Attachment II - PWS Additional Documents.pdf

Security Requirements for All SOWs & PWSs (updated Sep 2025)

The information below is the mandatory security requirements that must be incorporated into all Statements of Work and Performance Work Statements.

All Tobyhanna Army Depot (TYAD) contracts and other acquisition-related documents must ensure privacy and security controls follow this information, and that contractors, subcontractors, and service providers protect Privacy Act information in the same way the organization adhering to the Federal Acquisition Regulations (FAR) Privacy Act provisions (Subparts 24.1 and 24.2) and include the specified contract clauses (Parts 52.224-1 and 52.224-2), as appropriate, to ensure that personal information is protected as mandated.

In addition to the changes authorized by the clause of this contract; should Force Protection Condition (FPCON) at the installation change, the Government may require changes in contractor security matters and/or processes.

FPCON impact on work levels.

TYADs Current FPCON: Bravo

FPCON Charlie: Applies when a hostile incident occurs within the CDR’s area of interest (AOI), or intel is received indicating a hostile act or targeting against DoD elements, PAX, or facilities is likely.

FPCON Delta: Applies when a terrorist attack or hostile act has occurred or is anticipated against specific installations or operating areas.

Contracting Officer’s Representatives (CORs) - Please place an “X” on option 1 or option 2 below.

If option 1 applies, you must specify within the brackets which contracted services [XXX] will be affected.

1. _____ During FPCONs Charlie and Delta, [XXX] services are discontinued.

[XXX] services will resume when the FPCON level is reduced to level Bravo or lower.

2. __X__This contract and its employees are considered mission essential.

Therefore, all contractor employees are required to report for duty and remain on duty during declared emergencies and/or elevated FPCON levels unless otherwise directed by the contacting officer via the appropriate COR.

Unscheduled gate closures by the Security Police may occur at any time causing all personnel entering or exiting a closed installation to experience a delay. This cannot be predicted or prevented. Contractors are not compensated for unexpected closures or delays.

Vehicles operated by contractor personnel are subject to search pursuant to applicable regulations. Any moving violation of any applicable motor vehicle regulation may result in the termination of the contractor employee’s installation driving privileges.

The contractor’s employees shall become familiar with and obey the regulations of the installation, including fire, traffic, safety and security regulations while on the installation.

Contractor employees should only enter restricted areas when required to do so and only upon prior approval. All contractor employees shall carry proper identification with them at all times. The contractor shall ensure compliance with all regulations and orders of the installation which may affect performance.

(If Required) The contractor shall provide support during contingencies, exercises, heightened operations, and adverse weather or security closures in the accomplishment of performance requirements. From time to time, the Base Commander may decide to close all or part of a base in response to an unforeseen emergency or similar occurrence. Such emergencies include adverse weather such as snow, or ice, "an act of God,” such as tornado or earthquake, or a base disaster such as a gas leak or fire.

Emergency Communications and Services.

If assigned to TYAD for seven-days or longer, contractors will enroll in the ALERT!

Mass Warning Notification System (MWNS) at https://alertservices.csd.disa.mil/.

Alert! MWNS is NOT optional - it is a Headquarters Department of the Army (HQDA) requirement to be a registered user.

Due to the life-safety implications of the information being relayed and the requirement to provide immediate alerts and warnings, personnel assigned to TYAD must ensure that their personal contact information, including after-duty hours contact information, as appropriate (e.g., personal cellular phone numbers or landline phone numbers), e-mail addresses, home address, etc., are entered into the system and regularly updated or verified every 90 days to remain current and accurate.

• A Common Access Card (CAC) is required to register for ALERT!

• If a CAC has not been deemed necessary for the contractor (see below paragraph: Common Access Card (CAC), COR will send the following information to usarmy.tyad.tyad.mbx.secops-at@army.mil or TYAD Antiterrorism Officer to manually input personnel data into ALERT!

• Full Name

• Cell Phone

• Is SMS ok for alerts? Yes or No

• Email

• Contractor: For what Cost Center

• Name of COR

• Expected length of contract

In the event of a life-threatening emergency or natural disaster, COR will account for assigned contractors. COR will send personnel accountability report to Emergency Operations Center (EOC).

