Attachment 1 - Draft PWS 2021.09.10.pdf

This is a draft PWS and is subject to change.

PERFORMANCE WORK STATEMENT

FOR

CYBERSPACE OPERATIONS FORCES AND SUPPORT (COF)

In Support of the United States Transportation Command

TASK ORDER HTC71121xxxx

10 September 2021

Prepared by

UNITED STATES TRANSPORTATION COMMAND

DIRECTORATE OF COMMAND, CONTROL, COMMUNICATIONS & CYBER SYSTEMS

1. DESCRIPTION OF SERVICES

1.1 Background

The United States Transportation Command (USTRANSCOM) located at Scott Air Force Base (AFB), IL, is one of 11 Unified Combatant Commands (UCC). USTRANSCOM provides command and control (C2) for the synchronized transportation, distribution, and sustainment of personnel and assets, making possible the projection and maintenance of national power wherever needed with speed and agility, high efficiency, and a high level of trust and accuracy.

The Cyberspaces Operations Forces’ (COF) mission is to provide DODIN Operations, defensive cyber operations-internal defensive measures and overall cyberspace operations in support of

USTRANSCOM network systems and missions. COF provides mission-tailored, joint capability packages to Combatant Commanders in order to facilitate rapid establishment of Joint Force

Headquarters, fulfill Global Response Force execution and bridge joint operational requirements. The

COF delivers unmatched joint operational command and control enablers to Joint Force Commanders conducting emergent full spectrum operations. The Command, Control, Communications, and Cyber

(C4) Systems (C4S) Directorate (J6) provides essential Command, Control, Communications, and

Collaboration Support (C5S) services to the USTRANSCOM Commander in performance of the command’s mission to provide mission-tailored, joint capability packages to meet national security objectives.

USTRANSCOM COF operates in an environment which interfaces with numerous on-site and remote commercial, DoD, service, and common-user networks (i.e., Secret Internet Protocol Router Network

(SIPRNet), Non-secure Internet Protocol Router Network (NIPRNet), and the Scott AFB Local Area

Network (LAN), Wide Area Network (WAN) or Metropolitan Area Network (MAN)). A myriad of applications make use of the USTRANSCOM C4 infrastructure by providing access and services to the USTRANSCOM user community.

USTRANSCOM operates the Common Computing Environment (CCE) surrounded by a network defense infrastructure. The USTRANSCOM CCE, supported by TCJ6 and USTRANSCOM

Component Commands, is comprised of several operating systems on clients and servers, both physical and virtual. Supported operating systems, software, applications are listed in Appendix F: Operating

Systems/Software/Applications Supported and Protocols in Use are listed in Appendix G: Protocols in

Use. The diversity of applications riding on the USTRANSCOM CCE (C2 systems, information management systems, mail/message systems, and security systems) increases the complexity and difficulty to integrate new system requirements. The information security infrastructure operating with the USTRANSCOM CCE is a unique integration of products demanding a high degree of technical skills and understanding.

1.2 Scope

The scope of the Cyberspace Operational Forces (COF) requirement is to provide cybersecurity defense for the USTRANSCOM enterprise. This will be Security Operations Management/Cybersecurity Service

Provider (CSSP) services for on premises and in cloud environments. The major associated activities that the contractor shall perform cybersecurity boundary defense; infrastructure support; intrusion detection monitoring and incident management; cyber threat analysis; security solution administration; insider threat detection and analysis; cybersecurity forensic analysis; data scientist for zerotrust, policy analytics, splunk, and continuous improvement and optimization.

The Cyberspace Operational Forces (COF) contract is responsible for protecting against, defending, and responding to suspicious or malicious cyber activity across the USTRANSCOM enterprise. The contractor shall utilize managed services best practices to perform the tasks and subtasks of this Performance

Work Statement (PWS) to provide responsive IT service delivery. The required outcomes are delivering COF services to USTRANSCOM users within agreed service levels and achieving continual cybersecurity improvements to the COF services. The contractor shall be responsible for coordinating, managing, assigning resources, processes, and activities with regard to the successful delivery of the entire cybersecurity service delivery process as defined in this PWS. The contactor, in concert with the Government, will establish, collect, and report metrics to evaluate and improve service delivery performance.

This contract will also cover and support execution of USTRANSCOM's CSSP mission, defensive cyberspace operations (DCO), coordination of Cyberspace Protection Team (CPT) missions and requirements, DCO and joint planning to include development of Concepts of Operations (CONOPs) and

Operational Plans (OPLANs), joint training and readiness management, spectrum management, Satellite

Communications (SATCOM) mission planning, survivable SATCOM operations, senior leader airborne communications support, and tactical communications projects. The contract will require 24/7 on-site support for some COF activities.

