2025.01.16 DCWF PWS.pdf

USTRANSCOM DoD Cyber Workforce Framework Support Performance Work Statement (PWS)

13 December 2024

1.0. DESCRIPTION OF SERVICES

1.1. Background.

The United States Transportation Command (USTRANSCOM) mission is to provide air, land, and sea distribution for the Department of Defense (DoD) in times of peace and war.

USTRANSCOM is the single entity to direct and supervise execution of the strategic distribution system. It is the primary responsibility of USTRANSCOM to ensure the effectiveness, efficiency, and strategic alignment of distribution activities across the DoD.

This includes overseeing the following three key areas:

1. Force Projection: The movement of military personnel, equipment, and supplies to support the deployment of forces.

2. Sustainment: The ongoing logistical support of military operations, including the delivery of food, fuel, and other essential resources.

3. Redeployment/Retrograde Operations: The withdrawal and return of military forces, equipment, and supplies from a theater of operation.

To achieve these goals, USTRANSCOM is responsible for the development and establishment of the underlying concepts and operational frameworks which guide the planning and execution of DoD transportation operations. This enables the command to provide strategic direction, oversight, and coordination of transportation activities; ensuring that they are aligned with the DoD's overall objectives and priorities.

To improve the overall efficiency and interoperability of distribution, USTRANSCOM must transform the DoD’s end-to-end global supply chain management and distribution processes.

This involves working with all national partners such as the Office of the Secretary of Defense (OSD), the Services, Combatant Commanders, Agencies, and commercial partners.

This requires a highly effective Command, Control, Communications, and Computer (C4) Systems infrastructure and workforce that has the knowledge, skills, and abilities to optimize the C4 processes to support an end-to-end distribution perspective. To accomplish this task, the USTRANSCOM Command, Control, Communications, and Cyber Systems Directorate (TCJ6) must manage both the functional and technical support programs/projects to enhance the overall C4 program and processes. This task consists of support activities relating to the management of this effort.

1.2. Scope.

The scope of the DoD Cyberspace Workforce Framework (DCWF) requirement is to provide program management support for the administration, monitoring, and tracking of progress for all DCWF requirements and any subsequent guidance released under the DoD Manual (DoDM) 8140.03 and the DCWF program.

1.3. Task Areas.

1.3.1. Task Area 1: DoDM 8140.03 and DCWF Support – The contractor shall support the administration, monitoring, and tracking of progress for all DCWF requirements and any subsequent guidance released under the DoDM 8140.03 program. The contractor shall provide oversight and management of the DoDM 8140.03 program and report on the status of ongoing issues to the USTRANSCOM Program Manager and the Contracting Officer Representative (COR). The contractor shall continue to monitor and track progress in the fulfillment of USTRANSCOM requirements associated with DoD 8570.01-M, Information Assurance Workforce Improvement Program (IAWIP), until full implementation of DoDM 8140.03 and the DCWF is achieved by the DoD Chief Information Office (CIO).

Responsibilities shall include:

1.3.1.1. Attend required planning, status, and development meetings, as scheduled, for related programs in the scope of responsibilities and provide meeting minutes within three business days after the meeting.

1.3.1.2. Assist in the identification and development of processes, standards, requirements, and automation and/or improvements, as required.

1.3.1.3. Identify, analyze, request, manage, update, verify, and compile program packages and documentation as required for program certification and/or qualification compliance.

1.3.1.4. Develop and maintain a method for tracking and reporting program metrics as needed.

1.3.1.5. Assist in review, analysis, development, and updates to briefings, guidance, and policy, to include but not limited to: program overviews, USTRANSCOM Instruction (USTCI) 6600.01 - Policy for Cyberspace Workforce Management, USTCI 6600.06 - Policy for Systems Security Awareness Program, or others as identified by the J6-XS Command Cyber Program Manager.

1.3.1.6. Provide assistance to Cyber Workforce Program Manager in the maintenance, analysis, and support of DoD and USTRANSCOM Cyber Workforce Management policy statistics, information, or other requested data, documentation, or information to USTRANSCOM TCJ6, to include: the Chief Information Security Officer (CISO), J6-X Division Chief, J6-XS Branch Chief, the J6-XS Command Cyber Program Manager, or others as directed to support Federal Information Security Management Act (FISMA) or DOD and USTRANSCOM compliance and/or reporting requirements.

1.3.1.7. Assist in analyzing and providing information on program qualification, continuing education, or other programmatic standards as required.

1.3.1.8. Create, collect, administer, collate, resolve, manage, and maintain records.

1.3.1.9. Compile, analyze, and report DCWF position coding data, validation, or revalidation of positional or personnel requirements for USTRANSCOM and Component Commands as required.

1.3.1.10. Provide guidance to the Government in all other administration, notifications, maintenance, and functions of the DoDM 8140 and the DCWF as required.

1.3.1.11. Compare, compile, and report on the USTRANSCOM monthly Privileged User List against DCWF packages for compliance.

1.3.1.12. Document services provided for USTRANSCOM programs in a Monthly Status Report (MSR), including recommendations for improvement or incorporating best practices. This report shall be delivered to the Government Program Manager and the COR. Information shall be sufficiently detailed to allow the Government to evaluate contract compliance, contribution to USTRANSCOM mission, and to effectively assess/mitigate risk. The DoDM 8140.03 Program and DCWF MSR shall be delivered by the 5th business day of the month to the J6-X Division Chief, Chief Information Security Officer (CISO), J6-XS Branch Chief, J6-XS Command Cyber Program Manager, the COR and others as directed.

1.3.1.13. Deliver the quarterly Personnel Certification Report on the 10th business day of the month after the start of a new quarter to the J6-XS Command Cyber Program Manager or others as directed.

