Attachment_1_through_3_for_DD254.docx

Attachment 1

FOUO DD FORM 254 ATTACHMENT

Contract Number:

PROTECTING "FOR OFFICIAL USE ONLY" (FOUO) INFORMATION

1. GENERAL:

2. MARKINGS:

3. DISSEMINATION: Contractors may disseminate "For Official Use Only" information to their employees and subcontractors who have a need for the information in connection with a classified contract. Contractors must ensure employees and subcontractors are aware of the special handling instructions detailed below.

4. STORAGE: During working hours, "For Official Use Only" information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for the information. During nonworking hours, the information shall be stored to preclude unauthorized access. Filing such material with other unclassified records in unlocked files or desks, is adequate when internal building security is provided during nonworking hours. When such internal security control is not exercised, locked buildings or rooms will provide adequate after- hours protection or the material can be stored in locked receptacles such as file cabinets, desks, or bookcases.

5. TRANSMISSION: "For Official Use Only" information may be sent via first-class mail or parcel post. Bulky shipments may be sent by fourth-class mail. DoD components, officials of DoD components, and authorized DoD contractors, consultants, and grantees send FOUO information to each other to conduct official DoD business. Tell recipients the status of such information, and send the material in a way that prevents unauthorized public disclosure. Make sure documents that transmit FOUO material call attention to any FOUO attachments. Normally, you may send FOUO records over facsimile equipment. To prevent unauthorized disclosure, consider attaching special cover sheets, the location of sending and receiving machines, and whether authorized personnel are around to receive FOUO information. FOUO information may be passed to officials in other departments and agencies of the executive and judicial branches to fulfill a government function. Mark the records "For Official Use Only" and tell the recipient the information is exempt from public disclosure under the FOIA and requires special handling.

6. DISPOSITION: When no longer needed, FOUO information must be shredded.

7. UNAUTHORIZED DISCLOSURE: Unauthorized disclosure of "For Official Use Only" information does not constitute a security violation but the releasing agency should be informed of any unauthorized disclosure. The unauthorized disclosure of FOUO information protected by the Privacy Act may result in criminal sanctions and disciplinary action may be taken against those responsible.

Attachment 2

APPENDIX A

EXAMPLE OF US ARMY SAP ADDENDUM TO DD FORM 254

XXX (1) This contract requires access to Special Access Program information (SAPI). The Commander, US Army Training and Doctrine Command (TRADOC)(Fill in the name of the contracting command or activity), as the Cognizant Security Authority (CSA) for the US Army for this contract, has security oversight and management responsibility for all SAPI released to the contractor or developed under this contract, held within the Contractor's SAP Facility (SAPF) or in SCIF or SAPF under a Co-utilization Agreement (CUA). TRADOC is acting on behalf of the Technology Management Office (TMO), the Army Special Access Program Coordination Office (SAPCO) which is responsible for security oversight and management for Army SAPs. Under this contract, the Defense Security Service (DSS) is responsible for security compliance inspections of contractor SAP facilities. DSS retains responsibility for all collateral information released or developed under the contract. The contracting organization will assist the government when conducting threat and vulnerability surveys. The manuals, regulations and directives checked below provide the necessary guidance for physical, personnel, and information security for safeguarding SAPI, and are part of the security classification specification for this contract:

XXX DoD 5220.22-M-1, NISPOM, with DoD overprint and NISPOMSUB XXX JAFAN 6/3, Protecting Special Access Program Information within Information Systems XXX JAFAN 6/4, Special Access Program Tier Review Process XXX JAFAN 6/9, Physical Security Standards for Special Access Program Facilities, w/ change 2 XXX AR 25-2, Information Assurance XXX AR 380-28, DA Special Security System XXX AR 380-381, Special Access Programs (SAPS) and Sensitive Activities.

XXX Other XXX (2) Contract estimated completion date: TBD by prime contract XXX (3) The name, telephone number, email address and mailing address of the Contract Monitor (CM) for the SAP portion of this contract is: John Smith, Program Security Manager (PSM), 757-555-5555. NIPR: John.Smith@mi.army.mil / SIPR: john.smith@mi.army.smil.mil. (The Contract Monitor and the contractor security officer must be registered in the Army Contractor Automated Verification System (ACAVS) in order to process SAP actions) XXX (4) All DD Forms 254 prepared for subcontracts involving access to SAP under this contract must be forwarded to the PSM for approval and then to the Contracting Officer and Program Manager for review and concurrence prior to award of the subcontract.

XXX (5) The contractor will submit the request for SAP visit certifications through the PSM for approval of the visit. The certification request must arrive at the PSM at least ten (10) working days prior to the visit. Visit certification requests will be processed through ACAVS.

