Presentation on theme: "What is a Classified Contract?"— Presentation transcript:
1 What is a Classified Contract? UNCLASSIFIED-Like the term facility clearance (we really don’t clear the “facility”) the term classified contract is a little misleading.-In most cases the actual contract document itself is not classified.-A “classified contract” is one that will require the contractor or one of the contractor’s employees to have access to classified information to perform on the contract.-Access can occur at the contractor facility, at a government facility or at another cleared contractor facility.
2 The Classification Guidance Specification Department of Defense ContractSecurity Classification SpecificationOriginalRevisedFinalProper name of this form is “Department of Defense Contract Security Classification Specification” although it is always referred to as the“DD Form 254”For every contract issued to a facility which requires “access” to classified information, a DD Form 254 should be provided.-Keep in mind that the DD Form 254 is actually a very small part of the overall contract document. (explain)-This form is used to convey classification guidance and is one of three sources that may be used for derivative classification.DD Form 254, Dec 90
3 DD Form 254 Convey security classification guidance Advise contractors on handling procedures for classified material received or generatedThe DD Form 254 is designed to provide a contractor with the security requirements and classification guidance needed for performance of a classified contract.The DD Form 254 is not the vehicle for requesting that DSS verify any special procedures at a contractor or for requesting that DSS establish special procedures at the contractor facility prior to the release of such information to a contractor.The GCA must provide DSS with a written request and justification for such procedures.
4 When Issued ? ORIGINAL: REVISED: FINAL: solicitations/awards as needed final retention authority-An original DD form 254 is issued at the time of a solicitation for bid or proposal. This helps the company to estimate security costs which they must include in their bid or proposal. In some cases the company will need access to classified information to prepare their bid or proposal, in other cases they will not. In all cases, if the contract is going to be classified there should be an original 254 issued with the solicitation.-Another Original 254 is issued at the time the contract is issued or awarded. This communicates the classification guidance that the company will use during actual performance on the contract.-A revised 254 is issued as needed to communicate changes to the classification guidance or security requirements. If these changes will involve increased cost the contract will have to be modified to cover these costs.-In most cases the contractor facility is required to dispose of classified material within two years of completion or termination of the contract.-IF there is a legitimate reason for the company to retain the information longer than that the company may request authorization from the Government Contracting Activity (GCA). IF the GCA grants that request they would issue a Final 254 stating the conditions of that approval.If the contractor does not have a legitimate reason to retain the material beyond the two years they must dispose of the material. (Return to GCA or destroy)In that case there is no need for a final 254.
5 Considerations Consider security early in acquisition process DD Form 254 only means for providing classification guidanceAs specific as possibleInclude only information pertaining to contract-Beginning before the solicitation, the GCA should consider what are the legitimate security needs related to a program, and which contracts on that program will need to be classified and at what level.-By the time a solicitation is made, there should be a fairly clear understanding of the security requirements.-The level of security required on a contract will effect the cost of the contract.-As security requirements change, these changes should be communicated to the contractors and contracts may be modified based on increased or decreased costs.-As indicated earlier, the DD Form 254 is the only contractually binding document used to communicate classification guidance. It may include attachments such as a classification guide. It should give guidance which is detailed enough to cover all aspects of the contract, but should not include extraneous information.
6 Considerations (continued) Revisit security requirements at various stages:Pre-awardAwardR&DProductionetc.Issue a revised 254 whenever there are changes to any classification guidance previously provided.
