Bidders Library Security - DISAI 240-110-40.pdf

DEFENSE INFORMATION SYSTEMS AGENCY

P. O. BOX 549

FORT MEADE, MARYLAND 20755-0549

DISA INSTRUCTION 240-110-40* 26 June 2017

SECURITY

Multihazard Preparedness and Response (MHP&R)

1. Purpose. This Instruction prescribes policy and assigns responsibilities and duties for multihazard preparedness and response (MHP&R). It addresses threat intelligence support to DISA elements, MHP&R plans, communication of an emergency, hazard alerts and warnings, multihazard assessments, and training and exercises.

2. Applicability. This Instruction applies to areas and facilities physically controlled or managed by the Defense Information System Agency (DISA), Joint Force Headquarters – Department of Defense Information Networks (JFHQ-DODIN), DISA elements that are tenants on other government installations, DISA-occupied and leased facilities located outside a DoD installation, and areas located within DISA facilities that are manned or operated by contractors supporting a DISA project.

3. Authority. This Instruction is published in accordance with the authority contained in DoD Instruction O-2000.16, Volume 1, DoD Antiterrorism (AT) Program Implementation:

DoD AT Standards, 17 November 2016, and DoD Instruction O-2000.16, Volume 2, DoD Antiterrorism (AT) Program Implementation: DoD Force Protection Condition (FPCON), 17 November 2016.

4. Definitions.

4.1 Antiterrorism (AT). Defensive measures used to reduce the vulnerability of individuals and property to terrorist acts, to include rapid containment by local military and civilian forces.

4.2 Force Protection. Protective measures taken to mitigate hostile action against DoD personnel, to include family members, and resources, facilities, and critical information.

4.3 Human-Induced Threat. Hazards that are the result of human intent, negligence, error, or involve the failure of a manmade system (i.e., terrorist attacks, active shooters, bombings, accidental or intentional release of a hazardous chemical or toxic material, etc).

4.4 Natural Occurring Threat. Hazards that are initiated and sustained absent a human catalyst, often referred to as "Acts of God" (i.e., floods, tornadoes, blizzards, earthquakes, etc.).

DISAI 240-110-40

5. Policy.

5.1 Proactive measures and procedures that focus on the deterrence, detection, prevention, response to, and recovery from acts or events occurring from human-induced and naturally occurring threats will be established and maintained by the Agency.

5.2 Offices of primary responsibility (OPRs) will be established within each element to identify, implement, and maintain comprehensive preparedness and response plans specifically tailored to the unique operating environment of each DISA element.

5.3 Periodic assessments, program reviews, and inspections will be used to ensure prescribed policies and procedures are in compliance with DoD, appropriate combatant command, and DISA-specific guidance.

5.4 An annual multihazard preparedness and response exercise that validates the measures and procedures specifically developed to detect, respond to, and recover from human-induced and naturally occurring hazards will be conducted by each DISA element. (While a table top exercise (TTX) is acceptable, a thorough, realistic exercise is more representative of a team's ability to respond to an actual threat.)

5.5 All new construction, renovation, and relocation plans will be reviewed for antiterrorism (AT) concerns and must meet the minimum prescriptive standards outlined in Unified Facilities Criteria (UFC) 4-010-01, DoD Minimum Antiterrorism Standards for Buildings.

5.6 Contractor participation in emergency response exercises that teach emergency evacuation procedures, shelter-in-place actions, active shooter responses, responses to suspicious packages, and responses to naturally occurring threats are mandatory within all DISA elements.

6. Responsibilities.

6.1 Directors, Executives, Commanders, and Chiefs of Major Organizational Elements.

These individuals will:

6.1.1 Ensure personnel and resources under their operational control are adequately protected from potential hazards; such as, terrorism, workplace violence, severe weather, etc.

6.1.2 Ensure threat, vulnerability, and risk assessments covering personnel, facilities, and assets under their control are conducted.

6.1.3 Ensure appropriate memorandums of agreement (MOAs) or installation support agreements (ISAs) with geographic combatant commanders cover Agency personnel and activities with regards to antiterrorism (AT) and force protection (FP).

6.1.4 Review the organizational MHP&R plan annually or as threat changes.

6.2 Workforce Services and Development Directorate (WSD) Chief, Security Division (MP6). The WSD Chief, MP6, will:

6.2.1 Oversee MHP&R activities through program reviews and site assessments of DISA elements, to include DISA's geographically separated sites.

6.2.2 Designate a full time Agency MHP&R Program Manager, in writing, to supervise, implement, review, and assess the AT and FP readiness posture of the Agency.

6.2.3 Review, approve, and direct the dissemination of all pertinent intelligence information regarding human-induced or naturally occurring threats to DISA personnel and property.

6.2.4 Maintain an operational level of expertise in the prevention and detection of terrorism for DISA personnel and facilities and provide technical guidance, as necessary, to the DISA senior staff. (Attendance of a DoD-approved AT Level IV course is highly recommended for this position.)

6.2.5 Establish and maintain a program by which multihazard vulnerability assessments and program reviews are conducted by a qualified assessment team, in accordance with DoDI O-2000.16 (authority document).

7. Duties.

7.1 Multihazard Preparedness and Response (MHP&R) Program Manager Duties.

The MHP&R Program Manager will:

7.1.1 Ensure approved MHP&R measures are addressed within all Agency activities to include, where applicable, negotiations with facility owners, ISAs with host installations, and contracts obtained through the General Services Administration (GSA).

7.1.2 Advise the Command Staff on all concerns and issues involving human-induced or naturally occurring hazards that may affect the Agency's mission or its workforce.

7.1.3 Coordinate and/or conduct MHP&R vulnerability and risk assessments for DISA areas of responsibility (AORs), as required by DoDI O-2000.16 (authority document).

7.1.4 Conduct and or coordinate MHP&R training for the Agency's workforce in the form of formal and informal briefings and online training and track and report mandatory training, as required.

7.2 Chemical, Biological, Radiological, Nuclear, and High-Yield Explosives (CBRNE) Defense and Emergency Management (EM) Program Manager. The CBRNE Defense and EM Program Manager will:

7.2.1 Ensure the National Incident Management System (NIMS) and the Incident Command System (ICS) are utilized to the greatest extent possible when DISA elements are or may be impacted by scenarios involving CBRNE hazards or natural disasters.

7.2.2 Develop communications and information sharing capabilities with Federal, State, local, and host-nation intelligence and law enforcement organizations that will prevent, deter, or miti-gate hazardous incidents (CBRNE or natural disasters) against the Agency or its personnel, property, or interests.

7.2.3 Develop and provide timely, resource-capable courses of action (COAs) to the Agency's leadership that support effective crisis and consequence management.

7.2.4 Conduct an annual multihazard vulnerability analysis and risk assessment to determine Agency shortfalls and vulnerabilities to CBRNE hazards and natural disasters.

7.2.5 Assist with the coordination and/or conduct of CBRNE preparedness and response training and education that will incorporate the Agency's workforce worldwide.

7.3 Security Manager (SM) and Antiterrorism Officer (ATO). An SM and ATO will:

7.3.1 Develop and manage the assigned elements or site programs which focus on emergency preparedness and response protocols that address the hazards identified in the host installation's design basic threat (DBT) assessment or the DBT assessment developed by the element.

7.3.2 Prepare and forward standard and special reports to the MHP&R Program Manager, as required.

7.3.3 Provide or coordinate all MHP&R related exercises and drills with the assigned element's workforce and maintain all organizational records of MHP&R training and exercises conducted for a minimum of 2 years after the event.

7.3.4 Provide, coordinate, and ensure all DISA personnel (civilian, military, and contractors) comply with and follow the Agency's foreign travel requirements.

7.4 Civilian Employee, Military Member, and Contractor. These individuals will:

7.4.1 Be vigilant in their duties and maintain situational awareness at all times.

7.4.2 Report, to the appropriate authority, any incident, action, or situation that could possibly lead to the destruction or degradation of the Agency's mission or harm to the DISA workforce.

7.4.3 Complete all mandatory security-related training (AT Level I Awareness, Violence in the Work Place Prevention (VITWP), Security Awareness, Antiterrorism Foreign Travel Brief, etc.)

and, to the greatest extent possible, attend recommended training sessions that will enhance the individual's knowledge of the Agency's emergency preparedness and response protocols (i.e., Occupant Emergency Plan (OEP), Threat Awareness, Shelter-in-Place Procedures, and Active Shooter Response, etc.)

7.4.4 Provide feedback to the Security Division (MP6) on discovered or unresolved security issues that could adversely affect mission readiness or employee safety.

8. Threat Intelligence Support to DISA Elements.

8.1 The sharing of information between the Services, DoD, and local law enforcement agencies is critical to protecting the DISA workforce and, therefore, DISA's mission. Although DISA is not a collection agency, it still receives intelligence information used to plan appropriate opera-tional and security protocols to protect DISA's workforce and mission.

8.2 Cooperative and resourced detection and response actions shall be establishmented to ensure tactics, techniques, and procedures (TTPs) that promote workforce situational awareness implemented within the DISA AOR. Antiterrorism Fusion Cells and Threat Working Groups are two widely used forums to which ATOs and SMs should contribute, as these groups provide intelligence that has already been analyzed along with procedures to integrate deterrence and detection COAs to mitigate the impact of identified threats.

