DRAFT AIR AMBULANCE PATIENT TRANSPORTATION SERVICES

Requirement Description

8 May 2026

1. DESCRIPTION OF REQUIREMENTS

a. If and when requested by authorized representatives of the Contracting Officer, the contractor shall furnish air ambulance service from Outside the United States (OCONUS) to the Continental United States (CONUS) (i.e., intertheater air ambulance service), and within CONUS (i.e., domestic air ambulance service) for the movement of Department of War (DoW) eligible patients using contractor-furnished aircraft configured to air ambulance standards. The contractor shall provide all personnel, services, equipment, tools, fuel, oil, materials, facilities, supervision, and indirect materials necessary to perform air ambulance services, including a sufficient number of ground personnel for adequate maintenance and ground operations. The aircraft and medical crew may be required to be ready for immediate departure (not later than two hours) after confirmed notification of an air ambulance requirement.

b. The United States Government (USG) shall be entitled to transport one or more patients/non-medical attendants (including their personal baggage) and/or cargo up to the entire capacity of the aircraft performing missions. To compute aircraft payload, the contractor shall use Federal Aviation Administration (FAA) approved weight and balance methods and procedures.

c. Authorized representatives of the Contracting Officer who Order or make Calls for air ambulance service will contact carriers that are both DoW-approved and accredited for basic life support and critical care life support by either the Commission on Accreditation of Medical Transport Systems (CAMTS) or the National Accreditation Alliance of Medical Transport Applications (NAAMTA) for availability. Only in the event a carrier with DoW approval is not available, may a CAMTS and/or NAAMTA accredited air carrier without DoW approval be utilized, and then only if needed to save "life, limb, or eyesight".

d. Medical attendants shall be qualified according to the patient care needs, as validated by the Patient Movement Requirements Center (PMRC), and could include medical technicians, nurses, or physicians.

e. It is incumbent upon the contractor to utilize their appropriate aircraft for the number of patient(s) and route (e.g., distance, weight, domestic or international, etc.) for each mission.

f. When point-to-point pricing is provided, the contractor shall send an e-mail to both TACC.XOPAC-02@us.af. mil and TACC-XOGA@us.af.mil no later than 0800 CST or CDT (whichever is applicable). The email must provide daily status and the location of assets.

Additionally, if aircraft are later moved to another location(s) throughout the day, the contractor shall immediately send an e-mail notifying the 618 Air Operations Center/Tanker Airlift Control Center (618 AOC/TACC) (using the emails above) of the new location and availability. Failure to provide asset location or updated status of aircraft location for point-to-point missions may result in the loss of a mission which may have otherwise been awarded.

g. Ordering Service Procedure. When ordering services, the approved ordering officials shall perform a best value decision that considers price and may consider other factors such as aircraft availability, past performance, estimated transit time, contractor response time to mission notifications, and other factors that may be deemed appropriate. Price considerations are significantly more important than non-price considerations. For each carrier and each asset, the ordering official will rank order carriers by price considering each carrier's/asset's unique costs based on the applicable Great Circle Statue Miler (GCSM) rate and the forecasted positioning leg miles, active miles, and the depositioning leg miles (if applicable), as well as the projected medical care hours and the applicable rate. Once rank ordered, the ordering official will make the decision and contact the contractor determined to be the best value to make mission arrangements. The Government reserves the right to revise these ordering procedures as requirements or ordering processes dictate.

h. The selected carrier shall accept or decline a mission within one hour of receiving a Patient Movement Request (PMR). Upon receipt of the PMR, the selected carrier shall send an email to TACC.XOPAC-02@us.af.mil and TACC-XOGA@us.af.mil to confirm its receipt. Failure to accept or decline a mission within this timeframe may result in award of the mission to another carrier.

i. A departure reliability rate of at least 95% must be maintained. The departure reliability rate is the percentage of total "on time" departures of all calls issued. Any aircraft that departs (leaves the blocks) within 20 minutes of scheduled departure time shall be considered "on time". This rate is tracked by the ordering personnel. Failure to maintain a reliability rate of at least 95% may be cause for cancellation of the contract/agreement.

j. All aircraft must be licensed, operated, and maintained in accordance with all applicable rules and regulations of the FAA and Department of Transportation (DoT), giving particular attention to the responsibility of the air carrier to perform air transportation with the highest degree of safety. For instance, air carriers must have a required FAA Operations Specification (OpSpec) to perform air ambulance service using its aircraft. The aircraft performing missions under this contract shall not be considered public aircraft. The contractor shall have a current FAA authorization certificate to operate over routes and into the airfields specified under both Instrument Flight Rules (IFR) and Visual Flight Rules (VFR) conditions and rules. IFR capability authorization is not required for operations into airfields which do not have published IFR approach procedures. The contractor must satisfy DoW quality and safety requirements as described in 32 CFR Part 861.

