Attachment 0015_Security SOW SRC I - IV_06 Feb 2026 Draft.pdf

SECURITY STATEMENT OF WORK (SOW)

PHYSICAL SECURITY STANDARDS FOR DOD SECURITY RISK CATEGORIES

(SRC) I – IV ARMS, AMMUNITION AND EXPLOSIVES (AA&E) AND SRC I – III

MISSILES AND ROCKETS AT CONTRACTOR-OWNED, CONTRACTOR-

OPERATED (COCO) FACILITIES

1.0 Objective

The Contractor shall comply with the security standards for safeguarding the Security Risk Category (SRC) I – IV of arms, ammunition and explosives (AA&E) and SRC I – III missiles and rockets being controlled, stored or in the custody at Contractor-Owned, Contractor-Operated (COCO) facilities.

2.0 Applicable Documents

The Contractor shall use the latest versions as of Contract award date, of the following document to the extent specified herein as a guide for this Security Statement of Work (SOW). The Contractor shall comply with all Federal Acquisition Regulations (FAR) and Defense Federal Acquisition Regulations (DFARS) clauses incorporated by reference.

a. Department of Defense Manual 5100.76 Physical Security of Sensitive Conventional Arms, Ammunition, and Explosives (AA&E) dated 17 April 2012 Incorporating Change 2 dated 05 October 2020

3.0 Requirements

3.1 Facility Construction

The procuring command will issue a written suitability determination to validate compliance of structural adequacy on production and storage facilities used by the Contractor.

3.1.1 SRC I – II

The Contractor shall store SRC I – II A&E in accordance with (IAW) DoDM

5100.76 Incorporating Change 2 approved magazines secured with the Sargent & Greenleaf (S&G) 833C and S&G 951 and PadLock PL951 key-operated, high security padlock and hasp, formerly known as the Naval Ammunition Production Engineering Center (NAPEC) shrouded hasp.

3.1.2 SRC III – IV

The Contractor shall store SRC III – IV A&E IAW DoDM 51007.76 Incorporating Change 2 approved magazines, Type II portable magazines, or existing facilities approved by the procuring command. SRC III – IV arms shall be stored IAW DoDM 51007.76 Incorporating Change 2 General Service Administration (GSA)-approved magazines. The required locking system is the S&G 833C and S&G 951 and PadLock PL951 and high security hasp; formerly known as the NAPEC shrouded hasp, except on doors of Type II magazines, which follow the Bureau of Alcohol, Tobacco, and Firearms (ATF) locking requirements.

3.2 Lock and Key Control

The Contractor shall implement a control system that ensures accountability and control of storage structures locks and keys. The Contractor shall retain keys to A&E storage areas and Intrusion Detection System (IDS) separately from other keys. Only those individuals with authorized access are permitted to acquire the A&E keys. The number of keys shall be held to an absolute minimum and signed for by authorized employees only. The same level of security shall be given to replacement or spare locks, keys, and for core A&E keys. Master keying and the use of a master key system is prohibited. The Contractor shall appoint a key and lock custodian in writing, who shall maintain a key control register to ensure continuous administrative accountability of the locks and keys. Key and lock inventories shall be performed semiannually. The custodian shall maintain any A&E registers, issue and turn-in records, and inventories separate from administrative keys reports and for a minimum of one

(1) year.

3.2.1 SRC I – II

When not attended or used, the Contractor shall secure keys providing access to SRC I – II in a GSA-approved Class 5 security container or a GSA-approved Class 5 weapons container.

3.2.2 SRC III – IV

When not attended or used, the Contractor shall secure keys providing access to SRC III – IV in key containers of at least 12-gauge steel with a GSA-approved built-in three (3) position changeable combination lock, a built-in combination lock meeting Underwriters Laboratories (UL) Standard 768 Group I or a GSA-approved key operated security padlock.

3.3 Fencing

3.3.1 SRC I – II

The Contractor shall fence the entire perimeter of an enclave area storing SRC I – II. If the outer perimeter of the facility has adequate fencing and a closed-circuit television (CCTV) monitors the entrances to the storage area, it is not required to construct the inner fence. The minimum height of the chain-link fence is six (6) feet excluding top guard. Unless continuously manned, the Contractor shall secure the gates with GSA-approved security padlocks. Any drainage structures or water passages greater than 96 square inches, and a dimension greater than six (6) inches shall be barred to prevent unauthorized access.

3.3.2 SRC III – IV

Not required for SRC III – IV.

3.4 Lighting

3.4.1 SRC I – II

Exterior building and door lighting shall be provided for all structures storing SRC I – II. The lighting shall be of sufficient illumination to allow detection of unauthorized activity. Switches for exterior lights shall be installed in such a manner that they are only accessible to authorized individuals.

3.4.2 SRC III – IV

Not required for SRC III – IV.

3.5 Access Controls

The Contractor shall ensure only appropriately clear and authorized individuals are granted access to AA&E. The Contractor shall ensure that vehicular and pedestrian entry into and exit from the production and storage areas is controlled. Privately owned vehicles shall not be parked within 100 feet of storage and production structures.

3.6 Intrusion Detection System

3.6.1 SRC I – II Missiles and Rockets, SRC I – II A&E and SRC II – IV Arms

All SRC I – II missiles and rockets, SRC I – II A&E and SRC II – IV arms storage structures shall be protected by a UL-approved IDS to include interior point sensors on doors and other accessible openings, and interior motion or vibration sensors. If an IDS is absent or inoperable, the Contractor shall provide constant surveillance. An approved IDS will have an UL certificate that denotes Underwriters Laboratories, Inc. as the system and installer, and that the IDS complies with the following UL codes: UL-681, UL-827, UL-1076 and UL-2050. The IDS shall be installed by an UL-approved installer. Each separately alarmed area will have a UL certificate. The Contractor shall maintain daily logs of every alarm notification received and maintain logs for a minimum of 90 days. The logs shall be reviewed to identify and correct IDS reliability problems. The Contractor shall test the IDS monthly and maintain test record logs for one (1) year.

3.6.2 SRC III – IV

Not required for SRC III – IV missiles and rockets or A&E storage structures.

3.7 Security Force

Security patrols may consist of civilian security personnel, state or local police, or responsible Contractor employees. Where a public law enforcement agency has agreed to perform this function, the Contractor shall maintain a current letter of agreement to that effect from the agency. The Contractor shall establish liaison with local civil police agencies to conduct periodic surveillance and coordinate a security plan.

3.7.1 SRC I – II

A patrol shall periodically check facilities and areas used to store SRC I – II at least once during each 24-hour period. The Contractor shall ensure that the patrols record these checks. The Contractor shall review guard procedures at least annually and revise, if necessary, to provide greater application of security measures.

3.7.2 SRC III – IV

A patrol shall periodically check facilities and areas used to store SRC III – IV.

Patrols and inspections of facilities shall increase during nights, weekends, holidays, and when local threat conditions warrant.

3.8 Response Force

3.8.1 SRC I – II Missiles and Rockets, SRC I – II A&E and SRC II – IV Arms

The Contractor may select to use one (1) of the following investigative responses for SRC I – II: central station security force, proprietary security force, subcontract security force, law enforcement officials, or properly trained, designated employees. The UL certificate will state who the responder is and what the response time will be.

a. Response time to an activated alarm signal shall not exceed 15 minutes from the time of receipt of the activated alarm. The Contractor shall make arrangements with the responding law enforcement agency to contact the Contractor's representative who shall go immediately to the facility to ascertain the nature of the alarm and take appropriate measures to ensure the security of A&E items.

b. Security forces dispatched by an alarm monitoring station to an alarm shall remain on the premises until the Contractor's representative arrives, or for a period of not less than one (1) hour, whichever comes first. If the Contractor's representative fails to arrive within one (1) hour, the alarm monitoring station shall report the incident to the Contractor within 24 hours.

3.8.2 SRC III – IV

Not required for SRC III – IV missiles and rockets or A&E.

3.9 Additional Security Measures

During periods when the production line is unattended, the Contractor shall remove sensitive AA&E to approved storage areas or employ appropriate protective production line security measures. If used as overnight or temporary storage, the production building must meet the storage construction requirements criteria in Section 3.1.1 and 3.2.1.

3.10 Accountability

The Contractor shall have an accountability system for both sensitive AA&E components and end items produced under a DoD Contract or furnished or released to a Contractor by the DoD. The Contractor shall provide the U.S.

Government (USG) with a written description of established and retained accountability procedures. Review of accountability records and inventories for bulk storage shall be conducted quarterly.

3.11 Security Procedures

The Contractor shall develop written security procedures designed to ensure security standards in keeping with this Security SOW. The Contractor shall keep these procedures available at their facility for review by USG representatives.

3.12 Transportation

The Contractor shall transport sensitive AA&E as prescribed in the Contract.

3.12.1 SRC I – II

The Contractor shall ensure that internal movement, transportation on a Contractor’s facility, of SRC I – II A&E and SRC II arms include the Contractor’s ability to communicate with security and safety personnel.

3.13 Security Surveys and Inspections

To ensure that a prospective Contractor will satisfy physical security requirements of this Security SOW, USG security personnel (usually Defense Counterintelligence and Security Agency (DSCA)) will perform a pre-award security survey. The DSCA office will perform security inspections at recurring 18-month intervals during the Contract period of performance to ensure compliance with this Security SOW.

3.14 Exceptions and Waivers

The Contractor shall submit written requests for exceptions or waivers to the security requirements of this Security SOW to the USG Procuring Contract Officer (PCO), coordinating with DSCA and AMSFS-FP (Force Protection, G-2).

The PCO shall forward such requests to AMSFS-FP, who will either endorse the request up to the Department of Army (DA) for decision, or request further information from the Contractor. DA normally grants waivers for a period of one

(1) year and may extend only after reviewing the Contractor's request for an extension. Exception approvals may be granted on a permanent basis.

Requests for exceptions or waivers shall include a rationale statement as to why the Contractor cannot meet requirements and specify alternative or compensatory measures proposed by the Contractor to provide equivalent or better protection than the original standard. Additionally, the request for waiver shall include details of proposed actions to correct waived deficiencies such as facility design, as well as the expected date for correction of non-compliant areas. The AMSOS-SC office will furnish copies of approved exceptions or waivers to the applicable DSCA office.

3.15 Significant Incidents Pertaining to AA&E

The Contractor shall report all sensitive AA&E losses and thefts as soon as discovered to local law enforcement agencies. The Contractor shall notify the following no later than 72 hours after initial discovery: ATF, Federal Bureau of Investigation (FBI), CCRC-AC-CC, AMSJM-FP and DSCA. The Contractor shall report all A&E losses and thefts; significant damage to structures; any armed robbery or attempted armed robbery; forced entry or attempted forced entry with physical evidence of the attempt; evidence of terrorist involvement; or illegal trafficking.