DD Form 254, DEC 90 Previous editions are obsolete. 805/340

12. PUBLIC RELEASE. Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the industrial Security Manual or unless it has been approved for public release by appropriate US Government authority. Proposed public release shall be submitted for approval prior to release

Direct

X

Through (Specify):

Phillips Laboratory/PA, 3550 Aberdeen Ave SE, Kirtland AFB, NM 87117-5776. Provide 12 copies at least sixty (60) days before approval is required.

to the Directorate for Freedom of information and Security Review, Office of the Assistant Secretary of Defense (Public Affairs)* for review. In the case of non-DoD User Agencies, requests for disclosure shall be submitted to that agency.

13. SECURITY GUIDANCE. The security classification guidance needed for this classified effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended. (Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. Add additional pages as needed to provide complete guidance.) Where classified information is required in your response, it shall be included in the body of the appropriate section and marked according to the provisions of the NISPOM and ABL Security Classification Guide. The Airborne Laser (ABL) Security Classification Guide dated 30 September 1995, will be used for this effort. Ref. Blk 10a: See Addendum #1, attached. Ref. Blk 10d: This information is not releasable to any contractor employee who has not been granted a final U.S. Government clearance at an appropriate level, not one who is a foreign national or immigrant alien. Ref. Blk 10e: The contractor will comply with Air Force Instruction (AFI) 14-303, Release of Intelligence to Contractors, and will comply with the attached continuation sheets, "Requirements for Handling Collateral Intelligence Information." See Addendum #2. Ref. Blk 10e(1) and 10f: Submission of classified information higher than SECRET (including SCI and SAR) requires special arrangements to be made for the transfer of the information AND PRIOR GOVERNMENT APPROVAL. Any requests to submit this type of information must be sent to PL/TMS through the PCO. Ref. Blk 10f: SMC/TM retains security oversight for all SAR material provided to contractor visitor groups supporting the ABL mission and occupying space at Kirtland AFB. The Defense Investigative Service (DIS) will retain security oversight, to include SAR material, for all contract performance not conducted on Air Force installations. SMC/TM provides security cognizance for all non-SAR material maintained by contractor visitor groups supporting the ABL program and occupying space at Kirtland AFB. Ref. Blk 10j: FOUO applies. Refer to Chapter 13, Section 6 of the Industrial Security Manual. Ref. Blk 11d: The contractor is required to provide adequate and approved storage for classified hardware to the level of Top Secret, if required, which because of size or quantity cannot be safeguarded in a standard and approved storage container. Ref. Blk 11g: The contractor requires access to DTIC services and must apply for services via DD Forms 1540 and 1541. Contracting activity will certify need-to-know to DTIC. Ref. Blk 11i: See Addendum #3, attached. Ref. Blk 11j: See Addendum #4, attached.

14. ADDITIONAL SECURITY REQUIREMENTS. Requirements, in addition to IS requirements, are established for this contract. (If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the cognizant security office. Use Item 13 if additional space is needed.)

X

Yes

No

The minimum security requirements identified in COMSEC Addendum 1, INTELLIGENCE Addendum 2, OPSEC Addendum 3, and TEMPEST Addendum 4 require additional security procedures. These procedures must be determined prior to the establishment of the Special Access Program and require input from contractor security personnel.

15. INSPECTIONS. Elements of this contract are outside the inspection responsibility of the cognizant security office. (If Yes, explain and identify specific areas of elements carved out and the activity responsible for inspections. Use Item 13 if additional space is needed.)

X

Yes

No

SMC/TM retains security oversight for all SAR material provided to contractor visitor groups who support the ABL mission and occupy space at all government installations. The Defense Investigative Service (DIS) retains security oversight responsibility, excluding SAR material, for all contract performance not conducted at government installations.

