Atch 1 - PWS_DCS FY25_06.27.2024 .pdf

Attachment 1

HTC71124RC003

PERFORMANCE WORK STATEMENT (PWS)

Defense Courier Scheduled (DCS) Air Transportation Service

27 June 2024

1.0 DESCRIPTION OF SERVICES

1.1 Background. USTRANSCOM Defense Courier Division (DCD) requires air transportation via commercial scheduled service routes to augment its global transportation network. DCD couriers must maintain constant positive control of all material during loading, transport, and unloading. Two DCD couriers will accompany their material during all movements between staging areas and the aircraft and board the aircraft after their material has been loaded and aircraft doors sealed. DCD may also employ a team of recovery couriers at the arrival location to assist the traveling couriers with maintaining positive control during loading and unloading. DCD couriers will conduct planeside inventories to ensure all material is accounted for prior to departure.

The services provided within the scope of this contract are considered Covered Defense Information (CDI) as defined in DFARS 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting.

1.2 Scope of Work. The contractor will provide seats for two (2) travel couriers with personal carry-on baggage and cargo space for containerized and/or loose loaded courier materials as described in this PWS. Service will primarily be within the Continental United States (CONUS) and between CONUS and Alaska and Hawaii. Secondary service will include international routes to planned destinations listed in this PWS in para 1.5 with the flexibility to use alternate routes if determined feasible and agreed upon by both the contractor and DCD.

1.3. General Requirements. Except as otherwise stated in this contract, the contractor shall provide all personnel, equipment, tools, facilities, supervision, and direct materials necessary for the performance of the air transportation for two (2) DCD couriers with personal carry-on baggage and classified/sensitive material on scheduled service air routes as specified. The contractor will transport DCD couriers together with the courier material during ground handling operations and allow DCD couriers to continually observe aircraft and material as described below. When contractor personnel require access to the cargo bay after it has been sealed, couriers will be permitted access planeside in a position which allows them to observe and monitor the status of courier material, except in cases where courier observation would seriously jeopardize safety.

1.3.1 Passenger Seating. The contractor shall provide travel couriers with passenger seating that is no less than folding observer seating. Passenger based airlines shall permit pre-boarding of travel couriers.

Courier pre-boarding requirements for cargo-based carriers will not apply. Travel couriers shall be seated in close proximity of one another (side by side or separated by no more than one seat or one row;

across aisle seating is acceptable on narrow-body aircraft). Seating shall be positioned to allow safe passage as couriers enter and exit the aircraft and shall be unencumbered by cargo or baggage.

Passenger air carriers will charge no more than the Government fare per seat. Cargo air carriers will charge no more than the average commercial airfare cost between major northeast airports and the San Francisco/Oakland/Sacramento area.

1.4 Specific Tasks.

1.4.1 Containerized/Palletized Material. All routes must use sealable containers loaded into the aircraft. Containers (igloo/cans) or pallets provided by the airline will be used when containerized transportation of material is needed. The contractor will provide pre-staged, airworthy/inspected, airline containers/pallets as requested by regional Defense Courier Stations. Individual Courier Stations will pick up containers/pallets and transport them between Courier Station and contractor’s facility. For stations that do not have transport capability of containers/pallets, the contractor will provide temporary space for Defense Couriers to load containers at the contractor location. Containers will be of various sizes based on material weight with doors properly aligned to permit couriers to apply lock/security seals. Contractor will replace any containers that do not meet these standards at no cost to the Government. Palletized material will be secured by shrink wrap or nets provided by the defense couriers. Any required contractor-unique pallet nets shall be provided by the contractor.

1.4.2 Loose Loaded Material. DCD courier material will not be loose loaded on aircraft unless it is in direct possession of the travel couriers for the duration of the flight. Material cannot be loose loaded into the belly of aircraft for any route.

1.4.3 Ground Handling. The contractor will transport two couriers along with the container(s) to and from aircraft during ground handling operations and make every possible effort to keep the material/containers within the courier’s line of sight to ensure material security, integrity, and positive control.

1.5 Service Routing.

CONUS: Contractor shall manifest flights and schedule aircraft for round-trip transportation through a servicing airport within 60 miles of the CONUS servicing locations identified in Table 1. Each location must have an available route to service each of the other CONUS servicing locations, either directly or through a centralized hub as identified in para. 1.5.1.

