J.3 Contractor Security Requirements V4.22.2026

1. Security Plan and Identification of Critical Assets

The contractor will identify and document all critical assets related to the performance of contract work, including:

Finished product(s) furnished by contract agreement Any raw materials or subcomponents identified as adding security value to the finished product, e.g., security features incorporated from sources outside the contractor’s production processes

Production waste material Design files, schematics, or specifications Customer information Training or informational materials furnished to the customer describing security features or the application or interpretation of security features included in the product Communication of design criteria between the contractor and the customer or other parties

The above list is not intended to be comprehensive; it is the contractor’s responsibility to provide documentation of critical assets and the measures taken to adequately protect them. This documentation must be presented in a Security Plan and is subject to validation by the GPO Supply Chain Risk Management Assessment & Intelligence Branch before contract award. The functional requirements to be addressed in the Security Plan are described in greater detail in the Functional Requirements below.

The contractor shall conduct a formal risk assessment (ISO 27005, OCTAVE, NIST SP 800-30 or equivalent) to identify all critical assets, document the methodology used, and ensure completeness and consistency in asset identification.

2. Compliance and Validation

Compliance with these security requirements is subject to validation by GPO’s Supply Chain Risk Management Assessment & Intelligence, which will conduct regular supply chain risk management (SCRM) assessments of all supplier sites involved in the design, manufacture, storage, and distribution of products furnished under this contract. SCRM assessments will also be conducted at sub-contractor sites, in keeping with the stated requirement to identify all security materials used in the development and their sources.

The contractor must ensure that all subcontractors and suppliers with access to security-relevant materials are subject to equivalent security requirements and must contractually transfer these obligations to them. Subcontractor risk assessments must be documented and made available upon request.

A pre-award assessment is required to validate the contractor’s security plan and the adequacy of security measures implemented to protect the identified critical assets. Approval of the contractor’s site(s) must be given before contract award; however, the pre-award assessment may be waived at the contracting officer’s discretion if the contractor’s location (s) have been subject to prior review by the Supply Chain Risk Management Assessment & Intelligence. No unresolved actions are pending from a previous assessment.

After the initial/pre-award assessment and the contract is awarded, the Supply Chain Risk Management Assessment & Intelligence will conduct regularly scheduled assessments of all relevant contractor sites. The frequency of reviews is based on the documented level of risk. The table below provides the scheduling framework.

Risk Rating Table Linguistic Value Low Medium High Critical Numerical Rating 1 – 15 16 – 30 31 – 45 46 – 60

Primary Locations BCCM/COOP Locations & Secure Transport Locations

Frequency Criteria Frequency Criteria

< 12 Months Critical < 18 Months Critical 10 – 18 Months High 16 – 28 Months High 14 – 22 Months Medium 24 – 36 Months Medium 20 – 28 Months Low 32 – 48 Months Low

Secure Transportation Matrix – These assessments will take place whenever logistically possible to validate the safe transfer of GPO materials.

Any security plan changes must be reported to the Supply Chain Risk Management Assessment & Intelligence, which may affect the assessment timeline. Significant changes, such as renovation or relocation, require advance notice and approval.

3. Functional Requirements for Security

These requirements must be addressed in the Security Plan and demonstrated during the regular security assessments. All of the eight areas listed below must be addressed.

I. Security Management

An individual within the company is the central point of contact and is responsible for overseeing and managing security systems, policies, procedures, and activities.

All security roles within the organization are defined and documented.

Written policies and procedures are maintained within a Security Plan specific to the product supplied under this contract, addressing the identification of critical assets and security measures implemented to adequately protect those assets during production, storage, and transportation.

The company has established a relationship with local law enforcement and emergency services and can validate response times to emergencies at the facility.

Policies and procedures exist for recovery after a security incident or emergency, including guidance for material accountability, business resumption, and customer notification.

Facility Physical Security

These requirements must be addressed for any facilities employed in the design, manufacturing, and storage of the supplied product.

Adequate intrusion detection and prevention measures are used throughout the facility.