7 Considerations (continued) Upon contract completion or termination, contractor must:Return ALL classified received or generated under the contract;Destroy all of the classified; or,Request retention for a specified period of time-Remember when we discussed the final DD Form 254 we stated that when a contract is completed, the NISPOM provides an automatic 2 year retention period for material received or generated under that classified contract.-The facility is required to dispose of classified material within two years of completion of the contract.-IF there is a legitimate reason for the company to retain the information longer than this 2 year period, the company may request authorization from the Government Contracting Activity (GCA). IF the GCA grants that request they could issue a Final 254 stating the conditions of that approval or they could provide a letter authorizing an additional retention period..-If the contractor does not have a legitimate reason to retain the material beyond the two years they must dispose of the material. (Return to GCA or destroy)
8 Preparation of DD Form 254 Who? -US Government -Contractors Contracts with prime contractor-ContractorsContracts with sub-contractors-The organization issuing the contract is obligated to provide classification guidance by issuing a DD Form 254.-The form should be prepared by (1) someone with contracting authority and knowledge of the contracting process, (2) someone with program knowledge and subject matter expertise, (3) a security specialist who understands information security and industrial security.-In rare cases one person may have all of these qualifications. In most cases it is necessary and extremely important for these three people to work together to insure that the right information goes on the 254.-Contractors may use subcontractors to perform tasks (unless specifically prohibited).-If the subcontractor’s employees need access to classified information to perform those tasks, the prime contractor issues a classified contract and must issue a DD 254 with that contract.-The subcontractor must be a cleared facility in the NISP to have access to classified information (remember the by signing the Security Agreement the contractor agrees to verify FCL/Safeguarding for all perspective subcontractors.-For a SAP or SCI program where there is a requirement that the GCA must approve all subcontracts, the original DD 254 issued to the prime contractor must clearly state this (perhaps in item number 13).
9 Prime-Contractor Responsibility Pass good guidance...-It is the responsibility of the GCA to provide appropriate classification guidance to the Prime Contractor.-In return, if the Prime issues a classified subcontract, it is the responsibility of the Prime to “pass” appropriate classification guidance down the line to the Sub-contractor(s).-This continues down the line (sub passes appropriate classification guidance down the line to any second-tier sub-contractor and so on and so on)…down the line !
10 How to Prepare the DD Form 254….. Department of Defense ContractSecurity Classification SpecificationDD FORM 254PASS OUT “GUIDE FOR THE PREPARATION OF A DD FORM 254” and a copy of a DD Form 254.Explain that we are going to take a close (item by item) look at the 254 and provide a brief explanation of how the “GUIDE” came into being.Also - advise that the website on the bottom of the slide contains electronic versions of all DD Forms to include the DD Form 254.DD Form 254, Dec 90
11 Contracting Officer Responsibilities Determine need for classified accessVerify facility clearanceSponsorshipAccurately reflect security requirements for both the procurement process & contract performanceIF PRESENTING BOTH PARTS OF THE PRESENTATION, THIS SLIDE CAN BE ELIMINATED.-Contractors are not required to have a FCL during pre-award phase is access to classified material is not required.-If classified access is required during pre-award phase then FCL is required-Contracting Officer is responsible for verifying the clearance status of perspective contractors through Central Verification Activity. (see next slide)-If contractor is not cleared or have the appropriate safeguarding capability, request DSS take appropriate action-Keep in mind that unnecessary clearance actions are costly and divert DoD resources-Also, DFAR (Defense Supplement to the Federal Acquisition Regulation) makes the NISPOM applicable to all contracts which require access to classified information (Reference: Part 52-Solicitation Provisions and Contract Clauses)-And always think about how security requirements change through the life of a contract and how you should plan for security as the program progresses.
