01_GBFMD_Exhibit 1-PWS.pdf

Global Bulk Fuel Management and Delivery (GBFMD) Exhibit 1, Performance Work Statement

Effective 1-October-2025

Performance Work Statement (PWS) United States Transportation Command

Directorate of Acquisition Specialized Transportation Division, TCAQ-IL

Global Bulk Fuel Management and Delivery (GBFMD) Consulting and Data Analysis

1 October 2025 to 30 September 2028

Table of Contents SECTION 1 Purpose SECTION 2 Scope

2.A. Overview SECTION 3 Requirements: GBFMD Consulting and Data Analysis Support

3.A. Task 1 - Data Analysis 3.B. Task 2 – Consulting and Planning Operations 3.C. Task 3 – Reports

SECTION 4 Constraints and Risks 4.A. Non-Disclosure Agreements 4.B. Copyright and Intellectual Property Ownership Rights 4.C. Indemnity 4.D. Organizational Conflict of Interest (OCI)

SECTION 5 Task Order Evaluation 5.A. Adapt to Diverse Requirements 5.B. Conduct Comprehensive Data Analysis 5.C. Provide Strategic Insights and Actionable Recommendations 5.D. Facilitate Collaboration

SECTION 6 General and Administrative 6.A. Use of English Language 6.B. Invoicing and Payment 6.C. Point of Contact 6.D. Travel

SECTION 7 Security 7.A. Cyber Security 7.B. Industrial Security Information 7.C. Operational Security (OSPEC)

SECTION 8 Deliverables

SECTION 1 PURPOSE

This Performance Work Statement (PWS) details the requirements for contractor support, including both data-driven analysis and consulting services, to inform the integration of capabilities into USTRANSCOM's Global Bulk Fuel Management and Delivery (GBFMD) operations. Addressing the challenge of developing a resilient and adaptable bulk fuel supply chain in a dynamic global threat environment necessitates rigorous data analysis and strategic guidance. Under this contract, the contractor will perform data analysis, generating critical, data-backed reports, and provide expert consulting services to assist USTRANSCOM’s GBFMD operations. This data and guidance will be used to enhance GBFMD operations, especially during crisis and contingency operations. Specifically, the analysis and consulting will directly support the Global Petroleum Integration Cell (GPIC) by providing the data analytics and strategic insights necessary to develop proactive, data-informed strategies for ensuring uninterrupted fuel support to military operations worldwide. The contractor will translate complex data analysis into actionable recommendations and strategic guidance for optimizing the U.S. fuel supply chain, encompassing market dynamics, logistics operations, infrastructure vulnerabilities, and regulatory considerations.

SECTION 2 SCOPE

2.A. Overview

2.A.1. This contract provides a comprehensive suite of services, including data-driven analysis and expert consulting, designed to assist USTRANSCOM in analyzing DoD requirements and developing data-driven strategies for their integration into GBFMD operations. Recognizing that expertise relevant to GBFMD resides across multiple sectors, the Contractor must be familiar with the global energy environment, logistics, information technology (IT), and supply chain management; and must analyze DoD data within that context. The Contractor will conduct in-depth research, gather and analyze relevant data from a variety of sources, including classified DoD data, and provide data analytics reports and strategic recommendations in support of USTRANSCOM’s GBFMD operation.

The Contractor will participate in relevant planning and operational events (including classified discussions and planning events, as appropriate), provide subject matter expertise and strategic insights to USTRANSCOM staff, and develop tailored reports, presentations, white papers, and other materials as requested, offering actionable recommendations based on data analysis and industry best practices. The contractor must demonstrate a comprehensive understanding of the U.S. fuel supply chain, including:

i. Inherent knowledge of fuel movement, storage capacity, and network capabilities.

ii. Direct control or access to data regarding critical infrastructure.

iii. Access to real-time market data and insights into fuel availability, pricing, and potential disruptions.

iv. Familiarity with stringent environmental and safety regulations governing the fuel industry.

2.A.3.1. All work under this contract will be performed through individual Task Orders. Each Task Order will detail specific data analysis activities and consulting support based on USTRANSCOM's evolving needs and priorities related to GBFMD. Task Orders may focus on specific geographic regions, operational scenarios (e.g., contested logistics environments), functional areas within GBFMD (e.g., storage, distribution, contingency planning), or specific emerging challenges and opportunities within the commercial energy sector. The consulting support may include strategic assessments, recommendations for process improvement, and guidance on integrating data-driven insights into operational planning. Each Task Order will include the following: Statement of Objectives: Clearly defined goals and objectives for the data analysis, outlining the specific information and insights USTRANSCOM seeks to obtain.

2.A.3.2. Scope of Work: The Contractor's responsibilities include providing consulting services and performing tasks such as data analysis of DoD requirements (as identified by USTRANSCOM), evaluating specific capabilities, and employing relevant methodologies.

2.A.3.3. Performance Requirements: Measurable performance standards and metrics for evaluating the Contractor's performance, including specific timelines for deliverables and quality criteria for data analysis.

2.A.3.4. Deliverables: A comprehensive list of all required deliverables, including reports, presentations, data analyses, and other documentation, specifying format, content, and delivery schedules.

