A07 - ATTACH_0005_OPSEC_SOW.pdf

STATEMENT OF WORK: OPERATIONS SECURITY (OPSEC) REQUIREMENTS

(a) As defined in Army Regulation (AR) 530-1, Operations Security (OPSEC), sensitive information is information requiring special protection from disclosure that could cause compromise or threat to our national security, an Army organization, activity, family member, DA civilian or DoD contractor.

Critical Information is defined as information important to the successful achievement of U.S. objectives and missions, or which may be of use to an adversary of the United States. It consists of specific facts about friendly capabilities, activities, limitations (includes vulnerabilities), and intentions needed by adversaries for them to plan and act effectively so as to degrade friendly mission accomplishment. All critical information is sensitive, but not all sensitive information is critical.

(b) The Contractor shall not release sensitive information to the general public without prior written approval from the Contracting Officer. All contractor requests to release sensitive information shall be in writing and clearly explain the necessity for release of the information and consequences if approval is not granted. Contractor employees who are U.S.

citizens shall be provided access to sensitive information on a "need to know" basis required to fulfill the terms and conditions of the contract. Foreign National (FN) employees’ access to information will be limited to non-sensitive information. FN access to sensitive information will be approved in writing by the Contracting Officer on a case-by-case basis, and will be strictly limited to the information that the employee must know in order to fulfill the terms and conditions of the contract.

(c) The Contracting Officer will provide the Contractor with a list of known Critical Information (CI) pertinent to contract requirements as soon as possible after contract award. Critical Information shall be used by the Contractor’s appointed OPSEC Manager to prepare an OPSEC Plan.

(d) The Contractor shall be responsible for establishing and maintaining an OPSEC program to adequately manage, protect and control sensitive information that has been provided or generated under the contract. The Contractor shall prepare and submit a written OPSEC Plan to the Contracting Officer for approval IAW DD 1423/DI-MGMT-80934C within 30 calendar days after receipt of the CI information addressed in Paragraph 3 above. The Contracting Officer will coordinate with the

3 SEP 19

Government OPSEC Officer and advise the Contractor in writing of the approval, conditional approval or disapproval of the plan within 20 days of receipt.

(e) The Contractor shall conduct annual self-assessments of their OPSEC program and submit annual written assessments to the Contracting Officer in the anniversary month of contract award.

OPSEC Assessment checklists and sample assessment responses will be provided in advance by the Government as tools to aid the Contractor in assessing their OPSEC program.

(f) The Contractor shall provide OPSEC training to all employees regarding the safeguarding of sensitive information prior to employees being allowed access to such information, and annually thereafter.

(g) The Contractor shall destroy all sensitive program material at the completion of the contract so as to ensure the information cannot be accessed or utilized for any purpose and notify the Contracting Officer in writing of its destruction.

(h) These same requirements will flow down to all subcontractors working on or provided any sensitive information related to the contract.

(i) The Contractor shall develop an OPSEC Standing Operating Procedure (SOP)/Plan within 90 calendar days of contract award, to be reviewed and approved by the responsible Government OPSEC officer. This plan will include a process to identify critical information, where it is located, who is responsible for it, how to protect it and why it needs to be protected. The contractor shall implement OPSEC measures as ordered by the commander. In addition, the contractor shall have an identified Level II OPSEC coordinator per AR 530-1.

(j) Per AR 530-1, Operations Security, the contractor employees must complete Level I OPSEC Awareness training. New employees must be trained within 30 calendar days of their reporting for duty and annually thereafter.

(k) Contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified “Confidential,””Secret” or “Top Secret” and requires contractors to comply with – (1) The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22M); (2) any revisions to DoD 5220.22-M, notice of which has been furnished to the contractor.

(l) Per AR 381-12, Threat Awareness and Reporting Program (TARP), contractor employees must receive mandatory TARP training within 30 days of employment and annually thereafter.

Only TARP training by a CI agent is authorized unless the conditions in paragraph 2-4i apply.