DRAFT Scope of Work.docx

Scope of Work

Potable Water Sampling Contract

The following information outlines the potable water sampling requirements at Tobyhanna Army Depot. Please be advised that these requirements are subject to change to any time based on the monitoring regulations of the Pennsylvania Department of Environmental Protection (PaDEP). The selected bidder will be tasked with fulfilling all sampling requirements.

1. Weekly Total Coliform and Free Chlorine Sampling A. Sampling Frequency: Weekly sampling will be conducted for Total Coliform, E. coli, and Free Field Chlorine. This schedule will result in a total of four or five sampling events per month, contingent upon the number of weeks in any given month.

B. Sampling Responsibility: The contracted laboratory will be solely responsible for all sample collection.

C. Authorized Sample Locations – The Water Program Manager will furnish a Pennsylvania Department of Environmental Protection (PaDEP) approved Total Coliform Sample Siting Plan once the contract is awarded. This document will delineate all authorized sampling locations.

D. Protocol for Positive Bacteria Results: In the event of a positive bacteria sample, the laboratory is required to provide immediate notification to the Water Program Manger via both telephone and email. This notification will trigger the immediate collection of PaDEP mandated check samples.

E. Chorine Level Reporting Requirements: The laboratory must report any Free Chlorine readings that all outside the acceptable range of <0.20 mg/L or >4.0 mg/L. Notification must be made to the Water Program Manager in person and be documented via email.

F. PaDEP Reporting: Coliform and chlorine results must be submitted to the Pennsylvania Department of Environmental Protection (PaDEP) by the 10th day of the month following the month in which the sample were taken. Sample results will be provided to the Pennsylvania Department of Environmental Protection (PaDEP) on standard forms or filed electronically.

2. Quarterly PFAS Sampling A. Sampling Frequency: Perfluorooctanesulfonic Acid (PFOS) and Perfluorooctanoic Acid (PFAS) are to be sampled during the 1st, 2nd, 3rd, and 4th quarters. To ensure adequate time for potential resampling, all samples must be collected within the first month of each respective quarter.

B. Sampling Responsibility: The contracted laboratory will be solely responsible for all sample collection.

C. Authorized Sample Location: This information will be shared with the holder of the contract once it is awarded.

D. Protocol for results above Maximum Contaminant Level (MCL): The laboratory is required to provide immediate notification to the Water Program Manger via email.

E. PaDEP Reporting: Quarterly PFAS results must be submitted to the Pennsylvania Department of Environmental Protection (PaDEP) by the 28th day of the month following the end of the reporting period. For example, these deadlines are typically April 28th, July 28th, October 28th, and January 28th. Sample results will be provided to the Pennsylvania Department of Environmental Protection (PaDEP) on standard forms or filed electronically.

3. Annual Nitrate/Nitrite Sampling A. Sampling Frequency: Nitrite and Nitrate are to be collected annually each year. This sample is to be collected in January to ensure adequate time for a potential resample.

B. Sampling Responsibility: The contracted laboratory will be solely responsible for all sample collection.

C. Authorized Sample Location: This information will be shared with the holder of the contract once it is awarded.

D. Protocol for results above Maximum Contaminant Level (MCL): The laboratory is required to provide immediate notification to the Water Program Manger via email.

E. PaDEP Reporting: Annual Nitrate/Nitrite is to be reported 10 days after the end of the month in which the sample was collected. Sample results will be provided to the Pennsylvania Department of Environmental Protection (PaDEP) on standard forms or filed electronically.

4. Annual Twenty Regulated Volatile Organic Compounds (VOCs) A. Sampling Frequency: VOCs are to be collected annually each year. This sample is to be collected in January to ensure adequate time for a potential resample.

B. Sampling Responsibility: The contracted laboratory will be solely responsible for all sample collection.

C. Analytical Parameters: Carbon Tetrachloride, 1,2-Dichloroethane, 1,2-Dichlorobenze, 1,4-Dichlorobenzene, 1,1-Dichloroethene, cis-1,2-Dichloroethene, trans-1,2-Dichlroethene, Methylene Chloride, 1,2-Dichloropropane, Ethylbenzene, Chlorobenzene, Styrene, Tetrachloroethane, Toluene, 1,2,4-Trichlorobenzene, 1,1,1-Trichloroethane, 1,1,2-Trichloroethane, Trichloroethene, Vinyl Chloride, and Total Xylene.

D. Authorized Sample Location: This information will be shared with the holder of the contract once it is awarded.

E. The laboratory is required to provide immediate notification to the Water Program Manger via email.

F. PaDEP Reporting: Annual VOCs are to be reported 10 days after the end of the month in which the sample was collected. Sample results will be provided to the Pennsylvania Department of Environmental Protection (PaDEP) on standard forms or filed electronically.

5. Haloacetic Acid (HAA5s) and Trihalomethanes (TTHMs) A. Sampling Frequency: Annual sampling for HAA5s and TTHMs is scheduled for September 13th, with the allowable three-day variance before or after this date. It is the laboratory’s responsibility to prepare supplementary samples during collection to mitigate potential data loss from breakage or analytical issues.