A surveillance system is utilized for monitoring and recording activities inside and outside the facility at all times, particularly in areas where secure materials are produced, handled, and stored

An access control system is utilized, which is capable of restricting access to the facility and providing access to secure areas on an individual, personalized basis

There is a security center within or outside the facility used as a central point for managing, controlling, and auditing all security systems and associated activities

Intrusion Detection System (IDS)—The contractor will maintain an effective security system for the product covered by these specifications, including where it is manufactured and stored (awaiting shipment or disposal), to prevent theft and ensure it does not fall into unauthorized hands.

An IDS will detect an unauthorized penetration into the secured area. An IDS will be installed when documented risk assessment results determine that its use as a supplemental control is warranted. When used, all areas that reasonably afford access to the secured areas shall be protected by IDS, unless they are continually occupied. IDS will be monitored 24/7 (365), with the ability to immediately assess alarms and initiate a guard force and police response.

Closed-Circuit Television (CCTV) will be used to ensure the protection of product material while being manufactured and stored. CCTV video data will be maintained 24/7 (365) and backed up for at least 30 days afterward.

Access Controls – The perimeter entrance to a secure area will always be controlled to prevent unauthorized entry. An automated entry control system may achieve this. Uncleared persons are to be escorted within the facility by a cleared person familiar with the facility's security procedures.

Personnel entering or leaving an area must secure the entrance or exit point. Authorized personnel who permit another individual to enter the site are responsible for confirming the need to know and the required access.

Guard Force – The contractor must provide a guard force commensurate with the GPO criticality rating assigned to the product material manufactured or stored on site.

NOTE: The armed guard force requirement may be modified to ensure compliance with local/country laws or based on Supply Chain Risk Management Assessment(s) and site operations.

II. Personnel Security

All personnel working under this contract or on GPO programs or accessing sensitive information about those programs must have undergone adequate pre-employment screening, including background checks, employment, education verification, and credit history checks.

Depending upon the nature of the work performed, some employees and officers of the company may be required to undergo background screening by the U.S. government.

Adequate security training is performed during onboarding and regularly for all current employees.

Policies and procedures for personnel to self-report any changes in information relating to their background check.

Policies and procedures exist for dismissal and termination, removing access to secure areas, systems, and materials.

Policies and procedures exist for escorted visitor access.

All employees are provided with identification, which allows them to be recognized as authorized individuals, both visually and by the access control system.

Procedures exist for authorizing access to restricted areas, including an approval and notification process.

Interim Eligibility

General Rule: Personnel will not be granted access to Sensitive Information, Restricted Areas, or Government/Company systems used to process Government information until required screening and any applicable Government Background Screening are completed and eligibility is confirmed, unless Interim Eligibility is explicitly authorized.

Interim Eligibility Authorization: Interim Eligibility may be granted only when:

o The Government (or its designated authority) provides written authorization or direction permitting interim work status and defining any limitations; and o The Company Security Officer documents a risk-based determination that interim access is necessary for mission needs and can be appropriately limited and monitored.

Scope and Limitations: When Interim Eligibility is authorized, the Company will:

o Limit access to the minimum necessary (least privilege and need-to-know) o Restrict access to specific systems, data sets, and/or areas as defined by the

Government and Company Security Officer o Implement enhanced monitoring and supervision, as appropriate o Prohibit access to any categories explicitly disallowed by the Government

Time-Bound and Revocable: Interim Eligibility will be time-limited, reviewed at defined intervals, and may be revoked immediately upon:

o Government direction o Adverse information, including issues identified during screening o Noncompliance with security requirements

National Crime Information Center (NCIC) / Expedited Checks (If Applicable):

Where permitted and performed by authorized Government entities, an NCIC query or similar expedited check may support preliminary risk decisions. NCIC checks will not replace required background investigations or adjudications and will not, in and of themselves, authorize access absent the written Interim Eligibility authorization described above.

Interim Denial Handling: If the Government issues an interim denial or identifies concerns during screening, the Company will:

o Immediately implement Government-directed restrictions (including removal from duties/access if required) o Coordinate promptly with the Government and the affected Personnel to resolve outstanding issues o Maintain documentation of actions taken and final disposition

Insider Threat:

Employees must report any of the following instances that occur to their supervisor and security:

Examples of Reportable Events or Behaviors

The following is not intended to be an exhaustive list. When in doubt, report an event or behavior.

