Atch 1 - CSS Performance Work Statement (PWS) IDIQ.docx

Performance Work Statement for

Customer Satisfaction Survey Service

Indefinite Delivery/Indefinite Quantity (IDIQ)

9 July 2020

1. DESCRIPTION OF SERVICES:

The Department of Defense (DoD) Personal Property Program (DP3) moves personal property worldwide for DoD Services Members, DoD Civilians and U.S. Coast Guard members (collectively, customers), approximately 400,000 shipments annually, under the Defense Personal Property System (DPS), in the future to be replaced by Global Household Goods Contract (GHC), stores Non-Temporary Storage (NTS) for 30,000 shipments and ships 68,000 privately-owned vehicles (POV) under the Government Privately-Owned Vehicles Contract (GPC). All are included in the overall DP3 program. The largest concentration of these moves (40%) occurs between 15 May and 31 August, referred to as Peak Season. This Performance Work Statement (PWS) defines the general tasks to be performed under the Customer Satisfaction Survey (CSS) Indefinite Delivery/Indefinite Quantity (ID/IQ) contract. Task orders may be issued under this IDIQ contract for any of the DP3 programs and will include up to 4 stages (PWS paragraphs 1.1.1 thru 1.1.4) to be surveyed. Task Orders will also include survey questions to be utilized.

The purpose of this Performance Work Statement (PWS) is to seek an independent company to send Customer Satisfaction Surveys, related to up to four (4) stages for customer shipment(s) processed, moved or stored under DPS, GHC, NTS and GPC contracts or tender-based agreements. (For example, the quality of counseling conducted by Government offices, whether the move is conducted by a contractor via a contract vehicle like GHC or conducted via a tender of service agreement via DPS, may be surveyed). The results from the CSSs will be used to assist the Government in evaluating the customer’s overall satisfaction and the contractor’s performance across some or all of the phases of each shipment (Attachment 1 includes projected DP3 survey totals).

1.1 Customer Satisfaction Surveys (CSS): CSSs will be sent to customers whose shipments were processed under DP3 from entitlement counseling through shipment pack and pickup, storage, to delivery and the filing of a claim (if applicable). Surveys shall be solicited using mobile capable means (i.e. text, email, mobile friendly URL, mobile app, etc.). The CSS question(s) will be sent at up to four stages throughout the moving process, and each given phase may have one or more questions sent. The Government will phase-in the number of CSSs (e.g. shipping household goods (HHG), storage, shipping vehicles, etc.)based on the schedules of the contracts that support those areas. Attachment 2 is provided as an example of survey questions to be used for HHG shipments processed under DPS or GHC. Contractors may submit proposed changes to Attachment 2 including questions (different or altered), images, graphics, etc. in order to maximize customer participation and response rate. Surveys will be triggered by DP3 authorized systems (Ref. PWS Para 1.3) and the results reported will feed into the Government Data Warehouse, Integrated Data Environment & Global Transportation Network Convergence (IGC).

Each CSS will be developed in stages with each stage identified as Pre-Move Services, Physical Move Services, Post Move Services and/or Claims Services. Within 24 hours of receiving a trigger, the contractor shall initiate the applicable CSS to all customers identified in the trigger. Contactor shall only send surveys between 0800 to 1800 (based on customer’s time zone location), Monday through Friday. Surveys are not to be sent on weekends or holidays. As DP3 evolves, there may be a need to revise the customer satisfaction survey questions within the scope of this contract. The Contractor will work with the Government to develop new and/or revise existing survey questions when the need arises.

1.1.1 Pre-Move Services. Contractor shall send a survey to the customer to assess origin services for timeliness and accuracy of counseling. Survey shall indicate if the customer was counseled by a contractor or government representative. The survey shall include a block for additional free-text comments with no less than 3,000 characters.

1.1.2 Physical Move Services. Contractor shall send a survey on origin services, including the timeliness and quality of packing, accuracy of inventory, courtesy of the packing and loading crew; contract services providers were clean, neat, easily identifiable as company employees and exhibited professional behavior. The survey shall include a block for additional free-text comments with no less than 3,000 characters.