9. MHP&R Plans.

9.1 A comprehensive and executable organization, facility, or installation MHP&R plan that provides site-specific guidance and prescribes measures and procedures to detect, deter, protect, mitigate, respond to, and recover from probable human-induced and naturally occurring disasters is to be developed by each DISA site.

9.2 The MHP&R plans developed for DISA sites that are located on a DoD installation must be coordinated with that host installation's Antiterrorism Officer (ATO) or Emergency Preparedness Officer to ensure planned procedures are executable and properly resourced.

DISA elements and facilities that are not on or supported by a DoD installation will coordinate their plan development with the local emergency responders and the DISA MHP&R Program Manager.

10. Communication of an Emergency. All inhabited buildings must have a timely means to notify occupants of a threat(s) and to instruct the occupants in carrying out the proper response to the threat(s). The systems and/or procedures used must have the capability to provide real-time information to building occupants and personnel in the immediate vicinity of the threat.

The information relayed must be specific enough for the workforce to determine the appropriate response actions based on established response procedures. (Specific response actions will be outlined in each facility Occupant Emergency Plan (OEP). [The plan will be readily available to all DISA employees and briefed to every new employee during the new employee orientation

(NEO).])

10.1 Selected mass notification systems shall have primary and alternate(s) activation points and means to provide alert notification for visually and hearing impaired personnel (i.e., visual signals; such as, flashing lights to alert hearing impaired personal and horns or sirens for visually impaired personnel).

10.2 Site-specific procedures designed to receive and disseminate information to members of the workforce and their visitors (i.e., posting of force protection conditions (FPCONs), mass notification systems, e-mail blasts, etc.) will be established at each DISA element.

Dissemination methods must be established for routine work hours and after-hours notifica-tions. Phone rosters, e-mail lists, text message blasts, and social media sites can be also be used when establishing methods of communication. Established procedures must be practiced every 6 months.

10.3 Incidents, such as terrorist actions, naturally occurring hazards, criminal acts, etc., that physically threaten mission accomplishment must be communicated to the Security Division (MP6), as well as the DISA Command Center (DCC), as soon as possible using the most expedient method available.

11. Multihazard Assessments. Threat, vulnerability, and risk assessments will be conducted as the first step in developing MHP&R measures and procedures. The assessment will identify the threats against the assets involved, potential methods of attack, the assets' vulnerabilities to those threats, and level of risk to personnel and property. The frequency of assessments conducted on DISA elements will be based on mission, location, and population size. For example, a DISA element with an average daily population of 100 personnel will receive a Higher Headquarters (HHQ) MHP&R Assessment every 2 years. An element with an average daily population of less than 100 personnel will receive a HHQ MHP&R Assessment every 3 years depending on mission criticality or location. Some elements, regardless of size, will receive an annual assessment based on their geographical location or mission criticality.

All assessments will be conducted by qualified individuals, as required by Standards 3, 4, 5 and 6 in DoDI O-2000.16 (authority document). Results of all assessments, to include risk management decisions, will be provided to the MHP&R Program Manager within 60 days of assessment completion.

12. Training and Exercises. With assistance and guidance from the MHP&R Program Manager, each DISA activity will conduct training and exercise scenarios that enhance the overall knowledge and situational awareness of DISA civilian employees, military members, and supporting contractors.

12.1 Exercises will be conducted periodically throughout the calendar year, with a minimum of one annual exercise that will test the full response capability of the Agency's headquarters complex and each DISA geographically separated activity, in accordance with their responsi-bilities, as specified in their emergency response action plans.

12.2 DISA activities that are located on a host installation are encouraged to conduct exercises in conjunction with the installation's annual AT and FP exercise. The scope of the exercise will depend on the size, availability of resources, and response capabilities of the DISA element.

For example, a DISA activity with no command and control (C2) authority over the installa-tion or facility in which they reside will train their personnel on alert notification procedures, immediate response actions, and how to contact emergency responders. DISA activities with C2 authority will conduct the same training and exercise functions but will also maintain their C2 roles during an emergency.

ANDRES A. LOPEZ

Chief of Staff (Acting)

SUMMARY OF SIGNIFICANT CHANGES. This revision provides updated guidance concerning DISA antiterrorism (AT) and force protection (FP); emergency management;

and chemical, biological, radiological, muclear, and high-yield explosives (CBRNE) awareness, defense, and response for DISA-owned and -occupied facilities.

*This Instruction replaces DISAI 240-110-40, 24 October 2012.

OPR: WSD - disa.meade.mps.mbx.mps-front-office@mail.mil DISTRIBUTION: Approved for public release. Distribution is unlimited.