Attachment_0012-_AT_OPSEC_Review_Cover_Sheet.pdf

Page 1 of 4AMRDEC FORM 21, APR 2015

CONTRACT REQUIREMENTS PACKAGE ANTITERRORISM/OPERATIONS SECURITY REVIEW COVER SHEET For use of this form, see AMC-R 525-13, Antiterrorism; the proponent agency is AMRDEC AT/OPSEC.

SECTION I

Purpose of cover sheet: To document the review of the requirements package performance work statement (PWS), statement of work (SOW), quality assurance surveillance plan (QASP), and any applicable source selection evaluation criteria for antiterrorism (AT) and other related protection matters, to include, but not limited to: AT, Operations Security (OPSEC), Information Assurance (IA)/cyber security, physical security, law enforcement, intelligence, and foreign disclosure.

Army policy requirement: A signed AT/OPSEC cover sheet is required to be included in all requirements package except for supply contracts under the simplified acquisition level threshold ($150,000.00), field ordering officer actions and Government purchase card purchases. Command policy may require this form for supply contracts under the simplified acquisition level threshold.

Mandatory review and signatures: The organizational Antiterrorism Officer (ATO), Information Security (INFO SEC) Manager, Operations Security (OPSEC) Officer, Information Assurance (IA) Manager, Physical Security Officer (PSO) and Contracting Officer Representative (COR) must review and sign each requirements package prior to submission to the supporting contracting activity, to include coordination with other staff review as appropriate per section II below. If the requiring activity does not have an ATO, INFO SEC Manager, OPSEC Officer, IA Manager, and PSO, the first functional in the chain of command will review the contract for each functional consideration.

SECTION II

Standard Contract Language Provision/Contract Clause Text Applicability and/or Additional PWS/SOW Language. If standard contract or clause language found in Section III of this form is sufficient to meet specific contract request requirements, check "yes" in block below and include this language in the PWS/SOW. If standard contractual text (provisions or clauses) or clause language does not apply, check "no". If the standard PWS/ SOW language applies, but is not in and of itself sufficient, check "yes" and "PWS" and include both the standard language and additional contract specific language in the PWS/SOW. If yes is marked for items 1, 3, 5, 9, 10, 12, or 14, training is required. Mandatory training must be measured as a deliverable and evaluated in the QASP.

Organization: Prototype Integration Facility, AMRDEC Date: 14 June 16 Contract/TO/DO TBD (Technical Support for PIF 3)

Item - Antiterrorism confirms AR-525-13 and local requirements

1. AT level I training (general) YES NO PWS ATO

2. AT awareness training for US based contractor personnel traveling overseas YES NO PWS ATO

3. iWatch training YES NO PWS ATO

Antiterrorism Officer Review Signature: I am ATO Level II certified and have reviewed the requirements package and understand my responsibilities IAW Army Regulation525-13.

Grade: DE-03

Phone 256-313-5244

Item - Information Security confirms AR 380-5 and local requirements; Background Checks/Common Identification Standard confirms AD 2014-05 requirements

4. Contracts that require handling or access to Classified Information YES NO PWS INFO SEC

5. Threat Awareness Reporting Program (TARP) training YES NO PWS INFO SEC

6. Contractors requiring Common Access Card (CAC) YES NO PWS INFO SEC

7. Contractors that do not require CAC, but require access to a DoD facility or installation YES NO PWS INFO SEC

8. Identification of Contractor Employees YES NO PWS INFO SEC

9. Security Education, Training & Awareness (SETA) training YES NO PWS INFO SEC

10. Combating Trafficking in Persons, Cyber Awareness Challenge, Personal Identification Information (PII) and Sexual Harassment Assault Response Program (SHARP) training

YES NO PWS INFO SEC

Information Security Manager Review Signature: I have reviewed the requirements package and it contains the correct information to meet items 4, 5, 6, 7, 8, 9, and 10 requirements.

