W911SA25QA073 Attachment 02 - AT-OPSEC.pdf

1 of 2 v6.1 (FEB 23)

CONTRACT REQUIREMENTS PACKAGE ANTITERRORISM/

OPERATIONS SECURITY REVIEW COVER SHEET

Requirements Package Title POC DATE MO001 GROUNDS DIANNA BAUMAN November 18, 2024 Section I.

Purpose of cover sheet: To document the review of the requirements package statement of work statement (SOW) quality assurance surveillance plan and any applicable source selection evaluation criteria for antiterrorism (AT) and other related protection matters to include, but not limited to: AT, operations security (OPSEC), information assurance (IA)/cyber security, physical security, law enforcement, intelligence, foreign disclosure.

Army policy requirement: A signed AT/OPSEC cover sheet is required to be included in all requirements package except for supply contracts under the simplified acquisition level threshold, field ordering officer actions and Government purchase card purchases. Command policy may require this form for supply contracts under the simplified acquisition level threshold.

Mandatory review and signatures: The organizational antiterrorism officer (ATO) must review each requirements package prior to submission to the supporting contracting activity to include coordination with other staff elements for review as appropriate per section II below. If the requiring activity does not have an ATO, the first ATO in the chain of command will review the contract for considerations. An OPSEC officer review is also mandatory.

Section II.

Standard Contract Language Provision/Contract Clause Text Applicability and/or Additional SOW Language.

a. If standard contract or clause language found on page 2 (Section IV) of this form is sufficient to meet specific contract request requirements, check "yes" in block below and include this language in the SOW/PWS.

b. If standard contractual text (provisions or clauses) or clause language does not apply, check "no."

c. If the standard SOW language applies, but is not in of itself sufficient, check "yes" and "SOW/PWS" and include both the standard language and additional contract specific language in the SOW/PWS.

d. If standard contract text or clause language is not desired, but there is related contract specific language in the SOW/PWS, check "no" and "SOW/PWS."

Description Yes No SOW/PWS

1. AT level 1 training (general) ✔

2. Access and general protection policy and procedures ✔ ✔

2a. For contractor requiring Common Access Card (CAC) ✔

2b. For contractor not eligible for CAC, but requires access to DoD facility or installation. ✔

3. AT awareness training for US based contractor personnel traveling overseas ✔

4. Locally developed iWATCH Army training ✔

5. Army Training Certification Tracking System (ATCTS) registration for contractor employees who require access to government information systems.

6. For contracts that require a formal OPSEC program. ✔

7. Requirement for OPSEC training ✔ ✔

8. Information assurance/information technology training ✔

9. Information assurance/information technology certification ✔

10. Contractor Authorized to Accompany the Force clause ✔

11. Contract requiring performance or delivery in a foreign country ✔

12. Handling or access to classified information ✔

12a. Cont. "secure telecommunications" at contractor facilities (IAW DFARS 239.7401) ✔

12b. Cont. "covered system" support (IAW DFARS 239.7301) ✔

13. Controlled Unclassified Information (CUI) ✔

14. Threat Awareness Reporting Program (TARP) ✔

Section III. Remarks: (field will expand)

Non-CAC-holder Contractors and vendors requiring physical access to a single Army installation or facility, but who do not require access to a DOD computer network, will have a Government-employee sponsor to provide the contractual agreement with a cover memorandum signed by a verifying officer vouching for the need for long-term access to the installation.

Antiterrorism Review Signature: I am an ATO (Level II Certified) and have reviewed the requirements package and understand my responsibilities in accordance with Army Regulation 525‐13, Antiterrorism.

Name Grade Phone Date Joseph P. Ingalls GS12 502.898.0580 November 19, 2024 Operations Security Review Signature: I am OPSEC level II certified and have reviewed the requirements package, and it is in compliance with Army Regulation 530‐1, Operations Security.

Name Grade Phone Date Dianna Bauman GS 11 50028980303 November 18, 2024

2 of 2 v6.1 (FEB 23)

Section IV. Standard Contract Language/Contract Clause Applicability and/or Additional SOW Language.

1. AT Level I training. This standard language is for contractor employees with an area of performance within an Army controlled installation, facility or area. All contractor employees, to include subcontractor employees, requiring access Army installations, facilities and controlled access areas shall complete AT Level I Awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR or to the contracting officer, if a COR is not assigned, within 60 calendar days after completion of training by all employees and subcontractor personnel. AT level I Awareness training is available at the following website: http://jko.jten.mil.

