2025.07.10 Blended Additive Fuel Study SOO.pdf

Blended Additive Fuel Study

Statement of Objectives

United States Transportation Command (USTRANSCOM)

10 July 2025

TABLE OF CONTENTS

SECTION I

1.0 Description of Services

1.1 Introduction

1.2 Scope

SECTION II

2.0 Objectives

2.1 Task 1 – Program Management and Oversight

2.2 Task 2 – Test and Validate

2.3 Task 3 – Brief and Report Results

SECTION III

3.0 Deliverables

3.1 Inspection

3.2 Final Acceptance

4.0 Performance Standards

5.0 General Information

5.1 Place of Performance

5.2 Period of Performance

5.3 Travel

5.4 Identification of Potential Organizational Conflicts of Interest

5.5 Non-Disclosure Agreement for Contractor Employees

5.6 Non-Personal Services Contract

6.0 Security (Industrial, Personnel, Physical, Information, and Antiterrorism/Force Protection)

6.1 General Security Information

6.2 Operational Security (OPSEC)

6.3 Citizenship and Clearance Requirements

6.4 Common Access Card (CAC) Issuance Procedures

6.5 Visits by Contractors to USTRANSCOM/SDDC Buildings

6.6 Security and Emergency Operations Training

6.7 Derogatory Information

6.8 Antiterrorism/Force Protection

6.9 Note to the Prime Contractor Facility Security Officer (FSO)

6.10 USTRANSCOM Joint Security Office (Industrial Security) POCs

6.11 USTRANSCOM TCCS-S Approval

6.12 USTRANSCOM TCCS-S Tracking #: TCCS-S-XXX-YYYY

7.0 Cybersecurity

7.1 Operationally Critical Support

7.2 Cybersecurity Incident Reporting

7.3 Cybersecurity Incident Reporting Timelines

7.4 Mandatory Reporting Data

7.5 Incident Reporting Coordination

7.6 Confidentiality and Non-Attribution Statement

7.7 Reference Documents

SECTION I

1.0 DESCRIPTION OF SERVICES

1.1. Introduction. The United States Transportation Command (USTRANSCOM) located at Scott Air Force Base (AFB), IL, is one of 11 Unified Combatant Commands (UCC).

USTRANSCOM is the Department of Defense’s (DoD) Manager for Class III Bulk Petroleum, and as such synchronizes bulk fuel posture, planning, and execution, and advocates for resources, capabilities, and process improvements in coordination with Combatant Commands (CCMDs), the Services, and the Defense Logistics Agency (DLA).

1.2. Scope. As DoD’s Manager for Global Bulk Fuel Management and Delivery (GBFMD), in coordination with Assistant Secretary of Defense for Energy, Installations, and Environment ASD (EI&E), Joint Staff J4 Joint Petroleum Officer (JPO), and DLA Energy has identified an opportunity to further increase the operational responsiveness and resilience within the DoD bulk fuel supply network. The execution of a study aimed at the optimization of fuel types for specific warfighter mission requirements (i.e., fuel for specific mission sets vs. by service/aircraft) provides an opportunity to standardize fuel delivered to the warfighter at the operational level.

Services and support anticipated under this contract exist within the scope of the following tasks:

i. Task 1 – Test and Validate – Test and validate military specification (MILSPEC) fuel as outlined in Department of Defense Instruction (DODI) 4140.25 for optimization of fuel types for specific warfighter mission requirements. This study will provide a comparison of the additive process of commercial grade jet fuel (JAA) to MILSPEC fuel for all requirements and requiring units with specialized fuel requirements.

ii. Task 2 – Report Results – Report results of the fuel study in a timely manner.

SECTION II

2.0 OBJECTIVES

2.1 Task 1 – Program Management and Oversight. The contractor shall provide program management support for the tasks outlined below, to include the deliverables described in the paragraphs below. All deliverables shall meet professional standards for technical writing and the requirements set forth. The Contractor shall provide a Monthly Status Report (MSR) to the Government to include a summary of the tasks below, as well as the management and technical work conducted during the month. The contractor shall provide, at a minimum, the following information:

• On-going activities

• New activities

• Activities completed

• Deliverables submitted for that period

• Progress to date on all above-mentioned activities

• Schedule showing major tasks, milestones, and deliverables (planned and actual start and completion dates for each).