2. Specific Tasks

The contractor shall provide the knowledge, skills, abilities, staff support, and other related resources necessary to conduct the following Tasks:

● Task 1: Contract Level and Contract Management Requirements

● Task 2: Cyberspace Operations Support

● Task 3: Cybersecurity Service Provider (CSSP) Security Operations Management Support

2.1 Task 1: Contract Level and Contract Management Requirements

This task area consists of the functional activities relating to the administration and management of this effort. This task area specifies overarching program management for contractor tasks, personnel resources, and costs to ensure deliverables meet requirements under this PWS. The contractor shall immediately notify the Government when personnel are no longer associated with the project so accounts are deactivated promptly.

The contractor shall provide all deliverables, referenced documents, and contractor-generated and

Government approved plans, schedules, and milestones. The contractor shall meet Government requirements and milestones. The contractor shall notify the government, in writing, within 24 hours of the missed deadline.

The contractor shall identify a Program Manager (PM). The contractor shall designate a principal point of contact for technical issues. The Program Manager is the authorized point of contact with the

Government Contracting Officer’s Representative (COR). Responsibilities include, but are not limited to, interfacing with Government management personnel, staffing of all tasks, formulating and enforcing work standards, assigning schedules, reviewing work discrepancies, and communicating policies, purposes, and goals of the organization to subordinates.

All decisions regarding Government requirements or Government actions shall be made by Government personnel. The contractor’s representative shall submit evaluations, recommendations, etc., to the COR and/or Contracting Officer (CO) for action.

2.1.1 Task 1 Subtask 1: Contract Management Plan

The contractor shall submit a Contract Management Plan within fifteen (15) business days of contract award. The Government will review the plan and provide comments to the contractor within five (5) business days from receipt of the updated Contract Management Plan. The contractor shall have five (5) business days from receipt of the Government’s comments to submit the final plan. The contractor shall update the plan each option year within fifteen (15) business days after the option year being exercised.

2.1.2 Task 1 Subtask 2: Monthly Status Report

The contractor shall provide a Monthly Status Report (MSR) no later than the 15th of the month following the reporting period. In conjunction with the contract end date, the contractor shall submit a final MSR no later than the last business day of the final period of performance.

At a minimum, the MSR shall include the following information:

1. A list of the accomplishments, projects/assignments, and identified shortfalls/gaps for the reporting period by each active task area.

2. A synopsis of the efforts completed; deliverables provided; conferences and meetings attended;

and trips conducted during the reporting period. The MSR shall include a spending “burn down” financial graph showing funds expended to date and funds remaining against the budgeted amount.

The format of the financial chart(s) shall be as agreed between the contractor and the Government.

3. An overall evaluation of the contract to date, listing per task any issues, problem areas, missed deadlines, problem causes/resolutions and items that require Government action.

4. Delivery schedule for each project/initiative with breakdown of hours expended.

5. Ad-hoc Government Requested Metrics.

6. Staffing status, to include projected vacancies, current vacancies, and efforts towards filling vacant positions.

7. Cyberspace Workforce certification status of personnel aligned to task(s) being supported, to include basic, specialty and computing environment certifications and associated expiration dates.

2.1.3 Task 1 Subtask 3: In-Process Review

The contractor shall conduct quarterly In-Process Reviews (IPRs) as scheduled by the Government. The

IPR shall summarize status, progress, recommendations, and concerns in the development of any tasks or documentation described within this PWS. Initial quarterly IPR presentation material provided five

(5) business days prior to IPR meeting. Final presentation materials shall be prepared and provided to the COR two (2) business days prior to the IPR.

2.1.4 Task 1 Subtask 4: Travel

Performance under this contract may require contractor travel within and outside the Continental United

States. The Government will reimburse the contractor for travel expenses subject to the Federal

Acquisition Regulation (FAR) and the Joint Travel Regulation (JTR). All contractor travel shall be coordinated with and validated by the primary or alternate COR prior to incurring any travel expenses.

The contractor shall identify personnel who will be traveling in sufficient time to obtain the lowest possible rates for airfare, rental car, and lodging. For long distance travel, a minimum of five (5) business days advance notice from the travel commencement date is required. The travel request shall be in writing and contain the dates, location, and estimated travel costs. Contractor invoices (along with associated receipts) shall support all travel reimbursement requests.

2.1.5 Task 1 Subtask 5: Trip Reports

Within five (5) business days of completion of any travel, the contractor shall submit a trip report to include the following details: purpose, location, trip duration, travelers, and travel costs.

2.1.6 Task 1 Subtask 6: Meeting / Conference Minutes

The contractor shall attend meetings or conferences held at USTRANSCOM or other locations as identified by the Government, and provide meeting/conference minutes that detail the results as well as the impact of the meetings/conferences within three (3) business days’ day after completion of the meeting/conference. Meetings/Conferences will generally take place during the normal duty hours.