Recruitment

Report events or behaviors, including, but not limited to:

Requests for sensitive or unclassified information outside official channels Engaging in illegal activity or a request to do so

Information Collection/Transmittal

Report events or behaviors, including, but not limited to:

Attempts to access sensitive, classified, or protected information without authorization Use of unauthorized recording/transmitting devices in sensitive areas Unauthorized storage, removal, or access to sensitive, classified, or unclassified information Discussions involving sensitive or classified information over a non-secure means

Suspicious Behavior

Report behavior, including, but not limited to:

Attempts to expand access to sensitive information beyond the typical responsibilities Sudden reversal of financial situation or sudden repayment of large debts Attempts to entice or place personnel into compromising situations Travel that appears unusual or inconsistent with a person’s interests or financial means Making statements expressing support for or sympathy for a terrorist or hate group Expressing radical or threatening statements of violence in the workplace

Legal Issues:

Employees must report any of the following instances that occur to their supervisor and security:

Are arrested; subject to criminal charges (including charges that are dismissed); receive citations, tickets, or summonses; or are detained by federal, state, or other law-enforcement authorities for violations of the law within or outside of the U.S. (NOTE: Traffic citations/tickets/fines are reportable if they exceed $300 and only when the fine is assessed unless drugs or alcohol were involved. Court fees or other administrative costs associated with the traffic citation/ticket/fine should not be added to the final assessed amount.);

File for bankruptcy, regardless of whether it is for personal or business-related reasons;

Have your wages garnished for any reason;

Have your home foreclosed upon;

Are named defendants in any civil lawsuit, Citizenship Issues;

Change citizenship or acquire dual citizenship. Life Circumstances;

Have legal action resulting in a name change. Marry or cohabitate with a person (NOTE:

A cohabitant is a person who lives with you in a spouse-like relationship or with a similar bond of affection or obligation but is not your legal spouse, child, or another relative.)

They are hospitalized for mental health reasons.

Are treated for drug or alcohol abuse;

Use an illegal drug or a legal drug in a manner that deviates from approved medical direction;

Self-report any situations where you receive a large amount of cash (e.g., inheritance, gambling winnings, etc.).

Sensitive Information Access / Foreign Travel: (Not Applicable for non-U.S. company employees)

Contact with an individual associated with a foreign intelligence, security, or terrorist organization

Offers of financial assistance by a foreign national other than close family members

Have business-related travel to a sensitive or non-sensitive country (Use common sense as to what constitutes a “sensitive country” and consult internal agency publications.);

Have substantive contact with any foreign national not related to you and previously self-reported;

Are employed by, represent, or have other business-related associations with a foreign or foreign-owned interest or with a non-U.S. citizen or another individual who is both a U.S.

citizen and a citizen of a foreign country;

Have an immediate family member who assumes residence in a sensitive country, and when that living situation changes, e.g., your family member returns to the U.S. or moves to another country, keen or non-sensitive;

Undertake a foreign adoption or propose to host a foreign exchange student.

III. Operations Security

Policies and procedures exist for handling sensitive documents, data, and information, including classification, control, and destruction

Policies and procedures exist about information disclosure, including publicly available information on company activities

Disclosure of activities under this contract or about any other GPO program publicly or privately to a third party is prohibited without prior consent

Screening of incoming and outgoing communications for sensitive data may be required Regularly scheduled security awareness training is conducted for employees, detailing the policies and procedures for operations security

IV. IT Security

Intrusion prevention measures are employed to prevent access from the Internet to the company's internal network

Encryption of sensitive data at rest and in transit must meet or exceed FIPS 140-2 validated cryptographic standards (e.g., AES-256).