Base closure announcements will be disseminated via ALERT! MWNS.

https://usg01.safelinks.protection.office365.us/?url=https%3A%2F%2Falertservices.csd.disa.mil%2F&data=05%7C02%7Claura.l.mulrooney.civ%40army.mil%7C73b946e509c9422bb19c08dc2d608869%7Cfae6d70f954b481192b60530d6f84c43%7C0%7C0%7C638435139818984692%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=PJ4RKmcoiR9WhaAPRYf0PSx61qOIYMxQF2NUrxa53dM%3D&reserved=0 mailto:usarmy.tyad.tyad.mbx.secops-at@army.mil

Antiterrorism (AT) Level I Training. All contractor employees, to include subcontractor employees, requiring access to Army installations, facilities, and controlled access areas shall complete AT Level I awareness training prior to contract report date. This training is required for any additional or new contractor employees, who start after that period. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR/POC within 10 calendar days after completion of training by all employees and subcontractor personnel. AT level I awareness training is available at the following website:

https://jko.jten.mil course# JS-US007 for their training. Completion of contractor employee training will be documented on ELTY form 583, TYAD On-Post Training Record, or contractor equivalent. As applicable, contractor employees must complete annual AT awareness training as it pertains the length of the contract.

iWATCH Army Training. This locally developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 calendar days of contract award and within 30 calendar days of new employees commencing performance with the results reported to the COR NLT 60 calendar days after contract award. Contractors and all associated sub-contractors will be briefed by the TYAD Antiterrorism/Force Protection officer. It is recommended this training be conducted as part of an initial entry briefing or unit/organization newcomer’s briefings. Send training requests to usarmy.tyad.tyad.mbx.secops-at@army.mil, completion of contractor employee training will be documented on ELTY form 583, TYAD On-Post Training Record or contractor equivalent.

Access and General Protection/Security Policy and Procedures. Contractor and all associated sub-contractor employees shall comply with applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by TYAD Law Enforcement. Contractor workforce must comply with all personal identity verification requirements as directed by DoD, HQDA, and/or local policy.

Contractor and all associated sub-contractor employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB) (Army Directive 2014-05/AR 190-13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by the government representative), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

A background check and approval from Tobyhanna Army Depot (TYAD) Law Enforcement is required for all contractor and subcontractor personnel prior to on-site access at TYAD. All persons seeking entrance to TYAD shall submit to and comply with all security standards and requirements in force at the time such persons are https://jko.jten.mil/ mailto:usarmy.tyad.tyad.mbx.secops-at@army.mil seeking entry. All contractors, regardless of resident status or citizenship, will be subject to vehicle search and intense in-processing by TYAD security personnel prior to being granted access to TYAD. This security screening process may be time consuming, and access may be delayed or denied. The contractor shall ensure ELTY Form 648-C is completed for all contractor and subcontractor personnel requiring depot access to include warranty services. The TYAD point of contact (POC) will provide ELTY Form 648-C, “Request Access to Tobyhanna Army Depot” to the contractor/vendor at least ten days prior to the expected visit date for completion. The contractor/vendor shall return the completed ELTY Form 648-C to the TYAD POC in a timely manner so the same may be submitted to Security for processing no later than seven days prior to the visit. All the required fields on the form shall be complete and accurate by the contractor/vendor for timely processing. This requirement is inclusive of on-site supervisory or managerial personnel and sub-contractor personnel that the contractor anticipates will be performing work or visiting on-site. This security screening does not relieve the contractor of any responsibilities to conduct thorough pre-employment background checks and drug screening. Contractor workers will not be granted access to the work site until security screening is completed and access is approved. Any contractor personnel on-site who fail screening will not be permitted further access to TYAD.

Submit the completed ELTY Forms 648-C form(s) to the COR or POC. Ensure contracts include the provisions that check for the possibility of and prevent undocumented workers for inclusion in contracted work related to Army missions.

The company will ensure that its employees entering Army-controlled installations or facilities have obtained access badges and passes in accordance with facility regulations and that these badges and passes are obtained in advance so as not to delay the accomplishment of contracted services.

Common Access Card (CAC): [If applicable.] Before CAC issuance, the contractor employee requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation in accordance with Army Directive 2014-05. The contractor employee will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) Remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) Physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

Contractors shall be identified with Government issued identification card (e.g., Common Access Card (CAC) or unit specified identification card). When required, contractor personnel shall comply with local security policies to wear their identification card in a standardized manner, clearly visible attached to the torso of the exterior garment above the belt and below the shoulders except when in use (i.e., inserted in a computer CAC reader) or when in controlled areas requiring other credentials as the primary method of identification. To access any Government base and certain facilities, the contractor shall present required identification card upon demand. Upon exit from Government facilities, the contractor shall conceal their credentials (CAC or other credentials) from plain view. The contractor and Contractor Security Manager/Officer shall coordinate with the COR for Government credential issues.

For contractors that do not require CAC, but require access to a DoD facility or installation: Contractor and all associated subcontractor employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (Army Directive 2014-05/AR 190-13); applicable installation, facility and area commander installation and facility access and local security policies and procedures (provided by Government representative); or, at OCONUS locations, in accordance with status-of-forces agreements and other theater regulations.