Grade: GG-12

Phone 256-313-6747

Page 2 of 4AMRDEC FORM 21, APR 2015

SECTION II (CONTINUED)

Item - Operations Security confirms Army Regulation 530-1 and local requirements

11. OPSEC SOP / Plan requirements YES NO PWS OPSEC

12. OPSEC training YES NO PWS OPSEC

Operations Security Officer Review Signature: I am OPSEC Level II certified and have reviewed the requirements package and it is in compliance with Army Regulation 530-1, Operations Security.

Phone 256-842-5392

Grade: DE-03

Item - Information Assurance confirms AR 25-1, AR 25-2 and local requirements

13. Government Information Systems and Information Awareness requirements YES NO PWS IA

14. Information Assurance (IA) / Information Technology (IT) training and/or certification YES NO PWS IA

Information Assurance Manager Review Signature: I have reviewed the requirements package and it contains the correct information to meet items 13 and 14.

Grade: DE-IV

Phone 2568761438

Item - Physical Security confirms AR 190-3 and local requirements

15. Access and general protection / security policy and procedures YES NO PWS PSO

16. Contract requiring security guards YES NO PWS PSO

17. Key control YES NO PWS PSO

18. Lock combinations YES NO PWS PSO

Physical Security Manager Review Signature: I have reviewed the requirements package and it contains the correct information to meet items 15, 16, 17, and 18.

Grade: DE-03

Phone 256-842-5360

Item - Area COR

19. Contractor Authorized to Accompany the Force clause YES NO PWS COR

20. Contract requiring performance or delivery in a foreign country YES NO PWS COR

21. Contract involves storing of HAZMAT, and/or Arms, Ammunition & Explosives (AA&E) PWSYES NO COR

Requiring Element Review Signature: I have reviewed the requirements package and it contains the correct information to meet items 19, 20, and 21 requirements. Required after contract award.

Grade: DB-04

Phone 256-842-5113

Remarks:

SECTION III. STANDARD CONTRACT PROVISION AND CLAUSE TEXT APPLICABILITY AND/OR ADDITIONAL PWS LANGUAGE

1. AT LEVEL 1 TRAINING: This provision/contract text is for contractor employees with an area of performance within an Army controlled installation, facility or area. All contractor employees, to include subcontractor employees, requiring access to government installations, facilities and controlled access areas shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee to the COR, or to the contracting officer if a COR is not assigned, within 30 calendar days after completion of training by all employees and subcontractor personnel. AT level I awareness training is available at the following website: https://jkodirect.jten.mil.

2. AT AWARENESS TRAINING FOR US BASED CONTRACTOR PERSONNEL TRAVELING OVERSEAS: This standard language requires US based contractor employees and associated sub-contractor employees to make available and to receive Government provided area of responsibility (AOR)-specific AT awareness training as directed by AR 525-13. Specific AOR training content is directed by the combatant commander, with the unit ATO being the local point of contact.

Page 3 of 4AMRDEC FORM 21, APR 2015

SECTION III. STANDARD CONTRACT PROVISION AND CLAUSE TEXT APPLICABILITY (CONTINUED)

3. iWatch TRAINING: This standard language is for contractor employees with an area of performance within an Army controlled installation, facility or area. The contractor and all associated sub-contractors shall brief all employees on the local iWATCH program (training standards provided by the requiring activity ATO). This locally developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 calendar days of contract award and within 30 calendar days of new employees commencing performance with the results reported to the COR NLT 30 calendar days after contract award.

4. CONTRACTS THAT REQUIRE HANDLING OR ACCESS TO CLASSIFIED INFORMATION: Contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified “Confidential,” “Secret,” or “Top Secret” and requires contractors to comply with—

(1) The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M); any revisions to DOD 5220.22-M, notice of which has been furnished to the contractor.

5. THREAT AWARENESS REPORTING PROGRAM TRAINING: For all DoD contractors with security clearances. Per AR 381-12 Threat Awareness and Reporting Program (TARP), contractor employees must receive annual TARP training presented by a Counterintelligence Special Agent. Contact the Redstone Arsenal MI Detachment at 256-313-5186 for scheduling.

