Atch 1 - DRAFT PWS PMRATS 20251016.pdf

RFI TRANSCOM26C001

Attachment 1

DRAFT PERFORMANCE WORK STATEMENT (PWS)

FOR

POINT MUGU RANGE AIR TRANSPORTATION SERVICES

TRANSCOM26C001

16 October 2025

1. Description of Services.

1.1. Background. The Naval Base Ventura County, Point Mugu, operates and maintains station facilities and provides logistics services. Naval Air Warfare Center, Weapons Division (NAWCWD) at Point Mugu, CA and the Point Mugu Sea Range (PMSR) have defined the mission and requirements for this contract. Naval Test Wing Pacific (NTWP) and Air Test and Evaluation Squadron 30 have been assigned to monitor and schedule activities in support of NAWCWD and PMSR. In support of this mission, commercial services are required to support air transportation of passengers/cargo in and around Point Mugu as well as drone recovery operations and range test support on the PMSR as described below.

1.2.Scope. Except as otherwise stated, the contractor shall provide all personnel, facilities, equipment, supplies, materials, and services necessary for air transportation of passengers with personal baggage and/or cargo, drone recovery services and range test support to NAWCWD, Point Mugu, CA to include Range Surveillance and Clearance (RS&C). Fixed-wing transportation is required in and around the Southern CA area within a 200 nautical mile radius of Point Mugu, CA. Rotary-wing transportation is required between Ventura County airports (Naval Base Ventura County, Point Mugu, CA and Oxnard Airport, Oxnard, CA) and San Nicolas Island, CA, Santa Cruz Island, CA, within a 1.5 flight hour duration of Point Mugu.

Occasional flights may be scheduled outside of the 1.5-hour range. Drone recovery operations will be performed on the NAWCWD Point Mugu Sea Test Range and other ranges as required.

Range test support may include surveillance and clearance of marine vessels on the Sea Test Range, marine mammal monitoring, and the carriage of electronic test equipment and tracking devices as required.

1.3. Specific Tasks.

1.3.1. Aircraft.

1.3.1.1. Fixed Wing. Fixed-wing aircraft providing range test support are required as follows:

1.3.1.1.1. Fixed-wing aircraft with a minimum payload capability of 800 lbs. and flight range of 200 nautical miles and the capability of carrying up to four passengers, cargo, or any combination up to the capacity of the aircraft are required.

1.3.1.1.2. Fixed-wing aircraft with a minimum payload capability of 1600 lbs. and flight range of 200 nautical miles and the capability of carrying up to eight passengers, cargo, or any combination up to the capacity of the aircraft are required.

1.3.1.1.3. The Contractor shall provide fixed-wing aircraft with a separate cargo area suitable for large, bulky cargo. The aircraft shall be equipped to operate Ultra High Frequency (UHF) radios capable of transmitting and receiving on Navy frequencies.

1.3.1.1.4. Radar Range Surveillance. The Contractor shall provide support, on an hourly basis, to support NTWP and PMSR operational requirements in accordance with (IAW) priorities established by the Government. The Contractor shall provide a fixed wing aircraft, radar, and radar operators capable of meeting the requirements of Table 1 and shall be certified by PMSR for range clearance. For aircraft and radar systems not currently certified, the contractor and PMSR will work together to determine the flight profiles required to demonstrate the “Radar System Capabilities” of Table 1 for certification. For Radar Range Surveillance missions, aircrew will support Pre-Flight and Post-Flight briefings. Telephone support may be acceptable for aircrew experienced in supporting at PMSR, but in person briefs will occasionally be required. Note: When Radar Range Surveillance is used, Commercial Airlift Review Board (CARB) approval is not required if there are no government equipment, cargo, or personnel onboard. For all other requirements of this PWS, CARB approval is required.

Table 1: Radar Range Surveillance Requirements

Attribute Threshold Objective Aircraft Capabilities

Ceiling/Visibility Minimums for Operation 200ft / 0.5mi N/A

Radar System Capabilities Positional Accuracy of Track at Probability of Detection (Pdet) Range

0.5 NM N/A

Probability of Detection (Pdet) on the first pass 90% N/A

Sea State 3 N/A Target Size 3 m2 N/A PD Range 20 NM 25 NM Surveillance Rate 3,600 NM2/hr > 5,200 NM2/hr

Persistence 4 hours continuous (when surveillance area is 40nm from Point Mugu)

8 hours (when surveillance area is > 40nm from Point Mugu) can be accomplished with multiple sorties, multiple aircrew, and/or multiple aircraft

Other Aircraft System Capabilities Satellite Communications

(SATCOM)

No Yes

Vessel Classification Yes N/A Maritime VHF Radio Yes N/A

Attribute Threshold Objective Very High Frequency (VHF) radios Yes N/A

Ultra High Frequency (UHF) radios Yes N/A

UHF and VHF backup (can be single dual band radios)

Yes N/A

High Frequency (HF) radio No Yes

Automatic Identification System (AIS)

Yes. AIS tracks should be able to be correlated to the radar tracks real-time onboard N/A

1.3.1.2. Rotary-Wing. Rotary-wing aircraft shall be capable and equipped to support operations during non-daylight hours and have the capability of landing on pitching and rolling decks of ships at sea. Contractor operations to shipboard landings shall comply with all requirements of OPNAV Instruction 3100.8C. Rotary-wing aircraft shall have the capability to be equipped with UHF radios capable of transmitting and receiving Navy frequencies. The UHF radio will be contractor-provided. Rotary-wing aircraft providing test range support are required as follows:

1.3.1.2.1. Rotary-wing aircraft with a minimum payload capability of 1000 lbs.

and flight duration at least 1.5 hours and the capability of carrying up to five passengers, cargo, or any combination up to the capacity of the aircraft are required.

