W911SA26RA004 Attachment 1 AT OPSEC.pdf

FORT MCCOY ANTITERRORISM/OPSEC REQUIREMENTS

PACKAGE COVER SHEET (2024 UPDATEv3)

Section I. Purpose of cover sheet: To document the review of the requirements package performance work statement (PWS), quality as-surance surveillance plan, and any applicable source selection evaluation criteria for antiterrorism (AT) and other related protection matters to include, but not limited to: AT, operations security (OPSEC), information assurance (IA), physical security, law enforcement, intel-ligence, foreign disclosure. Army policy requirement: inclusion of a signed AT/OPSEC cover sheet is required in all requirements packages except for supply contracts under the simplified acquisition level threshold ($150,000), field ordering officer actions, and Government pur-chase card purchases. Command policy may require this form for supply contracts under the simplified acquisition level threshold. Manda-tory review and signatures: The organizational antiterrorism officer (ATO) must review each requirements package prior to submission to the supporting contracting activity to include coordination with other staff review as appropriate per section II below. If the requiring activ-ity does not have an ATO, the first ATO in the chain of command will review the contract for AT considerations. An OPSEC officer review is also mandatory.

Section II. Standard Contract Language Provision/Contract Clause Text Applicability and/or Additional PWS Language. If the standard con-tract or clause language text found on page two of this form is sufficient to meet specific contract request requirements, check "yes" in block below and include this language in the PWS. If standard contractual text (provisions or clauses) or clause language does not apply, check "no." If the standard PWS language applies, but is not in of itself sufficient, check "yes" and "PWS" and include both the standard language and additional contract specific language in the PWS. If standard contractual text or clause language is not desired, but there is related contract specific language in the PWS, check "no" and "PWS." If yes is marked for items 2, 3, 4, 5, 6, 8, or 10, training is required.

Mandatory training must be measured as a deliverable and evaluated in the QASP.

1. Access and General Protection/Security Policy and Procedures 1a. Contractors Requiring Common Access Card (CAC) ································

2. AT Level I Awareness Training

3. iWATCH Training ························································································

4. For Contracts That Require OPSEC SOP/Plan and Training

5. TARP/Counterintelligence Awareness Reporting Training

6. Contractors Requiring Access to Government Information Systems

7. Contracts Requiring Food Defense Measures ··········································

8. Contractors Requiring Handling or Access to Classified Information

9. Controlled Unclassified Information (CUI) ················································

10. AT Awareness For Contractor Personnel Traveling Overseas

11. Contracts requiring performance or delivery in a foreign country ·········

12. Contractor Authorized to Accompany the Force

YES NO PWS

YES NO PWS

YES NO PWS

YES NO PWS

YES NO PWS

YES NO PWS

YES NO PWS

YES NO PWS

YES NO PWS

YES NO PWS

YES NO PWS

YES NO PWS

YES NO PWS

Remarks:

PWS Meets AT/OPSEC Requirements: YES

MIPR/Purchase Requests The purchase request which has been provided to me meets the current AT/OSPEC requirements. It is incumbent upon the parent com-mand to review the associated contract IAW All Army Activities (ALARACT) Message 015/2012.

Antiterrorism Review Signature: I am ATO level II certified and have reviewed the requirements package and understand my responsibili-ties IAW Army Reg 525-13, Antiterrorism.

Date: Phone Number:

Operations Security Review Signature: I am OPSEC level II certified and have reviewed the requirements package and it is in compliance with Army Regulation 530-1, Operations Security.

Date: Phone Number:

Section III. Standard Contract Provision and Clause Text Applicability and/or Additional PWS Language.

1. Access and General Protection/Security Policy and Procedures. This provision/contract text is for contractor employees with an area of performance as defined by Fort McCoy local policy/procedures, and AR 190-13 (Installation Access Control), will add the following lan-guage in the PWS. "The contractor and all associated subcontractors’ employees shall provide all information required for background checks to meet installation access requirements to be accomplished by Director of Emergency Services or Security Office. Contractor work-force must comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy. The contractor and all associated subcontractors’ employees shall also comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III), Terrorist Screening Database (TSDB) (Army Directive 2014-05/AR 190-13), the Real ID Act of 2005 and applicable installation, facility, and area com-mander installation/facility access and local security policies and procedures (provided by government representative). In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facili-ty or installation change, the Government may require changes in contractor security matters or processes. The Government may require monthly participation in the Installation Random Antiterrorism Program."