6. FOR CONTRACTORS REQUIRING COMMON ACCESS CARD (CAC): Before CAC issuance, the contractor employee requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation in accordance with Army Directive 2014-05.

The contractor employee will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) Remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) Physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

7. CONTRACTORS THAT DO NOT REQUIRE CAC, BUT REQUIRE ACCESS TO A DOD FACILITY OR INSTALLATION: Contractor and all associated sub-contractors employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB) (Army Directive 2014-05/AR 190-13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

8. IDENTIFICATION OF CONTRACTOR EMPLOYEES: This standard language text is for contractor employees with an area of performance within an Army controlled installation, facility or area. The Contractor (to include subcontractors) shall provide each employee a Redstone Arsenal Identification (ID) Badge, which includes at a minimum, the Company Name, Employee Name and a color photo of the employee. ID Badges for Key Personnel shall also indicate their job title. ID Badges shall be worn at all times during which the employee is performing work under this contract. Each Contractor (to include subcontractors) employees shall wear the ID Badge in a conspicuous place on the front of exterior clothing and above the waist except when safety or health reasons prohibit. The Contractor (to include subcontractors) shall be responsible for collection of ID Badges upon completion of the contract or termination of employee. A listing of issued identification cards shall be furnished to the Contracting Officer prior to the contract performance date and updated as needed to reflect Contractor and Subcontractor personnel changes. Foreign owned companies and foreign national contractors will only be permitted to perform under this contract when there are no qualified U.S. companies and /or U.S. contractors. All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They shall also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed.

9. SECURITY EDUCATION, TRAINING & AWARENESS (SETA) TRAINING: This provision/contract text is for contractor employees with an area of performance within an Army controlled installation, facility or area. All contractor employees, to include subcontractor employees, requiring access to government installations, facilities and controlled access areas shall complete annual mandatory SETA awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The following URL is made available for your training: https://www.lms.army.mil. Upon completion of the training, you must provide certification to the Information Security Officer. Security Education, Training & Awareness covers Information Security, Personnel Security and Industrial Security Programs.

10. COMBATING TRAFFICKING IN PERSONS, CYBER AWARENESS CHALLANGE, PERSONAL IDENTIFICATION INFORMATION (PII) and SEXUAL HARRASSMENT ASSAULT RESPONSE PROGRAM (SHARP) TRAINING: This provision/contract text is for contractor employees with an area of performance within an Army controlled installation, facility or area. All contractor employees, to include subcontractor employees, requiring access to government installations, facilities and controlled access areas shall complete Combating Trafficking in Persons, Cyber Awareness Challenge, Personal Identification Information (PII), and Sexual Harassment Assault Response Program (SHARP). The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR or to the contracting officer, if a COR is not assigned, within 30 calendar days after completion of training by all employees and subcontractor personnel.

11. OPSEC SOP / PLAN REQUIREMENTS: The contractor shall develop an OPSEC Standing Operating Procedure (SOP)/Plan within 90 calendar days of contract award, to be reviewed and approved by the responsible Government OPSEC officer, per AR 530-1, Operations Security. This SOP/ Plan will include the government's critical information, why it needs to be protected, where it is located, who is responsible for it, and how to protect it.

12. OPSEC TRAINING: Level I OPSEC Awareness Training: Per AR 530-1, Operations Security, all contractor employees, to include subcontractor employees shall complete Level I OPSEC Awareness Training within 30 calendar days of their reporting for duty. All subcontractors shall take the Level 1 OPSEC Awareness Training located at the below website and print the certificates demonstrating completion. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR, within 10 calendar days after completion of training by all employees and subcontractor personnel. Note: after the first screen, select User Type: Civilian/Contractor, then Service: Army, then Grade N/A.

OPSEC awareness training is available at the following website: http://cdsetrain.dtic.mil/opsec/

Page 4 of 4AMRDEC FORM 21, APR 2015

13. GOVERNMENT INFORMATION SYSTEMS AND INFORMATION AWARENESS REQUIREMENTS: All contractor employees with access to a government info system must be registered in the ATCTS (Army Training Certification Tracking System) at commencement of services, and must successfully complete the DOD Cyber Awareness Challenge Training prior to access to the IS and then annually thereafter, and must sign an Acceptable Use Policy (AUP).

14. INFORMATION ASSURANCE (IA) / INFORMATION TECHNOLOGY (IT) TRAINING AND/OR CERTIFICATION: Per DoD 8570.01-M , DFARS

252.239.7001 and AR 25-2, the contractor employees supporting IA/IT functions shall be appropriately trained and/or certified, as required upon contract award. The baseline certification as stipulated in DoD 8570.01-M must be completed upon contract award. Additional training for IA workforce positions must be completed within six months.

15. ACCESS AND GENERAL PROTECTION / SECURITY POLICY AND PROCEDURES: This standard language text is for contractor employees with an area of performance within an Army controlled installation, facility or area. All contractor employees, to include associated sub-contractors employees shall comply with applicable installation, facility and area Commander Installation and facility access and local security policies and procedures (provided by the Government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. The contractor workforce shall comply with all personal identity verification requirements as directed by DoD, Department of the Army Headquarters, and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition at any individual facility or installation change, the Government may require changes in contractor security matters or processes. The prime contractor Human Resources/Security Officer is responsible for the collection of all Redstone Badges and CAC cards issued to their employees. The Human Resources/ Security Officer will then turn over these credentials to the COR. This applies when the contract expires; as well as, when a contractor resigns or is terminated. After accounting for all badges/CACs, the COR will turn in the credentials at the One Stop Badging Office or CAC Office (MILPO). All contract employees, including subcontractor employees who are not in possession of the appropriate security clearance or access privileges, will be escorted in areas where they may be exposed to classified and/or sensitive materials and/or sensitive or restricted areas.

16. CONTRACT REQUIRING SECURITY GUARDS: This standard language text is for contractor employees with an area of performance within an Army controlled installation, facility or area. The Physical Security Officer must or will review the PWS/SOW with the Contracting Officer (KO) for accuracy and completeness of AR 190-11 requirements. All contractor and all associated sub-contractor employees shall comply with applicable installation, facility and area commander installation/facility policies and procedures on storing weapons and ammunition IAW AR 190-11 (provided by government representative).

17. KEY CONTROL: The Contractor shall establish and implement methods of making sure all keys/key cards issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include key cards. No keys issued to the Contractor by the Government shall be duplicated. The Contractor shall develop and follow procedures covering key control that shall be included in the Standard Operating Procedures. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the Contracting Officer. In the event keys, other than master keys, are lost or duplicated, the Contractor shall, upon direction of the Contracting Officer, re-key or replace the affected lock or locks;

however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due the Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the Contractor. The Contractor shall prohibit access to Government issued keys/key cards by unauthorized personnel other than the Contractor's employees. The Contractor shall prohibit entry into controlled areas by unauthorized personnel other than the Contactor's employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the Contracting Officer.

18. LOCK COMBINATIONS: The Contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized persons. The Contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations. These procedures shall be included in the Contractor’s Standard Operating Procedures.

19. CONTRACTOR AUTHORIZED TO ACCOMPANY THE FORCE CLAUSE: DFARS Clause 252.225-7040, Contractor Personnel Authorized to Accompany U.S. Armed Forces Deployed Outside the United States. The clause shall be used in solicitations and contracts that authorize contractor personnel to accompany US Armed Forces deployed outside the US in contingency operations; humanitarian or peacekeeping operations; or other military operations or exercises, when designated by the combatant commander. The clause discusses the following AT/OPSEC related topics: required compliance with laws and regulations, pre-deployment requirements, required training (per combatant command guidance), and personnel data required.

20. CONTRACT REQUIRING PERFORMANCE OR DELIVERY IN A FOREIGN COUNTRY: DFARS Clause 252.225-7043, Antiterrorism/Force Protection for Defense Contractors Outside the US. The clause shall be used in solicitations and contracts that require performance or delivery in a foreign country. This clause applies to both contingencies and non-contingency support. The key AT requirement is for non-local national contractor personnel to comply with theater clearance requirements and allows the combatant commander to exercise oversight to ensure the contractor's compliance with combatant commander and subordinate task force commander policies and directives.

21. CONTRACT INVOLVES STORING OF HAZMAT, AND/OR ARMS, AMMUNITION & EXPLOSIVES (AA&E): For contracts requiring storage of:

Hazardous Material, use FAR Clause 52.223-3 or PADDS Clause IF70015

Arms, Ammunition and Explosives (AA&E), use DFARS Clause 252.223-7007 or PADDS Clause IA60004

Page of

AMRDEC FORM 21, APR 2015

Page of

AMRDEC FORM 21, APR 2015

CONTRACT REQUIREMENTS PACKAGE ANTITERRORISM/OPERATIONS SECURITY REVIEW COVER SHEET For use of this form, see AMC-R 525-13, Antiterrorism; the proponent agency is AMRDEC AT/OPSEC.

SECTION I

Purpose of cover sheet: To document the review of the requirements package performance work statement (PWS), statement of work (SOW), quality assurance surveillance plan (QASP), and any applicable source selection evaluation criteria for antiterrorism (AT) and other related protection matters, to include, but not limited to: AT, Operations Security (OPSEC), Information Assurance (IA)/cyber security, physical security, law enforcement, intelligence, and foreign disclosure.

Army policy requirement: A signed AT/OPSEC cover sheet is required to be included in all requirements package except for supply contracts under the simplified acquisition level threshold ($150,000.00), field ordering officer actions and Government purchase card purchases. Command policy may require this form for supply contracts under the simplified acquisition level threshold.

Mandatory review and signatures: The organizational Antiterrorism Officer (ATO), Information Security (INFO SEC) Manager, Operations Security (OPSEC) Officer, Information Assurance (IA) Manager, Physical Security Officer (PSO) and Contracting Officer Representative (COR) must review and sign each requirements package prior to submission to the supporting contracting activity, to include coordination with other staff review as appropriate per section II below. If the requiring activity does not have an ATO, INFO SEC Manager, OPSEC Officer, IA Manager, and PSO, the first functional in the chain of command will review the contract for each functional consideration.

SECTION II

Standard Contract Language Provision/Contract Clause Text Applicability and/or Additional PWS/SOW Language. If standard contract or clause language found in Section III of this form is sufficient to meet specific contract request requirements, check "yes" in block below and include this language in the PWS/SOW. If standard contractual text (provisions or clauses) or clause language does not apply, check "no". If the standard PWS/SOW language applies, but is not in and of itself sufficient, check "yes" and "PWS" and include both the standard language and additional contract specific language in the PWS/SOW. If yes is marked for items 1, 3, 5, 9, 10, 12, or 14, training is required. Mandatory training must be measured as a deliverable and evaluated in the QASP.

Item - Antiterrorism confirms AR-525-13 and local requirements

1. AT level I training (general)

ATO

2. AT awareness training for US based contractor personnel traveling overseas

ATO

3. iWatch training

ATO

Antiterrorism Officer Review Signature: I am ATO Level II certified and have reviewed the requirements package and understand my responsibilities IAW Army Regulation525-13.

Item - Information Security confirms AR 380-5 and local requirements; Background Checks/Common Identification Standard confirms AD 2014-05 requirements

4. Contracts that require handling or access to Classified Information

INFO SEC

5. Threat Awareness Reporting Program (TARP) training

INFO SEC

6. Contractors requiring Common Access Card (CAC)

INFO SEC

7. Contractors that do not require CAC, but require access to a DoD facility or installation

INFO SEC

8. Identification of Contractor Employees

INFO SEC

9. Security Education, Training & Awareness (SETA) training

INFO SEC

10. Combating Trafficking in Persons, Cyber Awareness Challenge, Personal Identification Information (PII) and Sexual Harassment Assault Response Program (SHARP) training

INFO SEC

Information Security Manager Review Signature: I have reviewed the requirements package and it contains the correct information to meet items 4, 5, 6, 7, 8, 9, and 10 requirements.