1.3.1.2.2. Rotary-wing aircraft with a minimum payload capability of 2500 lbs.

and flight duration at least 2.0 hours and the capability of carrying up to nine passengers, cargo, or any combination up to the capacity of the aircraft are required.

1.3.1.2.3. Rotary-wing aircraft is required for locating, recovering, and transporting 500 lb. and 2500 lb. drones from open sea environments. The aircraft crew shall be capable of drone recovery and lifting, utilizing required equipment operating approximately three feet above the water, in accordance with Federal Aviation Regulation (FAR) Part 133, and transporting recovered drones to Naval Air Station (NAS) Point Mugu, CA. Drone recovery missions are estimated to take 1 to 1.5 hours for target location and hook-up. An additional 20-30 minutes is the average time for return transport of the drones to NAS Point Mugu, CA. Total drone recovery operations must be completed within two hours of mission initiation. Some missions will require all drone recovery crew to have a SECRET clearance. These missions will be identified by the Contracting Officer Representative (COR) during scheduling.

1.3.2. Scheduling.

1.3.2.1. Prior to the start of the contract, the contractor shall furnish to the

Contracting Officer (CO) and the COR the contract liaison point of contact (POC) name, address, telephone number and e-mail address of the agent who shall serve as a liaison between the contractor and the COR. This person must have authority to adjust schedules, engage substitute airlift, and make decisions pertinent to the airlift for the contractor. The Contractor shall provide updated POC information to the CO and COR within 24 hours of change in POC information. In addition, the contractor will provide a telephone number that shall be manned from 0700 to 1700 on all work days.

1.3.2.2. Flights will normally be scheduled at least 24 hours in advance. Flights with less than 24 hours’ notice shall be scheduled only by mutual agreement between the contractor and the COR. Normal duty hours are from 0600 to 1800 local time, Monday through Friday. Occasional flights may be required during the night hours, holidays, and weekends.

1.3.2.3. The contractor’s aircraft shall be in position, unless unavoidably delayed by inclement weather or air traffic control delays, to depart on time. The contractor shall give timely notification to the Government’s flight scheduler of all delays in excess of 30 minutes of accomplishing the scheduled flight, including cancellations.

1.3.2.4. When directed by the Government, the contractor may be required to periodically standby for flights performed under the air transportation Contract Line-Item Number(s) (CLINs). The first hour of standby time, for each standby period, will be at no cost to the Government. Standby time shall commence one hour after the scheduled departure time or one hour after the aircraft is in place ready for loading, whichever is later. Standby time shall commence one hour after the aircraft is offloaded at destination and shall end when the authorized government representative releases the aircraft for departure, makes the determination that the aircraft will remain overnight, or the COR cancels the flight. Standby time will not be chargeable to the Government for contractor-controlled delays or for those caused by Acts of God or weather conditions below minimums, which preclude takeoff or flight to the destination.

For the purpose of payment, standby time will be computed to the nearest one-tenth hour increment.

1.3.2.5. If the requirement changes after the confirmed schedule is provided to the contractor, the flight scheduler may cancel or reschedule flights. A notice of cancellation may be given to the contractor at any time prior to departure. The contractor shall be reimbursed for one hour of flight time if a flight is cancelled after departure from base of operation. All efforts will be made by the government’s flight scheduler to provide the contractor with ample notice of changes or cancellations in the flight schedule. No changes in the prescribed flight schedule will be made without the authorization of the government’s flight scheduler. Any verbal changes made after hours by the flight scheduler will be confirmed in writing the next day.

1.3.3. Additional Requirements.

1.3.3.1. The government shall be entitled to transport passengers (including their personal baggage) and/or cargo up to the entire capacity of the aircraft without reconfiguration from what is required for normal contract performance. To compute aircraft payload, the contractor will use Federal Aviation Administration (FAA) approved weight and balance methods and procedures, ensuring that all operations are conducted within FAA approved limits and in accordance with all required operational authorizations, including CARB approval.

1.3.3.2. The contractor shall comply with all pertinent military regulations and/or directives, which pertain to the conduct of contractor personnel in military flight patterns and on military installations as well as maintaining required FAA certifications. Regulations can be obtained from the Airfield Operations Manager at Naval Base Ventura County Air Operations Department (805) 989-8521, https://www.airnav.com/airport/KNTD or NBVCINST 3710.7(Air Operations Manual).

1.3.3.3. The contractor shall provide an Aircraft Sortie report monthly within 7 calendar days of the conclusion of the month, which includes type and total number flights scheduled as well as flights completed to include duration and standby time. This report will also include names of passengers carried if required by the government.

1.3.3.4. Emergency survival equipment must be carried on aircraft as outlined in

Sec 135.167, 14CFR under FAR. The contractor shall comply with FAR, Part 135 concerning emergency equipment over extended overwater operations.

1.3.3.5. Unauthorized Personnel. The contractor shall not permit unauthorized persons to board the aircraft. At each departure airfield the contractor shall ensure that an accurate passenger manifest is left with appropriate airfield authorities, e.g. military air operators or civilian Fixed Base Operators (FBO) personnel.

