126FS004_Emergency_Management_System_Security_Plan_SOW_V6.pdf

We make lives better through connections.

Regional Transportation District 1660 Blake Street, Denver CO 80202 rtd-denver.com

Statement of Work Diana Rawles

126FS004

Version: 5

June 22, 2026 rtd-denver.com

Table of Contents Executive Summary

Project Description Scope of the Project Period of Performance Roles and Responsibilities

Project Requirements Business Requirements Project Management Requirements Documentation Requirements

Executive Summary Under this project, the contractor will develop and produce two documents. One is the System Security Plan, a required document for public transportation entities that are applying for Transit Security Grant Program. This document is intended to define a framework to protect people and infrastructure. The other document is a Threat and Hazard Identification and Risk Assessment, which is a standard document in emergency management to identify those events of greatest significance to the agency.

Project Description Scope of the Project

This project will encompass research, coordination, and writing of two plans: the System Security Plan (SSP) and the Threat and Hazard Identification and Risk Assessment (THIRA).

Period of Performance This project is funded through the Transit Security Grant Program which has a period of performance of 3 years from award date. The two plans should each take about a year to complete. The plans will be developed sequentially with some potential for overlap as the System Security Plan work concludes and the THIRA work initializes.

Roles and Responsibilities The contractor is responsible for providing two plans. One is the System Security Plan, which is described by FTA and APTA to define security posture. This will require research and coordination with leadership within RTD’s Transit Police Department and validation before ultimate approval by RTD. RTD will be responsible for furnishing information to the contractor to develop the plan as well as dedicating staff time to meet and discuss the plan with the contractor.

The other product plan is the Threat and Hazard Identification and Risk Assessment, which is described by FEMA to describe those events which pose greatest risk to RTD. This will require research, including regional THIRAs as well as information from RTD regarding infrastructure specifications and vulnerabilities.

RTD will be responsible for furnishing information to the contractor to develop the assessment as well as dedicating staff time to meet and discuss the assessment with the contractor.

Project Requirements

The project requirements that follow in this SOW are also documented below in this SOW.

Business Requirements

Business Requirement ID Business Requirement Name Description 1 Development of System Security Plan Research, writing, and ultimate acceptance by RTD of plan 2 Development of Threat and Hazard

Identification and Risk Assessment Research, writing, and ultimate acceptance by RTD of assessment

Project Management Requirements

PM

Requirement ID

PM Requirement Name

Description

REQ-3 Kick-off Meeting A Project Kickoff Meeting, coordinated with the RTD Project Manager (PM), shall be scheduled within seven (7) days after Notice to Proceed (NTP) and conducted within twenty-one (21) days. The Project Kickoff Meeting will be conducted by the Contractor and the RTD Project Manager at RTD offices, through Microsoft Teams, or other high-quality teleconferencing approach.

REQ-4 Project Meetings The contractor shall schedule and facilitate Progress Meetings held between the Contractor and RTD on a weekly or every other week basis, as deemed necessary by RTD, for the purpose of reviewing progress, coordinating activities, and other project activities that cannot be resolved by correspondence. The timing of these meetings shall be conducted at RTD’s sole discretion, based on the nature of the current project activities. These meetings may be at RTD offices, through Microsoft Teams, or other high- quality teleconferencing approach.

REQ-5 Project Meeting Agendas Agendas for the Progress Meetings will be prepared by the Contractor and may include any topics that the Contractor's Project Manager determines to be relevant to the project. The Contractor shall insure those persons knowledgeable in the topics to be discussed, including subcontractors, subject matter experts, and/or technical representatives, are present at all necessary meetings. Agendas will be submitted at least two (2) business days prior to the meeting.

REQ-6 Meeting Summaries Meeting summaries shall be taken at all meetings. Summaries shall include a summary of all topics discussed, a listing of all understandings and agreements reached, and an updated AIL (see below}. Unless otherwise agreed, the Contractor shall be responsible for taking all meeting summaries. The format for the meeting summaries shall be developed based on input from RTD. Completed meeting summaries shall be uploaded to the RTD Teams project site by the Contractor.

REQ-7 Meeting Summaries The meeting summaries shall be distributed to all attendees for review within three (3) business days from the end of the meeting.

REQ-8 Action Item List During meetings, action items will be identified, with each action item assigned to an individual for disposition by a pre-determined response date. These action items shall be maintained and updated throughout the project by the Contractor, in an Action Item List (AIL). The AIL format will be mutually agreed upon by the Contractor and RTD.

The AIL shall be maintained in the RTD Teams project site.

REQ-9 Issue Tracking systems The Contractor shall provide RTD key personnel access to any issue tracking system used by the Contractor to support the project. The Contractor will provide no less than monthly a status report of all tickets.

REQ-8 Monthly Status Report Contractor shall provide to the RTD PM a status report monthly highlighting key accomplishments, risks, issues, and milestones/deliverables updates.

The monthly status reports shall be uploaded by the Contractor to the RTD Teams project site. Status reports shall be uploaded by the Contractor to the RTD Teams project site.

REQ-9 Invoice Documentation The Contractor shall keep and maintain reasonably complete and reliably detailed records of milestones achieved in performing the Contract, including records of productivity to identify basis for payment, sufficient to evaluate the accuracy, completeness, and currency of the costs or prices.

REQ-10 Project Schedule Within thirty (30) days after NTP, the Contractor shall furnish, to RTD for RTD’s approval, a detailed Project Schedule. The detailed Project Schedule shall be based on critical-path-method and constructed using Microsoft Project or RTD approved substitute. The project schedule shall include both Contractor and RTD tasks. The project schedule shall be maintained on the RTD Teams project site.

REQ-11 Project Schedule Updates The Contractor shall be required to submit project schedule updates on at least a monthly basis. More frequent near-term schedule updates may be required, if deemed advantageous by RTD for monitoring the progress of specific phases of the project.

REQ-12 Site Visits The Contractor shall schedule and conduct site visits with the RTD PM with at least two

(2) weeks’ notice or at the discretion of the RTD PM.

REQ-13 Personnel All personnel assigned by the Contractor shall display appropriate identification while on RTD property and adhere to all RTD Rules and Regulations.

REQ-14 Project Communications All email communications from the Contractor shall originate from accounts that are owned and managed by the Contractor through access management controls.

REQ-15 Project Communications Within thirty (30) days of NTP, the Contractor shall provide a RACI along with Contractor’s escalation procedure, including contact names and information for each level of escalation. This shall be updated by the Contractor within one week of any changes in key personnel.

REQ-16 Project Communications The Contractor shall promptly notify the RTD PM of any problems or difficulties that may affect the timely or effective completion of the project or any scheduled deliverables.

REQ-17 Project Communications The Contractor shall coordinate activities with RTD PM regarding affected RTD business units and personnel, and with external individuals and organizations.

REQ-18 Subject Matter Experts The Contractor shall make all subject matter experts available - when required or requested.

Documentation Requirements Documentation Requirement ID

Documentation Requirement Name

Description

REQ-19 Documentation All documentation shall be in English, shall utilize Imperial measurements, and shall be submitted directly to RTD electronically in the following formats, as applicable:

MS Office formats (DOC, XLS, PPT, VSD) Adobe PDF (searchable) Scanned documents consisting of signatures, etc. may be approved for submittal.