2.1.7 Task 1 Subtask 7: Personnel Status Report

The contractor shall provide a personnel status report containing names and labor categories and task alignment and Cyberspace Workforce certifications (reference Appendix) of personnel supporting each major task. The contractor shall provide the report within twenty (20) business days of the contract start date and update the report within five (5) business days of any changes in personnel. The Contractor shall make every reasonable attempt to fill any vacancy of a position described in the Technical and

Management Work Plan in a time period no longer than a single billing cycle.

2.1.8 Task 1 Subtask 8: Non-Disclosure Agreement (NDA) for Contractor Employees and

Company to Company Agreements

Due to the sensitive nature of the data and information contractor personnel have access to, the contractor shall provide signed Nondisclosure and Conflict of Interest Agreements (NDAs) for all contractor personnel who perform any work under this contract to ensure contractor personnel do not compromise sensitive or proprietary information. The contractor shall provide a signed NDA for all personnel assigned to this contract. The contractor shall not grant their personnel access to COF information technology or supporting information before the signed NDA is accepted by the COR. The Government will retain these documents. See Appendix 3, Nondisclosure and Conflict of Interest Agreements. The contractor shall also be required to sign a non-disclosure agreement in accordance with DFARS

227.7103-7 if there is access to technical data or computer software delivered to the Government with restrictions as described in DFARS 227- 7103-7. Before obtaining access to another contractor’s proprietary information, in accordance with FAR 9.505-4, the contractor must agree with the other company to protect the information, complete necessary agreements, and furnish such agreements to the

Contracting Officer.

In addition to working with the Government, the Contractor will be required to work with other contractors in support of the TRANSCOM mission. The Contractor may gain access to proprietary information of other companies during contract performance. The Contractor agrees to enter into company-to-company agreements to: (1) protect another company's information from unauthorized use or disclosure for as long as it is considered proprietary by the other company; and, (2) to refrain from using the information for any purpose other than that for which it was furnished. For information purposes, the Contractor shall furnish copies of these agreements to the contracting officer. These agreements are not intended to protect information which is available to the Government or to the

Contractor from other sources and furnished voluntarily without restriction.

2.1.9 Task 1 Subtask 9: Transition-In Plan

For the first 30 calendar days, the incoming contractor personnel will be provided transitional training, i.e. will work side-by-side with or shadow the outgoing contractor on the local processes and procedures for performance of day-to-day duties, specifically deliverables. This effort is not functional in nature, but is to familiarize the incoming contractor with the USTRANSCOM work environment as it relates to the requirements of the PWS. The overall goal of the transition period is to ensure uninterrupted support and seamless transfer of responsibilities to the incoming contractor team(s). Management of the overlap between contracts is a Government function, and guidance will be issued providing direction and clarification of each contractor's responsibilities within the scope of their respective contracts.

This is the minimum essential task for the incoming contractor; nothing within this task limits the responsibility of the contractor to fully execute the contract from the date scheduled for full performance beginning 30 days after contract start.

2.1.10 Task 1 Subtask 10: Transition-Out Plan

The contractor shall provide a phased transition plan, to be executed if the follow-on contract is awarded to another prime contractor(s). The plan's level of detail must be sufficient for each of the parties to understand and execute; the parties are the Government, the incumbent contractor, and the contractor(s) awarded the follow-on contract. The overall goal of the transition plan is to ensure uninterrupted support to USTRANSCOM and seamless transfer of responsibilities to the incoming contractor team(s). Management of the overlap between contracts is a Government function, and guidance will be issued providing direction and clarification of each contractor's responsibilities within the scope of their respective contract. The contractor will ensure Task Continuity Folders (Task 4) are updated and available for review thirty (30) calendar days prior to period of performance expiration.

The transition plan should address the tasks in PWS. The transition plan shall consist of two parts:

transition-in and transition-out. The transition-in commences upon commencement of performance by a follow-on contractor and concludes when the incoming contractor team(s) is ready to assume responsibility for tasks and deliverables. Contract close-out requirements shall be executed by the outgoing contractor during the transition-out.

The incumbent contractor will provide a transition out plan that includes: 1) in-brief for Government and incoming contractor team management; 2) orientation for new contractor personnel; 3) training to incoming contractor personnel on standing COF procedures and use of specific information system applications; 4) transfer of Government property; 5) implementation of subcontractor arrangements; 6) exchange of program-related corporate knowledge; 7) establishment of memoranda of agreements and nondisclosure agreements as required; 8) administrative and logistic requirements (e.g. personnel in-processing, applying for Common Access Card and government system accounts, etc).

2.1.11 Task 1 Subtask 11: Service Contractor Manpower Report

The contractor shall report in the System for Award Management (SAM): 1) the total dollar amount invoiced for services performed during the previous Government fiscal year under the contract; 2) the prime contractor direct labor hours expended on the services performed during the previous Government fiscal year; and 3) if applicable Tier 1 subcontract number, including DUNS number/Unique Entity

Identifier (UEI) and name, and the number of subcontractor direct labor hours expended under the contract. Reporting inputs will be for the labor executed during the period of performance during each

Government fiscal year (FY), which runs October 1 through September 30.

