ATTACH_1_DD254.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

ATTACHMENT TWO (Continuation of Block 14 of the DD Form 254 for Contract To Be Determined)

14. Additional Security Requirements.

Facility Clearance. The contractor shall possess a SECRET Facility Clearance as prescribed by the DD Form 254, Contract Security Classification Specification.

Verification by the ATC Security and Intelligence Division shall be made to the Defense Security Service (DSS) using the National Industrial Security Program (NISP) Central Access Information Security System (NCAISS).

Personnel Security Clearances. All contractor employees shall possess at the time of contract award a final SECRET clearance. Within 30 days of employment, every new contract employee will receive a security indoctrination briefing. This briefing will at a minimum include the following topics: general security education, OPSEC awareness, Information Systems Security, Force Protection, and training on the Threat Awareness Reporting Program (TARP). This training will also provide any additional security training that may be job specific to the duties performed by the contractor. The contractor will notify the government in writing when this initial security training has been completed. A visit request will be submitted at the initial Phase In period of this contract and annually thereafter by the Facility Security Officer (FSO) or alternate FSO via the Joint Personnel Adjudication System (JPAS) to the ATC SMO code of W4QUAA. If JPAS is not available, a visit authorization letter shall be prepared on company letterhead and verified and signed by the FSO. In addition, the contractor shall notify the ATC Security Manager immediately when an employee resigns, is terminated, loses their security clearance or adverse information becomes available on an employee.

The ATC Security Manager can deny that contract employee access to the Restricted Area if the adverse information warrants loss of access to ATC’s Restricted Area.

Contract personnel whose security clearances are suspended shall not be permitted to work under this contract until their security clearance is reinstated. At the conclusion of this contract, the FSO or Alternate FSO, will submit a termination letter to the ATC Visitor Desk and a copy sent to the ATC Security Manager. All contract employees whether travelling on government orders or for personal travel, will report this travel to the ATC Security Manager

Information Systems (IS) Access. The contractor shall designate Information Technology (IT) positions for all personnel requiring access to IS in accordance with Army Regulation 25-2, Information Assurance, Army Regulation 25-1, Army Knowledge Management and Information Technology Management, Army Regulation 380-67, Department of the Army Personnel Security Program and Army Regulation 380-5, Department of the Army Information Security Program. ATC computer related positions will be designated as IT 1, 2, or 3. The contractor shall request the appropriate personnel security investigation based upon the IT position designation. The investigations must be favorably completed prior to employees being permitted access to IS and being placed in an IT position. All positons under this contract are designated as IT 3. The contractor shall prepare a list identifying this IT position designation and submit to the ATC

Information Assurance Manager (IAM) and ATC Security Manager. In accordance with Army Regulation 25-1, all employees requesting access to an IS shall be required to sign an Acceptable Use Policy (AUP) and adhere to the policies outlined in the document regarding acceptable use of Government-owned computer systems and networks. This document will be reviewed and signed annually thereafter. Also, prior to gaining access to a government computer system, all employees must take initial Cybersecurity Awareness training and annually thereafter. This is mandatory on line training which will be completed by scheduling an appointment with the Cybersecurity Office. All Army IS will be used for OFFICIAL business only. Using Army IS to access pornographic, game, militia or similar sites is strictly prohibited. Access to chat rooms (except AKO chat), use of commercial email addresses to send or receive DoD information, and use of Army IS to download shareware is also strictly prohibited. The contractor shall ensure that all IS used by contractor personnel are protected and accredited in accordance with Army Regulation 25-2 and related supporting directives and AUP guidance published by ATC. Any DoD information processed on either Government furnished or contractor furnished computers belongs to the Government.

During the Phase-In period, the Contractor shall complete a Request for Access (DD Form 2875 System Authorization Access Request) and Non-Disclosure Statement to ATC Computer Systems for the designated employees. This form shall be returned to the Government designee after completion. Where applicable, the contractor shall recommend through the COR to the ATC IAM the appointment of an Information Assurance Security Officer and alternate(s). Prior to any classified work being processed on an IS regardless of location, approval must be obtained by the ATC Information Assurance Manager and the ATC Security Manager.

Usage of Privately Owned Personal Electronic Devices (PEDs) Within the Restricted Area (RA). A privately owned personal electronic device (PED) is defined as a civilian multifunction cell phone, personal digital assistant, tablet, blackberry, personal wireless fitness devices (PWFD), digital inventory devices and electronic recording/storage devices. Contractor personnel shall not use the PED’s photographic/recording capability within the ATC Restricted Area (RA). The contractor shall not install or connect a privately owned PED to any government-owned computer or network system. Also, a PED that has the capability to store data cannot be connected to a government computer for purposes of charging the device’s battery. Contractor employees must use the appropriate wall adapter to charge a privately owned PED. All PEDs (government or personal) are prohibited in any area that contains a Secure Internet Protocol Router Network (SIPRNET) connection; in any area or briefing room where classified material is being discussed; and in any area designated as a Special Access Program (SAP) area.

