DRAFT_Performance Work Statement_ISO_14001.pdf

PERFORMANCE WORK STATEMENT (PWS)

FOR

ISO 14001 Environmental Management System Certification Body Services

PART 1

GENERAL INFORMATION

1. GENERAL: This is a non-personnel services contract to provide ISO 14001 Environmental Management System Certification Body (CB) Services. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.1 Description of Services/Introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform ISO 14001 Environmental Management System CB Services as defined in this Performance Work Statement except for those items specified as government furnished property and services. The contractor shall perform to the standards in this contract.

1.2 Background: Tobyhanna Army Depot (TYAD) is currently registered to the ISO 14001:2015 standard, with expiration of the current registration to expire in April 2027. The initial year of this contract will be to conduct a re-registration audit, with an option years to conduct three surveillance audits and an option year to conduct an additional re-registration audit. TYADs business of support to the DoD and its base operations are within the scope of the EMS.

The area of consideration does not include tenant activities co-located at the facility. Further information can be provided by a Request for Information to the Contracting office for quailified bidders to accurately assess TYADs level of risk to environmental impacts. TYAD has not been issued any nonconformances during the previous 3 year period which have been classified as MAJOR. TYAD has in its possession the previous 3 years of audit reports. TYAD has in its possession the previous 3 years of corrective actions issued by the incumbent CB. TYAD has in its possession all previously issued ISO 14001 certificates.

1.3 Objectives:

• The CB shall conduct a registration audit to ISO 14001:2015 before 28 February 2027.

• The CB shall conduct a surveillance 1 audit to ISO 14001:2015 before 28 February

2028.

• The CB shall conduct a surveillance 2 audit to ISO 14001:2015 before 28 February

2029.

• The CB shall conduct a registration audit to ISO 14001:2015 before 28 February 2030.

• The CB shall conduct a surveillance 1 audit to ISO 14001:2015 before 28 February

2031.

1.3 Scope: ISO 14001 Environmental Management System CB services include both surveillance and re-registration audits. The contractor shall accomplish an audit of TYAD to the ISO 14001:2015 standard and provide a comprehensive report of the audit results. The contractor shall conduct entrance, exit and daily briefs during the audit period.

1.4 Period of Performance: The period of performance shall be for one (1) Base Year of 12 months and four (4) 12-month option years.

Base Year: 01 July 2026 – 30 June 2027 Option Year 1: 01 July 2027 – 30 June 2028 Option Year 2: 01 July 2028 – 30 June 2029 Option Year 3: 01 July 2029 – 30 June 2030 Option Year 4: 01 July 2030 – 30 June 2031

1.5 Quality Control/ Quality Assurance: See QASP for this Contract.

1.6 Recognized Holidays: The contractor will not perform work on the following holidays:

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Independence Day Christmas Day Juneteeth Day

1.6.1 Hours of Operation: The contractor is responsible for conducting business, between the hours of 0700-1630 Monday thru Thursday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. For other than firm fixed price contracts, the contractor will not be reimbursed when the government facility is closed for the above reasons. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential.

1.6.2 Place of Performance: The work to be performed under this contract will be performed at Tobyhanna Army Depot, Tobyhanna, PA 18466.

1.6.3 Type of Contract: The government will award a Firm Fixed Price Contract.

1.6.4 Security Requirements: Contractor personnel performing work under this contract must have a security background check before admission to Tobyhanna Army Depot.

1.6.5 Physical Security: The contractor shall be responsible for safeguarding all government equipment, information, and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured. A background check and approval from TYAD Security Operations Branch is required for all contractor and subcontractor personnel prior to on-site access at TYAD.

All persons seeking entrance to TYAD shall submit to and comply with all security standards and requirements in force at the time such persons are seeking entry. All contractors, regardless of resident status or citizenship, will be subject to vehicle search and intense in-processing by TYAD security personnel prior to being granted access to TYAD. This security screening process may be time consuming, and access may be delayed or denied. The contractor shall ensure ELTY Form 648-C is completed for all contractor and subcontractor personnel requiring depot access to include warranty services. The TYAD point of contact (POC) will provide ELTY Form 648-C, Request Access to Tobyhanna Army Depot, to the contractor/vendor at least ten days prior to the expected visit date for completion. The contractor/vendor shall return the completed ELTY Form 648-C to the TYAD POC in a timely manner so the same may be submitted to Security for processing no later than seven days prior to the visit. All the required fields on the form shall be complete and accurate by the contractor/vendor for timely processing. This requirement is inclusive of on-site supervisory or managerial personnel and sub-contractor personnel that the Contractor anticipates will be performing work or visiting on-site. This security screening does not relieve the contractor of any responsibilities to conduct thorough pre-employment background checks and drug screening.