1.3.1.14. In the absence of the J6-XS Cyber Program Manager, the contractor shall verify annual DoD Cyber Awareness Challenge completion for USTRANSCOM personnel and authorize the Service Desk to reactivate disabled accounts upon verification of completed training in coordination with USTRANSCOM Directorate Training Coordinators (DTCs).

The contractor shall not direct the disabling of any user accounts.

1.4. Deliverable Schedule.

All deliverables shall be submitted directly to the COR. Deliverables shall be identified by Contract and or Delivery Order Number, PWS subtask number, and deliverable title. All deliverables shall meet professional standards and comply with the requirements set forth in this PWS. The contractor shall provide all deliverables electronically in Microsoft Office (Word, Excel, Power Point, Project, etc.) formats pursuant to the following schedule.

PWS

Task DELIVERABLE SCHEDULE

1.3.1.1. Minutes or Documentation of

Planning 3 business days after the meeting.

1.3.1.9.

1.3.1.10.

DCWF Coding/Validation Support 5th Business Day of the Month

1.3.1.11. Privileged User Compliance 5th Business Day of the Month

1.3.1.12.

DoDM 8140.03 Program and DCWF Monthly Status Report

(MSR)

5th Business Day of the Month

1.3.1.13. Quarterly Personnel Certification

Report

10th Business Day after the start of a new quarter.

1.5. Service Delivery Summary.

The Service Delivery Summary (SDS) represents the most important contract objectives that when met, ensure contract performance is satisfactory. Although not all PWS requirements are listed in the SDS, the contractor is fully expected to comply with all requirements in the

PWS.

PERFORMANCE

OBJECITVE PWS PARAGRAPH PERFORMANCE THRESHOLD

DoDM 8140.03 program and DCWF Monthly Status Report (MSR)

1.3.1.12 No more than one (1) late report in a twelve (12) month period and maintain a 95% accuracy each month.

Quarterly Personnel Certification Report 1.3.1.13

No more than one (1) late report per year and maintain a 95% accuracy each quarter.

Cyber-Incident Reporting 7.16.2 No more than one (1) late cyber-incident report or unreported cyber-incident in a twelve (12) month period.

2.0. GOVERNMENT- FURNISHED EQUIPMENT/INFORMATION (GFE) (GFI)

The Government will make available at a minimum two office spaces, furniture, telephone services, office supplies, and materials for contractor personnel required to work on-site at the Government facility. The Government will furnish appropriate user identification cards and passwords for shared resources. Multiple sources of data are required throughout the terms of this PWS and shall be provided by the Government in a timely manner.

3.0. CONTRACTOR MANPOWER REPORTING

As required and when directed by the Contracting Officer (CO) in writing, the contractor shall report all direct contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract via a secure data collection site.

Reporting inputs shall be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30.

4.0. POTENTIAL CONFLICT OF INTEREST (COI)

4.1. Definitions and Restrictions.

The following definitions and restrictions apply to prevent conflicting roles which may bias the contractor's judgment or objectivity, or to preclude the contractor from obtaining an unfair competitive advantage in concurrent or future acquisitions.

4.2. Descriptions or Definitions.

4.2.1. “Contractor” means the business entity receiving the award of this contract, its parents, affiliates, divisions and subsidiaries, and subcontractors.

4.2.2. "Development" means all efforts towards the solution of broadly defined problems.

This may encompass research, evaluating technical feasibility, proof of design and test, or engineering of programs not yet approved for acquisition or operation.

4.2.3. "Proprietary Information" means all information designated as proprietary in accordance with law and regulation and held in confidence or disclosed under restriction to prevent uncontrolled distribution. Examples include limited or restricted data, trade secrets, sensitive financial information, and computer software; and may appear in cost and pricing data or involve classified information.

4.2.4. “Systems" means the major acquisition programs that are maintained and managed by the Program Management Office (PMO) or USTRANSCOM Components.

4.2.5. “System Life" means all phases of the system's development, production, or support.

4.2.6. "System Engineering" means preparing specifications, identifying and resolving interface problems, developing test requirements, evaluating test data, and supervising design.

4.2.7. “Technical Direction" means developing work statements, determining parameters, directing other contractors' operations, or resolving technical controversies.

4.3. Restrictions.

Contractors and subcontractors who are involved in the support of products or capabilities may be susceptible to unequal access to information, biased ground rules, or impaired objectivity, which could present them with an immitigable conflict of interest and prevent future opportunities on related or follow-on contracts. In accordance with FAR 9.505, the Government has the obligation to conduct Office of Criminal Investigations (OCI) investigations and require as necessary, in sole discretion of the Government, OCI mitigation plans for review. As a result, the Government may conclude that a contractor or sub-contractor is prohibited from participating in such future opportunities.

4.3.1. The contractor may gain access to proprietary information of other companies during contract performance. The contractor agrees to enter into company-to-company agreements to (1) protect another company's information from unauthorized use or disclosure for as long as it is considered proprietary by the other company and (2) refrain from using the information for any purpose other than that for which it was furnished. For information purposes, the contractor shall furnish copies of these agreements to the CO. These agreements are not intended to protect information, which is otherwise/already available to the Government or to the contractor from other sources and furnished voluntarily without restriction.

5.0. GOVERNMENT QUALITY ASSURANCE

The Government will evaluate contractor’s performance for compliance with the requirements set forth in this PWS. The Government will monitor the contractor’s performance under this contract utilizing the Quality Assurance Surveillance Plan (QASP).