2.A.3.5. Period of Performance: A defined timeframe for completing the Task Order, including start and end dates and any milestones or interim deadlines.

2.A.3.6. Security Requirements: Specific security requirements, including required clearance levels, handling procedures for classified information (if applicable), Operational Security (OPSEC) requirements and cybersecurity requirements are identified below. Contractor Company(s) is required to obtain a Top-Secret FCL in order to participate in task orders that include classified data. To facilitate a comprehensive data analysis of commercial capabilities in relation to DoD's operational requirements and vulnerabilities, Task Orders will require access to classified information and may involve consulting services to leverage specialized expertise.

SECTION 3 REQUIREMENTS: GBFMD CONSULTING AND DATA ANALYSIS SUPPORT

3.A. Task 1 - Data Analysis

3.A.1. The Contractor shall perform data analysis, at the classified level, for USTRANSCOM based on the following categories:

3.A.1.1. Analyze Current Fuel Logistics Capacity: Assess existing fuel movement, storage capacity and network capabilities within the DoD.

3.A.1.2. Define Required Fuel Logistics Capacity: Determine the necessary fuel movement and storage capacity and network capabilities required to meet DoD operational demands.

3.A.1.3. Identify Challenges to Capacity Acquisition and Sustainment: Identify and analyze the challenges associated with obtaining and maintaining the required fuel logistics capacity and network capabilities to support DoD needs.

3.B. Task 2 – Consulting and Planning Operations

3.B.1. The contractor shall participate in relevant planning and operational events, including classified discussions. As part of integrated planning and operational support, the contractor will provide requested materials, including reports and presentations. The contractor will coordinate all travel requirements with the Contracting Officer Representatives (COR) for approval.

3.B.2. The Contractor will advise USTRANSCOM, providing expert consulting services informed by a deep understanding of the U.S. petroleum refining industry's real-time market insights, fuel logistics operations, and infrastructure. These consulting services will provide strategic guidance and actionable recommendations to enhance GBFMD effectiveness and resilience. The Contractor will draw upon data analysis findings, industry best practices, and understanding of the geopolitical landscape to inform their consultations.

3.C. Task 3 – Reports

3.C.1. The Contractor shall deliver comprehensive data analysis reports, structured to address the data points specified in this PWS and each individual task order. These reports will meticulously present the data required by the task order and, critically, will include actionable recommendations outlining how the presented data can be effectively applied to enhance the GBFM mission. Reports will emphasize clear data visualization and concise summaries of key findings to facilitate informed decision-making.

3.C.2. Trip Reports. The contractor shall submit a trip report to include the following details: purpose, location, length of trip, travelers, individuals contacted during trip, synopsis of all discussions, future actions identified, decisions made, or issues of concern arising during trip. The contractor shall submit a travel request to the COR and submit a trip report to COR within five business days of completion of travel.

SECTION 4 CONSTRAINTS AND RISKS

4.A. Non-Disclosure Agreements

The Contractor will have access to sensitive, non-public information during the performance of this contract. The Contractor agrees to the following:

(a) Protect such information from unauthorized disclosure in accordance with DoDI 8582.01 Series, Security of Unclassified DoD Information on Non-DOD Information Systems. (b) Use and disclose such information solely for performing this contract and not for any personal or commercial purpose. (c) Obtain prior written Government authorization before disclosing or discussing such information with any third party. (d) Return or electronically purge all non-public, sensitive information no longer required for contract performance upon Government request.

(e) Immediately notify the Government of any unauthorized release of such information.

Within one week of contract award, the Contractor shall provide the Government with executed Non-Disclosure Agreements (NDAs) (Attachment 2) for all Contractor personnel assigned to this contract. The Contractor is responsible for obtaining and maintaining these NDAs, which restrict disclosure of information to authorized individuals identified on the NDA form. The Contractor shall also secure and provide to the Contracting Officer with fully executed NDAs with any other contractors whose proprietary information is accessed during the performance of this contract, protecting such information from unauthorized use or disclosure for as long as it remains proprietary. The Contractor is solely responsible for obtaining and ensuring proper execution of these agreements.

4.B. Copyright and Intellectual Property Ownership Rights

In accordance with DFARS 252.227-7020, all deliverables, including reports, assessments, supporting materials, and related documentation created by the Contractor under this agreement, are considered "Works Made for Hire" as defined in 17 U.S.C. §101 and are the exclusive property of USTRANSCOM. USTRANSCOM shall hold all rights, titles, and interest therein, including all copyrights and other proprietary rights. The Contractor agrees to execute any necessary assignments to confirm USTRANSCOM's ownership. The Contractor shall also ensure that all employees, subcontractors, and subcontractor employees engaged in performing work under this agreement execute agreements transferring all rights in any deliverables they create to the Contractor prior to commencing work. Upon completion of this agreement, the Contractor shall provide USTRANSCOM with fully executed assignment documents confirming the transfer of all rights from all individuals who contributed to the deliverables.

4.C. Indemnity

Contractor shall indemnify and hold harmless the United States Government, its agents, and employees from and against any and all claims, demands, liabilities, costs, expenses, and losses (including reasonable attorneys' fees and expenses) arising out of, relating to, or resulting from Contractor's performance of this contract, including but not limited to the cybersecurity assessment and analysis of the assessed contractor's computer and information technology systems, specifically including claims based on: (1) acts or omissions of Contractor, its agents, employees, or subcontractors; (2) the unauthorized disclosure of any information obtained or created during the performance of the cybersecurity assessment and analysis; or (3) any breach of confidentiality obligations by Contractor, its agents, employees, or subcontractors. Contractor's obligation to indemnify under this clause shall not extend to claims arising solely from the gross negligence or willful misconduct of the Government.

4.D. Organizational Conflict of Interest (OCI)

As required by FAR 9.5, the Government will ensure no organizational conflicts of interest are present. If any such conflict of interest is found to exist, the Contracting Officer may disqualify the Offeror or determine that it is otherwise in the best interests of the United States to contract with the Offeror and include the appropriate provisions to avoid, neutralize, mitigate, or waive such conflict in the contract awarded. The Offeror shall provide the Contracting Officer with complete information of any previous or ongoing work that is in any way associated with this acquisition, or related acquisitions. The Offeror shall submit a mitigation plan that addresses actual or perceived conflicts of interest related to the services required by this effort for Government review. The Government will conduct an independent assessment review of any submitted OCI Mitigation Plan to determine if any actual or perceived OCI exists and what further actions are necessary, if any. Additionally, the Government will monitor contract performance for emerging areas of conflict of interest and take action considered necessary to avoid, neutralize, or mitigate conflicts. If the Offeror believes there is no OCI, a statement as such shall be included.

SECTION 5 TASK ORDER EVALUATION

Task Orders issued under this contract will be evaluated based on the demonstrated experience, expertise, and capabilities related to both the data analysis and consulting service areas outlined in Section 3 of this PWS. Specific evaluation criteria and their relative importance (weighting) will be detailed in each individual Task Order. Offerors should demonstrate their ability to:

5.A. Adapt to Diverse Requirements

Tailor data analysis methodologies and approaches to the unique requirements of each Task Order, including specific operational scenarios, geographic locations, fuel types, and scales of operation.

5.B. Conduct Comprehensive Data Analysis

Perform rigorous analysis of DoD data related to petroleum storage, distribution, and operations, as specified in individual Task Orders. This includes the ability to gather and analyze data from multiple sources, apply appropriate statistical and analytical techniques, and provide clear, concise, and well-supported findings and recommendations.

5.C. Provide Strategic Insights and Actionable Recommendations

Demonstrate experience in developing and delivering impactful strategic assessments, recommendations for operational improvement, and guidance on integrating data-driven insights. Showcase in-depth knowledge of the global bulk fuel market, DoD fuel logistics operations, and emerging energy technologies. Provide examples of successful application of this expertise to solve complex challenges. Offerors should demonstrate access to, and understanding of:

v. Real-time market dynamics affecting fuel availability and pricing.

vi. Fuel logistics operations and infrastructure within the U.S. fuel supply chain.

vii. The regulatory landscape governing the U.S. fuel industry.

5.D. Facilitate Collaboration

Effectively collaborate with USTRANSCOM personnel and other DoD stakeholders as required by each Task Order. This includes clear communication, effective coordination, and the ability to foster productive working relationships.

SECTION 6 GENERAL AND ADMINISTRATIVE

6.A. Use of English Language

All communication and documentation related to this contract shall be conducted and provided in the English language. Any supporting documentation or materials originally produced in a foreign language shall be accompanied by a certified English translation.

6.B. Invoicing and Payment

The contractor shall submit invoices electronically in accordance with the procedures and format specified in the contract. Invoices shall be detailed, clearly itemizing all costs incurred, and supported by appropriate documentation. Payment will be made by the Government upon verification and approval of the submitted invoices.

6.C. Point of Contact

The contractor shall designate a primary and an alternate point of contact responsible for all communication and coordination with the Government. Contact information shall include names, titles, email addresses, and telephone numbers. The designated points of contact shall be readily available during normal business hours and provide prompt responses to Government inquiries.

6.D. Travel

Performance under contract may require contractor travel. Travel requirements will be identified at the task order level. The Government will reimburse the contractor for travel expenses subject to Federal Acquisition Regulation and Joint Travel Regulation. All contractor travel shall be coordinated with and approved by the primary and/or alternate Contracting Officer Representative (COR) prior to incurring any travel expenses. Travel requests shall be in writing and contain the Government Action Officer (AO) name requesting the specific travel, dates, location, and estimated travel costs. The contractor shall identify personnel who will be traveling in sufficient time to obtain the lowest possible rates for airfare, rental car, and lodging. The contractor shall submit trip reports as stated in paragraph 3.C.2 . of this PWS. The Government will not reimburse local travel and related expenses to the contractor for daily travel to or from work.

SECTION 7 SECURITY

7.A. Cyber Security

7.A.1. General Cyber Security Requirements

7.A.1.1. Handling and Protection of Non-Public Information

7.A.1.1.1. For unclassified systems, in performance of this contract, the Contractor may have access to DoD Transactional Information (DTI), which for the purposes of this section shall mean any information developed or received in the course of planning, ordering, shipping, tracking, and invoicing in support of the requirements of this contract. To adequately protect this DTI, the Contractor information systems (IS) involved in the performance of this contract shall comply with the security requirements in the current version of the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations.” Unless Covered Defense Information (CDI) (as defined in DFARS 252.204-7012) is identified, present, processed, stored, or for, a Contractor compliance with NIST SP 800- 171 measures is required at the prime contractor level and does not apply to subcontractors and other entities that the prime contractor engages with in order to meet the requirements of this contract. CDI must be protected in accordance with DFARS 252.204-7012.

7.A.1.1.2. Additionally, the Contractor agrees to use such information only for the purposes of fulfilling the contracted requirements and to protect such information from unauthorized release or disclosure. Protection of the DTI does not abrogate any responsibilities of the Contractor to comply with or implement additional cyber security requirements as part of generally accepted system security principles or as required by other categories of information that may be co-resident with the DTI on the Contractor’s IS.

7.A.1.2. Operationally Critical Support

The services designated under this contract are “operationally critical support” as defined in DFARS 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting.

7.A.2. Cyber Security Self-Assessment and Plan of Action

7.A.2.1. The Contractor shall provide a Self-Assessment of its compliance with NIST SP 800-171 and present a Plan of Action that identifies any deviations, non-compliance, or proposed alternative means of compliance as well as plans for correcting non-compliant requirements to the Contracting Officer within 60 calendar days of contract award and then annually thereafter. The Self-Assessment and Plan of Action shall address all of the requirements in

NIST SP 800-171.

7.A.2.2. Table 7.A.2 provides modified requirements of CUI/CDI specific controls from NIST SP 800-171 that will be used to evaluate compliance in a non-CUI/CDI environment. Additionally, at any time during the period of performance, when a Contractor determines it is non-compliant with a NIST SP 800-171 requirement or an approved alternate means of compliance resulting in a High or Moderate Potential Impact as defined in Federal Information Processing Standards Publication (FIPS PUB) 199, “Standards for Security Categorization of Federal

Information and Information Systems,” the Contractor shall submit a Plan of Action within 15 calendar days of the determination of non-compliance.

7.A.2.3. Plans of Action and any requests to vary from NIST SP 800-171 shall be submitted to the Contracting Officer for consideration and approval by USTRANSCOM. The Contractor need not implement any security requirement determined by USTRANSCOM to be non-applicable or to have an equally effective alternative security measure implemented in its place. The Plan of Action shall follow the template provided (PWS Attachment 9).

Alternate formats for the Plan of Action may be proposed and must be approved by USTRANSCOM.

7.A.2.4. USTRANSCOM may conduct an on-site visit to a contractor’s facility or request a third-party assessment (Government agency or Government funded commercial entity) to review progress towards meeting their Plan of Action, evaluate any proposed variances to NIST SP 800-171 requirements, and to assess residual risk to the DTI resulting from the non-compliance. Date and time of on-site visits will be mutually agreed-upon by USTRANSCOM and the Contractor in advance.

Table 7.A.2 Modified NIST SP 800-171 Requirements

Req # NIST SP 800-171 Requirement USTRANSCOM Modified Requirement

3.1.3 Control the flow of CUI in accordance with

approved authorizations.

Limit the flow of DoD information to organizations or individuals necessary for the performance of the operationally critical requirements of this contract.

3.1.9 Provide privacy and security notices consistent

with applicable CUI rules.

Provide privacy and security notices consistent with U.S. Government and/or local governmental regulations.

3.1.19 Encrypt CUI on mobile devices and mobile

computing platforms.

Provide adequate technical protections on mobile devices and computing platforms that process and/or store contractual information.

3.1.22 Control CUI posted or processed on publicly

accessible systems.

Control DoD information posted or processed on publicly accessible systems.

3.7.3 Ensure equipment removed for off-site

maintenance is sanitized of any CUI.

Ensure equipment removed for off-site maintenance is sanitized of DoD information.

3.8.1 Protect (i.e., physically control and securely store)

system media containing CUI, both paper and digital.

Protect (i.e., physically control and securely store) system media containing DoD information, both paper and digital.

3.8.2 Limit access to CUI on system media to authorized

users.

Limit access to DoD information on system media to authorized users.

3.8.3 Sanitize or destroy system media containing CUI

before disposal or release for reuse.

Sanitize or destroy system media containing DoD information before disposal or release for reuse.

3.8.4 Mark media with necessary CUI markings and

distribution limitations.

Mark media with privacy and security notices consistent with U.S. Government and/or local government regulations.

3.8.5 Control access to media containing CUI and

maintain accountability for media during transport outside of controlled areas.

Control access to and maintain accountability for media containing DoD information.

3.8.9 Protect the confidentiality of backup CUI at

storage locations.

Provide information backup procedures (frequency, timeframe for storage, etc.) for DoD data located on contractor systems. Protect the confidentiality of backup materials containing DoD information.

3.9.1 Screen individuals prior to authorizing access to

organizational systems containing CUI.

Screen individuals prior to authorizing access to organizational systems containing DoD information.

3.9.2 Ensure that CUI and organizational systems

containing CUI are protected during and after personnel actions such as terminations and transfers.