SECTION II (CONTINUED)

Item - Operations Security confirms Army Regulation 530-1 and local requirements

11. OPSEC SOP / Plan requirements

OPSEC

12. OPSEC training

OPSEC

Operations Security Officer Review Signature: I am OPSEC Level II certified and have reviewed the requirements package and it is in compliance with Army Regulation 530-1, Operations Security.

Item - Information Assurance confirms AR 25-1, AR 25-2 and local requirements

13. Government Information Systems and Information Awareness requirements

IA

14. Information Assurance (IA) / Information Technology (IT) training and/or certification

IA

Information Assurance Manager Review Signature: I have reviewed the requirements package and it contains the correct information to meet items 13 and 14.

Item - Physical Security confirms AR 190-3 and local requirements

15. Access and general protection / security policy and procedures

PSO

16. Contract requiring security guards

PSO

17. Key control

PSO

18. Lock combinations

PSO

Physical Security Manager Review Signature: I have reviewed the requirements package and it contains the correct information to meet items 15, 16, 17, and 18.

Item - Area COR

19. Contractor Authorized to Accompany the Force clause

COR

20. Contract requiring performance or delivery in a foreign country

COR

21. Contract involves storing of HAZMAT, and/or Arms, Ammunition & Explosives (AA&E)

COR

Requiring Element Review Signature: I have reviewed the requirements package and it contains the correct information to meet items 19, 20, and 21 requirements. Required after contract award.

SECTION III. STANDARD CONTRACT PROVISION AND CLAUSE TEXT APPLICABILITY AND/OR ADDITIONAL PWS LANGUAGE

1. AT LEVEL 1 TRAINING: This provision/contract text is for contractor employees with an area of performance within an Army controlled installation, facility or area. All contractor employees, to include subcontractor employees, requiring access to government installations, facilities and controlled access areas shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee to the COR, or to the contracting officer if a COR is not assigned, within 30 calendar days after completion of training by all employees and subcontractor personnel. AT level I awareness training is available at the following website: https://jkodirect.jten.mil.

2. AT AWARENESS TRAINING FOR US BASED CONTRACTOR PERSONNEL TRAVELING OVERSEAS: This standard language requires US based contractor employees and associated sub-contractor employees to make available and to receive Government provided area of responsibility (AOR)-specific AT awareness training as directed by AR 525-13. Specific AOR training content is directed by the combatant commander, with the unit ATO being the local point of contact.

3. iWatch TRAINING: This standard language is for contractor employees with an area of performance within an Army controlled installation, facility or area. The contractor and all associated sub-contractors shall brief all employees on the local iWATCH program (training standards provided by the requiring activity ATO). This locally developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 calendar days of contract award and within 30 calendar days of new employees commencing performance with the results reported to the COR NLT 30 calendar days after contract award.

4. CONTRACTS THAT REQUIRE HANDLING OR ACCESS TO CLASSIFIED INFORMATION: Contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified “Confidential,” “Secret,” or “Top Secret” and requires contractors to comply with— (1) The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M); any revisions to DOD 5220.22-M, notice of which has been furnished to the contractor.

5. THREAT AWARENESS REPORTING PROGRAM TRAINING: For all DoD contractors with security clearances. Per AR 381-12 Threat Awareness and Reporting Program (TARP), contractor employees must receive annual TARP training presented by a Counterintelligence Special Agent. Contact the Redstone Arsenal MI Detachment at 256-313-5186 for scheduling.

6. FOR CONTRACTORS REQUIRING COMMON ACCESS CARD (CAC): Before CAC issuance, the contractor employee requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation in accordance with Army Directive 2014-05. The contractor employee will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) Remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) Physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

7. CONTRACTORS THAT DO NOT REQUIRE CAC, BUT REQUIRE ACCESS TO A DOD FACILITY OR INSTALLATION: Contractor and all associated sub-contractors employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB) (Army Directive 2014-05/AR 190-13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

8. IDENTIFICATION OF CONTRACTOR EMPLOYEES: This standard language text is for contractor employees with an area of performance within an Army controlled installation, facility or area. The Contractor (to include subcontractors) shall provide each employee a Redstone Arsenal Identification (ID) Badge, which includes at a minimum, the Company Name, Employee Name and a color photo of the employee. ID Badges for Key Personnel shall also indicate their job title. ID Badges shall be worn at all times during which the employee is performing work under this contract. Each Contractor (to include subcontractors) employees shall wear the ID Badge in a conspicuous place on the front of exterior clothing and above the waist except when safety or health reasons prohibit. The Contractor (to include subcontractors) shall be responsible for collection of ID Badges upon completion of the contract or termination of employee. A listing of issued identification cards shall be furnished to the Contracting Officer prior to the contract performance date and updated as needed to reflect Contractor and Subcontractor personnel changes. Foreign owned companies and foreign national contractors will only be permitted to perform under this contract when there are no qualified U.S. companies and /or U.S. contractors. All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They shall also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed.

9. SECURITY EDUCATION, TRAINING & AWARENESS (SETA) TRAINING: This provision/contract text is for contractor employees with an area of performance within an Army controlled installation, facility or area. All contractor employees, to include subcontractor employees, requiring access to government installations, facilities and controlled access areas shall complete annual mandatory SETA awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The following URL is made available for your training: https://www.lms.army.mil. Upon completion of the training, you must provide certification to the Information Security Officer. Security Education, Training & Awareness covers Information Security, Personnel Security and Industrial Security Programs.

10. COMBATING TRAFFICKING IN PERSONS, CYBER AWARENESS CHALLANGE, PERSONAL IDENTIFICATION INFORMATION (PII) and SEXUAL HARRASSMENT ASSAULT RESPONSE PROGRAM (SHARP) TRAINING: This provision/contract text is for contractor employees with an area of performance within an Army controlled installation, facility or area. All contractor employees, to include subcontractor employees, requiring access to government installations, facilities and controlled access areas shall complete Combating Trafficking in Persons, Cyber Awareness Challenge, Personal Identification Information (PII), and Sexual Harassment Assault Response Program (SHARP). The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR or to the contracting officer, if a COR is not assigned, within 30 calendar days after completion of training by all employees and subcontractor personnel.

11. OPSEC SOP / PLAN REQUIREMENTS: The contractor shall develop an OPSEC Standing Operating Procedure (SOP)/Plan within 90 calendar days of contract award, to be reviewed and approved by the responsible Government OPSEC officer, per AR 530-1, Operations Security. This SOP/Plan will include the government's critical information, why it needs to be protected, where it is located, who is responsible for it, and how to protect it.

12. OPSEC TRAINING: Level I OPSEC Awareness Training: Per AR 530-1, Operations Security, all contractor employees, to include subcontractor employees shall complete Level I OPSEC Awareness Training within 30 calendar days of their reporting for duty. All subcontractors shall take the Level 1 OPSEC Awareness Training located at the below website and print the certificates demonstrating completion. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR, within 10 calendar days after completion of training by all employees and subcontractor personnel. Note: after the first screen, select User Type: Civilian/Contractor, then Service: Army, then Grade N/A. OPSEC awareness training is available at the following website: http://cdsetrain.dtic.mil/opsec/

SECTION III. STANDARD CONTRACT PROVISION AND CLAUSE TEXT APPLICABILITY (CONTINUED)

13. GOVERNMENT INFORMATION SYSTEMS AND INFORMATION AWARENESS REQUIREMENTS: All contractor employees with access to a government info system must be registered in the ATCTS (Army Training Certification Tracking System) at commencement of services, and must successfully complete the DOD Cyber Awareness Challenge Training prior to access to the IS and then annually thereafter, and must sign an Acceptable Use Policy (AUP).

14. INFORMATION ASSURANCE (IA) / INFORMATION TECHNOLOGY (IT) TRAINING AND/OR CERTIFICATION: Per DoD 8570.01-M , DFARS 252.239.7001 and AR 25-2, the contractor employees supporting IA/IT functions shall be appropriately trained and/or certified, as required upon contract award. The baseline certification as stipulated in DoD 8570.01-M must be completed upon contract award. Additional training for IA workforce positions must be completed within six months.

15. ACCESS AND GENERAL PROTECTION / SECURITY POLICY AND PROCEDURES: This standard language text is for contractor employees with an area of performance within an Army controlled installation, facility or area. All contractor employees, to include associated sub-contractors employees shall comply with applicable installation, facility and area Commander Installation and facility access and local security policies and procedures (provided by the Government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. The contractor workforce shall comply with all personal identity verification requirements as directed by DoD, Department of the Army Headquarters, and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition at any individual facility or installation change, the Government may require changes in contractor security matters or processes. The prime contractor Human Resources/Security Officer is responsible for the collection of all Redstone Badges and CAC cards issued to their employees. The Human Resources/Security Officer will then turn over these credentials to the COR. This applies when the contract expires; as well as, when a contractor resigns or is terminated. After accounting for all badges/CACs, the COR will turn in the credentials at the One Stop Badging Office or CAC Office (MILPO). All contract employees, including subcontractor employees who are not in possession of the appropriate security clearance or access privileges, will be escorted in areas where they may be exposed to classified and/or sensitive materials and/or sensitive or restricted areas.

16. CONTRACT REQUIRING SECURITY GUARDS: This standard language text is for contractor employees with an area of performance within an Army controlled installation, facility or area. The Physical Security Officer must or will review the PWS/SOW with the Contracting Officer (KO) for accuracy and completeness of AR 190-11 requirements. All contractor and all associated sub-contractor employees shall comply with applicable installation, facility and area commander installation/facility policies and procedures on storing weapons and ammunition IAW AR 190-11 (provided by government representative).

17. KEY CONTROL: The Contractor shall establish and implement methods of making sure all keys/key cards issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include key cards. No keys issued to the Contractor by the Government shall be duplicated. The Contractor shall develop and follow procedures covering key control that shall be included in the Standard Operating Procedures. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the Contracting Officer. In the event keys, other than master keys, are lost or duplicated, the Contractor shall, upon direction of the Contracting Officer, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due the Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the Contractor. The Contractor shall prohibit access to Government issued keys/key cards by unauthorized personnel other than the Contractor's employees. The Contractor shall prohibit entry into controlled areas by unauthorized personnel other than the Contactor's employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the Contracting Officer.

18. LOCK COMBINATIONS: The Contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized persons. The Contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations. These procedures shall be included in the Contractor’s Standard Operating Procedures.

19. CONTRACTOR AUTHORIZED TO ACCOMPANY THE FORCE CLAUSE: DFARS Clause 252.225-7040, Contractor Personnel Authorized to Accompany U.S. Armed Forces Deployed Outside the United States. The clause shall be used in solicitations and contracts that authorize contractor personnel to accompany US Armed Forces deployed outside the US in contingency operations; humanitarian or peacekeeping operations; or other military operations or exercises, when designated by the combatant commander. The clause discusses the following AT/OPSEC related topics: required compliance with laws and regulations, pre-deployment requirements, required training (per combatant command guidance), and personnel data required.

20. CONTRACT REQUIRING PERFORMANCE OR DELIVERY IN A FOREIGN COUNTRY: DFARS Clause 252.225-7043, Antiterrorism/Force Protection for Defense Contractors Outside the US. The clause shall be used in solicitations and contracts that require performance or delivery in a foreign country. This clause applies to both contingencies and non-contingency support. The key AT requirement is for non-local national contractor personnel to comply with theater clearance requirements and allows the combatant commander to exercise oversight to ensure the contractor's compliance with combatant commander and subordinate task force commander policies and directives.

21. CONTRACT INVOLVES STORING OF HAZMAT, AND/OR ARMS, AMMUNITION & EXPLOSIVES (AA&E): For contracts requiring storage of:

9.0.0.2.20120627.2.874785