TABLE 1: CONUS Servicing Locations Servicing Location: State:

Buckley Space Force Base CO Ft Meade MD Hickam AFB HI Joint Base Elmendorf–Richardson AK Joint Base Lewis-McChord WA Lackland AFB TX Offutt AFB NE San Diego Naval Air Station CA Travis AFB CA Wright-Patterson AFB OH

OCONUS: Contractor shall manifest flights and schedule aircraft through a servicing airport within 80 miles of the OCONUS servicing locations identified in Table 2. Each OCONUS servicing location must have an available route to the connecting OCONUS/CONUS servicing location(s) as identified in Table 2.

TABLE 2: OCONUS Servicing Locations Servicing Location: Country: Connecting Location(s):

Andersen AB Guam Travis AFB or Yokota AB Mildenhall AB England Ft. Meade Ramstein AB Germany Ft. Meade Sydney Australia Travis AFB Yokota AB Japan Travis AFB Osan AB Korea Travis AFB or Hickam AFB

1.5.1 CONUS Centralized Hub. The Government requires a centralized hub connecting four CONUS servicing locations, at minimum, for simultaneous, single mission exchange of materials. Contractor shall identify and provide a centralized hub location for service to and from the four following CONUS servicing locations: Travis AFB, Buckley Space Force Base, Lackland AFB, and Ft. Meade. Contractor must provide a round-trip, direct route between these four locations and the centralized hub. Centralized hub location is determined by the contractor as proposed at time of award and may only be modified during performance by bilateral agreement with the Contracting Officer.

1.5.2 Additional CONUS Servicing Locations. Additional CONUS servicing locations with routing through the central hub, including but not limited to Jacksonville NAS (FL), Charleston AFB (SC), JB McGuire-Dix-Lakehurst (NJ) and Norfolk NAS (VA), may be tasked on an occasional basis. Due to the sporadic nature of these missions, Contractor shall coordinate scheduling details related to servicing airport and routing as necessary through the COR.

1.5.3 Current (Example) Routing. The Government currently utilizes round-trip transportation on the following routes to meet its service routing requirements identified above (Note: Many CONUS routes transit through centralized hub located in Memphis, TN):

Regular Stateside Routes:

Baltimore (BWI) to San Francisco (SFO), Oakland (OAK) or Sacramento (SMF) Baltimore (BWI) to San Antonio (SAT) Baltimore (BWI) to Denver (DIA) Baltimore (BWI) to Omaha (OMA) Denver (DIA) to Omaha (OMA) Denver (DIA) to San Antonio (SAT) San Francisco (SFO), Oakland (OAK) or Sacramento (SMF) to San Antonio (SAT) San Francisco (SFO), Oakland (OAK) or Sacramento (SMF) to Honolulu (HNL) San Francisco (SFO), Oakland (OAK) or Sacramento (SMF) to Anchorage (ANC) San Francisco (SFO), Oakland (OAK) or Sacramento (SMF) to Denver (DIA) San Francisco (SFO), Oakland (OAK) or Sacramento (SMF) to Seattle (SEA) San Francisco (SFO), Oakland (OAK) or Sacramento (SMF) to San Diego (SAN) Seattle (SEA) to Anchorage (ANC)

International Routes:

Oakland (OAK) to Anchorage (ANC) to Guam (GUM) Oakland (OAK) to Narita, Japan (JAA) Oakland (OAK) to Honolulu (HNL) to Seoul, S. Korea (KSI) Oakland (OAK) to Honolulu (HNL) to Sydney, Australia (SSY) Baltimore (BWI) to Newark (EWR) to Stansted, London (GSS) Baltimore (BWI) to Memphis (MEM) to Frankfurt, Germany (FRA)

1.6 Loading and Security.

1.6.1 Access. The contractor will permit couriers access to planeside for loading and offloading of material to ensure couriers have visibility of all courier material during transfer, onload, and offload.

The contractor will assist couriers in gaining unescorted airport access at each contracted airport location. In the event unescorted access is not available, the contractor will escort couriers and material planeside. On departing flights, the containers/loose loaded material must be under constant observation of traveling couriers until the aircraft door is sealed. On arriving flights, recovery couriers or traveling couriers must be prepositioned to view the cargo doors prior to opening and must observe container/material offload. Contractor must ensure couriers have constant view of the container(s)/material at all times. If couriers and courier material are transiting through a location, the contractor must provide a secure, temporary holding area for couriers to be out of the elements with constant ability to surveille the materials/sealed containers.

1.6.2 Diversions. In the event of a diversion, the two travel couriers on board must be permitted to deplane and preposition planeside prior to the aircraft cargo doors being opened. The couriers must maintain visibility over the cargo doors whether opened or closed and if opened must maintain constant visibility over material.