1.3.3.6. Baggage. The contractor is responsible for the loss and/or damage to passenger baggage and personal equipment while such items are in his custody or on board his aircraft. Liability for these items is limited to the actual value thereof, coverage commensurate with the commercial standard.

2. Deliverables and Schedule and Service Delivery Summary.

2.1. Deliverables Schedule. All deliverables shall be submitted directly to the COR electronically in Microsoft Office (e.g., Word, Excel, Power Point, Project) format. Deliverables shall be identified by contract number, PWS task/subtask number, and deliverable title. All deliverables must meet professional standards and comply with the requirements set forth in this

PWS.

PWS Para Deliverable Title

Initial Delivery Due Date

Government Review

Timeframe

Final Delivery Due Date

1.3.2.1 Contractor

Liaison Information

Prior to contract start date and within 24 hours of liaison information changes

N/A Prior to contract award and within 24 hours, as needed, for POC information changes

1.3.3.3 Sortie Report Within 7 calendar days

from the conclusion of each month of performance

Ongoing, monthly review

Within 2 work days of Government identified discrepancy https://www.airnav.com/airport/KNTD

3.7 Incident

Report

Within 24 hours of accident or incident

Ongoing until after action is resolved, if any

Within 24 hours of accident or incident

3.4 Verification

of Insurance Coverage

Written verification of insurance coverage to be provided to the CO prior to contract award and annually thereafter

Annually with additional updates as required per paragraph 3.4.2

N/A

4.3 Cybersecurity

Incident Reporting

As soon as practical but no later than 72 hours after discovering a reportable cyber-incident

Ongoing until cyber incident resolved

Follow-on cyber incident report, if necessary, within 5 calendar days of becoming aware of a reportable cyber incident

2.2. Service Delivery Summary (SDS). The SDS summarizes desired outcomes and identifies the performance thresholds/metrics that will be tracked to determine whether the desired outcomes are being achieved. Although not all PWS requirements are listed in the SDS, the Contractor is fully expected to comply with all requirements in the PWS and elsewhere in the contract (e.g., contract clauses).

Table 2: SDS Desired

Outcome

PWS

Para

Performance Threshold (Metric)

Source of Data

How Often

Collected

Calculation

Required Licenses

1.3.3.1, 1.3.3.2, 1.3.3.4, 4.5

100% compliance with licensing directives, regulations and requirements

Qualification Report & Contractor Reporting

Annually and Spot Inspection

# of days available / total # of days in the year.

Provide and maintain fixed-and rotary-wing aircraft, and range test support as required

1.3.1.1 1.3.1.2

95% of the time, within 24-hour notification measured monthly

SITREP

Report

Monthly # of days available / total # of days in the month

Maintain on-time Schedule

1.3.2 90% of monthly missions reported with an on-time takeoff

Sortie Report Monthly # of missions delayed by longer than 30 minutes / # of missions scheduled

Provide timely Cyber-incident reporting

4.3 No more than one

late cyber-incident report or unreported cyber-incident in a twelve (12) month period

Incident Report

As Required

# of late reports or unreported cyber-incidents per 12-month period

Drone Recovery Schedule

1.3.1.2.3 90% of monthly drone recovery missions scheduled completed within 2 hours of mission initiation

Sortie Report Monthly Time is longer than 2 hours after mission initiation-takeoff time / # of drone missions scheduled

3. General Information.

3.1. Post Award Pre-Performance Conference. The contractor shall attend a post-award conference conducted by the Contracting Officer, if one is held, prior to the start of performance. The contractor, at a minimum, shall be represented by his designated agent. The contractor shall be notified of the exact time and location of the conference not later than seven days prior to the scheduled conference date.

3.2. Government-Furnished Property and Services.

3.2.1. When the contractor is directed to land at Government installations, the following Government services will be received at these stations at no cost to the contractor:

ground handling of aircraft, air traffic control, and airfield safety protection.

3.2.2. The Government shall provide the contractor with a list of personnel authorized to schedule and request flights. While performing the services set forth in this contract, the contractor shall not permit any person to board the aircraft unless authorized by the COR.

3.3. Billing Information.

3.3.1. Except when otherwise noted at time of mission scheduling, billing will begin and end at Point Mugu, CA.

3.3.2. The contractor shall submit invoices. A detailed breakdown shall be submitted in the Misc Information area of Wide Area Workflow (WAWF) as an attachment.

3.3.3. Reimbursable Services and Cost.

3.3.3.1. Reimbursable expenses, listed in the Schedule, shall be identified as separate items and shall be supported by paid receipts.

3.3.3.2. The Government will reimburse the Contractor, at cost, for airport fees assessed as a result of authorized performance under this contract. Examples of airport fees include landing and parking fees.

3.3.3.3. In the event the contractor’s crew is required to remain overnight on a mission, the contractor will be reimbursed per diem rates consistent with PL 99-234, Federal Civilian Employees and Contractor Travel Expenses Act of 1985 and FAR 31.205-46(a)(2), during the performance period of this contract for each authorized overnight lodging. Food and lodging arrangements are the contractor’s responsibility. Claims for food/lodging expenses shall be supported by paid receipts to the maximum extent possible. In the event paid receipts cannot be furnished, other documentation must be submitted.