2. SERVICE DELIVERY SUMMARY (SDS)

The SDS summarizes desired outcomes and identifies the performance thresholds/metrics that will be tracked to determine whether the desired outcomes are being achieved. Although not all PWS requirements are listed in the SDS, the Contractor is fully expected to comply with all requirements in the PWS and elsewhere in the contract (e.g., contract clauses).

Table 1: SDS

DESIRED

OUTCOME

REQ

PARA

PERFORMANCE

THRESHOLD

(METRIC)

SOURCE

OF DATA

HOW OFTEN

COLLECTED

CALCULATION

Maintain departure reliability rate

1.i. 95% of the time Contractor Reports

Monthly # of late departures/total # of departures

Submit copies of all medical documentation to TCSG email for all services completed within 48 hours of service completion

10.k. 95% of the time, monthly

TCSG

email time stamp

Monthly # of medical documents submitted after 48 hours of service completion/total # of missions

Provide timely cyber-incident reporting

13 No more than one late cyber-incident report or unreported cyber-incident in a 12-month period.

Incident Report

As Required # of late reports or unreported cyber-incidents per 12-month period

3. DEFINITIONS

Aeromedical Crew Member (ACM). An ACM is a person trained to one of the levels below who is a care provider of aerospace medicine. An ACM involved in patient care shall not serve simultaneously as a required pilot or flight crew member of an air ambulance during aeromedical flight operations. The aircraft becomes a patient care unit specific to the needs of the patient. The ACMs should meet the critical care standards for CAMTS or NAAMTA. CAMTS standards can be found at https://www.camtsglobal.org/accreditation-standards. NAAMTA standards can be found https://intranet.naamta.com under view standards 13.11

Air Ambulance Service. An air carrier operating an aircraft used for air transportation that is specifically designed to accommodate the aeromedical needs of persons who are ill, injured, wounded, or otherwise mentally or physically incapacitated or helpless; who may require emergency medical care in-flight; and who, in a physician's opinion, cannot be safely transported on a standard commercial or charter flight.

Respiratory Therapist. A Respiratory Therapist shall be currently credentialed by the National Board of Respiratory Care and must have at least two years of current experience in critical respiratory care with emphasis on ventilators. Must have current Cardiopulmonary Resuscitation (CPR) provider certification and have successfully completed a course in Altitude Physiology, Aircraft Fight Safety, and Communications.

https://www.camtsglobal.org/accreditation-standards https://intranet.naamta.com/

Neonatal Incubator. Commonly referred to as Isolette. Incubator for premature or other newborn infants, providing controlled temperature, humidity, and oxygen levels and having armholes through which the infant can be reached with minimum disturbance to the controlled environment.

4. EXTENT OF OBLIGATION

This contract/agreement does not obligate any funds. The Government is obligated only to the extent of authorized purchases actually made under this contract/agreement.

5. INDIVIDUALS AUTHORIZED TO PURCHASE AIR AMBULANCE SERVICES

A list of individuals authorized to purchase Air Ambulance Services, identified either by title of position or by name of individual, organizational component, and the dollar limitation per purchase for each position title or individual shall be furnished to the contractor by the Contracting Officer.

6. AIR CARRIER INSURANCE REQUIREMENTS

a. Upon award, the contractor shall, at its own expense, procure from a financially and legally responsible insurance company, and maintain for the life of the contract/agreement, at least the minimum insurance coverage required by 14 CFR Part 205.4.

b. The contractor shall provide written verification of insurance coverage required by 14 CFR Part 205.4 to the Contracting Officer prior to contract/agreement award. The contractor shall provide annual proof of insurance from the insurance provider to the Contracting Officer. In the event of a planned cancellation or material change in policy coverage, 30 days prior written notice shall be given to the Contracting Officer. In the event of an unplanned cancellation or material change in policy coverage, notice shall be given to the Contracting Officer as soon as possible.

c. The contractor shall include in its required insurance policies and endorsement that any cancellation or material change in the coverage which adversely affects the Government's interests shall not be effective unless the contractor gives the Contracting Officer 30 days written notice as required by the contract/agreement.

7. LANDING PERMITS

a. To permit the use of military installations, the contractor must obtain landing permits following service specific instructions no later than 30 days prior to required approval date. The contractor shall begin the renewal process at least 60 days prior to expiration to allow for any delays in processing and to avoid a suspension on operator.

b. Pursuant to AFI 10-1001, a Landing Permit (DD Form 2401) may be obtained from the USTRANSCOM/TCAQ-C Contracting Officer at Scott AFB, IL. In addition, a Hold Harmless Agreement (DD Form 2402) and the Certificate of Insurance (DD Form 2400) must be completed and forwarded to the Contracting Officer. The contractor shall submit these completed forms along with the DD Form 2401 to the appropriate service installation.