B. Sampling Responsibility: The contracted laboratory will be solely responsible for all sample collection.

C. Authorized Sample Location: This information will be shared with the holder of the contract once it is awarded.

D. Protocol for results above Maximum Contaminant Level (MCL): The laboratory is required to provide immediate notification to the Water Program Manger via email.

E. PaDEP Reporting: HAA5s and TTHMs are to be submitted into PaDEP Greenport within 10 days following the end of the month in which the sample results were received. Sample results will be provided to the Pennsylvania Department of Environmental Protection (PaDEP) on standard forms or filed electronically

6. Inorganic Compounds (IOCs) A. Sampling Frequency: IOCs sampling is scheduled to occur between January 1, 2027, and December 31, 2027. Assuming no changes to the PaDEP monitoring requirements, subsequent sampling events will take place in 2027 and 2030. These samples are to be collected in January to ensure adequate time for a potential resample.

B. Sampling Responsibility: The contracted laboratory will be solely responsible for all sample collection.

C. Analytical Parameters: Arsenic, Barium, Cadmium, Chromium, Free Cyanide, Fluoride, Mercury, Nickel, Selenium, Antimony, Beryllium, and Thallium.

D. Authorized Sample Location: This information will be shared with the holder of the contract once it is awarded.

E. Protocol for results above Maximum Contaminant Level (MCL): The laboratory is required to provide immediate notification to the Water Program Manger via email.

F. PaDEP Reporting: IOC sample results are to be submitted to the PaDEP via Greenport by February 10th. Sample results will be provided to the Pennsylvania Department of Environmental Protection (PaDEP) on standard forms or filed electronically

7. Lead and Copper A. Sampling Frequency: Lead and Copper sampling is scheduled to take place between June 1, 2028, through September 30, 2028. Assuming no changes to the PaDEP monitoring requirements, subsequent sampling events will take place in 2028 and 2031.

B. Sampling Responsibility: The contracted laboratory will be solely responsible for all sample collection.

C. Number of Samples and Sampling: TYAD is required by the PaDEP to report 20 Lead and Copper samples into Greenport. The Water Program will ask for 40 samples bottles and the samples will be collected by Water Program Manager. The Water Program Manger will inform the lab ahead of time when sampling will take place.

D. Authorized Sample Locations: This information will come from the PaDEP Lead/Copper Sample Siting Plan and will be shared with the holder of the contract once it is awarded.

E. Protocol for results above Maximum Contaminant Level (MCL): The laboratory is required to provide immediate notification to the Water Program Manger via email.

F. PaDEP Reporting: Sample results are to be submitted to PaDEP via Greenport 10 days after the end of the month in which the sample was received. The laboratory is to enter the first 20 samples the lab receives from TYAD. Sample results will be provided to the Pennsylvania Department of Environmental Protection (PaDEP) on standard forms or filed electronically

8. Synthetic Organic Compounds (SOCs) A. Sampling Frequency: The sampling schedule for SOCs is currently planned for the 2nd and 3rd quarters of 2029 and 2032, pending the results of 2026 samples. The outcome of these results could necessitate a revision of the sampling frequency to quarterly or on an annual basis. To ensure adequate time for potential resampling, all samples must be collected within the first month of each respective quarter B. Sampling Responsibility: The contracted laboratory will be solely responsible for all sample collection.

C. Analytical Parameters: Endrin, Lindane, Methoxychlor, Toxaphene, Dalapon, Diquat, Endothall, Glyphosate, Di(2-ethylhexyl)adipate, Oxamyl, Simazine, Di(2-ethylhexyl)phthalate, Picloram, Dinoseb, Hexchlorocyclopentadiene, Carbofuran, Atrazine, Alachlor, Dioxin (2,3,7,8-TCDD), Heptachlor, Heptachlor Epoxide, and 2,4-D, and 2,4,5-TP Silvex, Hexachlorobenzene, Benzo(a)pyrene, Pentachlorophenol, PCBs, 1,2-Dibromo-3-Chloroprop, Ethylene Dibromide, Chlordane, and Vinyl Chloride.

D. Authorized Sample Location: This information will be shared with the holder of the contract once it is awarded.

E. Protocol for results above Maximum Contaminant Level (MCL): The laboratory is required to provide immediate notification to the Water Program Manger via email.

F. PaDEP Reporting: SOCs shall be reported to the PaDEP via Greenport within 10 days of the end of the monitoring period (or the end of the month, whichever is sooner). Sample results will be provided to the Pennsylvania Department of Environmental Protection (PaDEP) on standard forms or filed electronically

9. Radioactive Samples A. Sampling Frequency: In accordance with the PaDEP monitoring requirements, radiological samples will be collected during the 2031 calendar year. The collection will be scheduled for January 2031 to ensure adequate time for any potential resampling. Sampling is to include Gross Alpha Particle Activity, Combined Uranium, Radium-226, and Radium-228.

B. Sampling Responsibility: The contracted laboratory will be solely responsible for all sample collection.

C. Authorized Sample Location: This information will be shared with the holder of the contract once it is awarded.

D. Protocol for results above Maximum Contaminant Level (MCL): The laboratory is required to provide immediate notification to the Water Program Manger via email.

E. PaDEP Reporting: sample results shall be submitted to PaDEP via Greenport by the 10th day of the month following the end of the monitoring period or the month in which the result is determined, whichever is shorter. Sample results will be provided to the Pennsylvania Department of Environmental Protection (PaDEP) on standard forms or filed electronically.

10. Asbestos A. Sampling Frequency: As of April 2026, PaDEP does not require Asbestos sampling.

11. Emergency Sampling – Can occur at anytime A. Water Line/Main Break

i. Laboratory Mobilization: The laboratory shall arrive on-site within two to three hours of notification by the Water Program Manager. This response time applies during standard business hours/days.

ii. Sampling Responsibility: The contracted laboratory will be solely responsible for all sample collection.

iii. Sample Collection Schedule: Initial (day 1) coliform samples must be collected immediately upon arrival. Follow-up (day 2) samples are to be collected on the subsequent day (PaDEP requirements).

iv. Communication: The laboratory is required to report the results from both Day 1 and Day 2 sampling events to the Water Program Manger via telephone and email as soon as they become available. Formal lab reports must be submitted electronically to the Water Program Manger within three days of the initial sampling Adherence to this timeline is critical to facilitate the prompt and safe recission of any boil water advisory.

v. PaDEP Reporting: The lab is responsible for the prompt submission of all results to PaDEP via Greenport. These results should be entered as soon as possible and be classified as “special samples” upon submission.

vi. These samples will always be treated as RUSH samples that need a quick turn around time.

B. Positive Coliform Sample

i. Laboratory Mobilization: The lab is to be on site the following day of a positive coliform sample to conduct check samples which are required by the PaDEP.

ii. Sampling Responsibility: The contracted laboratory will be solely responsible for all sample collection.

iii. Authorized Sample Locations: The Water Program Manager will furnish a Pennsylvania Department of Environmental Protection (PaDEP) approved Total Coliform Sample Siting Plan once the contract is awarded. This document will delineate all authorized sampling locations.

iv. The laboratory shall call the Water Program Manger as soon as the results are ready. A formal lab report is to follow electronically as soon as possible.

v. PaDEP Reporting: The lab is responsible for the prompt submission of all results to PaDEP via Greenport.

C. Other emergency events can occur at any time and will follow the above guidelines for sampling and reporting.

Non-Reportable Sampling (Non-DEP)

1. Monthly Water Quality Parameters (1 sample)

a. Sampling Frequency: Monthly sampling is required and will be conducted within the first two weeks of each month. This schedule ensures sufficient time for re-sampling, should it be deemed necessary.

b. Analytical Parameters: Calcium, Orthophosphate as P, Alkalinity, Specific Conductance, Total Dissolved Solids (TDS), and laboratory ph.

c. Sampling Responsibility: The contracted laboratory will be solely responsible for all sample collection.

d. Authorized Sample Location: The precise sample location will be disclosed to the laboratory by the Water Program Manager once the contract is formally awarded.

e. Reporting Requirements: Reports must be submitted electronically to the Water Program Manger no later than the end of the month following the sample collection.

f. The data collected under this protocol is intended for internal use by TYAD for informational purposes only and is not reportable to PaDEP.

2. Quarterly Water Quality Parameters (6 samples)

a. Sampling Frequency: Sampling will take place during the 1st, 2nd, 3rd, and 4th quarters.

b. Analytical Parameters: Calcium, Orthophosphate as P, Alkalinity, Specific Conductance, Total Dissolved Solids (TDS), and laboratory ph.

c. Sampling Responsibility: Sample collection will be carried out by the Water Program Manager. It is the responsibility of the laboratory to supply all appropriate sampling containers and chain of custody documentation at least one week before the commencement of each quarter. To ensure readiness for sample receipt, the Water Program Manger will provide the laboratory with one week’s advance notice prior to the scheduled sampling event to arrange for sample pickup.

d. Authorized Sample Locations: The precise sample locations will be disclosed to the laboratory by the Water Program Manager once the contract is formally awarded.

e. Reporting Requirements: Reports must be submitted electronically to the Water Program Manger no later than the end of the month following the sample collection.

f. The data collected under this protocol is intended for internal use by TYAD for informational purposes only and is not reportable to PaDEP.

3. Coliform Bacteria testing may be requested at any time and will not be reported to PaDEP. The data collected under this protocol is intended for internal use by TYAD for informational purposes only.

Laboratory Requirements

1. Pursuant to the Environmental Laboratory Accreditation Regulation (25 Pa. Code, Chapter 252), the laboratory shall maintain valid registration and accreditation with the Pennsylvania Department of Environmental Protection for the duration of the contract. The laboratory is obligated to furnish a copy of said registration certificate and the associated registration number to the Water Program Manager upon award.

2. The contractor shall ensure that all analytical work, including sample collection, handling preservation, and analysis, is conducted in strict accordance with the methods and procedures mandated by the U.S. Environmental Protection Agency (EPA) under 40 CFR 141. No deviation from these protocols is permitted.

3. PaDEP Reporting:

A. Primary Reporting Method: The laboratory is responsible for the electric submission of all analytical results for the PaDEP via Greenport Reporting System. Submissions must utilize the approved Chemical Analyses Input Forms (Form 400).

B. Submission Deadline: All reports must be submitted into PaDEP Greenport as soon as results are ready or by the PaDEP due date.

C. Contingency Reporting Protocol: If electronic submission via Greenport is not feasible, the contractor shall send hard copies of the reports via mail. The reports must be sent to the following two locations and postmarked by the submission deadline:

PaDEP District Office Commonwealth of Pennsylvania Department of Environmental Protection Bureau of Community Environmental control 400 Clearview Lane Stroudsburg, PA 18360

PaDEP Data Processing Center PaDEP Safe Drinking Water Act Data Processing Center PRC Inc.

2330 Ararat Blvd.

Harrisburg, PA 17110

D. Laboratory Reporting Schedule

i. The contractor shall submit all reports electronically to the Water Program Manager according to the following deadlines:

1. For weekly Coliform and Chlorine Analyses: Reports are due within two (2) weeks of the sample collection date.

2. For all other Analyses: Reports are due no later than the tenth (10th) day of the moth following the month of sample collection.

E. The contractor shall be responsible for providing all labor, tools, materials, equipment, sample containers, reporting forms, transportation, and supervision required to fully execute the provisions of this contract. All work must be performed in compliance with all applicable local, state, and federal regulations.

F. The contractor shall bear full responsibility for the preservation and maintenance of sample integrity throughout the entire process, commencing at the time of sample acquisition and concluding upon the completion of the analytical procedure.

G. The contractor shall send all reports electronically to the Water Program Manager. These reports are to be in Adobe Acrobat PDF format.

H. All invoices must be submitted into Procurement Integrated Enterprise Environment (PIEE) and then into Wide Area Workflow (WAWF). Invoices are to be submitted each month once all monthly sampling is completed.

i. Please include a detailed description of the samples that are being billed for (for example weekly coliform/chlorine, 2nd quarter PFAS etc.).

Miscellaneous Information

· Routine Sample Collection: All samples are to be collected on Tuesdays between the hours of 0800 and 1430.

· Inclement Weather Protocol: In the event of inclement weather, the Water Program Manager will contact the laboratory to reschedule the collection day.

· Punctuality and Delay Notification: The contractor must notify the Water Program Manger immediately if they anticipate any delay in their arrival on the scheduled collection day.

· Laboratory personnel will be escorted to all sampling locations by the Water Program Manager for each weekly collection.

· The following federal holidays are observed:

· New Years Day – January 1

· Martin Luther King Jr – Third Monday in January

· President’s Day – Third Monday in February

· Memorial Day – Last Monday in May

· Juneteenth – June 19

· Independence Day – July 4

· Labor Day – First Monday in September

· Columbus Day – Second Monday in October

· Veterans Day – November 11

· Thanksgiving Day – Fourth Thursday in November

· Christmas Day – December 25

TYAD Security Operations Requirements Force Protection Condition (FPCON) Should the Force Protection Condition (FPCON) at the installation change, the Government may require changes in contractor security matters and/or processes.

If based on the requirements of this contract, contractor employees may be designated as mission essential. Mission-essential contractor employees are required to report for duty and remain on duty during declared emergencies and/or elevated FPCON levels unless otherwise directed by the Contracting Officer (KO) via the appropriate Contracting Officer's Representative (COR).

Unscheduled gate closures by Law Enforcement may occur at any time causing all personnel entering or exiting a closed installation to experience a delay. This cannot be predicted or prevented. Contractors are not compensated for unexpected closures or delays.

Vehicles operated by contractor personnel are subject to search pursuant to applicable regulations. Any moving violation of any applicable motor vehicle regulation may result in the termination of the contractor employee’s installation driving privileges.

The contractor’s employees shall become familiar with and obey the regulations of the installation, including law enforcement, fire, traffic, safety and security (protecting National security) regulations while on the installation. Contractor employees should only enter restricted areas when required to do so and only upon prior approval. All contractor employees shall carry proper identification with them at all times. The contractor shall ensure compliance with all regulations and orders of the installation which may affect performance.

(If Required) The contractor shall provide support during contingencies, exercises, heightened operations, and adverse weather or security closures in the accomplishment of performance requirements. From time to time, the Base Commander may decide to close all or part of a base in response to an unforeseen emergency or similar occurrence. Such emergencies include adverse weather such as snow, or ice, "an act of God,” such as tornado or earthquake, or a base disaster such as a gas leak or fire.

Emergency Communications and Services. If assigned to TYAD for (7) seven days or longer, contractors and subcontractor employees will enroll in the ALERT! Mass Warning Notification System (MWNS). Common Access Card (CAC) is required to register for ALERT!. If a CAC has not been deemed necessary for the contractor or subcontractor, the COR will provide the necessary information to TYADs Antiterrorism Officer or TYADs Emergency Manager in the Security Operations Branch for manual input into the ALERT! System.

ALERT! MWNS is NOT optional - it is a Headquarters Department of the Army (HQDA) requirement to be a registered user.

Due to the life-safety implications of the information being relayed and the requirement to provide immediate alerts and warnings, personnel assigned to TYAD must ensure that their personal contact information, including after-duty hours contact information, as appropriate (e.g., personal cellular phone numbers or landline phone numbers), e-mail addresses, home address, etc., are entered into the system and regularly updated or verified every 90 days to remain current and accurate.

In the event of a life-threatening emergency or natural disaster, COR will account for assigned contractors. COR will send personnel accountability report to Emergency Operations Center (EOC).

Base closure announcements will be disseminated via ALERT! MWNS.

Antiterrorism (AT) Level I Training. In accordance with AR 525-13, all contractor and subcontractor employees requiring access to Army installations, facilities, or controlled access areas shall complete AT Level I awareness training annually. This training must be completed prior to being granted installation access and beginning work. The contractor is responsible for ensuring this requirement is met and for providing certificates of completion for each employee to the COR upon request. The web-based training is available at https://jko.jten.mil (Course: JS-US007).

AT Level I and iWATCH training is not required to be in person. While in-person training is an option, the most common and widely accepted method is web-based. Army regulations explicitly provide multiple ways to meet the training requirement to ensure flexibility for all personnel, regardless of their location or access to a classroom setting.

iWATCH Army Training. This training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 calendar days of contract award and within 30 calendar days of new employees commencing performance with the results reported to the COR NLT 30 calendar days after contract award. Contractors and all associated sub-contractors will be briefed by the TYAD Antiterrorism/Force Protection officer. It is recommended this training be conducted as part of an initial entry briefing or unit/organization newcomer’s briefings. Send training requests to TYADs Antiterrorism Officer. Contractor employee training will be documented on a local form.

Access and General Protection/Security Policy and Procedures. Contractor and all associated sub-contractor employees shall comply with applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by TYAD Law Enforcement. Contractor workforce must comply with all personal identity verification requirements as directed by DoD, HQDA, and/or local policy.

Contractor and all associated sub-contractor employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB) (Army Directive 2014-05/AR 190-13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by the government representative), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

A background check and approval from TYAD Law Enforcement is required for all contractor and subcontractor personnel prior to on-site access at TYAD. All persons seeking entrance to TYAD shall submit to and comply with all security standards and requirements in force at the time such persons are seeking entry. All contractors, regardless of resident status or citizenship, will be subject to vehicle search and intense in-processing by TYAD security personnel prior to being granted access to TYAD. This security screening process may be time consuming, and access may be delayed or denied. The contractor shall ensure the required government access request form is completed. COR will provide specifics to the contractor after award and at least ten days prior to the expected visit date for completion. All the required fields on the form shall be accurate and complete. This requirement is inclusive of on-site supervisory or managerial personnel and sub-contractor personnel that the contractor anticipates will be performing work or visiting on-site. This security screening does not relieve the contractor of any responsibilities to conduct thorough pre-employment background checks and drug screening. Contractor workers will not be granted access to the work site until security screening is completed and access is approved. Any contractor personnel on-site who fail screening will not be permitted further access to TYAD.

Submit the completed local form(s) to the COR. Ensure contracts include the provisions that check for the possibility of and prevent undocumented workers for inclusion in contracted work related to Army missions.

The company will ensure that its employees entering Army-controlled installations or facilities have obtained access badges and passes in accordance with facility regulations and that these badges and passes are obtained in advance so as not to delay the accomplishment of contracted services.

Pre-Bid Site Visit Controls: Any pre-bid site visits held before the contract award will be conducted under strict security controls. These protocols—including mandatory pre-registration for baseline vetting and constant escorting—apply to all potential bidders, regardless of any previous work history with TYAD or current installation access. During this public solicitation phase, a contractor's prior access or familiarity with the installation does not grant them a "need-to-know" for a new requirement. All bidders will be treated as external entities, and the site visit is strictly for a visual inspection of physical conditions only.

Post-Award Information Release: Conversely, all project specifics—including exact locations, detailed plans, and mission context—can and must be provided to the contractor only after the contract is awarded and their personnel have completed all mandatory security training (AT, OPSEC, CUI). At this stage, the contractor has an established "lawful government purpose," and the controlled release of detailed information is appropriate and necessary for the performance of the contract.

Common Access Card (CAC): [If applicable.] Before CAC issuance, the contractor employee requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation in accordance with Army Directive 2014-05. The contractor employee will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) Remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) Physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

Contractors shall be identified with Government issued identification card (e.g., Common Access Card (CAC) or unit specified identification card). When required, contractor personnel shall comply with local security policies to wear their identification card in a standardized manner, clearly visible attached to the torso of the exterior garment above the belt and below the shoulders except when in use (i.e., inserted in a computer CAC reader) or when in controlled areas requiring other credentials as the primary method of identification. To access any Government base and certain facilities, the contractor shall present required identification card upon demand. Upon exit from Government facilities, the contractor shall conceal their credentials (CAC or other credentials) from plain view. The contractor and Contractor Security Manager/Officer shall coordinate with the COR for Government credential issues.

For contractors that do not require CAC, but require access to a DoD facility or installation: Contractor and all associated subcontractor employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (Army Directive 2014-05/AR 190-13); applicable installation, facility and area commander installation and facility access and local security policies and procedures (provided by Government representative); or, at OCONUS locations, in accordance with status-of-forces agreements and other theater regulations.

Collection of Badges: The Contractor shall account for all forms of Government-provided identification issued to the Contractor employees in connection with performance under this contract. The Contractor shall return such identification to the issuing agency at the earliest of any of the following, unless otherwise determined by the Government:

1. When no longer needed for contract performance

2. Upon completion of the Contractor employee’s employment

3. Upon contract completion or termination The Contracting Officer may delay final payment under a contract if the Contractor fails to comply with these requirements. The Contractor shall insert the substance of this clause, including this paragraph, in all subcontracts when the subcontractor’s employees are required to have routine physical access to a federally controlled facility and/or routine access to a federally controlled information system. It shall be the responsibility of the prime Contractor to return such identification to the issuing agency in accordance with the terms set forth in of this section, unless otherwise approved in writing by the Contracting Officer. The company will return all issued U.S. Government Common Access Cards, installation badges, and/or access passes to the COR when the contract is completed or when a contractor employee no longer requires access to the installation or facility. Contractor personnel will obtain a vehicle pass for access to the military installation and Common Access Cards (CAC) for computer access, if applicable.

Threat Awareness and Reporting Program (TARP). [If applicable.] For all contractors with security clearances, per AR 381-12, TARP contractor employees must receive initial and annual TARP training by a CI Agent or other trainer as specified.

Insider Threat Program. The contractor will establish and maintain an insider threat program to gather, integrate, and report relevant and available information indicative of a potential or actual insider threat, consistent with E.O. 13587 and Presidential Memorandum “National Insider Threat Policy and Minimum Standards for Executive Branch Insider Threat Programs.”

Operational Security (OPSEC). OPSEC is not a one-time checklist, it is a dynamic, ongoing process embedded in every phase of planning, execution, and daily operations. It requires continuous critical thinking and vigilance from everyone who interacts with government information or operates on a government installation. This includes military personnel, Department of Defense civilians, contractors, subcontractors, and family members. OPSEC is not just a policy, it’s a mindset. Its success depends on consistent awareness and execution by every member of the TYAD community.

At TYAD, all observations, communications, and experiences must be protected and must not be shared with anyone lacking a lawful government purpose or a validated business need-to-know. This disciplined approach ensures that emerging threats, evolving vulnerabilities, and shifting mission parameters are constantly reassessed and addressed to safeguard critical information.

OPSEC applies across the full spectrum of DoD missions, functions, programs, and activities under this contract. Practicing OPSEC daily is a requirement that is essential to mission success and the protection of national security assets.

Failure to properly safeguard sensitive or classified information—whether through negligence, willful misconduct, or ignorance—may result in administrative, disciplinary, contractual, or criminal consequences.

Applicability and Management of the Contractor OPSEC Plan The requirement for an Operations Security (OPSEC) Plan or an OPSEC Standing Operating Procedure (SOP) is based on the contractor's access to and handling of Critical Information and/or Controlled Unclassified Information (CUI), regardless of where that information resides. It is essential to distinguish between Information Security (INFOSEC), which protects data "at rest" within a system, and OPSEC, which protects data "in use" by governing the procedures and actions of personnel.

When contractor personnel access or handle CUI—such as building floor plans, technical manuals, or operational schedules—they are required to have an approved OPSEC Plan/SOP. This plan is the formal, documented agreement that outlines how the contractor will protect the government's sensitive information. Even when CUI is handled exclusively on Government Furnished Equipment (GFE), the contractor remains responsible for the "human factor." The OPSEC Plan transfers the responsibility for protecting this information from the Government to the contractor by legally obligating them to establish internal procedures for everything from secure physical storage and controlled discussions to the proper destruction of materials. Without this plan, the Government retains all risk for how a contractor safeguards its data.