Contractor workers will not be granted access to the work site until security screening is completed and access is approved. Any contractor personnel onsite who fail screening will not be permitted further access to TYAD. See “Access and General Protection/Security Policy and Procedures” below.

Please submit the completed ELTY Forms 648-C form(s) to the POC.

1.6.6 Special Qualifications:

• The CB shall possess and provide evidence of current ISO14001 accreditation. The CB cannot use this audit to obtain this accreditation.

• The CB shall be able to demonstrate ten (10) years of experience working within the defense industry. Objective evidence will be required.

• CB should have experience auditing complex industrial manufacturing, repair, and systems integration facilities within the defense sector.

• The CB shall demonstrate knowledge of environmental laws and regulations and environmental permits in understanding the complexities of a multi-media compliance program at an industrial facility.

• Lead auditors should have a minimum of four years of experience auditing to the ISO 14001 standard. This shall be demonstrated by providing the lead auditor’s resume.

• All auditors are subject to a security background check prior to being granted access to the facility.

• Within the last three years, all auditors shall have completed fifteen (15) hours of continuing education and have performed four (4) full EMS audits for a total of twenty

(20) audit days.

• The ability to maintain continuity of auditors from audit to audit and a plan on how this will be accomplished shall be provided.

• TYAD reserves the right to reject any potential individual auditors based on past negative experiences with them. Negative experiences include but are not limited to dishonest and disrespectful behaviors.

• Audits will be conducted according to the TYAD operating schedule.

• The audit duration will be calculated in accordance with International Accreditation

Forum Mandatory Directive 5 guidelines for performing audits.

1.6.7 Key Personnel: The following personnel are considered key personnel by the government:

ISO 14001 Environmental Management System Experienced Lead Auditor. The contractor shall provide a contract manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the contractor when the manager is absent shall be designated in writing to the contracting officer. The contract manager or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The contract manager or alternate shall be available between 0730 – 1600 Monday thru Friday except Federal holidays or when the government facility is closed for administrative reasons. Qualifications for all key personnel are listed below: ISO 14001 auditors accredited to audit for ISO 14001:2015 Environmental Management System.

1.6.8 Data Rights: The Government has unlimited rights to all documents/material produced under this contract. All documents and materials, to include the source codes of any software, produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the contractor without written permission from the Contracting Officer. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

1.6.9 Organizational Conflict of Interest: Contractor and subcontractor personnel performing work under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications, or work statements, etc.) or perform evaluation services which may create a current or subsequent Organizational Conflict of Interests (OCI) as defined in FAR Subpart 9.5. The Contractor shall notify the Contracting Officer immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the Contracting Officer to avoid or mitigate any such OCI. The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the Contracting Officer and in the event the Contracting Officer unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the Contracting Officer may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

1.6.10 The government will provide a workspace for the contractor team to perform the tasks as outline in this PWS. The workspace shall include a dedicated conference area and other items used in an office environment.

PART 2

DEFINITIONS & ACRONYMS

2. DEFINITIONS AND ACRONYMS:

2.1. DEFINITIONS:

2.1.1. CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies or service to the government. The term used in this contract refers to the prime.

2.1.2. CONTRACTING OFFICER. A person with authority to enter, administer, and or terminate contracts, and make related determinations and findings on behalf of the government. Note: The only individual who can legally bind the government.

2.1.3. CONTRACTING OFFICER'S REPRESENTATIVE (COR). An employee of the U.S.

Government appointed by the contracting officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor if that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.4. DEFECTIVE SERVICE. A service output that does not meet the standard of performance associated with the Performance Work Statement.

2.1.5. DELIVERABLE. Anything that can be physically delivered but may include non-manufactured things such as meeting minutes or reports.

2.1.6. KEY PERSONNEL. Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.1.7. PHYSICAL SECURITY. Actions that prevent the loss or damage of Government property.

2.1.8. QUALITY ASSURANCE. The government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

2.1.9. QUALITY ASSURANCE Surveillance Plan (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

2.1.10. QUALITY CONTROL. All necessary measures taken by the Contractor to assure that the quality of a product or service shall meet contract requirements.