12 CONTRACT SECURITY CLASSIFICATION SPECIFICATION DEPARTMENT OF DEFENSECONTRACT SECURITY CLASSIFICATION SPECIFICATION(The Requirements of the DoD Industrial Security Manual applyto all security aspects of this effort.)1. CLEARANCE AND SAFEGUARDINGa. FACILITY CLEARANCE REQUIREDb. LEVEL OF SAFEGUARDING REQUIREDSECRETSECRET2. THIS SPECIFICATION IS FOR: (X and complete as applicable)Item 1a. Insert the highest level of facility security clearance required by the contractor for performance of the contract.-Use only the words TOP SECRET, SECRET or CONFIDENTIAL (special caveats such as Restricted Data, Formerly Restricted Data, COMSEC information etc., will be captured in item 10)-The contractor must have a valid FCL at least as high as the classification indicated here.-To verify the contractor’s FCL, contact the CVA at (888) or log on the DSS website (www.dss.mil) and follow the instructions.Item 1b. Insert the highest level of safeguarding capability required for the contractor to perform on the contract.-The classification level in 1b should NEVER be higher than shown in 1a.-If the contractor will not need to possess or store classified at the facility, enter “Not Applicable” or “None.” (If this is the case, then Item 11a must be marked “Yes.”)Item 2. Mark the appropriate box: Although information may be entered in more than one box, only one “X” should appear in Item 2.Who provides the prime contract number? You or your agency.Who provides the subcontract number? The contractor issuing the subcontract.a. PRIME CONTRACT NUMBERXDNA C-0000b. SUBCONTRACT NUMBERc. SOLICITATION OR OTHER NUMBERDUE DATE (YYMMDD)
13 X 3. THIS SPECIFICATION IS : (X and complete as applicable) DATE (YYMMDD)a. ORIGINAL (Complete date in all cases)990101b. REVISED (Supersedesall previous specs)DATE (YYMMDD)Revision No.X9905051DATE (YYMMDD)c. FINAL (Complete Item 5 in all cases)4. IS THIS A FOLLOW-ON CONTRACT?XYESNOIf YES, completethe following:Classified material received or generated under______________(preceding contract No.) is transferred to this follow-on contract.DNA C-9999Item 3a. When the original DD Form 254 is issued, insert an “X” in Item 3a and enter date (The date of the original will appear unchanged on each revision or final DD From 254 issued thereafter.)Item 3b. When there is a change to classification guidance, a Revised DD Form 254 will be issued (give a sequential number to each revision and enter the date of the Revised DD Form 254. Also enter the date of the original DD Form 254 in 3a.)Item 3c. When a Prime or a Sub requests an extension of retention authority and it is approved by the GCA, a final DD Form 254 may be issued to reflect this. (NISPOM Chapter 5, Section 7 provides more information regarding disposition & retention.)-Enter the date the Final DD Form 254 is issued and complete item 5 as appropriate (also enter the date of the Original DD Form 254 in Item 3a.Item 4. Must be for the same contractor to the same contractor for the same item or services as the preceding contract.-Item 4 will be marked “Yes” and the preceding contract number entered in the space provided-This item authorizes the contractor or sub to transfer material received or generated under the preceding contract to the new contract (the material transferred should be reflected in item13.)Item 5. Used for final retention authority (not final delivery of goods). If a final DD Form 254 is issued, enter “X” in the YES box, the date of the contractor;s request for retention and the authorized period of retention in the spaces provided.-If not a final DD Form 254, enter “X” in the NO box.X5. IS THIS A FINAL DD FORM 254?YESNOIf YES, completethe following:In response to the contractor’s request dated____________, retention of the identified classified material is authorized for the period of_______________________________.
14 6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code) a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE(Name, Address and ZIP Code)Science CorporationP.O. Box 12345Colorado Springs, CO21732Central Region5800 East Campus Circle DriveIrving, TX7. SUBCONTRACTORa. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE(Name, Address and ZIP Code)8. ACTUAL PERFORMANCEa. LOCATION b. CAGE CODE c. COGNIZANT SECURITY OFFICE(Name, Address, and ZIP Code)Science CorporationParkview Office Center1100 Hitech Pkwy, Suite 3-AHuntsville, ALItem 6. Is used when a GCA issues guidance to a Prime ContractorItem 6a. Enter the name and address of the prime contractor.Item 6b. Enter the CAGE (Commercial & Government Entity) code (EXPLAIN)Item 6c. Enter the name and address of the DSS CSOItem 7. Is completed by the prime contractor when issuing a subcontract.Item 8. If work is to be performed at a location (of the company) other than specified in 6a, enter the appropriate name and address, CAGE and DSS CSO in Item 8.-If there are more places of performance (also send a copy of the DD Form 254 to the appropriate CSO) or performance of a contract on a government facility, identify those in Item 13.Item 9. Enter a short, concise, and unclassified description of the procurement action. This may be research, development; production, study, services, IR&D (such as: research and development of countermeasures techniques or services related to radar equipment.)3L068Southeast Region2300 Lake Park Drive, Suite 250Smyrna, GA9. GENERAL IDENTIFICATION OF THIS PROCUREMENTResearch and development