2. Access and general protection/security policy and procedures. This standard language is for contractor employees with an area of performance within Army controlled installation, facility, or area. Contractor and all associated subcontractor employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204‐9, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

2a. For contractors requiring Common Access Card (CAC). Before CAC issuance, the contractor employee requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation in accordance with Army Directive 2014‐05. The contractor employee will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on‐site or remotely; (2) remote access, via logon, to a DoD network using DoD‐approved remote access procedures; or (3) physical access to multiple DoD facilities or multiple non‐DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

2b. For contractors that do not require CAC, but require access to a DoD facility or installation. Contractor and all associated sub‐contractors employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC‐III) and Terrorist Screening Database (Army Directive 2014‐05/AR 190‐13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative); or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

3. AT Awareness Training for Contractor Personnel Traveling Overseas. This standard language required US based contractor employees and associated subcontractor employees to make available and to receive Government provided area of responsibility (AOR)-specific AT awareness training as directed by AR 525‐13.

Specific AOR training content is directed by the combatant commander, with the unit ATO being the local point of contact.

4. iWATCH Training. This standard language is for contractor employees with an area of performance within an Army controlled installation, facility or area. The contractor and all associated sub‐contractors shall brief all employees on the local iWATCH Army program (training standards provided by the requiring activity ATO). This local developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 calendar days of contract award and within 30 calendar days of new employees commencing performance with the results reported to the COR NLT 60 calendar days after contract award.

5. Army Training Certification Tracking System (ATCTS) registration for contractor employees who require access to government information systems. All contractor employees with access to a Government info system must be registered in the ATCTS (Army Training Certification Tracking System) at commencement of services, and must successfully complete the DOD Information Assurance Awareness prior to access to the information system and then annually thereafter.

6. For contracts that require a formal OPSEC program. The contractor shall develop an OPSEC Standing Operating Procedure (SOP)/Plan within 90 calendar days of contract award, to be reviewed and approved by the responsible Government OPSEC officer. This plan will include a process to identify critical information, where it is located, who is responsible for it, how to protect it and why it needs to be protected. The contractor shall implement OPSEC measures as ordered by the commander.

In addition, the contractor shall have an identified certified Level II OPSEC coordinator per AR 530‐1.

7. For contracts that require OPSEC Training. Per AR 530‐1, Operations Security, the contractor employees must complete Level I OPSEC Awareness training.

New employees must be trained within 30 calendar days of their reporting for duty and annually thereafter.

8. For IA/IT training. All contractor employees and associated subcontractor employees must complete the DoD IA awareness training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01‐M and AR 25‐2 within six months of appointment to IA/IT functions.

9. For IA/IT certification. Per DoD 8570.01‐M , DFARS 252.239.7001 and AR 25‐2, the contractor employees supporting IA/IT functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8570.01‐M must be completed upon contract award.

10. For contractors authorized to accompany the force. DFARS Clause 252.225‐7040, Contractor Personnel Authorized to Accompany U.S. Armed Forces Deployed Outside the United States, shall be used in solicitations and contracts that authorize contractor personnel to accompany US Armed Forces deployed outside the US in contingency operations; humanitarian or peacekeeping operations; or other military operations or exercises, when designated by the combatant commander.

The clause discusses the following AT/OPSEC related topics: required compliance with laws and regulations, pre‐deployment requirements, required training (per combatant command guidance), and personnel data required.

11. For Contract Requiring Performance or Delivery in a Foreign Country, DFARS Clause 252.225‐7043, Antiterrorism/Force Protection for Defense Contractors Outside the US . The clause shall be used in solicitations and contracts that require performance or delivery in a foreign country. This clause applies to both contingencies and non‐contingency support. The key AT requirement is for non‐local national contractor personnel to comply with theater clearance requirements and allows the combatant commander to exercise oversight to ensure the contractor’ compliance with combatant commander and subordinate task force commander policies and directives.

12. For contracts that require handling or access to classified information. Contractor shall comply with FAR 52.204‐2, Security Requirements. This clause involves access to information classified “Confidential,”“Secret,”or “Top Secret”and requires contractors to comply with (1) The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22‐M); (2) any revisions to DOD 5220.22‐M, notice of which has been furnished to the contractor.

12a. Cont. If secure telecommunication requirements apply, include clause 252.239-7016 and follow guidance at 239.74.

12b. Cont. If covered system support requirements apply, include provision 252.239-7017 into the solicitation, clause 252.239-7018 into the contract, and follow guidance at 239.73.

13. Controlled Unclassified Information (CUI). Include DFARS clause 252.204-7012, which requires the contractor to comply with NIST 800-171. Also include DFARS provision 252.204-2019 into solicitations. Acquisition officials should follow procedures outlined in DFARS 204.73 and verify vendors have an adequate NIST SP 800-171 summary assessment score within the Supplier Performance Risk System (within PIEE). If the score doesn't show a medium- or high-level assessment with a score of 110 or better (as described in the "NIST SP 800-171 DoD Assessment Methodology"), include clause 252.204-7020 and obtain the vendor's "system security plan" and "plan of action" for NIST SP 800-171 verification and assurance by Army security officials.