2.1.11. SUBCONTRACTOR. One that enters a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

2.1.12. WORKDAY. The number of hours per day the Contractor provides services in accordance with the contract.

2.1.12. WORK WEEK. Monday through Friday, unless specified otherwise.

2.2. ACRONYMS:

ACOR Alternate Contracting Officer's Representative AFARS Army Federal Acquisition Regulation Supplement AR Army Regulation CCE Contracting Center of Excellence CFR Code of Federal Regulations CONUS Continental United States (excludes Alaska and Hawaii) COR Contracting Officer Representative COTR Contracting Officer's Technical Representative COTS Commercial-Off-the-Shelf DA Department of the Army DD250 Department of Defense Form 250 (Receiving Report) DD254 Department of Defense Contract Security Requirement List DFARS Defense Federal Acquisition Regulation Supplement DMDC Defense Manpower Data Center DOD Department of Defense FAR Federal Acquisition Regulation HIPAA Health Insurance Portability and Accountability Act of 1996 ISO International Organization for Standardization

KO Contracting Officer OCI Organizational Conflict of Interest OCONUS Outside Continental United States (includes Alaska and Hawaii) ODC Other Direct Costs PIPO Phase In/Phase Out POC Point of Contact PRS Performance Requirements Summary PWS Performance Work Statement QA Quality Assurance QAP Quality Assurance Program QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Program TE Technical Exhibit

PART 3

3. CONTRACTOR MANAGEMENT REPORTING (CMR): The Office of the Assistant Secretary of the Army (Manpower & Reserve Affairs) operates and maintains a secure Army data collection site where the Contractor shall report ALL Contractor manpower (including subcontractor manpower) required for performance of this contract. The Contractor shall completely fill in all the information in the format using the following web address https://Contractormanpower.army.pentagon.mil. The required information includes: (1) Contracting Office, Contracting Officer, Contracting Officer’s Technical Representative (COTR) or also known as the Contracting Officer’s Representative (COR); (2) Contract number, including task and delivery order number. (3) Beginning and ending dates covered by reporting period. (4) Contractor's name, address, phone number, e-mail address, identity of Contractor employee entering data. (5) Estimated direct labor hours (including sub- Contractors). (6) Estimated direct labor dollars paid this reporting period (including sub- Contractors). (7) Total payments (including sub-Contractors). (8) Predominant Federal Service Code (FSC) reflecting services provided by Contractor (and separate predominant FSC for each sub-Contractor if different). (9) Estimated data collection cost. (10) Organizational title associated with the Unit Identification Code (UIC) for the Army Requiring Activity (The Army Requiring Activity is responsible for providing the Contractor with its UIC for the purposes of reporting this information). (11) Locations where Contractor and sub-Contractors perform the work (specified by zip code in the United States and nearest city, country, when in an overseas location, using standardized nomenclature provided on website); (12) Presence of deployment or contingency contract language; and (13) Number of Contractor and sub-Contractor employees deployed in theater this reporting period (by country). As part of its submission, the Contractor shall provide the estimated total cost (if any) incurred to comply with this reporting requirement. Reporting period shall be the period of performance not to exceed 12 months ending September 30 of each government fiscal year and must be reported by 31 October of each calendar year. Contractors may use a direct XML data transfer to the database server or fill in the fields on the website. The XML direct transfer is a format for transferring files from a contractor’s system to the secure website without the need for separate data entries for each required data element at the website. The specific formats for the XML direct transfer may be downloaded from the website.

PERFORMANCE REQUIREMENTS SUMMARY/ DELIVERABLES

Performance Objective (The Service required—usually a shall statement)

Standard Performance Threshold (This is the maximum error rate. It could possibly be “Zero deviation from standard”)

Method of Surveillance

PRS # 1.

The contractor shall provide a successful recertification audit of TYAD’s Environmental Management System to maintain ISO 14001:2015 certification.

The contractor provided ISO 14001:2015 Environmental Management Systems requirements with guidance for use.

Zero deviation from standard.

Periodic surveillance.

PRS # 2

The contractor shall provide a successful surveillance audit of TYAD’s Environmental Management System to maintain ISO 14001:2015 certification

The contractor provided ISO 14001:2015 Environmental

Periodic surveillance.

PRS # 3

The contractor shall provide a successful surveillance audit of TYAD’s Environmental Management System to maintain ISO 14001:2015 certification.

The contractor provided ISO 14001:2015 Environmental

Periodic surveillance.

PRS # 4

The contractor shall provide a successful recertification audit of TYAD’s Environmental Management System to maintain ISO 14001:2015 certification.

The contractor provided ISO 14001:2015 Environmental

Periodic surveillance.

PRS # 4

The contractor shall provide a successful surveillance audit of TYAD’s Environmental Management System to maintain ISO 14001:2015 certification.

The contractor provided ISO 14001:2015 Environmental

Periodic surveillance.

Deliverable Frequency # of Copies Medium/Format Submit To Final audit report providing a detailed report of the audit including any non-conformances identified.