Vulnerability assessments must be conducted at least semi-annually for high-risk environments, and at least annually for all others

Internal network controls are provided to segregate common resources from secure, restricted resources used to design and produce materials under this contract

Remote access to the company network is encrypted and secured via IPSec or other accepted technology, and direct remote access to the secure network segment is disallowed

Encryption is employed for data deemed sensitive to GPO programs while at rest in production or data storage systems

Encryption is used for data in transit when such data is considered sensitive, e.g., design files or shipment details sent via email or another transmission method

Vulnerability assessment and testing are performed regularly and do not exceed annually Backups of critical systems are performed regularly and adequately safeguarded Change management policies and procedures are implemented Audit documentation will be required for submission as required Note: FedRAMP certification is highly desirable

V. Material Security

All secure materials are stored in dedicated, separate storage areas with access limited to a small number of authorized employees

Critical production activities are performed only by authorized employees in secure, access-controlled areas

Movement and handling of materials are always performed strictly under two-person control.

o If two-person control is impossible due to operational constraints, compensating controls (such as continuous video monitoring or real-time logging) must be implemented and documented.

Material outside of dedicated storage areas is always under two-person control.

Materials are accounted for by physical or other means during all phases of production and storage, and this accounting method is audited and reconciled throughout the production process to final shipment.

Materials produced under this contract are adequately segregated, secured, and accounted for, including waste material.

Waste material is identified and disposed of in a manner adequate to ensure its destruction, rendering it useless for identification, re-use, or reverse engineering purposes.

An inventory control system ensures accountability of products and all materials used in manufacturing.

VI. Shipping and Receiving

All incoming shipments of security materials are inspected and verified before acceptance, and any discrepancies are reported to the shipper and supplier.

All outgoing shipments are inspected and verified before loading.

A manifest is produced for all shipments, validated at outgoing inspection, and transmitted to the customer according to an accepted procedure.

A secure chain-of-custody log must be maintained for all shipments, including signatures and timestamps for all handoffs/transfers.

The contractor must ensure that all secure carriers maintain insurance coverage meeting or exceeding the requirements for the material being shipped Procedures exist for customer notification of pending shipments, including scheduled delivery time and secure shipment details, such as carrier, drivers, and seal numbers.

All shipments are delivered via an accepted secure shipper.

Shipments are packaged in plain outer packaging, with no external indication of the contents. Internal packaging must have tamper-evident seal closures (when possible).

The security plan must document shipping methods, including subcontractors/suppliers of identified security raw materials and subcomponents.

Track and trace are employed on all secure shipments.

VII. Secure Carrier—Transportation of Materials between Specified Site Locations

Exclusive use of the vehicle will be required for the transport of all materials referenced in these specifications o All deliveries must be transported in appropriately sized, high-security, armored, alarmed, padlocked, and sealed vehicles o GPS capability to monitor vehicle location o Delivery of finished units will require a vehicle cab separate from the vehicle body.

o An armed driver and one-armed guard escort will be required to transport all materials All guards must have a current local/state/national-issued driver’s license, be in uniform, be trained in firearm safety, have existing weapon qualifications, and must carry a photo identification card issued by the secured carrier. At least one (1) guard of two (2) must remain with the material at all times

In an emergency, the guards must communicate with the local law enforcement department and their dispatcher(s). The guards must frequently communicate with the dispatcher throughout all trips

The driver is to be aware of all outside activity and must notify the dispatcher in the event of any incident

NOTE: The carrier must be bonded and insured. It must maintain storage, transfer, and accountability logs to support an audit trail for any particular delivery. It must conduct credit report checks to determine guards' financial status. It must also check prior employment, former addresses, prior arrests, convictions, and the fingerprints of guards with authority deemed appropriate by the government.

Note 2: The COR will determine the specificity between “Shipping and Receiving” and “Secure Carrier” as required and remove unnecessary language.

Business Continuity and Crisis Management (BC/CM)

Business Continuity may be addressed in a separate document but referenced in the Security Plan, and managing the following requirements:

The contractor will test and update the Business Continuity and Crisis Management Plan at least annually or after any significant event or operational change.

Identification of the most significant risks to business continuity at the production site(s) A plan for continuing consistent and timely delivery of ordered materials adequate to compensate for any foreseeable impact generated by the identified risks A plan for recovery of business functions during a prolonged outage, with an estimated timeline.

Identify redundant/alternate facilities to address facility and equipment loss.