6.0. GENERAL INFORMATION

6.1. Period of Performance.

The period of performance is a base period of 1 year with four 1-year options. Exercise of the option periods will be at the sole discretion of the Government. The intended period of performance is as follows:

Base period: 1 October 2025 through 30 September 2026 First option year: 1 October 2026 through 30 September 2027 Second option year: 1 October 2027 through 30 September 2028 Third option year: 1 October 2028 through 30 September 2029 Fourth option year: 1 October 2029 through 30 September 2030

6.2. Place of Performance.

This service requirement is in support of USTRANSCOM at Scott AFB, IL. Contractor training support personnel shall be located on base in the TCJ6 area in order to provide day-to-day support to on-site and remote Government personnel. The Government has the option to require the contractor to move to an off-base contractor-provided facility to accommodate changes in space availability. The Government will notify the contractor with sufficient time to allow for contract modification.

6.2.1. Teleworking – The contractor personnel who support Task Area 1 shall be authorized to telework up to two days a week in the event of inclement weather, health concerns, or additional specific events approved by the Government staff. All telework activities must be conducted through Government provided Virtual Private Network (VPN). In performance of these duties, the contractor shall set office procedures for reporting to work, measuring and reviewing work prior to Government acceptance, and time attendance and recording. All telework shall be performed on Government issued laptops, and the contractor shall take all appropriate measures to safeguard Government information. Verification of telework capabilities and any issues encountered which prevent normal operations while teleworking shall be electronically documented and communicated to the appropriate Government staff within two business days of telework duty completion. In the event of a real world/unplanned outage, the contractor shall contact the appropriate Government staff for further instruction on telework procedures.

Additional exceptions to the telework terms can be accommodated by agreement between the Government and contractor parties for certain situations, such as individuals classified as high-risk personnel according to USTRANSCOM guidelines. The Government will furnish a Non- Classified Internet Protocol Router Network (NIPR) laptop with VPN connectivity to USTRANSCOM for telework access, which will include access to Government systems, files and email. No classified work shall be performed while teleworking. The Government will define the means of communication during telework hours.

6.3. Hours of Operation.

The contractor shall perform their duties during the Government’s normal office hours between 0730 – 1600 Central Standard Time (CST). During normal duty hours, Government personnel must be present in the facility. If Government personnel are not present, contractor personnel shall vacate Government premises. In the event of facility closure due to safety constraints (e.g., weather, facility closure, pandemic measures), contractors may work from alternate duty locations, as approved by the Government.

7.0 Security (Industrial, Personnel, Physical, Information, and Antiterrorism/Force Protection)

7.1. General Security Requirements Information/Applicability: The majority of daily work associated with this PWS/SOW is at the unclassified level, but contractor personnel may be required to access classified information/systems at the SECRET level, and/or classified areas at the SECRET level, during the performance of this contract/task order. FAR Clause 52.204-2, Security Requirements, applies to the extent of this contract/task order involving access to information, areas, or material classified “CONFIDENTIAL” or “SECRET”.

Specific security protocols for contracted companies are outlined in 32 CFR Part 117, National Industrial Security Program Operating Manual (NISPOM), identified in this section of the PWS/SOW, and the DD Form 254 (DoD Contractor Security Classification Specification). A completed/signed DD Form 254 will be attached to the contract/task order.

7.2. Citizenship and Clearance Requirements: The contractor’s, subcontractors, and/or partner’s personnel performing services under this contract/task order shall be citizens of the United States of America. Overall, all contractor personnel shall possess the appropriate personnel security investigation for the position(s) occupied. Contractor personnel shall be required to have a background investigation that corresponds with the sensitivity level of the tasks to be performed. Non-US citizens are not eligible for Common Access Cards (CACs) unless they meet the parameters stated in Department of Defense Manual (DoDM) 1000.13, Volume 1. All personnel that will have Information Technology (IT)/Automated Data Processing (ADP) privileged access (i.e. Privileged Users) to US Information Systems (IS), and/or classified information, classified systems, or classified areas, shall be US citizens. Foreign Nationals or Local Nationals employed by the DoD are not authorized to have privileged access to US Information Systems.

7.3. Information Systems (IS) Roles/Categories and Associated Suitability Requirements (Federal Investigative Standards): Some positions performing services in support of this requirement may require IT/ADP privileged access. The IS roles/categories and the number of personnel assigned to each role is approved by the COR or the CO before the start of the contract/task order. The contractor shall comply with the appropriate provisions of applicable security regulations while assigned to this contract/task order for DOD and USTRANSCOM. The following guidance will be followed when determining background investigation levels for this contract/task order depending on requirements:

IS Role/Category Classified Access Required Investigation

General User (Non-Privileged Access) NO Tier 1 (T1) General User (Non-Privileged Access) YES Tier 3 (T3)

Privileged User (e.g. System Administrator) NO Tier 5 (T5) Privileged User YES Tier 5 (T5)

NOTE1: USTRANSCOM Joint Security Office (TCCS-S) will initiate/administer Tier 1 investigations to determine CAC eligibility only, classified access will not be granted based on the Tier 1 investigation. Tier 3 and Tier 5 investigations are the responsibility of the contractor. It is incumbent upon the contractor to have the appropriate investigations completed upon the start of the contract/task order.

POSITION LEVEL:

Information Technology (IT)-II Automated Data Processing (ADP)-II Or Non-Critical Sensitive Positions (SECRET):

IT/ADP-II and Non-Critical Sensitive Positions are those positions that:

have access to Secret or Confidential information; Security police/provost marshal-type duties involving the enforcement of law and security duties involving the protection and safeguarding of DoD personnel and property; category II automated data processing positions; duties involving education and orientation of DoD personnel; duties involving the design, operation, or maintenance of intrusion detection systems deployed to safeguard DoD personnel and property;

responsible for the direction, planning, design, operation, or maintenance of a computer system, and whose work is technically reviewed by a higher authority of the ADP-I category to ensure the integrity of the system; and any other position so designated by the head of the Component or designee.