XXX (6) The contractor will not reproduce any SAPI related material without prior written permission of the CM.

XXX (7) Security Classification Guides or extracts are attached or will be provided under separate cover.

XXX (8) Electronic processing of SAP requires accreditation of the equipment in accordance with JAFAN 6/3 and AR 25-2. (Note: Check only if item 11l indicates that a requirement exists for SAP AIS processing.)

XXX (9) This contract requires a contractor SAPF.

XXX (10) This contract requires indoctrination to ZGD(U) Special Access Program.

XXX (11) The contractor will perform SAPI work under this contract at the following locations: (list all locations)

Attachment 2

APPENDIX B

INSTRUCTIONS FOR THE US ARMY SCI ADDENDUM TO DD FORM 254

General: This section contains specific instructions for preparation of the “SCI Addendum," used in conjunction with the DD Form 254, for all Army SCI contracts and their related SCI subcontracts.

a. The SCI addendum is designed for use with the DD Form 254 on all Army SCI contractual efforts and their related subcontracts. The User Agency and the appointed CM are responsible for coordinating with HQ INSCOM, ACofS Security, G2, Contractor Support Element (CSE) for developing and incorporating the SCI addendum with an appropriate DD Form 254 for the prime contract.

b. Based on the guidance provided in the DD Form 254 and SCI addendum for the prime contract, the contractor (prime) is responsible for coordinating with the CM and the CSE for developing and incorporating the SCI addendum with an appropriate DD Form 254 for all related subcontracts.

This document must be executed and accompany all DD Forms 254 issued for Request for BID (RFB), Request for Proposal (RFP), Request for Quotation (RFQ), etc., and forwarded with the DD Form 254 to the CSE prior to award of an Army SCI contract. Those items that are pre “X’d”, apply to all Army SCI contracts/subcontracts.

Item 1: Regulations listed that are not marked, are to be marked with an “X “when they apply.

Imagery Policy Series (Available from the CM): Applies when the contract/subcontract requires TK level SCI (i.e. access, documents etc.)

DCID 6/9, Physical Security Standards for Sensitive Compartmented Information Facilities. Required when the contractor is authorized a Sensitive Compartmented Information Facility (SCIF).

DCID 6/3, Protecting Sensitive Compartmented Information within Information Systems, applies when AIS processing is involved.

DIAM 50-4, Security of Compartmented Computer Operations: Applies when the contract/subcontract requires the contractor to process SCI electronically utilizing computer equipment within an accredited SCIF. (See item 11l of the DD Form 254.)

DIAM 50-24, Security for Using Communication Equipment in a SCIF: Applies when and if a contractor/subcontractor intends the use of a modem connected to an unencrypted black telephone line and/or the use of secure telephone unit data port within an accredited SCIF.

AR 25-2, Information Assurance: Applies when item 11l of the DD Form 254 is marked “Yes”.

AR 380-381, Special Access Programs (SAPS): Applies when item 10f of the DD Form 254 is marked “Yes”.

Item 2: An estimated completion date must be annotated. Do not include proposed option years. An option is not official until it is exercised by the government.

Item 3: The name, official organization address, email address and telephone number of the designated Contract Monitor (CM) by the User Agency (contracting agency/ office). NOTE: The CM designated must be either military or a DA civilian, who possess the appropriate SCI access to the levels required by the contract. Further, the CM for the prime contract is always the CM for all related subcontracts. Additionally, in this item, identify the Security POC, with telephone number and email address, at the company to be awarded the contract/subcontract.

Item 4: When a subcontract for a portion of the SCI contract is to be authorized, prior to award of the subcontract, the prime contractor must execute and forward a DD Form 254 for the proposed subcontract through the prime contract CM, for his/her approval, to the CSE for concurrence.

Item 5: Cites requirement for SCI visit certifications.

Item 6: Identifies the requirement for prior written authority to reproduce SCI and all related material.

Item 7: Identifies whether or not classification guide(s) or extract(s) exist for this specific contract and how they are to be obtained by the contractor.

Item 8: Cites the requirement to have an accreditation of all electronic processing equipment prior to the processing SCI by the contractor.

Item 9: Identifies the requirement for the contractor to have their own accredited SCIF or co-utilized SCIF to execute the SCI portion of the contract.

Item 10: Cites the accesses required for execution of the contract, mark what accesses are required for performance on the contract/subcontract. Further, allows the option of citing an estimated number of accesses required

Item 11: Requires identification, in addition to Item 8 of the DD Form 254, of any additional locations where SCI work for this specific contract will be conducted.