At the completion of each audit.

Two copies to be provided

Electronic copy sent in a PDF format.

The report should be emailed to TYADs ISO 14001 Lead Auditor and TYADs Environmental Branch Chief

Security Operations (SECOPS) Requirements

All Tobyhanna Army Depot (TYAD) contracts and other acquisition-related documents must ensure privacy and security controls follow this information, and that contractors, subcontractors, and service providers protect Privacy Act information in the same way the organization adhering to the Federal Acquisition Regulations (FAR) Privacy Act provisions (Subparts 24.1 and 24.2) and include the specified contract clauses (Parts 52.224-1 and 52.224-2), as appropriate, to ensure that personal information is protected as mandated.

Force Protection Condition (FPCON) Should the Force Protection Condition (FPCON) at the installation change, the Government may require changes in contractor security matters and/or processes.

Unscheduled gate closures by Law Enforcement may occur at any time causing all personnel entering or exiting a closed installation to experience a delay. This cannot be predicted or prevented. Contractors are not compensated for unexpected closures or delays.

Vehicles operated by contractor personnel are subject to search pursuant to applicable regulations. Any moving violation of any applicable motor vehicle regulation may result in the termination of the contractor employee’s installation driving privileges.

The contractor’s employees shall become familiar with and obey the regulations of the installation, including law enforcement, fire, traffic, safety and security (protecting National security) regulations while on the installation. Contractor employees should only enter restricted areas when required to do so and only upon prior approval. All contractor employees shall carry proper identification with them at all times. The contractor shall ensure compliance with all regulations and orders of the installation which may affect performance.

Emergency Communications and Services. If assigned to TYAD for seven-days or longer, contractors and subcontractor employees will enroll in the ALERT! Mass Warning Notification System (MWNS). CAC is required to register for ALERT!. If a CAC has not been deemed necessary for the contractor or subcontractor, the COR will provide the necessary information to TYADs Antiterrorism Officer or TYADs Emergency Manager in the Security Operations Branch for manual input into the ALERT! System.

ALERT! MWNS is NOT optional - it is a Headquarters Department of the Army (HQDA) requirement to be a registered user.

Due to the life-safety implications of the information being relayed and the requirement to provide immediate alerts and warnings, personnel assigned to TYAD must ensure that their personal contact information, including after-duty hours contact information, as appropriate (e.g., personal cellular phone numbers or landline phone numbers), e-mail addresses, home address, etc., are entered into the system and regularly updated or verified every 90 days to remain current and accurate.

In the event of a life-threatening emergency or natural disaster, COR will account for assigned contractors. COR will send personnel accountability report to Emergency Operations Center (EOC).

Base closure announcements will be disseminated via ALERT! MWNS.

Antiterrorism (AT) Level I Training. In accordance with AR 525-13, all contractor and subcontractor employees requiring access to Army installations, facilities, or controlled access areas shall complete AT Level I awareness training annually. This training must be completed prior to being granted installation access and beginning work. The contractor is responsible for ensuring this requirement is met and for providing certificates of completion for each employee to the COR upon request. The web-based training is available at https://jko.jten.mil (Course: JS-US007).

AT Level I and iWATCH training is not required to be in person. While in-person training is an option, the most common and widely accepted method is web-based.

Army regulations explicitly provide multiple ways to meet the training requirement to ensure flexibility for all personnel, regardless of their location or access to a classroom setting.

iWATCH Army Training. This training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR.

This training shall be completed within 30 calendar days of contract award and within 30 calendar days of new employees commencing performance with the results reported to the COR NLT 30 calendar days after contract award. Contractors and all associated sub-contractors will be briefed by the TYAD Antiterrorism/Force Protection officer. It is recommended this training be conducted as part of an initial entry briefing or unit/organization newcomer’s briefings. Send training requests to TYADs Antiterrorism Officer. Contractor employee training will be documented on a local form.

Access and General Protection/Security Policy and Procedures. Contractor and all associated sub-contractor employees shall comply with applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by TYAD Law Enforcement. Contractor workforce must comply with all personal identity verification requirements as directed by DoD, HQDA, and/or local policy.