Collection of Badges: The Contractor shall account for all forms of Government-provided identification issued to the Contractor employees in connection with performance under this contract. The Contractor shall return such identification to the issuing agency at the earliest of any of the following, unless otherwise determined by the Government:

1. When no longer needed for contract performance

2. Upon completion of the Contractor employee’s employment

3. Upon contract completion or termination

The Contracting Officer may delay final payment under a contract if the Contractor fails to comply with these requirements. The Contractor shall insert the substance of this clause, including this paragraph, in all subcontracts when the subcontractor’s employees are required to have routine physical access to a federally controlled facility and/or routine access to a federally controlled information system. It shall be the responsibility of the prime Contractor to return such identification to the issuing agency in accordance with the terms set forth in of this section, unless otherwise approved in writing by the Contracting Officer. The company will return all issued U.S. Government Common Access Cards, installation badges, and/or access passes to the COR when the contract is completed or when a contractor employee no longer requires access to the installation or facility. Contractor personnel will obtain a vehicle pass for access to the military installation and Common Access Cards (CAC) for computer access, if applicable.

Security Clearances. [If applicable.] Performance of work will require access to classified information or equipment IAW the DD Form 254, Contract Security Classification Specification, provided as an attachment. Contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified “Confidential,” “Secret,” or “Top Secret” and requires contractors to comply with— (1) The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M); (2) any revisions to DOD

5220.22-M, notice of which has been furnished to the contractor. If subsequent to the date of this contract, the security classification or security requirements under this contract are changed by the Government and if the changes cause an increase or decrease in security costs or otherwise affect any other term or condition of this contract, the contract shall be subject to an equitable adjustment as if the changes were directed under the Changes clause of this contract.

The Contractor agrees to insert terms that conform substantially to the language of this clause but excluding any reference to the Changes clause of this contract, in all subcontracts under this contract that involve access to classified information.

Contractor personnel performing IT sensitive duties are subject to investigative and assignment requirements IAW AR 25-2, AR 380-67, DoD 8570.0 and affiliated regulations. Army regulation available at www.apd.army.mil.

Threat Awareness and Reporting Program (TARP). [If applicable.] For all contractors with security clearances, per AR 381-12, TARP contractor employees must receive initial and annual TARP training by a CI Agent or other trainer as specified.

Insider Threat Program. The contractor will establish and maintain an insider threat program to gather, integrate, and report relevant and available information indicative of a potential or actual insider threat, consistent with E.O. 13587 and Presidential Memorandum “National Insider Threat Policy and Minimum Standards for Executive Branch Insider Threat Programs.”

Operational Security (OPSEC). OPSEC is not a one-time checklist, it is a dynamic, ongoing process embedded in every phase of planning, execution, and daily operations.

It requires continuous critical thinking and vigilance from everyone who interacts with government information or operates on a government installation. This includes military personnel, Department of Defense civilians, contractors, subcontractors, and family members. OPSEC is not just a policy, it’s a mindset. Its success depends on consistent awareness and execution by every member of the TYAD community.

At TYAD, all observations, communications, and experiences must be protected and must not be shared with anyone lacking a lawful government purpose or a validated business need-to-know. This disciplined approach ensures that emerging threats, evolving vulnerabilities, and shifting mission parameters are constantly reassessed and addressed to safeguard critical information.

OPSEC applies across the full spectrum of DoD missions, functions, programs, and activities under this contract. Practicing OPSEC daily is a requirement that is essential to mission success and the protection of national security assets.

Failure to properly safeguard sensitive or classified information—whether through negligence, willful misconduct, or ignorance—may result in administrative, disciplinary, contractual, or criminal consequences.

OPSEC Plan. (If applicable- not all contracts require an OPSEC Plan or SOP)

When a contract involves any task that could expose critical information or Controlled Unclassified Information (CUI) to adversary exploitation, an OPSEC Plan or SOP is mandatory. To be more specific, any TYAD contract involving the repair, calibration, maintenance, upgrade, or testing of mission-critical electronic systems—such as communications, encryption, electronic warfare, satellite, or unmanned platforms— automatically triggers the requirement for an OPSEC Plan or SOP under AR 530-1.

These efforts involve Controlled Unclassified Information (CUI) like system configurations, performance data, and operational logs that adversaries could exploit.