3.3.4. Economic Price Adjustment. Economic Price Adjustment based on Actual

Cost of Fuel – Airlift: In order to protect the contractor and the government from significant market fluctuations in the price of fuel, an adjustment will be made based on actual costs incurred.

3.3.4.1. Economic price adjustment (EPA) is limited to changes in the contractor’s cost for fuel only.

3.3.4.2. Allowable fuel adjustments will be made upward or downward only if the price of fuel varies by more than one cent per gallon from the following pegged rate for fuel:

FUEL TYPE PEGGED RATE (Base Price)

JP-8 $4.03

JET-A $4.03

JET-A-1 $4.03

Av Gas 100LL $4.03

3.3.4.3. When the average price per gallon paid by the contractor is greater than the established base price indicated above, the government will reimburse the contractor the difference between the price paid and the established base price.

3.3.4.4. When the average price per gallon paid by the contractor is below the established base price indicated above, the contractor will reimburse the government the difference between the price paid and the established base price. Under these circumstances, the Contracting Officer will issue a demand letter and funds will be reimbursed as directed.

3.3.4.5. Reporting requirements for adjustments are as stated in the contract, but no later than 30 days after month’s end.

3.3.4.6. The actual average cost per gallon under this EPA clause shall be rounded to four decimal positions (e.g., $2.3699).

3.3.4.7. For the Contracting Officer to consider any request for adjustment, the contractor shall submit data that clearly supports any request for adjustment. At a minimum, the contractor shall submit: 1) total mileage and time flown in performance of the contract; 2) fuel costs associated with that performance; and 3) associated financial data or receipts, as required by the contract.

3.3.4.8. Fuel adjustments will be made using the CLIN titled “X003 Fuel”. The following steps will be taken to determine the adjustment:

3.3.4.9. The contractor’s fuel burn rate, established in the List of Aircraft in the contract, is multiplied by the total hours flown in performance of the contract.

3.3.4.10. The product is then multiplied by the difference between the average price per gallon paid and the established base price in the contract (also known as the variance).

Example Hours flown in support of the contract = 23,654 Burn rate for aircraft type (in schedule) = 4.21 gallons per hour Base price of fuel established in the contract = $2.50 Actual average cost per gallon = $2.6308

Calculation

Hours * Burn Rate * EPA Price Variance = Adjustment 23,654 * 4.21 = 99,583.34* $0.1308 = $13,025.50

3.4. Air Carrier Insurance Requirements.

3.4.1. Prior to performance of any services hereunder, the contractor shall, at its own expense procure and maintain during the entire performance period of this contract, with a financially and legally responsible insurance company, at least minimum insurance coverage as required by FAA and DOT.

3.4.2. The contractor will provide written verification of insurance coverage to the

Contracting Officer at USTRANSCOM TCAQ-R, 508 Scott Dr, Scott AFB IL 62225-5357 prior to the contract award. The contractor shall provide annual proof of insurance from the insurance provider to the Contracting Officer. In the event of a planned cancellation or material change in policy coverage, thirty (30) days prior written notice shall be given to the Contracting Officer. In the event of an unplanned cancellation or material change in policy coverage, notice shall be given to the Contracting Officer as soon as possible.

3.5. Landing Permits. To permit the use of military installations, the contractor must obtain landing permits following service specific instructions no later than 30 days prior to required approval date. The contractor shall begin the renewal process at least 60 days prior to expiration to allow for any delays in processing and to avoid a suspension on operator.

3.5.1. AIR FORCE BASES. Pursuant to AFI 10-1001, a Landing Permit (DD Form

2401) may be obtained from USTRANSCOM/TCAQ-C at Scott AFB, IL. In addition, a Hold Harmless Agreement (DD Form 2402) and the Certificate of Insurance (DD Form 2400) must be completed and forwarded to the CO at USTRANSCOM TCAQ-C, Scott AFB, IL. The Contractor shall submit these completed forms along with the DD Form 2401.

3.5.3. NAVY/MARINE CORP AIR STATIONS. Call Ms. Audrey Taylor for instructions at (202) 685-9202, audrey.taylor@navy.mil or access https://portal.navfac.navy.mil/portal/page/portal/extranet/afl/afl_airfields_tab Begin the process no later than 60 days prior to required approval date.

3.5.4. ARMY INSTALLATIONS. POC: Corey Howard -

corey.d.howard8.civ@mail.mil

3.6. Airfield Suitability and Restrictions/Certification Airfields.

3.6.1. Contractors are reminded that airfield restrictions exist at certain military and commercial airfields worldwide. An Air Mobility Command (AMC) publication, entitled "Airfield Suitability and Restrictions Report," identifies airfield restrictions specifically for AMC aircrews. This publication also lists "certification airfields" which are equivalent to FAA-designated "special airfields." These fields have unique airfield hazards and operating procedures requiring increased awareness and familiarity by air crews. US Government Contractors with a need to know can obtain the current edition of this publication, at no cost, by contacting the following office:

HQ AMC AIRFIELD SUITABILITY (A3AS)

310 W MARTIN ST

BLDG 1625, DEPT 1632-07

SCOTT AFB, IL 62225-5011

HQ AMC/A3AS TELEPHONE: (618) 229-3112

Email address airfield.helpdesk@us.af.mil

3.6.2. This publication is prepared for use by AMC aircrews and is made available to contractors for advisory purposes only.