Contractor and all associated sub-contractor employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB) (Army Directive 2014-05/AR 190-13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by the government representative), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

https://jko.jten.mil/

A background check and approval from TYAD Law Enforcement is required for all contractor and subcontractor personnel prior to on-site access at TYAD. All persons seeking entrance to TYAD shall submit to and comply with all security standards and requirements in force at the time such persons are seeking entry. All contractors, regardless of resident status or citizenship, will be subject to vehicle search and intense in-processing by TYAD security personnel prior to being granted access to TYAD. This security screening process may be time consuming, and access may be delayed or denied. The contractor shall ensure the required government access request form is completed. COR will provide specifics to the contractor after award and at least ten days prior to the expected visit date for completion. All the required fields on the form shall be accurate and complete. This requirement is inclusive of on-site supervisory or managerial personnel and sub-contractor personnel that the contractor anticipates will be performing work or visiting on-site. This security screening does not relieve the contractor of any responsibilities to conduct thorough pre-employment background checks and drug screening. Contractor workers will not be granted access to the work site until security screening is completed and access is approved. Any contractor personnel on-site who fail screening will not be permitted further access to TYAD.

Submit the completed local form(s) to the COR. Ensure contracts include the provisions that check for the possibility of and prevent undocumented workers for inclusion in contracted work related to Army missions.

The company will ensure that its employees entering Army-controlled installations or facilities have obtained access badges and passes in accordance with facility regulations and that these badges and passes are obtained in advance so as not to delay the accomplishment of contracted services.

Pre-Bid Site Visit Controls: Any pre-bid site visits held before the contract award will be conducted under strict security controls. These protocols—including mandatory pre-registration for baseline vetting and constant escorting—apply to all potential bidders, regardless of any previous work history with TYAD or current installation access. During this public solicitation phase, a contractor's prior access or familiarity with the installation does not grant them a "need-to-know" for a new requirement. All bidders will be treated as external entities, and the site visit is strictly for a visual inspection of physical conditions only.

Post-Award Information Release: Conversely, all project specifics—including exact locations, detailed plans, and mission context—can and must be provided to the contractor only after the contract is awarded and their personnel have completed all mandatory security training (AT, OPSEC, CUI). At this stage, the contractor has an established "lawful government purpose," and the controlled release of detailed information is appropriate and necessary for the performance of the contract.

Contractor and all associated subcontractor employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (Army Directive 2014-

05/AR 190-13); applicable installation, facility and area commander installation and facility access and local security policies and procedures (provided by Government representative); or, at OCONUS locations, in accordance with status-of-forces agreements and other theater regulations.

Collection of Badges: The Contractor shall account for all forms of Government-provided identification issued to the Contractor employees in connection with performance under this contract. The Contractor shall return such identification to the issuing agency at the earliest of any of the following, unless otherwise determined by the Government:

1. When no longer needed for contract performance

2. Upon completion of the Contractor employee’s employment

3. Upon contract completion or termination

The Contracting Officer may delay final payment under a contract if the Contractor fails to comply with these requirements. The Contractor shall insert the substance of this clause, including this paragraph, in all subcontracts when the subcontractor’s employees are required to have routine physical access to a federally controlled facility and/or routine access to a federally controlled information system. It shall be the responsibility of the prime Contractor to return such identification to the issuing agency in accordance with the terms set forth in of this section, unless otherwise approved in writing by the Contracting Officer. The company will return all issued U.S. Government Common Access Cards, installation badges, and/or access passes to the COR when the contract is completed or when a contractor employee no longer requires access to the installation or facility. Contractor personnel will obtain a vehicle pass for access to the military installation and Common Access Cards (CAC) for computer access, if applicable.

Insider Threat Program. The contractor will establish and maintain an insider threat program to gather, integrate, and report relevant and available information indicative of a potential or actual insider threat, consistent with E.O. 13587 and Presidential Memorandum “National Insider Threat Policy and Minimum Standards for Executive Branch Insider Threat Programs.”

Operational Security (OPSEC). OPSEC is not a one-time checklist, it is a dynamic, ongoing process embedded in every phase of planning, execution, and daily operations.

It requires continuous critical thinking and vigilance from everyone who interacts with government information or operates on a government installation. This includes military personnel, Department of Defense civilians, contractors, subcontractors, and family members. OPSEC is not just a policy, it’s a mindset. Its success depends on consistent awareness and execution by every member of the TYAD community.

At TYAD, all observations, communications, and experiences must be protected and must not be shared with anyone lacking a lawful government purpose or a validated business need-to-know. This disciplined approach ensures that emerging threats, evolving vulnerabilities, and shifting mission parameters are constantly reassessed and addressed to safeguard critical information.

OPSEC applies across the full spectrum of DoD missions, functions, programs, and activities under this contract. Practicing OPSEC daily is a requirement that is essential to mission success and the protection of national security assets.

Failure to properly safeguard sensitive or classified information—whether through negligence, willful misconduct, or ignorance—may result in administrative, disciplinary, contractual, or criminal consequences.

Applicability and Management of the Contractor OPSEC Plan The requirement for an Operations Security (OPSEC) Plan or Standing Operating Procedure (SOP) is based on the contractor's access to and handling of Critical Information and/or Controlled Unclassified Information (CUI), regardless of where that information resides. It is essential to distinguish between Information Security (INFOSEC), which protects data "at rest" within a system, and OPSEC, which protects data "in use" by governing the procedures and actions of personnel.

When contractor personnel access or handle CUI—such as building floor plans, technical manuals, or operational schedules—they are required to have an approved OPSEC Plan/SOP. This plan is the formal, documented agreement that outlines how the contractor will protect the government's sensitive information. Even when CUI is handled exclusively on Government Furnished Equipment (GFE), the contractor remains responsible for the "human factor." The OPSEC Plan transfers the responsibility for protecting this information from the Government to the contractor by legally obligating them to establish internal procedures for everything from secure physical storage and controlled discussions to the proper destruction of materials.

Without this plan, the Government retains all risk for how a contractor safeguards its data.

The management and approval of the contractor's OPSEC Plan is a shared responsibility, with defined roles at each stage. Per government acquisition and security policy, it is the Contracting Officer's Representative (COR) who is ultimately responsible for the initial identification and final enforcement of this requirement. The process is as follows: The COR (designated technical representative) identifies the need for an OPSEC Plan based on the work described and writes the requirement into the Statement of Work (SOW). After contract award, the COR enforces this by ensuring the contractor submits the plan on time. The Contracting Officer (KO) ensures the requirement is legally binding in the final contract and is the sole authority to take contractual action for non-compliance. Finally, the Government OPSEC Officer, as the technical expert, is responsible for reviewing the submitted plan against AR 530-1 and providing the formal approval or rejection back to the COR.

OPSEC Training Requirements. In accordance with AR 530-1 (4-2-a), all contractors and subcontractors shall complete OPSEC Level I certification training (Initial and Continual – detailed below).

The Contracting Officer’s Representative (COR) serves as the oversight authority: the COR verifies contractual compliance by collecting and reviewing certificates, ensuring they’re submitted within the required timeframe – first 30 days of assignment.

According to AR 530-1 (para 4-2) and DoDM 5205.02, there is no “grace period” or minimum number of days on-site before OPSEC Level I Initial and Continual training becomes mandatory—any contractor, subcontractor, or support‐service provider who requires access to TYAD information, systems, or facilities must complete both parts of their OPSEC Level I training.

OPSEC Level I training is comprised of two parts (Initial and Continual):

1. OPSEC Level I Initial training o To be completed within first 30 days of assignment to TYAD and annually thereafter – preferably before the job starts o Provides specific information about TYADs OPSEC program o Contractors and subcontractors must set up an appointment with TYADs OPSEC Officer for Initial training-COR to provide contact information o Conducted by TYAD’s OPSEC officer or alternate – training can be in person or via MS Teams (30 minutes) and is tracked by a TYADs OPSEC Officer via a local training form

2. OPSEC Level I Continual training:

o Commonly referred to as annual OPSEC training o To be completed within 30 days of assignment to TYAD and annually thereafter – preferably before the job starts o Provides general information about OPSEC and reemphasizes sound OPSEC practices throughout the contract period o Title of the training is: “OPSEC Awareness for Military Members, DoD Employees and Contractors” and is available online -https://securityawareness.dcsa.mil/opsec/index.htm o Certificates of completion must go to the COR

OPSEC Measures to Protect Critical Information. This section is critical because it moves beyond a simple, vague requirement to “practice OPSEC” and provides the contractor with specific, actionable, and enforceable rules of behavior.

https://securityawareness.dcsa.mil/opsec/index.htm

All contractors and subcontractors shall implement the following mandatory OPSEC measures during the entire period of performance to protect critical and sensitive unclassified information:

1. Training and Compliance: Complete all mandatory OPSEC training as specified in this contract and actively apply all TYAD OPSEC measures in daily, contract-related operations.

2. Secure Communications: Avoid discussing government operations in public spaces or over unprotected communications (e.g., personal cell phones).

Transmit Controlled Unclassified Information (CUI) only through authorized, encrypted channels as directed in the SOW/PWS = DoD Safe Access File Exchange (SAFE) is the accredited method for sending files that contain CUI, Personally Identifiable Information (PII), or other sensitive data that should not be transmitted over unencrypted, commercial email channels. The files are encrypted during the transfer process.

3. Public Release and Social Media Prohibition: Do not disclose or post any images, data, or operational details (e.g., maps, pictures, schedules, equipment, tactics) to any unofficial media, including personal or corporate social media platforms. All information or materials intended for public release require a documented OPSEC review by a TYAD certified OPSEC Level II reviewer.