ARMY INSTALLATIONS

usarmy.belvoir.hqda-dcs-g-3-5-7.list.usaasaops@mail.mil

NAVY INSTALLATIONS

CALP.HQ@navy.mil

AIR FORCE INSTALLATIONS

usaf.calp@mail.mil

MARINE INSTALLATIONS

mcicom_calp@usmc.mil

8. DELIVERABLES/NOTICES AND REPORTS

a. Notice of Accidents or Incidents. All Carrier Operations (both Commercial and Government). When a contractor's aircraft is involved in any accident or incident, DoW or otherwise, the contractor shall transmit the information in paragraphs #1-8 below to Headquarters Air Mobility Command (AMC) via HQ AMC/A3B, Scott AFB IL (618) 229- 4801/DSN 779-4801 or the HQ AMC/A3B Safety Manager at (618) 229-2106/DSN 779-2106 and to the Contracting Officer and Contracting Officer Representative (COR). Accident and incident information shall be provided to HQ AMC, the Contracting Officer and the COR/Alternate COR by the most expeditious means available within 24 hours of accident or incident. Accidents and incidents are defined in 49 CFR Part 830.

(1) Event schedule identifier

(2) Aircraft type and number

(3) Date and time of the accident or incident

(4) Last point of departure and point of intended landing of the aircraft, as applicable

(5) Nature of the accident or incident and extent of known damage to the aircraft, if any

(6) Total number of crewmembers and passengers on board

(7) Number of injured and fatalities aboard the aircraft

(8) Condition of baggage or Government-owned material, if any, on board

b. Aircraft Medical Incidents. The contractor shall report all aircraft medical incidents that occur in flight, or while passengers are under the control of the aircraft captain on missions performed in support of this BPA, to the Air Evacuation (AE) Desk at the 618 Air Operations Center (AOC) Operations Floor at (618) 229-0330 and the Contracting Officer at the next en route station for in-flight incidents, or the station where the incident occurs.

c. DoW Casualties. In cases where a death occurs on a Contractor's aircraft, the following information shall be furnished via telephone to the numbers listed below: Name, DoW ID, and component of service identified as Army-USA, Air Force-USAF, Navy-USN, Marine Corps- USMC, Coast Guard-USCG. The following is a list of phone numbers for service casualty offices:

mailto:usarmy.belvoir.hqda-dcs-g-3-5-7.list.usaasaops@mail.mil mailto:CALP.HQ@navy.mil mailto:usaf.calp@mail.mil mailto:mcicom_calp@usmc.mil

U.S. Army: (800) 626-3317 U.S. Air Force: (800) 433-0048 U.S. Navy: (800) 368-3202 U.S. Marines: (800) 847-1597 U.S. Space Force: (800) 525-0102 Coast Guard (USCG): (571) 266-2375Atlantic Area Op Center: (757) 398-6390 (accidents east of Mississippi) Pacific Area Op Center: (510) 437-3701 (accidents west of Mississippi)

d. An informational copy of the DoW casualty incident shall be provided to the USTRANSCOM Global Operations Center (GOC), Scott AFB, Illinois, via (618) 817-7700/7001 or DSN 322- 817-7700/7701.

e. Safety and Financial Information. As required by the Air Safety clause at USTRANSCOM Federal Acquisition Regulation Supplement (TRANSFARS) 5552.247-9000, the contractor must satisfy the requirements of 32 CFR Part 861. DoW will conduct periodic evaluations to assess the contractor's ability to perform safely. To complete the evaluation, the Government may contact the contractor in order to obtain information bearing upon the contractor's practices, resources, and capabilities. Upon request, the contractor shall provide data pertinent to such evaluations, including current audited financial statements, to HQ AMC/A3B, 510 POW/MIA Dr, Rm 316, Scott AFB IL 62225-5011. NOTE: Data furnished pursuant to this paragraph 11.e.

may be utilized by the USG or its representatives for any matter related to this BPA.

9. AIRFIELD SUITABILITY AND RESTRICTIONS/CERTIFICATIONS AIRFIELDS

a. Contractors are reminded that airfield restrictions exist at certain military and commercial airfields worldwide. An AMC publication entitled, "Airfield Suitability and Restrictions Report," identifies airfield restrictions specifically for AMC air crews. This publication also lists "certification airfields" which are the equivalent to FAA designated "special airfields." These fields have unique airfield hazards and operating procedures requiring increased awareness and familiarity by air crews. US Government Contractors with a need to know can obtain the current edition of this publication, at no cost, by contacting the following office:

HQ AMC AIRFIELD SUITABILITY (A3AS)

310 W Martin Street Building 1625, Dept 1632-07 Scott AFB, IL 62225-5011

HQ AMC/A3AS TELEPHONE: (618) 229-3112

b. This publication is prepared for use by AMC air crews and is made available to contractors for advisory purposes only.

c. Additionally, DoW, through the Defense Visual Information Distribution Services (DVIDS), produces "Airport Qualification Program" (AQP) videos for some certification airfields. These are available for advisory purposes only, at no cost (one copy per contractor), by contacting the following office:

DVIDS TELEPHONE: (888) 743-4662

Building 3, Room 105 Hap Arnold Blvd. E-Mail: dma.enterprise-customer-dervices@mail.mil Tobyhanna, PA 18466-5102 Website: www.dvidshub.net

d. This contract requires that at least one pilot member of an air crew, operating a DoW contract mission into a DoW-designated certification airfield, shall have performed pilot duties to that airfield within the past 12 months or reviewed an FAA-accepted pictorial (e.g., video) detailing airfield hazards within 30 days prior to performing the DoW contract mission.

e. Contractors shall ensure that air crews are adequately briefed on all restrictions at applicable airfields, including certification airfields, and properly trained before performing any DoW contract mission into these airfields.