1.6.3 Missing/Damaged Material. In the event pieces of courier material are missing or damaged, contractor personnel will cooperate fully with courier requests for rechecking aircraft cargo/baggage compartments and will provide couriers with all available requested information, documentation, records, recordings, or otherwise. In the event actual classified information is exposed to contractor personnel, the affected individuals may be required to sign an Inadvertent Disclosure agreement to document understanding of their obligation to safeguard any sensitive information gained by the inadvertent exposure in accordance with 18 United States Code Sections 793 and 794.

1.7 Hours of Operation and Scheduling.

1.7.1 Government Liaison. Prior to the start of the contract, the contractor shall furnish the Contracting Officer Representative (COR) with the name, address, e-mail address, and telephone number of the agent(s) who will serve as liaison between the contractor and the Defense Courier Division identified by the COR. The agent(s) must have authority to book seating and cargo space on contracted routes and make decisions pertinent to the airlift service for the contractor. The agent(s) must be available during regular business hours and must provide an after-hour’s phone number to be used in the event of emergency.

1.7.2 Hours of Operation. Contractor liaison and the COR will work in concert to establish best mission hours for courier requirements.

1.7.3 Mission Scheduling. All scheduling, movement forecasts, and changes will be made by the Defense Courier COR or Ordering Officer (OO). The COR or OO is responsible for evaluating individual transportation requirements and making an independent best value decision prior to scheduling the transportation. The COR or OO will first consider required delivery date/time (which includes coordination of the couriers’ follow-on truck segment) when making a scheduling decision that provides the best value to the Government, price and other factors considered. The COR or OO will schedule the transportation (passenger and material) a minimum of five business days prior to execution and will provide finalized weight and requested container size no less than 48 hours prior to scheduled flight (unless mutually agreed to between the contractor and Government). Whenever possible, roundtrip missions will be scheduled. The contractor will reserve sufficient aircraft space to accommodate the quantity of material agreed upon during scheduling and will guarantee seat availability for couriers. Contractor caused changes to the schedule occurring within 72 hours of execution will be considered in the performance metrics at paragraph 3.0. The contractor shall only invoice for completed missions.

1.7.4 Delays. The contractor shall notify the regional Defense Courier Stations and the on-call OO immediately when any positioning or arrival times will vary by more than 1 hour from established times.

A list of contacts will be provided by the COR. A departure time that varies by more than 1 hour for a contractor-controllable reason shall be considered in the reliability metrics at paragraph 3.0.

1.7.5 Cancellations.

1.7.5.1 Route Cancellations. In the event of a route cancellation the contractor must provide the Contracting Officer written notice within 90 business days, that the route is being eliminated from scheduled service operations of the airline and must provide alternate routes.

1.7.5.2 Trip Cancellations. In the event an individual trip is cancelled after scheduling, rescheduling shall be as agreed to by the Government.

1.7.6 Ad Hoc Missions. The Government will coordinate with contractor when service to or from locations outside of normal established routes is required within 8 business days to establish contacts and pricing. Contractor refusal to support ad hoc missions may be considered in the reliability metrics at paragraph 3.0.

1.7.7 International customs/clearance support. The Contractor shall retain responsibility for furnishing appropriate agencies all required manifest, immigration, and border clearance documents, covering all personnel and cargo aboard the aircraft upon entry into the U.S. or a foreign country. The Government, through coordination with DCD and the COR and at the request of the Contractor, will provide the Contractor with all passenger and cargo data necessary for the completion of aircraft clearance including customs, immigration, public health, and similar documents.

1.8 Definitions and applicable publications.

Reserved.

2.0 DELIVERABLES

Reserved.

3.0 SERVICE DELIVERY SUMMARY

Performance Objective

PWS

Paragraph

Performance Threshold

Airworthy/inspected containers provided 1.4.1 100% of the time Visibility of cargo as required 1.6.1 100% of the time Scheduling Reliability 1.7.3 100% of the time Operational Reliability 1.7.4 95% of the time Rescheduling of cancelled trip 1.7.5.2 100% of the time Support Ad Hoc mission request 1.7.6 95% of the time Resolution of COR complaints 5.4 95% of the time

4.0 GOVERNMENT FURNISHED EQUIPMENT (GFE) AND SERVICES

4.1 Seals and shrink wrap will be provided by the Government. In the event carrier unique pallet nets are required, they shall be contractor furnished.

