Attach_0008COCO_SOW_-_14_Nov_2012.pdf

SECURITY STATEMENT OF WORK (SOW)

PHYSICAL SECURITY STANDARDS FOR DOD SECURITY RISK CATEGORY (SRC)

ARMS, AMMUNITION AND EXPLOSIVES (AA&E)

CONTRACTOR-OWNED CONTRACTOR-OPERATED (COCO) FACILITIES

Paragraph/Title: Page:

1. General 2

2. Contractor-Owned AA&E Production and Storage Facilities 2

3. Facility Construction 2

4. Contractor Facility Suitability Determination 3

5. Additional Protective Measures 4

6. AA&E Production Line Security 7

7. In-Transit Security 8

8. Classified AA&E 8

9. Accountability 8

10. Disposal and DEMIL of AA&E 8

11. Arms Parts 9

12. Incident Reports 9

13. Physical Security Deviations 10

14. Standing Practices Procedures (SPP) 10

Appendix:

I - AUTHORITY AND CONTRACT CLAUSES RELATING TO DoD AA&E 11

II - SENSITIVE CONVENTIONAL AA&E SRC 13

III - REQUEST FOR SECURITY WAIVERS AND EXCEPTIONS 19

This Statement of Work (SOW) replaces all previous contract requirement documents concerning COCO facilities. The information is an extract from DoD M 5100.76, Department of Defense Physical Security of Sensitive Conventional Arms, Ammunition and Explosives. The intent is to provide COCO facilities an easy reference. This SOW was prepared by the Physical Security Office of the US Army Joint Munitions Command, Deputy Chief of Staff for Operations, Protection, and Intelligence, G3/2, 1 Rock Island Arsenal, Rock Island, IL 61299-6000.

JMC Operations, Protection and Intelligence, G3/2 14 Nov 2012

Subject: DoD Security Standards for SRC AA&E (COCO Sites)

1. GENERAL. AA&E in the custody of contractor owned facilities shall be protected according to the provisions of this statement of work (SOW) through the express terms of the contract.

Any additional requirements imposed by a DoD procuring command or activity shall be specified in section H, “Special Clauses Section,” of the contract. Additional AA&E Physical

Security requirements, if deemed required, shall be provided to the DoD OUSD (I) Director of

Security by the procuring command or activity.

2. CONTRACTOR-OWNED AA&E PRODUCTION AND STORAGE FACILITIES. These facilities include areas where, through contract with the DoD Components, arms, ammunition, and/or explosives are manufactured, retrofitted, modified, or developed. This SOW provides the physical security requirements that apply specifically to contractor-owned facilities. In addition to this SOW, all other requirements in DoD 6055.09-M, DoD Ammunition and Explosives

Safety Standards, February 29, 2008 applicable to the SRC of AA&E being controlled, stored, or otherwise in the control of the contractor shall be applied.

3. FACILITY CONSTRUCTION. AA&E in production and/or storage at contractor-owned facilities shall be secured in one of the structures listed in subparagraphs 3.a. through 3.i. of this

SOW as prescribed and authorized by the procuring command/activity:

a. A structure built in accordance with DoD 6055.09-M, DoD Ammunition and Explosives

Safety Standards, February 29, 2008 .

b. A structure that complies with DoD 4145.26-M, DoD Contractor’s Safety Manual for

Ammunition and Explosives, March 13, 2008.

c. A portable explosives magazine as specified in Naval Facilities Engineering Service Center

Technical Data Sheet TDS-2078-SHR, Pre-engineered Explosives Magazines, June 2001.

d. A structure built according to the procuring command/activity’s applicable Military

Department or UFC construction requirements for AA&E as supplemented by guidance in this

Manual.

e. A storage structure built in accordance with Military Handbook 1013/1A, Design Guidelines for Physical Security of Facilities, December 15, 1993 to meet appropriate threat and delay time requirements.

f. An existing structure if approved by the procuring command/activity. The procuring command/activity shall coordinate with the supporting DSS field office for those facilities approved for use by the procuring command/activity. The procuring command/activity shall ensure alternative or compensatory measures are implemented prior to approval of existing structures that are not compliant with this Manual. The procuring command/activity shall maintain a list and provide a copy to the DSS supporting field office.

JMC Operations, Protection and Intelligence, G3/2 14 Nov 2012

g. A GSA-approved modular vault according to Federal Specification AA-V-2737, Modular

Vault System, April 25, 1990 with a GSA-approved Class 5 Armory Vault Door in accordance with Federal Specification AA-D-600D, Door, Vault, Security, May 25, 2000.

h. A GSA-approved Class 5 map and plan container according to Federal Specification AA-F-

363D, “Filing Cabinet, Security, Maps and Plans, General Filing, and Storage,” June 1 2001 and

Federal Specification AA-F-358J, “Filing Cabinet, Legal and Letter Size, Uninsulated, Security,”

November 2, 2010, or GSA-approved Class 5 weapons storage container according to Federal

Specification AA-C-2859, “Cabinet, Security, Weapons Storage,” April 20, 2007, for the storage of SRC III and IV arms only.

i. A Type II Magazine (for storage of SRC III and IV A&E only) pursuant to Section 208, part

555 of title 27, Code of Federal Regulations.

4. CONTRACTOR FACILITY SUITABILITY DETERMINATION

a. Procuring command/activity approval (authorization) of any of the structures in section 3 above shall be based on one or all of the items in subparagraphs 4.a.(1) through 4.a.(4) of this enclosure.

(1) Type and quantity of the AA&E in possession of the contractor commensurate with all applicable safety requirements.

(2) Knowledge of the contractor’s AA&E storage and production structures based on past contract performance.

(3) Structural information provided by the contractor or DSS representative.

(4) Procuring command/activity on-site visit.

b. The procuring command/activity shall issue a written facility suitability determination to the contractor to show compliance by the contractor with the structural requirements of this SOW.

The procuring command or activity may accept suitability determinations made by another procuring command /activity as long as the structural integrity of the same facility is unchanged.

If more than one structure is involved for a given contract, the determination may encompass all of the applicable structures to avoid the necessity of a separate suitability determination for each storage structure. The suitability determination process must begin at the pre-award stage of the contract.

JMC Operations, Protection and Intelligence, G3/2 14 Nov 2012

5. ADDITIONAL PROTECTIVE MEASURES

a. Security Locks and Hasps

(1) Access doors to storage and production structures shall be secured with a key-operated high-security padlock in accordance with Military D2etail Specification MIL-DTL-43607H, “Padlock, Key Operated, High Security, Shrouded Shackle,” June 5, 2007 and hasp according to Military

Detail Specification MIL-DTL-29181, “Hasp, High Security, Shrouded, for High and Medium

Security Padlock,” March 10, 1998, as amended. GSA-approved Class 5 vault doors and doors of GSA-approved Class 5 weapons storage containers, and doors of Type II magazines are excluded from this requirement. High-security locks and hasps may be provided to the contractor as Government-furnished equipment, or the contractor may procure these items from the Defense Supply Center, Philadelphia, as directed by the procuring activity.

(2) The lock and hasp requirement is intended for production structures where AA&E is to be left unattended overnight. If AA&E is removed at the end of the duty day from the production structure, no special lock is required to be installed on the production structure.

b. Combination, Key, and Lock Control. The contractor shall implement a control system that ensures accountability and control of AA&E locks, keys, and combinations.

(1) The contractor shall appoint a key and lock custodian to implement and supervise the control and use of locks, keys, and combinations.

(2) AA&E storage structure keys shall be retained separately from other keys and accessible only to those persons whose duties require access to AA&E.

(3) The number of keys shall be held to the minimum necessary and must be signed for by those persons authorized access.

(4) When not attended or in use, keys shall be stored in approved containers as described in

Table 1. Reserve or replacement locks, cores, and keys shall be secured in the same manner as addressed below:

JMC Operations, Protection and Intelligence, G3/2 14 Nov 2012

Table 1 Key/Lock Security

SRC I and II (CAT I and II) SRC III and IV (CAT III and IV)

Keys and Combinations

General Services Administration

(GSA)-approved Class 5 security container* or GSA-approved Class

5 weapons container**.

Containers of at least 12-gauge steel (or material equivalent strength) security with a GSA-approved built in combination lock*** or a built in combination lock**** meeting Group 1.

* In accordance with Federal Specification AA-F-363D, Filing Cabinet, Security, Maps and Plans, General

Filing, and Storage, June 1 2001.

* In accordance with Federal Specification AA-F-358J, Filing Cabinet, Legal and Letter Size, Uninsulated, Security, November 2, 2010.

** In accordance with Federal Specification AA-C-2859, Cabinet, Security, Weapons Storage, April 20, 2007.

*** In accordance with Federal Specification FF-L-2937, Combination Lock, Mechanical, January 31, 2005.

**** In accordance with Underwriters Laboratories, Inc. Standard UL 768, Standard for Combination Locks, January 6, 2006.

c. Access Control. The contractor shall ensure that only appropriately cleared persons and authorized persons are granted access to AA&E. Vehicular and pedestrian entry into and exit from the production and storage areas shall be controlled. Privately owned vehicles shall not be parked within 100 feet of storage and production structures.

d. Security Lighting. Exterior building and door lighting shall be provided for all structures containing SRC I and II items. The lighting shall be sufficient to allow security forces to detect unauthorized activity. Switches for exterior lights shall be installed in such a manner that they are accessible only to individuals with authorized access.

e. Perimeter Fencing. The need for perimeter fencing of structures containing SRC I and II items shall be determined by the procuring command/activity after consultation with the AA&E contractor and/or the DSS representative. Guidelines for fencing are contained in Federal

Specification RR-F-191-K, Fencing, Wire and Post Metal (and Gates, Chain-link Fence Fabric, and Accessories) (General Specification), May 14, 1990. Perimeter fence chains as described in

Federal Specification RR-C-271D, Chains and Attachments, Welded and Weldless, September

25, 1990 fence and gate openings shall be secured with a general field service padlock according to Federal Specification FF-P-2827, Padlock, Key Operated, General Field Service, November

27, 2002.

f. Intrusion Detection/Alarm System

(1) Structures storing SRC I and II missiles and rockets, SRC I and II A&E, and SRC II-IV arms shall be protected by an IDS unless the areas where they are located are continuously manned or under constant surveillance so that unauthorized entry can be detected. The necessity for non-

JMC Operations, Protection and Intelligence, G3/2 14 Nov 2012 duty hour security checks of these structures shall be determined by the procuring command / activity after consultation with the AA&E contractor and/or the DSS representative. SRC III-IV ammunition and explosives do not require IDS.

(2) All materials and equipment used in the IDS shall be listed in Underwriters Laboratories

Inc., Standard for Safety, UL-2050, National Industrial Security Systems, August 10, 2003 under the specific alarm configuration/application, or be a system approved by the procuring commands DoD Component. A list of manufacturers of UL-listed IDS equipment is available from the UL Website at http://www.ul.com or from:

Underwriters Laboratories, Inc.

Publication Stock

333 Pfingsten Road

Northbrook, IL 60062

(3) All IDS material and equipment shall be installed according to the criteria established in

Underwriters Laboratories Inc., Standard for Safety, UL-2050, National Industrial Security

Systems, August 10, 2003. The Underwriters Laboratories Standard provides the technical requirements for installation, maintenance, testing, and operation of alarm equipment installed in an area or on an object that contains material for which physical security protection is necessary and required by this SOW.

(4) IDS transmission lines shall have line security (electronically monitored to detect evidence of tampering or attempted compromise). If line security is unavailable, two independent means of signal transmission from the alarmed area to the monitoring station shall be provided. Where feasible, one of the two independent means of alarm signal transmission shall be either a long-range radio or cellular telephone link. The dual transmission equipment shall continuously monitor the integrity of both the telephone wire line and cellular or long-range links. Upon loss of either communications path, the system shall immediately initiate notification to the monitoring facility via the remaining communications link. The AA&E contractor shall test the alarm sensors monthly to ensure the proper functioning of the system. A log of such test shall be retained for a period of 1 year.

(5) All alarm signals shall annunciate at a central control or monitoring station from which an armed police or security response force can be dispatched directly. Such station may be either a commercial central station listed with UL, an AA&E contractor proprietary station, or a local law enforcement monitoring station, or Government Contract Monitoring Station as specified in the

Underwriters Laboratories Inc., Standard for Safety, UL-2050, National Industrial Security

Systems, August 10, 2003.

JMC Operations, Protection and Intelligence, G3/2 14 Nov 2012

(6) Alarm systems must comply with the UL-2050 standard unless an exception is granted by the government procuring command/activity. Each alarmed area must be issued a certificate by the UL-listed alarm installing company.

(7) The response force shall respond within 15 minutes after receipt of an alarm signal and consist of one of the types of responses listed in subparagraphs 5.f.(7)(a) through 5.f.(7)(c) below:

(a) In-house AA&E Contractor Response Force. This refers to the AA&E contractor employee(s) on-site at the AA&E facility during non-duty hours. It also refers to a contract guard on-site during non-duty hours at the AA&E facility. These response forces are the responsibility of the AA&E contractor, rather than being controlled by a commercial central station or local law enforcement.

(b) Response Force Dispatched By a Commercial Central Station. Such force remains on the premises until a designated representative of the AA&E contractor arrives to assess the nature of the alarm and takes appropriate measures to ensure the security of the AA&E or for a period of not less than 1 hour. If the AA&E contractor representative fails to arrive within 1 hour, the central station (by contractual agreement) shall provide an incident report to the AA&E contractor within 24 hours of the incident. The report shall include the name of the subscriber, date and time of the alarm, and name of the contractor representative(s) notified to respond.

c) Local Law Enforcement Agency. The AA&E contractor shall arrange for the law enforcement agency monitoring station to contact his or her designated representative within 15 minutes of alarm activation. If off site, the contractor’s representative shall arrive at the premises within 1 hour of the alarm notification to assess the nature of the alarm and take appropriate measures to ensure the security of the AA&E. Arrangements shall also be made for the law enforcement authority to notify the contractor when the contractor’s representative fails to arrive within 1 hour as required.

(8) The AA&E contractor shall arrange for constant manning/surveillance of AA&E storage areas by security personnel during duty and non-duty hours when the IDS is inoperative due to equipment failure/repair, and/or during emergency conditions. When classified AA&E is involved, security personnel shall be cleared to the level of classified access.

6. AA&E PRODUCTION LINE SECURITY. The contractor shall assess the security vulnerabilities involving AA&E manufacturing/production operations in order to prevent the theft or pilferage of munitions during manufacturing. The contractor shall develop appropriate production line security countermeasures. Such protective measures shall be in writing and provided to the DSS for review. Procedures shall be included outlining protective measures to be employed when the production line(s) is left unattended. CCTV, metal detectors at exit

JMC Operations, Protection and Intelligence, G3/2 14 Nov 2012 points, additional barriers, and changes in production line processes are examples of protective measures that may be employed.

7. IN-TRANSIT SECURITY. The procuring command/activity shall advise the contractor of requisite transportation security requirements for shipments of AA&E to Government activities, other contractors, or subcontractors according to Enclosure 10, AA&E Transportation Security of DoDM 5100.76, April 17, 2012 and applicable provisions of Chapter 205 of Defense

Transportation Regulation 4500.9-R, Defense Transportation Regulation, Part II, Cargo

Movement, June 2008 that the contractor shall follow. Contractors shall ensure that internal movement (transportation on a contractor’s facility) of SRC I and II AA&E include the contractor’s ability to communicate with security and safety personnel.

8. CLASSIFIED AA&E. Contractors manufacturing, storing, transporting, or in possession of classified AA&E shall be cleared in accordance with DoD 5200.2-R, Personnel Security

Program, January 1987. Classified AA&E, if also categorized according to Appendix 2 of this

SOW, shall be stored and transported according to the provisions of this SOW. All other classified AA&E not categorized according to Appendix 2 shall be protected in accordance with

DoD 5220.22-M, National Industrial Security Program Operating Manual, February 1, 2006.

9. ACCOUNTABILITY. The procuring command/activity shall require the contractor to be accountable for AA&E produced/manufactured or under their control. The contractor is accountable for AA&E items with which they are furnished in support of a DoD contract as well.

The contractor shall provide the procuring command/activity with a written procedure of how accountability shall be established and retained, including inventories at specified frequencies. A copy of these procedures shall be furnished to DSS upon approval by the procuring command/activity.

10. DISPOSAL AND DEMIL OF AA&E. The procuring command/activity shall provide instructions to the contractor concerning the disposal and DEMIL of residual AA&E. AA&E awaiting such disposal may be stored outside in an “open” manner (excluding SRC I and II

AA&E) provided the conditions in subparagraphs 10.a. through 10.e. below are met:

a. The items remain under constant surveillance (e.g., CCTV, physical presence of contract employees, or contract employees who are able to maintain constant visual observation of the

AA&E).

b. The items are enclosed in a fenced area with 24-hour access control. The fence must be constructed according to the guidelines in Federal Specification RR-F-191-K, Fencing, Wire and

Post Metal (and Gates, Chain-link Fence Fabric, and Accessories) (General Specification), May

14, 1990.

JMC Operations, Protection and Intelligence, G3/2 14 Nov 2012

c. The items are banded and crated, with proper accountability and inventory procedures in place as prescribed by the procuring command/activity.

d. The open storage area is lighted during the hours of darkness or times of reduced visibility to enhance surveillance.

e. The surveillance system in place provides for the immediate detection of illegal activity, notification to monitoring locations, and 15-minute response as described in subparagraph 5.f.(7) above.

11. ARMS PARTS. Major parts for arms (such as barrels and major subassemblies) shall be afforded at least the same protection as SRC IV arms. An arms frame or receiver constitutes a weapon and such parts shall be stored according to the applicable category (e.g., the receiver of a

.50 caliber machine gun shall be stored as a SRC II arm).

12. INCIDENT REPORTS

a. Contractors shall report the incidents listed in subparagraphs 12.a. (1) through 12.a.(6) of this

SOW (see below), no later than 72 hours after discovery, to the office of the appropriate DSS

Regional Director for Industrial Security and the Government procuring command/activity (these points of contact can be found at http://www.dss.mil):

(1) All AA&E thefts and losses.

(2) Significant damage (e.g., explosion, fire, flood, other natural disasters) to AA&E and/or

AA&E structures.

(3) Any attempted or actual armed robbery of AA&E items.

(4) Forced entry or attempted forced entry into AA&E areas.

(5) Evidence of illegal trafficking of AA&E.

(6) Evidence of terrorist activity directed against AA&E areas as determined by local, State, or

Federal law enforcement, or responsible DoD Component.

b. The contractor shall also notify local law enforcement and the local FBI office of any of the incidents described in this section immediately upon discovery. After the initial notifications, the contractor shall send a written report of the incident to the appropriate DSS office.

JMC Operations, Protection and Intelligence, G3/2 14 Nov 2012

13. PHYSICAL SECURITY DEVIATIONS

a. Deviations from this Manual.

(1) Waivers may be approved for temporary relief from a specific requirement in this Manual pending action to conform to such requirement. Waivers shall be granted for a period not to exceed 12 months and may be extended only after a review of circumstances confirms the necessity of the extension. Waiver requests shall include a statement as to why the contractor is unable to meet the requirements in this Manual and shall outline compensatory measures proposed by the contractor that shall provide equivalent protection of AA&E at contractor facilities.

(2) Exceptions may be approved for permanent relief from a requirement specified in this

Manual. Exceptions shall be granted only when compliance with a requirement from this

Manual would unduly impede mission performance as described and documented in the extension request. As with waivers, approved exceptions shall specify the rationale for granting the exception. In addition, approved exceptions shall specify the alternative or compensatory measure(s) that shall provide equivalent protection of the exception security requirement(s).

Exceptions shall be reviewed every 3 years or at contract renewal by the Government procuring command/activity and DSS.

b. The procuring command/activity shall coordinate waiver requests with the office of the appropriate DSS Regional Director for Industrial Security. The procuring command/activity shall forward the waiver request, with recommendations, to its major command for decision.

Copies of approved waivers and exceptions shall be provided to the office of the appropriate

DSS Regional Director for Industrial Security.

c. Blanket deviations or exceptions shall not be authorized.

14. STANDING PRACTICE PROCEDURES (SPP)

a. Contractors shall prepare and maintain written procedures to implement the requirements in this SOW. These SPP shall be sufficient in scope to provide employees with the procedures necessary to ensure the safeguarding of AA&E. The office of the DSS Regional Director for

Industrial Security shall review SPP to determine their adequacy. Contractors shall modify SPP that DSS judges inadequate. A copy of the SPP shall be provided to the office of the DSS

Regional Director for Industrial Security, as appropriate, upon request.

b. Contractors shall develop training programs on SPP for those responsible for safeguarding

AA&E on an annual basis. SPP training records can be incorporated into other training records and shall be retained for 1 year.

JMC Operations, Protection and Intelligence, G3/2 14 Nov 2012

APPENDIX I - AUTHORITY AND CONTRACT CLAUSES RELATING TO DoD AA&E

1. AUTHORITY. The AA&E program falls under parts 223 and 252 of title 48, CFR (Parts 223 and 252 of title 48, Code of Federal Regulations).

2. CONTRACT CLAUSES. Some clauses of Parts 223 and 252 of title 48, Code of Federal

Regulations that are relevant to the Industrial Security Representative and/or contracting activity include:

a. Clause 223.7200 – Definition of AA&E. This clause means those items within the scope of

Appendix 2 of this SOW.

b. Clause 223.7201 – Policy. This clause establishes the conditions in which the requirements of this SOW and DoDM 5100.76, Physical Security of Sensitive Conventional Arms, Ammunition, and Explosives (AA&E), April 17, 2012 shall or shall not apply to contracts:

(1) The requirements of this SOW shall apply to contracts when:

(a) AA&E is provided to the prime contractor or subcontractor as Government-furnished property; or

(b) The contractor’s principal development, production, manufacture, or purchase of AA&E is for DoD use.

(2) The requirements need not apply to contracts when:

(a) The AA&E acquired under the contract is a commercial item within the meaning of subpart

2.101 of the Federal Acquisition Regulation; or

(b) The contract shall be performed in a Government Owned Contractor Operated ammunition production facility. However, if subcontracts issued under such a contract shall meet the criteria of subparagraph 2.b.(1) of this appendix, the requirements in this SOW shall apply.

c. Clause 223.7202 – Pre-award Responsibilities. This clause specifies that when an acquisition includes AA&E, technical or requirements personnel must state in the purchase request that

AA&E is involved and which physical security measures in this SOW apply.

d. Clause 223.7203 – Contract Clause. This clause instructs the procuring activity to include clause 252.223-7007, “Safeguarding Sensitive Conventional Arms, Ammunition, and

Explosives,” in all solicitations and contracts in which this SOW applies. This clause also

JMC Operations, Protection and Intelligence, G3/2 14 Nov 2012 instructs the procuring activity to complete paragraph (b) of clause 252.223-7007 of Parts 223 and 252 of title 48, Code of Federal Regulations.

e. Clause 252.223-7007 – Safeguarding AA&E. This clause:

(1) Requires the identification of the AA&E that is subject to this SOW by name, national stock number, and sensitivity risk category.

(2) Obligates the contractor to comply with the requirements in this SOW and DoDM 5100.76, Physical Security of Sensitive Conventional Arms, Ammunition, and Explosives (AA&E), April

17, 2012.

(3) Obligates the contractor to allow DSS, and other appropriate Government representatives, access to its facilities and those of its subcontractors at all reasonable times to conduct surveys, inspections, and investigations necessary to review compliance with the physical security standards of the contract.

(4) Requires the contractor to notify DSS within 10 workdays when it issues a subcontract and to ensure the clause is included in every contract, including all sub-tier contracts.3.

ADDITIONAL REQUIREMENTS. The contractor is also advised that it must comply with applicable Federal, State, and local laws, ordinances, codes, and regulations, including obtaining all required licenses and permits in connection with the performance of the contract.

JMC Operations, Protection and Intelligence, G3/2 14 Nov 2012

Appendix II - SENSITIVE CONVENTIONAL AA&E SRC

1. GENERAL. This enclosure outlines processes for identifying the SRC of AA&E based on utility, casualty or damage effect, adaptability, and portability. The SRC identification process supports the minimum security requirements to protect AA&E adequately. This enclosure includes SRC I-IV and provides guidance for uniform identification and coding of AA&E items.

a. On the basis of their relative utility, attractiveness, and availability to criminal and terrorist elements, AA&E shall be categorized according to the risks involved. Any single container that contains a variety of spare parts that can be assembled to perform the basic function of the end item shall be categorized the same as the end item.

b. Section 2 of this enclosure lists those missiles and rockets determined to be sensitive and assigns appropriate risk categories to them. Conventional missiles and rockets that meet the definition of SRC I shall be included automatically in that category as they come into the inventory.

c. Sensitive Conventional AA&E, rocket, and missile SRC and actions for physical security accountability and transportation shall be standardized throughout the Department of Defense.

These items shall be integrated into standard catalog data by all DoD Components and shall be included in applicable documents that address physical security, accountability, storage, transportation, and other related functional activities. DoD Component item managers through joint-Service coordination shall use the processes outlined in section 4 of this enclosure for determining the SRC of AA&E for uniform identification and codification of AA&E items.

Examples are in sections 2 and 3 of this enclosure.

d. To ensure a uniform approach to AA&E item identification and coding, DoD Components shall incorporate the criteria into their respective cataloging policies and procedures.

Additionally, the criteria shall become part of the Federal cataloging system.

e. The DoD Components shall periodically review A&E coding by means of routine catalog data changes. The exception to applying the methodology specified in this enclosure shall be when a joint-Service agreement is reached on a case-by-case basis to place an item in a higher or lower

SRC than that indicated by the total numerical value, or when evidence of theft, diversion, or misuse requires higher coding.

f. The OUSD(I), based on threat assessment, evaluated risk, and geographical location, may determine the requirements for items to be placed in higher risk category or application of additional security measures. When this method for determining increased protection is applied, a DoD-wide message shall be prepared and provided to DoD Components.

JMC Operations, Protection and Intelligence, G3/2 14 Nov 2012

g. Items represented as examples for each SRC are provided for general reference. The specific

SRC category of all AA&E should be verified through appropriate supply and logistics systems to ensure accurate designation and incorporation of security measures.

2. MISSILES, ROCKETS, AND A&E

a. MISSILES AND ROCKETS

(1) SRC I. Man-portable missiles and rockets in a ready-to-fire configuration or when jointly stored or transported with the launcher tube and/or grip-stock and the explosive round, although not in a ready-to-fire configuration, shall be considered SRC I weapon items. Examples include:

(a) Stinger missiles.

(b) Dragon, Javelin, light antitank weapon (66mm), shoulder-launched multi-purpose assault weapon rocket (83mm), M136 (AT4) anti-armor launcher and cartridge (84mm).

(2) SRC II. Missiles and rockets that are crew-served or require platform-mounted launchers and other equipment to function include HYDRA-70 rockets and the tube-launched optically wire guided (TOW) missile. (3) SRC III. Missiles and rockets that require platform-mounted launchers and complex hardware and software equipment to function include the HELLFIRE missile.

b. A&E

(1) SRC I. Complete explosive rounds for SRC I missiles and rockets include those items listed in section 2.a.(1) of this enclosure.

(2) SRC II. Examples include:

(a) Hand or rifle grenades (high-explosive and white phosphorous).

(b) Antitank or antipersonnel mines (each with an unpacked weight of 50 pounds or less).

(c) Explosives used in demolition operations, C-4, military dynamite, and trinitrotoluene (TNT) with an unpacked weight of 100 pounds or less.

(d) Warheads for sensitive missiles and rockets weighing less than 50 pounds each.

(3) SRC III. Examples include:

JMC Operations, Protection and Intelligence, G3/2 14 Nov 2012

(a) Ammunition, .50 caliber and larger with explosive-filled projectile (unpacked weight of 100 pounds or less).

(b) Incendiary grenades and fuses for high-explosive grenades.

(c) Blasting caps.

(d) Supplementary charges.

(e) Bulk explosives.

(f) Detonating cord.

(g) Warheads for sensitive missiles and rockets weighing more than 50 pounds, but less than

100 pounds each.

(4) SRC IV. Examples include:

(a) Ammunition with non-explosive projectile (unpacked weight of 100 pounds or less).

(b) Fuzes (other than those for high-explosive grenades).

(c) Illumination, smoke, and chlorobenzylidene malononitrile(CS grenades).

(d) Incendiary destroyers.

(e) Riot control agents (100 pound package or less). Liquid pepper spray procured or manufactured through commercial sources is excluded.

(f) Ammunition for weapons not otherwise categorized in paragraph 3.c. in this enclosure.

(g) Explosive compounds of sensitive missiles and rockets (except warheads).

(h) Warheads for precision-guided munitions weighing more than 50 pounds (unpacked weight).

3. ARMS

a. SRC II. Examples include:

(1) M-16/M4s

(2) Light automatic weapons up to and including M249, M2, and 40mm MK19 machine guns.

JMC Operations, Protection and Intelligence, G3/2 14 Nov 2012

(3) SRC II weapons frames and receivers; and weapons components such as silencers, mufflers, and noise suppression devices.

b. SRC III. Examples include:

(1) Functional launch tube with umbilical squib installed and grip stock for the Stinger missile.

(2) Launch tube, sight assembly, and grip stock for missiles.

(3) Tracker for the Dragon missile.

(4) Mortar tubes up to and including 81mm.

(5) Grenade launchers (single shot).

(6) Rocket and missile launchers with an unpacked weight of 100 pounds or less.

(7) Flame throwers.

(8) The launcher, missile guidance set, or the optical sight for the TOW and the Javelin

Command Launch Unit.

c. SRC IV. Examples include:

(1) Single shot and semi automatic (non-automatic) shoulder-fired weapons such as shotguns and bolt action rifles and weapons barrels.

(2) Handguns.

(3) Recoil-less rifles up to and including 106mm.

4. CAT - U. Examples include, AA&E such as those items with numerical ratings of 13-16.

AA&E that are uncategorized and/or generally exceed an unpacked weight of 100 pounds shall have security policy developed by the responsible DoD Component.

5. COMPUTATION OF SRC. The DoD Components shall use Tables 2 through 6 to determine the numerical value of each risk factor (utility, casualty or damage, adaptability, and portability) and compute the overall risk and SRC. To determine the numerical rating corresponding to risk, select one value from each table (Tables 2 through 5) and then total the four numbers. Use the total to obtain the overall SRC value from risk factor SRC Conversion table (Table 6).

JMC Operations, Protection and Intelligence, G3/2 14 Nov 2012

6. The Procuring Command Manger will follow SRC authentication by the security office responsible to conduct the review/SRC determination. The tables below will be used if the contracting office does not provide proper identification media to the security office.

Table 2 – Utility Risk Factor Values

Utility

Risk

Factor

Description

High 1 High-explosive, concussion, and fragmentation devices.

Moderate 2 Small arms ammunition.

Low

Ammunition items not described in section 4 of this enclosure. Non-lethal munitions, civil disturbance chemicals, incendiary devices.

Impractical

Practice, inert, or dummy munitions; small electric explosive devices;

fuel thickening compound; or items possessing other characteristics that clearly and positively negate potential use by terrorist, criminal, or dissident factions.

Table 3 – Casualty or Damage Risk Factor Values

Casualty or

Damage

Effect

High

Extremely damaging or lethal to personnel; devices that would probably cause death to personnel or major material damage.

Moderate

Moderately damaging or injurious to personnel; devices that could probably cause personnel injury or material damage.

Low 3 Temporarily incapacitating to personnel.

None

Flammable items and petroleum based products readily available from commercial sources.

JMC Operations, Protection and Intelligence, G3/2 14 Nov 2012

Table 4 – Adaptability Risk Factor Values

Adaptability

High

Usable as is without modification. Easy to employ without the use of other system components.

Slight modification. Other system components required; or can be used with slight modification.

Major modification. Other components not available in the commercial market are required; or can be used with modification that changes the configuration.

Requires specified functions or environmental sequences that are not readily reproducible, or construction makes it incapable of producing high order detonation; for example, gas grains and impulse cartridges.

Table 5 – Portability Risk Factor Values

Portability

High 1 Items easily carried/concealed by one person.

Items that can be carried by one person for a short distance despite their shape, size, and weight.

Items that require at least two persons to carry because of their shape, size, and weight.

Material handling equipment required. The weight, size, and shape of these items preclude the movement without materials-handling equipment.

Table 6 – Risk Factor Numerical Values and SRC Conversion

Numerical Rating (Sum totals from Risk Factor Tables 2-5)

Risk Factor Evaluation SRC*

(4 - 5) High Sensitivity II (2)

(6 - 8) Moderate Sensitivity III (3)

(9 -12) Low Sensitivity IV (4)

(13 - 16) Non-Sensitive U (Un-Sensitive)

*SRC I (1) calculation is not included since it is specifically defined.

JMC Operations, Protection and Intelligence, G3/2 14 Nov 2012

Appendix II – REQUEST FOR SECURITY WAIVERS AND EXCEPTIONS

1. Exceptions are generally regarded as permanent and waivers provide temporary relief from compliance with prescribed standards. Requests for waivers are appropriate if corrective actions can be accomplished reasonably by local administrative or work order action or by the initiation of a construction project.

2. Waivers of DoD specific requirements will be approved for a period not to exceed 1 year or the time needed to correct the condition(s), whichever is soonest. Whenever conditions or compensatory measures change an amendment to change the waiver must be submitted, to the servicing contracting representative. The servicing government contracting representative will provide requests to the appropriate security office for processing. When conditions remain unchanged for the duration of the waiver a request for extension is required. The reason why the condition was not corrected is required. Waivers need not be requested for temporary conditions that will be resolved or corrected within 90 days of identification of deficiency.

3. Exceptions generally provide permanent relief from regulatory requirements. Requests for exceptions will be approved only when correction of a deficiency is not feasible and when security afforded by alternative measures or procedures are equivalent or better than that provided by the standard criteria.

4. Exceptions: Exceptions will be granted on a permanent basis when it is a known deficient condition that cannot be corrected due to resource requirements, physical limitations, etc. The contractor will make a concerted effort to ensure original compensatory measures are in place and are being complied with. Whenever conditions or compensatory measures change, a request for amendment must be submitted to the servicing government contracting representative.

5. Suitability determinations will only be approved when it is determined that any approved waiver and/or exception is being maintained by the contractor. DSS representatives will conduct a check of approved waivers and/or exceptions is being complied with by the contractor.

Findings will be reported on the security report submitted by DSS.

6. Compensatory measures are procedures or measures initiated in lieu of full compliance with regulatory or prescribed DoD security standards. Measures that are regulatory or prescribed are not compensatory. Compensatory measures must be initiated immediately upon determination that a deficient security condition exists for which a waiver or exception is required.

Implementation of such measures will not be held in abeyance pending submission or approval of a request for waiver or exception. Compensatory measures are essential to ensure that standards of protection equivalent to the regulatory requirements are maintained. Failure to accomplish mandated compensatory measures would result in revocation of the applicable waiver or exception. All requests for waivers or exceptions based upon compensatory measures must specify the estimated annual cost of such measures

8. Waivers and exceptions are not valid until approved by the procuring agency. Waivers and exceptions will not be requested solely to eliminate an inconvenience or minimize expense.

Waivers and exceptions will be considered individually.

9. The example below, on company letterhead, will be used to request DoD security waivers or exceptions:

MEMORANDUM FOR: (Servicing Contracting Office)

SUBJECT: Request for Physical Security Waiver (or Exception) – (Company Name)

1. Request the following security waiver (or exception) is granted:

a. Regulation. (Cite appropriate DoD directive, regulation, or supplement, to include paragraph for which waiver or exception is requested.)

b. Standard. (Paraphrase the specific DoD regulatory standard for which waiver or exception is requested.)

c. Reason standard cannot be met. (Provide specific details; include any material such as maps, photos, drawings, etc. that clearly illustrate the DoD regulatory shortfall and why the required standard cannot or should not be implemented.)

d. Compensatory measures in effect and all costs related to those measures. (List actual measures; illustrate as required, which have been implemented.)

e. Other factors bearing on the request. (Impact on other approved waivers or exceptions, impact on resources, impact of other security shortfalls, etc.)

f. Corrective actions. (Include explicit information as to actions being taken or planned to meet regulatory standards to include leading milestones and date of completion.)

2. The following waivers and exceptions are currently assigned: (List by identification number and assignment date.

3. The point of contact is Mr. John Doe, Title, email: no.rubberstamped@approvals, Phone:

(123) 456-7890.

Signature block of Company Manager