CORs, contractors, and subcontractors should therefore assume that any work touching these capabilities will require a formal OPSEC Plan or SOP—complete with critical information identification, countermeasure assignment, and Government OPSEC Officer approval—to mitigate the risk of unauthorized disclosure. According to DoD policy and Army Regulation 530-1, an OPSEC Plan or SOP is required when the Statement of Work (SOW) or Performance Work Statement (PWS) includes any of the following criteria:

• The contract supports handling, processing, or storage of CUI or FOUO materials

• Identified critical information resides in documents, systems, or operations tied to the SOW/PWS

• Tasks involve design, development, manufacturing, testing, or maintenance of sensitive equipment

• Activities include exercises, deployments, or training events with potential visibility to unauthorized audiences

• Performance location is outside controlled or classified environments (e.g., off-installation work sites)

The requirement for an OPSEC Plan/SOP will be explicitly stated in the SOW/PWS by the Contracting Officer Representative (COR). If the SOW/PWS contains an “OPSEC Requirements” clause or cross-reference to AR 530-1, the contractor must:

1. Develop and submit an OPSEC Plan/SOP within 90 calendar days of contract award

2. Ensure the document is reviewed and approved by the designated Government OPSEC officer

3. Address these mandatory elements:

o Identification of the organization’s critical information and CUI o Reasons for each information item must be protected o Physical and digital locations where the information resides o Assigned responsibilities for safeguarding each piece of critical information o Specific countermeasures and enforcement procedures tied to the SOW/PWS tasks

4. Assign an OPSEC Coordinator who obtains OPSEC Level II certification per AR 530-1

CORs will flag these criteria in the SOW/PWS, to ensure that everyone has clear guidance for when an OPSEC SOP/Plan is required and how to comply with DoD and Army OPSEC regulations.

OPSEC Training Requirements. In accordance with AR 530-1 (4-2-a), the contractors and subcontractors shall ensure all personnel complete OPSEC Level I certification training (Initial and Continual – detailed below) before the contract report date.

The Contracting Officer’s Representative (COR) serves as the oversight authority: the COR verifies contractual compliance by collecting and reviewing certificates, ensuring they’re submitted within the required timeframe.

According to AR 530-1 (para 4-2) and DoDM 5205.02, there is no “grace period” or minimum number of days on-site before OPSEC Level I Initial and Continual training becomes mandatory—any contractor, subcontractor, or support‐service provider who requires access to TYAD information, systems, or facilities must complete both parts of their OPSEC Level I training before they begin work.

OPSEC Level I training is comprised of two parts (Initial and Continual):

1. OPSEC Level I Initial training o To be completed within 30 days of assignment to TYAD and annually thereafter – preferably before the job starts o Provides specific information about TYADs OPSEC program o Contractors and subcontractors must set up an appointment with TYADs OPSEC Officer for Initial training-COR to provide contact information o Conducted by TYAD’s OPSEC officer or alternate – training can be in person or via MS Teams (30 minutes) and is tracked by a TYADs OPSEC Officer via a local training form

2. OPSEC Level I Continual training:

o Commonly referred to as annual OPSEC training o To be completed within 30 days of assignment to TYAD and annually thereafter – preferably before the job starts o Provides general information about OPSEC and reemphasizes sound OPSEC practices throughout the contract period o Title of the training is: “OPSEC Awareness for Military Members, DoD Employees and Contractors” and is available online -https://securityawareness.dcsa.mil/opsec/index.htm o Certificates of completion must go to the COR

OPSEC Countermeasures. All personnel shall implement the following countermeasures in daily activities to protect critical unclassified information:

1. Complete mandatory OPSEC training and apply TYAD OPSEC countermeasures in support of contract-related operations.

2. Avoid discussing government operations in public or over unprotected communications. Transmit Controlled Unclassified Information (CUI) only as directed in the SOW/PWS, marking and handling it per DoD and TYAD regulations. Do not remove CUI from the installation.

3. Refrain from disclosing or posting images, data, or operational details (tactics, schedules, equipment changes, deployments) to any unofficial media or social platforms. All information (paperwork, pictures, videos, etc.) that will be released requires a documented OPSEC Review which can be done by a TYAD employee that has an OPSEC Level II certificate. Coordinate press releases through the COR, TYADs Public Affairs Office, or Technical POC when in doubt.

4. Report unauthorized disclosure attempts or solicitations by third parties immediately to TYAD Security Operations, Law Enforcement Branch, the contract POC, and your Facility Security Officer or Defense Security Service.

Non-disclosure obligations persist indefinitely.

5. Conceal or remove government-issued badges and IDs when off station. Do not duplicate, loan, or leave them unattended. Report lost or stolen credentials to the installation Security Office immediately.

6. Mark and protect internal company schedules, inventories, and vulnerability reports as Controlled Unclassified Information Category: OPSEC or any other category as appropriate (www.dodcui.mil). Protect government-provided drawings and data per SOW/PWS guidance.