1.1.3 Post Move Services. Contractor shall send a survey on destination services including timeliness of delivery, care and courtesy of the crew during unloading and unpacking, items were handled to protect against loss or damage, reassembled if disassembled at origin and debris was removed as required. The survey should also assess overall satisfaction with the moving company’s timeliness, courtesy, professionalism, and responsiveness in all phases of the move from first contact through delivery. The survey shall include a block for additional free-text comments with no less than 3,000 characters.

1.1.4 Claims Services. Contractor shall send a survey to customers on the claims process including responsiveness, timeliness of process and claims settlement satisfaction including a block for additional comments. This survey will only be sent to customers who file a claim. The survey should include a block for additional free-text comments with no less than 3,000 characters.

1.2 Information Technology System: The contractor shall provide and maintain an IT system able to manage the volume of CSS surveys for all DP3 shipments. Contractor shall employ a system that protects any and all Personally Identifiable Information (PII) of customers, and possess the capability to generate monthly and ad hoc reports to be sent to Government data warehouse.

1.3 Systems Integration: The contractor shall interface its system with Government managed system(s) for the purpose of receiving survey triggers and providing CSS response data. Contractor will provide an API for MilMove/DPS (or other government system(s)) to trigger surveys based on the data provided in the trigger. The API shall be flexible such that new surveys can be created and triggered based on the shipment data provided on the API. The contractor’s system shall include system failover and disaster recovery capabilities to mitigate degradations in system performance. Contractor shall provide CSS result data to a Government Data Warehouse, to include all trigger data, a unique survey ID created by the contractor’s CSS system, so the data can be associated in the data warehouse with the shipment and phase. Example data might include:

Triggers

DPS: Suggest creating by appending Service & Order Number & Order Issue Date & Origin GBLOC

Manual: Suggest similar to DPS, appending Service & Order Number & Order Issue Date & Origin GBLOC MilMove:

DPS: USMC-A8926-20200402-CLPK

Manual: USMC-A8926-20200402-CLPK

{HHG, POV, NTS}?

Jane Doe, janed@whatever.com

Government Office ID (DODAAC/ GBLOC?)

(1 Apr 2020 at 0215GMT)

FALSE = in progress

Triggering: Triggering shall primarily be via an interface (e.g. a web service), but manual triggering by an authorized user logging in to the CSS system shall be supported for times when the interface is not available (either due to outage or as a transition mechanism). In both cases, the same information shall be provided in order to properly trigger the survey. The intent is this metadata will be used to trigger the survey and also be carried with the survey and reported with the results. This is essential to proper analysis of the responses.

1.4 Data Transfer: The contractor shall transfer all CSS data and metadata to a Government Data Warehouse (currently IGC via the Global Exchange or GeX, subject to change over time). New and updated CSS data and metadata shall be transferred no less than every 12 hours into the Government’s data warehouse.

1.5 System Availability: The contractor’s IT system shall be available 98% of the time. This will be computed by dividing hours of availability by the total hours in the month. Scheduled downtime shall be coordinated with the Government at least 48 hours prior to downtime start.

1.6 Reports. The Contractor shall provide an analysis of survey results by a monthly report. Report shall be submitted in a mutually agreed upon format with the Government. Reporting of survey results will be through an interface to a Government specified data warehouse (IGC). In addition to the trigger and response data, the survey reporting shall include the survey transmission date/time to the customer, date/time the customer saw/received the survey, data/time the customer submitted the response. Only complete surveys should be sent to the data warehouse. Customers have up to one year to complete surveys. Contractor may be required to report specific trends to be tracked and will be included in each task order. Reports may include any of the following:

1) Number of surveys sent, number of surveys returned, including a response rate for surveys returned (e.g. provides response rate based on all 4 stages (pre-move, physical move, post-move, claims (not just dividing received by sent per month).

2) Overall score received (on the likert scale) by stages (pre-move, physical move, post-move, claims).

3) Overall scoring results for individual questions grouped by each stage. Indicate any trends in survey response rate. (For example, Overall, increases/decreases in ratings/response rates).

4) Trend analysis of all free text comments. (similar/same comments should be grouped in the analysis).