5.0 GENERAL INFORMATION

5.1 Only DoD Approved Air carriers or carriers that are eligible receive Commercial Airlift Review Board (CARB) approval may receive a contract award.

5.2 Transportation of hazardous material will not be required.

5.3 Aircraft Operator Standard Security Program exempts Government material from opening or x-ray screening. Bomb dogs or drug dogs are permitted for screening.

5.4 Quality complaints shall be resolved within 30 business days from the end of the month in which the complaint is received.

5.5 Contractor will submit invoices for material net weight (not to include container weight) and passenger movement fees through the same billing system.

5.6 Information Assurance

5.6.1 Requirement for Contractor Information Assurance (IA) Report

The contractor shall provide an Information Assurance Report to describe its environment’s safeguarding of DoD non-public information resident on or transiting the contractor's unclassified information systems from unauthorized access and disclosure. Protection measures applied should consider the risks (i.e., consequences and their probability) of loss, misuse, unauthorized access, or modification of information. The report shall address the SANS (SysAdmin, Audit, Network, Security) Institute's Twenty Critical Security Controls for Effective Cyber Defense: Consensus Audit Guidelines (http://www.sans.org/critical-security-controls) and be provided in accordance with the attached template at Attachment 01 to the PWS. The contractor is encouraged to provide additional information above and beyond what is outlined in the SANS guidelines to enhance the government’s understanding of the contractor’s information security posture. The report will be updated 30 days prior to exercise of an option period, if applicable.

6.0 CYBERSECURITY

6.1. Operationally Critical Support

The services designated under this contract are “operationally critical support” as defined in

DFARS 252.204-7012.

6.2. Cybersecurity Incident Reporting

6.2.1. In addition to the DFARS 252.204-7012 reporting requirements for unclassified systems and DoD Manual (DoDM) 5220.22, National Industrial Security Program Operating Manual (NISPOM) for classified systems, reportable cyber-incidents include, regardless of whether the information system contains CUI or there is an impact to the delivery schedule, but are not limited to, the following:

6.2.1.1. Cyber-incidents as defined in Table 1.

6.2.1.2. Notifications by a federal, state, or local law (including foreign) enforcement agency or cyber-center (i.e., National Cyber Investigative Joint Task Force (NCIJTF), National Cybersecurity & Communications Integration Center (NCCIC)) of being a victim of a successful or unsuccessful cyber-event, anomaly, incident, insider threat, breach, intrusion, or exfiltration.

Table 1.

Incident Category Description

Root Level Intrusion Unauthorized privileged access to an IS. Privileged access, often referred to as administrative or root access, provides unrestricted access to the IS. This category includes unauthorized access to information or unauthorized access to account credentials that could be used to perform administrative functions (e.g., domain administrator). If the IS is compromised with malicious code that provides remote interactive control, it will be reported in this category.

User Level Intrusion Unauthorized non-privileged access to an IS. Non-privileged access, often referred to as user level access, provides restricted access to the IS based on the privileges granted to the user. This includes unauthorized access to information or unauthorized access to account credentials that could be used to perform user functions such as accessing Web applications, Web portals, or other similar information resources. If the IS is compromised with malicious code that provides remote interactive control, it will be reported in this category.

Denial of Service Denial of Service (Incident)—Activity that denies, degrades, or disrupts normal functionality of an IS or DoD information network.

Malicious Logic Installation of software designed and/or deployed by adversaries with malicious intentions for the purpose of gaining access to resources or information without the consent or knowledge of the user. This only includes malicious code that does not provide remote interactive control of the compromised IS. Malicious code that has allowed interactive access should be categorized as Root or User Level Intrusion incidents. Interactive active access may include automated tools that establish an open channel of communications to and/or from an IS.

Ransomware Malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable. Malicious actors then demand ransom in exchange for decryption. Ransomware actors often target and threaten to sell or leak exfiltrated data or authentication information if the ransom is not paid. Ransomware is a reportable incident that may be associated with multiple incident categories depending on the attack vector and execution.

6.2.2. If the cyber-incident affects a classified system, vulnerabilities associated with the incident will be classified per the current version of USTRANSCOM Instruction 31-02, Security Classification Guide.