The management and approval of the contractor's OPSEC Plan is a shared responsibility, with defined roles at each stage. Per government acquisition and security policy, it is the Contracting Officer's Representative (COR) who is ultimately responsible for the initial identification and final enforcement of this requirement. The process is as follows: The COR (designated technical representative) identifies the need for an OPSEC Plan based on the work described and writes the requirement into the Statement of Work (SOW). After contract award, the COR enforces this by ensuring the contractor submits the plan on time. The Contracting Officer (KO) ensures the requirement is legally binding in the final contract and is the sole authority to take contractual action for non-compliance. Finally, the Government OPSEC Officer, as the technical expert, is responsible for reviewing the submitted plan against AR 530-1 and providing the formal approval or rejection back to the COR.

OPSEC Training Requirements. In accordance with AR 530-1 (4-2-a), all contractors and subcontractors shall complete OPSEC Level I certification training (Initial and Continual – detailed below).

The Contracting Officer’s Representative (COR) serves as the oversight authority: the COR verifies contractual compliance by collecting and reviewing certificates, ensuring they’re submitted within the required timeframe – first 30 days of assignment.

According to AR 530-1 (para 4-2) and DoDM 5205.02, there is no “grace period” or minimum number of days on-site before OPSEC Level I Initial and Continual training becomes mandatory—any contractor, subcontractor, or support‐service provider who requires access to TYAD information, systems, or facilities must complete both parts of their OPSEC Level I training.

OPSEC Level I training is comprised of two parts (Initial and Continual):

1. OPSEC Level I Initial training

· To be completed within first 30 days of assignment to TYAD and annually thereafter – preferably before the job starts

· Provides specific information about TYADs OPSEC program

· Contractors and subcontractors must set up an appointment with TYADs OPSEC Officer for Initial training. The COR will provide the necessary point of contact to schedule this training.

· Conducted by TYAD’s OPSEC officer or alternate – training can be in person or via MS Teams (30 minutes) and is tracked by a TYADs OPSEC Officer via a local training form

2. OPSEC Level I Continual training:

· Commonly referred to as annual OPSEC training

· To be completed within 30 days of assignment to TYAD and annually thereafter – preferably before the job starts

· Provides general information about OPSEC and reemphasizes sound OPSEC practices throughout the contract period

· Title of the training is: “OPSEC Awareness for Military Members, DoD Employees and Contractors” and is available online - https://securityawareness.dcsa.mil/opsec/index.htm

· Certificates of completion must go to the COR OPSEC Measures to Protect Critical Information. This section is critical because it moves beyond a simple, vague requirement to “practice OPSEC” and provides the contractor with specific, actionable, and enforceable rules of behavior.

All contractors and subcontractors shall implement the following mandatory OPSEC measures during the entire period of performance to protect critical and sensitive unclassified information:

1. Training and Compliance: Complete all mandatory OPSEC training as specified in this contract and actively apply all TYAD OPSEC measures in daily, contract-related operations.

2. Secure Communications: Avoid discussing government operations in public spaces or over unprotected communications (e.g., personal cell phones). Transmit Controlled Unclassified Information (CUI) only through authorized, encrypted channels as directed in the SOW/PWS = DoD Safe Access File Exchange (SAFE) is the accredited method for sending files that contain CUI, Personally Identifiable Information (PII), or other sensitive data that should not be transmitted over unencrypted, commercial email channels. The files are encrypted during the transfer process.

3. Public Release and Social Media Prohibition: Do not disclose or post any images, data, or operational details (e.g., maps, pictures, schedules, equipment, tactics) to any unofficial media, including personal or corporate social media platforms. All information or materials intended for public release require a documented OPSEC review by a TYAD certified OPSEC Level II reviewer. Coordinate all press releases through the COR and TYADs Public Affairs Office.

4. Reporting Requirements: Immediately report any attempts by unauthorized third parties to solicit sensitive information to the TYAD Security Operations Branch, the contract POC, and the contractor's Facility Security Officer (FSO).

5. Credential Control: Conceal or remove all government-issued badges and identification when off the installation. Do not duplicate, loan, or leave credentials unattended (CACs, badges, and/or parking passes or placards). Report any lost or stolen passes/badges/credentials to TYAD Law Enforcement Branch. The COR will provide all POC contact information.

6. Protection of Sensitive Data: Mark and protect internal company data related to this contract (e.g., schedules, deliverables, vulnerability reports) as CUI. All government-provided information, such as drawings and technical data, must be protected in accordance with DoD, Army guidance and guidance within contract package documents.

7. Information Disposal: At contract completion or upon Government request, return all government information to the COR or destroy it in accordance with approved TYAD procedures for handling CUI.

Photography or Videography. Contractors and subcontractors who will require photography or videography at TYAD must notify their COR at least fourteen business days in advance and complete OPSEC Level I Initial training. The COR will provide contractors with the contact information for points of contact within the security branch after award. All individuals must follow TYAD policy regarding photography and the use of personal electronic devices.

All photos and videos must then undergo an OPSEC Review—per AR 530-1 Chapter 4—to evaluate them against TYAD’s Critical Information List and identify any vulnerabilities. That review must be fully documented and signed off by a TYAD employee who holds OPSEC Level II certification (example: TYAD OPSEC Officer or Public Affairs personnel) before any imagery is distributed.