15 10. THIS CONTRACT WILL REQUIRE ACCESS TO: YES NO a. COMMUNICATIONS SECURITY (C0MSEC) INFORMATIONb. RESTRICTED DATAc. CRITICAL NUCLEAR WEAPON DESIGN INFO.d. FORMERLY RESTRICTED DATAe. INTELLIGENCE INFORMATION:(1) Sensitive Compartmented Information (SCI)(2) Non-SCIf. SPECIAL ACCESS INFORMATIONg. NATO INFORMATIONh. FOREIGN GOVERNMENT INFORMATIONItem 10-ACCESS REQUIREMENTS. Handout has specific statements you must incorporate for certain yes answers *.10a.* YES-prior approval of GCA If accountable COMSEC material is involved, item 11h (COMSEC account) would be mark yes too.10b. Always yes if item 10c is yes. Requires final US Government Clearance.10c.* YES-prior approval of GCA and final US Government Clearance.10e.* YES-prior approval of GCA. Regarding reviews, items 14 and 15 also be appropriately marked.10f.* YES-request access approval through the Program Security Office of the SAP. Must also provide subcontractor with any additional security requirements of the subcontract. Item 14 would also be YES and item 15 completed as appropriate.10g. YES-(North Atlantic Treaty Organization) prior approval of GCA. Also requires final US Government clearance and special briefings.10h. Except for NATO information. Requires a final Government clearance and prior approval of the GCA.10i. LIMDIS is gone. It has been incorporated into FOUO.10j. NISPOM does not include FOUO guidance, refer to GCA’s FOUO policy.10k.* OTHER.i. LIMITED DISSEMINATION INFORMATIONj. FOR OFFICIAL USE ONLYk. OTHER (Specify)
16 11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: YES NO a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT ANOTHERCONTRACTORS FACILITY OR A GOVERNMENT ACTIVITYb. RECEIVE CLASSIFIED DOCUMENTS ONLYc. RECEIVE AND GENERATE CLASSIFIED MATERIALd. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWAREe. PERFORM SERVICES ONLYf. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE THE U.S.PUERTO RICO, U.S. POSSESSIONS AND TRUST TERRITORIESg. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICALINFORMATION CENTER (DTIC) OR OTHER …DISTRIBUTION CENTERh. REQUIRE A COMSEC ACCOUNTItem 11-PERFORMANCE REQUIREMENTS. Same here-specific statements listed in your Handout.11a.* YES-no contract performance at the subcontractor site. This is an access elsewhere facility. Mark either item 8 or annotate item 13 with the actual performance location. Safeguarding not required, marked N/A or none.11b.* YES-receive classified documents only. No derivative classification authorized Detail classification guidance not necessary.11c. YES-detailed classification guidance is required performance (can attach or include in item 13).11d. YES-include as much details as possible (how much, how large etc)11e. YES-include statement in item 13 to explain the services and to provide appropriate guidance (sample statements are included in your booklet).11f. YES-indicate city and country of overseas performance in item 13. Item 14 may be marked YES (copy of 254 must be provided to OSSI)11g.* YES-contractor authorized to use the services of DTIC11h. YES-if accountable COMSEC information will be provided to the subcontractor. (mark NO is non-accountable COMSEC info is involved).11i.* TEMPEST is now EMINT (Emanation Intelligence) Explain. If yes, item 14 should be yes11j.* YES-prior approval of GCA and item 14 also yes.11k. YES-authorizes subcontractor to use DCS for transmission (only certain classified info qualifies for shipment by DCS.i. HAVE TEMPEST REQUIREMENTSj. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTSk. BE AUTHORIZED TO USE THE DEFENSE COURIER SERVICEl. OTHER (Specify)
17 12. PUBLIC RELEASE. Direct Through (Specify): Any Information (classified or unclassified) pertainingto this contract shall not be released for public disseminated except as providedby the Industrial Security Manual or unless it has been approved for public releaseby appropriate U.S. Government authority. Proposed public releases shall besubmitted for approval prior to releaseto the Directorate for Freedom of Information and Security Review, Office of theAssistant Secretary of Defense (Public Affairs)* for review. *In the case of non-DoDUser Agencies, requests for disclosure shall be submitted to that agency.12. PUBLIC RELEASE.DirectThrough (Specify):The contractor is responsible for obtaining the approval of the GCA prior to release of any information received or generated under the contract, except for certain types of information authorized by the NISPOM.Complete this item as required by internal agency directives to direct the contractor to the appropriate office in the GCA that has public release authority.