Coordinate all press releases through the COR and TYADs Public Affairs Office.

4. Reporting Requirements: Immediately report any attempts by unauthorized third parties to solicit sensitive information to the TYAD Security Operations Branch, the contract POC, and the contractor's Facility Security Officer (FSO).

5. Credential Control: Conceal or remove all government-issued badges and identification when off the installation. Do not duplicate, loan, or leave credentials unattended (CACs, badges, and/or parking passes or placards). Report any lost or stolen passes/badges/credentials to TYAD Law Enforcement Branch. The COR will provide all POC contact information.

6. Protection of Sensitive Data: Mark and protect internal company data related to this contract (e.g., schedules, deliverables, vulnerability reports) as CUI. All government-provided information, such as drawings and technical data, must be protected in accordance with DoD, Army guidance and guidance within contract package documents.

7. Information Disposal: At contract completion or upon Government request, return all government information to the COR or destroy it in accordance with approved TYAD procedures for handling CUI.

Photography or Videography. Contractors and subcontractors who will require photography or videography at TYAD must notify their COR at least fourteen business days in advance and complete OPSEC Level I Initial training. The COR will provide contractors with the contact information for points of contact within the security branch after award. All individuals must follow TYAD policy regarding photography and the use of personal electronic devices.

All photos and videos must then undergo an OPSEC Review—per AR 530-1 Chapter 4—to evaluate them against TYAD’s Critical Information List and identify any vulnerabilities. That review must be fully documented and signed off by a TYAD employee who holds OPSEC Level II certification (example: TYAD OPSEC Officer or Public Affairs personnel) before any imagery is distributed.

COMMUNICATIONS SECURITY (COMSEC) All telephonic and electronic communications with DoD organizations are subject to Communications Security (COMSEC) review and monitoring. The contractor is advised that any calls placed to or received from a DoD organization may be subject to monitoring and recording. The contractor shall ensure frequent dissemination of this notice to all employees who communicate with DoD personnel.

Information Security (INFOSEC). The contractor shall comply with all applicable regulations for the protection of government information. Information handled under this contract is categorized as either Controlled Unclassified Information (CUI) or Classified National Security Information (CNSI).

Controlled Unclassified Information (CUI) The handling, marking, safeguarding, and destruction of all CUI shall be in strict accordance with DoD Instruction 5200.48, Controlled Unclassified Information (CUI). Specific contractor responsibilities are detailed in the "Safeguarding CUI" section of this document.

CUI Training Requirement Any contractor or subcontractor personnel who will have access to CUI under this contract must complete mandatory CUI training prior to accessing such information. The "DoD Mandatory Controlled Unclassified Information (CUI) Training" course available on the DCSA CDSE Security Awareness Hub (https://securityawareness.dcsa.mil/cui/) satisfies this requirement. Completion certificates shall be provided to the COR upon request.

Contractor Responsibilities for Handling CUI The contractor shall comply with all CUI requirements outlined in Executive Order 13556 and 32 CFR Part 2002. The contractor's responsibilities include, but are not limited to:

• Marking: Applying uniform CUI markings to all CUI data and deliverables.

• Access Controls: Restricting CUI access to personnel with a lawful government purpose and validated need-to-know.

• Flow Down: Ensuring all CUI protection requirements are passed down to subcontractors.

• Physical Safeguarding: Implementing appropriate physical controls (e.g., locked storage, controlled-access areas) for all CUI, whether in hard copy or on electronic media.

• Incident Reporting: Reporting any actual or suspected loss or compromise of CUI to the COR immediately.

• Disposition: Returning all CUI to TYAD control or destroying it in accordance with DoD and Army guidelines upon contract completion.

Physical Security.

Safeguarding of Government Property The Contractor shall be responsible for safeguarding all government equipment, information, and property provided for Contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

NON-CONSTRUCTION, SUPPLY, or TECHNICAL SERVICES SAFETY STANDARDS

S1.0 Safety Requirements:

The following provides information pertaining to Safety and Accident Prevention for Non- Construction or Technical Services related contracts while at the Tobyhanna Army Depot.

These do not substitute or deflect in any way the requirement to institute and adhere to the provisions of all applicable referenced contractual Federal Acquisition Regulations (FAR) while performing the work under this contract. Failure to enforce safety requirements while at Tobyhanna Army Depot can result in termination of the contract.

S2.0 Safety Laws and Regulations:

1. The Contractor or Vendor shall comply with all Federal and State requirements governing safety and health protection and other applicable occupational safety codes.