Ensure that DoD information and organizational systems containing DoD information are protected during and after personnel actions such as terminations and transfers.

3.10.6 Enforce safeguarding measures for CUI at

alternate work sites (e.g., telework sites).

Enforce safeguarding measures for DoD Information at alternate work sites (e.g., telework sites).

3.11.1 Periodically assess the risk to organizational

operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.

Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of DoD information.

3.13.8 Implement cryptographic mechanisms to prevent

unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.

Implement cryptographic mechanisms to prevent unauthorized disclosure of DoD information during transmission when possible unless otherwise protected by alternate physical safeguards.

3.13.11 Employ FIPS-validated cryptography when used to

protect the confidentiality of CUI.

Employ FIPS-validated cryptography when used to protect the confidentiality of DoD information within the organization’s systems and when possible, when transmitting to external entities.

3.13.16 Protect the confidentiality of CUI at rest. Protect the confidentiality of DoD information at rest.

7.A.3. Cyber Incident Reporting

7.A.3.1. In addition to the DFARS 252.204-7012 reporting requirements for unclassified systems and 32 CFR Part 117, National Industrial Security Program Operating Manual (NISPOM) for classified systems, reportable cyber-incidents (regardless of whether the information system contains CDI or there is an impact to performance such as delivery schedule delay), include, but are not limited to, the following:

7.A.3.1.1. Cyber-incidents as defined in Table 7.A.3

7.A.3.1.2. Notifications by a federal, state, or local law enforcement agency or cyber-center (i.e., National Cyber Investigative Joint Task Force (NCIJTF), National Cybersecurity & Communications Integration Center (NCCIC) of being a victim of a successful or unsuccessful cyber-event anomaly, incident, insider threat, breach, intrusion, or exfiltration.

Table 7.A.3.

Incident Category Description Root Level Intrusion Unauthorized privileged access to an IS. Privileged access, often referred to as administrative or root access, provides unrestricted access to the IS. This category includes unauthorized access to information or unauthorized access to account credentials that could be used to perform administrative functions (e.g., domain administrator). If the IS is compromised with malicious code that provides remote interactive control, it will be reported in this category.

User Level Intrusion Unauthorized non-privileged access to an IS. Non-privileged access, often referred to as user level access, provides restricted access to the IS based on the privileges granted to the user. This includes unauthorized access to information or unauthorized access to account credentials that could be used to perform user functions such as accessing Web applications, Web portals, or other similar information resources. If the IS is compromised with malicious code that provides remote interactive control, it will be reported in this category.

Denial of Service Denial of Service (Incident)—Activity that denies, degrades, or disrupts normal functionality of an IS or DoD information network.

Malicious Logic Installation of software designed and/or deployed by adversaries with malicious intentions for the purpose of gaining access to resources or information without the consent or knowledge of the user. This only includes malicious code that does not provide remote interactive control of the compromised IS. Malicious code that has allowed interactive access should be categorized as Root or User Level

Intrusion incidents. Interactive active access may include automated tools that establish an open channel of communications to and/or from an IS.

Ransomware Malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable. Malicious actors then demand ransom in exchange for decryption. Ransomware actors often target and threaten to sell or leak exfiltrated data or authentication information if the ransom is not paid. Ransomware is a reportable incident that may be associated with multiple incident categories depending on the attack vector and execution.

7.A.3.2. If the cyber-incident affects a classified system, vulnerabilities associated with the incident will be classified per the current version of USTRANSCOM Instruction 31-02, Security Classification Guide.

7.A.4. Cybersecurity Incident Reporting Timelines

In addition to providing the notification required by DFARS 252.204-7012, the Contractor is required to notify USTRANSCOM as soon as practical, but no later than 72 hours after discovering a reportable cyber-incident. The reporting timeline begins when the incident is discovered or reported to the company, its employees, contractors, or cybersecurity firm responsible for providing cybersecurity and response for the company. The Contractor shall contact the USTRANSCOM Cyber Operations Center (CyOC) via phone at 618-817-4222. If the Contractor does not immediately reach the CyOC via phone, the Contractor shall send an email notification to transcom.scott.tcj6.mbx.cyoc-dodin-operations@mail.mil.

7.A.5. Mandatory Reporting Data

7.A.5.1. The Contractor shall work with the USTRANSCOM CyOC through resolution of the incident. Within 4 hours of becoming aware of a reportable cyber-incident, the Contractor shall provide an initial notification of the incident, even if some details are not yet available, which includes, but is not limited to, the following information:

7.A.5.1.1. Company Name

7.A.5.1.2. Who will be the POC with contact information

7.A.5.1.3. Contracting Officer POC (name, telephone, email)

7.A.5.1.4. Overall Assessment –Description of incident, data at risk, mitigations applied

7.A.5.1.5. Indicators of compromise

7.A.5.1.6. Vector of attack (if known)

7.A.5.1.7. Estimated time of attack (if known)

7.A.5.2. The Contractor shall provide a follow-on cyber-incident report to the USTRANSCOM CyOC within 24 hours of becoming aware of a reportable cyber-incident, which includes, but is not limited to, the following information:

7.A.5.2.1. Contractor unique Commercial and Government Entity (CAGE) code

7.A.5.2.2. Contract numbers affected

7.A.5.2.3. Facility CAGE code where the incident occurred if different than the prime Contractor location

7.A.5.2.4. POC if different than the POC recorded in the System for Award Management (name, address, position, telephone, email)

7.A.5.2.5. Contracting Officer POC (name, telephone, email)

7.A.5.2.6. Contract clearance level

7.A.5.2.7. DoD programs, platforms, systems, or information involved mailto:transcom.scott.tcj6.mbx.cyoc-dodin-operations@mail.mil

7.A.5.2.8. Location(s) of compromise

7.A.5.2.9. Date incident discovered

7.A.5.2.10. Type of compromise (e.g., unauthorized access, inadvertent release, other)

7.A.5.2.11. Description of technical information compromised

7.A.5.2.12. Any additional information relevant to the information compromise

7.A.6. Incident Reporting Coordination

7.A.6.1. In the event of a cyber-incident, USTRANSCOM may conduct an on-site review of network or information systems where DoD information is resident on or transiting to assist the Contractor in evaluating the extent of the incident and to share information in an effort to minimize the impact to both parties. Date and time of on-site visits will be mutually agreed upon by USTRANSCOM and the Contractor in advance.

7.A.6.2. The Contractor agrees to allow follow-on actions by the Government (e.g., USTRANSCOM, Federal Bureau of Investigation, Department of Homeland Security, DC3, etc.) to further characterize and evaluate the suspect activity. The Contractor acknowledges that damage assessments might be necessary to ascertain an incident methodology and identify systems compromised as a result of the incident. Once an incident is identified, the Contractor agrees to take all reasonable and appropriate steps to preserve any and all evidence, information, data, logs, electronic files and similar type information (reference NIST Special Publication 800-61: Computer Security Incident Handling Guide, (current version)) related to the incident for subsequent forensic analysis so that an accurate and complete damage assessment can be accomplished by the Government.

7.A.6.3. The Contractor is not required to maintain an organic forensic capability, but must ensure data is preserved (e.g., remove an affected system, while still powered on, from the network) and all actions documented until forensic analysis can be performed by the Government or, if the Government is unable to conduct the forensic analysis, a mutually agreed upon third party (e.g., Federally Funded Research and Development Center , commercial security contractor, etc.). Any follow-on actions shall be coordinated with the Contractor via the Contracting Officer.

7.A.6.4. The Contractor agrees to indemnify and hold the Government harmless for following any recommendations to remedy or mitigate the cyber-incident following the actions under paragraphs 11.A.6.1 and 11.A.6.2.

7.A.6.5. Contractors are encouraged to work with government entities in voluntary programs that help prevent incidents and can support investigation and risk management during an incident.

7.A.7. Confidentiality and Non-Attribution Statement

The Government may use and disclose reported information as authorized by law and will only provide attribution information on a need-to-know basis to authorized persons for cybersecurity and related purposes (e.g., in support of forensic analysis, incident response, compromise or damage assessments, law enforcement, counterintelligence, threat reporting, and trend analysis). The Government may share threat information with other USTRANSCOM industry partners without attributing or identifying the affected contractor.

7.B. Physical, Personnel, Information, Industrial and Antiterrorism/Force Protection Security Information

7.B.1. General Security Requirements Information/Applicability. The majority of daily work associated with this PWS/SOW is at the unclassified level, but contractor personnel may be required to access classified information/systems at the SECRET (S), TOP SECRET (TS) or TS-Sensitive Compartmented Information (TS-SCI) level, and/or classified areas at the SECRET, TOP SECRET or TS-SCI, during performance of this contract/task order. FAR Clause 52.204-2, Security Requirements, applies to the extent that this contract/task order involveing access to information, areas or material classified “CONFIDENTIAL” or “SECRET”, or “TOP SECRET”. Specific security protocols for contracted companies are outlined in 32 CFR Part 117, National Industrial Security Program Operating Manual (NISPOM), identified in this section of the PWS, and the DD Form 254 (DoD Contractor

Security Classification Specification). A completed/signed DD Form 254 will be attached to the contract/task order (a new DD 254 will need to be completed for each task order).

7.B.2. Citizenship and Clearance Requirements. The contractor’s, subcontractors, and/or partner’s personnel performing services under this contract/task order shall be citizens of the United States of America. Overall, all contractor personnel shall possess the appropriate personnel security investigation for the position(s) occupied.

Contractor personnel shall be required to have a background investigation that corresponds with the sensitivity level of the tasks to be performed. Non-US citizens are not eligible for Common Access Cards (CACs) unless they meet the parameters stated in Department of Defense Manual (DoDM) 1000.13, Volume 1. All personnel that will have Information Technology (IT)/Automated Data Processing (ADP) privileged access (i.e. Privilged Users) to US Information Systems (IS), and/or classified information, classified systems, or classified areas, shall be US citizens.

Foreign Nationals or Local Nationals employed by the DoD are not authorized to have privileged access to US Information Systems.