1.7 Ramp-up. The contractor will submit a ramp-up plan with their proposal submission including clearly identified activities required and the timeframes associated with accomplishing each Performance Work Statement (PWS) requirement. Contractor will have 90 days to ramp up performance. During the 90-day period the contractor is expected to complete activities in the timeframes indicated in the accepted contractor ramp-up plan. Any future task orders requiring an interface with an additional IT System(s) for purposes of receiving triggers will contain a ramp-up period of 90-days to accomplish system interfaces and testing at the price established in the IDIQ.

1.7.1 Development of surveys by line of business and phase. The surveys shall be created in coordination with the Government based on the line of business and phase. Some example survey questions are included in Attachment 2. The survey question bank shall be validated using the manual triggering process and online / downloadable reports. One downloadable report shall contain all data elements planned for transition to the data warehouse and in a format useful for analysis or importing (e.g. CSV, Excel, etc.)

1.7.2 IT System. The contractor’s IT system shall receive survey triggers from the Government managed IT system(s), process data for surveys and send CSS data to Government data warehouse (IGC) not later than task order start date. System testing for this capability will be available at the start of ramp-up.

1.7.2 Ramp-up Reports. Contractor shall submit bi-monthly (twice per month) reports including status of all PWS tasks commencing 2 weeks after contract award through ramp-up period. All reports shall detail the contractor’s progress toward accomplishing necessary tasks to begin performance on start date of the base period.

1.8 Post-Award Meeting. The contractor shall attend a Government-hosted post-award meeting at a Government identified location as scheduled by the Government upon award.

1.9 Data Rights. The Government has exclusive rights to any and all survey results, data, and reports created by the contractor, as well as any data analytics generated from the survey data. The Government reserves the right to share this information with any third party and further contract for other data analytics. The Contractor shall not have any ownership interest or rights in the data it produces and must turnover all data at the Government's request. Furthermore, the Contractor shall not assert any claim of ownership against the Government on the reports it produces on the Government's behalf. Once any such report is in the Government's possession, the Government may reproduce the data, the report, and any data analytics in any manner that fulfills a government purpose.

2.0 SERVICE DELIVERY SUMMARY (SDS)

Contractor shall perform the identified deliverables below. The SDS represents the most important contract objectives. While the contractor is fully expected to comply with all requirements in the PWS, the Government’s assessment of contractor performance will mainly focus on the performance objectives listed in the SDS. The performance objectives identified in the table below will be included in the evaluation process for meeting the requirements outlined in the PWS and considered in the annual Contractor Performance Assessment Reporting System ratings.

Customer Satisfaction Surveys

3.0 GENERAL INFORMATION

3.1 TYPE OF ORDER. The Government anticipates award of a Firm Fixed Price (FFP) IDIQ contract.

3.2 PERIOD OF PERFORMANCE. The period of performance shall be for one (12 month) Base period and up to four (4) option periods of twelve (12) months each:

Base Period: 1 Dec 2020 – 30 Nov 2021 Option Period 1: 1 Dec 2021 – 30 Nov 2022 Option Period 2: 1 Dec 2022 – 30 Nov 2023 Option Perion 3: 1 Dec 2023 – 30 Nov 2024 Option Period 4: 1 Dec 2024 – 30 Nov 2025

3.3 PLACE OF PERFORMACE. The primary places of performance will be the contractor’s facility.

3.4 GOVERNMENT FURNISHED PROPERTY/INFORMATION

The Government will provide the necessary data that will act as a trigger to the contractor to send each CSS.

3.5 CONTRACTING OFFICER’S REPRESENTATIVE (COR)

This contract will be monitored by a government representative; that individual will be designated and appointed prior to award.

3.6 SECURITY REQUIREMENTS

The Contractor will be fed information from a third party system that identifies when each CSS is to be sent.

4 CYBER SECURITY

4.1. Operationally Critical Support

The services designated under this contract are “operationally critical support” as defined in DFARS 252.204-7012.

4.2. Cybersecurity Incident Reporting

4.2.1. In addition to the DFARS 252.204-7012 reporting requirements for unclassified systems and DoD Manual (DoDM) 5220.22, National Industrial Security Program Operating Manual (NISPOM) for classified systems, reportable cyber-incidents include, but are not limited to, the following:

4.2.1.1. Unauthorized data exfiltration, manipulation or disclosure of any DoD information resident on or transiting the contractor's unclassified or classified information systems or networks.