7. At contract completion or upon Government request, return all government information or destroy it in accordance with TYAD proceed

Photography or Videography. Contractors and subcontractors who will require photography or videography at TYAD must notify their COR at least fourteen business days in advance, complete OPSEC Level I Initial training, and obtain a camera pass/permit ELTY 6422 or ELTY 6422A. Extra steps and authorizations will need to be arranged for photographs in Secret areas. Individuals are not permitted to use https://securityawareness.dcsa.mil/opsec/index.htm http://www.dodcui.mil/ personal devices—such as their own cell phones or cameras—in the controlled areas.

Instead, (with a signed camera pass/permit) they are only allowed to use equipment that has been officially provided by the government (Government Furnished Equipment, or GFE) or by the contractor (Contractor Furnished Equipment, or CFE) for mission-related purposes.

All photos and videos must then undergo an OPSEC Review—per AR 530-1 Chapter 4—to evaluate them against TYAD’s Critical Information List and identify any vulnerabilities. That review must be fully documented and signed off by a TYAD employee who holds OPSEC Level II certification (example: TYAD OPSEC Officer or Public Affairs personnel) before any imagery is distributed.

Information Security (INFOSEC). Contractor personnel must comply with local security requirements for entry and exit control for personnel and property at the Government leased facility or any Government facility where work is being performed.

Contractor employees will be required to comply with all Government security regulations and requirements. Initial and periodic security training and briefings will be required. Failure to comply with security requirements can cause for removal and the Contractor will not be permitted to provide service on this contract.

The Contractor shall not divulge any information about DoD files, data processing activities or functions, user identifications, passwords, or any other knowledge that may be gained, to anyone who is not authorized to have access to such information. The Contractor shall observe and comply with the security provisions in effect at the Government leased facility or any other Government facilities where work is being performed. Identification shall be worn and displayed as required.

Safeguarding Controlled Unclassified Information (CUI). CUI is Government-created or owned UNCLASSIFIED information that requires safeguarding and dissemination controls under Executive Order 13556 (implemented at 32 CFR Part 2002) and DoDI 5200.48. CUI encompasses sensitive or critical data that doesn’t meet classification criteria but still demands protection. The CUI policy establishes a uniform marking system across the Federal Government—replacing legacy markings such as FOUO, LES, and SBU—and alerts recipients that special handling may be required.

Refer to TYAD Critical Information List found in TYADs OPSEC plan – contact TYADs OPSEC Officer for more information.

Controlled Unclassified Information (CUI) Training Requirement: Any contractor or subcontractor personnel who will have access to CUI under this contract must complete CUI training prior to accessing such information or beginning work on any task involving CUI. The DoD Mandatory CUI Training course, available through the Defense Counterintelligence and Security Agency (DCSA), Center for Development of Security Excellence (CDSE), Security Awareness Hub (course title: DoD Mandatory Controlled Unclassified Information (CUI) Training satisfies this requirement.

https://securityawareness.dcsa.mil/cui/index.html https://securityawareness.dcsa.mil/cui/index.html

Completion certificates must be submitted to the Contracting Officer or designated Government representative no later than five (5) business days prior to the start of work involving CUI. Contractors are responsible for retaining proof of training and ensuring all applicable personnel remain compliant with training requirements throughout the period of performance.

In addition, it is required to refer to the DoD CUI Registry for category definitions, required markings, authorities, and examples. Not every Registry category applies to DoD. More resources and training are available at https://www.dodcui.mil/Home/Training/.

If your contract duties include handling CUI, your responsibilities are as follows:

1. Regulatory Basis and Definition • Comply with EO 13556, 32 CFR Part 2002, FAR 52.204-21, DFARS 252.204-7012, and NIST SP 800-171 or SP 800-53 Rev 4 as applicable. • Understand that “handling” CUI (32 CFR 2002.4(aa)) includes marking, safeguarding, transporting, disseminating, re-using, and disposing of information.

2. Identification and Marking • Inventory all CUI and apply uniform CUI markings (banner markings, category blocks, distribution statements) per the DoD CUI Registry. • Ensure markings remain visible on deliverables, media, and systems during transit and storage.

3. Access Controls and Dissemination • Restrict CUI access to personnel with a lawful government purpose and validated need-to-know. • Flow down all CUI protection requirements to your subcontractors, vendors, and suppliers.

4. Physical and Cyber Safeguarding • Implement physical controls (e.g., locked storage, controlled-access areas) for CUI. Contact TYADs Cyber Security personnel for specific cyber safeguarding requirements.

5. Incident Response and Reporting • Detect, respond to, and report to COR any actual or suspected CUI compromise within 72 hours, per DFARS 252.204-7012.

• Provide remediation updates until the incident is fully resolved.

6. Training and Awareness • Ensure all personnel handling CUI complete initial CUI safeguarding training before accessing CUI and annual refresher training thereafter. • Maintain training attendance records and curricula.