1a. Contractors Requiring Common Access Card (CAC). This provision/contract text is for contractor employees with an area of perfor-mance as defined by Fort McCoy local policy/ procedures and AR 190-13 (Installation Access Control) that requires a Common Access Card.

When applicable, add the following language into the PWS. "Before CAC issuance, the contractor employee requires, at a minimum, a fa-vorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation in accordance with Army Directive 2014-05. The contractor employee will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) Remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) Physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled NACI".

2. AT Level I Training. This provision/contract text is for contractor employees with an area of performance as defined by Fort McCoy local Policy/Procedures and AR 190-13 (Installation Access Control) or when deemed applicable by the ATO. When applicable, add the following language into the PWS: "All contractor employees, including subcontractor employees, requiring access to Army installations, facilities, or controlled access areas shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever applies. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee to the COR (or to the contracting officer, if a COR is not assigned) within 60 cal-endar days after completion of training by all employees and subcontractor personnel. AT Level I awareness training is available at https:// jkodirect.jten.mil. Classroom AT Level 1 Training can also be coordinated with the Fort McCoy Installation ATO at (608) 388-4719. This is an annual requirement. Submit training rosters to the COR and Contracting Office. COR will give a copy to the ATO.”

3. iWATCH Training. This provision/contract text is for contractor employees with an area of performance as defined by Fort McCoy local Policy/Procedures and AR 190-13 (Installation Access Control) or when deemed applicable by the ATO. When applicable, add the following language into the PWS: "The contractor and all associated subcontractors shall brief all employees on the local iWATCH program (training standards provided by the requiring activity ATO). This locally developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 calendar days of contract performance start date and within 30 calendar days of new employees’ commencing performance, with the results reported to the COR no later than 60 calendar days after contract award. This is an annual requirement. Submit training rosters to the COR and Con-tracting Office. COR will give a copy to the ATO.”

4. Contracts That Require an OPSEC Standing Operating Procedure/Plan/Training. This provision/contract text is for contractor employ-ees with an area of performance within an Army controlled installation, facility or area when deemed applicable by the OPSEC Officer, or alternate. When applicable, add the following language into the PWS: (Per AR 530-1 All contractor employees, including subcontractor employees, requiring access to Army installations, facilities, or controlled access areas shall complete OPSEC Level I training within 30 cal-endar days after contract start date or effective date of incorporation of this requirement into the contract, whichever applies. The con-tractor shall submit certificates of completion for each affected contractor employee and subcontractor employee to the COR (or to the contracting officer, if a COR is not assigned) within 60 calendar days after completion of training by all employees and subcontractor per-sonnel. Training is available at https://securityawareness.usalearning.gov/opsec/index.htm.

5. Counterintelligence Awareness and Reporting (CIAR) or (TARP) Training For Contractors With Security Clearances. This provision/ contract text is for contractor employees with an area of performance as defined by Fort McCoy local policy/ procedures and AR 190-13 (Installation Access Control) or when deemed applicable by the OPSEC Officer, or alternate. When applicable, add the following language into the PWS: "Per AR 381-12 all contractors with security clearances must complete TARP and/or CIAR training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee to the COR (or to the contracting officer, if a COR is not assigned) within 60 calendar days after completion of training by all employees and subcontractor personnel. Training can be coordinated by contacting the Installation OPSEC officer at 388-4719. This is an annual requirement. Submit training rosters to the COR (or to the contracting officer, if a COR is not assigned). The COR or contracting officer will provide a copy to the OPSEC Officer.”

6. Contractor Employees Who Require Access to Government Information Systems. Contractor employees with access to government information technology systems must add the following language to the PWS. “All contractors with access to government information technology systems must be registered in the Army Training Certification Tracking System (ATCTS) at commencement of services and must successfully complete the DoD Information Assurance Awareness training prior to access and then annually thereafter. All contractor em-ployees working IA/IT functions must comply with DoD and Army training requirements in DoD 8570.01, DoD 8570.01M and AR 25-2 within 6 months of employment. All contractor employees supporting IA/IT functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8570.01M must be completed upon contract start date. This is an annual requirement. (Submit training certificates to the COR, Contract Office and the Network Enterprise Center.

