Appendix H_Security Req.pdf

Security and AT/OPSEC Appendix to the PWS, SOO, or Solicitation Number:

Contract Number:

Current Version Date: 202 Page 1 of 9

Section I. Performance Work Statement (PWS), Statement of Objectives (SOO), or Statement of Work (SOW) Security Requirements Appendix

1. Security Requirements

In the performance of this contract, the contractor will require a ______________ Facility Clearance Level (FCL) with______________ safeguarding authorization. The contractor must have the appropriate FCL at the time of award. If sponsorship for a FCL is required, the contracto n the appropriate justification for FCL sponsorship. The Defense Counterintelligence Service Agency (DCSA) facilitates the FCL determination process and it is the responsibility of the contractor to work with the DCSA to obtain the appropriate clearance.

Contract Officers (KO) approval is required for the flow down of security requirements to any subcontractor for DD Form 254 items 10a, 10b, 10c, 10e(1), 10e(2), 10f, and 10g. The (KO) is the only authority able to approve the addition of subcontractors. Safeguarding is limited to those facilities which hold the appropriate DCSA FCLs. The level of safeguarding must be commensurate with the level listed in item 1b of the DD Form 254 associated with this effort. Reference DD Form 254 for detailed information on the implementation and compliance of security requirements/guidance.

2. Actual Performance Locations

The contractor will be required to access classified material at the following locations:

GOVERNMENT LOCATIONS

CONTRACTOR FACILITIES

NAME, ADDRESS, AND ZIP CODE CAGE CODE

COGNIZANT SECURITY OFFICES (CSO)

(Name, Address, ZIP Code, Telephone)

Secret Secret

TBD

Current Version Date: 202 Page 2 of 9

Security and AT/OPSEC Appendix to the PWS, SOO, or SOW Solicitation Number:

Contract Number:

3. CONTRACTOR will require access to all items checked will apply to this effort and all items checked requirements will not be levied against the contractor.

YES NO Requirements

YES NO

Communications Security (COMSEC) Information

YES NO

Restricted Data

YES NO

Critical Nuclear Weapon Design Information (CNWDI

YES NO

Formerly Restricted Data

YES NO

Sensitive Compartmented Information (SCI)

YES NO

Non-Sensitive Compartmented Information (Non-SCI)

YES NO

Special Access Programs (SAP)

YES NO

Atlantic Treaty North Organization (NATO)

YES NO

Foreign Government Information (FGI)

YES NO

Alternative Compensatory Control Measures (ACCM)

YES NO

Controlled Unclassified Information (CUI)

YES NO

NIPRNet

YES NO

Secured Internet Protocol Network (SIPRNet)

YES NO

Joint Worldwide Intelligence Communications Systems (JWICS)

YES NO

NSANet

Current Version Date: 202 Page 3 of 9

Solicitation Number:

Contract Number:

4. In perfor contractor.

YES NO Requirements

YES NO government activity

YES NO

Receive and store classified documents only

YES NO

Receive, store, and generate classified information or material

YES NO

Fabricate, modify, or store classified hardware

YES NO

Perform services only

YES NO Have access to U.S. classified information outside the U.S., Puerto Rico, U.S. Possessions, and Trust Territories

YES NO Be authorized to use the services of Defense Technical Information Center (DTIC) or other secondary distribution center

YES NO

Require a COMSEC account

YES NO

Have a TEMPEST requirement

YES NO

Have Operations Security (OPSEC) Requirements

YES NO

Be authorized to use Defense Courier Service (DCS)

YES NO

Receive, store, or generate CUI

YES NO

IT Sensitive Duties

Current Version Date: 202 Page 4 of 9

Solicitation Number:

Contract Number:

5. The contractor will require access to the following Security Classification Guides (SCGs):

TITLE DATE FUNCTIONAL OFFICE OF PRIMARY RESPONSIBILITY

1. ARCYBER SCG FOR CYBERSPACE

OPERATIONS AND SECURITY

19 MAY 2016

6. The contractor will require access to the following Operations Security (OPSEC) Plans:

TITLE DATE FUNCTIONAL OFFICE OF PRIMARY RESPONSIBILITY

7. Additional Remarks not already addressed in items 1 6 of this Security Appendix - Procedures for

GOVERNMENT LOCATIONS

Current Version Date: 202 Page 5 of 9

Solicitation Number:

Contract Number:

Section II. Contract Requirements Package Antiterrorism/OPSEC/Security/Cybersecurity Review

Purpose of section: To document the review of the requirements package Performance Work Statement (PWS), Statement of Objectives (SOO), Statement of Work (SOW), quality assurance surveillance plan (QASP) and any applicable source selection evaluation criteria for antiterrorism (AT) and other related protection matters to include, but not limited to: AT, Operations Security (OPSEC), cyber security, physical security, law enforcement, intelligence, and foreign disclosure. Army policy requirement: A signed AT/OPSEC cover sheet is required to be included in all requirements package.

Mandatory review and signatures: The organizational Antiterrorism Officer (ATO), Security Manager (SM), OPSEC Officer, Information System Security Manager/Officer (ISSM/ISSO) and Contracting Officer Representative (COR) must review and sign each requirements package prior to submission to the supporting contracting activity, to include coordination with other staff review, as appropriate per section II below. The ATO must be certified as Level II. The OPSEC Officer must be certified as a Level II OPSEC Officer. If the requiring activity (RA) does not have any qualified reviewers, the first functional person in the chain of command will review the contract for each functional consideration. Changes to the security requirements after the functional reviews are completed will void the review and require a subsequent functional review again.

rt and requirements will not be levied against the contractor.

YES NO 1. AT Level I Training. (This standard language is for contractor employees with an area of performance within an Army controlled installation, facility or area):

All contractor employees, to include subcontractor employees, requiring access to Army installations, facilities and controlled access areas shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR or to the contracting officer, if a COR is not assigned, within 60 calendar days after completion of training by all employees and subcontractor personnel. AT level I awareness training is available at the following website:

https://jkodirect.jten.mil/ for Non-CAC-holders may go to: http://jko.jten.mil/courses/atl1/launch.html.

YES NO 2. AT Awareness Training for contractor personnel traveling overseas for both unofficial and official travel:

(This standard language is for contractor employees with an area of performance within an Army controlled installation, facility or area): US based contractor employees and associated subcontractor employees shall receive government provided area of responsibility (AOR) specific AT awareness submit training as directed by AR 525-13, or other COCOM specific requirements, as necessary.

Specific AOR training content is directed by the combatant commander with the unit ATO being the local point of contact. US based contractor employees and associated subcontractor employees will update their PRO-File survey prior to their official or unofficial travel, in accordance with AR 525-28, Personnel Recovery. The PRO-File survey is available at the following link:

https://prmsglobal.prms.af.mil/prmsconv/Login/Banner.

YES NO 3. iWATCH Training. (This standard language is for contractor employees with an area of performance within an Army controlled installation, facility or area): The contractor and all associated subcontractors shall brief all employees on the local iWATCH program (training standards provided by the requiring activity ATO). This local developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 calendar days of contract award and within 30 calendar days of new employees commencing performance with the results reported to the COR NLT 60 calendar days after contract award. The training can be found at the following website:

http://www.myarmyonesource.com/familyprogramsandservices/iwatchprogram/default.aspx

Security and AT/OPSEC Appendix to the PWS, SOO, or

Contract Number:

Current Version Date: 20 Page 6 of 9

YES NO 4. Mass Warning Notification System (MWNS) Requirement. Per DoDI 6055.17, all contractors accessing government installations must register with the MWNS system in use at the government place of performance.

Additional remarks/requirements:

Antiterrorism Review Signature: I am an ATO (Level II Certified) and have reviewed the requirements package and understand my responsibilities in accordance with Army Regulation 525-13, Antiterrorism.

ATO Signature:

YES NO 5. Contractor OPSEC Program.

facilities): The contractor shall have an identified certified Level II OPSEC coordinator per AR 530-1.