16. CERTIFICATION AND SIGNATURE. Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below.

a. TYPED NAME OF CERTIFYING OFFICIAL Richard O. Conrad

b. TITLE Chief, Acquisition Security, ABL Program

c. TELEPHONE (Include Area Code) (505) 846-7675

d. ADDRESS (Include Zip Code)

17. REQUIRED DISTRIBUTION

Space and Missile Center/TM

X

a. CONTRACTOR

3550 Aberdeen Avenue SE, Bldg 760

X

b. SUBCONTRACTOR

Kirtland AFB, NM 87117-5776

X

c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR

e. SIGNATURE

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION

/// Original Signed //

X

e. ADMINISTRATIVE CONTRACTING OFFICER

X

f. OTHERS AS NECESSARY

DD Form 254 Reverse, DEC 90 *U.S. GPO: 1991-548-195/20024
F29601-96-R-0001Contract Expiration Date: 31 March 2003
Contract Monitor: Richard O. Conrad, Project Officer
Title: Chief, Acquisition Security
Organization: SMC/TMS
Phone Number: 505-846-7675

Addendum #1

COMSEC and/or Cryptographic Access

The contractor is governed by DoD 5220.22-S, COMSEC supplement to the Industrial Security Manual. Access to COMSEC material/information is restricted to U.S. citizens holding final U.S. Government clearances and is not releasable to personnel holding only a reciprocal clearance. Personnel requiring COMSEC access shall be briefed IAW DoD 5220.22-S. NOTE: The COMSEC/crypto briefing applies only to the use and control of crypto equipment and specialized COMSEC publications. NACSIM/NACSEM documents are not considered COMSEC controlled material. Additionally, cryptographic information/equipment shall be retained in a contractor facility COMSEC account IAW DoD 5220.22-S The Air Force program/project manager shall designate the number of personnel requiring cryptographic access. The number will be limited to the minimum necessary and will be on a strict need-to-know basis.

Addendum #2

Requirements for Handling Collateral Intelligence Information

1. The Air Force Instruction 14-303, applicable supplements and special Memorandum of Agreement (MOA) between SMC/TMS (PL/TMS) and PL/IN apply to this contract. Contractors must:

a. Maintain accountability for all intelligence released to their custody.

b. Not reproduce released intelligence documents without the written permission of the Senior Intelligence Officer (SIO), Phillips Laboratory, as defined under the Contractor/ PL/IN MOA. Reproductions must be controlled in the same manner as the original and are the property of Phillips Laboratory/IN, not the contractor.

c. Not to destroy any intelligence data provided under this contract without
advance approval of the SIO, Phillips Laboratory or as agreed in the MOA.

d. Restrict access only to those with the requisite security clearances and who are
providing services under this contract. Further dissemination to other
contractors, subcontractors, is limited to the terms of the MOA and with the
written permission of the SIO, Phillips Laboratory.

e. Not release intelligence material to foreign nationals or immigrant aliens without
the prior coordination and written approval of the SIO, Phillips Laboratory.

f. Maintain a record of individuals who access intelligence material in contractor
custody and to ensure that each assessor is knowledgeable of the requisite
security requirements. Provide reports to SMC/TMS for PL/IN as directed by the
MOA.

g. Ensure that all intelligence released to, reproductions of, and all intelligence
material generated under this contract remain the property of the U.S.
Government and are returned, upon request, to Phillips Laboratory/IN or is
destroyed when directed and destruction documented at the expiration of the
contract, whichever comes first.

Addendum #3

OPSEC Requirements

The contractor shall provide operations security (OPSEC) protection for all sensitive/ critical information in accordance with Air Force Instruction (AFI) 10-1101 paragraph(s) 2.6.2 and 3.2 and Phillips Laboratory Instruction 10-1101 paragraph(s) 1.4 - 1.4.4, 1.5.2, 2.2.1, 2.5, 5.1, 5.1.1, 5.1.2. The contractor shall describe the steps necessary to protect sensitive/critical information and comply on a non-interference basis with oversight from PL/INK.