2. Tobyhanna Army Depot requires full contractor or vendor compliance with all governmental, state & local safety regulations and standards. The Contractor or vendor is responsible for maintaining, monitoring, and enforcing all rules, regulations, and codes, by ALL personnel working for the contractor or vendor, including all subcontract employees.

3. As noted in Tobyhanna Army Depot Safety Regulation 385-1 - TYAD follows all and is certified as an ISO 45001 facility. Accordingly, the requirements contractor shall comply with and maintain these high safety standards and provide full compliance with all applicable safety regulations and standards. The Contractor shall maintain, monitor, and enforce employee compliance with all applicable rules, regulations, and codes.

4. If applicable, the Contractor or vendor shall indicate its plan for compliance considering conditions of the work described by the design, technical proposal, operational activities of the Government or others in the area of the work, identification of the coordinator, and implementation of all other accident prevention provisions of this contract.

S3.0 Important Phone Numbers:

Fire or Emergency: 911 Fire Department – (Non-Emergency): 570-615-7300

Security: 570-615-7550 Safety Office - 570-615-7027

S4.0 Red Card Program:

Tobyhanna Army Depot utilizes a program to allow employees to stop an action which is considered unsafe. Employees carry small red cards that can be thrown down when employee sees an action they consider unsafe. Work ceases until TYAD management can decide if it is safe or not. Contractors / vendors are required to comply with this program. If a TYAD employee presents the red card to the contractor / vendor, the contractor or vendor must stop working until the COR and Safety Office can determine if there is a safety hazard or not.

S5.0 Fossil Fuel Vehicles: Not Applicable

S6.0 If An Incident Happens:

1. Any serious injury or medical emergency:

• Immediately call emergency responders

• Dial 911 and give accurate location and nature of emergency. Make sure to tell the operator that you are calling from Tobyhanna Army Depot.

• Send someone to the nearest exit to assist responders.

• Treat victims to the best of your ability.

• Notify COR / call work order desk at 570-615-7805 if there is any blood or body fluids that must be cleaned up.

2. In the event of the smell of natural gas:

• Call dial 911and give accurate location and nature of emergency. Make sure to tell the operator that you are calling from Tobyhanna Army Depot.

• Have all personnel evacuate the area if the smell is significant.

• Upon arrival of fire personnel, provide information as to specific equipment and exact location of potential leak.

3. In the case of a fire:

• If the fire is small, use a fire extinguisher and call 911.

• Otherwise, dial 911 and pull the fire alarm.

• Evacuate the building.

IN ANY CONFLICT BETWEEN STANDARDS, THE STRICTER OF THE TWO SHALL APPLY.

IF UNSURE CONTACT THE COR / ET VIA PROPER RFI PROTOCOLS FOR VERIFICATION

THROUGH THE TYAD SAFETY OFFICE.

Standard Specifications for Projects Under the National Environmental Policy Act (NEPA) in

Accordance with 32 CFR 651

***Spill Response Procedures 1-2-3***

1. Stop work

2. Call 911

3. Evacuate Area

*********Damaged Asbestos?********* Environmental Questions?

Call Environmental Branch (EB) at 570-615-7098

10. Emergency/Spills All emergencies and spills must be reported to the TYAD Fire Department by calling 911 from a TYAD phone or (570) 615-7300. If a 911 call is placed on a cell phone, the call will go to the Monroe County Emergency Office. Notify the Monroe County Emergency Office that you are at TYAD, and the call will be forwarded to TYADs Fire Department. The contractor must ensure all personnel working on site are trained in the proper procedure according to 29 CFR 1910.120 (if applicable) to initiate a spill response to handle the hazardous substances they are working with. The contractor will take the necessary actions to prevent and contain spills of hazardous materials.

17. ISO 14001

TYAD is an ISO 14001 certified facility. All contractor and subcontractor employees on site must comply with TYAD Regulation 200-5, “Environmental Management System (EMS).” The contractor may obtain these regulations through the project COR.

28. Recycling The contractor must comply with TYADs general recycling plan for recyclable materials such as aluminum, steel, cardboard, paper, plastic and wood. The contractor should contact the EB for additional information on the recycling of materials through the COR. The COR will coordinate with EB to have the contractor recycle metals, cardboard, etc., through TYADs recycling program. All Construction and Demolition (C&D) material transferred from a construction project into the TYAD recycling program must be segregated and material type and weights submitted to the project COR for consolidation. Any material entering the TYAD recycling program that is not documented and properly reported will be absorbed into the TYAD recycling program and not count towards the C&D requirement of the project. Clean wood shall be recycled by the contractor off TYAD property.