7. Compliance Documentation and Audits • Produce evidence of compliance— assessment reports, audit findings, corrective action plans—upon Government request. • Grant Government inspectors’ on-site access to review CUI protection measures.

8. CUI Disposition and Destruction • Return CUI to TYAD control, destroy it when no longer needed. • Perform destruction in accordance with DoD and Army guidelines.

https://www.dodcui.mil/Home/Training/

By adhering to these controls, you help protect critical information, support mission success, and maintain full compliance with DoD and Federal regulations.

Confidentiality, Integrity, Availability, and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by TYAD or collected by the contractor on behalf of TYAD shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any person except as may be necessary in the performance of the contract. The contractor assumes responsibility for protection of the confidentiality, integrity, and availability of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the contractor. Each contractor employee or any of its subcontractors at any level to whom any TYAD records may be made available or disclosed shall be notified in writing by the contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein. The confidentiality, integrity, and availability of such information shall be protected in accordance with TYAD policies and instructions. Unauthorized disclosure of information will be subject to the TYAD sanction policies and/or governed by the following laws and regulations:

• 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

• 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

• 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

• 18 U.S.C. 1030 The Computer Fraud and Abuse Act (CFAA)

• 44 U.S.C. 3301 Definition of Records

Government Access for Security Assessment. In addition to the Inspection Clause in the contract, the contractor (and/or any subcontractor) shall afford the Government access to the contractor’s facilities, installations, operations, documentation, information systems, and personnel used in performance of this contract to the extent required to carry out a program of security assessment (to include vulnerability testing), investigation, and audit to safeguard Security and Privacy Requirements for Information Technology Procurements against threats and hazards to the confidentiality, integrity, and availability of federal data or to the protection of information systems operated on behalf of TYAD, including but are not limited to:

a. At any tier handling or accessing information, consent to and allow the Government, or an independent third party working at the Government’s direction, without notice at any time during a weekday during regular business hours contractor local time, to access contractor and subcontractor installations, facilities, infrastructure, data centers, equipment (including but not limited to all servers, computing devices, and portable media), operations, documentation (whether in electronic, paper, or other forms), databases, and personnel which are used in performance of the contract. The purpose of the access is to facilitate performance inspections and reviews, security and compliance audits, and law enforcement investigations. For security audits, the audit may include but not be limited to such items as buffer overflows, open ports, unnecessary services, lack of user input filtering, cross site scripting vulnerabilities, Structured Query Language (SQL) injection vulnerabilities, and any other known vulnerabilities.

b. At any tier handling or accessing protected information, fully cooperate with all audits, inspections, investigations, forensic analysis, or other reviews or requirements needed to carry out requirements presented in applicable law or policy. Beyond providing access, full cooperation also includes, but is not limited to, disclosure to investigators of information sufficient to identify the nature and extent of any criminal or fraudulent activity and the individuals responsible for that activity. It includes timely and complete production of requested data, metadata, information, and records relevant to any inspection, audit, investigation, or review, and making employees of the contractor available for interview by inspectors, auditors, and investigators upon request. Full cooperation also includes allowing the Government to make reproductions or copies of information and equipment, including, if necessary, collecting a machine or system image capture.

c. Cooperate with inspections, audits, investigations, and reviews.

Physical Security. The Contractor shall be responsible for safeguarding all government equipment, information and property provided for Contractor use. At the close of each work period, government facilities, equipment and materials shall be secured.

Key Control. [If applicable.] The Contractor shall establish and implement methods of making sure all keys/key cards issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include key cards. No keys issued to the Contractor by the Government shall be duplicated. The Contractor shall develop procedures covering key control that shall be included in the Quality Control Plan. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the KO.

In the event keys, other than master keys, are lost and/or duplicated, the Contractor shall, upon direction of the KO, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the locks or locks shall be deducted from the monthly payment due to the Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaces by the Government and the total cost deducted from the monthly payment due to the Contractor.

The Contractor shall prohibit the use of Government issued keys/key cards by any persons other than the Contractor’s employees. The Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas or personnel authorized entrance by the KO.

Lock Combination. [If applicable.] The Contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized persons. The Contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations. These procedures shall be included in the Contractor’s Quality Control Plan.

COMSEC/IT Security. All communications with DoD organizations are subject to communications security (COMSEC) review. All telephone communications networks are continually subject to intercept by unfriendly intelligence organizations. DoD has authorized the military departments to conduct COMSEC monitoring and recording of telephone calls originating from, or terminating at, DoD organizations. Therefore, the contractor is advised that any time a contractor place or receive a call they are subject to COMSEC procedures. The contractor shall ensure wide and frequent dissemination of the above information to all employees dealing with DoD information. The contractor shall abide by all Government regulations concerning the authorized use of the Government's computer network, including the restriction against using the network to recruit Government personnel or advertise job openings.