BACKGROUND INVESTIGATION REQUIREMENTS:

(IT-II/ADP-II/Non-Critical Sensitive) Requirements for SECRET – (Tier 3):

Positions designated by the Government at the Non-Critical Sensitive/ADP-II/IT-II rating require a Tier 3 (or acceptable periodic reinvestigation) favorably adjudicated (a favorable adjudication grants eligibility at the SECRET level as prescribed by DoDM 5200.02). The IT- II/ADP-II requirement mandates the contractor have a minimum Facilities Clearance Level at the SECRET (or higher) level, to include interim clearances, due to investigation submissions as directed in DoD 5220.22-M Operating Manual, DoDM 5200.01 and Defense Information Security System (DISS).

POSITION LEVEL:

Information Technology (IT)-III Automated Data Processing (ADP)-III Or Non-Sensitive Positions (Position of Trust Determination) (No Classified Access–Tier 1) All other positions involved in computer activities and CAC. No clearance is granted for classified access and only a Position of Trust (PoT) is awarded and posted in DISS.

BACKGROUND INVESTIGATION REQUIREMENTS:

(Non-Sensitive/IT-III/ADP-III) Requirements for Position of Trust Determinations (No Classified Access - Tier 1/NACI):

Positions designated by the Government as Non-Sensitive/IT-III/ADP-III require a favorably adjudicated Tier 1/NACI investigation or greater IAW DoDI 5200.46, DoD Investigative and Adjudicative Guidance for Issuing the Common Access Card (CAC), dated 9 Sep 2014, DoDM 1000.13, Vol 1, DoD Identification (ID) Cards: ID Card Lifecycle, dated 23 Jan 2014. Before a CAC or NIPRNet access will be granted, a favorable Tier 1/NACI investigation or greater must be on record in DISS, and a favorable Federal Bureau of Investigation (FBI) National Criminal History Check (fingerprint check) on record with the Defense Counterintelligence and Security Agency (DCSA). A CAC may be issued on an interim basis based on a favorable FBI fingerprint check and successful submission of a Tier 1 investigation to DCSA, and on record in

DISS.

NOTE: The above requirements for Non-Sensitive/IT-III/ADP-III positions are for unclassified access and systems only. No classified access will be granted based on the Tier 1 investigation.

USTRANSCOM will only process Tier 1 investigations and will not complete any personnel security investigations (Tier 3/Tier 5) for classified access. It is incumbent upon the contractor to have the appropriate investigations completed upon start of the contract.

7.4. Security Clearance and Special Access Requirements: All positions on this contract/task order, require a minimum of either an interim SECRET granted by the Defense Counterintelligence and Security Agency (DCSA) Adjudication & Vetting Services (AVS), or a completed adjudication of SECRET granted by the DCSA AVS.

7.5. Facilities Clearance (FCL): The contractor must have a valid FCL at the SECRET level.

FCL procedures and security guidelines for adjudicative requirements are outlined in 32 CFR, Part 117. FCLs must be awarded by the Defense Counterintelligence and Security Agency (DCSA) Facility Clearance Branch.

7.6. Personnel and Facilities Clearance Validation: Upon contract/task order award, the USTRANSCOM contracting team will send TCCS-S the contractor cage code for FCL verification via the National Industrial Security System (NISS). The contractor will submit names of the contractor personnel performing on the contract/task order to the USTRANSCOM contracting team, who will provide to TCCS-S for vetting through the DoD personnel security system of record to ensure investigative and clearance requirements have been satisfied. This shall be completed before the COR/Mission Partner Affiliation Sponsor (MPAS) accesses the Mission Partner Identity, Credential, and Access Management (MP ICAM) system and creates CAC applications for contractor personnel. If a contractor’s employee does not have the required investigative or security clearance level based on the Government’s determination, the contractor’s employee will be denied the ability to work in support of this contract/task order.

7.7. Common Access Card (CAC) Issuance Procedures:

a) Facility Security Officer (FSO) will verify, via the DOD personnel security system of record, contractors on the contract/task order have the required background investigation to obtain a CAC and provide those names to the CO/COR. Contractors that require a Tier 3 and Tier 5 investigation are the responsibility of the contractor.

Contractors that only require a Tier 1 as determined by the FSO will submit to the TCCS-S Personnel Security Program Manager (through the CO or COR) an OF Form 306 (Declaration for Federal Employment) and a MP ICAM Form 1 with Section 1 completed. TCCS-S will initiate the SF-85 (questionnaire for Non-Sensitive Positions) via the National Background Investigation Services (NBIS) for completion and submission to DCSA, for Tier 1 investigations only.

b) At the same time, the contractor company will coordinate and obtain electronic fingerprinting for their employee. The third-party company will “electronically” capture the applicant’s fingerprints, using the USTRANSCOM (Submitting Office (SON), Security Office (SOI), and Agency Location Code (ALC)). Hardcopy fingerprint cards are NOT acceptable. These steps shall be completed before the COR/MPAS accesses MP ICAM to create a CAC application.

c) Basic US Citizen Contractor CAC Requirements:

1. Requires access on a continual basis of 6 months or more.

2. Contractor personnel require access to a DoD facility or networks, either on-site or from a remote location.

3. Users need access to systems for platforms that requires CAC login or user authentication.

d) Basic Non-US Citizen Contractor CAC Requirements:

1. Meet (as direct/indirect DoD hire personnel) the investigative requirements for DoD employment as recognized through international agreements pursuant to DoDI 1400.25, Civilian Personnel Management, Volume 1231. In addition to these investigative requirements, a fingerprint check against the FBI criminal history database, an FBI investigations files (name check search), and a name check against the Terrorist Screening Database shall be required prior to CAC issuance IAW Office of Personnel Management Memorandum, “Final Credentialing Standards for Issuing Personal Identity Verification Cards under HSPD-12”, July 31, 2008.

