ATT0021 item b TEIS IV - DD254 Item 13 Continuation Page.pdf

DD Form 254 – Item 13 Continuation Page Contract Number:

Solicitation Number:

Page 1 of 8Current Version Date: 20250715

All item checked "YES", will apply to this effort. Add any additional requirements may be added in the "Remarks" section if necessary. Items that are checked "NO", add the statement, "NOT APPLICABLE TO THIS EFFORT".

YES NO Requirements YES NO 4. Follow-on contract. The classified portion of work has been completed on the contract cited in this item. The processing of classified will no longer be done under this contract. All classified material/information associated with this contract is authorized to be transferred to the contract number cited in Item 2a of the DD Form 254. Remarks:

YES NO 8. Actual Places of Performance. Reference Item 8 of the DD FORM 254 for actual places of performance. Specific remarks regarding those locations are found below and/or places of performance are duplicated.

Remarks:

YES NO 10a. Communication Security (COMSEC) Information. Access to COMSEC material is required in the performance of this contract. Access to COMSEC requires a final clearance. The contractor may be authorized to receive government furnished cryptographic equipment, if a COMSEC account is required and if Item 11h of this DD Form 254 is checked. Contractor personnel are subject to The Department of Army Cryptographic Access Program (DACAP), IAW AR 380-40. The contractor shall comply with NSA/CSA Manual 3- 16, AR 380-40, and the Committee of National Security Systems Instructions (CNSSI) 4001, “Control of Communications Security Material,” or other guidance provided by the central office of record. If access to COMSEC information is required at Government facilities, contractor shall adhere to the government COMSEC plan or guidance. Approval by the KO/COR is required prior to transporting or carrying classified COMSEC material on a cleared commercial carrier or passenger aircraft. The government project manager shall designate the number of personnel requiring cryptographic (CRYPTO) access. Approval by the KO is required prior to the flow down of COMSEC requirements to any subcontractor.

Remarks:

YES NO 10b. Restricted Data. Contractor requires access to Restricted Data per the PWS. Refer to 10 CFR 1045 “Nuclear Classification and Declassification” and Atomic Energy Act of 1954, as amended, for further information. Approval by the KO is required prior to the flow down of Restricted Data requirements to any subcontractor.

Remarks:

NOT APPLICABLE TO THIS EFFORT. REQUIREMENT WILL NOT BE LEVIED ON THE

CONTRACTOR.

YES NO 10c. Critical Nuclear Weapon Design Information (CNWDI). Contractor requires access to Critical Nuclear Weapons Design Information. Special briefings and procedures are required. Approval by the KO is required prior to the flow down of CNWDI requirements to any subcontractor. Remarks:

NOT APPLICABLE TO THIS EFFORT. REQUIREMENT WILL NOT BE LEVIED ON THE

CONTRACTOR.

YES NO 10d. Formerly Restricted Data. Contractor requires access to Formerly Restricted Data (FRD) per the PWS, SOW, or SOO.

Remarks:

NOT APPLICABLE TO THIS EFFORT. REQUIREMENT WILL NOT BE LEVIED ON THE

CONTRACTOR.

W91RUS27RA001

Solicitation Number:

Page 2 of 8Current Version Date: 20250715

YES NO Requirements YES NO 10e(1). Sensitive Compartmented Information (SCI).

Access to Intelligence information that is Sensitive Compartmented Information (SCI) may be required in the performance of this contract. Refer to the SCI Addendum for additional guidance.

Contractors are required to complete SCI training requirements through COR approved appropriate training systems/databases. Only those personnel that require access to SCI information to complete their job duties will be provided SCI access. Approval by the KO is required prior to the flow down of SCI requirements to any subcontractor.

Remarks:

YES NO 10e(2). Non-Sensitive Compartmented Information (Non-SCI). Access to Intelligence information that is Non-SCI may be required in the performance of this contract. Approval by the KO is required prior to the flow down of Non-SCI requirements to any subcontractor.

Remarks:

YES NO 10f. Special Access Programs (SAP). Contractor requires access to SAP. Information per the PWS, SOW, or SOO. Contractor will comply with DoDM 5205.07 (Volumes 1-4), AR 380-381, and requirements and directions provided by the Program Security Officer (PSO), name and contact information found below, or successor. Approval by the KO is required prior to the flow down of SAP requirements to any subcontractor. Requiring Activity’s (RA) PSO is required to provide the SAP Security Plan to contractors for adherence.

PSO Name (must be completed if 10f is checked YES: PSO Contact Information (Phone and DISA Email): Remarks:

NOT APPLICABLE TO THIS EFFORT. REQUIREMENT WILL NOT BE LEVIED ON THE

CONTRACTOR.

