Atch 1 -TRDM Condensed PWS.pdf

Condensed

PERFORMANCE WORK STATEMENT

FOR

Transportation Command (TRANSCOM) Reference Data Management (TRDM)

In Support of the United States Transportation Command

Contract Number: TBD

DATE: TBD

Prepared by

UNITED STATES TRANSPORTATION COMMAND

DIRECTORATE OF COMMAND, CONTROL, COMMUNICATIONS AND CYBER

SYSTEMS

Table of Contents

1. Background

2. Scope

3. Goal

4. Brief Summary of the Task Areas

5. Brief Summary of the "Shall" Statements

6. Brief Summary of the Deliverables

7. Period of Performance

8. Brief Summary of the DoD Cyber Workforce Framework (DCWF) Code Assignments

1. Background The United States Transportation Command (USTRANSCOM) is a combatant command that provides global transportation and logistics support. The TRANSCOM Reference Data Management (TRDM) system is the official Program of Record for the command's enterprise reference data. TRDM's mission is to collect, maintain, and distribute standardized reference data from authoritative sources to ensure data interoperability and synchronization across all USTRANSCOM systems and partners.

2. Scope The scope of this project is to provide the technical operation, maintenance, and distribution of the TRDM system and its data. The contractor will be responsible for a wide range of support tasks, including but not limited to:

• Requirement analysis

• Data collection and management

• Interface and architecture validation

• Data distribution

• Implementation, planning, and documentation related to the software development lifecycle

3. Goal The primary goal is to establish and maintain TRDM as a trusted and authoritative source of reference data for the entire USTRANSCOM enterprise, its users, and its interconnection partners. The program prioritizes adherence to key initiatives such as Data Governance, Data Security, Modernization, and Zero Trust.

4. Brief Summary of the Task Areas The contractor is responsible for comprehensive management and support across five main areas:

• Contract Management: Includes overall program management, regular reporting (weekly, monthly), progress reviews, security reviews, and managing the transition-in and transition-out processes.

• User Access & Operations Support: Involves maintaining the TRDM websites on both unclassified and classified networks (AWS GovCloud), managing user access, providing help desk support during business hours (0800-1800 CT), and ensuring data access complies with DoD security policies.

• System Service Management: Encompasses the management of incidents, system configuration, changes, software releases, and knowledge. This includes facilitating the

Configuration Control Board (CCB), managing data change requests, and maintaining interconnection agreements.

• System Operations Management: Focuses on the technical health and security of the system. Responsibilities include monitoring system resources, automating data exchange through web services, managing capacity and load balancing, executing the vulnerability management (IAVM) program, and performing database administration (PostgreSQL), backup, and recovery.

• Data Management and Sharing: Requires advanced data engineering to build and maintain data pipelines (ETL/ELT), manage data quality, maintain the data catalog and metadata, oversee the data lifecycle, and document the data architecture.

• Cybersecurity: Requires comprehensive cybersecurity obligations for government contractors, detailing requirements for incident reporting, secure software development, workforce qualifications, and adherence to the Risk Management Framework (RMF).

5. Brief Summary of the "Shall" Statements The PWS contains numerous mandatory requirements ("shall" statements). The most critical obligations related to security and compliance are summarized below:

• Personnel Security: All contractor personnel shall be U.S. citizens and shall possess a minimum of a final Secret security clearance. This clearance shall be maintained for the duration of the contract.

• Cybersecurity Framework and Policies: The contractor shall support all activities to obtain and maintain the Risk Management Framework (RMF) Authorization to Operate (ATO). The contractor shall also comply with all relevant DoD, USTRANSCOM, and Federal cybersecurity policies and shall participate in an Annual Security Review (ASR).

• Vulnerability and Risk Management: The contractor shall execute the Information Assurance Vulnerability Management (IAVM) program, perform static and dynamic code scans before deployment, and remediate all "Critical" and "High" findings. A Plan of Action & Milestones (POA&M) for all vulnerabilities shall be developed and maintained.

• Secure Development and Operations: All development shall adhere to secure coding practices. The contractor shall enforce role-based access controls and conduct annual failover and recovery exercises.

• Incident Reporting: The contractor shall report all cyber incidents to the government within 72 hours of discovery and shall deliver a detailed Cyber Incident Report within 72 hours of resolution.

• General Reporting and Documentation: Beyond security, the contractor shall deliver regular reports (Weekly, Monthly), create and maintain management plans (Configuration, Backup, Transition), and provide materials and minutes for quarterly reviews.

6. Brief Summary of the Deliverables The contractor is required to provide numerous deliverables throughout the contract period. The most significant ones include:

• Regular Reports: Weekly Activities Report (WAR), Monthly Status Report (MSR), and Monthly Metrics Report (MMR).

• Management Plans: A Contract Management Plan at the start of the contract, a Transition-In Plan, and a Transition-Out Plan. Several system-level plans (e.g., Failover Guide, CM Plan) must be reviewed and updated annually.

• Reviews and Meetings: Presentation materials and minutes for quarterly In Progress Reviews (IPRs) and an Annual Security Review (ASR).

• Security and RMF Artifacts: A Plan of Action & Milestones (POA&M) Report, Cyber- Incident Reports as needed, and all necessary documentation to support the RMF Authorization to Operate (ATO).

• Other Direct Costs (ODC) Purchase Requests: All ODC purchases require the contractor to submit a written request with competitive quotes to the COR at least five business days in advance.

7. Period of Performance The contract is structured with a one-month transition period, a one-year base period, and four one-year option periods.

• Transition Period: September 1, 2026 – September 30, 2026

• Base Period: October 1, 2026 – September 30, 2027

• Option Period One: Through September 30, 2028

• Option Period Two: Through September 30, 2029

• Option Period Three: Through September 30, 2030

• Option Period Four: Through September 30, 2031

8. Brief Summary of the DoD Cyber Workforce Framework (DCWF) Code Assignments The PWS mandates that all personnel performing cyberspace work be qualified according to the DCWF. Most positions are designated as IT Privileged Users and require specific certifications.

• Key Roles Identified: The assigned codes correspond to roles such as Program Manager, Systems Administrator, Software Developer, Database Administrator, Systems Security Analyst, Information System Security Officer, and Data Architect/Engineer.

• Required Certifications: The required Computing Environment (CE) certifications are primarily focused on Amazon Web Services (AWS), including AWS Certified Cloud

Practitioner, Developer, Solutions Architect, and Data Engineer. SecurityX, CISM, Certified Information Systems Security Professional (CISSP), Database certifications for PostgreSQL are also required.