10. INVOICES

a. The contractor shall submit invoices in accordance with Defense Federal Acquisition Regulation Supplement (DFARS) 252.232-7006, Payment Instructions in the Procurement Integrated Enterprise Environment (PIEE) website WAWF module. All invoices, except those for ground transportation, shall be submitted using WAWF.

b. Invoices for ground transportation shall be sent to the originating facility.

c. All services completed shall be accompanied by sales slips that shall contain the following minimum information:

Name of Supplier BPA Number Date of Service Request Purchase Number Itemized List of Services Furnished Quantity, Unit Price, and Extension of Each Service Date Service was Provided

d. Invoices shall identify the call number, aircraft tail number used, date and time of each mission, quantity of GCSMs flown, and the number of hours and level for all medical personnel used. GCSMs flown shall be invoiced showing positioning leg miles, active miles (patient/medical personnel onboard), and depositioning leg miles (if a round-trip mission).

NOTE: The Government's obligation for payment of the positioning leg miles shall be for actual miles flown, but it shall not exceed the mileage between the contractor's primary operations location and the patient's embarkation point. The Government will pay for all GCSMs and applicable medical personnel rates according to the price list. For round-trip missions, the Government's obligation for payment of depositioning leg miles shall be for actual miles flown, not exceeding the mileage between the patient's debarkation point and the contractor's primary operations location. Mileage will be determined by the Great Circle Mapper® website at mailto:askdimoc@dma.mil http://gc.kls2.com/. Reimbursable expenses must be identified separately, and receipts must be provided for all expenses claimed.

e. Should the Government cancel a scheduled flight after the Contractor's aircraft has already departed its home base enroute to position, the Government shall reimburse the contractor actual miles and hour(s) incurred (beginning when the positioning leg miles started and concluding immediately when depositioning leg ends) at the GCSM and Medical Personnel rates set forth in the price list.

f. Landing/Parking/Airport Fees. In the event the contractor is directed to land at a civil airport by the Government, the contractor will be reimbursed, at cost, for airport fees assessed by the airport. Airport fees include landing fees, ramp fees, and parking fees. The contractor shall provide copies of paid receipts with the invoices.

g. Any Federal Transportation Taxes (reference Public Law 97-248, Tax Equity and Fiscal Responsibility Act of 1982) that the contractor is required to pay in the performance of this contract shall be added to the contractor's invoices as a separate item, and the Government shall reimburse the contractor for the amount of such taxes.

h. The contractor shall be reimbursed for food and lodging if required to remain overnight (RON) while performing a mission. Lodging and food shall not exceed the limits stated in Public Law 99-234 as provided in FAR 31.205-46(a)(2). Lodging and food arrangements are the contractor's responsibility.

i. Fuel Reimbursement. To protect the contractor and the Government from significant market fluctuations, fuel will be reimbursed using aircraft burn rates based on the following calculations:

(a) The contractor's fuel burn rate, established in the List of Aircraft, is multiplied by the total mileage flown in performance of the mission.

(b) The product is then multiplied by the price per gallon paid.

Example:

Miles flown in support of the mission = 3,654 Burn rate for aircraft type (in schedule) = 4.21 gallons per mile Actual average cost per gallon = $4.6308 Calculation: Miles * Burn Rate * Cost Per Gallon = Fuel Reimbursement. 3,654 * 4.21 * $4.6308 = $71,237.17

j. A summary invoice shall be submitted at least monthly or upon expiration of this contract/agreement, whichever occurs first, for all services performed during a billing period, identifying the sales slips covered therein and stating their total dollar value. Services performed shall be supported by receipt copies of the sales slips.

k. Copies of all medical documentation utilized for all services completed will be scanned digitally and emailed to transcom.scott.tcsg.mbx.patient-movement-safety-program@mail.mil no later than 48 hours after completion of the service. All medical documentation shall be protected in accordance with Health Insurance Portability and Accountability Act (HIPAA) requirements;

refer tohttps://www.hhs.gov/hipaa/for-professionals/security/guidance/index.html?language=es.

11. DEROGATORY INFORMATION

Any member of the contracted company team (Program Manager, FSO, or other supervisory staff) aware of pending human resource activity of consequence (to include termination or suspension), behaviors or patterns of concern, or misconduct, to include reporting requirements in accordance with Security Executive Agent Directive (SEAD)3 (for contractors with classified security eligibility), for any contractors supporting this contract/agreement during the established period of performance, will immediately contact the USTRANSCOM Joint Security Office (TCCS-S) Attn: Industrial Security Program Manager. If the Government notifies the contractor that the employment or the continued employment of any contractor personnel is prejudicial to the interests or endangers the security of the United States of America and/or USTRANSCOM personnel, information, or assets; that employee shall be removed and barred from the worksite.