Billing cycle for this contract will be on a monthly basis, (first calendar day of each month through the last calendar day of that month).

2.1.12 Task 1 Subtask 12: Incident Management

Contractor shall use the government provided incident handling trouble ticket systems for all trouble tickets, technical issues, and/or service delivery actions.

2.1.13 Task 1 Subtask 13: Mission-Essential Contractor Services Plan

Contractor shall provide a plan for Mission-Essential Contractor Services. The plan shall include provisions for providing split operational, as described below, support of tasks during exercises and contingencies. Contractor’s plan shall specify required mission essential services and plan to support per the government’s approval. If any personnel changes or contract modification occurs to impact the

Mission-Essential Plan, a revised plan is due within thirty (30) business days.

The government functional(s) has identified all or a portion of the services performed under this contract as “Emergency-Essential” as defined and described in DoD Instruction (DODI) 1100.22, “Policy and

Procedures for Determining Workforce Mix.” Hereafter, the personnel identified by the contractor to perform these services shall be referred to as “Mission Essential Contractor Personnel.” Requirements

Affecting Contractor Personnel Performing Mission Essential Services

This applies to personnel supporting Task Area 3, Subtask 4.2 and Task Area 3 Subtask 4.3 (Optional) during contingencies, emergencies, and/or exercises.

Within twenty (20) business days after contract start, the contractor shall provide a written list of all

“Mission Essential Contractor Personnel” to the government functional(s) or designee. The list shall identify individual employee names and their work locations under this contract.

The government functional(s), as required to comply with or perform pursuant to DoD requirements, shall direct the contractor to comply with requirements intended to safeguard the safety and health of Mission

Essential Contractor Personnel. The contracting office may communicate the requirements through a letter of notification or other means, and subsequently modify the contract to incorporate new requirements as needed.

2.1.14 Task 1 Subtask 14: Equipment Custodian Duties

The contractor shall perform Equipment Custodian (EC) duties within their area of responsibility and maintain proper accountability of all Government owned/purchased hardware IAW United States

Transportation Command Instruction (USTCI) 33-16, Management of Information Technology Hardware

& Software Assets, and Air Force Manual (AFMAN) 17-1203, Information Technology (IT) Asset

Management (ITAM), as well as maintain inventory information for all warranty and maintenance contracts. The contractor shall provide inventory information to the Government IAW with USTCI 33-

16, annually or within 30 days from EC change.

2.2 Task 2: Cyberspace Operations Support

The contractor shall provide support for USTRANSCOM's Cyberspace Operations to include

Cyberspace Protection Team (CPT) operations, cyberspace operations planning, joint training and readiness management, spectrum management, Satellite Communications (SATCOM) mission planning, survivable SATCOM operations, senior leader airborne communications support, and tactical communications projects.

Support for this task shall be provided during the duty hours listed in paragraph 5.8. The contractor shall support all sub-tasks using the Government provided automated software tools, when applicable, and IAW the suspense assigned by the Government or through the Government staffing process.

The Government estimates twenty (20) trips annually in support of this task.

2.2.1 Task 2 Subtask 1: Cyberspace Operations Support

The contractor shall support the planning and execution of C4S and Cyberspace Operations IAW command guidance and current operations timelines. This support shall include:

2.2.1.1 Task 2 Subtask 1.1: Cyberspace Operations Support

• Supporting J6 facilitated cyber-related Battle Rhythm Events (BREs) by:

o Developing and distributing written agendas o Drafting and maintaining written BRE documentation o Gathering, consolidating, and building BRE slide decks and contents o Facilitating sessions to include briefing topics assigned by the BRE facilitator o Documenting and disseminating written minutes, action items, and records o Coordinating event times and locations to include scheduling conference rooms and required GFE communications resources (i.e. VTCs, conference lines, etc.)

o Operating GFE information systems to include Microsoft Office Products and

SharePoint portals/sites

• Supporting USTRANSCOM orders process by:

o Developing draft Cyberspace Operations orders on behalf of government representative o Serving as TCJ6 focal point for reviewing, commenting on, and coordinating

USTRANSCOM orders in accordance with TCJ3-led orders process o Maintaining written records of TCJ6 Division and overall Directorate comments/responses to orders coordination o As directed, drafting, coordinating and submitting TCJ6 compliance reporting on assigned/tasked orders

• Assisting with development of DCO CONOPs aligned to cyberspace domain mission assurance requirements

• Advising on integration of DCO and CPT capabilities to manage/mitigate operational risk resulting from cyberspace threats and vulnerabilities.