National Defense Authorization Act Section 889 Compliance. DoD, GSA, and NASA have issued an interim rule amending the Federal Acquisition Regulation (FAR) to implement section 889(a)(1)(B) of the John S. McCain National Defense Authorization Act (NDAA) for Fiscal Year (FY) 2019 (Pub. L. 115-232). Section 889(a)(1)(B) prohibits executive agencies from entering into, extending, or renewing a contract with an entity that uses any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system, on or after August 13, 2020, unless an exception applies, or a waiver is granted. See solicitation provision 52.204-24 and clause 52.204-25.

Service or Equipment Installations Over $250K Contractor Safety Standards for TYAD June 2024

SERVICE or EQUIPMENT INSTALLATION CONTRACTOR SAFETY

STANDARDS FOR TYAD

Below are some “installation specific” safety standards which contractors are required to adhere to while performing any work on Tobyhanna Army Depot. It is the contractor’s responsibility to always incorporate these particular requirements into their daily operations while under contract and to institute these specifics into their overall site safety controls. These do not substitute or deflect in any way the requirement to institute and adhere to all OSHA 29 CFR 1910 & 1926 and USACE EM385-1 safety standards, as well as all applicable contractual Federal Acquisition Regulations while performing the work under this contract on Tobyhanna Army Depot.

It is the responsibility of the contractor to enforce the below requirements as well as all current revisions of the above referenced standards. Failure to enforce safety requirements on the depot can result in immediate stop works, safety stand down orders and even complete termination of the contract.

Important Phone Numbers:

Fire or Emergency: 911 Fire Department – (Non-Emergency): 570-615-7300 Security: 570-615-7550 Safety Office - 570-615-7027

S1.0 THE CONTRACTOR IS SOLELY RESPONSIBLE AND LIABLE

FOR JOB- SITE SAFETY

1. Review of the project plans and other documents by any government appointed official does not constitute an acceptance of Federal responsibility or liability for the adequacy of the safety measures identified for the job or for the Contractor's compliance with all applicable safety rules and regulations.

2. The Contractor remains solely responsible and liable for job-site safety at all times during the term of the contract. No outside personnel (other than ET, COR, TYAD Safety, or other government appointed contract personnel) are allowed onto the job site at any time during contract without prior permissions and/or escort by the ET, COR or KO.

3. Tobyhanna Army depot has restrictions on the use of fossil fuels in all buildings.

When it is determined that electric or other alternatively fueled vehicles are insufficient or unavailable for movement of material within the buildings on the installation, fossil-fueled vehicles can be used only when all alternatives of accepted electric material movement equipment have been considered, and the last option is use of a fossil fuel vehicle or project failure. This includes any situations where safety of employees and equipment may be jeopardized. Convenience will never be an acceptable justification to utilize fossil-fueled vehicles. The Government

Designated Representative (GDR) will notify the appropriate supervisor(s) or leader(s) in the area where the need to utilize a fossil fuel vehicle is required. The supervisor / leader will take the necessary steps to notify the employees in the work area of the option to leave the area during the material movement process. The GDR and Contractor will also document all actions the Contractor took to utilize electric or other alternatively fueled vehicles. The documentation will specifically state why electric or alternatively fueled vehicles are insufficient and all mitigation efforts used to minimize the effects of fossil-fueled vehicles to include information as to any appropriate scrubbers that can be utilized along with any ventilation or exhaust systems that can be used to externally vented to the outside of the facility.

The documentation must be submitted to the TYAD Safety office for approval prior to any equipment being used. A final copy of the Approved documentation will be provided to the TYAD Safety Division.

4. All direct construction supervision, including subcontractors, must as a minimum, complete an OSHA 30-hour safety course for construction. These certificates must be submitted as part of the site safety plan BEFORE construction activities start.

5. RED CARD PROGRAM - Tobyhanna Army Depot utilizes a program to allow employees to stop an action which is considered unsafe. Employees carry small red cards that can be thrown down when employee sees any action they consider unsafe. Work ceases until TYAD management can decide if it is safe or not.

Contractors are required to comply with this program. If a TYAD employee presents the red card to the contractor, the contractor must stop working until the COR and Safety Office can determine if there is a safety hazard or not.

6. All contractor personnel, to include subcontractors, vendors, suppliers, or visitors, when performing any type of work activity, or gaining access through an occupied area or shop - must have all applicable PPE that is required for the area to include, but not limited to, hardhats, safety glasses, hearing protection, and respirator protection. Notify both COR & Area Supervision, for access approval and prior to any work activities being performed.

