Tobyhanna Onsite Contractors Security Safety and Environmental requirements.pdf

Version – JUL 2026

TOBYHANNA ARMY DEPOT ON-SITE CONTRACTOR WORKFORCE AND

VISITOR RESTRICTIONS

1. NON-RESIDENT/NON-IMMIGRANT ALIENS

a. All non-resident/non-immigrant aliens must have approval prior to being permitted access to Tobyhanna Army Depot (TYAD). Such approval must be obtained by requesting access through the following: apply at the alien-resident’s embassy; proceed to the U.S. Embassy; proceed to the Department of the Army; proceed to Army Materiel Command; proceed to U.S. Communications-Electronics Command; proceed to TYAD.

b. All non-resident/non-immigrant aliens granted access to TYAD are required to be escorted by Government personnel. One Government escort can accommodate a maximum of two non-resident/non-immigrant aliens.

c. Due to limited availability of Government personnel, contractors shall not be permitted to employ non-resident/non-immigrant aliens as part of the contractor’s on-site workforce. Limited exceptions to this restriction may be considered on a case-by-case basis. Such exceptions shall only be considered where a specialized skill or trade is not otherwise available, and even under such circumstances would only be considered for very limited duration, e.g., a few hours/days. However, even if limited exception is considered, access may still be denied. Contractors whose personnel are either denied entry to TYAD or permitted limited entry to TYAD due to the security requirements pertaining to non-resident aliens/non-immigrants are not relieved of their obligation to provide the required contract performance and must do so at no additional cost to the Government. Any contractor failing to perform or that fails to perform in a timely manner under such circumstances may be terminated for default or other contractual remedies as appropriate.

d. Due to limited availability of Government personnel, visitors requiring escort may not be permitted access, or access may be limited to a certain time and duration.

2. FOR THE PURPOSE OF FORMAL ESCORTED SITE VISITS

Resident aliens (immigrants) in possession of a valid Form I-551, Alien Registration Receipt Card (“Green Card”), are not required to obtain approval as set forth in paragraph 1.a. above (but see paragraph 5, below). Such individuals must have proper identification in addition to a valid form I-551 in their physical possession at all times while at TYAD. Individuals lacking proper identification and valid form I-555 will be denied access to TYAD.

3. SECURITY SEARCHES, IN-PROCESSING, AND SECURITY SCREENING

The DoD requires all installations to conduct a vetting process to determine fitness and eligibility for access. All visitors to the installation are subject to be vetted by Automated Installation Entry and/or NCIC-III, as well as a check of the Installation Bar List. The Contractor shall ensure its personnel have an acceptable form of identification to access Tobyhanna Army Depot. A Department of Defense Common Access Card, a state-issued Real ID, or a U.S.-issued passport are all acceptable forms of identification.

All persons seeking entrance to TYAD must submit to and comply with all security standards and requirements in force at the time such persons are seeking entry. All visitors and contractors, regardless of resident status or citizenship, will be subject to vehicle search and intense in-processing by TYAD Security personnel prior to being granted access to TYAD. This security screening process may be time consuming and access may be delayed or denied.

Any Contractors who will be working on site, company representatives who will be visiting periodically, and any companies or contractors requesting or requiring TYAD badges for other business reasons must submit a completed TYAD form 648-C to their contract or depot point of contact. The completed form must be submitted at least five

(5) workdays in advance of on-site performance for each employee intended for onsite performance or five (5) workdays in advance of visits or other business at the depot.

Any contractor employee (s) already on site who have not been screened, will be subject to security screening. This requirement is inclusive of on-site supervisory or managerial personnel and sub-contractor personnel that the Contractor anticipates will be performing work or visiting on-site. This security screening does not relieve the contractor of any responsibilities to conduct thorough pre-employment background checks and drug screening. Contractor workers will not be granted access to the work site until security screening is completed and access is approved. Any contractor personnel on site who fail screening will not be permitted further access to TYAD.

Within five (5) workdays of the submission of the documentation and TYAD form 648-C, the Government will have completed the security check and the Contractor shall be notified whether all listed personnel will be permitted to work on-site. However, actual access to Tobyhanna Army Depot by the roster personnel will remain contingent upon such resident alien (immigrant) individuals presenting two (2) forms of identification as they process into the Depot through the Security building: a valid Form I-551, Alien Registration Receipt Card (“Green Card”) in addition to at least one other verifiable form of identification. For resident alien personnel processing into Tobyhanna Army Depot (TYAD), the required secondary verifiable form of identification (to be presented alongside their valid Form I-551 "Green Card") must be an unexpired, original, physical document. Acceptable options include primary photo identification, such as a foreign passport containing a photograph and biographic information, or a valid state-issued driver's license or non-driver state identification card (even if marked "Not for Federal Official Use" or non-REAL ID compliant, as it is being paired with the I-551).