PEDs are authorized for private, non-work related matters. Under no circumstances will a privately owned PED be used to transmit sensitive government information.

Reports of Adverse Information. The contractor shall report to the ATC Security Manager immediately all adverse information on contractor personnel such as security violations, arrests, bankruptcy, wage garnishments and denial, suspension, or revocation of security clearances. The ATC Security Manager may deny employees’ access into APG restricted areas based upon the adverse information.

Installation Access. All contractor personnel will comply with the requirements of APG Regulation 190-4, Movement Control Within the Installation, for entry, exit, and internal control of personnel, material and vehicles on APG. To gain access to APG, DA Form 1602, Civilian Identification Card, shall be issued to contractors who do not require computer access or do not travel on official Government business upon written approval from the COR. All vehicles and personnel are subject to search and seizure of contraband and/or unauthorized Government property in accordance with Army Regulation 190-13, The Army Physical Security Program.

Unescorted Access into Restricted Areas. Unescorted access will be permitted into the APG restricted area provided the contractor employee was issued a final SECRET clearance by the Central Adjudication Facility (CAF). Most areas of ATC are within the restricted areas of APG.

Restricted Area (RA) Security Identification Credential. Contractor personnel will be granted unescorted access provided the security clearance requirement stated above has been met. Once a written request from the COR has been received and the security clearance has been verified by the visit authorization letter or a visit request submitted via JPAS, the contractor employee will have their Department of Defense Common Access Card (CAC) programmed for unescorted access into the RA. At the same time the contract employee’s CAC is programmed, they will be issued an organizational credential to be used while in the RA. This credential identifies that the employee has an official need to be in the RA. If a contractor requires camera pass authority, their government point of contact must send an email to ATC Security justifying why the individual needs camera authorization in the RA. Once approved by ATC Security, a camera pass icon will be placed on the organizational credential. At no time will a contractor be permitted to take any type of photographs, video or recording with their personal cellular or Smartphone while in the Restricted Area (RA). Contractor personnel will wear their security credential above the waist at all times when in the restricted areas of APG with the following exceptions: (a) when photography is ongoing and the employee is likely to be in the photograph, and (b) when the employee is actually working with a piece of equipment that could catch the security credential and endanger the safety of the employee.

Photographic and Recording Permits. The Contractor is not authorized to use any type of photographic and recording equipment within APG restricted areas.

Common Access Card. All contractor employees who require computer access or travel on official Government business shall be issued a Department of Defense Common Access Card (CAC) through the Defense Enrollment Eligibility Reporting System (DEERS). CACs are processed in accordance with the guidelines for the Trusted Associate Sponsorship System (TASS). The contractor organization security manager gets the upcoming applicant vetted per requirements and forwards that information to the COR who is the Trusted Agent (TA) identified in the TASS. Once the TA receives the required information, it is entered into the TASS. The system generates an ID and new applicant password. The ID and password is forwarded to the applicant who will enter this information into TASS. The system will receive this information and it will notify the applicant with an approval email. Once the TA approves issuance of a CAC to the applicant through the TASS, the applicant can go to the nearest RAPIDS center with the proper identification and will be processed for a CAC which will be issued to them on the spot.

Safeguarding Government Information and Property. The contractor shall be responsible for safeguarding all Government information and property provided for contractor use. The contractor shall safeguard information and material designated as classified, unclassified sensitive, For Official Use Only (FOUO), Operations Security (OPSEC) sensitive, and Personally Identifiable Information (PII) in accordance with applicable directives stated in Item 13 (Security Guidance). The contractor will not release any work related information to the public without prior authorization. In addition, the contractor will not post any personal comments associating them with working for the federal government or any type of work related information on social media platforms. This includes discussion forums, blogging, etc. Contractor personnel who have access to the Army Test and Evaluation Command (ATEC) Decision Support System (ADSS) will not disclose ADSS information to any person or entity without explicit authority. Government-furnished property will be secured in accordance with AR 190-51, Security of Unclassified Army Property (Sensitive and Nonsensitive).

Foreign Nationals/Immigrant Aliens. Foreign nationals/immigrant aliens are not authorized to work on this contract.

Loss or Possible Compromise of Classified Information. The contractor shall immediately report the loss or possible compromise of classified information or material to the ATC Security Manager or his designee in accordance with ATC Regulation 380-5, Information Security Program. In the event that there is a data spillage, the contractor will immediately notify their government supervisor, ATC Security Manager or his designee and the ATC Information Assurance Manager.