7.B.3. Information Systems (IS) Roles/Categories and Associated Suitability Requirements (Federal Investigative Standards). Contractor personnel with IA administrative privileges and/or who will monitor DoD IT systems or software as designated by DoD Instruction 8500.01 and DoD Manual 5200.02 may be rated at the various levels listed below. The IS roles/categories and the number of personnel assigned to each role is approved by the COR or the CO before the start of the contract/task order. The contractor shall comply with the appropriate provisions of applicable security regulations while assigned to this contract/task order for DoD and USTRANSCOM. The following guidance will be followed when determining background investigation levels for this contract/task order depending on requirements:

IS Role/Category Classified Access Required Investigation General User (Non-Privileged Access) (IT/ADP-III, Non-Sensitive) NO Tier 1 (T1)

General User (Non-Privileged Access) (IT/ADP-II, Non-Critical Sensitive) YES Tier 3 (T3)

Privileged User (e.g. System Administrator) (IT/ADP-I, Critical Sensitive) NO Tier 5 (T5)

Privileged User (e.g. System Administrator) (IT/ADP-1, Critical Sensitive) YES Tier 5 (T5)

NOTE: USTRANSCOM Joint Security Office (TCCS-S) will initiate/administer Tier 1 investigations to determine CAC eligibility only, classified access will not be granted based on the Tier 1 investigation. Tier 3 and Tier 5 investigations are the responsibility of the contractor. It is incumbent upon the contractor to have the appropriate investigations completed upon the start of the contract/task order.

7.B.4. Security Clearance and Special Access Requirements. All positions on this contract/task order require a minimum of either an interim SECRET granted by the Defense Counterintelligence and Security Agency (DCSA) Adjudication & Vetting Services (AVS), or a completed adjudication of SECRET granted by DCSA AVS. In addition, some positions on this contract/task order require access to TOP SECRET or Sensitive Compartmented Information (SCI). Contractors requiring access to TOP SECRET or TS-SCI must have an eligibility determination of TOP SECRET as granted by DCSA AVS. Tasks that require collateral TOP SECRET and TS-SCI security clearances are outlined in the table below. TS-SCI will not be released to contractor employees without specific release approval of the originator.

Paragraph Task Area Restricted System Access

TOP SECRET SCI

7.B.5. Facilities Clearance (FCL). The contractor must have a valid FCL at the TOP SECRET level. FCL procedures and security guidelines for adjudicative requirements are outlined in 32 CFR Part 117. FCLs must be awarded by the DCSA Office of Entity Vetting.

7.B.6. Personnel and Facilities Clearance Validation. Upon contract/task order award, the USTRANSCOM contracting team will send TCCS-S the contractor cage code for FCL verification via the National Industrial

Security System (NISS). The contractor will submit names of the contractor personnel performing on the contract/task order to the USTRANSCOM contracting team, who will provide to TCCS-S for vetting through the DoD personnel security system of record to ensure investigative and clearance requirements have been satisfied.

This shall be completed before the COR/Mission Partner Affiliation Sponsor (MPAS) accesses the Mission Partner Identity, Credential, and Access Management (MP ICAM) system and creates CAC applications for contractor personnel. If a contractor’s employee does not have the required investigative or security clearance level based on the Government’s determination, the contractor’s employee will be denied the ability to work in support of this contract/task order.

7.B.7. Common Access Card Issuance Procedures.

a. Facility Security Officer (FSO) will verify, via the DoD personnel security system of record, contractors on the contract/task order have the required background investigation to obtain a CAC and provide those names to the CO/COR. Contractors that require a Tier 3 and Tier 5 investigation are the responsibility of the contractor. Contractors that only require a Tier 1 as determined by the FSO will submit to the TCCS-S Personnel Security Program Manager (through the CO or COR) an OF Form 306 (Declaration for Federal Employment) and a MP ICAM Form 1 with Section 1 completed. TCCS-S will initiate the SF-85 (questionnaire for Non-Sensitive Positions) via the National Background Investigation Services (NBIS) for completion and submission to DCSA, for Tier 1 investigations only.

b. At the same time, the contractor company will coordinate and obtain electronic fingerprinting for their employee. The third-party company will “electronically” capture the applicant’s fingerprints, using the USTRANSCOM (Submitting Office Number, Security Office Identifier, and Agency Location Code). Hardcopy fingerprint cards are NOT acceptable. These steps shall be completed before the COR/MPAS accesses MP ICAM to create a CAC application.

c. Basic US Citizen Contractor CAC Requirements.

i. Requires access on a continual basis of 6 months or more.

ii. Contractor personnel require access to a DoD facility or networks, either on-site or from a remote location.

iii. Users need access to systems for platforms that require CAC login or user authentication.

d. Basic Non-US Citizen Contractor CAC Requirements.

i. Meet (as direct/indirect DoD hire personnel) the investigative requirements for DoD employment as recognized through international agreements pursuant to DoDI 1400.25, Civilian Personnel Management, Volume 1231. In addition to these investigative requirements, fingerprint check against the FBI criminal history database, an FBI investigations files (name check search), and a name check against the Terrorist Screening Database shall be required prior to CAC issuance IAW Office of Personnel Management Memorandum, “Final Credentialing Standards for Issuing Personal Identity Verification Cards under HSPD-12”, July 31, 2008.

ii. Possess (as foreign military, employee, or contract support personnel), a visit status and security assurance that has been confirmed, documented, and processes IAW international agreements pursuant to DoDI 1400.25, Civilian Personnel Management.

e. CAC Applications.