• Problems and corrective actions taken. Include issues or concerns that may affect project milestones, personnel, and cost resources and proposed resolutions to address them including risk mitigation plans.

• Government actions required (deliverables awaiting Government approval, etc.)

The Contractor shall meet with key client agency representatives to ensure a common understanding of the requirements, expectations, and ultimate end products. The Kickoff Meeting, which is planned to occur NLT 5 business days after the award of the contract, will be coordinated with the COR. The Contractor shall discuss the overall understanding of the project and review the background information and materials provided by the client. Discussions will also include the scope of work; deliverables to be produced; how the efforts will be organized; how the project will be conducted; assumptions made/expected, and results. A concerted effort shall be made to gain a thorough understanding of the client organizational expectations. However, nothing discussed in this or in any subsequent meetings or discussions between the client and the Contractor shall be construed as adding, deleting, or modifying any contract requirements, including deliverable specifications and due dates.

2.2 Task 2 – Test and Validate. The contractor will coordinate with the appointed contracting officer representative(s) (COR) to obtain access to facilities, personnel, and systems supporting the execution of contracted tasks for the study, which will be executed for USTRANSCOM as the Single Manager for GBFMD.

The purpose of this study is to challenge the status quo of JP-8 as the primary/standard fuel to the warfighter and current DoD policy that requires DLA to deliver MILSPEC fuel (e.g., JP-8) for all validated requirements. This includes understanding the current DoD supply chain, focused on the nuances of the mixture of JAA and JP-8 procured, stored, transported, and consumed globally.

Additional requirements are as follows:

i. Test and validate MILSPEC fuel as outlined in DODI 4140.25 for optimization of fuel types for specific warfighter mission requirements.

ii. Test the hypothesis that the DoD bulk fuel supply network would be more effective with JAA as the primary fuel on the battlefield vs. JP-8 as the standard fuel on the battlefield.

iii. Authoritatively assess studies, reports, and engineering analyses related to the requirement for JP-8 vs. JAA, to a high degree of fidelity. The report must separate conventional wisdom and opinions from facts and assess the rigor behind the presented facts.

iv. Determine the factual commercial and DoD restrictions on switching between JP-8 and JAA (and other alternative fuels) for storage and transportation (e.g., pigging, tank cleaning, etc.).

v. Determine if the current policy of JP-8 as the primary fuel to the warfighter is based on the most demanding requirement (e.g., F-35s), vs. the most needed requirement (e.g., C-17s).

vi. Determine operational implications, risk-to-mission, versus the engineering implications of using JAA vs. JP-8 in weapon/support systems. Nearly all existing analyses of using JP-8 vs. JAA focuses on risk-to-force, meaning the impacts to the equipment if it consumes JAA vs. JP-8 (e.g., reduce lifespan of the equipment).

vii. Determine the supply network benefits of storing and transporting JAA vs. both JAA and JP-8 as well as the implications to the additive supply chain, to include the distribution of additives to the point of need in a contested environment.

viii. Determine where in the supply chain the process of integrating additives should occur for non-negotiable JP-8 requirements (e.g., systems that operationally must have fuel with additives).

ix. Compare the operational implications with the network benefits to derive a risk assessment.

x. The study will not examine the policy of using JP-5 for naval shipboard aviation fuel.

That will remain outside the scope of the study.

2.3. Task 3 – Brief and Report Results. The contractor shall provide an in-person out brief and a report that contains the findings of the testing within 30 days of study completion. This report will provide a comparison of the additive process of commercial grade jet fuel (JAA) to MILSPEC fuel for all requirements and requiring units with specialized fuel requirements.