2.2.1.2 Task 2 Subtask 1.2: Cyberspace Operations Support

• Supporting USTRANSCOM and external Boards, Bureaus, Centers, Cells, and Working

Groups (B2C2WG), BREs, planning conferences, briefings, and planning teams/groups by:

o As directed, attending on behalf of government representative o Developing and presenting USTRANSCOM approved briefing products on behalf of government representative o Submitting written notes, action items, and briefing products to appropriate government representatives based on USTRANSCOM equities and communities of interest o Assessing and recommending USTRANSCOM involvement in planning and implementation efforts

• Maintaining knowledge and awareness of future joint Cyberspace Operations development efforts/initiatives (for example, Joint All Domain Command and Control

(JADC2), Joint Cyber Command and Control (JCC2), and Joint Cyber Warfighting

Architecture (JCWA))

2.2.2 Task 2 Subtask 2: Support to Joint & Strategic Planning

The contractor shall support all phases of the Joint Planning Process (JPP) to ensure incorporation of

USTRANSCOM C4S and Cyberspace Operations equities. This support shall include:

2.2.2.1 Task 2 Subtask 2.1: Support to Joint & Strategic Planning

• Ability to support planning activities for up to one (1) supporting plan per quarter

• Maintaining knowledge of and advising on current National and DoD cyber policy, doctrine, guidance, instructions, and orders

• Assisting with writing of USTRANSCOM policy, doctrine, operating techniques, methodology, and procedures for Cyberspace Operations and C4S security, survivability, sustainability, interoperability, and readiness across the JDDE

• Assisting government representatives with analyzing, writing, and maintaining C4S (Annex K) and

Cyberspace Operations (Appendix 16, Annex C) portions of Campaign, Contingency, and

Operations Plans IAW prescribed Adaptive Planning and Execution (APEX) formats and JP 5-0

Joint Planning doctrine

• Attending relevant B2C2WGs, planning conferences, briefings, and planning teams/groups and providing written minutes on C4S and Cyberspace Operations relevant tasks and/or guidance

• As directed, coordinating with USTRANSCOM planning stakeholders and authors

• Accomplishing TCJ6 assigned joint planning tasks during real world and exercise/training events

• Assisting development and maintenance of critical asset lists (CAL) and defended asset lists (DAL) to inform Cyberspace Operations planning o Supporting MRT-C and KT-C analysis o Facilitating production of a CAL/DAL based on identified MRT-C and KT-C o Identifying gaps and seams in MRT-C and KT-C

2.2.2.2 Task 2 Subtask 2.2: Support to Joint & Strategic Planning

• Ability to support two (2) concurrent planning efforts for USTRANSCOM supporting plans

• Supporting development of USTRANSCOM and TCJ6 strategy documents o Recommending and advising on objectives for USTRANSCOM Cyber and C4S strategies o Developing supporting tasks and identifying appropriate OPRs and OCRs o Assisting with development of and reporting against assessment metrics

2.2.3 Task 2 Subtask 3: Support to CPT Operations

The contractor shall support all aspects of CPT missions to include:

2.2.3.1 Task 2 Subtask 3.1: Support to CPT Operations

• Ability to support up to two (2) concurrent CPT operations

• Facilitating implementation/execution of the USTRANSCOM CPT mission coordination lifecycle from initial nomination to post-mission reporting

• Developing and maintaining templates and process documentation for the USTRANSCOM CPT mission coordination lifecycle

• Utilizing approved templates, o Prepare CPT mission nomination packages and briefings o Draft and coordinate CPT tasking orders, mission packages, and rules of engagement

• Reporting mission status via government provided systems/portals to internal/external stakeholders

IAW mission guidelines and applicable policies

• Maintaining and validating records/requests and all supporting documents for CPT account creation

• Tracking CPT account status

• Identifying and coordinating actions to resolve issues with CPT accounts or access to

USTRANSCOM systems and networks

• Maintaining records of program and system owner responses to mission findings as documented in

CPT-produced mission reports and outbriefs by o Correlating mission findings with security processes/policies o Coordinating findings with all applicable program and system owners o Receiving and tracking program/system POA&Ms o Monitoring/reporting on mitigation/resolution actions

• Assisting with identification and implementation of process improvement initiatives

2.2.3.2 Task 2 Subtask 3.2: Support to CPT Operations

• Ability to support up to four (4) concurrent CPT operations

• Identifying shortfalls/gaps in CPT capability or capacity and ICW Cyberspace Operations-Integrated

Planning Element (CO-IPE), recommend and develop requests for support/direct support in accordance with Global Force Management processes

• Advising TCJ6 on impacts/concerns of DoD-wide Defensive Cyberspace Forces resourcing and alignment decisions

2.2.4 Task 2 Subtask 4: Support to Joint Exercise Planning

The contractor shall be responsible for analyzing, developing, and planning C4S and Cyberspace

Operations support to meet Directorate-approved training objectives and exercise requirements. This support shall include:

2.2.4.1 Task 2 Subtask 4.1: Support to Joint Exercise Planning

• Developing exercise plans and participating in exercise planning events for up to two (2) Tier 1

CCMD exercises and two (2) Command Post/Tabletop Exercises per fiscal year

• Preparing and maintaining a comprehensive Cyberspace Operations exercise planning schedule that identifies all exercise/training events utilizing USTRANSCOM C4S and Cyberspace Operations resources