Appendix 4

TEMPEST Security Requirements

a. The contractor shall ensure that compromising emanations (TEMPEST) conditions related to the contract are considered.

b. The contractor shall provide countermeasure assessment data to the Contracting Officer (CO), with an information copy to the AFSC field level TEMPEST manager, in the form of a TEMPEST Countermeasures Assessment Request (TCAR). The TCAR shall provide only specific responses to the data required on paragraph c. below; the contractor's standard security plan shall not be used as a "stand-alone" TCAR response. The contractor shall not submit a detailed facility analysis/assessment. The TCAR information will be used to complete a TEMPEST Countermeasures Assessment (TCA) of the contractor's facility to be performed by the government TEMPEST authority using current Air Force TEMPEST directives. TEMPEST is applied on a case-by-case basis and further information may be required to complete the TCA; should this be the case, the contractor shall provide this information to the contracting officer when requested. After evaluation of the TCAR by the government TEMPEST authority, additional TEMPEST requirements may be necessary. When changes to the information required in paragraph c. below occur (including, but not limited to, relocation of equipment from the originally approved room, or increasing the classification level or volume of processing), the contractor shall notify the contracting officer of these changes so that a new TCA may be accomplished. The contractor shall submit to the CO a new TCAR, with an information copy to the AFMC field level TEMPEST manager, identifying the new configuration at least thirty (30) days before the changes occur; the contractor shall not commence SECRET or higher processing with the new configuration until receiving approval to do so from the contracting officer.

c. TCAR Contents

(1) SYSTEM DESCRIPTION:

(a) SYSTEM/FACILITY: Full name and address of company submitting request and RFP/contract number and duration. Also provide a brief title identifying the overall system or facility (e.g., XYZ missile word processing system, ABL aircraft interactive graphics system, etc.).

(b) LOCATION: Identify the address (including city, state, zip code, facility, building and room number) where the system and facility are located.

(2) RESPONSIBLE PERSONNEL:

(a) SECURITY OFFICER/MANAGER: Provide name, title, office symbol, and telephone number. Include the Company Appointed TEMPEST Authority (CATA) if applicable.

(b) SYSTEM CUSTODIAN: If different from c.(2)(a) above, provide name, title, office symbol, and telephone number.

(3) OPERATIONAL RISK:

LEVEL/AMOUNT OF CLASSIFIED: Identify the levels of classification (including specific designator, such as SCI, SAR, etc.) that will be processed, and the estimated volume per day/month for each level expressed as a percent (of the total material processed) for each level. If time-sharing a device, list classification(s), volume(s), and percent(ages) of use by other program(s). Volume may be described in data bytes/day, lines/day, pages/day, or hours/day.

e. Classified processing shall not begin until specific written approval/authorization, including approval for changes required pursuant to paragraph c. above, is provided by the contracting officer.

Guidance For SPO/Contracting Officer

1. When the contractor provides the information required in paragraph c., the contracting officer/program manager/contract monitor shall make a determination of whether TEMPEST requirements have been adequately met. The AFMC field level TEMPEST office will perform the TCA and provide a written recommendation to the CO. NOTE: The contractor SHOULD NOT submit a detailed facility assessment/ analysis that he may have already completed; he should only submit the TCAR information required by paragraph c. for a TCA to be completed by the TEMPEST office.

The contractor shall direct comments/questions about any part of the TCA process to the contracting office and not to the local TEMPEST office.

2. The contracting officer will then provide the contractor with a written notification of TEMPEST compliance or will identify corrective measures required. When action is complete, no changes to the equipment or facility may be made unless prior approval is obtained from the contracting officer.

3. The TCAR should be submitted and approved as soon as it has been determined that classified processing will be required for contract performance, preferably at the RFP stage, before source selection/contract award in case additional cost will be incurred. The CO should NOT wait until just before the contractor begins classified processing to submit the TCAR to the contracting and TEMPEST offices.

Ordering/Delivering Documents

1. The government contracting officer and/or system program office are responsible for ordering and delivering applicable NACSEM/NACSIM documents to the contractor in accordance with provisions of the Federal Acquisition Regulation (FAR) 52.210-3, 10.008(d), and 10.011(c). The local TEMPEST office will provide guidance on requisition procedures. The documents are ordered through local Air Force Publication Distribution Office (PDO) channels using AF Form 764a, and shall be returned to the government upon completion of the contract.

2. See AFR 0-5 for the titles and classifications of the NACSEM/NACSIM documents.