Alternatively, travelers may present official federal or employment credentials, which include a USCIS-issued Employment Authorization Document (EAD/Form I-766), a TSA-issued Transportation Worker Identification Credential (TWIC), a Federal PIV (Personal Identity Verification) Card or other U.S. Government-issued civilian/contractor badges, or a Veterans Health Identification Card (VHIC). Lastly, official bureaucratic or civil documents are also accepted, including an original, unlaminated Social Security Card, a certified copy of a U.S. Birth Certificate bearing an official seal, or a Certificate of U.S. Naturalization or Citizenship (Form N-550, N-570, or N-560).

4. SUBMISSION OF BIDS OR PROPOSALS

Bidders/offerors who hand carry bids or quotes do so at their own risk. Bidders/offerors are solely responsible for the timely submission of bids /proposals/quotations, any delays security measures notwithstanding.

5. CONTRACTOR ON-SITE WORKFORCE – ADDITIONAL SECURITY

REQUIREMENTS

A. This section is in addition to the requirements above regarding non-resident aliens (non-immigrants) for on-site performance. Prior to the commencement of performance under the contract and within seven (7) workdays of contract award, the Contractor shall submit to the Security Operations Branch Chief, Tobyhanna Army Depot, a roster of all contractor personnel, inclusive of on-site supervisory or managerial personnel and sub-contractor personnel, that the Contractor anticipates will be performing work on-site. The roster shall indicate which individuals are U.S. citizens and which are resident aliens (immigrants). The following documentation shall accompany the roster for each individual named on the roster as a resident alien (immigrant):

i) A copy of a verifiable form of identification, such as a state-issued Real ID, or a U.S.-issued passport.; and

ii) A copy of a valid Department of Justice Immigration and Naturalization Service Form I-551, Alien Registration Receipt Card (“Green Card”).

Contractors who fail to identify any and all resident aliens (immigrants) who will be used for on-site performance and who will seek access to Tobyhanna Army Depot as a worker for or through the contractor, inclusive of managerial and subcontractor personnel, may be subject to civil and criminal penalties and sanctions as well as contract remedies.

B. Within five (5) workdays of the submission of the roster, documentation, and TYAD form 648-C, the Government will have completed the security check and the Contractor shall be notified whether all listed personnel will be permitted to work on-site. However, actual access to Tobyhanna Army Depot by the roster personnel will remain contingent upon such resident alien (immigrant) individuals presenting two (2) forms of identification as they process into the Depot through the Security building: a valid Form I-551, Alien Registration Receipt Card (“Green Card”) in addition to at least one other verifiable form of identification. For resident alien personnel processing into Tobyhanna Army Depot (TYAD), the required secondary verifiable form of identification (to be presented alongside their valid Form I-551 "Green Card") must be an unexpired, original, physical document. Acceptable options include primary photo identification, such as a foreign passport containing a photograph and biographic information, or a valid state-issued driver's license or non-driver state identification card (even if marked "Not for Federal Official Use" or non-REAL ID compliant, as it is being paired with the I- 551). Alternatively, travelers may present official federal or employment credentials, which include a USCIS-issued Employment Authorization Document (EAD/Form I-766), a TSA-issued Transportation Worker Identification Credential (TWIC), a Federal PIV (Personal Identity Verification) Card or other U.S. Government-issued civilian/contractor badges, or a Veterans Health Identification Card (VHIC). Lastly, official bureaucratic or civil documents are also accepted, including an original, unlaminated Social Security Card, a certified copy of a U.S. Birth Certificate bearing an official seal, or a Certificate of U.S. Naturalization or Citizenship (Form N-550, N-570, or N-560).

C. The roster that the Contractor submits is amendable. However, up to five (5) workdays will be required to perform a security check on any personnel added to the roster. The Contractor is urged to include contingency or “back-up” personnel in the original roster in order to avoid delays due to roster amendment.

D. Contractors whose personnel are denied entry to TYAD due to the security requirements are not relieved of their obligation to provide the required contract performance and must do so at no additional cost to the Government. Any contractor failing to perform or that fails to perform in a timely manner under such circumstances may be terminated for default or be subject to other contractual remedies as appropriate.

(End of Note)

Security Requirements for All SOWs & PWSs (updated April 2026)

The information below is mandatory security requirements that must be incorporated into all Statements of Work and Performance Work Statements.

All Tobyhanna Army Depot (TYAD) contracts documents and other acquisition-related documents must ensure privacy and security controls follow this information, and that contractors, subcontractors, and service providers protect Privacy Act information in the same way the organization adhering to the Federal Acquisition Regulations (FAR) Privacy Act provisions (Subparts 24.1 and 24.2) and include the specified contract clauses (Parts 52.224-1 and 52.224-2), as appropriate, to ensure that personal information is protected as mandated.