Supply Chain Risk Management Questionnaire

PLEASE COMPLETE IN DETAIL

Vendor:

Location:

Describe how this facility supports (Product/R&D/etc.) GPO:

Number of Staff/Employees at this location & number per shifts if applicable:

Security Plan

1. Is there an established security plan for review?

2. Does the security plan document all critical assets and/or asset classes?

3. Are each protective measure explained for each critical asset?

4. Are all critical sub-contractors or suppliers identified?

5. Does the security plan address the eight areas defined in Contract Security

Requirements part 3, Functional Requirements for Security?

1. Security Management

2. Facility Physical Security

3. Personnel Security

4. Operations Security

5. IT Security

6. Material Security

7. Shipping and Receiving

8. Business Continuity and Disaster Recovery

6. Explain any security plan procedures at your facility that you feel were not addressed above.

Certifications Identify all certifications, i.e. NASPO, ISO etc. (if applicable) Security Management

1. Is there an individual or group who serves as the central point of contact and responsibility for oversight and management of security systems, policies, procedures, and activities?

2. Are all security roles within the organization defined and documented?

Does the company have an established audit/assessment process/procedure to document the security program? If so, how often?

2a Date of last review:

3. Does the company have an established process/procedure to document and track security discrepancies/deficiencies & corrective actions?

4. Does the company have an established relationship with local law enforcement and emergency services?

4a. Name of local department/agency?

5. Have response times to emergencies at the facility been validated and documented?

5a Documentation of last response emergency response actual or validation:

6. Do policies and procedures exist for recovery after a security incident or emergency?

6a Date of last review:

7. Do the policies and procedures address material accountability, business resumption, and customer notification?

8. Explain any security management procedures at your facility that you feel were not

Physical Security

1. Are adequate intrusion detection and prevention measures are used throughout the facility?

Explain.

2. Is a surveillance system is utilized for monitoring and recording activities inside and outside the facility at all times, particularly in areas where secure materials are produced, handled, and stored?

Explain surveillance system capabilities (digital, infrared, and storage length), if no system describe procedures.

3. Is there a security center within or outside the facility used as a central point for managing, controlling, and auditing all security systems and associated activities?

4. Does your facility utilize armed or unarmed security personnel?

Describe security personnel, coverage and hours of operation.

5. Describe your facility perimeter (wall, fencing, fully enclosed, open, type of materials used and height).

6. Does your facility have barriers and locks on doors, windows and gates sufficient to meet threats?

7. Are the doors kept locked at all times to prevent unauthorized personnel from entering?

8. Do you have bars, screens, or other materials over the windows?

9. Do you have an intrusion detection system?

If yes, describe who is monitoring the alarm and where the alarms enunciate.

10. Is your facility exterior lighted/illuminated at night?

If yes, describe what areas are illuminated.

11. Is the shipping/receiving area secure at all times to prevent access by unauthorized personnel?

If yes, describe what physical barriers are used and what personnel is allowed access. If no, what is the process to deny unauthorized access?

12. Are door hinges on the interior of the area, if not are they pinned or tap welded?

13. Are outgoing shipments stored in a separate area that is secure and prevents unauthorized access?

If yes, describe where the shipments are stored and who has access to them. If no, what is the process to deny unauthorized access?

14. Describe any aspects of physical security at your facility that you feel were not

Access Control

1. Is an access control system utilized which is capable of restricting access to the facility and providing access to secure areas on an individual, personalized basis?

2. Do you use an employee badge system for entry and monitoring onsite activities?

3. Is vehicle access into your facility controlled?

If yes, describe how vehicle access is controlled and what vehicles are allowed access. Are there processes & procedures in place denying phone & camera usage? If no, what is the process to deny unauthorized access?

4. Are vehicles and drivers screened or inspected prior to entry to your facility?

Describe the method of screening (driver ID checks, vehicle inspections, etc.).

4a Are there requirements denying cell phones & cameras?

5. Do you identify, record, and track all visitors?

Explain what method or process used and how are the records kept?

5a Are visitors escorted?

6. Is a process in place to control, manage, and audit, badges and/or keys that are issued and turned in?

If yes, what method is used and how are the records kept?