The contractor shall develop an OPSEC Standard Operating Procedure (SOP)/Plan within 90 calendar days of contract award, to be reviewed and approved by the responsible Government OPSEC officer. This plan will include a process to identify critical information, where it is located, who is responsible for it, how to protect it and why it needs to be protected. The contractor shall implement OPSEC measures as ordered by the commander. The CDRL associated with this deliverable shall be included in the PWS of this effort.

YES NO 6. Government OPSEC Program. (This standard language is for contractor employees with an area of performance within an Army controlled installation, facility or area): Contractor shall adhere to all OPSEC policies set forth by government appointed OPSEC officer. This includes but is not limited to policies found in the CECOM OPSEC Plan and any policies set forth via HQDA mandate

YES NO 7. Public Release of Materials. Per AR 530-1 Operations Security and CECOM OPSEC Plan, an OPSEC review is required for any information related to U.S. Government or military operations and other supporting programs not already approved for public release, e.g., requirements found in the PWS. This OPSEC review must be completed by an appointed OPSEC Officer who is also Level II OPSEC certified. The OPSEC review must be done in conjunction with the Public Affairs review and results of the review must be documented. The OPSEC and PAO contact information for this effort can be found below.

OPSEC Officer (Name, Email, Phone Number):

Public Affairs Officer (Name, Email, Phone Number):

YES NO 8. For contracts that require OPSEC Training. Per AR 530-1 Operations Security, the CECOM OPSEC Plan, and AR 350-1 Army Training and Leader Development contractor employees must complete Level I OPSEC Awareness training within 30 calendar days of reporting for duty and annually thereafter. Level I OPSEC training is available via the Army Learning Management System (ALMS) application at the following link:

https://www.lms.army.mil/ tion: 2 hours). An Enterprise Access Management Service Army (EAMS) account is required to access the ALMS application.

Contractors shall also participate in any command directed OPSEC stand downs, e.g., ad-hoc refresher trainings. If Computer Based Training (CBT) via ALMS cannot be completed, the organization's OPSEC Officer can provide the training to meet the initial and refresher training requirements.

Contract Number:

Current Version Date: 202 Page 7 of 9

YES NO 9. OPSEC Officer Review of Contracting Effort. The signature below annotates that no sensitive, CUI, or other critical information is contained within the contract effort and it is ready to be published on publically accessible sites such as SAM.gov.

Additional remarks/requirements:

Operations Security Review Signature: I am OPSEC level II certified and have reviewed the requirements package, and it is in compliance with Army Regulation 530-1, Operations Security.

OPSEC Officer Signature:

YES NO 10. Army Training Certification Tracking System (ATCTS) Registration. (Required when contractor employees require access to government information systems): All contractor employees with access to a government information system must be registered in the ATCTS (Army Training Certification Tracking System) at commencement of services, and must successfully complete the DoD Cybersecurity Awareness Challenge and Accepted Use Policy (AUP) prior to access to the IS, and then annually thereafter. IT access requests must include current AUP and training certificates for initial and contract renewals.

YES NO 11. Cybersecurity/Information Technology (IT) Training. All contractor employees and associated sub-contractor employees must complete the DoD Cybersecurity awareness training before issuance of network access and annually thereafter. All contractor employees working Cybersecurity/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01-M and Department of the Army Pamphlet 25 2 6 (Cybersecurity Training and Certification Program) within six months of appointment to Cybersecurity/IT functions.

YES NO 12. Cybersecurity/Information Technology (IT) Certification. Per DoD 8570.01-M (Ch4) , DFARS

252.239.7001 and Department of the Army Pamphlet 25 2 6 (Cybersecurity Training and Certification Program), the contractor employees supporting Cybersecurity/IT functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8570.01-M (Ch4) must be completed upon contract award. Contractor personnel requiring network privileged access will have a final adjudicated Tier 3 or Tier 5 security investigation. The investigation required is dependent on the network accreditation requirements and guidance provided by the Information System Security Manager/Officer of the local network or system. The government security manager will initiate the requisite security investigation for contractors requiring network security investigations as required by the Information System Security Manager/Officer. Detailed privileged users access can be reference in Department of the Army Pamphlet 25 2 7.