(This section must be in the final contract) - Force Protection Condition (FPCON) Should the Force Protection Condition (FPCON) at the installation change, the Government may require changes in contractor security matters and/or processes.

If based on the requirements of this contract, contractor employees may be designated as mission essential. Mission-essential contractor employees are required to report for duty and remain on duty during declared emergencies and/or elevated FPCON levels unless otherwise directed by the Contracting Officer (KO) via the appropriate Contracting Officer's Representative (COR).

Unscheduled gate closures by Law Enforcement may occur at any time causing all personnel entering or exiting a closed installation to experience a delay. This cannot be predicted or prevented. Contractors are not compensated for unexpected closures or delays.

Vehicles operated by contractor personnel are subject to search pursuant to applicable regulations. Any moving violation of any applicable motor vehicle regulation may result in the termination of the contractor employee’s installation driving privileges.

The contractor’s employees shall become familiar with and obey the regulations of the installation, including law enforcement, fire, traffic, safety and security (protecting National security) regulations while on the installation. Contractor employees should only enter restricted areas when required to do so and only upon prior approval. All contractor employees shall carry proper identification with them at all times. The contractor shall ensure compliance with all regulations and orders of the installation which may affect performance.

The contractor, if required, shall provide support during contingencies, exercises, heightened operations, and adverse weather or security closures in the accomplishment of performance requirements. From time to time, the Base Commander may decide to close all or part of a base in response to an unforeseen emergency or similar occurrence. Such emergencies include adverse weather such as snow, or ice, "an act of God,” such as tornado or earthquake, or a base disaster such as a gas leak or fire.

(This section must be in the final contract) - Emergency Communications and Services. If assigned to TYAD for (7) seven days or longer, contractors and subcontractor employees will enroll in the ALERT! Mass Warning Notification System

(MWNS). Common Access Card (CAC) is required to register for ALERT!. If a CAC has not been deemed necessary for the contractor or subcontractor, the COR will provide the necessary information to TYADs Antiterrorism Officer or TYADs Emergency Manager in the Security Operations Branch for manual input into the ALERT! System.

ALERT! MWNS is NOT optional - it is a Headquarters Department of the Army (HQDA) requirement to be a registered user.

Due to the life-safety implications of the information being relayed and the requirement to provide immediate alerts and warnings, personnel assigned to TYAD must ensure that their personal contact information, including after-duty hours contact information, as appropriate (e.g., personal cellular phone numbers or landline phone numbers), e-mail addresses, home address, etc., are entered into the system and regularly updated or verified every 90 days to remain current and accurate.

In the event of a life-threatening emergency or natural disaster, COR will account for assigned contractors. COR will send personnel accountability report to Emergency Operations Center (EOC).

Base closure announcements will be disseminated via ALERT! MWNS.

(This section must be in the final contract) - Antiterrorism (AT) Level I Training. In accordance with AR 525-13, all contractor and subcontractor employees requiring access to Army installations, facilities, or controlled access areas shall complete AT Level I awareness training annually. This training must be completed prior to being granted installation access and beginning work. The contractor is responsible for ensuring this requirement is met and for providing certificates of completion for each employee to the COR upon request. The web-based training is available at https://jko.jten.mil (Course: JS-US007).

AT Level I and iWATCH training is not required to be in person. While in-person training is an option, the most common and widely accepted method is web-based.

Army regulations explicitly provide multiple ways to meet the training requirement to ensure flexibility for all personnel, regardless of their location or access to a classroom setting.

(This section must be in the final contract) - iWATCH Army Training. This training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 calendar days of contract award and within 30 calendar days of new employees commencing performance with the results reported to the COR NLT 30 calendar days after contract award. Contractors and all associated sub-contractors will be briefed by the TYAD Antiterrorism/Force Protection officer. It is recommended this training be conducted as part of an initial entry briefing or unit/organization newcomer’s briefings. Send training requests to TYADs Antiterrorism Officer. Contractor employee training will be documented on a local form.

https://jko.jten.mil/

(This section must be in the final contract) - Access and General Protection/Security Policy and Procedures. Contractor and all associated sub-contractor employees shall comply with applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by TYAD Law Enforcement. Contractor workforce must comply with all personal identity verification requirements as directed by DoD, HQDA, and/or local policy.

Contractor and all associated sub-contractor employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB) (Army Directive 2014-05/AR 190-13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by the government representative), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

A background check and approval from TYAD Law Enforcement is required for all contractor and subcontractor personnel prior to on-site access at TYAD. All persons seeking entrance to TYAD shall submit to and comply with all security standards and requirements in force at the time such persons are seeking entry. All contractors, regardless of resident status or citizenship, will be subject to vehicle search and intense in-processing by TYAD security personnel prior to being granted access to TYAD. This requirement is inclusive of on-site supervisory or managerial personnel and sub-contractor personnel that the contractor anticipates will be performing work or visiting on-site. This security screening process may be time consuming, and access may be delayed or denied. COR will provide specifics to the contractor after award and at least ten days prior to the expected visit date for completion. This security screening does not relieve the contractor of any responsibilities to conduct thorough pre-employment background checks and drug screening. Contractor workers will not be granted access to the work site until security screening is completed and access is approved. Any contractor personnel on-site who fail screening will not be permitted further access to TYAD. Ensure undocumented workers are not included in contracted work related to Army missions.