This includes security deviations/incidents and credible derogatory information on contractor personnel as noted in the DoD personnel security system of record. Personnel who have incident reports posted in the DoD personnel security system of record will be denied the ability to support the contract/agreement until the issues have been resolved and the incident has been removed in the DoD personnel security system of record. The Contractor shall make any changes necessary in the appointment(s), at no additional cost to the Government. If any incident involves or may involve the mishandling of classified information or a potential Negligent Discharge of Classified Information, the USTRANSCOM Joint Security Office Attn:

Industrial Security Program Manager, will be notified within 24 hours during the normal work week and within 72 hours if the incident occurs over the weekend.

12. ADDITIONAL STANDARDS FOR DoW CONTRACT AIRCRAFT OPERATIONS

UNDER 14 CFR PART 135 (NONCOMMUTER) (PASSENGER AND CARGO

OPERATIONS)

All aircraft must be listed on air carrier's certificate, and flight crews must be trained, qualified, and scheduled IAW 14 CFR Part 135. This applies even when the contracted operations fall under CFR Part 91 or other CFRs. CFRs, as well as other applicable laws (e.g., International Civil Aviation Organization (ICAO), Public Law, and CFR updates) have priority. Safety is the top priority. It is the DoW's intention to default to the guidance that provides the highest level of aviation safety. In addition, air carriers shall comply with the following:

a. Operations:

(1) Pilots are responsible for ensuring correct computing and documenting of the weight and balance for all DoW flights and for ensuring the gross weight and center of gravity do not exceed the aircraft's limitations. Actual or interrogated weights must be used. Completed load manifests/weight and balance forms must be retained for 30 days.

(2) Companies are required to maintain the last 30 days documentation for all DoW flights to demonstrate compliance with the flight locating requirements of 14 CFR 135.79.

(3) Single-engine aircraft shall be limited to flight during daylight hours and VFR conditions only. Daylight hours are defined as 30 minutes before official sunrise to 30 minutes after official https://www.hhs.gov/hipaa/for-professionals/security/guidance/index.html?language=es sunset; or in Alaska, during extended twilight hours when terrain features can be readily distinguishable for a distance of at least one mile.

(4) All DoW passenger charters will be flown under IFR to the maximum extent possible.

(5) Air ambulance operations can only be conducted IAW approved Operations Specifications on their certificate. Rotor-wing operations: A021, "Helicopter Air Ambulance (HAA) Operations."

Fixed-wing operations: A024, "Air Ambulance Operations-Airplane."

(6) Night Vision Imaging Systems (NVIS) may be used for night operations conducted IAW approved Operations Specifications on their certificate. Rotor-wing operations: A050 "Helicopter Night Vision Goggle Operations (HNVGO)." Fixed-wing operations: A051 "Airplane Night Vision Goggle (ANVG) Operations."

(7) Rotor-Wing Operations Only:

(a) Multi-engine rotor-wing may be used for night and IFR, providing the helicopters are operated IAW approved Operations Specification.

(b) U.S. Navy Contracted Shipboard Landings. The pilot(s) shall have completed training that is approved by the Navy and meet subsequent proficiency and currency requirements to ensure standardization with shipboard guidelines.

b. Aircrew Requirements:

(1) A pilot-in-command (PIC) and second-in-command (SIC) will be used:

(a) For all fixed-wing, whole-plane charters.

(b) If the aircraft certificate requires a two-pilot crew, or has seating configuration for ten or more passengers; and

(c) When the aircraft is operated under IFR.

(2) For DoW charter passenger operations, the PIC and SIC (when required), must have at least 250 hours combined hours in their respective positions in the type of aircraft being operated.

Type (as defined in 14 CFR 135.293b) means any one of a group of airplanes as determined by the FAA to have a similar means of propulsion, the same manufacturer, and no significantly different handling or flight characteristics. For rotor wing, type (as defined in 14 CFR 135.293b) means a basic make and model.

(a) While acting as PIC, only PIC time will be counted towards the 250-hour requirement. Prior SIC time will not be counted.

(b) The PIC must have 1,500 hours total pilot time and have logged 100 hours PIC time in the past 12 months. 25 hours of this 12-month time can be performed in an FAA-approved same type aircraft/helicopter simulator.

(c) The PIC must have at least 10 takeoffs and 10 landings, and 50 hours in the type and model aircraft being operated.

(d) Float plane PICs must have at least 250 total hours in float plane operations.

(3) The PIC and SIC (when required), shall be IFR qualified (i.e., both shall hold a commercial instrument rating for all DOW flights regardless of the weather or type of flight plan filed). (Not required for operations restricted to VFR only.)

(a) Both pilots shall meet the currency requirements of 14 CFR 135.247.

(b) The PIC shall have a current 14 CFR 135.297 instrument proficiency check and a current 14 CFR 135.293 competency check.