3.6.3. Additionally, DOW, through the Defense Imagery Management Operations

Center (DIMOC), produces “Airport Qualification Program” (AQP) videos for some certification airfields. This contract requires that at least one pilot member of an aircrew, operating a DOW contract mission into a DOW-designated certification airfield, shall have performed pilot duties to that airfield within the past 12 months or reviewed an FAA- accepted pictorial, e.g., video, detailing airfield hazards within 30 days prior to performing the DOW contract mission. These are available for advisory purposes only, at no cost (one copy per contractor), by contacting the following office:

DIMOC TELEPHONE: (888) 743-4662

Building 3, Room 105 FAX: (570) 895-6106 11 Hap Arnold Blvd. E-Mail: askdimco@dma.mil Tobyhanna, PA 18466-5102 Website: http://defenseimagery.mil

3.6.4. Contractors shall ensure that aircrews are adequately briefed on all restrictions at applicable airfields, including certification airfields, and properly trained before performing mailto:corey.d.howard8.civ@mail.mil mailto:airfield.helpdesk@us.af.mil any DOW contract mission into these airfields.

3.7. Notice of Accidents or Incidents. All Carrier Operations (both Commercial and

Government customers). When a Contractor’s aircraft is involved in any accident, DOW or otherwise, the Contractor shall transmit the information in paragraph #1-8 below to Headquarters AMC, via HQ AMC/A3B, Scott AFB IL (618) 229-4801/DSN 779-4801 or the HQ AMC/A3B Safety Manager at 618-229-2106/DSN 779-2106 and to the CO and the COR. Accident and incident information shall be provided to HQ AMC, the CO and the COR/ACOR by the most expeditious means available. Accidents and incidents are defined in 49 CFR Part 830.

(1) Event schedule identifier

(2) Aircraft type and number

(3) Date and time of the accident or incident

(4) Last point of departure and point of intended landing of the aircraft, as applicable

(5) Nature of the accident or incident and extent of known damage to the aircraft, if any

(6) Total number of crew members and passengers on board

(7) Number of injured and fatalities aboard the aircraft

(8) Condition of baggage or Government-owned material, if any, on board

3.8. General Security Information. The majority of daily work associated with this PWS is at the UNCLASSIFIED level, but contractor personnel may be required to access classified information/systems at the SECRET level, and/or classified areas at the SECRET level, during the performance of this contract/task order. FAR Clause 52.204-2, Security Requirements, applies to the extent of this contract/task order involving access to information, areas, or material classified “CONFIDENTIAL” or “SECRET”. Specific security protocols for contracted companies are outlined in 32 CFR Part 117, National Industrial Security Program Operating Manual (NISPOM), identified in this section of the PWS, and the DD Form 254 (DoD Contractor Security Classification Specification). A completed/signed DD Form 254 will be attached to the contract/task order.

3.8.1. Personnel Security Requirements. The contractor’s, subcontractors, and/or partner’s personnel performing services under this contract, shall be citizens of the United States of America. Personnel who are dual citizens must be identified to the COR and must obtain a final security clearance before reporting to perform services under this contract. Dual citizens will not be given access to classified information/areas on the basis of an interim clearance. The contractor, subcontractor(s), and/or partner(s) shall possess the capability to articulate well, speak and write fluently in the English Language, and comprehend the English Language.

Overall, all contractor personnel shall possess the appropriate personnel security investigation for the position occupied. Contractor personnel shall be required to have a background investigation that corresponds with the sensitivity level of the tasks to be performed.

The following guidance will be followed when determining background investigation and clearance levels for this contract depending on requirements. No personnel will require IT/ADP/Critical Sensitive levels in support of this requirement.

IT-II/ADP-II/Non-Critical Sensitive Positions Those positions in which the incumbent is responsible for the direction, planning, design, operation, or maintenance of a computer system, and whose work is technically reviewed by a higher authority of the ADP-I category to ensure the integrity of the system.

(IT-II/ADP-II/Non-Critical Sensitive) Background Investigation Requirements:

Positions designated by the Government at the Non-Critical Sensitive/ADP-II/IT-II rating require a National Agency Check with Local Credit (NACLC) (or acceptable periodic reinvestigation) favorably adjudicated (a favorable adjudication grants eligibility at the SECRET level as prescribed by DOD 5200.2-R). The IT-II/ADP-II requirement mandates the contractor have a minimum FCL at the SECRET (or higher) level due to investigation submissions as directed in DOD 5220.22-M, DOD 5200.1-R and JPAS.

IT III/ADP III/Non-Sensitive Positions All other positions involved in computer activities and Common Access Card / PIV Card issuance. No clearance is granted for classified access and only a Position of Trust is awarded and posted in the Joint Personnel Adjudication System (JPAS).

(IT-III/ADP-III/Non-Sensitive) Background Investigation Requirements:

Positions designated by the Government at the Non-Sensitive/ADP-III/IT-III rating require a National Agency Check with Inquiries (NACI) (or acceptable investigation/reinvestigation) favorably adjudicated (a favorable adjudication issues a Position of Trust determination as prescribed by DOD 5200.2-R and DOD DTM 08-003 (Dated Dec 08). Favorable NACI or equivalent investigation results must be posted in JPAS before a Common Access Card (CAC) or NIPRNET access will be granted. To obtain interim CAC/NIPRNET access, NACI investigations will be opened with fingerprint, name and criminal records checks returned favorably before the credentials (CAC and NIPRNET) are issued. NACI submissions will be completed on the Standard Form (SF) 85P and submitted with fingerprint cards (FP 258) to USTRANSCOM Force Protection, Security Services Center (SSC) for processing. No classified access will be granted based on the NACI investigation.