The company will ensure that its employees entering Army-controlled installations or facilities have obtained access badges and passes in accordance with facility regulations and that these badges and passes are obtained in advance so as not to delay the accomplishment of contracted services.

(This section must be in the final contract) - Pre-Bid Site Visit Controls: Any pre-bid site visits held before the contract award will be conducted under strict security controls. These protocols—including mandatory pre-registration for baseline vetting and constant escorting—apply to all potential bidders, regardless of any previous work history with TYAD or current installation access. During this public solicitation phase, a contractor's prior access or familiarity with the installation does not grant them a "need-to-know" for a new requirement. All bidders will be treated as external entities, and the site visit is strictly for a visual inspection of physical conditions only.

(This section must be in the final contract) - Post-Award Information Release:

Conversely, all project specifics—including exact locations, detailed plans, and mission context—can and must be provided to the contractor only after the contract is awarded and their personnel have completed all mandatory security training (AT, OPSEC, CUI).

At this stage, the contractor has an established "lawful government purpose," and the controlled release of detailed information is appropriate and necessary for the performance of the contract.

Common Access Card (CAC): [If applicable.] Before CAC issuance, the contractor employee requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation in accordance with Army Directive 2014-05. The contractor employee will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) Remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) Physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

Contractors shall be identified with Government issued identification card (e.g., Common Access Card (CAC) or unit specified identification card). When required, contractor personnel shall comply with local security policies to wear their identification card in a standardized manner, clearly visible attached to the torso of the exterior garment above the belt and below the shoulders except when in use (i.e., inserted in a computer CAC reader) or when in controlled areas requiring other credentials as the primary method of identification. To access any Government base and certain facilities, the contractor shall present required identification card upon demand. Upon exit from Government facilities, the contractor shall conceal their credentials (CAC or other credentials) from plain view. The contractor and Contractor Security Manager/Officer shall coordinate with the COR for Government credential issues.

(This section must be in the final contract) - For contractors that do not require CAC, but require access to a DoD facility or installation: Contractor and all associated subcontractor employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (Army Directive 2014-05/AR 190-13); applicable installation, facility and area commander installation and facility access and local security policies and procedures (provided by Government representative); or, at OCONUS locations, in accordance with status-of-forces agreements and other theater regulations.

(This section must be in the final contract) - Collection of Badges: The Contractor shall account for all forms of Government-provided identification (even visitor badges) issued to the Contractor employees in connection with performance under this contract.

The Contractor shall return such identification to the issuing agency at the earliest of any of the following, unless otherwise determined by the Government:

1. When no longer needed for contract performance

2. Upon completion of the Contractor employee’s employment

3. Upon contract completion or termination

The Contracting Officer may delay final payment under a contract if the Contractor fails to comply with these requirements. The Contractor shall insert the substance of this clause, including this paragraph, in all subcontracts when the subcontractor’s employees are required to have routine physical access to a federally controlled facility and/or routine access to a federally controlled information system. It shall be the responsibility of the prime Contractor to return such identification to the issuing agency in accordance with the terms set forth in of this section, unless otherwise approved in writing by the Contracting Officer. The company will return all issued U.S. Government Common Access Cards, installation badges, and/or access passes to the COR when the contract is completed or when a contractor employee no longer requires access to the installation or facility. Contractor personnel will obtain a vehicle pass for access to the military installation and Common Access Cards for computer access, if applicable.

Threat Awareness and Reporting Program (TARP). [If applicable.] For all contractors with security clearances, per AR 381-12, TARP contractor employees must receive initial and annual TARP training by a CI Agent or other trainer as specified.

Insider Threat Program. [If applicable.] The contractor will establish and maintain an insider threat program to gather, integrate, and report relevant and available information indicative of a potential or actual insider threat, consistent with E.O. 13587 and Presidential Memorandum “National Insider Threat Policy and Minimum Standards for Executive Branch Insider Threat Programs.”

(This section must be in the final contract) - Operations Security (OPSEC).

OPSEC is mandatory for all and is not a one-time checklist, it is a dynamic, ongoing process embedded in every phase of planning, execution, and daily operations. It requires continuous critical thinking and vigilance from everyone who interacts with government information or operates on a government installation. This includes military personnel, Department of Defense civilians, contractors, subcontractors, and family members. OPSEC is not just a policy, it’s a mindset. Its success depends on consistent awareness and execution by every member of the TYAD community.

At TYAD, all observations, communications, and experiences must be protected and must not be shared with anyone lacking a lawful government purpose or a validated business need-to-know. This disciplined approach ensures that emerging threats, evolving vulnerabilities, and shifting mission parameters are constantly reassessed and addressed to safeguard critical information.

OPSEC applies across the full spectrum of DoD missions, functions, programs, and activities under this contract. Practicing OPSEC daily is a requirement that is essential to mission success and the protection of national security assets.

Failure to properly safeguard sensitive or classified information—whether through negligence, willful misconduct, or ignorance—may result in administrative, disciplinary, contractual, or criminal consequences.

Applicability and Management of the Contractor OPSEC Plan The requirement for an Operations Security (OPSEC) Plan or an OPSEC Standing Operating Procedure (SOP) is based on the contractor's access to and handling of Critical Information and/or Controlled Unclassified Information (CUI), regardless of where that information resides.

It is essential to distinguish between Information Security (INFOSEC), which protects data "at rest" within a system, and OPSEC, which protects data "in use" by governing the procedures and actions of personnel.

When contractor personnel generate, access or handle CUI—such as building floor plans, maps, technical manuals, operational schedules, or documents that contain information that falls within a CUI category www.dodcui.mil—they are required to have an approved OPSEC Plan/SOP. Contact the COR for more information on an OPSEC Plan/SOP. This plan is a formal, documented agreement that outlines how the contractor will protect the government's sensitive information.

Even when CUI is handled exclusively on Government Furnished Equipment (GFE), the contractor remains responsible for the "human factor." The OPSEC Plan transfers the responsibility for protecting this information from the Government to the contractor by legally obligating them to establish internal procedures for everything from secure physical storage and controlled discussions to the proper destruction of materials.

Without this plan, the Government retains all risk for how a contractor safeguards its data.

The management and approval of the contractor's OPSEC Plan is a shared responsibility, with defined roles at each stage. Per government acquisition and security policy, it is the Contracting Officer's Representative (COR) who is ultimately responsible for the initial identification and final enforcement of this requirement. The process is as follows: The COR (designated technical representative) identifies the need for an OPSEC Plan based on the work described and writes the requirement into the Statement of Work (SOW)/checks this off on the Security Review Cover Sheet.

After contract award, the COR enforces this by ensuring the contractor submits the plan on time. The Contracting Officer (KO) ensures the requirement is legally binding in the final contract and is the sole authority to take contractual action for non-compliance. Finally, the Government OPSEC Officer, as the technical expert, is responsible for reviewing the submitted plan against AR 530-1 and providing the formal approval or rejection back to the COR.

(This section must be in the final contract) – Mandatory Annual OPSEC Training Requirements. In accordance with AR 530-1 (4-2-a), all contractors and subcontractors http://www.dodcui.mil/ shall complete OPSEC Level I certification training annually (Initial and Continual – detailed below).

The Contracting Officer’s Representative (COR) serves as the oversight authority: the COR verifies contractual compliance by collecting and reviewing certificates, ensuring they’re submitted within the required timeframe – first 30 days of assignment.

According to AR 530-1 (para 4-2) and DoDM 5205.02, there is no “grace period” or minimum number of days on-site before OPSEC Level I Initial and Continual training becomes mandatory—any contractor, subcontractor, or support‐service provider who requires access to TYAD information, systems, or facilities must complete both parts of their OPSEC Level I training.

OPSEC Level I training is comprised of two parts (Initial and Continual):

1. OPSEC Level I Initial training (annual):

o To be completed within first 30 days of assignment to TYAD and annually thereafter – preferably before the job starts o Provides specific information about TYADs OPSEC program o Contractors and subcontractors must set up an appointment with TYADs OPSEC Officer for Initial training. The COR will provide the necessary point of contact to schedule this training.

o Conducted by TYAD’s OPSEC officer or alternate – training can be in person or via MS Teams (30 minutes) and is tracked by a TYADs OPSEC Officer via a local training form

2. OPSEC Level I Continual training (annual):

o Commonly referred to as annual OPSEC training o To be completed within 30 days of assignment to TYAD and annually thereafter – preferably before the job starts o Provides general information about OPSEC and reemphasizes sound OPSEC practices throughout the contract period o Title of the training is: “OPSEC Awareness for Military Members, DoD Employees and Contractors” and is available online -https://securityawareness.dcsa.mil/opsec/index.htm o Certificates of completion must go to the COR

(This section must be in the final contract) - OPSEC Measures to Protect Critical Information. All personnel are required to protect critical information at all times and in all forms. This section is critical because it moves beyond a simple, vague requirement to “practice OPSEC” and provides the contractor with specific, actionable, and enforceable rules of behavior.

https://securityawareness.dcsa.mil/opsec/index.htm

All contractors and subcontractors shall implement the following mandatory OPSEC measures during the entire period of performance to protect critical and sensitive unclassified information:

1. Training and Compliance: Complete all mandatory OPSEC training as specified in this contract and actively apply all TYAD OPSEC measures in daily, contract-related operations.

2. Secure Communications: Avoid discussing government operations in public spaces or over unprotected communications (e.g., personal cell phones).

Transmit Controlled Unclassified Information (CUI) only through authorized, encrypted channels as directed in the SOW/PWS = DoD Safe Access File Exchange (SAFE) is the accredited method for sending files that contain CUI, Personally Identifiable Information (PII), or other sensitive data that should not be transmitted over unencrypted, commercial email channels. The files are encrypted during the transfer process.

3. Public Release and Social Media Prohibition: Do not disclose or post any images, data, or operational details (e.g., maps, pictures, schedules, equipment, tactics) to any unofficial media, including personal or corporate social media platforms. All information or materials intended for public release require a documented OPSEC review by a TYAD certified OPSEC Level II reviewer.

Coordinate all press releases through the COR and TYADs Public Affairs Office.

4. Reporting Requirements: Immediately report any attempts by unauthorized third parties to solicit sensitive information to the TYAD Security Operations Branch, the contract POC, and the contractor's Facility Security Officer (FSO).

5. Credential Control: Conceal or remove all government-issued badges and identification when off the installation. Do not duplicate, loan, or leave credentials unattended (CACs, badges, and/or parking passes or placards). Report any lost or stolen passes/badges/credentials to TYAD Law Enforcement Branch. The COR will provide all POC contact information.

6. Protection of Sensitive Data: Mark and protect internal company data related to this contract (e.g., schedules, deliverables, vulnerability reports) as CUI. All government-provided information, such as drawings and technical data, must be protected in accordance with DoD, Army guidance and guidance within contract package documents.

7. Information Disposal: At contract completion or upon Government request, return all government information to the COR or destroy it in accordance with approved TYAD procedures for handling CUI.

(This section must be in the final contract) - Photography or Videography.

Contractors and subcontractors who take photos or video at TYAD must notify their COR at least fourteen business (14) days in advance and complete OPSEC Level I Initial training. The COR will provide the contractor with the security branch’s points of contact after the contract is awarded. All individuals must follow TYAD policy regarding photography/videography and the use of personal electronic devices.

All photos and videos must undergo an OPSEC Review—per AR 530-1 Chapter 4—to evaluate them against TYAD’s Critical Information List and identify any vulnerabilities.

That review must be fully documented and signed off by a TYAD employee who holds OPSEC Level II certification before disseminated.

COMMUNICATIONS SECURITY (COMSEC) (If applicable) All telephonic and electronic communications with DoD organizations are subject to Communications Security (COMSEC) review and monitoring. The contractor is advised that any calls placed to or received from a DoD organization may be subject to monitoring and recording. The contractor shall ensure frequent dissemination of this notice to all employees who communicate with DoD personnel.

(This section must be in the final contract) - Information Security (INFOSEC). The contractor shall comply with all applicable regulations for the protection of government information. Information handled under this contract is categorized as either Controlled Unclassified Information (CUI) or Classified National Security Information (CNSI).

Controlled Unclassified Information (CUI) The handling, marking, safeguarding, and destruction of all CUI shall be in strict accordance with DoD Instruction 5200.48, Controlled Unclassified Information (CUI). Specific contractor responsibilities are detailed in the "Safeguarding CUI" section of this document.

(This section must be in the final contract) - CUI Training Requirement Any contractor or subcontractor personnel who will generate or have access to CUI under this contract must complete mandatory CUI training prior to accessing such information. The "DoD Mandatory Controlled Unclassified Information (CUI) Training" course available on the DCSA CDSE Security Awareness Hub (https://securityawareness.dcsa.mil/cui/) satisfies this requirement. Completion certificates shall be provided to the COR upon request.

(This section must be in the final contract) - Contractor Responsibilities for Handling CUI – even if it is their own information that must be controlled (example: Personal Identifiable Information, etc.). Contractors are responsible for handling CUI when it is created, collected, or maintained in performance of a government contract. The contractor shall comply with all CUI requirements outlined in Executive Order 13556 and 32 CFR Part 2002. www.dodcui.mil The contractor's responsibilities include, but are not limited to:

• Marking: Applying uniform CUI markings to all CUI data and deliverables.

• Access Controls: Restricting CUI access to personnel with a lawful government purpose and validated need-to-know.

• Flow Down: Ensuring all CUI protection requirements are passed down to subcontractors.

http://www.dodcui.mil/

• Physical Safeguarding: Implementing appropriate physical controls (e.g., locked storage, controlled-access areas) for all CUI, whether in hard copy or on electronic media.

• Incident Reporting: Reporting any actual or suspected loss or compromise of CUI to the COR immediately.