4.2.1.2. Unauthorized access to the contractor’s unclassified or classified information system(s) or networks(s) on which DoD information is resident or transiting.

4.2.1.3. Cyber-incidents as listed in the MITRE ATT&CK Framework available at https://attack.mitre.org/, incorporated herein by reference, which affect network or information systems where DoD information is resident or transiting.

4.2.1.4. Notifications by a federal, state, or local law enforcement agency or cyber-center (i.e., National Cyber Investigative Joint Task Force (NCIJTF), National Cybersecurity & Communications Integration Center (NCCIC)) of being a victim of a successful or unsuccessful cyber-event, anomaly, incident, insider threat, breach, intrusion, or exfiltration.

4.2.2. If the cyber-incident affects a classified system, vulnerabilities associated with the incident will be classified per the current version of USTRANSCOM Instruction 31-02, Security Classification Guide.

4.3. Cybersecurity Incident Reporting Timelines

In addition to providing the notification required by DFARS 252.204-7012, the contractor is required to notify USTRANSCOM as soon as practicable, but no later than 24 hours after discovering a reportable cyber-incident. The reporting timeline begins when the incident is discovered or reported to the company, its employees, contractors, or cybersecurity firm responsible for providing cybersecurity and response for the company. The contractor shall contact the USTRANSCOM Cyber Operations Center (CyOC) via phone at 618-220-4222. If the contractor does not immediately reach the CyOC via phone, the contractor shall send an email notification to transcom.scott.tcj6.mbx.cyoc@mail.mil.

4.4. Mandatory Reporting Data

4.4.1. The contractor shall work with the USTRANSCOM CyOC through resolution of the incident. Within 24 hours of becoming aware of a reportable cyber-incident, the contractor shall provide an initial notification of the incident, even if some details are not yet available, which includes, but is not limited to, the following information:

(a) Company Name

(b) Who will be the POC with contact information

(c) Contracting Officer POC (name, telephone, email)

(d) Overall Assessment –Description of incident, data at risk, mitigations applied

(e) Indicators of compromise

(f) Vector of attack (if known)

(g) Estimated time of attack (if known)

4.4.2. The contractor shall provide a follow-on cyber-incident report to the USTRANSCOM CyOC within 72 hours of becoming aware of a reportable cyber-incident, which includes, but is not limited to, the following information:

(a) Contractor unique Commercial and Government Entity (CAGE) code

(b) Contract numbers affected

(c) Facility CAGE code where the incident occurred if different than the prime Contractor location

(d) POC if different than the POC recorded in the System for Award Management (name, address, position, telephone, email)

(e) Contracting Officer POC (name, telephone, email)

(f) Contract clearance level

(g) DoD programs, platforms, systems, or information involved

(h) Location(s) of compromise

(i) Date incident discovered

(j) Type of compromise (e.g., unauthorized access, inadvertent release, other)

(k) Description of technical information compromised

(l) Any additional information relevant to the information compromise

4.5. Incident Reporting Coordination

4.5.1. In the event of a cyber-incident, USTRANSCOM may conduct an on-site review of network or information systems where DoD information is resident on or transiting to assist the contractor in evaluating the extent of the incident and to share information in an effort to minimize the impact to both parties. Date and time of on-site visits will be mutually agreed upon by USTRANSCOM and the contractor in advance.

4.5.2. The contractor agrees to allow follow-on actions by the Government (e.g., USTRANSCOM, Federal Bureau of Investigation, Department of Homeland Security, DC3, etc.) to further characterize and evaluate the suspect activity. The contractor acknowledges that damage assessments might be necessary to ascertain an incident methodology and identify systems compromised as a result of the incident. Once an incident is identified, the contractor agrees to take all reasonable and appropriate steps to preserve any and all evidence, information, data, logs, electronic files and similar type information (reference NIST Special Publication 800-61: Computer Security Incident Handling Guide, (current version)) related to the incident for subsequent forensic analysis so that an accurate and complete damage assessment can be accomplished by the Government.

