B08 Attachment 3 Security Appendix to the SOW.pdf

Security and AT/OPSEC Appendix to the PWS, SOO, or SOW Requiring Activity:

Solicitation/Contract Number:

Section I. Security Appendix to the Performance Work Statement (PWS), Statement of Objectives (SOO), or Statement of Work

(SOW)

1. Security Requirements In the performance of this contract, the contractor will require a ______________ Facility Clearance Level (FCL) with

______________ safeguarding authorization. The contractor must have the appropriate FCL at the time of award. If sponsorship for a FCL is required, the contractor will work with the Contracting Officer’s Representative (COR) to obtain the appropriate justification for FCL sponsorship. The Defense Counterintelligence and Security Agency (DCSA) facilitates the FCL determination process and it is the responsibility of the contractor to work with the DCSA to obtain the appropriate clearance. KO approval is required for the flow down of security requirements to any subcontractor for DD Form 254 items 10a, 10b, 10c, 10e(1), 10e(2), 10f, and 10g. Safeguarding is limited to those facilities which hold the appropriate DCSA FCLs. The level of safeguarding must be commensurate with the level listed in item 1b of the DD Form 254 associated with this effort. Reference DD Form 254 for detailed information on the implementation and compliance of security requirements/guidance.

2. Actual Performance Locations The contractor will be required to access classified material at the following locations:

GOVERNMENT LOCATIONS

CONTRACTOR FACILITIES

NAME, ADDRESS, AND ZIP CODE CAGE CODE COGNIZANT SECURITY OFFICES (CSO)

(Name, Address, ZIP Code, Telephone)

20201001

Solicitation/Contract Number:

3. Contractor will require access to (all items checked “YES” will apply to this effort and all items checked “NO” are not applicable to this effort and requirements will not be levied against the contractor):

YES NO YES NO

Communications Security (COMSEC) Information Special Access Program (SAP) Information

Restricted Data North Atlantic Treaty Organization (NATO) Information

Critical Nuclear Weapon Design Information

(CNWDI)

Foreign Government Information (FGI)

Formerly Restricted Data Alternative Compensatory Control Measures

(ACCM)

Sensitive Compartmented Information (SCI) Controlled Unclassified Information (CUI)

Non-SCI NIPRNet

SIPRNet

JWICS

NSANet

4. In performing this contract, the contractor will (all items checked “YES” will apply to this effort and all items checked “NO” are not applicable to this effort and requirements will not be levied against the contractor):

YES NO YES NO

Have access to classified information only at another contractor’s facility or a government activity

Be authorized to use the services of Defense Technical Information Center (DTIC) or other secondary distribution center

Receive and store classified documents only Require a COMSEC account

Receive, store, and generate classified information or material

Have a TEMPEST requirement

Fabricate, modify, or store classified hardware Have Operations Security (OPSEC) Requirements

Perform services only Be authorized to use Defense Courier Service

Have access to U.S. classified information outside the U.S., Puerto Rico, U.S. Possessions and Trust Territories

Receive, store, or generate CUI

IT Sensitive Duties

Requiring Activity:

Solicitation/Contract Number:

5. The contractor will require access to the following Security Classification Guides (SCGs):

TITLE DATE FUNCTIONAL OFFICE OF PRIMARY RESPONSIBILITY

1. ARCYBER SCG FOR CYBERSPACE

OPERATIONS AND SECURITY

19 MAY 2016 U.S. ARMY CYBER COMMAND AND SECOND

ARMY, or most current SCG.

6. The contractor will require access to the following Operations Security (OPSEC) Plans:

TITLE DATE FUNCTIONAL OFFICE OF PRIMARY RESPONSIBILITY

7. Additional Remarks not already addressed in items 1 – 6 of this Security Appendix - Procedures for termination of contractor access or the reference of local and Army policy should be incorporated here.

Additional Remarks

Requiring Activity:

Solicitation/Contract Number:

Section II. Contract Requirements Package Antiterrorism/OPSEC/Security/Cybersecurity Review

Purpose of section: To document the review of the requirements package Performance Work Statement (PWS), Statement of Objectives (SOO), Statement of Work (SOW), quality assurance surveillance plan (QASP) and any applicable source selection evaluation criteria for antiterrorism (AT) and other related protection matters to include, but not limited to: AT, Operations Security (OPSEC), cyber security, physical security, law enforcement, intelligence, and foreign disclosure. It is an Army policy requirement that all signatures to this Security Addendum to the Performance Work Statement (PWS) be included in all requirement packages.

Items in paragraphs 3 and 4 checked “YES” apply to this effort. Items checked “NO” are not applicable to this effort and requirements will not be levied against the contractor.

1. AT Level I Training – (This standard language is for contractor employees with an area of performance within an Army controlled installation, facility or area):

All contractor employees, to include subcontractor employees, requiring access to Army installations, facilities and controlled access areas shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR or to the contracting officer, if a COR is not assigned, within 60 calendar days after completion of training by all employees and subcontractor personnel. AT level I awareness training is available at the following website: https://jkodirect.jten.mil/ for CAC holders (Course number “-US007”). Non-CAC-holders may go to: http://jko.jten.mil/courses/atl1/launch.html.

Additional remarks/requirements:

2. AT Awareness Training for contractor personnel traveling overseas for both unofficial and official travel: US based contractor employees and associated subcontractor employees shall receive government provided area of responsibility (AOR) specific AT awareness submit training as directed by AR 525-13, or other COCOM specific requirements, as necessary. Specific AOR training content is directed by the combatant commander with the unit ATO being the local point of contact. US based contractor employees and associated subcontractor employees will update their PRO-File survey prior to their official or unofficial travel, in accordance with AR 525-28, Personnel Recovery. The PRO-File survey is available at the following link: https://prmsglobal.prms.af.mil/prmsconv/Login/Banner.

Additional remarks/requirements:

YES NO

YES NO

Solicitation/Contract Number:

3. iWATCH Training (This standard language is for contractor employees with an area of performance within an Army controlled installation, facility or area): The contractor and all associated subcontractors shall brief all employees on the local iWATCH program (training standards provided by the requiring activity ATO). This local developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 calendar days of contract award and within 30 calendar days of new employees commencing performance with the results reported to the COR NLT 60 calendar days after contract award.

http://www.myarmyonesource.com/familyprogramsandservices/iwatchprogram/default.aspx

Additional remarks/requirements:

4.Mass Warning Notification System (MWNS) Requirement: Per DoDI 6055.17, all contractors accessing government installations must register with the MWNS system in use at the government place of performance.

Additional remarks/requirements:

Antiterrorism Review Signature: I am an ATO (Level II Certified) and have reviewed the requirements package and understand my responsibilities in accordance with Army Regulation 525-13, Antiterrorism. In organizations that do not have an ATO assigned, an ATC may sign the AT/OPSEC cover sheet after completing the training administered by the appropriate HQDA activities,ACOM,ASCC,DRU,ARNG.

ATO Signature:

5. Formal OPSEC Program (Required if non administration work is performed, e.g.,time sheets, and HR functions at contractor facilities): The contractor shall develop an OPSEC Standard Operating Procedure (SOP)/Plan within 90calendar days of contract award, to be reviewed and approved by the responsible Government OPSEC officer and COR. This plan will include a process to identify critical information, where it is located, who is responsible for it, how to protect it and why it needs to be protected. The contractor shall implement OPSEC measures as ordered by the commander. In addition, the contractor shall have an identified certified Level II OPSEC coordinator per AR 530-1. Details on obtaining Level II certification can be furnished by the Government OPSEC Officer.

Additional remarks/requirements:

YES NO

YES NO

Solicitation/Contract Number:

6. For contracts that require OPSEC Training: Per AR 530-1 Operations Security, the CECOM OPSEC Plan, and AR 350-1 Army Training and Leader Development contractor employees must complete Level I OPSEC Awareness training within 30 calendar days of reporting for duty and annually thereafter. Level I OPSEC training is available via the Army Learning Management System (ALMS) application at the following link: https://www.lms.army.mil/ and by searching “Army OPSEC Level I (Duration:2 hours). An Enterprise Access Management Service Army (EAMS) account is required to access the ALMS application. Contractors shall also participate in any command directed OPSEC stand-downs, e.g., ad-hoc refresher trainings. If Computer Based Training (CBT) via ALMS cannot be completed, the organization's OPSEC Officer can provide the training to meeting initial and refresher training requirements.

Additional remarks/requirements:

8. For Cybersecurity/Information Technology (IT) training: All contractor employees and associated sub-contractor employees must complete the DoD Cybersecurity awareness training before issuance of network access and annually thereafter. All contractor employees working Cybersecurity/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01-M and AR 25-2 within six months of appointment to Cybersecurity/IT functions.

Additional remarks/requirements:

9. Cybersecurity/Information Technology (IT) Certification - Per DoD 8570.01-M (Ch4) , DFARS 252.239.7001 and AR 25-2, the contractor employees supporting Cybersecurity/IT functions shall be appropriately certified upon contract award.