COMMUNICATIONS SECURITY (COMSEC) (If applicable) All telephonic and electronic communications with DoD organizations are subject to Communications Security (COMSEC) review and monitoring. The contractor is advised that any calls placed to or received from a DoD organization may be subject to monitoring and recording. The contractor shall ensure frequent dissemination of this notice to all employees who communicate with DoD personnel.

Information Security (INFOSEC). The contractor shall comply with all applicable regulations for the protection of government information. Information handled under this contract is categorized as either Controlled Unclassified Information (CUI) or Classified National Security Information (CNSI).

Controlled Unclassified Information (CUI) The handling, marking, safeguarding, and destruction of all CUI shall be in strict accordance with DoD Instruction 5200.48, Controlled Unclassified Information (CUI). Specific contractor responsibilities are detailed in the "Safeguarding CUI" section of this document.

CUI Training Requirement Any contractor or subcontractor personnel who will have access to CUI under this contract must complete mandatory CUI training prior to accessing such information. The "DoD Mandatory Controlled Unclassified Information (CUI) Training" course available on the DCSA CDSE Security Awareness Hub (https://securityawareness.dcsa.mil/cui/) satisfies this requirement. Completion certificates shall be provided to the COR upon request.

Contractor Responsibilities for Handling CUI The contractor shall comply with all CUI requirements outlined in Executive Order 13556 and 32 CFR Part 2002. The contractor's responsibilities include, but are not limited to:

· Marking: Applying uniform CUI markings to all CUI data and deliverables.

· Access Controls: Restricting CUI access to personnel with a lawful government purpose and validated need-to-know.

· Flow Down: Ensuring all CUI protection requirements are passed down to subcontractors.

· Physical Safeguarding: Implementing appropriate physical controls (e.g., locked storage, controlled-access areas) for all CUI, whether in hard copy or on electronic media.

· Incident Reporting: Reporting any actual or suspected loss or compromise of CUI to the COR immediately.

· Disposition: Returning all CUI to TYAD control or destroying it in accordance with DoD and Army guidelines upon contract completion.

Classified National Security Information (CNSI) (If applicable) If this contract requires access to CNSI, all such information shall be handled, stored, and protected in strict accordance with AR 380-5, Army Information Security Program, the National Industrial Security Program Operating Manual (NISPOM), and the security classification guidance provided in the DD Form 254 issued for this contract.

SECURITY CLEARANCES AND ACCESS TO CLASSIFIED INFORMATION (If applicable) Performance of this contract requires contractor access to Classified National Security Information. The definitive guidance for classification requirements is provided in the DD Form 254, Contract Security Classification Specification, which is attached to and made a part of this contract.

The contractor shall comply with FAR 52.204-2, Security Requirements, the Security Agreement (DD Form 441), and the National Industrial Security Program Operating Manual (NISPOM). The contractor is responsible for ensuring all personnel who require access to classified information possess the appropriate security clearance and need-to-know before access is granted.

Physical Security.

Safeguarding of Government Property The Contractor shall be responsible for safeguarding all government equipment, information, and property provided for Contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

Key Control (If applicable) The Contractor shall establish and implement methods of making sure all keys and key cards issued to the Contractor by the Government are not lost, misplaced, or used by unauthorized personnel.

· No keys issued by the Government shall be duplicated.

· The Contractor shall develop a key control procedure, to be included in their Quality Control Plan, which includes procedures for the turn-in of keys by personnel who no longer require access.

· The Contractor shall immediately report any lost or duplicated keys to the Contracting Officer (KO). In the event a key is lost or duplicated, the Government may, at its option, re-key or replace the affected locks, and the total cost shall be deducted from the monthly payment due to the Contractor.

Lock Combinations (If applicable) The Contractor shall establish and implement methods to ensure that lock combinations are not revealed to unauthorized personnel. The Contractor shall ensure combinations are changed when personnel with knowledge of the combination no longer have a need-to-know.

As prescribed in 204.7504(a), use the following clause:

CONTRACTOR COMPLIANCE WITH THE CYBERSECURITY MATURITY MODEL CERTIFICATION LEVEL REQUIREMENTS (NOV 2025)

(a) Definitions. As used in this clause- Controlled unclassified information means information the Government creates or possesses, or information an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls (32 CFR 2002.4(h)).

Current means—

(1) With regard to Conditional Cybersecurity Maturity Model Certification (CMMC) Status—

(i) Not older than 180 days for Conditional Level 2 (Self) assessments and Conditional Level 2 (certified third-party assessment organization (C3PAO)) assessments, with—

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Conditional CMMC Status date (see 32 CFR 170.16 and 170.17); and

(B) A corresponding affirmation of continuous compliance by an affirming official (see 32 CFR 170.4); and

(ii) Not older than 180 days for Conditional Level 3 (Defense Industrial Base Cybersecurity Assessment Center (DIBCAC)) assessments, with—

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Conditional CMMC Status date (see 32 CFR 170.18); and

(B) A corresponding affirmation of…