• Disposition: Returning all CUI to TYAD control or destroying it in accordance with DoD and Army guidelines upon contract completion.

Classified National Security Information (CNSI) (If applicable) If this contract requires access to CNSI, all such information shall be handled, stored, and protected in strict accordance with AR 380-5, Army Information Security Program, the National Industrial Security Program Operating Manual (NISPOM), and the security classification guidance provided in the DD Form 254 issued for this contract.

SECURITY CLEARANCES AND ACCESS TO CLASSIFIED INFORMATION (If applicable) Performance of this contract requires contractor access to Classified National Security Information. The definitive guidance for classification requirements is provided in the DD Form 254, Contract Security Classification Specification, which is attached to and made a part of this contract.

The contractor shall comply with FAR 52.204-2, Security Requirements, the Security Agreement (DD Form 441), and the National Industrial Security Program Operating Manual (NISPOM). The contractor is responsible for ensuring all personnel who require access to classified information possess the appropriate security clearance and need-to-know before access is granted.

(This section must be in the final contract) - Physical Security.

Safeguarding of Government Property The Contractor shall be responsible for safeguarding all government equipment, information, and property provided for Contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

Key Control - The Contractor shall establish and implement methods of making sure all keys and key cards issued to the Contractor by the Government are not lost, misplaced, or used by unauthorized personnel.

• No keys issued by the Government shall be duplicated.

• The Contractor shall develop a key control procedure, to be included in their Quality Control Plan, which includes procedures for the turn-in of keys by personnel who no longer require access.

• The Contractor shall immediately report any lost or duplicated keys to the Contracting Officer (KO). In the event a key is lost or duplicated, the Government may, at its option, re-key or replace the affected locks, and the total cost shall be deducted from the monthly payment due to the Contractor.

Lock Combinations The Contractor shall establish and implement methods to ensure that lock combinations are not revealed to unauthorized personnel when applicable. The Contractor shall ensure combinations are changed when personnel with knowledge of the combination no longer have a need-to-know.

NON-CONSTRUCTION, SUPPLY, OR TECHNICAL SERVICES Over $250K SAFETY STANDARDS FOR TYAD June 2024

NON-CONSTRUCTION, SUPPLY, or TECHNICAL SERVICES SAFETY

STANDARDS

S1.0 Safety Requirements:

The following provides information pertaining to Safety and Accident Prevention for Non-Construction or Technical Services related contracts while at the Tobyhanna Army Depot. These do not substitute or deflect in any way the requirement to institute and adhere to the provisions of all applicable referenced contractual Federal Acquisition Regulations (FAR) while performing the work under this contract. Failure to enforce safety requirements while at Tobyhanna Army Depot can result in termination of the contract.

S2.0 Safety Laws and Regulations:

1. The Contractor or Vendor shall comply with all Federal and State requirements governing safety and health protection and other applicable occupational safety codes.

2. Tobyhanna Army Depot requires full contractor or vendor compliance with all governmental, state & local safety regulations and standards. The Contractor or vendor is responsible for maintaining, monitoring, and enforcing all rules, regulations, and codes, by ALL personnel working for the contractor or vendor, including all subcontract employees.

3. As noted in Tobyhanna Army Depot Safety Regulation 385-1 - TYAD follows all and is certified as an ISO 45001 facility. Accordingly, the requirements contractor shall comply with and maintain these high safety standards and provide full compliance with all applicable safety regulations and standards. The Contractor shall maintain, monitor, and enforce employee compliance with all applicable rules, regulations, and codes.

4. If applicable, the Contractor or vendor shall indicate its plan for compliance considering conditions of the work described by the design, technical proposal, operational activities of the Government or others in the area of the work, identification of the coordinator, and implementation of all other accident prevention provisions of this contract.

S3.0 Important Phone Numbers:

Fire or Emergency: 911 Fire Department – (Non-Emergency): 570-615-7300 Security: 570-615-7550 Safety Office - 570-615-7027

S4.0 Red Card Program:

Tobyhanna Army Depot utilizes a program to allow employees to stop an action which is considered unsafe. Employees carry small red cards that can be thrown down when employee sees an action they consider unsafe. Work ceases until TYAD management can decide if it is safe or not. Contractors / vendors are required to comply with this program. If a TYAD employee presents the red card to the contractor / vendor, the contractor or vendor must stop working until the COR and Safety Office can determine if there is a safety hazard or not.