4.5.3. The contractor is not required to maintain an organic forensic capability, but must ensure data is preserved (e.g., remove an affected system, while still powered on, from the network) and all actions documented until forensic analysis can be performed by the Government or, if the Government is unable to conduct the forensic analysis, a mutually agreed upon third party (e.g., Federally Funded Research and Development Center (FFRDC), commercial security contractor, etc.). Any follow-on actions shall be coordinated with the contractor via the Contracting Officer.

4.5.4. The contractor agrees to indemnify and hold the government harmless for following any recommendations to remedy or mitigate the cyber-incident following the actions under 1.5.1. and 1.5.2.

4.6. Confidentiality and Non-Attribution Statement

The Government may use and disclose reported information as authorized by law and will only provide attribution information on a need-to-know basis to authorized persons for cybersecurity and related purposes (e.g., in support of forensic analysis, incident response, compromise or damage assessments, law enforcement, counter intelligence, threat reporting, and trend analysis). The Government may share threat information with other USTRANSCOM industry partners without attributing or identifying the affected contractor.

Add the following surveillance item to the Service Delivery Summary (SDS):

The Quality Assurance Surveillance Plan (QASP) shall also be updated to incorporate the above SDS entry with the method of surveillance established as 100% inspection of all cyber-incidents and reports.

4.7 Handling and Protection of Non-Public Information. In performance of this contract, the contractor may have access to DoD Information which for the purposes of this section shall mean any information developed or received in the course of planning, providing storage services and invoicing in support of the requirements of this contract. To adequately protect this information, contractor information systems (IS) involved in the performance of this contract shall comply with the security requirements in the current version of the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations,” as soon as practical but no later than the first day orders may be issued as detailed in clause 52.216-18 Ordering. The contractor agrees (a) to use and protect such information from unauthorized disclosure law DoD Instruction 8582.01: Security of Unclassified DoD Information on Non-DoD Information Systems; (b) to use and disclose such information only for the purpose of performing this contract and to not use or disclose such information for any personal or commercial purpose; (c) to comply with other current Federal and DoD information protection and reporting requirements for specified categories of information (e.g. , medical, proprietary, critical program information (CPI), personally identifiable information, export controlled); (d) to obtain permission of the Government Program Manager before disclosing/discussing such information with a third party; (e) to return and/or electronically purge, upon Government request, any DoD information no longer required for contractor performance; and (f) to advise the CO and/or COR of any unauthorized release of such information.

4.8 PII/Security, Covered Defense Information. The contractor will have access to Covered Defense Information (CDI) in the form of "other information" as defined in DFARS 252.204-7012 and described in the Controlled Unclassified Information (CUI) Registry at http://www.archives.gov/cui/registry/category-list.html. The CDI requiring safeguarding or dissemination controls is as follows:

Customer relocation orders/task orders which contain PII;

Reserved for any other items provided to, or generated by the contractor (such as reports) that meet the definition of PII/CDI.

5. Cyber Security Assessments and Mitigation Plans. The contractor shall provide a Self-Assessment of its compliance with NIST SP 800-171 and present a Plan of Action that identifies any deviations, non-compliance, or proposed alternative means of compliance as well as plans for correcting non-compliant requirements to the contracting officer within 30 days after award, or as authorized by the contracting officer. The Self- Assessment and Plan of Action shall address all of the requirements in NIST SP 800-171. The table in Appendix 6 provides modified requirements of CUI/CDI specific controls from NIST SP 800-171 that will be used to evaluate compliance in a non-CUI/CDI environment. Additionally, at any time during the period of performance, when a contractor determines it is non-compliant with a NIST SP 800-171 requirement or an approved alternate means of compliance resulting in a High or Moderate Potential Impact as defined in Federal Information Processing Standards Publication (FIPS PUB) 199, “Standards for Security Categorization of Federal Information and Information Systems,” the contractor shall submit a Plan of Action within 15 days of the determination of non-compliance.

5.1 Plans of Action and any requests to vary from NIST SP 800-171 shall be submitted to the contracting officer for consideration and approval by USTRANSCOM. The contractor need not implement any security requirement determined by USTRANSCOM to be non-applicable or to have an equally effective alternative security measure implemented in its place. The Plan of Action shall follow the template provided in Appendix 5. Alternate formats for the Plan of Action may be proposed and must be approved by USTRANSCOM.