Courier Card. The contractor may be required to hand carry classified material from one location on the installation to another location. Also, the contractor may be required to hand carry classified to another cleared facility or military organization. In accordance with Army Regulation 380-5, Department of the Army Information Security Program, the contractor will be in possession of the DD Form 2501, Courier Authorization Card. The card authorizes the appropriately cleared government civilian and contractor to hand carry classified material. The contractor’s level of clearance will be the same level of classified material that is being hand carried. If a contractor needs a DD Form 2501, their government sponsor must submit a written request to the COR. The COR will forward request to ATC Security for approval and subsequent issuance of the card. A courier briefing will be given by ATC Security to all courier card holders prior to issuance of the card. If the contractor loses access or leaves employment with the contractor, the card will be returned to ATC Security.

Key Control. The contractor shall have access as needed to all Government-furnished facilities in accordance with Army Regulation 190-11, Physical Security of Arms, Ammunition and Explosives, Army Regulation 190-51, Security of Unclassified Army Property (Sensitive and Nonsensitive), Army Regulation 380-5, Department of the Army Information Security Program and ATC Regulation 380-8, Security Key and Lock Control. The contractor shall develop and implement procedures to account for, control and safeguard metal and electronic keys and proximity cards received from the Government in accordance with above regulations.

Security Training. The contractor shall develop and implement a security education program to ensure contractor personnel understand and are familiar with security requirements. The contractor shall conduct security indoctrination for all new employees within 30 days after their arrival and refresher sessions annually thereafter. Upon completion of the security indoctrination, the contractor will have each employee sign the Standard Form (SF) 312 Classified Information Nondisclosure Agreement prior to granting access to classified information. The contractor will maintain the SF 312 on each employee and this document should be available to the government upon request.

Contractor personnel may attend ATC’s annual refresher training; however, contractor personnel who are unable to attend the training shall receive the same training from contractor management. This training will include general security education, OPSEC awareness, Information Systems Security, Force Protection, and training on the Threat Awareness Reporting Program (TARP). Designated ATC Security personnel will conduct Anti-Terrorism/Force Protection training for contractor personnel traveling OCONUS. The FSO or the alternate FSO will provide through the COR a record of all contractor employees who have attended annual mandatory training by name and date of attendance to the ATC Security Manager.

iWATCH Training. All contractors who perform their tasks within an Army controlled installation, facility or area must be briefed on iWATCH procedures. The contractor and all associate sub-contractors shall brief all employees on the local iWATCH program (training standards provided by the requiring activity Anti-Terrorism Officer (ATO)).

This locally developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 days of new employees commencing performance with the results reported to the COR upon completion of this training.

Operations Security. All written (hard copy) and electronic material produced by the contractor which will be disseminated outside of ATC will be subject to an OPSEC and Security review to be performed by the ATC OPSEC Officer prior to release. This includes all written (hardcopy) and electronic materials produced such as organizational press releases and marketing material. All information associated with a program that is indicated as unclassified/sensitive by the COR shall be afforded protection sufficient to preclude disclosure to individuals who do not have a need to know of the material. As a minimum, the following requirements apply:

a. Distribution of information/reports of this contract shall be limited to personnel associated with this contract and applicable Government personnel.

b. Documents/material shall be kept under lock and key when not in use.

c. Documents/material indicated by the COR as unclassified/sensitive which are no longer required shall be destroyed by shredding or by placing information in a box for destruction during a trip to the incinerator.

Disclosure of Proprietary and Intellectual Information. The contractor may be required to access data and information that is proprietary to another government agency, government contractor or of such a nature that its dissemination or use other than as specified would be adverse or contradictory to the government’s interest. The contractor and their employees shall not divulge or release data or information developed or obtained under this contract except to authorized government personnel or upon written approval from the Contracting Officer. The Contractor shall not use, disclose or reproduce proprietary data that bears a restrictive legend. The Contractor shall obtain written permission of the originator prior to releasing any information. Under Title 18, Sections 793 and 798, the Contractor and the Contractor employees are liable for any improper release. The Contractor will direct all inquiries, comments, or complaints arising from matters observed, experienced, or learned as a result of, or in connection with the performance of this contract to the Contracting Officer. The resolution of which may require dissemination of official information. In this case, the Contracting Officer, upon a request from the contractor, will coordinate with the ATC Security Manager or designee for guidance. Inquiries the Contractor receives for information relative to the Freedom of Information Act (FOIA) shall be directed to the Contracting Officer, or COR for evaluation. The Government retains the authority to release or deny access to the information. The Contractor shall be responsible for search and submission of records under the Contractors control upon Government request. All work, including but not limited to intellectual property and data rights, produced under this contract is the sole property of the Government.

Departing Employees. The contractor shall ensure all contractor employees return photographic security identification badges and Common Access Cards/ Identification Cards and all permits issued by the Government at the completion of their employment.

