Attachment 8 AOI Requirements.pdf

Contract Requirements Package

Antiterrorism / Operations Security / Information Protection Review Coversheet

AOI-RC, v3.5 Page 2 of 2

Section IV - Standard Contract Language/Contract Clause Applicability and/or Additional SOW or PWS Language

1. Access and General Protection/Security Policy and Procedures. This standard language is for contractor employees with an area of performance within

Government controlled installation, facility, or area. The contractor shall comply with all applicable installation/facility access and local security policies and procedures, which may be obtained from the Contracting Officer’s Representative (COR). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by the local installation’s Security Forces, Director of Emergency Services or local Security

Office. The contractor shall ensure compliance with all personal identity verification requirements as directed by DoD, HAF and/or local policy. Should the Force

Protection Condition (FPCON) change, the Government may require changes in contractor security matters or processes.

1a. For Contractors Requiring Common Access Card (CAC). Before CAC issuance, the contractor employee requires, at a minimum, a favorably adjudicated

National Agency Check with Inquiries (NACI/Tier 1) or higher investigation IAW DoDI 5200.46. The contractor employee will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) Remote access, via logon, to a

DoD network using DoD-approved remote access procedures; or (3) Physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial/interim CAC may be issued based on a successfully scheduled NACI with the Office of Personnel Management and a favorable completion of an FBI fingerprint check.

1b. For Contractors that do not require CAC, but require access to a DoD Facility and/or Installation. Contractor and all associated sub-contractors employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist

Screening Database (TSDB) (DODIO 2000.16V1_DAFI 31-145, DAFI 31-101 and DODM 5200.08v3_DAFMAN 31-101v3), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

2. All contractor employees and associated sub-contractor employees assigned to work on a government site and/ or requiring access to a DoD network will be required to complete the necessary training required of them initially and annually for the duration of the contract (i.e., DoD IAA Cyber Awareness, Protecting

Sensitive Information, Force Protection, etc.).

3. For Contracts that require Handling or Access to Classified Information. For contracts that require handling or access to classified information, the contractor shall comply with FAR Clause 52.204-2, Security Requirements, including the National Industrial Security Program Operating Manual (DoD 5220.22-M) and applicable updates/changes. This clause involves access to information classified “Confidential/Secret/Top Secret” and requires contractors to comply with a

Visitor Group Security Agreement (VGSA) when designated as a Visitor Group at all contractor operations located on Air Force/Air National Guard installations in accordance with this PWS. Contract personnel must be entered in the Defense Information System for Security (DISS) and vendor will comply with paragraph

1.6h above. A DD 254, DoD Contract Security Classification Specification, is required for all classified contracts. Completion of localized security training

(information protection related material) will be accomplished at the Wing/Unit level. Derivative Classification and Marking Classified CBTs may also be required as per assigned duties (i.e., SIPRNet).

4. Antiterrorism Awareness Level I Training (AT Level I). This standard language is for contractor employees with an area of performance within a US Government controlled installation, facility or area. All contractor employees, to include subcontractor employees, requiring access to US Government installations, facilities and controlled access areas shall complete AT Level I training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. AT Level I may be accomplished by a Level I qualified instructor; completing the Force Protection computer-based training (CBT) course on Joint Knowledge Online (JKO) at https://jkodirect.jten.mil/Atlas2/page/login/Login.jsf. For those without a CAC, select

"Non-CAC" user on the JKO site. Tracking for each contractor or subcontractor employee is the responsibility of the COR or unit AT Representative.

5. AT Awareness Training for Contractor Personnel Traveling Overseas. US based contractor employees and associated sub-contractor employees will be made available and receive government provided area of responsibility (AOR) specific AT awareness training as directed by DODI O-2000.16, VOLUME 1-O. Specific

AOR training content is directed by the combatant commander with the unit ATO being the local point of contact. (Item 9 below will apply)

6. For contracts that require an OPSEC Plan. The contractor shall develop an OPSEC Plan and provide it to the COR or KO within 30 calendar days of contract award to be reviewed and approved by the responsible Government OPSEC officer, per AFI 10-701, Operations Security. This Plan shall include the government's critical information, why it needs to be protected, where it is located, who is responsible for it, and how to protect it. For the contractor to effectively comply with OPSEC provisions of the contract, the organization will provide the following guidance: (1) Organization’s Critical Information; (2) Adversaries’ collection threat information as it applies to the organization’s mission and the contract; (3) Operations Security guidance; and (4) Specific OPSEC measures the organization requires (as appropriate).

6a. Requirement for OPSEC Training. In accordance with AFI 10-701, Operations Security, OPSEC PMs/SMO/SMNCOs/Coordinators will provide OPSEC training or training materials to contract employees within 30 days of employees’ initial assignment to the contract and prior to having access to any critical information (CI) and annually thereafter. General organizational orientations may need to be supplemented by duty-related orientations in the work center targeted toward specific critical information and vulnerabilities associated with the work. Initial training (OPSE 1301 - OPSEC Fundamentals) located on the

Defense Counterintelligence and Security Agency website: https://securityawareness.usalearning.gov/opsec/index.htm and the OPSEC Annual training- DAF-

Operations Security Awareness Training located on My Learning https://lms-jets.cce.af.mil/moodle/course/view.php?id=11654#section-1

7. For Information Assurance (IA) / Information Technology (IT) Training. All contractor employees and associated sub-contractor employees shall complete the

DoD Information Assurance Awareness Cyber Awareness Challenge before issuance of network access and annually thereafter. All contractor employees performing services involving IA/IT functions shall comply with DoD and Air Force training requirements in DoDD 8140.01, DoD 8570.01-M and AFPD 33-2 within 45 days of the start of contract performance.

8. For Information Assurance (IA) / Information Technology (IT) Certification. In accordance with DoD 8570.01-M , DFARS 252.239.7001 and AFM

33-282, Contractor employees performing services supporting IA/IT functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8570.01-M shall be completed upon contract award.

9. For Contract Requiring Performance or Delivery in a Foreign Country, DFARS Clause 252.225-7043, Antiterrorism/Force Protection for Defense Contractors

Outside the US. The clause shall be used in solicitations and contracts that require performance or delivery in a foreign country. This clause applies to both contingencies and non-contingency support. The key AT requirement is for non-local national contractor personnel to comply with theater clearance requirements and allows the combatant commander to exercise oversight to ensure the contractor’s compliance with combatant commander and subordinate task force commander policies and directives.

10. For Contractors Authorized to Accompany the Force. DFARS Clause 252.225-7040, Contractor Personnel Authorized to Accompany U.S. Armed Forces

Deployed Outside the United States. The clause shall be used in solicitations and contracts that authorize contractor personnel to accompany US Armed Forces deployed outside the US in contingency operations; humanitarian or peacekeeping operations; or other military operations or exercises, when designated by the combatant commander. The clause discusses the following AT/OPSEC related topics: required compliance with laws and regulations, pre-deployment requirements, required training (per combatant command guidance), and personnel data required.