(c) The SIC shall have a current 14 CFR 135.293 competency check, to include, as a minimum, one precision approach, one nonprecision approach, and one missed approach. The SIC must meet the instrument currency requirements of 14 CFR 61.57(c).

(1) If the SIC is assigned to pilot only one type of aircraft for the DoW, that pilot must meet the instrument requirements of section 14.b. in that type of aircraft.

(2) If the SIC is assigned to pilot more than one type of aircraft for the DoW, that pilot must meet the instrument requirements of this section in each type of aircraft, and the check shall alternate between the different types of aircraft that the pilot operates for the DoW.

c. Aircraft:

(1) Shall have two or more engines (except for helicopters, float planes, and aircraft supporting U.S. Army Corps of Engineers operations-only missions).

(a) Must meet the IFR performance requirements of 14 CFR 135.181.

(b) Must be turbine powered if more than nine passengers are carried.

(2) Shall also meet the following standards:

(a) Shall be maintained in a good state of repair and appearance. Aircraft showing deterioration or neglect, such as unrepaired cracks, punctures, loose rivets, missing fasteners, deterioration of interior, paint, or windows are unacceptable for DoW use. These concerns are in addition to airworthiness requirements.

(b) If operating IFR, must have on board a complete set of aeronautical charts and approach plates (for each required pilot) covering the area of operation. For DoW VFR-only contract missions, must have on board suitable aeronautical charts to provide appropriate level of situational awareness IAW applicable regulations.

(c) Must have a first-aid kit and emergency equipment, accessible to the passengers and appropriate to the environment of operation.

(d) Must have approved life preservers for overwater flights IAW CFR Part 91.205b(12). Rotor wing shall also have emergency flotation gear (pop-out) or standard flotation gear (fixed floats).

(3) Aircraft operated single pilot for the DoW, and aircraft on a DoW VFR-only BPA call (which allows successful recovery of the aircraft in the event of Inadvertent Instrument Meteorological Conditions (I-IMC)) shall possess the following navigation and communication equipment:

(a) Directional gyro

(b) Artificial horizon

(c) Rate of turn indicator

(d) Vertical speed indicator

(e) One type of FAA-approved navigation equipment such as a Very High Frequency Omni- Directional Range (VOR), Global Positioning System (GPS), etc. A GPS shall be available for operations in remote areas where other navigational aids are not available.

(f) One Air Traffic Control (ATC) transponder for all Navy shipboard operations.

(g) An Emergency Locator Transmitter (ELT).

(h) At least one Very High Frequency (VHF) receiver and transmitter.

(4) In addition to (3) above, aircraft operated with two pilots shall be equipped for IFR operations and possess the following navigation and communication equipment. (Not applicable to DoW VFR only contract operations):

(a) Two independent navigation systems suitable for the location served, at least one navigation system will include VOR/Distance Measuring Equipment (DME) capability.

(b) Dual VHF receivers and transmitters.

(c) Capability to perform a precision approach other than a Ground-Controlled Approach (GCA).

(d) A transponder.

(5) The SIC position (when required to be filled) must include the following operable equipment:

(a) The ability to manipulate all primary and auxiliary flight controls, lift/drag devices, and landing gear.

(b) Airspeed indicator.

(c) Altimeter.

(d) Artificial horizon.

(e) Gyroscopic direction indicator or equivalent.

(f) An independent navigation system.

13. CYBERSECURITY INCIDENT REPORTING

13.1. Operational Critical Support. The services provided within the scope of this contract are considered "operationally critical support" as defined in DFARS 252.204-7012, "Safeguarding Covered Defense Information and Cyber Incident Reporting."

13.2. Cybersecurity Incident Reporting

13.2.1 In addition to the DFARS 252.204-7012 reporting requirements for unclassified systems and 32 CFR Part 117 for classified systems, reportable cyber-incidents include, (regardless of whether the information system contains covered defense information (CDI) or there is an impact to performance such as delivery schedule delay), include, but are not limited to, the following:

13.2.2. Cyber-incidents as defined in Cyber Security Table 1.

13.2.2.1. Notifications by a federal, state, or local law enforcement agency or cyber-center (e.g., National Cyber Investigative Joint Task Force (NCIJTF), National Security & Communications Integration Center (NCCIC)), Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Department of Defense Cyber Crime Center (DC3) of being a victim of a successful or unsuccessful cyber-event, anomaly, incident, insider threat, breach, intrusion, or exfiltration.

Cyber Security Table 1:

Incident Category Description Root Level Intrusion Unauthorized privileged access to an IS. Privileged access, often referred to as administrative or root access, provides unrestricted access to the IS. This category includes unauthorized access to information or unauthorized access to account credentials that could be used to perform administrative functions (e.g., domain administrator). If the IS is compromised with malicious code that provides remote interactive control, it will be reported in this category.

