall use a non-disclosure of information clause that prohibits release of unclassified information to the public without approval of the contracting activity.

3. The Contractor shall not release to anyone outside the Contractor's organization any unclassified information, regardless of medium (e.g., film, tape, document), pertaining to any part of this contract or any program related to this contract without prior approval from the government.

4. Technical Data is any recorded information related to experimental, developmental, or engineering works that can be used to define an engineering or manufacturing process or to design, procure, produce, support, maintain, operate, repair, or overhaul program material. The data may be graphic or pictorial delineations in media, such as computer software, drawings, or photographs, text in specifications, or related performance or design documents, or computer printouts. Examples of technical data include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, catalog-item identifications, and related information, and computer software documentation.

5. GOVERNMENT DISTRIBUTION STATEMENTS: Will be added to all technical data generated during the execution of this contract, in accordance with DoD Directive 5230.24.

6. The contractor shall protect CUI from unauthorized disclosure by appropriately marking, safeguarding, disseminating, and destroying such information.

7. CUI may be identified in security classification guides to ensure the information receives appropriate protection.

8. For unauthorized disclosures of CUI, no formal security inquiry or investigation is required.

However, appropriate management action shall be taken to fix responsibility for unauthorized disclosure of CUI whenever feasible or required by other guidance, and appropriate disciplinary action shall be taken against those responsible. The DoD Component that originated the CUI shall be informed of its unauthorized disclosure.

CUI/FOUO DD Form 254 Attachment

DD254, Block 13, Section 10j Continuation Sheet (continued):

Attachment Controlled Unclassified Information (CUI) and Sub-Category for Official Use Only

(FOUO)

FOR OFFICIAL USE ONLY (FOUO)

1. The “FOR OFFICIAL USE ONLY” marking is assigned to information at the time of its creation in a DOD User Agency. It is not authorized as a substitute for a security classification marking but it is used on official government information that may be withheld from the public under exemptions 2 through 9 IAW Army Regulation 25-55, The Department of the Army Freedom of Information Act Program.

2. Control, marking, and protection of FOUO information will be in accordance with this document and Army Regulation 380-5, The Department of the Army Information Security Program, Chapter 5, para 5-1 through 5-6.

3. Specific Handling Instructions: All emails containing (FOUO) will be digitally encrypted in accordance with AR 25-1, para. 6-4 (M-7b.) dated 4 Dec 08.

4. FOR OFFICIAL USE ONLY is restricted to personnel with a valid need to know unless public release authorization has been obtained. Information, in any media format may only be disseminated of FOUO data to those individuals or organizations with direct affiliation with the given program or project. Further dissemination of such information will be at the discretion of the Government Security Manager. Personnel no longer requiring access to FOUO must delete or surrender any in their possession and terminate future access to it. The contractor may disseminate “FOR OFFICIAL USE” Attachment Controlled Unclassified Information (CUI) and Sub-Category for Official Use Only (FOUO) ONLY” (FOUO) information to their employees who have a need to know for the information in connection with this contract.

5. All FOUO material will be destroyed by tearing or shredding to make unreadable. Electronic media will be purged with approved software or destroyed through a physical process. Attachment Controlled Unclassified Information (CUI) and Sub-Category for Official Use Only (FOUO). Use of the above marking does not mean that the information cannot be released to the public, only that it must be reviewed by the Government prior to its release to determine whether a significant and legitimate government purpose is served by withholding the information or portions of it.

6. An unclassified document containing FOUO information will be marked “FOR OFFICIAL USE ONLY” at the bottom of the front cover (if any), on the first page, on each page, on the back, and on the outside of the back cover (if any). No portion marking will be shown.

7. Within a classified document, an individual page that contains both FOUO and classified information will be marked at the top and bottom with the highest security classification of the information appearing on the page. If an individual portion contains FOUO information but no classified information, the page will be marked FOUO.

8. Removal of the “For Official Use Only” marking can only be accomplished by the originator or other competent authority. When the “For Official Use Only” status is terminated, all know holders will be notified to the extent practical.