14. Threat Awareness Reporting Program. For all contractors with security clearances. Per AR 381-12 Threat Awareness and Reporting Program (TARP), contractor employees must receive annual TARP training by a CI agent or other trainer as specified in 2-4b.

JANUARY 3, 2023

of v6.1 (FEB 23) CONTRACT REQUIREMENTS PACKAGE ANTITERRORISM/ OPERATIONS SECURITY REVIEW COVER SHEET Requirements Package Title

POC

DATE

Section I.

Purpose of cover sheet: To document the review of the requirements package statement of work statement (SOW) quality assurance surveillance plan and any applicable source selection evaluation criteria for antiterrorism (AT) and other related protection matters to include, but not limited to: AT, operations security (OPSEC), information assurance (IA)/cyber security, physical security, law enforcement, intelligence, foreign disclosure.

Army policy requirement: A signed AT/OPSEC cover sheet is required to be included in all requirements package except for supply contracts under the simplified acquisition level threshold, field ordering officer actions and Government purchase card purchases. Command policy may require this form for supply contracts under the simplified acquisition level threshold.

Mandatory review and signatures: The organizational antiterrorism officer (ATO) must review each requirements package prior to submission to the supporting contracting activity to include coordination with other staff elements for review as appropriate per section II below. If the requiring activity does not have an ATO, the first ATO in the chain of command will review the contract for considerations. An OPSEC officer review is also mandatory.

Section II.

Standard Contract Language Provision/Contract Clause Text Applicability and/or Additional SOW Language.

a. If standard contract or clause language found on page 2 (Section IV) of this form is sufficient to meet specific contract request requirements, check "yes" in block below and include this language in the SOW/PWS.

b. If standard contractual text (provisions or clauses) or clause language does not apply, check "no."

c. If the standard SOW language applies, but is not in of itself sufficient, check "yes" and "SOW/PWS" and include both the standard language and additional contract specific language in the SOW/PWS.

d. If standard contract text or clause language is not desired, but there is related contract specific language in the SOW/PWS, check "no" and "SOW/PWS."

Description Yes No

SOW/PWS

1. AT level 1 training (general)

2. Access and general protection policy and procedures 2a. For contractor requiring Common Access Card (CAC) 2b. For contractor not eligible for CAC, but requires access to DoD facility or installation.

3. AT awareness training for US based contractor personnel traveling overseas

4. Locally developed iWATCH Army training

5. Army Training Certification Tracking System (ATCTS) registration for contractor employees who require access to government information systems.

6. For contracts that require a formal OPSEC program.

7. Requirement for OPSEC training

8. Information assurance/information technology training

9. Information assurance/information technology certification

10. Contractor Authorized to Accompany the Force clause

11. Contract requiring performance or delivery in a foreign country

12. Handling or access to classified information 12a. Cont. "secure telecommunications" at contractor facilities (IAW DFARS 239.7401) 12b. Cont. "covered system" support (IAW DFARS 239.7301)

13. Controlled Unclassified Information (CUI)

14. Threat Awareness Reporting Program (TARP) Section III. Remarks: (field will expand) Antiterrorism Review Signature: I am an ATO (Level II Certified) and have reviewed the requirements package and understand my responsibilities in accordance with Army Regulation 525‐13, Antiterrorism.

Name Grade Phone Date Operations Security Review Signature: I am OPSEC level II certified and have reviewed the requirements package, and it is in compliance with Army Regulation 530‐1, Operations Security.

Name Grade Phone Date Section IV. Standard Contract Language/Contract Clause Applicability and/or Additional SOW Language.

1. AT Level I training. This standard language is for contractor employees with an area of performance within an Army controlled installation, facility or area. All contractor employees, to include subcontractor employees, requiring access Army installations, facilities and controlled access areas shall complete AT Level I Awareness training within calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR or to the contracting officer, if a COR is not assigned, within calendar days after completion of training by all employees and subcontractor personnel. AT level I Awareness training is available at the following website: http://jko.jten.mil.

2. Access and general protection/security policy and procedures. This standard language is for contractor employees with an area of performance within Army controlled installation, facility, or area. Contractor and all associated subcontractor employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204‐9, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

2a. For contractors requiring Common Access Card (CAC). Before CAC issuance, the contractor employee requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation in accordance with Army Directive 2014‐05. The contractor employee will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on‐site or remotely; (2) remote access, via logon, to a DoD network using DoD‐approved remote access procedures; or (3) physical access to multiple DoD facilities or multiple non‐DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

2b. For contractors that do not require CAC, but require access to a DoD facility or installation. Contractor and all associated sub‐contractors employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC‐III) and Terrorist Screening Database (Army Directive 2014‐05/AR 190‐13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative); or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

3. AT Awareness Training for Contractor Personnel Traveling Overseas. This standard language required US based contractor employees and associated subcontractor employees to make available and to receive Government provided area of responsibility (AOR)-specific AT awareness training as directed by AR 525‐13. Specific AOR training content is directed by the combatant commander, with the unit ATO being the local point of contact.