YES NO 10g. North Atlantic Treaty Organization (NATO). Contractors that require access to NATO Information per the PWS, SOO or SOW requires a final clearance and NATO access briefing/ debriefing. If there are specific levels of NATO accesses, list the specific levels in the “Remarks” section as appropriate. Approval by the KO is required prior to the flow down of NATO requirements to any subcontractor.

Remarks:

YES NO 10h. Foreign Government Information (FGI). Contractor requires access to Foreign Government Information per the PWS, SOW, or SOO. FGI is classified information provide to the U.S. by a foreign government(s). Access to FGI requires final clearance.

Remarks:

NOT APPLICABLE TO THIS EFFORT. REQUIREMENT WILL NOT BE LEVIED ON THE

Solicitation Number:

Page 3 of 8Current Version Date: 20250715

YES NO Requirements YES NO 10i. Alternative Compensatory Control Measures (ACCM). Contractor requires access to ACCM

Information.

Remarks:

NOT APPLICABLE TO THIS EFFORT. REQUIREMENT WILL NOT BE LEVIED ON THE

CONTRACTOR.

YES NO 10j. Controlled Unclassified Information (CUI). Access to CUI is required in the performance of this contract. Information designated as CUI, generated or provided under this contract shall be controlled, handled, stored, marked, safeguarded, transmitted, and destroyed IAW DoDI 5200.48 and AR 380-5. Contractor and sub-contractor employees shall complete annual CUI training.

Remarks:

YES NO 10k. Security Classification Guides (SCG). SCGs associated with this effort are listed below by title, date, and office of primary responsibility per AR 380-49. Contractor will require access to all SCGs listed below:

Remarks:

YES NO 10k. Secured Internet Protocol Network (SIPRNet). SIPRNet access is required for the performance of the contract. Requests for access will be submitted to the COR to facilitate the local vetting and approval process. Contractor personnel must follow appropriate processes for obtaining login credentials to SIPRNet. Contractor personnel must be cleared at the SECRET level in order to obtain access to SIPRNet. If SIPRNet is required at the contractor facility, the FSO shall coordinate with appropriate DCSA representatives. The contractor must receive a NATO awareness briefing before having access to SIPRNet, refer to Item 13e for more guidance. The contractor will requires access to the Defense Information Systems Network (DISN) Secret Internet Protocol Routing Network (SIPRNet) security classification guide.

Remarks:

YES NO 10k. JWICS. JWICS access is required for the execution of the contract. Requests for access will be submitted to COR to facilitate the vetting and approval process. Contractor must follow appropriate processes for obtaining login credentials to JWICS. Contractor personnel must be cleared at the NATO SECRET level in to obtain access to JWICS. If JWICS is required at contractor facilities, the contractor shall coordinate with the appropriate Special Security Officer (SSO) and/or Contractor Special Security Officer (CSSO). The Contractor requires access to the JWICS SCG, Defense Intelligence Agency.

Remarks:

YES NO 10k. NSANet. NSANet access is required for the execution of the contract. Requests for access will be submitted to COR to facilitate the vetting and approval process access to NSANet requires final clearance. Contractor must follow appropriate processes for obtaining login credentials.

Remarks:

Solicitation Number:

Page 4 of 8Current Version Date: 20250715

YES NO Requirements YES NO 10k. Other. Check this item for any required access (i.e., required for contract performance) that is not covered by items 10athrough 10j. Specify the type of information and include any additional remarks as needed in Item 13.

YES NO 11a. Have access to classified information only at another contractor’s facility or at a government activity. The contractor shall have access to classified information only at another contractor’s facility or at a government activity. If this item is checked, than safeguarding of classified is NONE and items 11b, 11c, 11d, 11h, or 11k do not apply to this effort.

Remarks:

NOT APPLICABLE TO THIS EFFORT. REQUIREMENT WILL NOT BE LEVIED ON THE

CONTRACTOR.

YES NO 11b. Receive and store classified documents only. Contractor is authorized to receive classified documents only for purposes named in the remarks below. There will be no generation or derivative classification of material at the contractor facility. Special storage requirements are listed in remarks below. If this checked "YES", then Item 1b would be completed at the appropriate level and Items 11c,11d, 11h, 11i or 11k does not apply to this effort.

Remarks:

NOT APPLICABLE TO THIS EFFORT. REQUIREMENT WILL NOT BE LEVIED ON THE

CONTRACTOR.

YES NO 11c. Receive, store, and generate classified information or material. Contractor is authorized to receive, store, and generate classified material at the contractor’s facility. Contractor will reference the appropriate security classification guidance when generating or deriving classified material or hardware, reference item 10k. All classified information received or generated will be properly stored and handled according to the markings on the material. If this Item is checked "YES", then Item 1b would be completed at the appropriate level. All classified information received or generated is the property of the U.S. Government. At the termination or expiration of this contract, the U.S.

