Attachment 0010 - Antiterrorism (AT) _ Operations Security (OPSEC) Coversheet.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

JANUARY 3, 2023

of v6.1 (FEB 23) CONTRACT REQUIREMENTS PACKAGE ANTITERRORISM/ OPERATIONS SECURITY REVIEW COVER SHEET Requirements Package Title

POC

DATE

Section I.

Purpose of cover sheet: To document the review of the requirements package statement of work statement (SOW) quality assurance surveillance plan and any applicable source selection evaluation criteria for antiterrorism (AT) and other related protection matters to include, but not limited to: AT, operations security (OPSEC), information assurance (IA)/cyber security, physical security, law enforcement, intelligence, foreign disclosure.

Army policy requirement: A signed AT/OPSEC cover sheet is required to be included in all requirements package except for supply contracts under the simplified acquisition level threshold, field ordering officer actions and Government purchase card purchases. Command policy may require this form for supply contracts under the simplified acquisition level threshold.

Mandatory review and signatures: The organizational antiterrorism officer (ATO) must review each requirements package prior to submission to the supporting contracting activity to include coordination with other staff elements for review as appropriate per section II below. If the requiring activity does not have an ATO, the first ATO in the chain of command will review the contract for considerations. An OPSEC officer review is also mandatory.

Section II.

Standard Contract Language Provision/Contract Clause Text Applicability and/or Additional SOW Language.

a. If standard contract or clause language found on page 2 (Section IV) of this form is sufficient to meet specific contract request requirements, check "yes" in block below and include this language in the SOW/PWS.

b. If standard contractual text (provisions or clauses) or clause language does not apply, check "no."

c. If the standard SOW language applies, but is not in of itself sufficient, check "yes" and "SOW/PWS" and include both the standard language and additional contract specific language in the SOW/PWS.

d. If standard contract text or clause language is not desired, but there is related contract specific language in the SOW/PWS, check "no" and "SOW/PWS."

Description Yes No

SOW/PWS

1. AT level 1 training (general)

2. Access and general protection policy and procedures 2a. For contractor requiring Common Access Card (CAC) 2b. For contractor not eligible for CAC, but requires access to DoD facility or installation.

3. AT awareness training for US based contractor personnel traveling overseas

4. Locally developed iWATCH Army training

5. Army Training Certification Tracking System (ATCTS) registration for contractor employees who require access to government information systems.

6. For contracts that require a formal OPSEC program.

7. Requirement for OPSEC training

8. Information assurance/information technology training

9. Information assurance/information technology certification

10. Contractor Authorized to Accompany the Force clause

11. Contract requiring performance or delivery in a foreign country

12. Handling or access to classified information 12a. Cont. "secure telecommunications" at contractor facilities (IAW DFARS 239.7401) 12b. Cont. "covered system" support (IAW DFARS 239.7301)

13. Controlled Unclassified Information (CUI)

14. Threat Awareness Reporting Program (TARP) Section III. Remarks: (field will expand) Antiterrorism Review Signature: I am an ATO (Level II Certified) and have reviewed the requirements package and understand my responsibilities in accordance with Army Regulation 525‐13, Antiterrorism.

Name Grade Phone Date Operations Security Review Signature: I am OPSEC level II certified and have reviewed the requirements package, and it is in compliance with Army Regulation 530‐1, Operations Security.

Name Grade Phone Date Section IV. Standard Contract Language/Contract Clause Applicability and/or Additional SOW Language.

1. AT Level I training. This standard language is for contractor employees with an area of performance within an Army controlled installation, facility or area. All contractor employees, to include subcontractor employees, requiring access Army installations, facilities and controlled access areas shall complete AT Level I Awareness training within calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR or to the contracting officer, if a COR is not assigned, within calendar days after completion of training by all employees and subcontractor personnel. AT level I Awareness training is available at the following website: http://jko.jten.mil.

2. Access and general protection/security policy and procedures. This standard language is for contractor employees with an area of performance within Army controlled installation, facility, or area. Contractor and all associated subcontractor employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204‐9, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

2a. For contractors requiring Common Access Card (CAC). Before CAC issuance, the contractor employee requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation in accordance with Army Directive 2014‐05. The contractor employee will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on‐site or remotely; (2) remote access, via logon, to a DoD network using DoD‐approved remote access procedures; or (3) physical access to multiple DoD facilities or multiple non‐DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

2b. For contractors that do not require CAC, but require access to a DoD facility or installation. Contractor and all associated sub‐contractors employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC‐III) and Terrorist Screening Database (Army Directive 2014‐05/AR 190‐13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative); or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

3. AT Awareness Training for Contractor Personnel Traveling Overseas. This standard language required US based contractor employees and associated subcontractor employees to make available and to receive Government provided area of responsibility (AOR)-specific AT awareness training as directed by AR 525‐13. Specific AOR training content is directed by the combatant commander, with the unit ATO being the local point of contact.

4. iWATCH Training. This standard language is for contractor employees with an area of performance within an Army controlled installation, facility or area. The contractor and all associated sub‐contractors shall brief all employees on the local iWATCH Army program (training standards provided by the requiring activity ATO). This local developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within calendar days of contract award and within calendar days of new employees commencing performance with the results reported to the COR NLT calendar days after contract award.

5. Army Training Certification Tracking System (ATCTS) registration for contractor employees who require access to government information systems. All contractor employees with access to a Government info system must be registered in the ATCTS (Army Training Certification Tracking System) at commencement of services, and must successfully complete the DOD Information Assurance Awareness prior to access to the information system and then annually thereafter.

6. For contracts that require a formal OPSEC program. The contractor shall develop an OPSEC Standing Operating Procedure (SOP)/Plan within 90 calendar days of contract award, to be reviewed and approved by the responsible Government OPSEC officer. This plan will include a process to identify critical information, where it is located, who is responsible for it, how to protect it and why it needs to be protected. The contractor shall implement OPSEC measures as ordered by the commander. In addition, the contractor shall have an identified certified Level II OPSEC coordinator per AR 530‐1.

7. For contracts that require OPSEC Training. Per AR 530‐1, Operations Security, the contractor employees must complete Level I OPSEC Awareness training. New employees must be trained within 30 calendar days of their reporting for duty and annually thereafter.

8. For IA/IT training. All contractor employees and associated subcontractor employees must complete the DoD IA awareness training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01‐M and AR 25‐2 within six months of appointment to IA/IT functions.

9. For IA/IT certification. Per DoD 8570.01‐M , DFARS 252.239.7001 and AR 25‐2, the contractor employees supporting IA/IT functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8570.01‐M must be completed upon contract award.

10. For contractors authorized to accompany the force. DFARS Clause 252.225‐7040, Contractor Personnel Authorized to Accompany U.S. Armed Forces Deployed Outside the United States, shall be used in solicitations and contracts that authorize contractor personnel to accompany US Armed Forces deployed outside the US in contingency operations; humanitarian or peacekeeping operations; or other military operations or exercises, when designated by the combatant commander. The clause discusses the following AT/OPSEC related topics: required compliance with laws and regulations, pre‐deployment requirements, required training (per combatant command guidance), and personnel data required.

11. For Contract Requiring Performance or Delivery in a Foreign Country, DFARS Clause 252.225‐7043, Antiterrorism/Force Protection for Defense Contractors Outside the US . The clause shall be used in solicitations and contracts that require performance or delivery in a foreign country. This clause applies to both contingencies and non‐contingency support. The key AT requirement is for non‐local national contractor personnel to comply with theater clearance requirements and allows the combatant commander to exercise oversight to ensure the contractor’ compliance with combatant commander and subordinate task force commander policies and directives.

12. For contracts that require handling or access to classified information. Contractor shall comply with FAR 52.204‐2, Security Requirements. This clause involves access to information classified “Confidential,”“Secret,”or “Top Secret”and requires contractors to comply with (1) The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22‐M); (2) any revisions to DOD 5220.22‐M, notice of which has been furnished to the contractor.

12a. Cont. If secure telecommunication requirements apply, include clause 252.239-7016 and follow guidance at 239.74.

12b. Cont. If covered system support requirements apply, include provision 252.239-7017 into the solicitation, clause 252.239-7018 into the contract, and follow guidance at 239.73.

13. Controlled Unclassified Information (CUI). Include DFARS clause 252.204-7012, which requires the contractor to comply with NIST 800-171. Also include DFARS provision 252.204-2019 into solicitations. Acquisition officials should follow procedures outlined in DFARS 204.73 and verify vendors have an adequate NIST SP 800-171 summary assessment score within the Supplier Performance Risk System (within PIEE). If the score doesn't show a medium- or high-level assessment with a score of 110 or better (as described in the "NIST SP 800-171 DoD Assessment Methodology"), include clause 252.204-7020 and obtain the vendor's "system security plan" and "plan of action" for NIST SP 800-171 verification and assurance by Army security officials.

14. Threat Awareness Reporting Program. For all contractors with security clearances. Per AR 381-12 Threat Awareness and Reporting Program (TARP), contractor employees must receive annual TARP training by a CI agent or other trainer as specified in 2-4b.

11.0.0.20130303.1.892433.887364

All contractors must be US citizens to handle Classified. US Persons may perform Unclassified work.

- Classified COMSEC material is not releasable to contractor employees who have not received a FINAL clearance at the appropriate security level. COMSEC access shall be IAW DoD 5220.22-M and AR 380-40. When access is required at Government facilities, contractor personnel will adhere to COMSEC rules and regulations as mandated by Command policy and procedures. Written concurrence of the KO is required prior to subcontracting. Contractor required to establish NSA COMSEC Account for CCI maintained and accountable for at Fort Rucker, AL. NSA/CSS Policy Manual 3-16, "Control of Communications Security (COMSEC) Material: Aug 05, and National Industrial Security Program Operating Manual (NISPOM) apply to this contract. Classified COMSEC material is not releasable to contractor employees who have not received a FINAL clearance at the appropriate security level.

- Controlled Unclassified Information (CUI) Information generated and/or provided under this contract shall be safeguarded and marked as specified in DoDI Instruction 5200.48 AR 380-5 or AR 25-55.

- Contractor must develop an OPSEC plan.

Security Requirements The Contracting Officer Representative (COR), Facility Security Officer (FSO) and Certifying Official will execute a Visitor Group Security Agreement (VGSA) after the Contract is awarded.

All contractor personnel assigned to this contract shall be U.S. Citizens or U.S. Persons. The contractor shall comply with all appropriate Government security directives and regulations. In accordance with (IAW) Army Regulation and Air Force Instructions, all prospective contractors will undergo a verification process to determine the trustworthiness and suitability prior to being granted access to federal property. Limited access with escort may be granted (at the installation's discretion) for an interim period while investigations are being conducted. Security Managers will submit all background investigations on prospective contractors requiring CAC and/or network access. Contractor must ensure an owning relationship is established in the Defense Information System Security (DISS) for Contractors that require a Security Clearance with Eligibility/Access to Classified. The Government will take a Servicing Relationship in Defense Information System Security (DISS). Contractors with Common Access Card (CAC) requirement, the Government and Contracting Company will take Owning Relationship in Defense Information System Security (DISS).

The Contractor shall identify themselves as a Contractor employee when answering government telephones.

The Contractors government e-mail signature block shall include the word "contractor" and company name.

Government Issued Common Access Card (CAC) The common access card (CAC) is the DOD personal identity verification credential. In order to receive a CAC, every employee must be investigated as part of the HSPD-12 process. The type of investigation used in compliance with HSPD-12 adjudications is the Tier 1 (Tl), Equivalent or Higher investigation. The Tier 1 serves as the minimum type of investigation required to be issued a CAC and access to Limited Restricted Area as determined by Ft. Rucker, Garrison Security Office. The Contractor shall be responsible for notifying the Government when an employee departs so the CAC can be returned and inactivated by ACLC Security or Mission Partner Affiliation Sponsor (MPAS).

Threat Awareness and Reporting Program (TARP) now CIAR BLOCK 14: As of 13 July 2025, Army Regulation 381-12 has been revised and are in effect. Threat Awareness and Reporting Program (TARP) has been replaced by Counterintelligence Awareness and Reporting (CIAR). There is no longer a requirement for CIAR training to be conducted in a live training session. DA personnel will complete “Counterintelligence Awareness and Reporting for DoD Employees” – https://securityawareness.dcsa.mil/index.html . This is still an annual requirement for all DoD employees and must be completed within 30 days of assignment or employment to an organization, and every 12 months thereafter.

iWATCH Training The contractor and all associated sub-contractors shall brief all employees on the local iWATCH Program (training standards provided by ACLC Security Manager). This local developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the ACLC Security Manager. This training shall be completed within 30 calendar days of new employees and annually thereafter.