Additional remarks/requirements:

Information System Security Manager/Officer Review Signature: I have reviewed the requirements package and it contains the correct information to meet the cybersecurity requirements of this effort.

ISSM/ISSO Signature:

YES NO 13. Access and general protection/security policy and procedures. (This standard language is for contractor employees with an area of performance within Army controlled installation, facility, or area):

Contractor and all associated subcontractors employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DoD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

Contract Number:

Current Version Date: 20 Page 8 of 9

YES NO 14. Controlled Unclassified Information (CUI) Training. Per DoDI 5200.48, paragraph 3.6b, all contractor employees shall complete an initial CUI training within the 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. All contractor employees shall also complete a refresher CUI training annually. Online CUI training is accessible at: https://securityawareness.usalearning.gov/cui/index.html

YES NO 15. Threat Awareness Reporting Program (TARP). Per AR 381-12 Threat Awareness and Reporting Program (TARP), contractor employees must receive annual TARP training by a CI special agent or other trainer as specified in 2-4b.

Additional remarks/requirements:

Security Manager Review Signature: I have reviewed the requirements package and it contains the correct information to meet the security requirements for this effort.

Security Manager Signature:

YES NO 16. For contractors requiring Common Access Cards (CAC). Before CAC issuance, the contractor employee requires, at a minimum, a favorably adjudicated Tier 1 or an equivalent or higher investigation in accordance with Army Directive 2014-05. The contractor employee will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) Remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) Physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled Tier 1 at the Office of Personnel Management.

YES NO 17. For contractors requiring unclassified network privileged access. Contractor personnel requiring network privileged access will have a final adjudicated Tier 3 or Tier 5 security investigation.

The investigation required is dependent on the network accreditation requirements and guidance provided by the Information System Security Manager/Officer of the local network or system. The government security manager will initiate the requisite security investigation for contractors requiring network security investigations as required by the Information System Security Manager/Officer.

Detailed privileged users access can be reference in Department of the Army Pamphlet 25 2 7 and AR 25-2, paragraph 2-38.

YES NO 18. For contractors that do not require CAC, but require access to a DoD facility or installation.

(For contractors that do not require CAC, but require access to a DoD facility or installation):

Contractor and all associated subcontractors employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB) (Army Directive 2014-05/AR 190-13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

Contract Number:

Current Version Date: 202 Page 9 of 9

YES NO 19. For contractors authorized to accompany the force. DFARS Clause 252.225-7040 (DFARS Clause 252-225-7995 for CENTCOM), DFARS Clause 252.225-7040 (DFARS Clause 252-225-7995 for CENTCOM), Contractor Personnel Authorized to Accompany U.S. Armed Forces Deployed Outside the United States. The clause shall be used in solicitations and contracts that authorize contractor personnel to accompany US Armed Forces deployed outside the US in contingency operations; humanitarian or peacekeeping operations; or other military operations or exercises, when designated by the combatant commander. The clause discusses the following AT/OPSEC related topics: required compliance with laws and regulations, pre-deployment requirements, required training (per combatant command guidance), and personnel data required.

YES NO 20. For Contract Requiring Performance or Delivery in a Foreign Country. DFARS Clause 252.225-7043, Antiterrorism/Force Protection for Defense Contractors Outside the US. The clause shall be used in solicitations and contracts that require performance or delivery in a foreign country.

This clause applies to both contingencies and non-contingency support. The key AT requirement is for non-local national contractor personnel to comply with theater clearance requirements and allows the combatant commander to exerci commander and subordinate task force commander policies and directives.

Additional remarks/requirements:

Contracting Officer Representative Review Signature: I have reviewed the requirements package and it contains the correct information to meet the contractual requirements of this effort.

COR Signature: