W911SA23Q3061 Attachment 1 ATOPSEC.pdf

Contract Requirements Package Antiterrorism/Operations Security Review Cover Sheet

Requirements Package Title Date___________________

Section I.

Purpose of cover sheet: To document the review of the requirements package statement of work (SOW), performance work statement (PWS), quality assurance surveillance plan (QASP) and any applicable source selection evaluation criteria for antiterrorism (AT) and other related protection matters, including but not limited to AT, operations security (OPSEC), information assurance (IA)/cyber security, physical security, law enforcement, intelligence, and foreign disclosure.

Army policy requirement: A signed AT/OPSEC cover sheet must be included in all requirements packages except for

Mandatory review and signatures:

Section II. Standard Contract Language Provision/Contract Clause Text Applicability and/or Additional SOW/PWS Language.

a.

request requirements, check “Yes” in the block below and include this language in the SOW/PWS.

b. If standard contractual text (provisions or clauses) or clause language does not apply, check “No.”

c.

d.

PWS, check “No” and “SOW/PWS.”

1. AT Level I training (general) Yes No SOW/PWS

2. Access and general protection policy and procedures Yes No SOW/PWS

2a. For contractor requiring Common Access Card (CAC) Yes No SOW/PWS

2b. For contractor not eligible for CAC, but requiring access to a DoD facility or installation

Yes No SOW/PWS

3. AT awareness training for U.S.-based contractor personnel traveling overseas

Yes No SOW/PWS

4. Locally developed iWATCH Army training Yes No SOW/PWS

5. Yes No SOW/PWS

6. For contracts that require a formal OPSEC program Yes No SOW/PWS

7. Requirement for OPSEC training Yes No SOW/PWS

8. Information assurance/information technology training Yes No SOW/PWS

9. Yes No SOW/PWS

10. Contractor Authorized to Accompany the Force clause Yes No SOW/PWS

11. Contract requiring performance or delivery in a foreign country Yes No SOW/PWS

12. Yes No SOW/PWS

12a. Cont. “secure telecommunications” at contractor facilities (IAW DFAR 239.7401)

Yes No SOW/PWS

12b. Cont. “covered system” support (IAW DFARS 239.7301) Yes No SOW/PWS

13. Yes No SOW/PWS

14. Threat Awareness Reporting Program (TARP) Yes No SOW/PWS

Section III. Remarks:

Antiterrorism Review Signature:

understand my responsibilities in accordance with Army Regulation 525-13, Antiterrorism.

Reviewer Date Typed or printed name, rank or civilian grade Phone number

Signature

Operations Security Review Signature:

it is in compliance with Army Regulation 530-1, Operations Security.

Reviewer Date Typed or printed name, rank or civilian grade Phone number

Signature

Section IV. Standard Contract Language/Contract Clause Applicability and/or Additional SOW/PWS Language

1. AT Level I training. This standard language is for contractor employees with an area of performance within an Army-controlled installation, facility, or area. All contractor employees, including subcontractor employees, requiring access to Army installations, facilities, and controlled access areas shall complete AT Level I awareness training within XX calendar employees and subcontractor personnel. AT Level I awareness training is available at the following website: http://jko.jten.mil.

2. Access and general protection/security policy and procedures. This standard language is for contractor employees with an area of performance within an Army-controlled installation, facility, or area. Contractor and all associated subcontractor employees shall provide all information required for background checks to meet installation access requirements to be of Contract Personnel) as directed by DoD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, 2a. For contractors requiring CAC. Before CAC issuance, the contractor employee requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation in accordance with Army Directive 2014-05. The contractor employee will be issued a CAC only if duties involve one of the following: (1) both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more.

2b. For contractors that do not require a CAC, but require access to a DoD facility or installation. Contractor and all associated subcontractor employees shall comply with adjudication standards and procedures using the National Crime

AR 190-13); applicable installation, facility and area commander installation and facility access and local security policies agreements and other theater regulations.

3. AT Awareness Training for Contractor Personnel Traveling Overseas. This standard language requires U.S.-based by the combatant commander, with the unit ATO being the local point of contact.

4. Locally Developed iWATCH Army Training. This standard language is for contractor employees with an area of performance within an Army-controlled installation, facility, or area. The contractor and all associated subcontractors shall brief all employees on the local iWATCH Army program (training standards provided by the requiring activity ATO).

This locally developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within XX calendar days of contract award and within YY calendar days of new employees commencing performance, with the results reported to the COR NLT XX calendar days after contract award.

to Government information systems.

registered in the ATCTS at commencement of services and must successfully complete the DoD Information Assurance Awareness prior to access to the information system and annually thereafter.

6. For contracts that require a formal OPSEC program. The contractor shall develop an OPSEC Standing Operating Procedure (SOP)/Plan within 90 calendar days of contract award, to be reviewed and approved by the responsible responsible for it, how to protect it, and why it needs to be protected. The contractor shall implement OPSEC measures

AR 530-1.

7. For contracts that require OPSEC Training. Per AR 530-1, Operations Security, the contractor employees must complete Level I OPSEC Awareness training. New employees must be trained within 30 calendar days of their reporting for duty and annually thereafter.

8. For IA/IT training. All contractor employees and associated subcontractor employees must complete the DoD IA awareness training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01-M, and AR 25-2 within six months of appointment to IA/IT functions.

Per DoD 8570.01-M, DFARS 252.239.7001, and AR 25-2, the contractor employees supporting

8570.01-M must be completed upon contract award.

10. For contractors authorized to accompany the force. DFARS Clause 252.225-7040, Contractor Personnel Authorized to Accompany U.S. Armed Forces Deployed Outside the United States, shall be used in solicitations and contracts that authorize contractor personnel to accompany U.S. Armed Forces deployed outside the U.S. in contingency operations; humanitarian or peacekeeping operations; or other military operations or exercises, when designated by the combatant commander. The clause discusses the following AT/OPSEC-related topics: required compliance with laws and regulations, pre-deployment requirements, required training (per combatant command guidance), and personnel data required.

11. For contracts requiring performance or delivery in a foreign country. DFARS Clause 252.225-7043, Antiterrorism/ Force Protection for Defense Contractors Outside the US, shall be used in solicitations and contracts that require performance or delivery in a foreign country. This clause applies to both contingencies and non-contingency support. The key AT requirement is for non-local national contractor personnel to comply with theater clearance requirements and allows the combatant commander to exercise oversight to ensure the contractor’s compliance with combatant commander and subordinate task force commander policies and directives.

Contractor shall comply with FAR

Secret” and requires contractors to comply with (1) the Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M); (2) any revisions to DoD 5220.22-M, notice of which has been furnished to the contractor.

12a. Cont. If secure telecommunication requirements apply, include clause 252.239-7016 and follow guidance at 239.74.

12b. Cont. If covered system support requirements apply, include provision 252.239-7017 into the solicitation, clause 252.239-7018 into the contract, and follow guidance at 239.73.

Include DFARS clause 252.204-7012, which requires the contractor to procedures outlined in DFARS 204.73 and verify vendors have an adequate NIST SP 800-171 summary assessment score within the Supplier Performance Risk System (within PIEE). If the score doesn’t show a medium- or high-level assessment with a score of 110 or better (as described in the “NIST SP 800-171 DoD Assessment Methodology”), include clause

14. Threat Awareness Reporting Program. For all contractors with security clearances. Per AR 381-12 Threat Awareness and Reporting Program (TARP), contractor employees must receive annual TARP training by a CI agent or other trainer as