SECTION III

3.0. DELIVERABLES

All deliverables shall be submitted directly to the COR in electronic format. Deliverables shall be identified by SOW Task number, and deliverable title. The Contractor shall provide all deliverables electronically in Microsoft Office (Word, Excel, Power Point, Project, etc.) formats pursuant to the following schedule.

All technical data delivered under this contract are developed exclusively at the Government’s expense, and in accordance with Department of Defense Federal Acquisition Regulation Supplement (DFARS) 252.227-7013, 252.227-7014, 252.227-7016, DFARS 252.227-7015, 252.227-7017, 252.227-7019, 252.227-7030, 252.227-7037 the Government has unlimited rights in these deliverables. For all other noncommercial data delivered under this task order, the Government has Unlimited Rights to use, modify, reproduce, release, display, or disclose, in whole or in part, in any manner and for any purpose whatsoever, without restrictions of any kind, within and without the Government.

All contract deliverables shall be presented to the Government according to the table below.

Deliverable SOO Reference Due Date Delivery Method

Kickoff Meeting Minutes 2.1

Due no later than 2 business days after the kickoff meeting

By email to the COR in Microsoft Word, Excel, or

PDF format

Monthly Status Report 2.1, 2.3

Due on or before the 10th calendar day of the month following the previous month of performance

By email to the COR in Microsoft Word, Excel, or

PDF format

Quarterly Briefings 2.3 Due within 30 calendar days of quarter completion

Microsoft PowerPoint and

Teams or in person

Final Report 2.3 Due within 30 calendar days of study completion

By email to the COR in Microsoft Word, Excel, or

PDF format

Final Out Brief 2.3 Due within 30 calendar days of study completion

Microsoft PowerPoint in person

Trip Reports 5.3 Within 5 business days after completion of travel

By email to the COR in Microsoft Word, Excel, or

PDF format

3.1. Inspection. A deliverable is a specific measurable, tangible, and verifiable activity, outcome, result, item, or product that the Contractor shall provide and that will require formal Government acceptance and approval. The Government will review, assess, and provide comments, as required.

3.2. Final Acceptance. Final inspection and acceptance of all work performed, reports, or other deliverables shall be performed at the place of delivery. The Government will notify the Contractor of deliverable acceptance or provide comments in writing, and the Contractor, if necessary, shall revise and resubmit the final deliverable to the Government within 5 business days (unless otherwise specified) after receipt of Government comments.

4.0 PERFORMANCE STANDARDS

The Service Delivery Summary (SDS) summarizes desired outcomes and identifies the performance thresholds/metrics that will be tracked to determine whether the desired outcomes are being achieved. Although not all Statement of Objectives (SOO) requirements are listed in the SDS, the contractor is fully expected to comply with all requirements in the SOO and elsewhere in the contract (e.g., contract clauses).

Desired Outcome

PWS

Para Performance

Threshold (Metric)

Source of Data

How Often

Collected Calculation

Provide Monthly

Status Report 2.1, 2.3 No more than two late reports per year Submitted Reports Monthly

Number of late reports submitted per year

Provide Quarterly Briefing

2.3 Delivered within 30 calendar days with a 98% “on time” rate

Briefing Quarterly Number of late briefings per year

Provide Final Report 2.3

Delivered within 30 calendar days with a 100% “on time” rate

Submitted Reports

End of contract

Number of late report provided

Provide Final Out Brief 2.3

Delivered within 30 calendar days with a 100% “on time” rate

Briefing End of contract

Number of late briefing provided

Cyber- Incident

Reporting 7.2

No more than one late cyber incident report or unreported cyber-incident in a twelve (12) month period

Daily Operational

Status/Report Log

Annually

Number of late cyber-incident reports or unreported cyber-incidents in a 12-month period

5.0. GENERAL INFORMATION

5.1. Place of Performance. The primary location for these efforts is at the assessing contractor’s facility. If some activities within this statement of objectives are to be performed at locations other than the primary place of performance, the contractor must seek Contracting Officer (CO) approval.

The contractor shall provide support during normal Government business hours between 0800- 1700 hours of the work location time zone, Monday through Friday, excluding Federal Government holidays. The following will be observed as Federal Government holidays: New Year's Day, Martin Luther King's Birthday, Washington’s Birthday, Memorial Day, Juneteenth, Independence Day, Labor Day, Columbus Day, Veteran's Day, Thanksgiving Day, and Christmas Day. Note: Any of the above holidays falling on a Saturday shall be observed on the preceding Friday. Holidays falling on a Sunday shall be observed on the following Monday. Contract support hours are subject to change due to increased requirements for operations outside the normal workday, and contractors may be required to provide support outside normal business hours based on operational requirements. Any shifting of hours will be coordinated with the contractor by the COR in writing. The COR shall also have the authority to reduce hours or scope to the benefit of the Government when needed, however, any increase in hours, or scope that would cause an increase in the negotiated cost of the task order will require the approval of the CO.

5.2. Period of Performance. The anticipated period of performance is one year (01 August 2025 through 31 July 2026).

5.3. Travel. Performance under this contract may require Contractor travel to Scott AFB. The Government will reimburse the Contractor for travel expenses subject to FAR 31.205-46 Travel Costs. All contractor travel shall be coordinated with and validated by the primary or alternate COR prior to incurring travel expenses. The Government will not pay profit on travel. The Contractor shall identify personnel who will be traveling in sufficient time to obtain the lowest possible rates for airfare, rental car, and lodging. For long distance travel, a minimum of seven (7) calendar days advance notice from the travel commencement date is required unless mission requirements dictate otherwise. The travel request shall be in writing and contain the dates, location, and estimated travel costs. Contractor invoices (along with associated receipts) shall support all travel reimbursement requests. Actual travel costs will be reported to the COR by person, by trip, within five (5) business days of completion of travel. The Government will not reimburse local travel and related expenses to the Contractor for daily travel to or from Scott AFB or the Contractor's facility.

Deliverable(s): Trip Reports.

5.4. Identification of Potential Organizational Conflicts of Interest. All personnel (military, Government civilian, and support contractor) within the TCJ5/4 will have access and work with acquisition/proprietary information governed by Federal Acquisition Regulation (FAR).

Organizational conflict of interests shall be avoided, neutralized or mitigated IAW FAR 9.505.

5.5. Non-Disclosure Agreement for Contractor Employees. In performance of this contract, the Contractor may have access to sensitive, non-public information. The Contractor agrees (a) to use and protect such information from unauthorized disclosure IAW DTM 08-027 - Security of Unclassified DOD Information on Non-DOD Information Systems, 31 July 2009; (b) to use and disclose such information only for the purpose of performing this contract and to not use or disclose such information for any personal or commercial purpose; (c) to obtain permission of the Government before disclosing/discussing such information with a third party; (d) to return and/or electronically purge, upon Government request, any non-public, sensitive information no longer required for Contractor performance; and (e) to advise the Government of any unauthorized release of such information. The Contractor shall have its employees assigned to this contract execute a non-disclosure agreement for delivery to the Government. The Government will require Contractor personnel to sign a non-disclosure statement to protect non-public information of other Contractors and/or the Government.

5.6. Non-Personal Services Contract. This requirement is for a “non- personal services contract” as defined in FAR 37.101. PERSONAL SERVICES CONTRACTS ARE EXPRESSLY

PROHIBITED BY 5 U.S.C.3109 AND FAR SUBPART 37.1.

It is, therefore, understood and agreed that the Contractor and/or the Contractor’s employees:

(1) shall perform the services specified herein as independent Contractors, not as employees of the Government; (2) shall be responsible for their own management and administration of the work required and bear sole responsibility for complying with any and all technical, schedule, or financial requirements or constraints attendant to the performance of this contract; (3) shall be free from supervision or control by any Government employee with respect to the manner or method or performance of the services specified; but (4) shall, pursuant to the Government’s right and obligation to inspect, accept, or reject the work, comply with such general direction of the CO, or the duly authorized representative of the CO, as is necessary to ensure accomplishment of the contract objectives.

This requirement shall not be administered in a manner that makes it a personal services contract. A personal services contract is a contract that is administered in a manner that makes Contractor personnel appear, in effect, to be Government employees. The relationship between the Government managers and Contractor employees resembles an employer-employee relationship. In personal services situations there is relatively continuous supervision and control of Contractor employees by Government employees.

6.0. SECURITY (INDUSTRIAL, PERSONNEL, PHYSICAL, INFORMATION, and

ANTITERRORISM/FORCE PROTECTION)

6.1. General Security Information. The majority of daily work associated with this PWS/SOW is at the unclassified level. Access to classified information is NOT authorized on this contract.

6.2 Operational Security (OSPEC). Protecting critical information (friendly activities, intentions, capabilities, or limitations) is crucial to prevent adversaries from gaining advantage.

Therefore, contractors must adhere to OPSEC requirements throughout the contract lifecycle. All information provided is for official use only. Additionally, mandatory initial and annual OPSEC training is required after contract award for all contractors working on-site at a DoD facility or off-site accessing a Federally controlled information system. Proof of completion must be available to the COR/CO. Training can be accessed at the following website:

(https://securityawareness.usalearning.gov/opsec/index.htm ).

Immediately consult the contracting office’s OPSEC coordinator regarding the USTRANSCOM Critical Information and Indicators List (CIIL) and any OPSEC questions. Protect critical information (e.g., mission details, units, cargo) from unauthorized disclosure and coordinate with the government to minimize shared information. Report suspected/known compromises immediately to the COR and security office. Safeguard information (including FOUO and CUI) per the CIIL using measures like: encryption; locked storage; restricted distribution; secure destruction;

limiting verbal discussions; avoiding unencrypted phones/foreign mail; prompt document retrieval;

cover pages; and minimizing public disclosure. Contact the COR/CO for clarification.

6.3. Citizenship and Clearance Requirements. The contractor’s, subcontractors, and/or partner’s personnel performing services under this contract/task order shall be citizens of the United States of America. Non-US citizens are not eligible for Common Access Cards (CACs) unless they meet the parameters stated in Department of Defense Manual (DoDM) 1000.13, Volume 1. All personnel that will have Information Technology (IT)/Automated Data Processing (ADP) privileged access (i.e. Privileged Users) to US Information Systems (IS), and/or classified information, classified systems, or classified areas, shall be US citizens. Foreign Nationals or Local Nationals employed by the DoD are not authorized to have privileged access to US Information Systems.

6.4. Common Access Card (CAC) Issuance Procedures.

a) Facility Security Officer (FSO) will verify, via the DOD personnel security system of record, contractors on the contract/task order have the required background investigation to obtain a CAC and provide those names to the CO/COR. Contractors that require a Tier 5 investigation is the responsibility of the contractor. Contractors that only require a Tier 1 as determined by the FSO will submit to the TCCS-S Personnel Security Program Manager (through the CO or COR) an OF Form 306 (Declaration for Federal Employment) and a MP ICAM Form 1 with Section 1 completed. TCCS-S will initiate the SF-85 (questionnaire for Non-Sensitive Positions) via the National Background Investigation Services (NBIS) for completion and submission to DCSA, for Tier 1 investigations only.

b) At the same time, the contractor company will coordinate and obtain electronic fingerprinting for their employee. The third-party company will “electronically” capture the applicant’s fingerprints, using the USTRANSCOM (Submitting Office (SON), Security Office (SOI), and Agency Location Code (ALC)). Hardcopy fingerprint cards are NOT acceptable. These steps shall be completed before the COR/MPAS accesses MP ICAM to create a CAC application.

c) Basic US Citizen Contractor CAC Requirements:

1. Requires access on a continual basis of 6 months or more.

2. Contractor personnel require access to a DoD facility or networks, either on-site or from a remote location.

3. Users need access to systems for platforms that requires CAC login or user authentication.

d) Basic Non-US Citizen Contractor CAC Requirements:

1. Meet (as direct/indirect DoD hire personnel) the investigative requirements for DoD employment as recognized through international agreements pursuant to DoDI 1400.25, Civilian Personnel Management, Volume 1231. In addition to these investigative requirements, a fingerprint check against the FBI criminal history database, an FBI investigations files (name check search), and a name check against the Terrorist Screening Database shall be required prior to CAC issuance IAW Office of Personnel Management Memorandum, “Final Credentialing Standards for Issuing Personal Identity Verification Cards under HSPD-12”, July 31, 2008.

2. Possess (as foreign military, employee, or contract support personnel), a visit status and security assurance that has been confirmed, documented, and processed IAW international agreements pursuant to DoDI 1400.25, Civilian Personnel Management.

e) CAC Applications:

1. The CAC applications (MP ICAM Form 1 with Section 1 completed) must have an adjudication Tier 1 or Tier 5 background investigation posted in the DoD personnel security system of record, or

2. An interim CAC may be approved when the contractor employee has a favorable fingerprint, name and criminal records check completed and has either a Tier 1 or Tier 5 background check “open” with DCSA.

3. The MP ICAM MPAS will not approve the CAC applications in MP ICAM until that MPAS has verified, with a member of USTRANSCOM TCCS-S, one of the above requirements.

6.5. Visits by Contractors to USTRANSCOM/SDDC Buildings. Any visit(s) by contractor personnel assigned to this contract/task order will submit the name(s), social security number(s), date of visit, and POC coordinating visit to the COR. COR will (1) work with TCCS-S Joint Security Desk on obtaining escort badges upon check-in and (2) conduct escort duties during contractor visit.

6.6. Security and Emergency Operations Training. USTRANSCOM Contractor personnel shall attend/complete the following training as prescribed by DoD, USTRANSCOM and Air Force Instructions: Workplace Violence, Annual Security Awareness, Operations Security (OPSEC), DOD Antiterrorism Level I, Active Shooter/Attacker, Emergency Operations, Combating Trafficking in Person (CTIP), Controlled Unclassified Information (CUI), and any Security Stand-down Day Training scheduled by the Commander, USTRANSCOM. Contractor personnel assigned elsewhere shall attend security training established by their respective Government security offices and/or installations. CUI training can be accessed via https://www.cdse.edu/Training/eLearning/IF141/.

6.7. Derogatory Information. Any member of the contracted company team (Program Manager, FSO, or other supervisory staff) aware of pending human resource activity of consequence (to include termination or suspension), behaviors or patterns of concern, or misconduct, to include reporting requirements in accordance with Security Executive Agent Directive (SEAD) 3 (for contractors with classified security eligibility), for any contractors supporting this contract/task order during the established period of performance, will immediately contact the USTRANSCOM Joint Security Office (TCCS-S) Attn: Industrial Security Program Manager. If the Government notifies the contractor that the employment or the continued employment of any contractor personnel is prejudicial to the interests or endangers the security of the United States of America and/or USTRANSCOM personnel, information, or assets; that employee shall be removed and barred from the worksite. This includes security deviations / incidents and credible derogatory information on contractor personnel as noted in the DoD personnel security system of record. Personnel who have incident reports posted in the DoD personnel security system of record will be denied the ability to support the contract/task order until the issues have been resolved and the incident has been removed in the DoD personnel security system of record. The contractor shall make any changes necessary in the appointment(s), at no additional cost to the Government. If any incident involves or may involve the mishandling of classified information or a potential Negligent Discharge of Classified Information, the USTRANSCOM Joint Security Office Attn: Industrial Security Program Manager, will be notified within 24 hours during the normal work week and within 72 hours if the incident occurs over the weekend.

6.8. Antiterrorism/Force Protection. Contractor employees will comply with antiterrorism Force Protection conditions (FPCONs) at the location they are performing work, whether it is CONUS or OCONUS.

6.9. Note to the Prime Contractor Facility Security Officer (FSO). The prime contractor will forward the name, address, email address and telephone number of the Company FSO and backup to the USTRANSCOM Joint Security Office (TCCS-S) at: transcom.scott.tccs.mbx.industrial-security@mail.mil.

6.10. USTRANSCOM Joint Security Office (Industrial Security) POCs.

USTRANSCOM

Attn: TCCS-S (Industrial Security Specialist) 508 Scott Drive https://www.cdse.edu/Training/eLearning/IF141/

Scott AFB, IL 62225 Commercial: 618-817-4078

6.11. USTRANSCOM TCCS-S Approval.

Jennifer Rodriguez, Industrial Security Program Manager, USTRANSCOM Joint Security Office

6.12. USTRANSCOM TCCS-S Tracking #: TCCS-S-XXX-YYYY

7.0. CYBERSECURITY

7.1. Operationally Critical Support. The services designated under this contract are “operationally critical support” as defined in DFARS 252.204-7012.

7.2. Cybersecurity Incident Reporting.

7.2.1. In addition to the DFARS 252.204-7012 reporting requirements for unclassified systems and DoD Manual (DoDM) 5220.22, National Industrial Security Program Operating Manual (NISPOM) for classified systems, reportable cyber-incidents include, but are not limited to, the following:

7.2.1.1. Cyber-incidents as defined in Table 1.

7.2.1.2. Notifications by a federal, state, or local law enforcement agency or cyber-center (i.e., National Cyber Investigative Joint Task Force (NCIJTF), National Cybersecurity & Communications Integration Center (NCCIC)) of being a victim of a successful or unsuccessful cyber-event, anomaly, incident, insider threat, breach, intrusion, or exfiltration.

Table 1.

Incident Category Description

Root Level Intrusion Unauthorized privileged access to an IS. Privileged access, often referred to as administrative or root access, provides unrestricted access to the IS. This category includes unauthorized access to information or unauthorized access to account credentials that could be used to perform administrative functions (e.g., domain administrator). If the IS is compromised with malicious code that provides remote interactive control, it will be reported in this category.

User Level Intrusion Unauthorized non-privileged access to an IS. Non-privileged access, often referred to as user level access, provides restricted access to the IS based on the privileges granted to the user. This includes unauthorized access to information or unauthorized access to account credentials that could be used to perform user functions such as accessing Web applications, Web portals, or other similar information resources. If the IS is compromised with malicious code that provides remote interactive control, it will be reported in this category.

Denial of Service Denial of Service (Incident)—Activity that denies, degrades, or disrupts normal functionality of an IS or DoD information network.

Malicious Logic Installation of software designed and/or deployed by adversaries with malicious intentions for the purpose of gaining access to resources or information without the consent or knowledge of the user. This only includes malicious code that does not provide remote interactive control of the compromised IS. Malicious code that has allowed interactive access should be categorized as Root or User Level Intrusion incidents. Interactive active access may include automated tools that establish an open channel of communications to and/or from an IS.

Ransomware Malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable.

Malicious actors then demand ransom in exchange for decryption. Ransomware actors often target and threaten to sell or leak exfiltrated data or authentication information if the ransom is not paid. Ransomware is a reportable incident that may be associated with multiple incident categories depending on the attack vector and execution.

7.2.2. If the cyber-incident affects a classified system, vulnerabilities associated with the incident will be classified per the current version of USTRANSCOM Instruction 31-02, Security Classification Guide.

7.3. Cybersecurity Incident Reporting Timelines. In addition to providing the notification required by DFARS 252.204-7012, the contractor is required to notify USTRANSCOM as soon as practical, but no later than 72 hours after discovering a reportable cyber-incident. The reporting timeline begins when the incident is discovered or reported to the company, its employees, contractors, or cybersecurity firm responsible for providing cybersecurity and response for the company. The contractor shall contact the USTRANSCOM Cyber Operations Center (CyOC) via phone at 618-817-4222. If the contractor does not immediately reach the CyOC via phone, the contractor shall send an email notification to transcom.scott.tcj6.mbx.cyoc-dodin-operations@mail.mil.

7.4. Mandatory Reporting Data.

7.4.1. The contractor shall work with the USTRANSCOM CyOC through resolution of the incident. Within 72 hours of becoming aware of a reportable cyber-incident, the contractor shall provide an initial notification of the incident, even if some details are not yet available, which includes, but is not limited to, the following information:

(a) Company Name

(b) Who will be the POC with contact information

(c) Contracting Officer POC (name, telephone, email)

(d) Overall Assessment –Description of incident, data at risk, mitigations applied

(e) Indicators of compromise

(f) Vector of attack (if known)

(g) Estimated time of attack (if known)

7.4.2. The contractor shall provide a follow-on cyber-incident report to the USTRANSCOM CyOC within 5 days of becoming aware of a reportable cyber-incident, which includes, but is not limited to, the following information:

(a) Contractor unique Commercial and Government Entity (CAGE) code

(b) Contract numbers affected

(c) Facility CAGE code where the incident occurred if different than the prime Contractor location

(d) POC if different than the POC recorded in the System for Award Management (name, address, position, telephone, email)

(e) Contracting Officer POC (name, telephone, email)

(f) Contract clearance level

(g) DoD programs, platforms, systems, or information involved

(h) Location(s) of compromise

(i) Date incident discovered

(j) Type of compromise (e.g., unauthorized access, inadvertent release, other)

(k) Description of technical information compromised

(l) Any additional information relevant to the information compromise

7.5. Incident Reporting Coordination.

7.5.1. In the event of a cyber-incident, USTRANSCOM may conduct an on-site review of network or information systems where DoD information is resident on or transiting to assist the contractor in evaluating the extent of the incident and to share information in an effort to minimize the impact to both parties. Date and time of on-site visits will be mutually agreed upon by USTRANSCOM and the contractor in advance.

7.5.2. The contractor agrees to allow follow-on actions by the Government (e.g., USTRANSCOM, Federal Bureau of Investigation, Department of Homeland Security, DC3, etc.) to further characterize and evaluate the suspect activity. The contractor acknowledges that damage assessments might be necessary to ascertain an incident methodology and identify systems compromised as a result of the incident. Once an incident is identified, the contractor agrees to take all reasonable and appropriate steps to preserve any and all evidence, information, data, logs, electronic files and similar type information (reference

NIST Special Publication 800-61, Computer Security Incident Handling Guide, (current version)) related to the incident for subsequent forensic analysis so that an accurate and complete damage assessment can be accomplished by the Government.

7.5.3. The contractor is not required to maintain an organic forensic capability, but must ensure data is preserved (e.g., remove an affected system, while still powered on, from the network) and all actions documented until forensic analysis can be performed by the Government or, if the Government is unable to conduct the forensic analysis, a mutually agreed upon third party (e.g., Federally Funded Research and Development Center (FFRDC), commercial security contractor, etc.). Any follow-on actions shall be coordinated with the contractor via the Contracting Officer.

7.5.4. The contractor agrees to indemnify and hold the government harmless for following any recommendations to remedy or mitigate the cyber-incident following the actions under

7.5.1. and 7.5.2.

7.6. Confidentiality and Non-Attribution Statement. The Government may use and disclose reported information as authorized by law and will only provide attribution information on a need-to-know basis to authorized persons for cybersecurity and related purposes (e.g., in support of forensic analysis, incident response, compromise or damage assessments, law enforcement, counterintelligence, threat reporting, and trend analysis). The Government may share threat information with other USTRANSCOM industry partners without attributing or identifying the affected contractor.

7.7. Reference Documents.

• Executive Order (E.O.) 13691 of February 13, 2015. Promoting Private Sector Cybersecurity Information Sharing

• NIST Special Publication 800-61 Computer Security Incident Handling Guide

• USTRANSCOM Instruction 31-02 Security Classification Guide

Attachment:

1. Non-Disclosure Agreement