All issued keys will be returned before departure. The turn in of these items will be completed no later than 24 hours after their departure. The contractor will ensure that all contract employees receive a security debriefing upon their departure. Following the debriefing, the employee will sign the bottom portion of the SF 312. The contractor will ensure that all employees who maintain a hand receipt do not leave the installation until all items have been accounted for and all equipment under their control has been transferred to the new hand receipt holder. An employment/installation clearance procedure and checklist will be developed and implemented by the contractor to ensure that an employee has turned in all badges, Government property, and keys before leaving employment on the installation and access to the Local Area Network (LAN)/email has been cancelled. This checklist will contain a signature block for the ATC Security and Intelligence Division to initial to ensure all contract employees have cleared all aspects of employment at ATC. Security badges will be returned to the ATC Security and Intelligence Division on the employee’s last day of employment with the government. If departure is after normal business hours, the FSO will collect the badge on the last day of employment and turn the badge in to ATC Security and Intelligence Division the next business day. Keys and proximity cards will be returned to the issuing key custodian prior to the employee departing ATC.

Force Protection. The contractor shall ensure that each contractor employee receives annual Level I Antiterrorism awareness training per Army Regulation 525-13 (Antiterrorism). Contractor personnel may attend ATC’s annual Force Protection training; however, contractor personnel who are unable to attend the training shall receive the same training from contractor management.

ATTACHMENT ONE (Continuation of Block 13 of the DD Form 254 for Contract Number To Be Determined)

13. Security Guidance.

Item 10j. This contract does require access to Controlled Unclassified Information (CUI). All CUI information that is generated, handled and stored will be in compliance with the Department of Defense Manual Number 5200.01, Volume 4, DoD Information Security Program: Controlled Unclassified Information (CUI). This manual provides guidance for the identification and protection of CUI.

Item 11c & 11d. All classified material that is generated, handled, and stored will be in compliance with AR 380-5, Department of the Army Information Security Program. The highest level of classification for this contract is SECRET. The contractor will be receiving, storing and generating classified information (documents). Individual security classification guides will be provided by the ATC Program Manager for the services to be performed under this contract. Contractor must provide a GSA approved security container at their facility for storage of classified documents up to the level and including SECRET. The security container will have the capacity to store several folders. The safe dimensions should have a minimum capacity of 12" X 12" X 8".

Item 11j. The contract requires planning for and application of OPSEC in accordance with Army Regulation 530-1, Operations Security (OPSEC) and the contract clauses and statement of work.

OPSEC guidance will also be provided as applicable for the services to be performed under this contract. In addition, the ATC Security Manager shall advise the contractor of ATC’s Critical Information (CI), why it needs to be protected, where it is located, who is responsible for it and how to protect it. Individual security classification guides and test plans will be provided by ATC for performance of this contract as needed.

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of AEM LiveCycle Designer

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

October 31, 2020 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785 DD 254, DoD Contract Security Classification Specification List of Attachments [2] (All Files Must be Attached Prior to Signing, i.e., for any digital signature on the form) ATTACHMENT ONE To Be Determined for Body Armor Solicitation.pdf ATTACHMENT TWO To Be Determined for Body Armor 254.pdf

NA

6943 Colleran Road Aberdeen Proving Ground, MD 21005-5059

1. Security Classification Guide for Interceptor Body Armor (IBA), dated 25 October 2005

2. Security Classification Guide for Armor Materials and Technology, dated 10 April 2002

3. Security Classification Guide for Soldier Protection System (SPS), dated 7 January 2013

3. (DOD) 5200 I-R, Transmitting or Transporting of Classified Information

Hard body armor plates are tested with threat ammunition. Each type of threat ammunition is coded, so unclassified FOUO reports can be generated. During testing, the range personnel have access to the threat codes as well as the barrel type. th range personnel must have SECRET security clearances, since they have all the information required to correlate information that is classified as SECRET.

During routine operation, the range personnel will not produce any classified media, but there is the potential that classified media could be generated either in paper, digital or video format. The range security officer must brief all range personnel on procedures as not to generate classified media. Range personnel shall use threat codes in conversation and shall segregate all data that could be combined to form a classified document.

Range personnel must immediately notify their security officer if classified information is inadvertently generated. Once generated, the range security officer must immediately segregate, mark and store the classified information. The range security officer must then contact the ATC security officer for guidance on the disposition of the classified information.

Contracting Officer Representative, ATC

(410) 278-3779 rep: JENELL BIGHAM ATC Industrial Security Specialist

(410) 278-2953

6515 Integrity Court Building 4310 Aberdeen Proving Ground, MD 21005-3013 Address: Building 324 6867 Colleran Road Aberdeen Proving Ground, Maryland 21005-5059