Security Plan Attachment A.pdf

ATTACHMENT A

• Security Plan – The work to be performed under this contract will involve access to sensitive BARDA program information. Within 15 days after contract award, the Contractor shall develop and submit a written Draft Security Plan that describes their procedures and policies to defend against theft, tampering, or destruction of product-related material, equipment, documents, information, and data. The Draft Security Plan will include, at a minimum:

o Personnel Security Policies and Procedures including but not limited to:

recruitment of new employees; interview process; background checks;

suitability / adjudication policy; access determination; rules of behavior;

termination procedures; and non-disclosure agreements.

o Physical Security Policies and Procedures including but not limited to:

internal / external access control; identification policies; facility visitors;

parking areas; barriers; shipping, receiving and transport; security lighting;

restricted areas; signage; intrusion detection systems; closed circuit television;

other control measures.

o Information Security Policies and Procedures including but not limited to:

identification of sensitive information; access control / determination; secure storage procedures; document control; destruction procedures.

o Information Technology Security Policies and Procedures including but not limited to: intrusion detection and prevention systems; encryption systems;

identification of sensitive information; passwords; removable media; laptop policy; access control / determination; secure storage procedures; document control; backup procedures; disaster recovery.

o Security Reporting Requirement - Violations of established security protocols will be reported to the Contracting Officer’s Technical Representative (COTR) upon discovery. The Contractor will investigate violations to determine the cause, extent, loss or compromise of sensitive program information, and corrective actions taken to prevent future violations.

BARDA will determine if the severity of the violation requires further government intervention.

The BARDA Program Protection Officer will review the plan and submit comments to the Contracting Officer within 10 business days after receipt of the Draft Security Plan. The Contractor shall review the comments, and submit a Final Security Plan in accordance with the contract security requirements to the Government within 30 days. Upon Government approval and completion of the

ATTACHMENT A

Final Security audits, the Contractor shall submit to the Contracting Officer a letter certifying compliance. Performance of the work under this contract shall be in accordance with this approved Final Security Plan.