User Level Intrusion Unauthorized non-privileged access to an IS. Non-privileged access, often referred to as user level access, provides restricted access to the IS based on the privileges granted to the user. This includes unauthorized access to information or unauthorized access to account credentials that could be used to perform user functions such as accessing Web applications, Web portals, or other similar information resources. If the IS is compromised with malicious code that provides remote interactive control, it will be reported in this category.

Denial of Service Denial of Service (Incident)—Activity that denies, degrades, or disrupts normal functionality of an IS or DoW information network.

Malicious Logic Installation of software designed and/or deployed by adversaries with malicious intentions for the purpose of gaining access to resources or information without the consent or knowledge of the user. This only includes malicious code that does not provide remote interactive control of the compromised IS. Malicious code that has allowed interactive access should be categorized as Root or User Level Intrusion incidents. Interactive active access may include automated tools that establish an open channel of communications to and/or from an IS.

Ransomware Malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable. Malicious actors then demand ransom in exchange for decryption. Ransomware actors often target and threaten to sell or leak exfiltrated data or authentication information if the ransom is not paid. Ransomware is a reportable incident that may be associated with multiple incident categories depending on the attack vector and execution.

13.2.3. To comply with DFARS clause 252.204-7012, contractor is required to develop a System Security Plan (SSP) detailing the policies and procedures their organization has in place to comply with National Institute of Standards & Technology (NIST) Special Publication (SP) 800-

171. The SSP serves as a foundational document for the required NIST SP 800-171 self-assessment as required by the Cybersecurity Maturity Model Certification Level 2 (Self), which applies IAW DFARS 252.204-7021.

13.2.4. If the cyber-incident affects a classified system, vulnerabilities associated with the incident will be classified per the current version of USTRANSCOM Instruction 31-02, Security Classification Guide.

13.3. Cybersecurity Incident Reporting Timelines. In addition to providing the notification required by DFARS 252.204-7012, the contractor is required to notify USTRANSCOM as soon as practicable, but no later than 72 hours after discovering a reportable cyber-incident. The reporting timeline begins when the incident is discovered or reported to the company, its employees, contractors, or cybersecurity firm responsible for providing cybersecurity and response for the company. The contractor shall contact the USTRANSCOM Cyber Operations Center (CyOC) via phone at 618-817-4222. If the contractor does not immediately reach the

CyOC via phone, the contractor shall send an email notification to transcom.scott.tcj6.mbx.cyoc-dodin-operations@mail.mil.

13.4 Mandatory Reporting Data

13.4.1. The contractor shall work with the USTRANSCOM CyOC through resolution of the incident. Within 72 hours of becoming aware of a reportable cyber-incident, the contractor shall provide an initial notification of the incident, even if some details are not yet available, which includes, but is not limited to, the following information:

(a) Company Name

(b) Who will be the POC with contact information

(c) Contracting Officer POC (name, telephone, email)

(d) Overall Assessment -Description of incident, data at risk, mitigations applied

(e) Indicators of compromise

(f) Vector of attack (if known)

(g) Estimated time of attack (if known)

13.4.2. The contractor shall provide a follow-on cyber-incident report to the USTRANSCOM CyOC, within five days of becoming aware of a reportable cyber-incident, which includes, but is not limited to, the following information:

(a) Contractor unique Commercial and Government Entity (CAGE) code

(b) Contract numbers affected

(c) Facility CAGE code where the incident occurred if different than the prime Contractor location

(d) POC if different than the POC recorded in the System for Award Management (name, address, position, telephone, email)

(e) Contracting Officer POC (name, telephone, email)

(f) Contract clearance level

(g) DoW programs, platforms, systems, or information involved

(h) Location(s) of compromise

(i) Date incident discovered

(j) Type of compromise (e.g., unauthorized access, inadvertent release, other)

(k) Description of technical information compromised

(l) Any additional information relevant to the information compromise

13.5. Incident Reporting Coordination

13.5.1. In the event of a cyber-incident, USTRANSCOM may conduct an on-site review of network or information systems where DoW information is resident on or transiting to assist the contractor in evaluating the extent of the incident and to share information in an effort to minimize the impact to both parties. Date and time of on-site visits will be mutually agreed upon by USTRANSCOM and the contractor in advance.

13.5.2. The contractor agrees to allow follow-on actions by the Government (e.g., USTRANSCOM, FBI, CISA, DC3, etc.) to further characterize and evaluate the suspect activity.

The contractor acknowledges that damage assessments might be necessary to ascertain an incident methodology and identify systems compromised as a result of the incident. Once an incident is identified, the contractor agrees to take all reasonable and appropriate steps to preserve any and all evidence, information, data, logs, electronic files, and similar type information (reference NIST SP 800-61: Computer Security Incident Handling Guide, (current version)) related to the incident for subsequent forensic analysis so that an accurate and complete damage assessment can be accomplished by the Government.

13.5.3. The contractor is not required to maintain an organic forensic capability, but must ensure data is preserved (e.g., remove an affected system, while still powered on, from the network) and all actions documented until forensic analysis can be performed by the Government or, if the Government is unable to conduct the forensic analysis, a mutually agreed upon third party (e.g., Federally Funded Research and Development Center (FFRDC), commercial security contractor, etc.). Any follow-on actions shall be coordinated with the contractor via the Contracting Officer.