6.3. Cybersecurity Incident Reporting Timelines

6.3.1. In addition to providing the notification required by DFARS 252.204-7012, the contractor is required to notify USTRANSCOM as soon as practical, but no later than 72 hours after discovering a reportable cyber-incident. The reporting timeline begins when the incident is discovered or reported to the company, its employees, contractors, or cybersecurity firm responsible for providing cybersecurity and response for the company. The contractor shall contact the USTRANSCOM Cyber Operations Center (CyOC) via phone at 618-817- 4222. If the contractor does not immediately reach the CyOC via phone, the contractor shall send an email notification to transcom.scott.tcj6.mbx.cyoc-dodin-operations@mail.mil.

mailto:transcom.scott.tcj6.mbx.cyoc-dodin-operations@mail.mil

6.4. Mandatory Reporting Data

6.4.1. The contractor shall work with the USTRANSCOM CyOC through resolution of the incident. Within 72 hours of becoming aware of a reportable cyber-incident, the contractor shall provide an initial notification of the incident, even if some details are not yet available, which includes, but is not limited to, the following information:

6.4.1.1. Company Name

6.4.1.2. Who will be the POC with contact information

6.4.1.3. CO POC (name, telephone, email)

6.4.1.4. Overall Assessment –Description of incident, data at risk, mitigations applied

6.4.1.5. Indicators of compromise

6.4.1.6. Vector of attack (if known)

6.4.1.7. Estimated time of attack (if known)

6.4.2. The contractor shall provide a follow-on cyber-incident report to the USTRANSCOM CyOC within 5 days of becoming aware of a reportable cyber-incident, which includes, but is not limited to, the following information:

6.4.2.1. Contractor unique Commercial and Government Entity (CAGE) code

6.4.2.2. Contract numbers affected

6.4.2.3. Facility CAGE code, if applicable, where the incident occurred if different than the prime Contractor location

6.4.2.4. POC if different than the POC recorded in the System for Award Management (name, address, position, telephone, email)

6.4.2.5. CO POC (name, telephone, email)

6.4.2.6. Contract clearance level

6.4.2.7. DoD programs, platforms, systems, or information involve

6.2.3. If the cyber-incident affects a classified system, vulnerabilities associated with the incident will be classified per the current version of USTRANSCOM Instruction 31-02, Security Classification Guide.

6.3. Cybersecurity Incident Reporting Timelines

6.3.1. In addition to providing the notification required by DFARS 252.204-7012, the contractor is required to notify USTRANSCOM as soon as practical, but no later than 72 hours after discovering a reportable cyber-incident. The reporting timeline begins when the incident is discovered or reported to the company, its employees, contractors, or cybersecurity firm responsible for providing cybersecurity and response for the company. The contractor shall contact the USTRANSCOM Cyber Operations Center (CyOC) via phone at 618-817- 4222. If the contractor does not immediately reach the CyOC via phone, the contractor shall send an email notification to transcom.scott.tcj6.mbx.cyoc-dodin-operations@mail.mil.

mailto:transcom.scott.tcj6.mbx.cyoc-dodin-operations@mail.mil

6.4. Mandatory Reporting Data

6.4.3. The contractor shall work with the USTRANSCOM CyOC through resolution of the incident. Within 72 hours of becoming aware of a reportable cyber-incident, the contractor shall provide an initial notification of the incident, even if some details are not yet available, which includes, but is not limited to, the following information:

6.4.3.1. Company Name

6.4.3.2. Who will be the POC with contact information

6.4.3.3. CO POC (name, telephone, email)

6.4.3.4. Overall Assessment –Description of incident, data at risk, mitigations applied

6.4.3.5. Indicators of compromise

6.4.3.6. Vector of attack (if known)

6.4.3.7. Estimated time of attack (if known)

6.4.4. The contractor shall provide a follow-on cyber-incident report to the USTRANSCOM CyOC within 5 days of becoming aware of a reportable cyber-incident, which includes, but is not limited to, the following information:

6.4.4.1. Contractor unique Commercial and Government Entity (CAGE) code

6.4.4.2. Contract numbers affected

6.4.4.3. Facility CAGE code, if applicable, where the incident occurred if different than the prime Contractor location

6.4.4.4. POC if different than the POC recorded in the System for Award Management (name, address, position, telephone, email)

6.4.4.5. CO POC (name, telephone, email)

6.4.4.6. Contract clearance level

6.4.4.7. DoD programs, platforms, systems, or information involved

6.4.4.8. Location(s) of compromise

6.4.4.9. Date incident discovered

6.4.4.10. Type of compromise (e.g., unauthorized access, inadvertent release, other)

6.4.4.11. Description of technical information compromised

6.4.4.12. Any additional information relevant to the information compromise

6.5. Incident Reporting Coordination

6.5.1. In the event of a cyber-incident, USTRANSCOM may conduct an on-site review of network or information systems where DoD information is resident on or transiting to assist the contractor in evaluating the extent of the incident and to share information to minimize the impact to both parties. Date and time of on-site visits will be mutually agreed upon by USTRANSCOM and the contractor in advance.