Antiterrorism Force Protection Plan (AT/FP) The Contractor shall comply with the Aviation Center Logistics Command's Antiterrorism Plan. Contractor shall implement changes in FPCON's and establish FPCON Measures as required during Fort Rucker Exercise and Non Exercise events in accordance with the Antiterrorism Plan. All Contractor personnel shall complete AT Level I Training within 90 calendar days of DAC, and annually thereafter. All newly hired Contractor personnel shall complete Annual AT Training Level 1 Training within 30 days and annually thereafter. Training is located at: http://jko. jten.mil.

OPSEC Awareness Training OPSEC Plan shall include Contractor developed OPSEC Awareness Training. All Contractor personnel shall complete OPSEC Awareness Training within 90 calendar days of DAC, and annually thereafter. All newly hired Contractor personnel shall complete Annual OPSEC Awareness Training within 30 days.

National Crime Information Center (NCIC-III) A records check through the National Crime Information Center (NCIC) Interstate Identification Index (III) is the Army minimum baseline background check for entrance onto Fort Rucker for non-DoD Identification holders that require Automated Installation (AIE) Contractor Identification Card for unescorted access. The Contractor shall have a program to recover and turn-in Government issued AIE Card Contractor Identification Card upon termination of employment.

Controlled Unclassified Information (CUI) Requirements The Controlled Unclassified Information marking is assigned to information at the time of its creation in a DOD User Agency. It is not authorized as a substitute for a security classification marking but it is used on official Government Information that may be withheld from the public under exemptions 2 through 9 of the Freedom of Information Act. Other non-security markings such as "Limited Official Use" and "Official Use Only" are used by non-DOD User Agencies for the same type of information and should be safeguarded and handled in accordance with instructions received from such agencies.

Use of the above markings does not mean that the information cannot be released to the public, only that it must be reviewed by the Government prior to its release to determine whether a significant and legitimate Government purpose is served by withholding the information portions of it.

IDENTIFICATION MARKINGS:

At minimum, CUI markings for unclassified DoD documents will include the acronym “CUI” in the banner and footer of the document. In accordance with Part 2002 of Title 32, CFR, the CUI designation indicator must contain, at minimum, the name of the DoD Component determining that the information is CUI.

All document subjects and titles, as well as individual sections, parts, paragraphs, or similar portions of a CUI document known to contain CUI, will be portion marked with “(CUI).” Use of the unclassified marking “(U)” as a portion marking for unclassified information within CUI documents or Materials is required.

Any Controlled Unclassified Information" released to a contractor by a DOD User Agency is required to be marked with the following statement prior to transfer:

THIS DOCUMENT CONTAINS INFORMATION EXEMPT FROM MANDATORY DISCLOSURE UNDER THE FOIA. EXEMPTIONS APPLY.

Removal of the Uncontrolled Unclassified Information marking can only be accomplished by the originator or other competent authority. When Uncontrolled Unclassified Information status is terminated, all known holders will be notified to the extent possible.

DISSEMINATION: Contractors may disseminate Controlled Unclassified Information to their employees and subcontractors who have a need for the information in connection with a classified contract.

STORAGE: During working hours Controlled Unclassified Information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for the information. During non-working hours, the information shall be stored to preclude unauthorized access. Filing such material with other unclassified records in unlocked files or desks is adequate when internal building security is provided during non-working hours. When such internal security control is not exercised, locked buildings or rooms will provide adequate after hours -protection or the material can be stored in locked receptacles such as file cabinets, desks or bookcases.

TRANSMISSION: Controlled Unclassified Information may be sent via first-class mail or parcel post. Bulky shipments may be sent fourth-class mail. Controlled Unclassified Information when sent via Government Email must be ENCRYPTED. Transmission via non Government Email is prohibited.

DISPOSITION: When no longer needed, Controlled Unclassified Information will be disposed of by shredding to preclude reconstructing and before placing in a recycling or trash container or as directed by the User Agency.

UNAUTHORIZED DISCLOSURE: Unauthorized disclosure of Controlled Unclassified Information does not constitute a security violation, but the releasing agency should be informed of any unauthorized disclosure. The unauthorized disclosure of FOUO information protected by the Privacy Act may result in criminal sanctions.

Point of contact is AMCOM Combined Logistics Command (S2), Security Manager: 334-255-1948.