Attachment 14 - Draft Security Plan Instr.pdf

Attachment 14

Draft Security Plan Instructions

Section I. Security Administration:

1. Security Program: The offeror shall have a comprehensive security program that provides a security plan for the overall protection of personnel, information, data, and facilities associated with fulfilling the BARDA requirement. The offeror’s proposal shall include a security plan which establishes security practices and procedures that demonstrate how the offeror will meet and adhere to the security requirements outlined in Section II (noted below) by time of contract award. The offeror shall also ensure that other entities (sub-contractors, consultants, etc.) performing work on behalf of the offeror establishes and manages a security program that is in compliance with BARDA security requirements.

2. Facility Security Plan: As part of the offeror’s overall security program, the offeror shall submit a written security plan (in their proposal) to the Contracting Officer to be evaluated by the Technical Evaluation Panel (TEP), which will include a member of BARDA’s Program Protection Office. Performance of work under the BARDA contract will be in accordance with the offeror’s approved security plan. The offeror’s security plan will include the following processes and procedures at a minimum:

(a) Security Administration: Organization and responsibilities; security risk assessment for site; threat levels identification; security procedures during elevated threats; liaison with law enforcement; security education and training.

(b) Personnel Security Policies and Procedures: Candidate recruitment process; background investigations; employment suitability policy; access determination;

rules of behavior/ conduct; termination procedures; non-disclosure agreements.

(c) Physical Security Policies and Procedures: Internal / external access control; protective services; identification/ badging; visitor access controls; parking areas and access control; perimeter fencing / barriers; shipping, receiving and transport;

security lighting; restricted areas; signage; intrusion detection systems; alarm monitoring / response; closed circuit television; product storage security; other control measures.

(d) Information Security: Identification of sensitive information; access control;

storage of information; document control; retention/ destruction requirements.

(e) Information Technology Security Policies and Procedures: Intrusion detection and prevention systems; employee training; encryption systems; identification of sensitive information/ media; password policy; removable media policy; laptop policy;

media access control/ determination; secure storage; system document control; system backup; system disaster recovery.

3. Site master plan: Offeror shall provide a site schematic for security systems which includes: main access points; security cameras; electronic access points; bio-containment laboratories.

4. Site threat / risk assessment: Offeror shall provide a written risk assessment for the facility addressing: criminal threat; terrorist threat; industrial espionage; natural disasters;

and potential loss of critical infrastructure (power/water/natural gas, etc.) This assessment shall include recent data obtained from local law enforcement agencies.

Section II. Security Requirements:

1. Physical Security:

(a) Closed Circuit Television (CCTV) Monitoring:

• CCTV with time lapse video recording for exits / entrances to the facility and buildings where critical assets are processed and stored.

• Video recordings maintained for a minimum of 30 days.

(b) Lighting:

• Lighting covering perimeter, parking areas, entrances/exits. Lighting should have emergency power backup and be sufficient for CCTV.

(c) Receiving and Shipping:

• Receiving and shipping areas must have controlled access and contingency plans that implement modified procedures to restrict shipping and receiving to mission critical products during times of elevated threat.

(d) Physical Access Control:

• Intrusion Detection System with centralized monitoring system capability.

• Immediate notification / response to any alarms.

• Electronic system (i.e. card key) utilized to control access to areas where assets critical to the contract are located (facilities, laboratories, clean rooms, production facilities, warehouses, etc.)

(e) Employee/Visitor Identification:

• Photo identification for all personnel displayed at all times.

• Visitor control; identification; screening and accountability system.

(f) Security Fencing:

• Requirements for security fencing will be determined by the criticality of the program and the potential threat environment.

(g) Protective Security Forces:

• Requirements for a security force at the facility will be determined by the criticality of the program and the potential threat environment.

2. Security Operations:

(a) Information Sharing:

• Establish liaison with law enforcement and procedures for receiving and disseminating threat information.

(b) Training:

• Conduct new employee security awareness training.

• Conduct and maintain records of annual security awareness training.

(b) Security Management:

• Designate a knowledgeable employee to manage security operations.

3. Personnel Security:

(a) Records Checks / Interview:

• Verification of date of birth; citizenship; education; previous employment (5 year history); previous residences (5 year history);

national / local criminal records search; and a personal interview of candidate.

(b) Hiring / Retention Standards:

• Policies concerning hiring and retention of employees to include employee conduct and behavior standards.

4. Information Security:

(a) Physical Document Control:

• Applicable documents shall be identified and marked as procurement sensitive, proprietary or with appropriate government markings.

• Sensitive, proprietary and government documents should be maintained in a lockable filing cabinet / desk or other storage device.

(b) Document Destruction

• Documents shall be destroyed using approved destruction measures

(i.e. shredders / third party vendor / pulverizing / incinerator).

5. Information Technology Security:

(a) Access:

• Limit information system access to authorized users.

• Identify information system users, processes acting on behalf of users, or devices and authenticate identities before allowing access.

• Limit physical access to information systems and equipment.

(b) Training:

• ensure that personnel are trained and are made aware of the security risks associated with their activities and of the applicable laws, policies, standards, regulations, or procedures related to IT systems.

(c) Audit and Accountability:

• create, protect, and retain information system audit records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful, unauthorized, or inappropriate information system activity; and ensure that the actions of individual information system users can be uniquely traced to those users.

(d) Configuration Management:

• establish and enforce security configuration settings.

(e) Contingency Planning:

• establish, maintain, and implement plans for emergency response, backup operations, and post-disaster recovery for information systems to ensure the availability of critical information resources.

(f) Incident Response:

• establish an operational incident handling capability for information systems that includes adequate preparation, detection, analysis, containment, and recovery.

(g) Media Protection:

• protect information system media, both paper and digital; limit access to information on information system media to authorized users; and sanitize or destroy information system media no longer needed.

(h) Physical / Environmental Protection:

• limit physical access to information systems, equipment, and the respective operating environments to authorized individuals; protect the physical and support infrastructure for information systems;

• protect information systems against environmental hazards; provide appropriate environmental controls in facilities containing information systems.

6. Transportation Security: Adequate security controls shall be implemented to protect materials while in transit from theft, destruction, manipulation, or damage.

7. Security Reporting Requirements: The Offeror shall immediately report to the government any activity or incident that is in violation of established security standards or indicates the loss or theft of government products. The facts and circumstances associated with these incidents will be documented in writing for government review.

8. Security Audits: The Offeror agrees to formal security audits conducted at the discretion of the government. Security audits may include both prime and sub locations.

9. Waivers: Commensurate protective measures may be applied in lieu of mandated BARDA security requirements as long as the commensurate protective measure affords an equal level of protection for the asset. Requests for waivers to BARDA security requirements should be submitted through the contracting officer to the Program Protection Office, BARDA. The Deputy Director, BARDA or his / her designee has final approval authority for all waivers to security requirements.