The baseline certification as stipulated in DoD 8570.01-M (Ch4) must be completed upon contract award.

Additional remarks/requirements:

Information System Security Manager/Officer Review Signature: I have reviewed the requirements package and it contains the correct information to meet the cybersecurity requirements of this effort.

ISSM/ISSO Signature

YES NO

YES NO

YES NO

YES NO

20201001

Operations Security Review Signature: I am OPSEC level II certified and have reviewed the requirements package, and it is in compliance with Army Regulation 530-1, Operations Security.

OPSEC Officer Signature

Additional remarks/requirements:

7. Army Training Certification Tracking System (ATCTS) Registration (Required when contractor employees require access to government information systems): All contractor employees with access to a government information system must be registered in the ATCTS (Army Training Certification Tracking System) at commencement of services, and must successfully complete the DoD Cybersecurity Awareness Challenge and Accepted Use Policy (AUP) prior to access to the IS, and then annually thereafter. IT access requests must include current AUP and training certificates for initial and contract renewals.

Solicitation/Contract Number:

10. Access and general protection/security policy and procedures (This standard language is for contractor employees with an area of performance within Army controlled installation, facility, or area): Contractor and all associated subcontractors employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DoD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

Additional remarks/requirements:

11. Handling or access to Classified Information - Contractor shall comply with FAR 52.204-2, Security Requirements.

This clause involves access to information classified “Confidential,” “Secret,” or “Top Secret” and requires contractors to comply with— (1) The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M); (2) any revisions to DoD 5220.22-M, notice of which has been furnished to the contractor.

Additional remarks/requirements:

Additional remarks/requirements:

Security Manager Review Signature: I have reviewed the requirements package and it contains the correct information to meet the security requirements for this effort.

Security Manager Signature:

13. For contractors requiring Common Access Cards (CAC): Before CAC issuance, the contractor employee requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation in accordance with Army Directive 2014-05. The contractor employee will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) Remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) Physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on afavorable review of the FBI fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

Refer to item 13b of the continuation page for information regarding IT Level Designations.

Additional remarks/requirements:

YES NO

YES NO

YES NO

YES NO

20201001

12. Security Training / Briefings - Several training requirements exist for contractor personnel per DoD and Army regulation / directives. Refer to 13h of the Continuation page of the DD254.

Solicitation/Contract Number:

14. For contractors that do not require CAC, but require access to a DoD facility or installation (For contractors that do not require CAC, but require access to a DoD facility or installation):

Contractor and all associated subcontractors employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB) (Army Directive 2014-05/AR 190-13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

Additional remarks/requirements:

15. For contractors authorized to accompany the force: DFARS Clause 252.225-7040 (DFARS Clause 252-225-7995 for CENTCOM), DFARS Clause 252.225-7040 (DFARS Clause 252-225-7995 for CENTCOM), Contractor Personnel Authorized to Accompany U.S. Armed Forces Deployed Outside the United States. The clause shall be used in solicitations and contracts that authorize contractor personnel to accompany US Armed Forces deployed outside the US in contingency operations; humanitarian or peacekeeping operations; or other military operations or exercises, when designated by the combatant commander. The clause discusses the following AT/OPSEC related topics: required compliance with laws and regulations, pre-deployment requirements, required training (per combatant command guidance), and personnel data required.

Additional remarks/requirements:

16. For Contract Requiring Performance or Delivery in a Foreign Country: DFARS Clause 252.225-7043, Antiterrorism/Force Protection for Defense Contractors Outside the US. The clause shall be used in solicitations and contracts that require performance or delivery in a foreign country. This clause applies to both contingencies and non-contingency support. The key AT requirement is for non-local national contractor personnel to comply with theater clearance requirements and allows the combatant commander to exercise oversight to ensure the contractor’s compliance with combatant commander and subordinate task force commander policies and directives.

Additional remarks/requirements:

Contracting Officer Representative Review Signature: I have reviewed the requirements package and it contains the correct information to meet the contractual requirements of this effort.

COR Signature:

YES NO

YES NO

90 calendar days of contract award. The Government will have 20 calendar days for review and comment. The Contractor will have 10 calendar days to incorporate Government comments. Subsequent Government final disposition is required 15 calendar days after incorporation of comments by the contractor

10 Sonar Drive Woburn, MA 01801-5704

Andover, MA 01810-2452

Programs, Naval Air Systems Command

PMA-272

Set (RSDS) Security Classification Guide (SCG), ID# 02-295.1 NAVAL AIR

SYSTEMS COMMAND (NAVAIR), RD:

2018-08-29