2. Possess (as foreign military, employee, or contract support personnel), a visit status and security assurance that has been confirmed, documented, and processed IAW international agreements pursuant to DoDI 1400.25, Civilian Personnel Management.

e) CAC Applications:

1. The CAC applications (MP ICAM Form 1 with Section 1 completed) must have an adjudication Tier 1, Tier 3, or Tier 5 background investigation posted in the DoD personnel security system of record, or

2. An interim CAC may be approved when the contractor employee has a favorable fingerprint, name and criminal records check completed and has either a Tier 1, Tier 3, or Tier 5 background check “open” with DCSA.

3. The MP ICAM MPAS will not approve the CAC applications in MP ICAM until that MPAS has verified, with a member of USTRANSCOM TCCS-S, one of the above requirements.

7.8. Access to Scott Air Force Base or USTRANSCOM Facilities: Upon receipt of the CAC, permanently assigned contractor personnel located at USTRANSCOM at Scott AFB (SAFB), IL, may obtain a USTRANSCOM Facility Access Badge if the employee will be assigned physically on SAFB in a USTRANSCOM-owned or managed facility, has a valid Visit Access Request on file, and attends Initial Security Training (IST) on-site. The Government will provide unrestricted access to facilities, consistent with security clearance eligibility and need-to-know, necessary for the on-site personnel to perform their work IAW the contract/task order. Contractor personnel assigned on-site at USTRANSCOM will wear and display the USTRANSCOM Facility Access Badge at all times while in USTRANSCOM facilities. Visits to SAFB by contractor personnel who do not possess the CAC will be facilitated by the COR/CO sponsoring the employee through the online base access system.

7.9. Visits by Non-Assigned Contractors to USTRANSCOM/SDDC Buildings: Any visit(s) by contractor personnel not permanently assigned to this contract/task order (i.e., company presidents, company security managers, contractor personnel not permanently assigned at SAFB, etc.) require an electronic visit access request be submitted using the DoD personnel security system of record. The DoD personnel security system of record visits can be forwarded to the Security Management Office (SMO) code: USTC-S-USTC-SDDC-1. The visit access request shall annotate the contract/task order number in the POC block of the visit access request and the name/phone number of either the functional, COR or CO in the phone number block.

7.10. Visits by Permanently Assigned Contractors: Permanently assigned contractor employees on SAFB will require a visit access request for the current Period of Performance (PoP) posted in the DoD personnel security system of record to SMO: USTC- S-USTC-SDDC-1. The visit access request will annotate the contract number in the POC block of the visit access request and the name/phone number of either the functional, COR or CO in the phone number block.

7.11. Supplemental Notes Regarding Visit Information in the DoD Personnel Security System of Record: Personnel requiring access to Government facilities will properly complete the “Visit Information” block in the DoD personnel security system of record.

Otherwise, contractor employees will be denied access to the facility and classified and/or sensitive information. Also, prime contractors will annotate their contract number and subcontractors will provide the name of their Company, with the prime contract number they are assigned to by the Prime, in the “additional information” block of the Visit table.

A valid “Reason for the Visit” must be stated and the “visit access” must not exceed that of the contract.

7.12. Security and Emergency Operations Training: Contractor personnel physically assigned at USTRANSCOM at SAFB shall attend/complete the following training as prescribed by DoD, USTRANSCOM and Air Force Instructions: Initial Security, Workplace Violence, Annual Security Awareness, Operations Security (OPSEC), DOD Antiterrorism Level I, Active Shooter/Attacker, Emergency Operations, Combating Trafficking in Person (CTIP), Controlled Unclassified Information (CUI), Derivative Classification, and any Security Stand-down Day Training scheduled by the Commander, USTRANSCOM. Contractor personnel assigned elsewhere shall attend security training established by their respective Government security offices and/or installations.

7.13. Additional Security Conditions: All contractors assigned to USTRANSCOM on SAFB will complete the contractor in-processing before the start of work on this or any contract/task order in USTRANSCOM. Contractors starting work on a new contract/task order will report to the Joint Security Desk, located in Building 1900 first-floor breezeway.

In-processing includes the following:

• Verification of personal identification

• Verification of Visit Access Request in the DoD personnel security system of record

• Verification of the contractor’s Security Clearance Eligibility in the DoD personnel security system of record

• Brief and sign the individual SF-312 (Security Agreement)

• Complete North Atlantic Treaty Organization (NATO) Indoctrination

• Review of Facility access requirements

• Issuance of a Temporary USTRANSCOM Facility Access Badge for the facility

• Creation of a personnel security file

7.14. Derogatory Information: Any member of the contracted company team (Program Manager, FSO, or other supervisory staff) aware of pending human resource activity of consequence (to include termination or suspension), behaviors or patterns of concern, or misconduct, to include reporting requirements in accordance with Security Executive Agent Directive (SEAD) 3 (for contractors with classified security eligibility), for any contractors supporting this contract/task order during the established period of performance, will immediately contact the USTRANSCOM Joint Security Office (TCCS-S) Attn: Industrial Security Program Manager. If the Government notifies the contractor that the employment or the continued employment of any contractor personnel is prejudicial to the interests or endangers the security of the United States of America and/or USTRANSCOM personnel, information, or assets; that employee shall be removed and barred from the worksite. This includes security deviations / incidents and credible derogatory information on contractor personnel as noted in the DoD personnel security system of record. Personnel who have incident reports posted in the DoD personnel security system of record will be denied the ability to support the contract/task order until the issues have been resolved and the incident has been removed in the DoD personnel security system of record. The contractor shall make any changes necessary in the appointment(s), at no additional cost to the Government.