7. Explain any access controls at your facility that you feel were not addressed above.

Personnel Security

1. Have all personnel working under this contract or on GPO programs or having access to sensitive information about those programs undergone adequate pre-employment screening, to include background checks, employment and education verification, and credit history checks?

2. Have key management personnel and other employees in sensitive positions been identified?

3. Have those personnel identified above completed government-mandated background checks?

4. Is adequate security training performed during the on-boarding process and at regular intervals for all current employees?

5. Do policies and procedures exist for dismissal and termination, for removing access to secure areas, systems, and materials?

6. Do policies and procedures exist for escorted visitor access?

7. Are all employees provided with identification allowing them to be recognized as authorized individuals, both visually and by the access control system?

8. Do procedures exist for authorizing access to restricted areas, including an approval and notification process?

9. Describe any personnel security procedures not addressed above.

Operations Security

1. Do policies and procedures exist for handling sensitive documents, data, and information, including classification, control, and destruction?

2. Do policies and procedures exist pertaining to information disclosure, including publicly available information on company activities?

3. Does company policy state that disclosure of activities under this contract or pertaining to any other GPO program publicly or privately to a third party are prohibited without prior consent?

4. Are incoming and outgoing communications screened for sensitive data?

5. Has a Critical Information List (CIL) been developed to prevent the divulgence of Intellectual Property, Trade Secrets and/or Special/Unique Projects?

6. Are employees aware of the CIL and how to protect the information?

Explain awareness process.

7. Describe any operations security procedures not addressed above.

Education and Training

1. Does your company provide a security awareness program related to protecting product integrity and facility security?

1a Describe what is covered in this training and awareness program.

1b How often training required? And, how is this documentation maintained?

2. Is your company certified in a supply chain security or known shipper/consignor program? (e.g., Partners in Protection (“PIP”) and Authorized Economic Operator (“AEO”), etc.)

3. Do you require cargo integrity training for persons working on behalf of the organization in the shipping and receiving areas and opening mail?

3a If yes, how often?

4. Describe any education and training procedures not addressed above.

IT Security

1. Are intrusion prevention measures employed to prevent access from the

Internet to the company's internal network?

1a Explain.

2. Are control measures used on the internal network to segregate common resources from secure, restricted resources used to design and/or produce materials under this contract?

2a Explain.

3. Is remote access to company network encrypted and secured via Internet Protocol Security or other accepted technology?

4. Is direct remote access to secure network segment disallowed by technical controls?

5. Is encryption employed for data deemed sensitive to GPO programs while at rest in production or data storage systems?

6. Is encryption used for data in transit when such data is considered sensitive, e.g. design files or shipment details sent via email or other transmission method?

7. How often are vulnerability assessments and testing performed?

7a Date of vulnerability assessments and testing performed:

7b If yes, is database results and corrective actions maintained for record? If not describe process.

8. How often are backup of critical systems performed and are they adequately safeguarded?

9. Are change management policies and procedures implemented?

10. Describe any education and training procedures not addressed above.

Material Security

1. Are all secure materials stored in dedicated, separate storage areas with access limited to a small number of authorized employees?

2. Are critical production activities performed only by authorized employees in secure, access-controlled areas?

3. Is movement and handling of materials is performed strictly under two-person control at all times?

4. Is material outside of dedicated storage areas is under two-person control at all times?

5. Are materials accounted for by physical or other means during all phases of production and storage?

Describe procedures.

6. Is this accounting method audited and reconciled throughout the production process to final shipment?

7. Are materials produced under this contract adequately segregated, secured, and accounted for, including waste material?

8. Is waste material identified and disposed of in a manner adequate to ensure its complete destruction, rendering it useless for purposes of identification, re-use, or reverse engineering?

9. Is an inventory control system utilized to ensure accountability of product and all materials used in manufacturing?

10. Describe any education and training procedures not addressed above.

Shipping and Receiving

1. Are all incoming shipments of security materials inspected and verified prior to acceptance, and any discrepancies are reported to the shipper and supplier?

2. Are all outgoing shipments inspected and verified prior to loading?

3. Is a manifest produced for all shipments, validated at outgoing inspection, and transmitted to the customer according to an accepted procedure?