NOTE: The above requirements for IT-III/ADP-III/Non-Sensitive Positions are for access to unclassified systems only. Contractors who require access to classified systems or areas must have interim or final adjudication of background investigations at the Critical or Non-Critical Sensitive levels.

The contractor needs to understand and be aware that USTRANSCOM will only process NACI/Position of Trust investigations. These background investigations are not the DOW prescribed personnel security investigations for classified access. It is incumbent upon the contractor to have the appropriate investigations completed upon start of the contract.

Language, and comprehend the English Language. Overall, all contractor personnel shall possess the appropriate personnel security investigation for the position occupied. Contractor personnel shall be required to have a background investigation that corresponds with the sensitivity level of the tasks to be performed.

The following guidance will be followed when determining background investigation and clearance levels for this contract depending on requirements. No personnel will require IT/ADP/Critical Sensitive levels in support of this requirement.

IT-II/ADP-II/Non-Critical Sensitive Positions Those positions in which the incumbent is responsible for the direction, planning, design, operation, or maintenance of a computer system, and whose work is technically reviewed by a higher authority of the ADP-I category to ensure the integrity of the system.

(IT-II/ADP-II/Non-Critical Sensitive) Background Investigation Requirements:

Positions designated by the Government at the Non-Critical Sensitive/ADP-II/IT-II rating require a National Agency Check with Local Credit (NACLC) (or acceptable periodic reinvestigation) favorably adjudicated (a favorable adjudication grants eligibility at the SECRET level as prescribed by DOD 5200.2-R). The IT-II/ADP-II requirement mandates the contractor have a minimum FCL at the SECRET (or higher) level due to investigation submissions as directed in DOD 5220.22-M, DOD 5200.1-R and JPAS.

IT III/ADP III/Non-Sensitive Positions All other positions involved in computer activities and Common Access Card / PIV Card issuance. No clearance is granted for classified access and only a Position of Trust is awarded and posted in the Joint Personnel Adjudication System (JPAS).

(IT-III/ADP-III/Non-Sensitive) Background Investigation Requirements:

Positions designated by the Government at the Non-Sensitive/ADP-III/IT-III rating require a National Agency Check with Inquiries (NACI) (or acceptable investigation/reinvestigation) favorably adjudicated (a favorable adjudication issues a Position of Trust determination as prescribed by DOD 5200.2-R and DOD DTM 08-003 (Dated Dec 08). Favorable NACI or equivalent investigation results must be posted in JPAS before a Common Access Card (CAC) or NIPRNET access will be granted. To obtain interim CAC/NIPRNET access, NACI investigations will be opened with fingerprint, name and criminal records checks returned favorably before the credentials (CAC and NIPRNET) are issued. NACI submissions will be completed on the Standard Form (SF) 85P and submitted with fingerprint cards (FP 258) to USTRANSCOM Force Protection, Security Services Center (SSC) for processing. No classified access will be granted based on the NACI investigation.

NOTE: The above requirements for IT-III/ADP-III/Non-Sensitive Positions are for access to unclassified systems only. Contractors who require access to classified systems or areas must have interim or final adjudication of background investigations at the Critical or Non-Critical Sensitive levels.

The contractor needs to understand and be aware that USTRANSCOM will only process NACI/Position of Trust investigations. These background investigations are not the DOW prescribed personnel security investigations for classified access. It is incumbent upon the contractor to have the appropriate investigations completed upon start of the contract.

3.8.2. Facilities Clearance Level (FCL). The contractor must have a valid SECRET FCL at time of request for proposal submission due date. FCL procedures and security guidelines for adjudicative requirements are outlined in DoD 5220.22-M Operating Manual. FCLs and Interim FCLs must be awarded by the Defense Counterintelligence and Security Agency (DCSA) Facility Clearance Branch.

3.8.3. Personnel and Facilities Clearance Validation. Upon contract award, the contractor shall submit the names of contractor personnel to the USTRANSCOM Mission Assurance Division (TCJ34) Industrial Security Manager for vetting through JPAS to ensure investigative and clearance requirements have been satisfied. This shall be completed before the COR/Trusted Agent (TA) accesses the DoD Trusted Associate Sponsorship System (TASS) to create and approval a CAC application. If a contractor’s employee does not have the required investigative or security clearance level based on the Government’s determination, the contractor’s employee will be denied the ability to work in support of this contract.

3.8.4. The Government shall ensure the roles/privileges assigned to contractor personnel on the Government computing platforms are limited to the roles/privileges essential to that individual’s performance of his/her assignments. The Government may limit or revoke these roles or privileges for any reason.

3.8.5. If the Government notifies the contractor that the employment or the continued employment of any contractor personnel is prejudicial to the interests of or which endangers the security of the United States of America (USA), that employee shall be removed and barred from the worksite. Matters prejudicial to the interests of or which endangers the security of the USA include, but are not limited to, security deviations/incidents. This also includes credible derogatory information uncovered in background investigations and any information received through law enforcement channels. In such cases the contractor shall make any changes necessary in the appointment(s) of personnel at no cost to the Government.

3.8.6. No antiterrorism (AT) measures are required except compliance with those in force at the military installation the contractor employees may access.