If any incident involves or may involve the mishandling of classified information or a potential Negligent Discharge of Classified Information, the USTRANSCOM Joint Security Office Attn: Industrial Security Program Manager, will be notified within 24 hours during the normal work week and within 72 hours if the incident occurs over the weekend.

7.15. Accessing NATO Information: No contractor employee will access NATO information without first being indoctrinated on NATO and having that access recorded in the DoD personnel security system of record. Any NATO information accessed will be only on SIPRNet. Senders of NATO information will ensure the receiving network is accredited and the receiving point is a Sub-Registry or authorized Control Point. No NATO information will be stored with US classified information. Access to NATO information will be based on need-to-know, appropriate access level, and training. NATO information will not be disseminated to unauthorized users. NATO information will not be printed unless authorized by a USTRANSCOM NATO – Sub-Registry person in TCCS-S. All printed NATO classified information must be strictly controlled and tracked in a NATO registry. Contact the USTRANSCOM Sub-Registry for additional control measures. In accordance with 32 CFR, part 117, NATO briefed personnel will be re-briefed on an annual basis. USTRANSCOM will indoctrinate all on-site contractor employees and document in the DoD personnel security system of record. Contractor personnel assigned to USTRANSCOM facilities will be NATO briefed and debriefed by USTRANSCOM, with appropriate annotations to the DoD personnel security system of record. Company FSOs may take responsibility for all NATO refresher briefings per 32 CFR, part 117 and record the date of the annual briefings in the contractor employee’s records.

7.16. Security Debriefing: Contractor personnel physically working at USTRANSCOM at

SAFB, IL, shall complete out-processing on the last day of the contract/task order or upon termination or reassignment from duties under the current contract/task order. The following closeout tasks will be completed, before the contractor departs:

• Review of the contractor’s personnel security folder

• Review and debrief the contractor’s SF-312

• Debrief anyone with NATO Access

• Update and annotate the DoD personnel security system of record reflecting the current status of the contractor at USTRANSCOM

• Surrender CAC (with copy of the revocation notice from the COR or MPAS), for those off-site CACs will be physically mailed to TCCS-S for collection and turned into Scott AFB ID office for DMDC inventory and destruction.

• Surrender the USTRANSCOM Facility Access Badge to the Joint Security Desk

• Contractor personnel shall have surrendered all Government supplies, materials, and equipment to the COR.

7.17. Antiterrorism/Force Protection: Contractor employees will comply with antiterrorism Force Protection conditions (FPCONs) at the location they are performing work, whether it is CONUS or OCONUS.

7.18. NOTE TO THE PRIME CONTRACTOR FACILITY SECURITY OFFICER (FSO):

The prime contractor will forward the name, address, email address and telephone number of the Company FSO and backup to the USTRANSCOM Joint Security Office (TCCS-S) at: transcom.scott.tccs.mbx.industrial-security@mail.mil

7.19. USTRANSCOM Joint Security Office (Industrial Security) POCs:

USTRANSCOM

Attn: TCCS-S (Industrial Security Specialist) 508 Scott Drive Scott AFB, IL 62225 Commercial: 618-817-4078

7.20. USTRANSCOM TCCS-S Approval:

Andrew Daub, Chief, USTRANSCOM Joint Security Office

7.21. USTRANSCOM TCCS-S Tracking #: TCCS-S-XXX-YYYY

mailto:transcom.scott.tccs.mbx.industrial-security@mail.mil

References

Defense Electronic Libraries:

• Acquisition Notes: http://acqnotes.com

• Assist – Quick Search: http://quicksearch.dla.mil

• Official Website of the Joint Chiefs of Staff (JCS): https://www.jcs.mil/

• Defense Acquisition University (DAU): https://www.dau.mil

• Department of Defense: http://www.esd.whs.mil/dd/dod-issuances/

• Federal Registry: https://www.federalregister.gov/

• Joint Electronic Library: https://www.jcs.mil/Doctrine/

• USTRANSCOM: https://ww2.ustranscom.mil/FP_2018/fp_index.cfm

• Security Regulation Guidance:

http://www.dtic.mil/whs/directives/corres/pub1.html

• Federal Information Processing Standards (FIPS) and National Institute of

Standards and Technology (NIST): https://csrc.nist.gov/publications

• Military Standards (MIL-STD): https://www.dau.mil/

• Committee on National Security Systems (CNSS):

https://www.cnss.gov/CNSS/issuances/Instructions.cm

• Institute of Electrical and Electronics Engineers (IEEE) Publications:

https://www.ieee.org/publications_standards/index.html

Governing Guidance and Directives:

• American National Standards Institute (ANSI)/Electronic Industries Alliance (EIA) 748:

Earned Value Management, current edition

• CJCS Instruction 5123.01H, Charter of the Joint Requirements Oversight Council (JROC) and Implementation of the Joint Capabilities Integration and Development Systems (JCIDS), August 31, 2018

• CJCS Instruction 6510.01F, Information Assurance (IA) and Support to Computer Network Defense (CND), June 9, 2015

• CJCSM 3213.02D, Joint Staff Alternative Compensatory Control Measures (ACCM) Program Management Manual (Limited Distribution)

• CJCSM 6510.01B, Cyber Incident Handling Program, 10 July 2012

• Data Item Management-81861, Data Item Description: Integrated Program Management

Report (IPMR), June 20, 2012

• DD Form 254, Contract Security Classification Specification, November 1, 2017

• Defense Federal Acquisition Regulation Supplement, current edition

• DoD 5200.08, Security of DoD Installations and Resources and the DoD Physical Security

Review Board (PSRB), Change 3, November 20, 2015

• DoD Instruction 5220.22, National Industrial Security Program, May 1, 2018 http://acqnotes.com/ http://quicksearch.dla.mil/ http://www.jcs.mil/ https://www.dau.mil/ http://www.esd.whs.mil/dd/dod-issuances/ https://www.federalregister.gov/ http://www.jcs.mil/Doctrine/ https://ww2.ustranscom.mil/FP_2018/fp_index.cfm http://www.dtic.mil/whs/directives/corres/pub1.html https://csrc.nist.gov/publications https://www.dau.mil/ https://www.cnss.gov/CNSS/issuances/Instructions.cm https://www.ieee.org/publications_standards/index.html

• DoDM 6025.18, Implementation of The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule in DoD Health Care Programs, March 13, 2019

• DoD Instruction 8500.01, Cybersecurity, Change 1, October 7, 2019

• DoD Instruction, 8510.01, Risk Management Framework (RMF) for DoD Information

Technology (IT), Change 2, July 28, 2017

• DoD Directive 5230.25, Withholding of Unclassified Technical Data from Public

Disclosure, December 28, 2016

• DoD Instruction 8320.02, Data Sharing, in a Net Centric Department of Defense, August

5, 2013

• DoD Instruction 1100.22, Policy and Procedures for Determining Workforce Mix, Change 1, December 1, 2017

• DoD Instruction 2000.12, DoD Antiterrorism (AT) Program, Change 3, May 8, 2017

• DoD Instruction O-2000.16, DoD Antiterrorism (AT) Program Implementation: DoD AT

Standards, Volume 1, Change 2, November 20, 2019

• DoD Instruction O-2000.16, DoD Antiterrorism (AT) Program Implementation: DoD Force

Protection Condition (FPCON) System Volume 2, May 8, 2017

• DoD Instruction 5025.13, DoD Plain Language Program, January 23, 2020

• DoD Instruction 5200.02, “Personnel Security Program,” September 9, 2014

• DoD Instruction 8330.01, “Interoperability of Information Technology (IT), Including

National Security Systems (NSS),” December 18, 2017

• DoD Instruction 8500.01, “Cybersecurity,” March 14, 2014

• DoD Instruction 8510.01, “Risk Management Framework (RMF) for DoD Information

Technology (IT),” July 28, 2017

• DoD Instruction 8520.02, “Public Key Infrastructure (PKI) and Public Key (PK)

Enabling,” May 24, 2011

• DoD Instruction 8551.01, “Ports, Protocols, and Services Management (PPSM)”, July 27, 2017

• DoD Instruction 8582.01, “Security of Unclassified DoD Information on Non-DoD

Information Systems,” October 27, 2017

• DoD Manual 1000.13, Volume 1, “DoD Identification (ID) Cards: ID Card Life-

Cycle,” January 23, 2014

• DoD Manual 5200.01, Volume 1, “DoD Information Security Program: Overview, Classification, and Declassification,” February 24, 2012

• DoD Manual 5200.01 Volume 2, “DoD Information Security Program: Marking of

Classified Information,” March 19, 2013

• DoD Manual 5200.01 Volume 3, “DoD Information Security Program: Protection of

Classified Information,” March 19, 2013

• DoDI 5200.48, “Controlled Unclassified Information,” 6 March 2020

• DoD 5200.08-R, Change-1, DoD Physical Security Program, May 27, 2009

• DFARS 252.205-7012, Safeguarding Covered Defense Information and Cyber Incident

Reporting

• DoD Manual 5200.02, “Procedures for the DoD Personnel Security Program (PSP),”

April 3, 2017

• DoD Manual 5220.22, Volume 3, “National Industrial Security Program: Procedures for

Government Activities Relating to Foreign Ownership, Control, or Influence (FOCI),” April 17, 2014

• DoD Standard MIL-STD-881C, “Work Breakdown Structures (WBS) for Defense Materiel Items,” October 3, 2011

• FD Form 258, Fingerprint Card

• Office of Management and Budget Circular A-11, “Preparing, Submitting, and Executing the Budget,” current edition

• USTRANSCOM Instruction 31-02, “Security Classification Guide,” April 6, 2018

• USTRANSCOM Instruction 5200.08, “Policy for Operations Security,” June 18, 2021

• USTRANSCOM Instruction 33-1, “Information Systems Security Education, Training, and Awareness Program,” March 27, 2017

• USTRANSCOM Instruction 33-48, “Data Management Policy and Responsibilities,”

February 16, 2016

• USTRANSCOM Instruction 6600.01, “Cyber Workforce Management,” March 31, 2021

• Scott Air Force Base: AF Instruction 31-101_AMC, January 4, 2014

• FIPS 199, “Standards for Security Categorization of Federal Information and Information

Systems,” February 2004

• FIPS 200, “Minimum Security Requirements for Federal Information and Information

Systems,” March 2006

• NIST SP 800-18 Revision 1, “Guide for Developing Security Plans for Federal

Information Systems” February 2006

• NIST SP 800-30 Revision 1, “Guide for Conducting Risk Assessments,” September 2012

• NIST SP 800-37 Revision 2, “Risk Management Framework for Information Systems and

