Attachment D - Passport Printer Security Requirements.docx
DOCX document 39 KB Posted
- Solicitation number
- 19AQMM24R0113
About this file
This document is the Attachment D - Security Requirements for a U.S. Passport Printer & Maintenance Contract. It outlines the security requirements for the manufacturing, storage, and transportation of U.S. passport printers under a federal contract.
Key details include:
- A TOP SECRET facility clearance is required for the Prime Contractor, and all personnel performing on-site maintenance at Department of State (DoS) locations must have a SECRET personnel clearance, or a Moderate Risk Public Trust (MRPT) determination.
- Subcontractors must also meet facility and personnel security requirements, including MRPT determinations for key personnel.
- The contractor must implement a comprehensive security plan to protect sensitive information, equipment, and materials related to the passport printer manufacturing process.
- Strict physical security requirements are specified for the printer manufacturing, storage, and transportation facilities, including access controls, surveillance, and inventory management.
- The document is referenced in the draft solicitation for the Next Generation Passport Personalization Printers Support contract (Solicitation No. 19AQMM24R0113) issued by the Department of State Office of Acquisition Management.
View the file
Other files
Show all 25
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
19AQMM24R0113
ATTACHMENT D: Security Requirements for U.S. Passport Printer & Maintenance Contract
SECURITY REQUIREMENTS FOR U.S. PASSPORT PRINTER & MAINTENANCE CONTRACT
The Bureau of Diplomatic Security (DS), U.S. Department of State (DoS), reserves the right and authority to conduct periodic inspections of contractor facilities and to perform background investigations on the company and its management in terms of its affiliations with persons or organizations that are inimical to the security interests of the United States, as well as background investigations of company employees and inspection of contractor facilities that are necessary to ensure proper compliance with the terms of the contract. The particular area of security interest under this contract relates to the manufacturing facilities and its employees who will be involved in the manufacturing of the printers and/or the maintenance of the printers during their life cycle.
A. GENERAL REQUIREMENTS
A TOP SECRET facility clearance is required for the Prime Contractor at the beginning of contractor performance.
Facility and Personnel Security Clearances
| (a) | A facility security clearance at the TOP SECRET level, issued by the Defense Counterintelligence and Security Agency (DCSA), is required for performance on this contract and any subsequent task orders in accordance with the DD Form 254, Department of Defense Contract Security Classification Specification. |
| (b) | Since it will be necessary for some Contractor personnel to have access to classified material and/or to enter into areas requiring a security clearance, each Contractor employee requiring such access must have an individual security clearance issued by DCSA commensurate with the required access prior to performance. Individuals must maintain their personnel security clearance throughout the duration of employment under this award. At a minimum, personnel performing on-site maintenance at DoS locations must have a SECRET personnel clearance. Personnel who are not required to have personnel security clearances must be issued a favorable Moderate Risk Public Trust (MRPT) determination. |
| (c) | The Contractor shall obtain a Department of State building pass for all employees performing under this award who require frequent and continuing access to Department of State facilities in accordance with DOSAR 652.204-70 Department of State Personal Identification Card Issuance Procedures. |
| (d) | Performance of this contract order shall be in accordance with the attached DD Form 254, Department of Defense Contract Security Classification Specification and FAR 52.204-2 "SECURITY REQUIREMENTS." |
| (e) | Subcontracting firms whose personnel will require access to classified information/areas or who perform on-site maintenance must possess a facility security clearance commensurate with their level of access. All subcontractors must be approved by the CO or COR and all subcontractors’ DD Forms 254 must be approved by DS/IS/IND prior to performance on contract. |
| (f) | Subsequent to contract award, the Government will conduct a formal briefing for the contractor. The purpose of the briefing will be to bring to the contractor’s attention the governing documents and directives regarding all security considerations in the staffing of the project, site access, and Diplomatic Security procedures. |
| (g) | Contractors must return all access control documentation and building badges to the DoS COR at the completion of contract services. |
| (h) | In the event, a personnel security clearance is rescinded for an individual assigned to this contract the individual shall be removed from the contract and replaced by a substitute acceptable to the Government at no cost to the government. |
| (i) | The contractor will debrief all personnel who resign, are transferred, terminated, or otherwise removed from the contract on the last day of work on site and their Department of State badge shall be turned into the COR. The company must cancel the visitor authorization request previously sent to DS/IS/IND. Each employee under this contract is individually responsible for the protection of information and shall be required to sign an agreement regarding the confidentiality of the work performed under this contract. |
| (j) | The company Facility Security Officer (FSO) must send a Visitor Authorization Request (VAR) to DS/IS/IND via e-mail to DS_IND_CONTRACTORVARS@STATE.GOV for each contractor employee having a personnel security clearance issued by the DCSA. |
| (k) | The contractor is required to ensure a secure environment, meeting the requirements outlined in this document, to ensure the secure production and maintenance of printers that will be used to personalize US Government Passports. The security requirements will pertain to the printers that will be manufactured under the terms of the contract as well as the employees who will work in areas of production, inventory control, shipping, quality control, distribution and accounting for products and components in the aforementioned areas. |
| (l) | The Prime contractor and all subcontractors shall screen their employees in accordance with company hiring policies. A copy of the company’s hiring practice and associated hiring forms shall be provided to DS/IS/IND for review at time of proposal submission. All personnel performing on this contract will be vetted according to contract position and/or access required to perform their duties as determined by the COR. Personnel Security Clearances and Moderate Risk Public Trust (MRPT) determinations will be required for most personnel. Any individual not approved by Diplomatic Security will not be allowed to perform on the contract. |
| (m) | The contractor shall notify DS/IS/IND of any changes to the contractor’s ownership, facility, physical location, or security system where the printers are being manufactured within 30 days of the changed condition. |
B. SUBCONTRACTORS
All other contractors (subcontractors, partnerships, teaming agreements, etc.) performing services on this contract will be required to meet the following security requirements.
| I. | U.S. Subcontractors |
| A. | Facility Security Requirements for U.S. Firms |
(a) A U.S. subcontracting firm which possesses a TOP SECRET facility security clearance issued by the DCSA in accordance with the National Industrial Security Program Operating Manual (NISPOM) meets the facility security requirements.
(b) A U.S. firm which does not possess a TOP SECRET facility security clearance issued by DCSA will be required to comply with the following:
1) The contractor must be organized and incorporated under the laws of any of the fifty states, the District of Columbia, or Puerto Rico, and be located in the U.S. and its territorial areas or possessions.
2) The contractor must have a reputation for integrity and lawful conduct in its business dealings. The contractor and its key managers must not be barred from participating in U.S. Government contracts.
3) The contractor must not be under foreign ownership, control or influence (FOCI) to such a degree that contract performance would be inconsistent with the national interest. The contractor shall complete a SF Form 328, Certificate Pertaining to Foreign Interests, so the Department of State can evaluate any Foreign Ownership, Control or Influence.
4) All key management and contractor personnel must favorably pass the Moderate Risk Public Trust (MRPT) investigation process to be deemed eligible for access to SBU information and contract performance. Contracting companies must submit an MRPT initiation request for all personnel requiring a MRPT determination. The requests are reviewed by IND for contract compliance and then processed by The Office of Personnel, Security and Suitability (PSS). The PSS Clearance Coordinator Team (CC) will work with the applicant to complete and obtain necessary documentation to begin the investigation. Initial assignment to the contract is contingent upon favorable completion of an Interim MRPT. Continued assignment on the contract is contingent on receiving a Final MRPT. IND will provide a notification of eligibility once PSS has completed the investigation and a determination is made. . If checks are unfavorable, the individual cannot work on the contract in any capacity.
5) If the contractor is part of a multiple facility organization, the home office facility must meet the above facility security requirements.
6) If the contractor is part of a parent-subsidiary relationship, the parent and subsidiary must meet the above facility security requirements, unless the Department of State determines excluding the parent from this process is consistent with the National interest.
7) The contractor shall notify DS/IS/IND of any changes to the contractor’s ownership, facility, physical location, or security system where the printers are being manufactured.
B. Personnel security investigations of contractor personnel employed by U.S. Firms Key contractor employees assigned to this contract, who are involved in the management, design, and production of U.S. passport printers, the control and distribution of passport printers, and the enforcement of the security plan for ensuring secure manufacture, storage and shipment of printers will be subject to an investigation by the US Government. Additionally, DoS reserves the right to vett any additional personnel it deems necessary.
(a) Contractor personnel working for a cleared contractor who possess TOP SECRET or SECRET personnel security clearances issued by the DSCA meet this requirement.
(b) Contractor personnel who do not possess TOP SECRET or SECRET security clearances issued by DCSA must favorably pass a Moderate Risk Public Trust (MRPT) determination to be conducted by the Bureau of Diplomatic Security, Department of State. All contractor personnel must favorably pass the Moderate Risk Public Trust (MRPT) investigation process to be deemed eligible for access to SBU information and contract performance. Contracting companies must submit an MRPT initiation request for all personnel requiring a MRPT determination. The requests are reviewed by IND for contract compliance and then processed by The Office of Personnel, Security and Suitability (PSS). The PSS Clearance Coordinator Team (CC) will work with the applicant to complete and obtain necessary documentation to begin the investigation. Initial assignment to the contract is contingent upon favorable completion of an Interim MRPT. Continued assignment on the contract is contingent on receiving a Final MRPT. IND will provide a notification of eligibility once PSS has completed the investigation and a determination is made. If checks are unfavorable, the individual cannot work on the contract in any capacity.II. FOREIGN FIRMS A. Facility Security Requirements for Foreign Firms
(a) Foreign firms must execute the U.S. Government’s Certificate Pertaining to Foreign Interests, SF Form 328, so the U.S. Government can evaluate the firm’s foreign ownership, control or influence to determine if such ownership is in the best interest of the US Government.
(b) A foreign firm incorporated and operating in a country with which the U.S. has an industrial security agreement and which possesses a facility security clearance issued by their parent government meets the facility security requirements. This facility security clearance must be certified to the U.S. Government by the foreign government. The U.S. government also reserves the right to conduct other appropriate local checks as deemed necessary.
(c) Other foreign firms will be subjected to investigative inquiries by Diplomatic Security and the American Embassy located in the host country:
All key management and contractor personnel must favorably pass the Moderate Risk Public Trust (MRPT) investigation process to be deemed eligible for access to SBU information and contract performance. Contracting companies must submit an MRPT initiation request for all personnel requiring a MRPT determination. The requests are reviewed by IND for contract compliance and then processed by The Office of Personnel, Security and Suitability (PSS). The PSS Clearance Coordinator Team (CC) will work with the applicant to complete and obtain necessary documentation to begin the investigation. Initial assignment to the contract is contingent upon favorable completion of an Interim MRPT. Continued assignment on the contract is contingent on receiving a Final MRPT. IND will provide a notification of eligibility once PSS has completed the investigation and a determination is made. If checks are unfavorable, the individual cannot work on the contract in any capacity. (d) The contractor must have a reputation for integrity and lawful conduct in its business dealings. The contractor and its key managers must not be barred from participating in its Government contracts.
B. Personnel security investigations of contractor personnel employed by foreign firms Key foreign national contractor employees assigned to this contract, who are involved in the management, design, and production of U.S. passport printers, the control and distribution of passport printers, and enforcement of the security plan for ensuring secure manufacture, storage and shipment of printers will be subject to an investigation by the US Government.
Personnel will be required to complete the same requirements as stated in II. A. (c). All personnel must favorably pass the MRPT to be deemed eligible for contract performance.
After successful completion of the required checks conducted on the designated employees, Diplomatic Security will issue a Moderate Risk Public Trust certification. If checks are unfavorable, the individual cannot work on the contract in any capacity.
C. PROTECTION OF EQUIPMENT AND SENSITIVE BUT UNCLASSIFIED MATERIALS
The contractor shall comply with the following requirements to prevent unauthorized disclosure of data or unauthorized access to printer hardware, software, and sensitive materials. The contractor shall provide a guaranteed secure process for the manufacture, storage, and shipment of printers. The contractor shall control the security of the manufacture, storage, and distribution of the printers and all related materials, including waste material generated during the manufacturing process. The U.S. Government reserves the right to conduct periodic announced or unannounced inspections to ensure compliance with these security requirements. U.S. Department of State employees acting in this capacity shall not be considered visitors.
(a) The contractor shall appoint a security manager who will be responsible for compliance with these security requirements.
(b) The contractor shall protect all sensitive information and materials provided to or generated by the contractor in performance of this contract.
(c) All IT processing of any sensitive information shall be accomplished on stand-alone systems and shall only be accomplished within the approved project areas of the contractors’ facilities only by contractor employees who have been approved by the Department of State.
(d) Sensitive information shall be marked “Sensitive but Unclassified” retained in opaque binders to prevent accidental access to the information, locked in a secure container approved by DoS and separated from other non-sensitive information in the same container.
(e) The contractor shall maintain records of inventories and all other administrative records pertaining to the DOS Printer Project, and will make such records available to the U.S. Department of State upon request. Such records include job sheets, work logs, inspection records, audit records, input numbers, records for production of components, finished and partially finished products. Such records will be maintained separately from other contractor production records and will be secured in a safe or vault, which can be accessed only by the DOS Printer Project Manager or designee.
(f) The contractor will furnish software in accordance with the statement of work. Software developed or used in the performance of this contract will be protected from unauthorized disclosure in accordance with the security requirements contained in this contract.
(g) The Contractor is responsible for submitting a comprehensive security plan to DS/IS/IND detailing exactly how it will meet all physical, procedural and industrial security requirements listed in this RFP prior to award of contract. The manufacturer’s security plan must address such items as:
| 1) | Material & asset identification |
| 2) | Secure Storage |
| 3) | IT systems |
| 4) | Access control & password management |
| 5) | Information & material protection |
| 6) | Safe transport of all goods and materials |
| 7) | Trusted human resource management |
D. TRANSPORTATION OF SENSITIVE AND NON-SENSITIVE EQUIPMENT AND MATERIALS
The contractor is responsible for the secure shipment of printers from the point of manufacture to the place of receipt by the U.S. Government.
CONUS Shipments:
Within the United States, transportation of printers will be accomplished by one of the following two methods:
(a) The printers shall be shipped by a common carrier having a point-to-point package tracking system (UPS, DHL, and Federal Express are examples of such a carrier). Continuous chain of receipts from point of origin to point of final destination will be required.
(b) Shipments handled exclusively by the contractor will be accompanied by a prime or subcontractor employee with either a personnel security clearance or a MRPT determination, who will be responsible for arranging the shipment from point of origin to point of delivery. The prime or subcontractor employee will exercise continuous surveillance of the shipment to assure that no unauthorized access to the shipment has occurred.
OCONUS Shipments:
Outside the United States, shipments of printers will be made using bonded carriers possessing bonded warehouses and point-to-point package tracking systems.
(a) The printers will be shipped by a common carrier having a point-to-point package tracking system (UPS, DHL, and Federal Express are examples of such a carrier). Continuous chain of receipts from point of origin to point of final destination will be required.
(b) Materials and products shipped between Prime Contractor and their subcontractors and from Prime Contractor to destination(s) in the United States will be shipped only by bonded, licensed shipping companies, which have a system in place for continuous tracking and accountability for shipments en-route. Overland shipments by truck will be locked and sealed during shipment, and trucks will be equipped with two-way radio communications to enable tracking of the shipment and notification of problems encountered en-route. The names of companies proposed by the contractor for shipment of materials and products will be provided to the U.S. Government in advance to permit background checks of the companies and their employees, as deemed appropriate.
(c) Printers produced by Contractor for shipment to the United States will be individually packed in crates, each addressed to its final destination. Crating must occur in an area approved by the US Government. Shipments will be addressed to a DOS passport center or office to the attention of a DOS employee at that location. Shipments will be identified with the invoice number, coded product identification, and flight number. Crates will be sealed in such a way that unauthorized tampering or evidence of an attempt to open the crate is readily detectable. The contractor will be required to notify the U.S. Government of the date of each shipment and its estimated arrival at the destination. The contractor shall notify the addressee of the estimated arrival date and is requested to notify Contractor immediately of the receipt of the shipment, and of unusual delays, problems, or discrepancies in connection with the shipment. The prime contractor shall report any problems encountered during shipment to the DOS COR.
(d) Shipping Records: A complete record must be maintained of the precise amount of materials produced and shipped. In the event material is damaged during shipping, disposition records must also be maintained.
(e) Reports of Theft, Loss or Damaged Product or Inventory: The contractor shall actively cooperate with U.S. and foreign law enforcement authorities, the U.S. contracting agency, and security representatives in the conduct of an investigation of product that is lost, stolen or pilfered, damaged or tampered with while in the possession of the supplier/shipper. All incidents must be reported within 24 hours of discovery to the COR. The contractor will provide frequent updated information concerning the status of any investigation.
(f) Liabilities: The Contractor shall be held ultimately liable for ensuring the secure delivery of all material shipped in conjunction with this contract.
E. APPLICABILITY TO SUBCONTRACTORS
The prime contractor shall include in all subcontracts the exact terms and conditions of the security requirements contained in this contract.
F. SECURITY AWARENESS
The Contractor shall implement a security awareness program familiarizing employees with the sensitive aspects of this contract and briefing them on their responsibility for complying with the security requirements before they are authorized access to sensitive information or allowed access to printers.
The Department of State, Industrial Security Office (DS/IS/IND) is the primary point of contact for security issues on this contract: Department of State, Bureau of Diplomatic Security, SA-20 13th Floor, 1801 North Lynn Street, Rosslyn, VA 20522-2008 or DSINDDomesticTeam@state.gov In case of a security problem or incident, notification shall be made within 24 hours of the problem or incident to the Department of State COR. In the case of a security problem or incident outside of the United States, the local RSO of the US Embassy should be contacted.
G. BREACH OR IMPROPER DISCLOSURE
Upon determination that a breach or improper disclosure has occurred the contractor employee shall be immediately removed from the facility and an incident report shall be submitted from the contractor to the Contracting Officer (CO) and the COR within 24 hours.
H. PHYSICAL SECURITY REQUIREMENTS FOR PRINTER MANUFACTURING, TEMPORARY STORAGE AND TRANSPORTATION FACILITIES The Contractor shall provide a secure production facility for the fabrication, storage and transport of the offered printers. The facility must meet the following minimum requirements that will be verified by preliminary and ongoing site inspections by the Bureau of Diplomatic Security (DS), U.S. Department of State (DoS). DS reserves the right to periodically inspect the contractor production and storage facilities by on-site visits—announced and unannounced.
| A. | General Physical and Access Control Requirements |
| (a) | There shall be color closed circuit TV (CCTV) cameras located inside and outside the secure room housing the printers, recording on a continual 24/7 basis. Full perimeter CCTV coverage is required, to include entry/exit gates, and perimeter entry/exit doors and loading docks. All videotapes/hard drives must be retained for a minimum of three (3) months. Digital Video Recording (DVR) devices are preferred over conventional VCR CCTV recording. |
| (b) | The facility shall have duress alarms strategically placed throughout the facility housing the printers along with passive infrared motion sensors providing intrusion detection capability. Doors and windows in the area housing the DoS printers shall be alarmed with balanced magnetic switch contacts and monitored 24/7 by an internal security force or an accredited local alarm company. |
| (c) | The facility shall provide 24-hour automated access control to the printer design, production, storage, and shipping areas. An electronic, automated access control mechanism shall control and record access to secure areas by entry location and time periods. Procedures shall be in place so all access attempts are monitored, and rejected attempts are recorded and investigated to determine the reasons for unauthorized access attempts to a restricted area. |
| (d) | An automated system must be in place to ensure only authorized employees enter the restricted printer design, production, storage, and shipping areas. |
| (e) | No personal items (purses, lunches, coats, cell phones, pagers, laptops, cameras, photographic/recording devices of any kind, etc.) will be allowed in the secure printer design, production, storage, and shipping areas. |
| (f) | The Contractor shall ensure that visitors not associated with this contract will not be admitted to the secure printer design, production, storage, and shipping areas without prior approval of the DoS COR or designated representative. |
| (g) | All visitors shall be required to provide picture identification and sign a visitor’s registry log prior to entry into the printer design, production, storage, and shipping areas. Visitors must be escorted at all times by a cleared company employee. |
B. Physical Security Requirements
| (a) | The perimeter of the contractor’s manufacturing facility or the area in which the printers will be housed during manufacturing shall be surrounded by a 2-meter high wire perimeter fence. The perimeter shall be protected against intrusion with infrared motion detectors, which sound an alarm to plant security if an attempt is made to penetrate any point of the perimeter. Visual observation of the perimeter fence shall be unobstructed. Facility security shall respond within 5 minutes of the alarm annunciation to the area indicated to investigate the incident, protect the perimeter, and if necessary, call the local police for assistance. Closed circuit television (CCTV) recording and monitoring system shall be used to protect the very sensitive areas of the facility where the printers are housed. The CCTV cameras shall record access at main points, such as perimeter gate, front door entrance, and segregated work areas. Where lighting is limited, use of infrared enhancement is recommended to provide picture clarity. |
| (b) | All gates to the facility shall be manned 24 hours daily throughout the year. The guard shall admit only those personnel who have been authorized access by the security manager. Access to the facility is limited to: |
| (1) | Facility employees who have been issued a pass/badge by facility security. |
| (2) | Facility security personnel shall provide employees of companies who regularly deliver materials/supplies to the plant a pass/badge. Temporary employees or substitute personnel must be escorted to their destination inside the facility by facility security or by an authorized employee. |
| (3) | Visitors to the facility shall sign in and be under the constant escort of an authorized facility employee. |
| (4) | All authorized personnel access lists must be updated continuously to reflect either those who are newly authorized access or to delete those names that are no longer authorized. |
| (5) | The facility shall have limited access points; i.e., a main entrance for personnel; an incoming material receiving dock; and an outgoing products loading dock. The door hardware on the attack side of exterior doors should be removed. The windows and emergency exits shall be alarmed to facility security that shall respond within 5 minutes of alarm annunciation to investigate possible intrusion attempts. The facility shall be equipped with an emergency power system, which shall operate the alarm system in the event of a power outage for the duration of the outage. |
| (6) | All windows that might reasonably afford visual observation of sensitive activities within the facility shall be made opaque or equipped with blinds, drapes, or other coverings. |
| (7) | Visitors to the facility must be met at the front entrance by an employee authorized access and constantly escorted while in the facility and specifically any areas where the DoS printers are designed, produced, stored or shipped. Visitors shall sign a register with full name, name of person visiting, reason for visit, and the time/date in. Visitors shall be issued a Visitor Badge, which must be prominently displayed during the visit. Upon departure, the visitor shall enter time/date out information in the visitor register. The visitor register shall be maintained for the duration of the contract and provided upon request or at time of inspection if requested. |
| (8) | Incoming Materials Dock: The door to the incoming materials receiving dock shall be closed and locked except when incoming materials are being delivered and brought into the DoS printer production area. Delivery personnel are permitted entry only to the loading dock. Only contractor employees authorized access to the DoS printer production area are permitted to bring materials into the room. |
| (9) | Outgoing Products Loading Dock: The door to the outgoing products loading dock shall be closed and locked except when in use for the purpose of loading outgoing products onto trucks. Truck drivers and crews are not permitted access into the building. Employees who have been authorized access to the facility shall bring products to the loading dock from inside the building. Outgoing products are packed and crated by authorized employees vetted by DoS within the building. Packing and crating will be in accordance with DoS instructions. |
| (10) | The three main access points, i.e., the personnel entrance, the incoming materials receiving dock, and the outgoing products loading dock, shall be monitored by closed-circuit TV cameras monitored by the contractor’s security office. The facilities’ security personnel shall respond within 5 minutes to any incident requiring the presence of security personnel. The videotapes shall be maintained for a minimum of three (3) months or longer, if required, in connection with an investigation. Videotapes will be made available to the Department of State, if the possibility exists that the recorded incident is related to the DoS Printer Project. |
| (11) | The contractor shall perform all work, except printer assembly, on the DoS Printer Project in a room dedicated strictly for the DoS project. The room will be sanitized prior to being assigned to the DoS Printer Project, i.e.; all materials and products associated with any previous work conducted in the room, will be removed. All project materials brought into the project room will be inventoried and accounted for, as well as all products or components taken out of the room. The project room’s entrance shall be secured with an electronic access controller, which can be opened with an electronic card-key usable only in that lock. Only those personnel who have been vetted by the DoS to work on the Printer Project will be permitted unescorted access to the DoS project room and will be given an access card-key. The Project Supervisor will be responsible for ensuring that only authorized employees enter the DoS project room. The contractor’s security personnel shall maintain a current roster of employees working on the DoS Printer Project and will provide a copy of the roster and all revisions to the COR and DS/IS/IND. |
| (12) | Product Storage: Materials, partially finished products, components, finished products requiring temporary storage shall be stored in the DoS project room with access limited to those specifically designated and cleared to perform on the project. The area designated as the DoS project room must conform to the requirements of the National Industrial Security Program Operating Manual (NISPOM) Chapter 5 for closed areas. This area also must be protected by an Intrusion Detection System conforming to the requirements of NISPOM Chapter5, Section 9. An on-site inspection of the proposed area will be conducted by DS/IS/IND prior to approval to proceed. |
| (13) | The contractor shall maintain records of inventories and all other administrative records pertaining to the DoS Printer Project, and will make such records available to the U.S. Department of State upon request. Such records include job sheets, final proofs, work logs, inspection records, audit records, input numbers, records of production of components, finished and partially finished products, and destruction records of spoiled or unusable sensitive waste materials. Such records will be maintained separately from other contractor production records and will be secured in a safe or vault, which can be accessed only by personnel authorized to work on the DoS Printer Project. |
| (14) | Only a minimum number of authorized persons shall have knowledge of combinations to authorized storage containers. Containers shall bear no external markings indicating the level of sensitive material authorized for storage. |
| (a) | A record of the names of persons having knowledge of the combination shall be maintained. |
| (b) | Security containers, vaults, cabinets, and other authorized storage containers shall be kept locked when not under the direct supervision of an authorized person entrusted with the contents. |
| (c) | The record of the combination shall be safeguarded as a sensitive document. Superseded combinations shall be destroyed. |
| (d) | Combinations shall be changed by a person authorized access to the contents of the container or by the Security Manager or his designee. Combinations shall be changed as follows: |
| 1. | Initial use of an approved container or lock for the protection of sensitive materials. |
| 2. | The termination of employment of any person having knowledge of the combination, or when the clearance granted to any such person has been withdrawn, suspended, or revoked. |
| 3. | The compromise or suspected compromise of a container or its combination, or discovery of a container left unlocked and unattended. |
| 4. | At other times when considered necessary by the Security Manager. |
| (15) | Supervision of keys and padlocks – Use of key operated padlocks are subject to the following requirements: |
| (a) | A key and lock custodian shall be appointed to ensure proper custody and handling of keys and locks used for protection of sensitive material; |
| (b) | A key and lock control register shall be maintained to identify keys for each lock and their current location and custody; |
| (c) | Keys and locks shall be audited each month; |
| (d) | Keys shall be inventoried with each change of custody; |
| (e) | Keys shall not be removed from the premises; |
| (f) | Locks shall be changed or rotated at least annually, and shall be replaced after loss or compromise of their operable keys; |
| (g) | Making master keys is prohibited. |
File details come from the government source that posted it. Updated .