CUI/FOUO DD Form 254 Attachment

DD254, Block 13, Section 10j Continuation Sheet (continued):

Attachment Controlled Unclassified Information (CUI) and Sub-Category for Official Use Only

(FOUO)

9. During working hours, “For Official Use Only” information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for the information. During non-working hours, the information shall be stored to preclude unauthorized access. Filing such material with other classified records in unlocked files or desks is adequate when internal building security is provided during non-working hours. When such internal security is not exercised, locked buildings or rooms will provide adequate after-hours protection or the material can be stored in locked receptacles such as file cabinets, desks, or bookcases. “For Official Use Only” information may be sent via First Class US Mail or by parcel post. Bulky shipments may be set by Fourth Class US Mail.

10. Unauthorized disclosure of “For Official Use Only” information does not constitute a security violation but the Government Customer should be informed of any unauthorized disclosure. The unauthorized disclosure for FOUO information protected by the Privacy Act may result in criminal sanctions.

DD Form 254, Section 14, Appendage #2

Section 14 Additional Security Requirements:

1. Contractor personnel shall have the appropriate level of investigation and/or security clearance for site of performance of work. The Contractor will observe and comply with all security provisions in effect at the selected site. The contractor will only receive classified material at the actual performance location(s) as identified in the DD254. The COR must ensure the contractor complies with the DD Form 254 and any special clauses into the contract. The contractor shall return all classified/sensitive material, to include program material, to the Government at the completion of this contract. Information Disclosure: A Certificate of Non-Disclosure shall be signed and returned to the COR prior to contract award. Copies will be maintained by the COR for the life of the contract. All contractors performing work under this contract are required to have valid JPAS visit requests submitted to the Security Management Office (SMO) by their Facility Security Officer (FSO) for each government location where work is being performed. Contractor will return all issued U.S.

Government Common Access Cards, installation badges, and/or access passes to the COR when the contract is completed or when a contractor employee no longer requires access to the installation or facility. The contractor will observe and comply with all security provisions in effect while working on the Government Installation.

2. Only U.S. Citizens are authorized to work on classified tasks.

3. Contractor must have a Facility Clearance.

4. The contractor shall not release any information or data under this contract without the approval of the Procuring Contracting Officer. A Non-Disclosure Agreement (NDA) shall be signed and returned to the COR upon task order award.

5. To preserve national security interests, the contractor shall ensure that all aspects of the work performed under specific task are evaluated for conformance with security procedures and standards.

The contractor shall evaluate all information, material, products for security implications and prepare appropriate security documents and plans as necessary.

6. The contractor shall be capable of handling, receiving and storing SECRET documents, equipment, and test items, using the applicable standards of “SECRET” information.

7. The contractor and all associated subcontractors shall brief all employees on the iWATCH program. This training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR/ATO. The contractor shall access the iWATCH training at http://mdwhome.mdw.army.mil/iwatch and provide written confirmation to the COR that the training was completed within 60 calendar days of contract award and within 45 calendar days of new employees commencing performance.

8. The contractor will implement an employee verification process, whether through background checks or other similar processes and provide a written response explaining how the verification process was completed and attest to the trustworthiness of the workforce, within 45 days of contract award.

DD Form 254, Section 14, Continuation Sheet

Section 14 Security Requirements (continued):

9. The contractor shall provide adequate physical, transportation, and informational security of Government property including test hardware, weapons, ammunition, technical data, and proprietary information.

10. All Contractor and subcontractor employees, who require access to Army installations, facilities, or controlled access areas, shall complete Level I Awareness Training (AT) within forty-five (45) days after contract start date or effective date of incorporation of this requirement into the contract, whichever applies. The Contractor shall submit certificates of completion for each affected Contractor and subcontractor employee to the COR/Anti-Terrorism Officer (ATO), or to the KO if a COR is not assigned, within sixty (60) calendar days of the completion of training. AT Level I AT is available at http://jko.jten.mil/courses/atl1/launch.html

11. The contractor and all associated subcontractors’ employees shall comply with applicable installation, facility, and area commander installation and facility access and local security policies and procedures (provided by the Government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by the installation Provost Marshal Office, Director of Emergency Services, or Security Office. The contractor workforce must comply with all personal identity verification requirements as directed by DoD, HQDA, and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

12. Per AR 530-1, Operations Security, contractor employees working on the SPS VTP program must complete Level I OPSEC training within 30 calendar days of contract award. All contractor employees must complete annual OPSEC awareness training at the following link:

http://cdsetrain.dtic.mil/opsec/.