3.8.7. Contractor employees with Transportation Worker Identification Credentials (TWIC) issued by the Transportation Security Administration (TSA) do not satisfy the DoD requirement for a background investigation for accessing classified information.

3.9. Non-Disclosure Agreement for Contractor Employees. In performance of this contract, the Contractor shall have access to sensitive, non-public information. The contractor agrees (a) to use and protect such information from unauthorized disclosure IAW DTM 08-027 - Security of Unclassified DOD Information on Non- DOD Information Systems, 31 July 2009;

(b) to use and disclose such information only for the purpose of performing this contract and to not use or disclose such information for any personal or commercial purpose; (c) to obtain permission of the Government before disclosing/discussing such information with a third party;

(d) to return and/or electronically purge, upon Government request, any non-public, sensitive information no longer require for contractor performance; and (e) to advise the Government of any unauthorized release of such information. Upon request, the contractor shall have its employees assigned to this contract execute a non-disclosure agreement for delivery to the Government. The Government will require contractor personnel to sign a non-disclosure statement to protect non-public information of other contractors and/or the Government.

3.10. Derogatory Information. If the Government notifies the contractor that the employment or the continued employment of any contractor personnel is prejudicial to the interests or endangers the security of the United States of America, that employee shall be removed and barred from the worksite. This includes security deviations/incidents and credible derogatory information on contractor personnel during the course of the task order’s period of performance as noted in JPAS. Personnel who have incident reports posted in JPAS will be denied the ability to support the task order until the issues have been resolved and the incident has been removed in JPAS. The contractor shall make any changes necessary in the appointment(s), at no additional cost to the Government. If any incident involves or may involve the mishandling of classified information or a potential Negligent Discharge of Classified Information, the USTRANSCOM TCJ3-M, Mission Assurance Division (618-220-6538/6531) will be notified within 24 hours during the normal work week and within 72 hours if the incident occurs over the weekend.

4. CYBER SECURITY

4.1. Operationally Critical Support

The services designated under this contract are “operationally critical support” as defined in Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012.

4.2. Cybersecurity Incident Reporting

4.2.1. In addition to the DFARS 252.204-7012 reporting requirements for unclassified systems and DoD Manual (DoDM) 5220.22, National Industrial Security Program Operating Manual (NISPOM) for classified systems, reportable cyber-incidents include, but are not limited to, the following:

4.2.1.1. Cyber-incidents as defined in Cyber Security Table 1.

4.2.1.2. Notifications by a federal, state, or local law enforcement agency or cyber-center (i.e., National Cyber Investigative Joint Task Force (NCIJTF), National Cybersecurity & Communications Integration Center (NCCIC)) of being a victim of a successful or unsuccessful cyber-event, anomaly, incident, insider threat, breach, intrusion, or exfiltration.

Cyber Security Table 1:

Incident Category Description

Root Level Intrusion Unauthorized privileged access to an IS. Privileged access, often referred to as administrative or root access, provides unrestricted access to the IS. This category includes unauthorized access to information or unauthorized access to account credentials that could be used to perform administrative functions (e.g., domain administrator). If the IS is compromised with malicious code that provides remote interactive control, it will be reported in this category.

User Level Intrusion Unauthorized non-privileged access to an IS. Non-privileged access, often referred to as user level access, provides restricted access to the IS based on the privileges granted to the user. This includes unauthorized access to information or unauthorized access to account credentials that could be used to perform user functions such as accessing Web applications, Web portals, or other similar information resources. If the IS is compromised with malicious code that provides remote interactive control, it will be reported in this category.

Denial of Service Denial of Service (Incident)—Activity that denies, degrades, or disrupts normal functionality of an IS or DoD information network.

Malicious Logic Installation of software designed and/or deployed by adversaries with malicious intentions for the purpose of gaining access to resources or information without the consent or knowledge of the user. This only includes malicious code that does not provide remote interactive control of the compromised IS. Malicious code that has allowed interactive access should be categorized as Root or User Level Intrusion incidents. Interactive active access may include automated tools that establish an open channel of communications to and/or from an IS.

Ransomware Malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable. Malicious actors then demand ransom in exchange for decryption. Ransomware actors often target and threaten to sell or leak exfiltrated data or authentication information if the ransom is not paid. Ransomware is a reportable incident that may be associated with multiple incident categories depending on the attack vector and execution.

4.2.2. If the cyber-incident affects a classified system, vulnerabilities associated with the incident will be classified per the current version of USTRANSCOM Instruction 31-02, Security Classification Guide.

4.3. Cybersecurity Incident Reporting Timelines. In addition to providing the notification required by DFARS 252.204-7012, the contractor is required to notify USTRANSCOM as soon as practical, but no later than 72 hours after discovering a reportable cyber-incident. The reporting timeline begins when the incident is discovered or reported to the company, its employees, contractors, or cybersecurity firm responsible for providing cybersecurity and response for the company. The contractor shall contact the USTRANSCOM Cyber Operations Center (CyOC) via phone at 618-817-4222. If the contractor does not immediately reach the CyOC via phone, the contractor shall send an email notification to transcom.scott.tcj6.mbx.cyoc-dodin-operations@mail.mil.