Government will be contacted for proper disposition instructions.

Remarks:

YES NO 11d. Fabricate, modify, or store classified hardware. Contractor will fabricate, modify, or store classified hardware at their facility. A description of the area required to store such material and details regarding what the contractor will require, can be found in the remarks below. If this item is checked "YES", the 1b should be completed at the appropriate level.

Remarks:

NOT APPLICABLE TO THIS EFFORT. REQUIREMENT WILL NOT BE LEVIED ON THE

CONTRACTOR.

YES NO 11e. Perform services only. Contractor will perform services only as described in the remarks below:

Remarks:

Solicitation Number:

Page 5 of 8Current Version Date: 20250715

YES NO Requirements YES NO 11f. Have access to U.S. classified information outside the U.S., Puerto Rico, U.S.

Possessions, and Trust Territories. The contractor will have access to classified information at OCONUS locations. Refer to item 8a for a listing of OCONUS locations. RA is responsible for identifying security oversight for the OCONUS locations and ensuring compliance with Foreign Clearance Guide.

Remarks:

YES NO 11g. Be authorized to use the services of Defense Technical Information Center (DTIC) or other secondary distribution center. The contractor will prepare DD Form 1540, Registration for Scientific and Technical Information Services and DD Form 2345, Militarily Critical Technical Data Agreement, for authorized access to Defense Technical Information Center DTIC. Completed forms will be provided to the KO/COR for processing and submission to DTIC.

Remarks:

YES NO 11h. Require a COMSEC account. Contractor requires a COMSEC account. Access to COMSEC requires a final clearance. If this item is checked, then item 10a will be checked.

Remarks:

NOT APPLICABLE TO THIS EFFORT. REQUIREMENT WILL NOT BE LEVIED ON THE

CONTRACTOR.

YES NO 11i. Have a TEMPEST requirement. The contractor shall submit a TEMPEST countermeasure review (TCR) worksheet to the Army certified TEMPEST technical authority (CTTA) and coordinate with their Cognizant Security Agency (CSA) for CTTA TEMPEST countermeasure implementation IAW AR 380-27, paragraph 2-6g.

Remarks:

YES NO 11j. Have Operations Security (OPSEC) Requirements.

Refer to the AT/OPSEC to the PWS, SOO, or SOW for details on OPSEC requirements.

Remarks:

U.S. Army Information Systems Engineering Command (USAISEC) Operations Security (OPSEC) Plan, OCT 2023

YES NO 11k. Be authorized to use Defense Courier Service (DCS). Contractor is authorized to use DCS.

The KO/COR will obtain written approval from the United States Transportation Command’s (USTRANSCOM) Defense Courier Division (TCJ3-C), Scott AFB, IL 62225-5357. Only certain classified information qualifies for shipment by DCS. If this item is checked "YES", then the item 1b must state something other than "NONE".

Remarks:

Solicitation Number:

Page 6 of 8Current Version Date: 20250715

YES NO Requirements YES NO 11l. Receive, store, or generate CUI. Contractor is authorized to receive, store, or generate CUI in the performance of this contract. Information designated as CUI, generated under this contract shall be controlled, handled, stored, marked, safeguarded, transmitted and destroyed IAW DoDM 5200.48, AR 380-5, and the following guidance:

Electronically transmitted CUI shall be sent via:.

Emailing CUI between the Government and a Contractor: Digitally encrypted email can be accessed via DOD CAC or if the Contractor's company has the proper DOD-approved assurance certificates installed. For more details on DOD-approved assurance certificates visit https://public.cyber.mil/eca/.

Government SharePoint: Contractor must have a DOD CAC and access is based on the Government's approval.

DOD Safe (use email certification to enter site) - https://safe.app.mil/.

IntelDocs - https://inteldocs.intelink.gov/inteldocs.

USB: Use of an approved USB is based on the Government's approval, CUI-marked files must be properly mark and safeguard.

Camera: Contractor must have approval from work location or Government representative to utilize a camera and take pictures prior to use. Photos and memory cards must be safeguarded appropriately.

Fax: Send CUI-marked documents via facsimile machine to recipient.

The contractor may disseminate CUI information to their employees and subcontractors that have a need-to-know.

The contractor shall report the unauthorized disclosure of CUI to the COR.

Contractor and subcontractor employees shall complete annual CUI training at https://securityhub.usalearning.gov/index.html.

Remarks:

YES NO 11m. Other (Specify). Check this item to add any additional performance requirements not covered or not referenced in Item 10 or 11.

Remarks:

Item 13, IT requirements - Reference PWS

Solicitation Number:

Page 7 of 8Current Version Date: 20250715

YES NO Requirements

YES NO

12. Public Release. All requests for public release shall be submitted by the government COR utilizing the CECOM Public Release Approval System (PRAS) at:

https://pras.army.mil/PRAS/default.asp and/or through the OPSEC Officer and Public Affairs Office (PAO) identified below:

OPSEC Officer and Contact Information (Include phone, email, and mailing address):

Josh Dobbins 2133 Cushing Street Fort Huachuca, AZ 85613

(520) 538-7642 joshus.s.dobbins.civ@army.mil

PAO (Include phone, email, and mailing address):

Ms. Ann Gonzalez 6585 Surveillance Loop Aberdeen Proving Ground, MD 21005-1845

(443) 861-6719 ann.c.gonzalez.civ@army.mil

13a Base Contract Only. Specific security requirements, e.g., SCG, place of performance are contingent upon each task order and shall be stipulated in the task order’s DD Form 254.

13b. Network Privileged Access. Contractor personnel will hold a security clearance commensurate with the classification level of the Information Technology (IT) system granted access to. The Facility Security Officer will clear contractor personnel if privileged access investigation requirements do not exceed the clearance requirements listed on the DD Form 254, Item 1a. For situations requiring higher clearances than listed on the DD Form 254, item 1a the government security manager will initiate the requisite security investigation required by the Information System Security Manager/ Officer. Detailed privileged users’ access can be. referenced in AR 25-2, paragraph 2-38

13c. Spillages. Classified and covered defense information, as defined in DFARS 252.204-7012, information, will be protected IAW the NISPOM and DFARS 252.204-7012. All security and cyber incidents involving classified and covered defense information, e.g., spillage, shall be immediately reported to the RA Security Specialist and to their DSS Industrial Security Representative. A spillage occurs whenever, or covered defense information is transferred onto an information system not authorized for the appropriate security level or exploited by external/malicious sources. Information will be forwarded to KO/COR and the Program Manager for a program damage assessment to be conducted IAW AR 380-49. Contractors responsible for a willful or negligent spillage of information shall pay enterprise service providers for the associated cleanup costs across the enterprise to restore the affected network or networks to a normal operating configuration.

13d. PWS, SOW, or SOO. The PWS, SOW, or SOO shall be provided to the contractor’s FSO and/or CSSO along with the DD Form 254 and associated Continuation Pages. This is to ensure that the FSO and/or CSSO are aware of all contractual requirements relating to security within the effort.

13e. NATO Awareness Briefing. All personnel that require access to SIPRNet and JWICS must complete the NATO Awareness Briefing prior to access.

Solicitation Number:

Page 8 of 8Current Version Date: 20250715

YES NO Requirements YES NO 13f. OCONUS Travel. Contractors traveling to OCONUS locations for either official or unofficial travel will require a defensive counterintelligence briefing prior to their departure.

YES NO 13g. Generation of classified material. The generation of classified material includes derivatively classified information.

YES NO 13h. Security Trainings/Briefings. Several training requirements exist for contractor personnel per DoD and Army regulation/directives. On-site contractors may receive training briefs from the government appointed Security Manager; however, contracting companies will be required to provide training to off-site contractor employees. Training is tailored to the organization’s requirements as well as local policy and other approved government training.

YES NO 13i. Individual Courier Card. Must have a need to know and approval from the COR prior to Courier Cards being issued.

NOT APPLICABLE TO THIS EFFORT. REQUIREMENT WILL NOT BE LEVIED ON THE

CONTRACTOR.

YES NO 13k. Additional Remarks not addressed on Item s 1a – 13i of this Security Appendix.

Remarks:

Reproduction of CUI information may be accomplished on Unclassified copiers within designated Government or Contractor reproduction areas only. Commercial printing facilities will not be used to reproduce CUI information.

Certification and Signature (ALWAYS REQUIRED - IF SCI CONTRACT, THE SCI CONTRACT, THE SCI CONTRACT MONITOR MUST ALSO SIGN) Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official(s) named below.

Signature block for COR and/or PM required.

COR SIGNATURE (ALWAYS REQUIRED) CM SIGNATURE (REQUIRED ON SCI CONTRACTS)

X Heather A. Lucas Security Manager ISEC

X Contracting Officer Representative

NAME: Heather A. Lucas NAME:

DATE: DATE:

TITLE: Security Manager (ISEC) TITLE:

EMAIL: heather.a.lucas .civ@army.mil EMAIL:

PHONE: (520) 945-8904 PHONE: