B08 Attachment 0007 Security SOW.pdf

SECURITY

STATEMENT

OF WORK

1. GENERAL AA&E in the custody of contractor owned facilities shall be protected according to the provisions of this Statement of Work (SOW).

2. CONTRACTOR-OWNED AA&E PRODUCTION AND STORAGE FACILITIES These facilities include areas where, through contract with the DoD Components, arms, ammunition, and/or explosives are manufactured, retrofitted, modified, or developed. This SOW outlines the additional requirements not further defined in DoD 5100.76M that apply specifically to contractor-owned facilities. In addition to this SOW, all other requirements in DoD 5100.76M and Reference (h) which are applicable to the SRC of AA&E being controlled, stored, or otherwise in the control of the contractor shall be applied.

3. FACILITY CONSTRUCTION AA&E in production and/or storage at contractor-owned facilities shall be secured in one of the structures listed in subparagraphs 3.a. through 3.i. of this SOW as prescribed and authorized by Joint Munitions Command (JMC) HQ:

a. A structure built in accordance with Reference (h).

b. A structure that complies with Reference (j).

c. A portable explosives magazine as specified in Reference (aj).

d. A structure built according to Department of Defense or UFC construction requirements for AA&E as supplemented by guidance in this SOW.

e. A storage structure built in accordance with Reference (l) to meet appropriate threat and delay time requirements.

f. An existing structure if approved by the JMC HQ. The JMC HQ shall coordinate with the supporting DSS field office for those facilities approved for use by JMC HQ. JMC HQ shall ensure alternative or compensatory measures are implemented prior to approval of existing structures that are not compliant with this SOW. JMC HQ shall maintain a list and provide a copy to the DSS supporting field office.

g. A GSA-approved modular vault (see Reference (ar)) with a GSA-approved Class 5Armory Vault Door in accordance with Reference (as).

h. A GSA-approved Class 5 map and plan container (see References (x) and (y)), or GSA-approved Class 5 weapons storage container (see Reference (aa)), for the storage of SRC III and IV arms only.

i. A Type II Magazine (for storage of SRC III and IV A&E only) pursuant to Reference (ap).

4. CONTRACTOR FACILITY SUITABILITY DETERMINATION

a. JMC HQ approval (authorization) of any of the structures in section 3 of this SOW shall be based on one or all of the items in subparagraphs 4.a.(1) through 4.a.(4).

(1)Type and quantity of the AA&E in possession of the contractor commensurate with all applicable safety requirements.

(2)Knowledge of the contractor’s AA&E storage and production structures based on past contract performance.

(3)Structural information provided by the contractor or DSS representative.

(4)JMC HQ on-site visit.

b. JMC HQ shall issue a written facility suitability determination to the contractor to show compliance by the contractor with the structural requirements of this SOW. The procuring command or activity may accept suitability determinations made by another procuring command /activity as long as the structural integrity of the same facility is unchanged. If more than one structure is involved for a given contract, the determination may encompass all of the applicable structures to avoid the necessity of a separate suitability determination for each storage structure. The suitability determination process must begin at the pre-award stage of the contract.

5. ADDITIONAL PROTECTIVE MEASURES

a. Security Locks and Hasps

(1)Access doors to storage and production structures shall be secured with a key-operated high-security padlock (see Reference (al)) and hasp (see Reference (am)). GSA-approved Class 5 vault doors and doors of GSA-approved Class 5 weapons storage containers, and doors of Type II magazines are excluded from this requirement. High-security locks and hasps will be procured by the contractor from the Defense Supply Center, Philadelphia.

(2)The lock and hasp requirement is intended for production structures where AA&E is to be left unattended overnight. If AA&E is removed at the end of the duty day from structures identified in section 2 of this SOW, no special lock is required to be installed on the production structure.

b. Combination, Key, and Lock Control. The contractor shall implement a control system that ensures accountability and control of AA&E locks, keys, and combinations.

(1)The contractor shall appoint a key and lock custodian to implement and supervise the control and use of locks, keys, and combinations.

(2)AA&E storage structure keys shall be retained separately from other keys and accessible only to those persons whose duties require access to AA&E.

(3)The number of keys shall be held to the minimum necessary and must be signed for by those persons authorized access.

(4)When not attended or in use, keys shall be stored in approved containers as described in Table 1 in Enclosure 4 of DoD 5100.76M. Reserve or replacement locks, cores, and keys shall be secured in the same manner as addressed in Table 1 in Enclosure 4 of DoD 5100.76M.

c. Access Control. The contractor shall ensure that only appropriately cleared persons and authorized persons are granted access to AA&E. Vehicular and pedestrian entry into and exit from the production and storage areas shall be controlled. Privately owned vehicles shall not be parked within 100 feet of storage and production structures.

d. Security Lighting. Exterior building and door lighting shall be provided for all structures containing SRC I and II items. The lighting shall be sufficient to allow security forces to detect unauthorized activity. Switches for exterior lights shall be installed in such a manner that they are accessible only to individuals with authorized access.

e. Perimeter Fencing. The need for perimeter fencing of structures containing SRC I and II items shall be determined by the JMC HQ after consultation with the AA&E contractor and/or the DSS representative. Guidelines for fencing are contained in Reference (aq). Perimeter fence chains as described in Reference (ae) shall be secured with a general field service padlock (see Reference (af)).

f. Intrusion Detection/Alarm System

(1)Structures storing SRC I and II missiles and rockets, SRC I and II A&E, and SRC II-IV arms shall be protected by an IDS unless the areas where they are located are continuously manned or under constant surveillance so that unauthorized entry can be detected. The necessity for non-duty hour security checks of these structures shall be determined by the JMC HQ after consultation with the AA&E contractor and/or the DSS representative.

(2)All materials and equipment used in the IDS shall be listed in Reference (t) under the specific alarm configuration/application, or be a system approved by the procuring commands DoD Component authority listed in paragraph 6.b. of Enclosure 4 of this SOW. A list of manufacturers of UL-listed IDS equipment is available from the UL Website at http://www.ul.com or from:

Underwriters Laboratory Publication Stock 333 Pfingsten Road Northbrook, IL 60062

(3)All IDS material and equipment shall be installed according to the criteria established in Reference (t). Reference (t) provides the technical requirements for installation, maintenance, testing, and operation of alarm equipment installed in an area or on an object that contains material for which physical security protection is necessary and required by this SOW.

(4)IDS transmission lines shall have line security (electronically monitored to detect evidence of tampering or attempted compromise). If line security is unavailable, two independent means of signal transmission from the alarmed area to the monitoring station shall be provided. Where feasible, one of the two independent means of alarm signal transmission shall be either a long-range radio or cellular telephone link. The dual transmission equipment shall continuously monitor the integrity of both the telephone wire line and cellular or long-range links. Upon loss of either communications path, the system shall immediately initiate notification to the monitoring facility via the remaining communications link. The AA&E contractor shall test each alarm sensor monthly to ensure the proper functioning of the system. A log of such test shall be retained for a period of 1 year.

(5)All alarm signals shall annunciate at a central control or monitoring station from which an armed police or security response force can be dispatched directly. Such station may be either a commercial central station listed with UL, an AA&E contractor proprietary station, or a local law enforcement monitoring station, or Government Contract Monitoring Station as specified in Reference (t).

(6)Alarm systems must comply with Reference (t) unless an exception is granted by JMC HQ. Each alarmed area must be issued a certificate by the UL-listed alarm installing company or DoD Component approving office as listed in Enclosure 4.

(7)The response force shall respond within 15 minutes after receipt of an alarm signal and consist of one of the types of responses listed in subparagraphs 5.f.(7)(a) through 5.f.(7)(c) of this

SOW.

(a)In-house AA&E Contractor Response Force. This refers to the AA&E contractor employee(s) on-site at the AA&E facility during non-duty hours. It also refers to a contract guard on-site during non-duty hours at the AA&E facility. These response forces are the responsibility of the AA&E contractor, rather than being controlled by a commercial central station or local law enforcement.

(b)Response Force Dispatched By a Commercial Central Station. Such force remains on the premises until a designated representative of the AA&E contractor arrives to assess the nature of the alarm and takes appropriate measures to ensure the security of the AA&E or for a period of not less than 1 hour. If the AA&E contractor representative fails to arrive within 1 hour, the central station (by contractual agreement) shall provide an incident report to the AA&E contractor within 24 hours of the incident. The report shall include the name of the subscriber, date and time of the alarm, and name of the contractor representative(s) notified to respond.

(c)Local Law Enforcement Agency. The AA&E contractor shall arrange for the law enforcement agency monitoring station to contact his or her designated representative within 15 minutes of alarm activation. If off site, the contractor’s representative shall arrive at the premises within 1 hour of the alarm notification to assess the nature of the alarm and take appropriate measures to ensure the security of the AA&E. Arrangements shall also be made for the law enforcement authority to notify the contractor when the contractor’s representative fails to arrive within 1 hour as required.

(8)The AA&E contractor shall arrange for constant manning/surveillance of AA&E storage areas by security personnel during duty and non-duty hours when the IDS is inoperative due to equipment failure/repair, and/or during emergency conditions. When classified AA&E is involved, security personnel shall be cleared to the level of classified access.

6. AA&E PRODUCTION LINE SECURITY The contractor shall assess the security vulnerabilities involving AA&E manufacturing/production operations in order to prevent the theft or pilferage of munitions during manufacturing. The contractor shall develop appropriate production line security countermeasures. Such protective measures shall be in writing and provided to the DSS for review.

Procedures shall be included outlining protective measures to be employed when the production line(s) is left unattended. CCTV, metal detectors at exit points, additional barriers, and changes in production line processes are examples of protective measures that may be employed.

7. IN-TRANSIT SECURITY The government shall advise the contractor of requisite transportation security requirements for shipments of AA&E to Government activities, other contractors, or subcontractors according to Enclosure 10 of DoD 5100.76M and applicable provisions of Chapter 205 of Reference (i) that the contractor shall follow. Contractors shall ensure that internal movement (transportation on a contractor’s facility) of SRC I and II AA&E includes the contractor’s ability to communicate with security and safety personnel.

8. CLASSIFIED AA&E Contractors manufacturing, storing, transporting, or in possession of classified AA&E shall be cleared in accordance with Reference (m). Classified AA&E, if also categorized according to Enclosure 7 of DoD 5100.76M, shall be stored and transported according to the provisions of DoD 5100.76M. All other classified AA&E not categorized according to Enclosure 7 of DoD 5100.76M shall be protected in accordance with Reference (n).

9. ACCOUNTABILITY The government shall require the contractor to be accountable for AA&E produced/manufactured or under their control. The contractor is accountable for AA&E items with which they are furnished in support of a DoD contract as well. The contractor shall provide the government with a written procedure of how accountability shall be established and retained, including inventories at specified frequencies. A copy of these procedures shall be furnished to DSS upon approval by the government.

10. DISPOSAL AND DEMIL OF AA&E The government shall provide instructions to the contractor concerning the disposal and DEMIL of residual AA&E. AA&E awaiting such disposal may be stored outside in an “open” manner (excluding SRC I and IIAA&E) provided the conditions in subparagraphs 10.a. through 10.e. of this SOW are met.

a. The items remain under constant surveillance (e.g., CCTV, physical presence of contract employees, or contract employees who are able to maintain constant visual observation of the

AA&E).

b. The items are enclosed in a fenced area with 24-hour access control. The fence must be constructed according to the guidelines in Reference (aq).

c. The items are banded and crated, with proper accountability and inventory procedures in place as prescribed by the government.

d. The open storage area is lighted during the hours of darkness or times of reduced visibility to enhance surveillance.

e. The surveillance system in place provides for the immediate detection of illegal activity, notification to monitoring locations, and 15-minute response as described in subparagraph 5.f.(7) of this SOW.

11. ARMS PARTS Major parts for arms (such as barrels and major subassemblies) shall be afforded at least the same protection as SRC IV arms. An arms frame or receiver constitutes a weapon and such parts shall be stored according to the applicable category (e.g., the receiver of a.50 caliber machine gun shall be stored as a SRC II arm).

12. INCIDENT REPORTS

a. Contractors shall report the incidents listed in subparagraphs 12.a.(1) through 12.a.(6) of this SOW, no later than 72 hours after discovery, to the office of the appropriate DSS Regional Director for Industrial Security and the Government (these points of contact can be found at http://www.dss.mil):

(1)All AA&E thefts and losses.

(2)Significant damage (e.g., explosion, fire, flood, other natural disasters) to AA&E and/or AA&E structures.

(3)Any attempted or actual armed robbery of AA&E items.

(4)Forced entry or attempted forced entry into AA&E areas.

(5)Evidence of illegal trafficking of AA&E.

(6)Evidence of terrorist activity directed against AA&E areas as determined by local, State, or Federal law enforcement, or responsible DoD Component.

b. The contractor shall also notify local law enforcement and the local FBI office of any of the incidents described in this section immediately upon discovery. After the initial notifications, the contractor shall send a written report of the incident to the appropriate DSS office.

13. PHYSICAL SECURITY DEVIATIONS

a. Deviations from this SOW.

(1)Waivers may be approved for temporary relief from a specific requirement in this SOW pending action to conform to such requirement. Waivers shall be granted for a period not to exceed 12 months and may be extended only after a review of circumstances confirms the necessity of the extension. Waiver requests shall include a statement as to why the contractor is unable to meet the requirements in this SOW and shall outline compensatory measures proposed by the contractor that shall provide equivalent protection of AA&E at contractor facilities.

(2)Exceptions may be approved for permanent relief from a requirement specified in this SOW. Exceptions shall be granted only when compliance with a requirement from this SOW would unduly impede mission performance as described and documented in the extension request.

As with waivers, approved exceptions shall specify the rationale for granting the exception. In addition, approved exceptions shall specify the alternative or compensatory measure(s) that shall provide equivalent protection of the exception security requirement(s). Exceptions shall be reviewed every 3 years or at contract renewal by the Government and DSS.

b. The government shall coordinate waiver requests with the office of the appropriate DSS Regional Director for Industrial Security. The government shall forward the waiver request, with recommendations, to AMC HQ for decision. Copies of approved waivers and exceptions shall be provided to the office of the appropriate DSS Regional Director for Industrial Security.

c. Blanket deviations or exceptions shall not be authorized.

14. STANDING PRACTICE PROCEDURES (SPP)

a. Contractors shall prepare and maintain written procedures to implement the requirements in this SOW. These SPP shall be sufficient in scope to provide employees with the procedures necessary to ensure the safeguarding of AA&E. The office of the DSS Regional Director for Industrial Security shall review SPP to determine their adequacy. Contractors shall modify SPP that DSS judges inadequate. A copy of the SPP shall be provided to the office of the DSS Regional Director for Industrial Security, as appropriate, upon request.

b. Contractors shall develop training programs on SPP for those responsible for safeguarding AA&E on an annual basis. SPP training records can be incorporated into other training records and shall be retained for 1 year.

REFERENCES

(a) DoD 5100.76-M, “Physical Security of Sensitive Conventional Arms, Ammunition, and Explosives,” May 8, 2018

(b) DoD Directive 5143.01, “Under Secretary of Defense for Intelligence (USD(I)),” April 22,

(c) DoD Instruction 5100.76, “Safeguarding Conventional Arms, Ammunition, and Explosives (AA&E),” May 18, 2018

(d) DoD Manual 5200.01, “DoD Information Security Program,” February 24, 2012, as amended

(e) DoD Manual 8910.01, “DoD Information Collections Manual,” April 19, 2017, as amended

(f) DoD 5200.08-R, “Physical Security Program,” May 27, 2009, as amended

(g) DoD Instruction 6055.16, “Explosives Safety Management Program,” August 31, 2018, as amended

(h) DoD 6055.09-M, “DoD Ammunition and Explosives Safety Standards,” February 29, 2008, as amended

(i) Defense Transportation Regulation 4500.9-R, “Defense Transportation Regulation, Part II, Cargo Movement,” June 2019

(j) DoD 4145.26-M, “DoD Contractor’s Safety Manual for Ammunition and Explosives,” August 31, 2018

(k) DoD Manual 4140.01, “DoD Supply Chain Materiel Management Procedures,” date varies by volume.

(l) Military Handbook 1013/1A, “Design Guidelines for Physical Security of Facilities,” December 15, 1993

(m) DoD Manual 5200.02, “Procedures For The DoD Personnel Security Program (PSP),”April 3, 2017

(n) DoD 5220.22-M, “National Industrial Security Program Operating Manual,” May 18, 2016, as amended

(o) Section 922(g) of title 18, United States Code

(p) DoD Instruction 6400.06, “Domestic Abuse Involving DoD Military and Certain Affiliated Personnel,” July 9, 2015, as amended

(q) DoD Instruction 6055.17, “DoD Emergency Management (EM) Program,” February 13,

(r) Unified Facilities Criteria 4-021-02NF, “Security Engineering Electronic Security Systems,” October 23, 2006, as amended

(s) Unified Facilities Guide Specification Division 28, Section 28 10 05, “Electronic Security System,” May 2016

(t) Underwriters Laboratories Inc., Standard for Safety, UL-2050, “National Industrial Security Systems,” August 10, 2003, www.ul.com

(u) Federal Information Processing Standards Publication 140-3, “Security Requirements for Cryptographic Modules,” March 22, 2019

(v) Section 797 of title 50, United States Code

(w) DoD Instruction 5200.08, “Security of DoD Installations and Resources and the DoD Physical Security Review Board (PSRB),” May 19, 2010, as amended

(x) Federal Specification AA-F-363D, “Filing Cabinet, Security, Maps and Plans, General Filing, and Storage,” June 1 2001

(y) Federal Specification AA-F-358J, “Filing Cabinet, Legal and Letter Size, Uninsulated, Security,” November 2, 2010

(aa) Federal Specification AA-C-2859, “Cabinet, Security, Weapons Storage,” April 20, 2007

(ab) Federal Specification FF-L-2937, “Combination Lock, Mechanical,” January 31, 2005, as amended

(ac) Underwriters Laboratories, Inc. Standard UL 768, “Standard for Combination Locks,” January 6, 2006

(ad) Department of Homeland Security, “User’s Guide on Security Seals for Domestic Cargo,” January 2007

(ae) Federal Specification RR-C-271D, “Chains and Attachments, Welded and Weldless,” September 25, 1990

(af) Federal Specification FF-P-2827, “Padlock, Key Operated, General Field Service,” November 27, 2002

(ag) Commercial Item Description, “Padlock (Key Operated),” August 6, 1999

(ah) Commercial Item Description, “Padlock Set (Individually Keyed or Keyed Alike),” August 6, 1999

(ai) Federal Specification AA-V-2940, “Vault System, Armory, Assembled,” February 20,

(aj) Naval Facilities Engineering Service Center Technical Data Sheet TDS-2078-SHR, “Pre- Engineered Explosives Magazines,” June 2001

(ak) Naval Facilities Engineering Security Center-Internal Locking Device (ILD) “Engineering Drawings,” January 2009

(al) Military Detail Specification MIL-DTL-43607H, “Padlock, Key Operated, High Security, Shrouded Shackle,” June 5, 2007

(am) Military Detail Specification MIL-DTL-29181, “Hasp, High Security, Shrouded, for High and Medium Security Padlock,” March 10, 1998, as amended

(an) Naval Sea Warfare Center Purchase Specification NSWC 3046-93-2, “Pre-Engineered/Pre- Fabricated Steel Armory,” April 2011

(ao) Naval Sea Warfare Center Purchase Specification NSWC 3046-93-1, “Pre-Engineered/Pre- Fabricated Steel Magazines,” April 2011

(ap) Section 208, part 555 of title 27, Code of Federal Regulations

(aq) Federal Specification RR-F-191-K, “Fencing, Wire and Post Metal (and Gates, Chain-link Fence Fabric, and Accessories) (General Specification),” May 14, 1990

(ar) Federal Specification AA-V-2737, “Modular Vault System,” April 25, 1990

(as) Federal Specification AA-D-600D, “Door, Vault, Security,” May 25, 2000

(at) DoD Instruction 4140.01, “DoD Supply Chain Materiel Management Policy,” December 14, 2011, as amended

(au) DoD Manual 4160.21, “Defense Materiel Disposition,” October 22, 2015

(av) Parts 223 and 252 of title 48, Code of Federal Regulations

(aw) Subpart 2.101 of the Federal Acquisition Regulation, current edition

(ax) DoD Directive 5105.65, “Defense Security Cooperation Agency (DSCA),” October 26,

(ay) Office of the Chairman of the Joint Chiefs of Staff, “DoD Dictionary of Military and Associated Terms,” current edition

(az) DoD Directive 5105.64, “Defense Contract Management Agency (DMCA),” January 10,

(ba) Chapter 47 of title 10, United States Code (also known as the “Uniform Code of Military Justice, as amended”)