7. Contracts that Require Delivery of Food and Water. Contractor employees delivering food and water with an area of performance as defined by Fort McCoy local Policy/Procedures and AR 190-13 (Installation Access Control) will add the following language in the PWS.

"The supplies delivered under this contract shall be transported in delivery conveyances maintained to prevent tampering with and /or adulteration or contamination of the supplies, and if applicable, equipped to maintain a prescribed temperature. All deliver vehicles will also be subject to inspection at all times and all places by the Contracting Officers Representative, Post Veterinarian, and/or Law Enforce-ment Officials. When the sanitary conditions of the delivery conveyance have led, or may lead to product contamination, adulteration, con-stitute a health hazard, or the delivery conveyance is not equipped to maintain prescribed temperatures, or the transport results in prod-uct ‘unfit for intended purpose’, supplies tendered for acceptance may be rejected without further inspection. As the holder of a contract with the Department of Defense, it is incumbent upon the awardee to insure that all products and/or packaging have not been tampered or contaminated. Delivery conveyances will be locked or sealed at all times, except when actively loading or unloading. Unsecured vehi-cles will not be left unattended. All incoming truck drivers will provide adequate identification upon request. In the event of an identified threat to an installation, or a heightened force protection/Homeland Security Threat Level, the contractor may be required to adjust deliv-ery routes to minimize vulnerability risks and enable direct delivery to DOD facilities."

8. Contractors That Require Handling or Access to Classified Information. Contractor employees that require handling or access to classi-fied information within as defined by Fort McCoy local Policy/Procedures and AR 190-13 (Installation Access Control) will add the following language in the PWS. "The contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified “Confidential,” “Secret,” or “Top Secret” and requires contractors to comply with (1) the Security Agreement (DD Form 441), in-cluding the National Industrial Security Program Operating Manual (DoD 5220.22-M), and (2) any revisions to DoD 5220.22-M, notice of which has been furnished to the contractor."

9. Controlled Unclassified Information (CUI). Include DFARS clause 252.204-7012, which requires the contractor to comply with NIST 800-

171. Also include DFARS provision 252.204-2019 into solicitations. Acquisition officials should follow procedures outlined in DFARS 204.73 and verify vendors have an adequate NIST SP 800-171 summary assessment score within the Supplier Performance Risk System (within PIEE). If the score doesn’t show a medium- or high-level assessment with a score of 110 or better (as described in the “NIST SP 800-171 DoD Assessment Methodology”), include clause252.204-7020 and obtain the vendor’s “system security plan” and “plan of action” for NIST SP 800-171 verification and assurance by Army security officials.

Paragraph II - Contracts Requiring Performance or Deliver to a Foreign Country or Contractors Authorized to Accompany the Force

10. AT Awareness Training for Contractor Personnel Traveling Overseas. Contracts that require employees to travel overseas will add the following language in the PWS. "U.S.-based contractor employees and associated subcontractor employees traveling overseas are required to receive government-provided AT awareness training specific to the area of responsibility (AOR). All contractor employees and associat-ed subcontractors traveling overseas will contact the ATO at 388-4719 within 60 days of traveling overseas to schedule an overseas Area of Operation (AOR) briefing as directed by AR 525-13."

11. Contractors Requiring Performance or Delivery in a Foreign Country. Contractor employees that require performance or delivery in a foreign country will add the following language in the PWS. "Solicitations and contracts that require performance or delivery in a foreign country will comply with DFARS Clause 252.225-7043, Antiterrorism/Force Protection for Defense Contractors Outside the United States.

This clause applies to both contingencies and non-contingency support. The key AT requirement is for nonlocal national contractor person-nel to comply with theater clearance requirements and allows the combatant commander to exercise oversight to ensure the contractor’s compliance with combatant commander and subordinate task force commander policies and directives."

12. Contractors Authorized to Accompany the Force. Contractor employees that require personnel to accompany the force will add the following language in the PWS. "Solicitations and contracts that authorize contractor personnel to accompany US Armed Forces deployed outside the US in contingency operations; humanitarian or peacekeeping operations; or other military operations or exercises, when desig-nated by the combatant commander will comply with DFARS Clause 252.225-7040. The clause discusses the following AT/OPSEC related topics: required compliance with laws and regulations, pre-deployment requirements, required training (per combatant command guid-ance), and personnel data required."