Request for Proposals Attachment 2 ASPR Security Requirements

Attachment 2: ASPR Security Requirements
* This list of deliverables and ASPR-mandated security requirements may be required for any contract or agreement awarded by or on behalf of ASPR. ASPR shall be the sole determiner of the necessity of inclusion of these requirements, or subset thereof, on a case-by-case basis, as identified in the Deliverables Section of the Solicitation. Included with Project Proposals, offerors must include a statement attesting to their intent and ability to comply with these deliverables and security requirements within the deadline dates stated in Section F.3.2 (Deliverable Table) of the RFP solicitation. These ASPR deliverables and security requirements are included in the solicitation to enable awareness and early planning by offerors for their inclusion as performance requirements under contract awards.

Security Reporting Requirements

The partner facility shall notify the Government Security Team within 24 hours of any activity or incident that is in violation of established security standards or indicates the loss or theft of government products associated with this Agreement. The facts and circumstances associated with these incidents will be documented in writing for government review.

Operational Security (OPSEC)

The performer shall develop an OPSEC Standard Operating Procedure (SOP)/Plan within ninety (90)-calendar-days after project award to be reviewed and approved by the responsible Government OPSEC officer. This plan will be submitted to the COR for coordination of approval. This SOP/Plan will include identifying the critical information related to this award, why it needs to be protected, where it is located, who is responsible for it, and how to protect it.

Security Plan

The contractor shall develop a comprehensive security program that provides overall protection of personnel, information, data, and facilities associated with fulfilling the Government requirement. This plan shall establish security practices and procedures that demonstrate how the contractor will meet and adhere to the security requirements outlined below prior to the commencement of product manufacturing. The Draft Security Plan shall be delivered to the CO and COR no later than 30 calendar days after award. The contractor shall also ensure all subcontractors, consultants, researchers, etc. performing work on behalf of this effort, comply with all Government security requirements and prime contractor security plans.
a. The Government will perform an internal review in detail and submit comments