Attachment J.3 Contractor Security Requirements FY26.pdf

Security Team Revisions to J.3 for TTP Sleeves

Controls must be appropriate, justified, and effective for the environment. Acceptable measures typically fall into several categories:

1. Administrative / Policy Measures

• Documented Information Security Policy

• Defined roles and responsibilities

• Security awareness and training for all personnel

• Acceptable use policies

• Procedures for onboarding/offboarding

• Physical access policies and badge control

2. Technical / System Controls

• Access control based on least privilege

• Multi factor authentication for systems

• Network segmentation

• Logging and monitoring of access and security events

• Encryption of sensitive data in transit and at rest

• Vulnerability management and patching

• Endpoint protection (antivirus, EDR)

3. Physical Security Measures

• Controlled facility access (badge systems, man‐traps, guard checks)

• Surveillance cameras with retention policies

• Secure storage for sensitive assets (locked cabinets, safes)

• Environmental controls (temperature, fire, water leak detection)

4. Risk Management & Operational Controls

• Periodic risk assessments

• Documented risk treatment plans

• Incident response planning and testing

• Business continuity and disaster recovery procedures

• Supplier/vendor security review processes

5. Audit & Continuous Improvement

• Internal & External audits of security processes

• Management reviews of the ISMS

• Corrective actions to address findings

• Evidence of monitoring and continual improvement

The following does not apply to this requirement:

• Requirement for a two‐person control of the product at all times during movement of the material.

•Requirement for armored, alarmed, GPS‐ capable vehicles and armed guard escorts.

• Requirement is not sensitive material at this point therefore, not required for pre‐employment screening requirements—including background checks, employment and education verification, credit history checks, NCIC checks, Interim Eligibility Authorization with least‐privilege, time‐ bound access, self‐reporting requirements, and sensitive information access/foreign travel—apply to contractor personnel who will not have access to a government facility.

J.3 Contractor Security Requirements V4.22.2026

1. Security Plan and Identification of Critical Assets

The contractor will identify and document all critical assets related to the performance of contract work, including:

Finished product(s) furnished by contract agreement Any raw materials or subcomponents identified as adding security value to the finished product, e.g., security features incorporated from sources outside the contractor’s production processes

Production waste material Design files, schematics, or specifications Customer information Training or informational materials furnished to the customer describing security features or the application or interpretation of security features included in the product Communication of design criteria between the contractor and the customer or other parties

The above list is not intended to be comprehensive; it is the contractor’s responsibility to provide documentation of critical assets and the measures taken to adequately protect them. This documentation must be presented in a Security Plan and is subject to validation by the GPO Supply Chain Risk Management Assessment & Intelligence Branch before contract award. The functional requirements to be addressed in the Security Plan are described in greater detail in the Functional Requirements below.

The contractor shall conduct a formal risk assessment (ISO 27005, OCTAVE, NIST SP 800-30 or equivalent) to identify all critical assets, document the methodology used, and ensure completeness and consistency in asset identification.

2. Compliance and Validation

Compliance with these security requirements is subject to validation by GPO’s Supply Chain Risk Management Assessment & Intelligence, which will conduct regular supply chain risk management (SCRM) assessments of all supplier sites involved in the design, manufacture, storage, and distribution of products furnished under this contract. SCRM assessments will also be conducted at sub-contractor sites, in keeping with the stated requirement to identify all security materials used in the development and their sources.

The contractor must ensure that all subcontractors and suppliers with access to security-relevant materials are subject to equivalent security requirements and must contractually transfer these obligations to them. Subcontractor risk assessments must be documented and made available upon request.

A pre-award assessment is required to validate the contractor’s security plan and the adequacy of security measures implemented to protect the identified critical assets. Approval of the contractor’s site(s) must be given before contract award; however, the pre-award assessment may be waived at the contracting officer’s discretion if the contractor’s location (s) have been subject to prior review by the Supply Chain Risk Management Assessment & Intelligence. No unresolved actions are pending from a previous assessment.

After the initial/pre-award assessment and the contract is awarded, the Supply Chain Risk Management Assessment & Intelligence will conduct regularly scheduled assessments of all relevant contractor sites. The frequency of reviews is based on the documented level of risk. The table below provides the scheduling framework.

Risk Rating Table

Linguistic Value Low Medium High Critical Numerical Rating 1 – 15 16 – 30 31 – 45 46 – 60

Primary Locations BCCM/COOP Locations & Secure Transport Locations

Frequency Criteria Frequency Criteria

< 12 Months Critical < 18 Months Critical 10 – 18 Months High 16 – 28 Months High 14 – 22 Months Medium 24 – 36 Months Medium 20 – 28 Months Low 32 – 48 Months Low

Secure Transportation Matrix – These assessments will take place whenever logistically possible to validate the safe transfer of GPO materials.

Any security plan changes must be reported to the Supply Chain Risk Management Assessment & Intelligence, which may affect the assessment timeline. Significant changes, such as renovation or relocation, require advance notice and approval.

3. Functional Requirements for Security

These requirements must be addressed in the Security Plan and demonstrated during the regular security assessments. All of the eight areas listed below must be addressed.

I. Security Management

An individual within the company is the central point of contact and is responsible for overseeing and managing security systems, policies, procedures, and activities.

All security roles within the organization are defined and documented.

Written policies and procedures are maintained within a Security Plan specific to the product supplied under this contract, addressing the identification of critical assets and security measures implemented to adequately protect those assets during production, storage, and transportation.

The company has established a relationship with local law enforcement and emergency services and can validate response times to emergencies at the facility.

Policies and procedures exist for recovery after a security incident or emergency, including guidance for material accountability, business resumption, and customer notification.

Facility Physical Security

These requirements must be addressed for any facilities employed in the design, manufacturing, and storage of the supplied product.

Adequate intrusion detection and prevention measures are used throughout the facility.

A surveillance system is utilized for monitoring and recording activities inside and outside the facility at all times, particularly in areas where secure materials are produced, handled, and stored

An access control system is utilized, which is capable of restricting access to the facility and providing access to secure areas on an individual, personalized basis

There is a security center within or outside the facility used as a central point for managing, controlling, and auditing all security systems and associated activities

Intrusion Detection System (IDS)—The contractor will maintain an effective security system for the product covered by these specifications, including where it is manufactured and stored (awaiting shipment or disposal), to prevent theft and ensure it does not fall into unauthorized hands.

An IDS will detect an unauthorized penetration into the secured area. An IDS will be installed when documented risk assessment results determine that its use as a supplemental control is warranted. When used, all areas that reasonably afford access to the secured areas shall be protected by IDS, unless they are continually occupied. IDS will be monitored 24/7 (365), with the ability to immediately assess alarms and initiate a guard force and police response.

Closed-Circuit Television (CCTV) will be used to ensure the protection of product material while being manufactured and stored. CCTV video data will be maintained 24/7 (365) and backed up for at least 30 days afterward.

Access Controls – The perimeter entrance to a secure area will always be controlled to prevent unauthorized entry. An automated entry control system may achieve this. Uncleared persons are to be escorted within the facility by a cleared person familiar with the facility's security procedures.

Personnel entering or leaving an area must secure the entrance or exit point. Authorized personnel who permit another individual to enter the site are responsible for confirming the need to know and the required access.

Guard Force – The contractor must provide a guard force commensurate with the GPO criticality rating assigned to the product material manufactured or stored on site.

NOTE: The armed guard force requirement may be modified to ensure compliance with local/country laws or based on Supply Chain Risk Management Assessment(s) and site operations.

II. Personnel Security

All personnel working under this contract or on GPO programs or accessing sensitive information about those programs must have undergone adequate pre-employment screening, including background checks, employment, education verification, and credit history checks.

Depending upon the nature of the work performed, some employees and officers of the company may be required to undergo background screening by the U.S. government.

Adequate security training is performed during onboarding and regularly for all current employees.

Policies and procedures for personnel to self-report any changes in information relating to their background check.

Policies and procedures exist for dismissal and termination, removing access to secure areas, systems, and materials.

Policies and procedures exist for escorted visitor access.

All employees are provided with identification, which allows them to be recognized as authorized individuals, both visually and by the access control system.

Procedures exist for authorizing access to restricted areas, including an approval and notification process.

Interim Eligibility General Rule: Personnel will not be granted access to Sensitive Information, Restricted

Areas, or Government/Company systems used to process Government information until required screening and any applicable Government Background Screening are completed and eligibility is confirmed, unless Interim Eligibility is explicitly authorized.

Interim Eligibility Authorization: Interim Eligibility may be granted only when:

o The Government (or its designated authority) provides written authorization or direction permitting interim work status and defining any limitations; and o The Company Security Officer documents a risk-based determination that interim access is necessary for mission needs and can be appropriately limited and monitored.

Scope and Limitations: When Interim Eligibility is authorized, the Company will:

o Limit access to the minimum necessary (least privilege and need-to-know) o Restrict access to specific systems, data sets, and/or areas as defined by the

Government and Company Security Officer o Implement enhanced monitoring and supervision, as appropriate o Prohibit access to any categories explicitly disallowed by the Government

Time-Bound and Revocable: Interim Eligibility will be time-limited, reviewed at defined intervals, and may be revoked immediately upon:

o Government direction o Adverse information, including issues identified during screening o Noncompliance with security requirements

National Crime Information Center (NCIC) / Expedited Checks (If Applicable):

Where permitted and performed by authorized Government entities, an NCIC query or similar expedited check may support preliminary risk decisions. NCIC checks will not replace required background investigations or adjudications and will not, in and of themselves, authorize access absent the written Interim Eligibility authorization described above.

Interim Denial Handling: If the Government issues an interim denial or identifies concerns during screening, the Company will:

o Immediately implement Government-directed restrictions (including removal from duties/access if required) o Coordinate promptly with the Government and the affected Personnel to resolve outstanding issues o Maintain documentation of actions taken and final disposition

Insider Threat:

Employees must report any of the following instances that occur to their supervisor and security:

Examples of Reportable Events or Behaviors

The following is not intended to be an exhaustive list. When in doubt, report an event or behavior.

Recruitment

Report events or behaviors, including, but not limited to:

Requests for sensitive or unclassified information outside official channels Engaging in illegal activity or a request to do so

Information Collection/Transmittal

Report events or behaviors, including, but not limited to:

Attempts to access sensitive, classified, or protected information without authorization Use of unauthorized recording/transmitting devices in sensitive areas Unauthorized storage, removal, or access to sensitive, classified, or unclassified information Discussions involving sensitive or classified information over a non-secure means

Suspicious Behavior

Report behavior, including, but not limited to:

Attempts to expand access to sensitive information beyond the typical responsibilities Sudden reversal of financial situation or sudden repayment of large debts Attempts to entice or place personnel into compromising situations Travel that appears unusual or inconsistent with a person’s interests or financial means Making statements expressing support for or sympathy for a terrorist or hate group Expressing radical or threatening statements of violence in the workplace

Legal Issues:

Employees must report any of the following instances that occur to their supervisor and security:

Are arrested; subject to criminal charges (including charges that are dismissed); receive citations, tickets, or summonses; or are detained by federal, state, or other law-enforcement authorities for violations of the law within or outside of the U.S. (NOTE: Traffic citations/tickets/fines are reportable if they exceed $300 and only when the fine is assessed unless drugs or alcohol were involved. Court fees or other administrative costs associated with the traffic citation/ticket/fine should not be added to the final assessed amount.);

File for bankruptcy, regardless of whether it is for personal or business-related reasons;

Have your wages garnished for any reason;

Have your home foreclosed upon;

Are named defendants in any civil lawsuit, Citizenship Issues;

Change citizenship or acquire dual citizenship. Life Circumstances;

Have legal action resulting in a name change. Marry or cohabitate with a person (NOTE:

A cohabitant is a person who lives with you in a spouse-like relationship or with a similar bond of affection or obligation but is not your legal spouse, child, or another relative.)

They are hospitalized for mental health reasons.

Are treated for drug or alcohol abuse;

Use an illegal drug or a legal drug in a manner that deviates from approved medical direction;

Self-report any situations where you receive a large amount of cash (e.g., inheritance, gambling winnings, etc.).

Sensitive Information Access / Foreign Travel: (Not Applicable for non-U.S. company employees)

Contact with an individual associated with a foreign intelligence, security, or terrorist organization Offers of financial assistance by a foreign national other than close family members

Have business-related travel to a sensitive or non-sensitive country (Use common sense as to what constitutes a “sensitive country” and consult internal agency publications.);

Have substantive contact with any foreign national not related to you and previously self-reported;

Are employed by, represent, or have other business-related associations with a foreign or foreign-owned interest or with a non-U.S. citizen or another individual who is both a U.S.

citizen and a citizen of a foreign country;

Have an immediate family member who assumes residence in a sensitive country, and when that living situation changes, e.g., your family member returns to the U.S. or moves to another country, keen or non-sensitive;

Undertake a foreign adoption or propose to host a foreign exchange student.

III. Operations Security

Policies and procedures exist for handling sensitive documents, data, and information, including classification, control, and destruction

Policies and procedures exist about information disclosure, including publicly available information on company activities

Disclosure of activities under this contract or about any other GPO program publicly or privately to a third party is prohibited without prior consent

Screening of incoming and outgoing communications for sensitive data may be required Regularly scheduled security awareness training is conducted for employees, detailing the policies and procedures for operations security

IV. IT Security

Intrusion prevention measures are employed to prevent access from the Internet to the company's internal network

Encryption of sensitive data at rest and in transit must meet or exceed FIPS 140-2 validated cryptographic standards (e.g., AES-256).

Vulnerability assessments must be conducted at least semi-annually for high-risk environments, and at least annually for all others

Internal network controls are provided to segregate common resources from secure, restricted resources used to design and produce materials under this contract

Remote access to the company network is encrypted and secured via IPSec or other accepted technology, and direct remote access to the secure network segment is disallowed

Encryption is employed for data deemed sensitive to GPO programs while at rest in production or data storage systems

Encryption is used for data in transit when such data is considered sensitive, e.g., design files or shipment details sent via email or another transmission method

Vulnerability assessment and testing are performed regularly and do not exceed annually Backups of critical systems are performed regularly and adequately safeguarded Change management policies and procedures are implemented Audit documentation will be required for submission as required Note: FedRAMP certification is highly desirable

V. Material Security

All secure materials are stored in dedicated, separate storage areas with access limited to a small number of authorized employees Critical production activities are performed only by authorized employees in secure, access-controlled areas

Movement and handling of materials are always performed strictly under two-person control.

o If two-person control is impossible due to operational constraints, compensating controls (such as continuous video monitoring or real-time logging) must be implemented and documented.

Material outside of dedicated storage areas is always under two-person control.

Materials are accounted for by physical or other means during all phases of production and storage, and this accounting method is audited and reconciled throughout the production process to final shipment.

Materials produced under this contract are adequately segregated, secured, and accounted for, including waste material.

Waste material is identified and disposed of in a manner adequate to ensure its destruction, rendering it useless for identification, re-use, or reverse engineering purposes.

An inventory control system ensures accountability of products and all materials used in manufacturing.

VI. Shipping and Receiving

All incoming shipments of security materials are inspected and verified before acceptance, and any discrepancies are reported to the shipper and supplier.

All outgoing shipments are inspected and verified before loading.

A manifest is produced for all shipments, validated at outgoing inspection, and transmitted to the customer according to an accepted procedure.

A secure chain-of-custody log must be maintained for all shipments, including signatures and timestamps for all handoffs/transfers.

The contractor must ensure that all secure carriers maintain insurance coverage meeting or exceeding the requirements for the material being shipped Procedures exist for customer notification of pending shipments, including scheduled delivery time and secure shipment details, such as carrier, drivers, and seal numbers.

All shipments are delivered via an accepted secure shipper.

Shipments are packaged in plain outer packaging, with no external indication of the contents. Internal packaging must have tamper-evident seal closures (when possible).

The security plan must document shipping methods, including subcontractors/suppliers of identified security raw materials and subcomponents.

Track and trace are employed on all secure shipments.

VII. Secure Carrier—Transportation of Materials between Specified Site Locations

Exclusive use of the vehicle will be required for the transport of all materials referenced in these specifications o All deliveries must be transported in appropriately sized, high-security, armored, alarmed, padlocked, and sealed vehicles o GPS capability to monitor vehicle location o Delivery of finished units will require a vehicle cab separate from the vehicle body.

o An armed driver and one-armed guard escort will be required to transport all materials All guards must have a current local/state/national-issued driver’s license, be in uniform, be trained in firearm safety, have existing weapon qualifications, and must carry a photo identification card issued by the secured carrier. At least one (1) guard of two (2) must remain with the material at all times

In an emergency, the guards must communicate with the local law enforcement department and their dispatcher(s). The guards must frequently communicate with the dispatcher throughout all trips

The driver is to be aware of all outside activity and must notify the dispatcher in the event of any incident

NOTE: The carrier must be bonded and insured. It must maintain storage, transfer, and accountability logs to support an audit trail for any particular delivery. It must conduct credit report checks to determine guards' financial status. It must also check prior employment, former addresses, prior arrests, convictions, and the fingerprints of guards with authority deemed appropriate by the government.

Business Continuity and Crisis Management (BC/CM)

Business Continuity may be addressed in a separate document but referenced in the Security Plan, and managing the following requirements:

The contractor will test and update the Business Continuity and Crisis Management Plan at least annually or after any significant event or operational change.

Identification of the most significant risks to business continuity at the production site(s) A plan for continuing consistent and timely delivery of ordered materials adequate to compensate for any foreseeable impact generated by the identified risks A plan for recovery of business functions during a prolonged outage, with an estimated timeline.

Identify redundant/alternate facilities to address facility and equipment loss.