6.5.2. The contractor agrees to allow follow-on actions by the Government (e.g., USTRANSCOM, Federal Bureau of Investigation, Department of Homeland Security, DC3, etc.) to further characterize and evaluate the suspect activity. The contractor acknowledges that damage assessments might be necessary to ascertain an incident methodology and identify systems compromised because of the incident. Once an incident is identified, the contractor agrees to take all reasonable and appropriate steps to preserve any and all evidence, information, data, logs, electronic files and similar type information (reference National Institute of Standards and Technology (NIST) Special Publication (SP) 800-61, Computer Security Incident Handling Guide, (current version)) related to the incident for subsequent forensic analysis so that an accurate and complete damage assessment can be accomplished by the Government.

6.5.3. The contractor is not required to maintain an organic forensic capability, but must ensure data is preserved (e.g., remove an affected system, while still powered on, from the network) and all actions documented until forensic analysis can be performed by the Government or, if the Government is unable to conduct the forensic analysis, a mutually agreed upon third party (e.g., Federally Funded Research and Development Center (FFRDC), commercial security contractor, etc.). Any follow-on actions shall be coordinated with the contractor via the CO.

6.5.4. The contractor agrees to indemnify and hold the government harmless for following any recommendations to remedy or mitigate the cyber-incident following the actions under

6.5.1. and 6.5.2.

6.6. Confidentiality and Non-Attribution Statement

The Government may use and disclose reported information as authorized by law and will only provide attribution information on a need-to-know basis to authorized persons for cybersecurity and related purposes (e.g., in support of forensic analysis, incident response, compromise or damage assessments, law enforcement, counterintelligence, threat reporting, and trend analysis). The Government may share threat information with other USTRANSCOM industry partners without attributing or identifying the affected contractor.

6.7 Reference documents:

- Executive Order (E.O.) 13691 of February 13, 2015. Promoting Private Sector Cybersecurity Information Sharing

- NIST Special Publication 800-61 Computer Security Incident Handling Guide

- USTRANSCOM Instruction 31-02, Security Classification Guide

7.0 Security

7.1 Operations Security (OPSEC)

OPSEC must be included in contracts to ensure that critical information is protected.

Disclosing this information to the adversary could potentially affect mission success and cause harm to military members, civilians, and contractors and their families. OPSEC is a process used to protect unclassified sensitive information from exploitation by an adversary. Sensitive unclassified information—which is also referred to as critical information or critical program information (CPI)—is defined as information that is not classified but which needs to be protected from unauthorized disclosure. The government will identify what information is sensitive/critical information.

7.2 Operations Security Requirements

The prime contractor and all subcontractors shall provide protection for sensitive unclassified information to limit unauthorized disclosures of critical information. The prime contractor and all subcontractors shall employ the countermeasures listed below to protect that information.

These OPSEC requirements will be in effect throughout the life of the procurement from award through the conclusion of services at the end of the period of performance or other procurement termination. In any case where uncertainty or ambiguity regarding OPSEC measures exists, the contractor shall consult the requirements or contracting office’s OPSEC coordinator as soon as possible.

7.3 Countermeasures to Unauthorized Disclosure of Critical Information Countermeasures are required to negate the susceptibility of critical information to exploitation by an adversary or competitor. The contractor shall protect all critical information listed in a manner appropriate to the nature of the information, including use of the necessary countermeasures as listed below applicable to specific items:

• Transmission of critical information to the minimum set of recipients with a need-to-know.

• Immediate and appropriate destruction in a manner precluding reconstruction of all critical information no longer needed under this contract.

• Restricting verbal discussion of critical information to venues and circumstances that prevent the monitoring and interception of the discussion by unauthorized personnel.

• Refraining from the use of foreign postal systems to ship critical information.

• Promptly retrieving documents containing critical information printed on printers accessible by persons without a need to know the critical information.

• Refrain from including critical information in contract and budget documents, presentations, press releases, and other publications to that which is essential to the performance of this requirement.

• The contractor shall notify the COR immediately of all known and suspected compromises of critical information. If the COR cannot be reached, the contractor shall notify the supported command duty officer if after normal work hours.