Organizations: A System Life Cycle Approach for Security and Privacy,” June 5, 2014

• NIST SP 800-53, Revision 4, “Security and Privacy Controls for Federal Information

Systems and Organizations,” January 22, 2015

• NIST SP 800-53A Revision 4, “Assessing Security and Privacy Controls in Federal

Information Systems and Organizations: Building Effective Assessment Plans,” December 18, 2014

• NIST SP 800-60 Volume 1, Revision 1, “Guide for Mapping Types of Information and Information Systems to Security Categories,” August 2008

• NIST SP 800-61 Revision 2, “Computer Security Incident Handling Guide,” August

• CNSS Instruction 1253, “Security Categorization and Control Selection for National Security Systems,” March 27, 2014

• 12207.0-1996 IEEE/EIA Standard Industry Implementation of International Standard ISO/IEC 12207: 1995 (ISO/IEC 12207) Standard for Information Technology Software Life Cycle Processes. Superseded by: 12207-2008 – Standard for Information Technology

– Software Life Cycle Processes

• 12207.1-1997 - Industry implementation of International Standard ISO/IEC 12207: 1995.

(ISO/IEC 12207) Standard FOR Information Technology - Software Life Cycle Processes

- Life Cycle Data superseded by: 15289-2017: 15289-2017 - ISO/IEC/IEEE Draft International Standard - Systems and software engineering -- Content of life-cycle information items (documentation)

• Executive Order (E.O.) 13691 of February 13, 2015. Promoting Private Sector Cybersecurity Information Sharing

7.22. Cybersecurity.

7.22.1. Operationally Critical Support – The services designated under this contract are “operationally critical support” as defined in DFARS 252.204-7012.

7.22.2. Cybersecurity Incident Reporting

7.22.2.1. In addition to the DFARS 252.204-7012 reporting requirements for unclassified systems and DoD Manual (DoDM) 5220.22, National Industrial Security Program Operating Manual (NISPOM) for classified systems, reportable cyber-incidents include, but are not limited to, the following:

Unauthorized data exfiltration, manipulation or disclosure of any DoD information resident on or transiting the contractor's (or its subcontractors') unclassified or classified information systems or networks.

Unauthorized access to the contractor’s (or its subcontractors’) unclassified or classified information system(s) or networks(s) on which DoD information is resident or transiting.

Cyber-incidents as listed in the MITRE ATT&CK Framework available at https://attack.mitre.org/, incorporated herein by reference, which affect network or information systems where DoD information is resident or transiting.

Notifications by a federal, state, or local law enforcement agency or cyber-center (i.e., National Cyber Investigative Joint Task Force (NCIJTF), National Cybersecurity & Communications Integration Center (NCCIC)) of being a victim of a successful or unsuccessful cyber-event, anomaly, incident, insider threat, breach, intrusion, or exfiltration.

If the cyber-incident affects a classified system, vulnerabilities associated with the incident will be classified per the current version of USTRANSCOM Instruction 31-02, Security Classification Guide.

7.22.3. Cybersecurity Incident Reporting Timelines – In addition to providing the notification required by DFARS 252.204-7012, the contractor is required to notify USTRANSCOM as soon as practicable, but no later than 4 hours after discovering a reportable cyber-incident. The reporting timeline begins when the incident is discovered or reported to the company, its employees, contractors, or cybersecurity firm responsible for providing cybersecurity and response for the company. The contractor shall contact the USTRANSCOM Cyber Operations Center (CyOC) via phone at (618) 817-4222. If the contractor does not immediately reach the CyOC via phone, the contractor shall send an email notification to ttranscom.scott.tcj6.mbx.cyoc-dodin-operations@mail.mil.

7.22.4. Mandatory Reporting Data

7.22.4.1. The contractor shall work with the USTRANSCOM CyOC through resolution of the incident. Within 4 hours of becoming aware of a reportable cyber-incident, the contractor shall provide an initial notification of the incident, even if some details are not yet available, which includes, but is not limited to, the following information:

7.22.4.1.1. Company Name

7.22.4.1.2. Who will be the POC with contact information

7.22.4.1.3. Contracting Officer POC (name, telephone, email)

7.22.4.1.4. Overall Assessment –Description of incident, data at risk, mitigations applied

7.22.4.1.5. Indicators of compromise

7.22.4.1.6. Vector of attack (if known)

7.22.4.1.7. Estimated time of attack (if known)

7.22.4.2. The contractor shall provide a follow-on cyber-incident report to the USTRANSCOM CyOC within 24 hours of becoming aware of a reportable cyber-incident, which includes, but is not limited to, the following information:

7.22.4.2.1. Contractor unique Commercial and Government Entity (CAGE) code

7.22.4.2.2. Contract numbers affected

7.22.4.2.3. Facility CAGE code where the incident occurred if different than the prime contractor location

7.22.4.2.4. POC if different than the POC recorded in the System for Award Management (name, address, position, telephone, email)

7.22.4.2.5. Contracting Officer POC (name, telephone, email)

7.22.4.2.6. Contract clearance level

7.22.4.2.7. Name of subcontractor and CAGE (if applicable) code if incident occurred on a subcontractor network

7.22.4.2.8. DoD programs, platforms, systems, or information involved

7.22.4.2.9. Location(s) of compromise

7.22.4.2.10. Date incident discovered

7.22.4.2.11. Type of compromise (e.g., unauthorized access, inadvertent release, other)

7.22.4.2.12. Description of technical information compromised

7.22.4.2.13. Any additional information relevant to the information compromise

7.22.5. Incident Reporting Coordination

7.22.5.1. In the event of a cyber-incident, USTRANSCOM may conduct an…