4. Do procedures exist for customer notification of pending shipment, including anticipated delivery time and secure shipment details, e.g.

carrier, drivers, and seal numbers?

5. Are all shipments are delivered via an accepted secure shipper?

6. Are shipments packaged in plain outer packaging, with no external indication of the contents?

7. Does internal packaging have tamper-evident seal closures?

7a Describe the process to prevent shipment from being compromised.

8. Are shipping methods and routes documented in the security plan, including sub-contractors/suppliers of identified security raw materials and subcomponents?

9. Is track and trace employed on all secure shipments?

10. Describe any shipping and receiving procedures not addressed above.

Business Continuity/Crisis Management (BC/CM)

1. Is there Business Continuity/Crisis Management (BC/CM) plan?

2. Has the organization designated a BC/CM Leader/Manager?

3. Has management or staff been trained in communicating with internal and external stakeholders in time of crisis?

4. Does the BC/CM plan identify the greatest threats & risks to business continuity at the production site(s)?

Man-made (Crime, Terrorism, Cyber, CBRN) Natural (Severe Weather, Fires, Earthquakes, Flooding) Infectious Diseases (Influenza, SARS, COVID)

5. Does the BC/CM plan address continuing consistent and timely delivery of ordered materials adequate to compensate for any foreseeable impact generated by the identified risks?

6. Is Safety Stock required &/or maintained?

6a. If Safety Stock is required or maintained, how much & where is it located?

7. Explain timeline of delivery due to impact.

8. Does the organization test the BC/CM plan periodically at the business leadership level and all business sites, but no less than annually?

8a Date of test:

9.

In the event of a crisis, please describe the measure of time required to replace, repair or bypass damage or destruction: 1 – 3 months, 3 – 4 months, 5 – 6 months, or 6 or more months.

10. In the event of a crisis, please describe the measure of impact if product material were disrupted while targeted in an attempt to negate essential functions: Less than 1% of product or production impacted; 1-10%; 10- 25%; 25-50%; or greater than 50%

11. On a scale of 1 – 10 (1 being the least), what is the impact non-production will have on the economics of the surrounding community. Explain.

12. Describe business continuity/crisis management procedures not addressed above.

13. Location of designated Back-Up/Alternate facility if Primary facility is inoperable:

Address:

Secure Transportation

1. Are transportation personnel (Driver/Passenger) armed?

2. Number of personnel assigned to a secure transport shipment?

3. Are armored vehicles used for secure transport?

4. Explain methods of communication utilized?

5. Does vehicle or personnel and control center have GPS to track shipment?

6. Does the transport have a SOP?

7. List secure transport driver(s) training requirements?

8. Explain how and/or where products are stored and/or maintained if shipment has to stop, is delayed or cannot reach its destination?

9. Describe secure transportation procedures not addressed above.

10.

Mission, Symbolism, History, Accessibility, Recognizability, Population and Proximity

On a scale of 1 – 5 (1 being no effect and 5 being catastrophic)

1. The loss of this facility effect to fulfilling the production requirement?

On a scale of 1 – 5 (1 being no effect and 5 being catastrophic)

2. Does this facility have any symbolic reference to the nation/local government?

On a scale of 1 – 5 (1 not symbolic and 5 very symbolic)

3. Has the facility been attacked (criminal, cyber, or terrorist) recently?

On a scale of 1 – 5 (1 never and 5 recently and/or regularly)

4. Is the facility easily accessible?

On a scale of 1 – 5 (1 secure, with access control and 5 open to the public)

5. How long would it take recover operations if this facility was lost?

On a scale of 1 – 5 (1 less than a week and 5 more than a year)

6. If 20% of the workforce at this facility was unable to work due to casualties.

On a scale of 1 – 5 (1 being no effect and 5 being production would stop)

7. How many similar facilities are in close proximity to continue operations?

On a scale of 1 – 5 (1 being three or more facilities and 5 no other facility)

Total Question 1 – 7

Previous Recommendations – Please provide the status of the previous report recommendations

1.

2.

3.

4.

5.