• Serving as interface between USTRANSCOM Operations and Plans Directorate (TCJ3), TCJ6, CO-

IPE and TCC personnel to ensure proper planning for C4S and Cyberspace Operations resources

• Recommending options for and assisting with resolution of exercise and resource conflicts

• Organizing and facilitating Cyberspace Operations-focused tabletop exercises for campaign, deliberate, contingency, and crisis response scenarios

• Serving as Directorate focal point for developing, consolidating and coordinating TCJ6 exercise/training objectives

• Building Cyberspace Operations Master Scenario Events List (MSEL) and entering MSELs into applicable GFE databases and portals for Chairman Joint Chiefs of Staff (CJCS), CCMD, and

USTRANSCOM exercises

• Assisting with designing, planning, coordinating, and integrating cyber effects into exercises to achieve the command’s training objectives

• Identifying requirements for and coordinating/scheduling exercise observers and evaluators

• Facilitating design of a TCJ6 Cybersecurity Assessment Program (CAP) IAW DOT&E guidance and evaluation requirements o Developing Cyber Readiness Campaign activities to meet CAP objectives o Completing and coordinating required CAP documentation to include production of an annual

Cybersecurity Assessment Master Plan (CAMP)

• Developing and coordinating requests for exercise enabling activities to include Red Teams and cyber threat emulation o Preparing and staffing support agreements o Documenting rules of engagements o Facilitating planning and working sessions with appropriate stakeholders

2.2.4.2 Task 2 Subtask 4.2: Support to Joint Exercise Planning o Ability to support up to three (3) Tier 1 CCMD exercises and three (3) Command Post/Tabletop

Exercises per fiscal year o Support up to two (2) wargaming events to include development of scenarios, identification of resources, and collaboration with modeling teams

2.2.5 Task 2 Subtask 5: Readiness and Joint Training

The contractor shall be responsible for facilitating the USTRANSCOM TCJ6 readiness and joint training reporting. This support shall include:

• Preparing the TCJ6 Monthly Mission Training Assessment Report, Quarterly Training Brief (QTB), Joint Monthly Readiness Report (JMRR) and quarterly Joint Forces Readiness Report (JFRR)

• Performing an annual update of the Joint Mission Essential Task List (JMETL)

• Managing the TCJ6 Joint Mission Essential Tasks (JMETs)

• Overseeing the monthly and quarterly JMET assessments

• Providing guidance and training to Directorate assessors on the Defense Readiness Reporting

System (DRRS) and Joint Training Information Management System (JTIMS)

• Evaluating the C4S and Cyberspace Operations portion of the Command’s readiness reports to determine sufficiency and accuracy of provided information

• Compiling the data into meaningful readiness indicators

• Recommending JMET updates/changes and assessment criteria

• Assisting with preparation for USTRANSCOM joint training meetings and completing any action items and after action reports as necessary

• Managing the USTRANSCOM TCJ6 Joint Lessons Learned Program (JLLP)

• Serving as the TCJ6 Lessons Manager (LM)

• Providing lessons learned inputs to the USTRANSCOM Joint Lesson Manager, IAW

USTRANSCOMI 3100.01 (10-14), after contingency, exercise, and training events.

2.2.6 Task 2 Subtask 6: Communications Spectrum Management

The contractor shall be responsible for supporting all functions of Spectrum Management within

USTRANSCOM. This support shall include:

• Serving as the USTRANSCOM Point of Contact (POC) for all radio frequency (RF) spectrum related matters

• Identifying, documenting, and coordinating on RF spectrum resource requirements supporting

USTRANSCOM's worldwide missions

• Submitting frequency-spectrum resource requests IAW mission requirements

• Reviewing and developing spectrum management portions of operational and exercise plans

• Interfacing with CC/S/A representatives to ensure adequacy of spectrum management support for contingency, crisis response, and exercise plans

• Coordinating with the Joint Chiefs of Staff (JCS), Military Communications-Electronics Board

(MCEB), Joint Spectrum Center (JSC), Service’s Spectrum Management Offices, participating

Combatant Commander Staffs, and TCCs on spectrum problems that arise during exercises and contingencies

• Assisting with development of command-specific policy and guidance for use of the electromagnetic spectrum

• Advising on implementation of new, spectrum-efficient technologies for their use in support of the command’s spectrum requirements

• Performing monthly assessments of spectrum-related JMETs

• Providing technical advice for all spectrum/wireless communications issues

2.2.7 Task 2 Subtask 7: SATCOM Management and Planning

The contractor shall be responsible for supporting all aspects of SATCOM management and planning.