18 1. What classified information will the contractor need ? 13. SECURITY GUIDANCE.The security classification guidance neededfor this effort is identified below. If any difficulty is encountered in applyingthis guidance or if any other contributing factor indicates a need for changesin this guidance, the contractor is authorized and encouraged to providerecommended changes: to challenge the guidance or the classificationassigned to any information or material furnished or generated under thiscontract; and to submit any questions for interpretation of this guidance to theofficial identified below. Pending final decision, the information involvedshall be handled and protected at the highest level of classification assigned,or recommended. (Fill in as appropriate for the classified effort. Attach, orforward under separate correspondence, any documents/guides/extractsreferenced herein. Add additional pages as needed to provide completeguidance.1. What classified information will the contractor need ?One of the most important parts of the entire form - this is where the specifics are captured. It is here we are going to find out what is involved in performing this classified activity. Should not be vague and leave it up to the contractor to figure out what is classified about what they are doing .These are merely some of the questions that should be asked when preparing guidance for a contract. Put yourself in the contractor’s place and try to determine what guidance will be needed to properly protect the classified information that will be furnished or generated under the contract.Use this item to identify applicable guides, to provide narrative guidance which identifies the specific types of information to be classified, to provide appropriate downgrading or declassification instructions, to provide any special instructions, explanations, comments or statements required for information or to clarify any other items identified in the DD Form 254.Each contract is unique in its performance requirements. Don’t try to follow a format or provide all the guidance in this item. Give reasons for the classification. Write guidance in plain English. Use additional pages as necessary to expand or explain the guidance.2. What guidance will the contractor need to protect it ?3. Will classified hardware be furnished or generated ?4. Will classified be generated; in what form, when, and how ?5. Can a non-technical person understand this guidance ?
19 Elements of this contract are outside the inspection Yes NoRequirements, inaddition to NISPOM requirements, are established for this contract (If Yes, identifythe pertinent contractual clauses in the contract document itself, or providean appropriate statement which identifies the additional requirements. Provide acopy of the requirements to the cognizant security office. Use Item 13 if additionalspace is needed.)14. ADDITIONAL SECURITY REQUIREMENTS.Yes No15. INSPECTIONS.Elements of this contract are outside the inspectionresponsibility of the cognizant security office. (If Yes,explain and identify specific areas or elements carved out and the activityresponsible for inspections. Use Item 13 if additional space is needed.)Item 14 applies any time security requirements are imposed on a contractor that are in addition to the requirements of the NISPOM or its Supplements.YES-requires the contracting activity to incorporate the additional requirements by statements or reference in Item 13.Costs incurred due to additional security requirements are subject to negotiation between the contractor and the GCA.Prior approval of the GCA is required before a prime contractor can impose additional security requirements on a subcontractorA copy of the DD Form 254 containing the additional security requirements should be provided to the CSO.Item 15 YES-when DSS is relieved, in whole or in part, of inspection/oversight responsibility. Provide information on the specific areas carved-out and identify the activity responsible for inspection.Item 16. Certification and Signature. Enter the name, title, telephone number, address and signature of a designated official (who should ensure it has been adequately staffed among appropriate contracting, program and security personnel) certifying that the security requirements are complete and adequate for performance of the classified contract.Item 17. Required Distribution. As a minimum, distribution should be to those shown in this item as applicable. Further internal distribution as necessary is ok.
20 The Classification Guidance Specification Department of Defense ContractSecurity Classification SpecificationOriginalRevisedFinalWe’ve gone through the entire form, block by block, item by item and I bet you are glad that this hour is just about up. I hope that you have learned not only what should or could go in the various items but what the possible implications could be for putting erroneous or vague information in any of the items.I also hope that you leave here with a better appreciation of what this form is all about. Like I said earlier this is probably the most important and the most misunderstood form in our program - but you all can make a difference.I encourage you to use the handouts I provided today - these are invaluable resources that will assist you as we all work together towards that common goal of protecting our nation’s classified information..DD Form 254, Dec 90
21 Questions!???????_________________________DD Form 254
Your consent to our cookies if you continue to use this website.