1. The CAC applications (MP ICAM Form 1 with Section 1 completed) must have an adjudication Tier 1, Tier3, or Tier 5 background investigation posted in the DoD personnel security system of record, or

2. An interim CAC may be approved when the contractor employee has a favorable fingerprint, name and criminal records check completed and has either a Tier 1, Tier 3, or Tier 5 background check “open” with DCSA.

3. The MP ICAM MPAS will not approve the CAC applications in MP ICAM until that MPAS has verified, with a member of USTRANSCOM TCCS-S, one of the above requirements.

7.B.8. Access to Scott Air Force Base or USTRANSCOM Facilities. Upon receipt of the CAC, permanently assigned contractor personnel located at USTRANSCOM at Scott AFB (SAFB), IL, may obtain a USTRANSCOM Facility Access Badge if the employee will be assigned physically on SAFB in a USTRANSCOM-owned or managed facility, has a valid Visit Access Request on file, and attends Initial Security Training (IST) on-site. The Government will provide unrestricted access to facilities, consistent with security clearance eligibility and need-to-know, necessary for the on-site personnel to perform their work IAW the contract/task order. Contractor personnel assigned on-site at USTRANSCOM will wear and display the USTRANSCOM Facility Access Badge at all times while in USTRANSCOM facilities. Visits to SAFB by contractor personnel who do not possess the CAC will be facilitated by the COR/CO sponsoring the employee through the online base access systems.

7.B.9. Visits by Non-Assigned Contractors to USTRANSCOM Buildings. Any visit(s) by contractor personnel not permanently assigned to this contract/task order (i.e. company presidents, company security managers, contractor personnel not permanently assigned at SAFB, etc.) require an electronic visit access request be submitted using the DoD personnel security system of record. The DoD personnel security system of record visits can be forwarded to the Security Management Office (SMO) code: US-TRANSCOM-1. The visit access request shall annotate the contract/task order number in the POC block of the visit access request and the name/phone number of either the functional, COR or CO in the phone number block.

7.B.10. Visits by Permanently Assigned Contractors. Permanently assigned contractor employees on SAFB will require a visit access request for the current period of performance posted in the DoD personnel security system of record to SMO: US-TRANSCOM-1. The visit access request will annotate the contract number in the POC block of the visit access request and the name/phone number of either the functional, COR or CO in the phone number block.

7.B.11. Supplemental Notes Regarding Visit Information in the DoD Personnel Security System of Record.

Personnel requiring access to Government facilities will properly complete the “Visit Information” block in the DoD personnel security system of record. Otherwise, contractor employees will be denied access to the facility and classified and/or sensitive information. Also, prime contractors will annotate their contract number and subcontractors will provide the name of their company, with the prime contract number they are assigned to by the prime, in the “additional information” block of the visit table. A valid “Reason for the Visit” must be stated and the “visit access” must not exceed that of the contract.

7.B.12. Security and Emergency Operations Training. Contractor personnel physically assigned at USTRANSCOM at SAFB shall attend/complete the following training as prescribed by DoD, USTRANSCOM and Air Force Instructions: Initial Security, Workplace Violence, Annual Security Awareness, Operations Security (OPSEC), DoD Antiterrorism Level I, Active Shooter/Attacker, Emergency Operations, Combating Trafficking in Person (CTIP), Controlled Unclassified Information (CUI), Derivative Classification, and any Security Stand-down Day Training scheduled by the Commander, USTRANSCOM. Contractor personnel assigned elsewhere shall attend security training established by their respective Government security offices and/or installations. SCI Training will be conducted by USTRANSCOM TCJ2, SSO and contractor personnel will attend all training for this SCI requirement.

7.B.13. Additional Security Conditions. All contractors assigned to USTRANSCOM on SAFB will complete the contractor in-processing before the start of work on this or any contract/task order in USTRANSCOM. Contractors starting work on a new contract/task order will report to the Joint Security Desk, located in Building 1900 first-floor breezeway. In-processing includes the following:

a. Verification of personal identification

b. Verification of Visit Access Request in the DoD personnel security system of record

c. Verification of the contractor’s Security Clearance Eligibility in the DoD personnel security system of record

d. Brief and sign the individual SF-312 (Security Agreement)

e. Complete North Atlantic Treaty Organization (NATO) Indoctrination

f. Review of Facility access requirements

g. Issuance of Temporary USTRANSCOM Facility Access Badge for the facility

h. Creation of a personnel security file

7.B.14. Derogatory Information. Any member of the contracted team (Program Manager, FSO, or other supervisory staff) aware of pending human resource activity of consequence (to include termination or suspension), behaviors or patterns of concern, or misconduct, to include reporting requirements in accordance with Security Executive Agent Directive (SEAD) 3 (for contractors with classified security eligibility), for any contractors supporting this contract/task order during the established period of performance, will immediately contact the USTRANSCOM Joint Security Office (TCCS-S) Attn: Industrial Security Program Manager. If the Government notifies the contractor that the continued employment of any contractor personnel is prejudicial to interests or endangers the security of the United States of America and/or USTRANSCOM personnel, information, or assets;