S5.0 Fossil Fuel Vehicles:

Tobyhanna Army depot has restrictions on the use of fossil fuels in all buildings. When it is determined that electric or other alternatively fueled vehicles are insufficient or unavailable for movement of material within the buildings on the installation, fossil-fueled vehicles can be used only when all alternatives of accepted electric material movement equipment have been considered, and the last option is use of a fossil fuel vehicle or project failure. This includes any situations where safety of employees and equipment may be jeopardized. Convenience will never be an acceptable justification to utilize fossil-fueled vehicles. The Government Designated Representative (GDR) will notify the appropriate supervisor(s) or leader(s) in the area where the need to utilize a fossil fuel vehicle is required. The supervisor / leader will take the necessary steps to notify the employees in the work area of the option to leave the area during the material movement process. The GDR and Contractor will also document all actions the Contractor took to utilize electric or other alternatively fueled vehicles. The documentation will specifically state why electric or alternatively fueled vehicles are insufficient and all mitigation efforts used to minimize the effects of fossil-fueled vehicles to include information as to any appropriate scrubbers that can be utilized along with any ventilation or exhaust systems that can be used to externally vented to the outside of the facility. The documentation must be submitted to the TYAD Safety office for approval prior to any equipment being used. A final copy of the Approved documentation will be provided to the TYAD Safety Division.

S6.0 If An Incident Happens:

1. Any serious injury or medical emergency:

• Immediately call emergency responders

• Dial 911 and give accurate location and nature of emergency. Make sure to tell the operator that you are calling from Tobyhanna Army Depot.

• Send someone to the nearest exit to assist responders.

• Treat victims to the best of your ability.

• Notify COR / call work order desk at 570-615-7805 if there is any blood or body fluids that must be cleaned up.

2. In the event of the smell of natural gas:

• Call dial 911and give accurate location and nature of emergency. Make sure to tell the operator that you are calling from Tobyhanna Army Depot.

• Have all personnel evacuate the area if the smell is significant.

• Upon arrival of fire personnel, provide information as to specific equipment and exact location of potential leak.

3. In the case of a fire:

• If the fire is small, use a fire extinguisher and call 911.

• Otherwise, dial 911 and pull the fire alarm.

• Evacuate the building.

S7.0 Operation & Maintenance Manuals

1. The Contractor shall provide to the COR a copy of all Operation and

Maintenance (O&M) Manuals and Parts Manuals for any equipment provide.

2. The O&M Manuals shall contain a complete set of mechanical drawings and diagrams; a complete set of electrical drawings and diagrams including electrical schematics; logic circuitry descriptions; spare parts list; operator and maintenance instructions for operating, testing, and maintaining all system components.

3. The O&M Manuals shall contain complete detailed instructions and schedules for system PM.

4. The O&M Manuals shall contain a detailed description of the lock-out/tag-out procedures needed to bring the system and individual components to a zero-energy state for maintenance and servicing.

5. The O&M data must be consistent with the manufacturer's standard brochures, schematics, printed instructions, general operating procedures, and safety precautions.

IN ANY CONFLICT BETWEEN STANDARDS, THE STRICTER OF THE TWO SHALL

APPLY. IF UNSURE CONTACT THE COR / ET VIA PROPER RFI PROTOCOLS FOR

VERIFICATION THROUGH THE TYAD SAFETY OFFICE.

ISP-N-2025

9 Jun 2025

Standard Specifications for Projects Under the National Environmental Policy Act (NEPA) in Accordance with 32 CFR 651 Proponent ELTY-ISP-N

***Spill Response Procedures 1-2-3***

1. Stop work

2. Call 911

3. Evacuate Area

*********Damaged Asbestos?*********

Environmental Questions?

Call Environmental Branch (EB) at

570-615-7098

1. Air Pollution Control The contractor must control fugitive emissions, including dust, during the course of their contract. The contractor must obtain approval from the Environmental Branch (EB) prior to exhausting equipment to the outside. The contractor must not allow any pollutant or particulate matter to be released to the atmosphere at levels that are visible from outside of Tobyhanna Army Depot (TYAD). The contractor must not perform work that will release pollutants or particulate matter to the atmosphere when the wind speed exceeds ten miles per hour and will result in adverse effects to the surrounding areas.

TYAD will monitor the wind speed; it is the contractor’s responsibility to obtain wind speed information through the Contracting Officer Representative (COR).

2. Asbestos The contractor must ensure that all materials used in the performance of this contract are asbestos-free.

Unless specified in the contract, the contractor must not disturb any existing Asbestos- Containing Material (ACM) in the performance of this contract. If ACM, or suspect ACM might be disturbed in performance of this contract, the contractor must avoid encountering the material and immediately notify the COR and the Contract Administrator in writing. The COR must coordinate with EB to have the material tested to determine if there is ACM. If the material is determined to be ACM and the contractor cannot avoid disturbing the material, the COR will notify the Contracting Officer. The Contracting Officer will direct a change pursuant to the contract clauses entitled “Changes” and “Differing Site Conditions.” If ACM, or suspect ACM has been disturbed, the contractor must immediately notify the COR and call the EB. The contractor will shut down and not move any equipment or supplies near the damaged ACM. The contractor will evacuate all non-contaminated contractor personnel from the immediate vicinity. Any contractor personnel thought to be contaminated with asbestos must remain in the area until the EB responds.