S2.0 CODE COMPLIANCE

As noted in Tobyhanna Army Depot Safety Regulation 385-1 - TYAD follows all requirements and is certified as an ISO 45001 facility. Accordingly, the contractor shall comply with and maintain these high safety standards and provide full compliance with all applicable safety regulations and standards. The Contractor shall maintain, monitor, and enforce employee compliance with all applicable rules, regulations, and codes.

Tobyhanna Army Depot requires full contractor compliance with all safety regulations and standards. The Contractor is responsible for maintaining, monitoring, and enforcing all rules, regulations, and codes, by ALL personnel working for the contractor including all subcontractors. These codes include:

Title 29 Code of Federal Regulations-1910 (OSHA General Industry Standards)

Title 29 Code of Federal Regulations-1926 (Construction Industry Standards)

National Fire Protection Association Codes

Uniform Facilities Code

Unified Facilities Guide Specifications (UFGS)

USACE EM385-1-1

All other codes as required to maintain safety standards.

S3.0 JOB HAZARD ANALYSIS (JHA) / ACTIVITY HAZARD ANALYSIS

(AHA)

Prior to the start of work, the contractor shall prepare a JHA / AHA for each phase of work that will be done under the contract. This will be completed in accordance with all applicable OSHA safety requirements. A phase is any operations involving a certain type of work. Examples include demolition, excavation, masonry work, concrete pouring, roofing, and electrical wiring. Work done by each subcontractor is also a phase. The JHA / AHA will:

1. List the activity being performed and identify the sequence of work steps.

2. List the hazards associated with each step, and the procedures and training required to eliminate or reduce the risk to an acceptable level.

S4.0 SITE SPECIFIC SAFETY & ACCIDENT PREVENTION PLANS

Contractors will submit a written Site-Specific Safety / Contractor Accident Prevention Plan prior to beginning activities. The plan must follow the guidelines in OSHA 29 CFR 1926 or 1910 as applicable.

1. Who will implement the plan, including who is responsible for safety and accident prevention?

2. A means for coordinating and controlling subcontractors and suppliers.

3. Safety training.

4. Who will investigate accidents?

5. Emergency response.

6. Job site cleanup and safe access.

7. Public safety requirements such as signs and barricades.

S5.0 FALL PROTECTION

1. Personnel performing works at a height of six feet or more from any lower level shall comply with OSHA 29 CFR 1926.500 through 1926.503 safety standards for any type of new installations. OSHA 29 CFR 1910-28 shall apply to any type of servicing on previously installed equipment.

2. There are currently no certified anchorage points or permanent guardrail systems on any TYAD roof. Most roofs of the depot are more than 20 feet high.

3. Contractors and their employees must be protected from falling off the edge of the roof, regardless of how briefly the employees are at the edge of the roof.

S6.0 ELECTRICAL SAFETY

Follow the current Tobyhanna Army Depot standard. This standard is based on NFPA 70E.

Copies of the TYAD Electrical standard may be obtained by request from the ET, COR or KO on the project or service contract.

S7.0 DEPOT REQUIRED PERMITS / APPROVALS

Permits are required for:

1. Excavation: Contractors must utilize the PA 1 Call system and also coordinate with contracting officer representative (COR) for a TYAD dig permit for any excavations prior to any groundbreaking including digging, drilling and stake driving.

2. Trenching: Contractors will adhere to OSHA requirements and receive approval from

TYAD Safety office before any trenching deeper than 5 feet is performed.

Notifications of such activities will be provided to the COR along with required plans, requests and permits prior to any trenching works being performed. Contractor is responsible for field verifying all utilities and underground entities. Excavation or trench greater than 18 inches in depth that remains open greater than (1) day OR left unattended for any period of time shall have a safety orange construction fence installed around the perimeter of the opening. Caution tape or cones for this purpose is unacceptable.

3. Confined Space: All confined space works on TYAD are to be considered as permit required entries, (unless reclassified by the TYAD Safety office,) and Contractor must first request and be provided with an approved "signed" permit from TYAD Safety Office prior to any confined space entry. Contractor will refer to all OSHA requirements and must have a confined space plan and all appropriate safety equipment. Contractor is to request approval from TYAD Safety office through COR prior to entry.

4. Burning / fire: Hot work permits must be obtained daily from the Fire Department.

5. Cranes: For use of cranes and all WHE and LHE at TYAD see S.10.13

6. Army Radiation Permits: Non-Army agencies (including other military Services, vendors, and civilian contractors) require an Army Radiation Permit (ARP) to use, store, or possess ionizing radiation sources on TYAD (see 32 CFR 655). Non-Army applicants will apply by letter with supporting documentation to the Depot Commander.