This support shall include:

• Serving as the USTRANSCOM Point of Contact (POC) for all SATCOM programs and requirements

• Reviewing and developing SATCOM portions of operational and exercise plans

• Providing SATCOM planning support to worldwide USTRANSCOM and TCC end-users for narrowband, wideband, protected, and commercial capabilities

• Validating all USTRANSCOM-related SATCOM requests, to include satellite and gateway access requests

• Maintaining monthly metrics on the number and timeliness of satellite/gateway requests processed, and provide to the Government two (2) business days prior to presentation

• Arranging, monitoring, and supporting USTRANSCOM SATCOM operations during training, exercise, and contingency/crisis events from pre‐ deployment through execution to termination, supporting USTRANSCOM Command Centers (including alternate sites), and deployed forces

• Assisting with resolving problems that users may encounter in planning or operating SATCOM terminals

• Maintaining and supporting USTRANSCOM's and TCC’s satellite database entries

• Guiding potential users through identification of command‐wide SATCOM requirements and assisting USTRANSCOM in justifying and defending these requirements to the Joint Staff and in validating the command Integrated Communications Database (ICDB)

• Performing customer interviews and site surveys required for any changes to the existing SATCOM systems

• Reviewing engineering plans and site information to ensure conformance with current architecture, as well as assist in the development of future changes and upgrades to SATCOM systems

• Providing technical assistance with the installation, implementation, configuration, integration, and status of USTRANSCOM SATCOM systems

• Coordinating with and ensuring each site is prepared to accept delivery of SATCOM hardware, and assessing the impact of different SATCOM designs at USTRANSCOM sites

• Participating in acceptance testing and tracking of maintenance requirements

• Identifying any single point of failure to include recommendation of changes to prevent isolation of

SATCOM systems

• At a minimum, conducting annual technical evaluations of SATCOM to ensure proper interoperability/integration with current and future C2 systems and networks; and identify and document equipment and software deficiencies and their impact on operability and security.

• Preparing appropriate briefs, information papers, and requirement documents necessary to assess, implement, install, and monitor terminal facilities and supporting systems

• Notifying IT Operations Management within one (1) hour of any negative impacts to operational status

• Performing monthly assessments of SATCOM related JMETs

2.2.8 Task 2 Subtask 8: Survivable Satellite Communications Terminal Operations and

Management

The contractor shall be responsible for supporting and operating government provided survivable satellite communications terminals and associated equipment supporting USTRANSCOM on Scott

AFB. This shall include:

• In coordination with 375th Air Mobility Wing maintenance personnel, addressing and resolving all issues related to terminal operations and associated voice and data circuits

• Monitoring the operational status of the terminal, associated applications, databases, and voice and data circuits during duty hours

• Producing terminal outage/restoral messages IAW current DoD guidance and sending to required

USTRANSCOM IT Operations Management within one (1) hour of awareness of outage/restoral

• Coordinating scheduled system outages through Authorized Service Interruptions (ASIs) process to gain approval from USTRANSCOM and AMC emergency action personnel

• Providing 24-hour on-call support for terminal outage reporting

• Providing hardware user orientation, initial hands-on and back-up operational training for the terminal equipment to 375th Air Mobility Wing maintenance and user personnel, estimated at four to six personnel per year, when required by the Government

• Supporting COMSEC requirements, maintenance and operating activities ICW the USTRANSCOM

Global Operations Center (GOC), AMC 618th Air Operations Center (Tanker Airlift Control Center

(TACC)), and the terminal located in buildings 750/751

• As required, attending survivable satellite communications mission planning and operations training courses. These classified training courses are not commercially available. USTRANSCOM will schedule attendance at such courses. If contractor personnel resign or are removed from the contract at the request of the contractor, the cost of training any replacement contractor personnel shall be the responsibility of the contractor.

• Participating in planning events for system upgrades, enhancements, or augmentation affecting the survivable satellite communications functionality.

2.2.9 Task 2 Subtask 9: Airborne Communications Task Management

The contractor shall coordinate with Air Mobility Command Senior Leader Command, Control and

Communications System (SLC3S) staff personnel. This shall include:

• Developing, advocating for, and defending Integrated Priority List (IPL) nomination packages

• Supporting the biennial SLC3S Interim Program Review (IPR) updates to USTRANSCOM

Commander (TCCC) by scheduling the IPR with senior USTRANSCOM staff members and distributing read-ahead material to all participants, IAW with Government staffing process

• Reviewing and providing comments on system specifications, safety, and Operational Test

Evaluations (OT&E) requirements IAW Government suspense.

2.2.10 Task 2 Subtask 10: Tactical Communications Task Management

The contractor shall provide project management support and technical assistance on tactical C4S issues.

Tactical C4S issues can include but are not limited to radios, computers, SATCOM, phones, video teleconference, in-transit visibility systems, and air traffic control systems. This support shall include:

• Reviewing/recommending, planning, policy development, technical integration and interoperability, implementation, installation, and life-cycle support for tactical C4S

• Assisting with planning, organizing, developing, and implementing all elements of assigned projects

• Assisting in ensuring that all projects conform to current DoD guidelines and standards.