4. iWATCH Training. This standard language is for contractor employees with an area of performance within an Army controlled installation, facility or area. The contractor and all associated sub‐contractors shall brief all employees on the local iWATCH Army program (training standards provided by the requiring activity ATO). This local developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within calendar days of contract award and within calendar days of new employees commencing performance with the results reported to the COR NLT calendar days after contract award.

5. Army Training Certification Tracking System (ATCTS) registration for contractor employees who require access to government information systems. All contractor employees with access to a Government info system must be registered in the ATCTS (Army Training Certification Tracking System) at commencement of services, and must successfully complete the DOD Information Assurance Awareness prior to access to the information system and then annually thereafter.

6. For contracts that require a formal OPSEC program. The contractor shall develop an OPSEC Standing Operating Procedure (SOP)/Plan within 90 calendar days of contract award, to be reviewed and approved by the responsible Government OPSEC officer. This plan will include a process to identify critical information, where it is located, who is responsible for it, how to protect it and why it needs to be protected. The contractor shall implement OPSEC measures as ordered by the commander. In addition, the contractor shall have an identified certified Level II OPSEC coordinator per AR 530‐1.

7. For contracts that require OPSEC Training. Per AR 530‐1, Operations Security, the contractor employees must complete Level I OPSEC Awareness training. New employees must be trained within 30 calendar days of their reporting for duty and annually thereafter.

8. For IA/IT training. All contractor employees and associated subcontractor employees must complete the DoD IA awareness training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01‐M and AR 25‐2 within six months of appointment to IA/IT functions.

9. For IA/IT certification. Per DoD 8570.01‐M , DFARS 252.239.7001 and AR 25‐2, the contractor employees supporting IA/IT functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8570.01‐M must be completed upon contract award.

10. For contractors authorized to accompany the force. DFARS Clause 252.225‐7040, Contractor Personnel Authorized to Accompany U.S. Armed Forces Deployed Outside the United States, shall be used in solicitations and contracts that authorize contractor personnel to accompany US Armed Forces deployed outside the US in contingency operations; humanitarian or peacekeeping operations; or other military operations or exercises, when designated by the combatant commander. The clause discusses the following AT/OPSEC related topics: required compliance with laws and regulations, pre‐deployment requirements, required training (per combatant command guidance), and personnel data required.

11. For Contract Requiring Performance or Delivery in a Foreign Country, DFARS Clause 252.225‐7043, Antiterrorism/Force Protection for Defense Contractors Outside the US . The clause shall be used in solicitations and contracts that require performance or delivery in a foreign country. This clause applies to both contingencies and non‐contingency support. The key AT requirement is for non‐local national contractor personnel to comply with theater clearance requirements and allows the combatant commander to exercise oversight to ensure the contractor’ compliance with combatant commander and subordinate task force commander policies and directives.

12. For contracts that require handling or access to classified information. Contractor shall comply with FAR 52.204‐2, Security Requirements. This clause involves access to information classified “Confidential,”“Secret,”or “Top Secret”and requires contractors to comply with (1) The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22‐M); (2) any revisions to DOD 5220.22‐M, notice of which has been furnished to the contractor.

12a. Cont. If secure telecommunication requirements apply, include clause 252.239-7016 and follow guidance at 239.74.

12b. Cont. If covered system support requirements apply, include provision 252.239-7017 into the solicitation, clause 252.239-7018 into the contract, and follow guidance at 239.73.

13. Controlled Unclassified Information (CUI). Include DFARS clause 252.204-7012, which requires the contractor to comply with NIST 800-171. Also include DFARS provision 252.204-2019 into solicitations. Acquisition officials should follow procedures outlined in DFARS 204.73 and verify vendors have an adequate NIST SP 800-171 summary assessment score within the Supplier Performance Risk System (within PIEE). If the score doesn't show a medium- or high-level assessment with a score of 110 or better (as described in the "NIST SP 800-171 DoD Assessment Methodology"), include clause 252.204-7020 and obtain the vendor's "system security plan" and "plan of action" for NIST SP 800-171 verification and assurance by Army security officials.

14. Threat Awareness Reporting Program. For all contractors with security clearances. Per AR 381-12 Threat Awareness and Reporting Program (TARP), contractor employees must receive annual TARP training by a CI agent or other trainer as specified in 2-4b.

11.0.0.20130303.1.892433.887364