4.4. Mandatory Reporting Data.

4.4.1. The contractor shall work with the USTRANSCOM CyOC through resolution of the incident. Within 72 hours of becoming aware of a reportable cyber-incident, the contractor shall provide an initial notification of the incident, even if some details are not yet available, which includes, but is not limited to, the following information:

(a) Company Name

(b) Who will be the POC with contact information

(c) Contracting Officer POC (name, telephone, email)

(d) Overall Assessment –Description of incident, data at risk, mitigations applied

(e) Indicators of compromise

(f) Vector of attack (if known)

(g) Estimated time of attack (if known)

4.4.2. The contractor shall provide a follow-on cyber-incident report to the

USTRANSCOM CyOC within 5 days of becoming aware of a reportable cyber-incident, which includes, but is not limited to, the following information:

(a) Contractor unique Commercial and Government Entity (CAGE) code

(b) Contract numbers affected

(c) Facility CAGE code where the incident occurred if different than the prime Contractor location

(d) POC if different than the POC recorded in the System for Award Management (name, address, position, telephone, email)

(e) Contracting Officer POC (name, telephone, email)

(f) Contract clearance level

(g) DoD programs, platforms, systems, or information involved

(h) Location(s) of compromise

(i) Date incident discovered

(j) Type of compromise (e.g., unauthorized access, inadvertent release, other)

(k) Description of technical information compromised

(l) Any additional information relevant to the information compromise

4.3. Incident Reporting Coordination.

4.3.1. In the event of a cyber-incident, USTRANSCOM may conduct an on-site review of network or information systems where DoD information is resident on or transiting to assist the contractor in evaluating the extent of the incident and to share information in an effort to minimize the impact to both parties. Date and time of on-site visits will be mutually agreed mailto:transcom.scott.tcj6.mbx.cyoc-dodin-operations@mail.mil upon by USTRANSCOM and the contractor in advance.

4.3.2. The contractor agrees to allow follow-on actions by the Government (e.g., USTRANSCOM, Federal Bureau of Investigation, Department of Homeland Security, DC3, etc.)

to further characterize and evaluate the suspect activity. The contractor acknowledges that damage assessments might be necessary to ascertain an incident methodology and identify systems compromised as a result of the incident. Once an incident is identified, the contractor agrees to take all reasonable and appropriate steps to preserve any and all evidence, information, data, logs, electronic files and similar type information (reference NIST Special Publication 800- 61, Computer Security Incident Handling Guide, (current version)) related to the incident for subsequent forensic analysis so that an accurate and complete damage assessment can be accomplished by the Government.

4.3.3. The contractor is not required to maintain an organic forensic capability, but must ensure data is preserved (e.g., remove an affected system, while still powered on, from the network) and all actions documented until forensic analysis can be performed by the Government or, if the Government is unable to conduct the forensic analysis, a mutually agreed upon third party (e.g., Federally Funded Research and Development Center (FFRDC), commercial security contractor, etc.). Any follow-on actions shall be coordinated with the contractor via the Contracting Officer.

4.3.4. The contractor agrees to indemnify and hold the government harmless for following any recommendations to remedy or mitigate the cyber-incident following the actions under 4.3.1. and 4.3.2.

4.4. Confidentiality and Non-Attribution Statement. The Government may use and disclose reported information as authorized by law and will only provide attribution information on a need-to-know basis to authorized persons for cybersecurity and related purposes (e.g., in support of forensic analysis, incident response, compromise or damage assessments, law enforcement, counterintelligence, threat reporting, and trend analysis). The Government may share threat information with other USTRANSCOM industry partners without attributing or identifying the affected contractor.

4.5. Operations Security. OPSEC must be included in contracts to ensure that critical information is protected. The contractor shall be responsible for OPSEC procedures when operating missions for the DoD to include safeguarding critical information. Disclosing this information to the adversary could potentially affect mission success and cause harm to military members, civilians, and contractors and their families. OPSEC is a process used to protect unclassified sensitive information from exploitation by an adversary. Sensitive unclassified information—which is also referred to as critical information or critical program information (CPI)—is defined as information that is not classified but which needs to be protected from unauthorized disclosure. Examples are information labeled CUI, such as proprietary information, contractor sensitive information, limited distribution information, or personally identifiable information (PII). Contractors must ensure employees to include aircrew receive OPSEC training upon initial assignment and annually thereafter. Flight crews should be aware of persons who are seeking information about the contractor, flights, passenger units and equipment being transported, etc. They should seek to maintain a low profile while operating DoD missions. If the contractor has questions about OPSEC they can be addressed by the COR and USTRANSCOM.

4.5.1. Operations Security Requirements. The prime contractor and all subcontractors shall provide protection for sensitive unclassified information to limit unauthorized disclosures of critical information. The prime contractor and all subcontractors shall employ the countermeasures listed below to protect that information. These OPSEC requirements will be in effect throughout the life of the procurement from award through the conclusion of services at the end of the period of performance or other procurement termination.

In any case where uncertainty or ambiguity regarding OPSEC measures exists, the contractor shall consult the requirements or contracting office’s OPSEC coordinator as soon as possible.

4.5.2 Countermeasures to Unauthorized Disclosure of Critical Information.

Countermeasures are required to negate the susceptibility of critical information to exploitation by an adversary or competitor. The contractor shall protect all critical information listed in a manner appropriate to the nature of the information, including use of the necessary countermeasures as listed below applicable to specific items:

• Refrain from including critical information in contract and budget documents, presentations, press releases, and other publications to that which is essential to the performance of this…