20R0009-A003 AttachF-PrimeSubSecurityReqtsforProductionFacility.docx

Attachment F-A003: Prime and Subcontractor Security Requirements for Passport Card Stock

1. This contract does not require access to U.S. Government classified information. This requirement does require diligence on the part of Offerors to provide adequate and appropriate controls over the security of the production facilities that will produce the Passport Card Stock that will be manufactured under the terms of the contract as well as the employees who will work in areas of production, inventory control, shipping, quality control, distribution and accounting for products and components in the aforementioned areas. All security requirements apply to the prime contractor and any subcontractors that are involved in the manufacturing of offered Passport Card products.

2. As such:

a. The prime contracting firm must be a U.S. firm. A U.S. firm is defined as a company organized and existing under the laws of any of the fifty states, the District of Columbia, or Puerto Rico, and located in the United States.

b. The prime contractor must provide a graphic representation of the ownership structure.

c. Foreign Ownership Control or Influence (FOCI)

i. The U.S. company is considered under FOCI whenever a foreign interest has the power, direct or indirect, whether or not exercised, and whether or not exercisable through the ownership of the U.S. company's securities, by contractual arrangements or other means, to direct or decide matters affecting the management or operations of that company in a manner which may adversely affect performance on the contract.

ii. A prime contractor under FOCI must propose mitigations and demonstrate that the FOCI is effectively mitigated from impacting successful contract performance.

iii. The Department of State (DOS) reserves the right to impose any security method(s), safeguard(s), or restriction(s) it believes necessary to ensure the integrity of the Passport Card Stock product and ensure the contract is not adversely affected to include FOCI and may implement measures to mitigate any concerns.

d. Key personnel (Section C.3.2) proposed by the offeror and agreed upon by the DOS must be U.S. citizens who have received a favorably adjudicated Moderate Risk Public Trust (MRPT) determination performed by the Bureau of Diplomatic Security (DS).

i. In addition to Key Personnel performing on the contract, the Corporate Officer performing as the Company Security Officer (or actual CSO) shall be proposed as a key person and must be an employee of the prime contractor.

ii. DS reserves the right and authority to conduct periodic inspections of contractor facilities and to perform background investigations on the company and its management in terms of its affiliations with persons or organizations that are inimical to the security interests of the United States, as well as background investigations of company employees and inspection of contractor facilities that are necessary to ensure proper compliance with the terms of the contract.

iii. It is not the intention of DS to monitor and inspect the facilities and employees of RFID chip and antenna suppliers or inlay substrate providers that will provide commercially offered chip and antenna components and inlay substrates to fabricators of the Passport Card Stock. It is expected that chip, antenna, adhesive, reader, and inlay substrate providers will provide proper security controls and accountability of their product and components in terms of accepted industry standards for those products and components.

e. The facility that will be involved in the manufacturing of the Passport Card Stock material must be located within the contiguous U.S. and owned by the prime contracting firm.

f. Only U.S. citizen employees who have received a favorably adjudicated MRPT determination performed by DS shall:

i. Have unescorted physical access to the DOS secure production area within the manufacturing facility;

ii. Take part in the management, design, production, spoilage, control and distribution of passport card material;

iii. Participate in enforcement of the security plan for ensuring secure manufacturing, storage and shipment of cards.

3. Company Security Officer

a. The prime contractor shall appoint a Security Officer that is a U.S. citizen residing in the United States who is eligible to receive a favorably adjudicated MRPT conducted by DS whose duties are as follows:

i. Fully implement the contract security plan to meet all contract security requirements to include;

1. Visitation policy for the manufacturing facility;

2. Training plan for company employees regarding their obligations to conform to all contract security requirements in spirit and in practice and a policy of non-retaliation for employees who report known or suspected violations of the contract security requirements;

3. Reports of Changes to security procedures, implemented or proposed, and the reasons for those changes;

4. Reports and a detailed description of any acts of noncompliance, whether inadvertent or intentional, and the steps taken to prevent such acts from recurring; and

5. Any recommendations to improve the overall security of the manufacturing facility and DOS products.

ii. Execute mitigation measures imposed by DOS to mitigate FOCI and to report any changes or impending changes to any of the company’s executive management, or key management personnel.

iii. To report any areas of non-compliance to the Contracting Officer (CO), Contracting Officer’s Representative (COR), and DS.

b. The Company Security Officer shall be vested with sufficient authority and resources to ensure day-to-day operational compliance with all contractual security requirements and FOCI mitigations if imposed.

c. Serve as a primary point of contact for the Bureau of Diplomatic Security.