5.2 USTRANSCOM may conduct an on-site visit to a contractor's facility or request a third party assessment (U.S. Government agency or U.S. Government funded commercial entity) to review progress towards meeting their Plan of Action, evaluate any proposed variances to NIST SP 800-171 requirements resulting from the non-compliance. Date and time of on-site visits will be mutually agreed-upon by USTRANSCOM and the contractor in advance.

Security Regulation Guidance that might apply:

DoD: (DoD issuances found at: http://www.dtic.mil/whs/directives/corres/pub1.html):

• O-2000.16 (DODI Antiterrorism (AT) Standards), Vol 1, 17 November 2016

• DoD 5200.02, Personnel Security Program, 17 April 2017

• DoD 5200.08-R, Change-1, DoD Physical Security Program, May 27, 2009

• DoDO 2000.16, DoD Antiterrorism (AT) Standards, Vol. 1, November 17, 2016

• DODI 1000.13, DoD ID Card Lifecycle, (Dated Jan 2013, Vol. 1).

• DoDI 5200.02, DODM Procedures for the DOD Personnel Security Program

• DoDI 5220.22, National Industrial Security Program Operating Manual (NISPOM), 18 May 2016

• DoDI 8500.01, Cybersecurity, March 13, 2014

• DoDI 8510.01, DoD Information Assurance Certification and Accreditation Process (DIACAP), November 28, 2007

• DoDI 8582.01, Security of Unclassified DoD Information on Non-DoD Systems, June 6, 2012

• DoDM 5200.01 VOL. 1, DoD Information Security Program: Overview, Classification, and Declassification, 24 February 2012

• DoDM 5200.01 VOL. 2, DoD Information Security Program: Marking of Classified Information Summary of Changes, CH 2, 19 March 2013

• DoDM 5200.01 VOL. 3, DoD Information Security Program: Protection of Classified Information Summary of Changes, CH 2, 19 March 2013

• DoDM 5200.01 VOL. 4, 2/24/2012 DoD Information Security Program: Controlled Unclassified Information (CUI) Summary of Changes, 24 February 2012

• DTM 08-027, Change-1, Security of Unclassified DoD Information on Non-DoD Information Systems, September 16, 2010

• NIST SP 800-18, Guide for Developing Security Plans for Federal Information Systems, February 2006

• NIST SP 800-30, Guide for Conducting Risk Assessments, September 2012

• NIST SP 800-37, Guide for Applying the Risk Management Framework to Federal Information, 5 June 2014

• CJCSM 3213.02D, Joint Staff Alternative Compensatory Control Measures (ACCM) Program Management Manual (Limited Distribution).

USTRANSCOM:

• USTRANSCOM Instruction 31-02, USTRANSCOM Security Classification Guide, 9 October 2015

• USTRANSCOM Instruction 31-12, USTRANSCOM Operations Security – OPSEC, 19 February 15

FORMS:

• FD Form 258, fingerprint Card.

DoD publications, directives, and instructions listed above are available at:

http://www.dtic.mil/whs/directives/corres/pub1.htm

NOTE TO THE PRIME CONTRACTOR FACILITY SECURITY OFFICER (FSO):

The prime contractor will forward the name, address, email address and telephone number of the Company FSO and backup to the USTRANSCOM Protection Programs Division TCJ3-MP to:

steven.m.strait@mail.mil and steven.g.stegen.civ@mail.mil USTRANSCOM Protection Programs Division (Industrial Security) Points of Contact:

USTRANSCOM

Attn: TCJ3-MP (Steve Strait or Steve Stegen) 508 Scott Drive Scott AFB IL 62225 Commercial: 618-220-6531/220-7892 (respectively)

USTCJ3-MP Approval: Steven M. Strait, USTRANSCOM (Protections Programs Branch) USTCJ3- MP Tracking #: USTRANSCOM-MP-0088-19

Appendices:

1. Projected DP3 survey totals

2. List of Potential CSS Questions and Stages

3. Visual Representation

4. Milmove/DPS/IGC – Systems Providing Triggers

5. NIST.SP.800-171_POAM_Template

6. CUI Requirements Table