A07_W91CRB18R0002_Attachment_J-2_DD254.pdf

DEPARTMENT OF DEFENSE 1. CLEARANCE AND SAFEGUARDING

CONTRACT SECURITY CLASSIFICATION SPECIFICATION a. FACILITY CLEARANCE REQUIRED

SECRET

(The requirements of the DoD Industrial Security Manual apply to all aspects of this effort)

b. LEVEL OF SAFEGUARDING REQUIRED

SECRET

2. THIS SPECIFICATION IS FOR: (X and complete as applicable) 3. THIS SPECIFICATION IS: (X and complete as applicable)

a. PRIME CONTRACT NUMBER a. ORIGINAL (Complete date in all cases) Date (YYYYMMDD)

b. SUBCONTRACT NUMBER

b. REVISED (Supersedes all previous specs) Revision No.

Date (YYYYMMDD)

c. SOLICITATION OR OTHER NUMBER Due Date (YYYYMMDD) c. FINAL (Complete Item 5 in all cases) Date (YYYYMMDD)

W91CRB-17-R-0004

4. IS THIS A FOLLOW-ON CONTRACT? YES NO. If Yes complete the following

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract

5. IS THIS A FINAL DD FORM 254? YES NO. If Yes complete the following

In response to the contractor's request dated , retention of the identified classified material is authorized for the period of .

6. CONTRACTOR (Include Commercial and Government Entity ( CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

TBD

7. SUBCONTRACTOR

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICES ( Name, Address, and Zip Code)

TBD

8. ACTUAL PERFORMANCE

a. LOCATION b. CAGE CODE c. COGNIZANT SECURITY OFFICE (Name, Address, and Zip Code)

TBD

9. GENERAL IDENTIFICATION OF THIS PROCUREMENT

Production of Small Tactical Optical Rifle Mounted micro Laser Range Finder II (STORM II) FFP with multiple Delivery Orders.

10. THIS CONTRACT WILL REQUIRE ACCESS TO: YES NO 11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: YES NO

a. COMMUNICATIONS SECURITY (COMSEC)

INFORMATION (SIPRNET)

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHER

CONTRACTOR’S FACILITY OR A GOVERNMENT ACTIVITY

b. RESTRICTED DATA b. RECEIVE CLASSIFIED DOCUMENTS ONLY

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION c. RECEIVE AND GENERATE CLASSIFIED MATERIAL

d. FORMERLY RESTRICTED DATA: d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. INTELLIGENCE INFORMATION: e. PERFORM SERVICES ONLY

(1) Sensitive Compartmented Information (SCI) f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S., PUERTO

RICO, U.S. POSSESSIONS AND TRUST TERRITORIES

(2) Non-SCI

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL

INFORMATION CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER

f. SPECIAL ACCESS INFORMATION h. REQUIRE A COMSEC ACCOUNT

g. NATO INFORMATION i. HAVE A TEMPEST REQUIREMENT

h. FOREIGN GOVERNMENT INFORMATION j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

i. LIMITED DISSEMINATION INFORMATION k. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICE

j. FOR OFFICIAL USE ONLY INFORMATION/CONTROLLED

UNCLASSIFIED INFORMATION

l. OTHER (Specify).

k. OTHER Specify) SCG for AN/PSQ-23 &AN/PSQ-23A&B STORM MLRF 27 Feb 2013

DD Form 254, DEC 1999 Previous editions are obsolete

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the industrial Security Manual or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public release shall be submitted for approval prior to release to the Directorate for Freedom of Information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review. *In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

Direct

Through (Specify):

Public Release POC:

Program Executive Office Soldier Public Affairs Office 5901 Putnam Road, Fort Belvoir, VA, 22060

13. SECURITY GUIDANCE. The security classification guidance needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes: to challenge the guidance or classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any document/guides/extracts referenced herein.

Add additional pages as needed to provide complete guidance. The contractor will follow all security requirements within this DD254.

Ref 6, 7, & 8: Solicitation DD254 - For planning purposes only.

Ref 10j: For Official Use Only (FOUO) Information generated and/or provided under this contract shall be safeguarded and marked as specified in DOD 5200.1-R, (see continuation sheet).

Ref 10k: Security Classification Guide for the AN/PSQ-23 &AN/PSQ-23A&B STORM MLRF, dated 27 Feb 2013, will be provided. Classified info will be protected IAW AR 25-2, AR 380-67, AR 380-5 and all FOUO information will be protected IAW NISPOM Chapter 5, FOUO Protection. All contractors handling classified information must possess a SECRET clearance. PM requirements include UNCLASSIFIED through the SECRET classified levels.

See continuation sheet for Refs 11c, 11d, 11g, and 11j.

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to ISM requirements, are established for this contract. (If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement, which identifies the additional requirements. Provide a copy of the requirements to the cognizant security office. Use Item 13 if additional space is needed.)

Yes No

Only U.S. Citizens are authorized to work on this contract. The contractor will only receive classified material at the actual performance location(s) as identified in the DD254. The COR must ensure the contractor complies with the DD Form 254 and any special clauses into the contract. The contractor shall return all classified/sensitive material, to include program material, to the Government at the completion of this contract. Information Disclosure: A Certificate of Non-Disclosure shall be signed and returned to the COR prior to contract award. Copies will be maintained by the COR for the life of the contract.

All contractors performing work under this contract are required to have valid JPAS visit requests submitted to the Security Management Office (SMO) by their Facility Security Officer (FSO) for each government location where work is being performed. Contractor will return all issued U.S. Government Common Access Cards, installation badges, and/or access passes to the COR when the contract is completed or when a contractor employee no longer requires access to the installation or facility. The contractor will observe and comply with all security provisions in effect while working on the Government Installation.

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office. (If Yes, explain and identify specific areas or elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.

Yes No

NOTE: DSS does not conduct security reviews for Sensitive Compartmented Information (SCI) but is still responsible for security reviews involving Non-SCI (collateral classified information) in the possession of a contractor or subcontractor.

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL

Chancey Reynolds

b. TITLE Acquisition Operations Specialist

c. TELEPHONE (Include Area Code)

703-704-1282

d. ADDRESS (Include ZIP Code) 17. REQUIRED DISTRIBUTION

5901 Putnam Road, Bldg. 328 Fort Belvoir, VA 22060-5422

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

e. SIGNATURE

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHERS AS NECESSARY

DD Form 254, DEC 1999 Previous editions are obsolete

CUI/FOUO DD Form 254 Continuation Sheet

DD254, Block 13, Section 10j Continuation Sheet Attachment Controlled Unclassified Information (CUI) and Sub-Category for Official Use Only

(FOUO)

1. The definition of CUI is information that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Government-wide policies, excluding information that is classified pursuant to Executive Order 13526 of December 29, 2009, or the Atomic Energy Act, as amended (References (m) and (n)).

2. When CUI is to be provided to or generated by DoD contractors, the controls and protective measures to be applied shall be described in the pertinent contract documents (e.g., contract clause;

statement of work; or DD Form 254, “Department of Defense Contract Security Classification Specification”). Solicitations and contracts shall use a non-disclosure of information clause that prohibits release of unclassified information to the public without approval of the contracting activity.

3. The Contractor shall not release to anyone outside the Contractor's organization any unclassified information, regardless of medium (e.g., film, tape, document), pertaining to any part of this contract or any program related to this contract without prior approval from the government.

4. Technical Data is any recorded information related to experimental, developmental, or engineering works that can be used to define an engineering or manufacturing process or to design, procure, produce, support, maintain, operate, repair, or overhaul program material. The data may be graphic or pictorial delineations in media, such as computer software, drawings, or photographs, text in specifications, or related performance or design documents, or computer printouts. Examples of technical data include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, catalog-item identifications, and related information, and computer software documentation.

5. GOVERNMENT DISTRIBUTION STATEMENTS: Will be added to all technical data generated during the execution of this contract, in accordance with DoD Directive 5230.24.

6. The contractor shall protect CUI from unauthorized disclosure by appropriately marking, safeguarding, disseminating, and destroying such information.

7. CUI may be identified in security classification guides to ensure the information receives appropriate protection.

8. For unauthorized disclosures of CUI, no formal security inquiry or investigation is required.

However, appropriate management action shall be taken to fix responsibility for unauthorized disclosure of CUI whenever feasible or required by other guidance, and appropriate disciplinary action shall be taken against those responsible. The DoD Component that originated the CUI shall be informed of its unauthorized disclosure.

DD254, Block 13, Section 10j Continuation Sheet (continued):

(FOUO)

FOR OFFICIAL USE ONLY (FOUO)

1. The “FOR OFFICIAL USE ONLY” marking is assigned to information at the time of its creation in a DOD User Agency. It is not authorized as a substitute for a security classification marking but it is used on official government information that may be withheld from the public under exemptions 2 through 9 IAW Army Regulation 25-55, The Department of the Army Freedom of Information Act Program.

2. Control, marking, and protection of FOUO information will be in accordance with this document and Army Regulation 380-5, The Department of the Army Information Security Program, Chapter 5, para 5-1 through 5-6.

3. Specific Handling Instructions: All emails containing (FOUO) will be digitally encrypted in accordance with AR 25-1, para. 6-4 (M-7b.) dated 4 Dec 08.

4. FOR OFFICIAL USE ONLY is restricted to personnel with a valid need to know unless public release authorization has been obtained. Information, in any media format may only be disseminated of FOUO data to those individuals or organizations with direct affiliation with the given program or project. Further dissemination of such information will be at the discretion of the Government Security Manager. Personnel no longer requiring access to FOUO must delete or surrender any in their possession and terminate future access to it. The contractor may disseminate “FOR OFFICIAL USE” Attachment Controlled Unclassified Information (CUI) and Sub-Category for Official Use Only (FOUO) ONLY” (FOUO) information to their employees who have a need to know for the information in connection with this contract.

5. All FOUO material will be destroyed by tearing or shredding to make unreadable. Electronic media will be purged with approved software or destroyed through a physical process. Attachment Controlled Unclassified Information (CUI) and Sub-Category for Official Use Only (FOUO). Use of the above marking does not mean that the information cannot be released to the public, only that it must be reviewed by the Government prior to its release to determine whether a significant and legitimate government purpose is served by withholding the information or portions of it.

6. An unclassified document containing FOUO information will be marked “FOR OFFICIAL USE ONLY” at the bottom of the front cover (if any), on the first page, on each page, on the back, and on the outside of the back cover (if any). No portion marking will be shown.

7. Within a classified document, an individual page that contains both FOUO and classified information will be marked at the top and bottom with the highest security classification of the information appearing on the page. If an individual portion contains FOUO information but no classified information, the page will be marked FOUO.

8. Removal of the “For Official Use Only” marking can only be accomplished by the originator or other competent authority. When the “For Official Use Only” status is terminated, all know holders will be notified to the extent practical.

DD254, Block 13, Section 10j Continuation Sheet (continued):

(FOUO)

9. During working hours, “For Official Use Only” information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for the information. During non-working hours, the information shall be stored to preclude unauthorized access. Filing such material with other classified records in unlocked files or desks is adequate when internal building security is provided during non-working hours. When such internal security is not exercised, locked buildings or rooms will provide adequate after-hours protection or the material can be stored in locked receptacles such as file cabinets, desks, or bookcases. “For Official Use Only” information may be sent via First Class US Mail or by parcel post. Bulky shipments may be set by Fourth Class US Mail.

10. Unauthorized disclosure of “For Official Use Only” information does not constitute a security violation but the Government Customer should be informed of any unauthorized disclosure. The unauthorized disclosure for FOUO information protected by the Privacy Act may result in criminal sanctions.

DD Form 254 Continuation Sheet

DD254, Section 13 Continuation Sheet:

Ref 11c: The contractor requires access to classified source data up to and including SECRET in support of the work effort. Any extracts or use of such data requires the contractor to apply derivative classifications and markings consistent with the source documents. Use of “Multiple Sources” on the “Derived From” line necessitates compliance with the NISPOM, paragraph 4-208, and the use of a bibliography. The contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified “Confidential,” “Secret,” or “Top Secret” and requires contractors to comply with (1) the Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M), and (2) any revisions which is furnished to the contractor. Contractor performance is restricted to locations in Block 8a.

Government agency or activity will provide security classification guidance for performance of this contract. Submit visit request to the KO and/or Security Management Office for need-to-know verification.

Ref 11d: Contractor must provide adequate storage at their facility for classified hardware to the level of SECRET

Ref 11g: DD Form 1540 and DD Form 2345 must be completed for registration with DTIC. The sponsoring KO must submit DD Form 1540 “Registration for Scientific and Technical Information Services” to DTIC on behalf of the contractor. For subcontractors, the prime contractor submits the DD Form 1540 with the KO verifying the need-to-know. The contractor may also submit DD Form 2345 “Militarily Critical Technical Data Agreement” (after registration with DTIC) to the Defense Logistics Services Center for access to unclassified, militarily critical technical data from other DOD sources. The KO must certify the need-to-know to DTIC. See NISPOM Chapter 11, Section 2 for more information.

Ref 11j: The contractor shall develop an OPSEC Standard Operating Procedure (SOP)/Plan within 30 calendar days of contract award (and annually thereafter), to be reviewed and approved by the responsible Government OPSEC officer, per AR 530-1, Operations Security. The contractor should use the provided Security Classification Guides (SCG)s to develop their SOP. The SOP/Plan will specify the Government’s critical information, why it needs to be protected, where it is located, who is responsible for it, and how to protect it. In addition, the contractor shall identify an individual who will be the OPSEC Manager, and ensure that this individual is OPSEC Level II certified per AR 530-1.

This can be accomplished by completing the OPSEC Program Management Course (OPSE-2390).

The Government will evaluate contractor OPSEC performance on an annual basis or as conditions warrant. The contractor will implement an employee verification process, whether through background checks or other similar processes, and provide a written response explaining how the verification process was completed and attest to the trustworthiness of the workforce within 45 days of contract award. All contractor employees must complete initial OPSEC Awareness training within 45 calendar days of contract award and annually thereafter, http://cdsetrain.dtic.mil/opsec/index.htm.