13.5.4. The contractor agrees to indemnify and hold the government harmless for following any recommendations to remedy or mitigate the cyber-incident following the actions under 13.5.1.

and 13.5.2.

13.6. Confidentiality and Non-Attribution Statement. The Government may use and disclose reported information as authorized by law and will only provide attribution information on a need-to-know basis to authorized persons for cybersecurity and related purposes (e.g., in support of forensic analysis, incident response, compromise or damage assessments, law enforcement, counterintelligence, threat reporting, and trend analysis). The Government may share threat information with other USTRANSCOM industry partners without attributing or identifying the affected contractor.

13.7. Controlled Unclassified Information (CUI)

13.7.1. There are two types of controlled unclassified information that the contractor will have access to under this contract. Any contractor covered information systems that process, transmit or store CUI must protect said information from unauthorized disclosure. CUI is information that the U.S. Government creates or possesses, or that an entity creates or possesses on behalf of the U.S. Government, which requires safeguarding or dissemination controls as mandated by law, regulation, or U.S. Government-wide policy. See 32 CFR 2002.4(h).

13.7.2. The contractor will have access to a specific category of CUI known as General Privacy (PRVCY) information, such as passenger manifests.1 This pertains to personal information, often called Personally Identifiable Information (PII). PII is any information about an individual maintained by an agency (in this case an air carrier operating on behalf of an agency), including

(1) any information that can be used to distinguish or trace an individual‘s identity, such as name, social security number (SSN), DoW ID (DODID) numbers, driver’s license or state identification number, date and place of birth, mother’s maiden name, or biometric records (e.g., fingerprint, voiceprint, iris scan), or ; and (2) any other information that is linked or linkable to an individual, 1 Note the requirements to protect CUI IAW NIST SP 800-171 include physical media. Physical media includes both digital media as well as paper records.

such as medical, educational, financial, employment information, and/or system authentication information (passwords, PINs).

13.7.3. Operations Security (OPSEC). OPSEC information, a category of CUI, may be included during performance. OPSEC procedures must be included in contracts to ensure that critical information is protected. The contractor shall be responsible for OPSEC procedures when operating missions for the DoW to include safeguarding critical information. Disclosing this information to the adversary could potentially affect mission success and cause harm to military members, civilians, and contractors and their families. OPSEC is a process used to protect unclassified sensitive information from exploitation by an adversary. Contractors must ensure employees, to include aircrew, receive OPSEC training upon initial assignment and annually thereafter. Flight crews should be aware of persons who are seeking information about the contractor, flights, passenger units and equipment being transported, etc. They should seek to maintain a low profile while operating DoW missions. If the contractor has questions about OPSEC they can be addressed by the COR and USTRANSCOM.

13.7.4. Operations Security Requirements. The prime contractor and all subcontractors shall provide protection for CUI to limit unauthorized disclosures of critical information. The prime contractor and all subcontractors shall employ the countermeasures listed below to protect that information. These OPSEC requirements will be in effect throughout the life of the procurement from award through the conclusion of services at the end of the period of performance or other procurement termination. In any case where uncertainty or ambiguity regarding OPSEC measures exists, the contractor shall consult the requirements or contracting office’s OPSEC coordinator as soon as possible.

13.7.5. Countermeasures to Unauthorized Disclosure of Critical Information.

Countermeasures are required to negate the susceptibility of critical information to exploitation by an adversary or competitor. The contractor shall protect all critical information listed in a manner appropriate to the nature of the information, including use of the necessary countermeasures as listed below applicable to specific items:

13.7.5.1. Refrain from including critical information in contract and budget documents, presentations, press releases, and other publications to that which is essential to the performance of this requirement.

13.7.5.2. Encryption or password protection of electronically stored critical information.

13.7.5.3. Encryption or password protection of e-mail containing critical information.

13.7.5.4. Storage of hard copy critical information and storage media in locked containers when not in use.

13.7.5.5. Transmission of critical information to the minimum set of recipients with a need to know.

13.7.5.6. Immediate and appropriate destruction in a manner precluding reconstruction of all critical information no longer needed under this contract.

13.7.5.7. Restricting verbal discussion of critical information to venues and circumstances that prevent the monitoring and interception of the discussion by unauthorized personnel.

13.7.5.8. Refraining from the use of unencrypted telephones to transmit critical information.

13.7.5.9. Refraining from the use of foreign postal systems to ship critical information.

13.7.5.10. Promptly retrieving documents containing critical information printed on printers accessible by persons without a need to know the critical information.

13.7.5.11. Use of cover pages or other appropriate means to prevent the viewing of critical information by unauthorized persons.

13.7.5.12. The contractor shall notify the COR. USTRANSCOM J39, and the USTRANSCOM security office immediately of all known and suspected compromises of critical information. If the COR cannot be reached, the contractor shall notify the supported command duty officer if after normal work hours.