2.2.11 Task 2 Subtask 11: Contingency, Emergency, and Exercise Operations Support

During operation of the C4 systems that support USTRANSCOM there may be instances where the

Government will increase the level of support due to contingency, emergency, or exercise operations.

When increased levels of operation are forecast, the COR will notify the contractor, in writing, ten (10) business days prior to the change. During contingency operations, the Government may require 24-hour continuous C4S support for the USTRANSCOM Global Operations Center, the COR will notify the contractor, in writing, a minimum of 24 hours prior to the need of support. In the event of an unforeseen contingency or emergency, the Government may notify the contractor verbally, to be followed up in writing. Notification will include the identification and scope of the contingency, emergency, or exercise. Extended support shall be activated within 24 hours after notification by the Government unless otherwise specified. The Government may extend the on-site hours during contingencies, emergencies, or exercise to 24-hour operations. The Government estimates up to seven (7) contingency/emergency/exercise periods per year.

2.3 Task 3: Cybersecurity Service Provider (CSSP) Security Operations Management Support

The contractor shall act as subject matter experts (SME) for CSSP associated activities. The contractor shall perform cybersecurity boundary defense; infrastructure support; intrusion detection monitoring and incident management; cyber threat analysis; security solution administration; insider threat detection and analysis; cybersecurity forensic analysis; and continuous improvement and optimization.

In this capacity, the contractor shall attend meetings or conferences held at USTRANSCOM and/or other locations as identified by the Government, and provide written meeting/conference minutes unless otherwise exempted by the Government.

The contractor shall maintain and enhance the USTRANSCOM CSSP Security Operations Management using Government-furnished security mechanisms and equipment located at Scott AFB, IL;

USTRANSCOM Commercial/Government Cloud Environment; Joint Enabling Capabilities Command

(JECC)—Norfolk, VA; Ramstein AB, GE; McConnell AFB, KS, O’Fallon IL, Fairview Heights, IL;

USTRANSCOM component and support locations; and undisclosed alternate location. The contractor shall configure, maintain and enhance Government-furnished security mechanisms hosted on premises and in cloud service provider environments.

The contractor shall support the Cybersecurity Service Provider (CSSP) in maintaining plans and procedures to augment existing personnel to surge operations in response to major incidents. Surge conditions could last for up to 14 days, or longer depending the circumstances.

The contractor shall perform all work in accordance with all applicable laws, e.g., Executive Order 13800, Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure; Clinger Cohen Act

(CCA); regulations and national standards, e.g., National Institute of Standards and Technology (NIST);

DoD, DISA, NSA, USCYBERCOM, and USTRANSCOM standards and instructions; and commercial best practices.

The contractor personnel whom support Task 3 shall be authorized to telework on in the event of inclement weather, health concerns, or additional specific events approved by the CSSP government staff. All telework activities must be conducted through government provided VPN. In performance of these duties, the contractor shall set office procedures for reporting to work, measuring and reviewing work prior to Government acceptance, and time attendance and recording. All telework shall be performed on Government issued laptops, and the contractor shall take all appropriate measures to safeguard Government information. Verification of telework capabilities and any issues encountered which prevent normal operations while teleworking shall be electronically documented and communicated to the appropriate CSSP government staff within two (2) business days of telework duty completion. In the event of a real world/unplanned outage, the contractor shall contact the appropriate

CSSP government staff for further instruction on telework procedures. The Government will furnish a

NIPR laptop with VPN connectivity to USTRANSCOM for telework access to include access to

Government systems, files and email. No classified work shall be performed while teleworking. The

Government will define the means of communication during telework hours.

The contractor shall maintain continuous situational awareness over the Evaluator Scoring Metrics

(ESM) applicable to assigned Performance Work Statements (PWS) tasks. Reference ESM as specified in DoD O- 8530.01-M. During the course of this contract, the contractor shall ensure that applicable documentation and deliverables meet the requirements of the most current ESM in effect and when required create new SOPs and documentation in support of this objective.

The Government estimates twenty (20) trips annually in support of this task. After completion of trips, the contractor will provide written trip reports within 5 duty days unless otherwise exempted by the

Government.

2.3.1 Task 3 Subtask 1: Cybersecurity Operations and Defense Task Lead

The Contractor shall identify a senior level Cyber Operations Manager to serve as the Government’s POC and to provide technical and administrative supervision and guidance for all contractor personnel assigned to the CSSP Task, supervise on- going technical efforts, and manage contract performance. The contractor shall provide on-site support at Scott AFB from 0730 to 1630 local time, Monday through Friday, and afterhours and weekend support, as required to support incident response and exercise activities with a one (1) hour response time to begin work. The activities associated with this task include, but are not limited to the following:

• Support USTRANSCOM defensive cyber operations and initiatives

• Coordinate all day-to-day CSSP contract activities and deliverables

• Liaison between USTRANSCOM Component Head entities, CSSP Subscribers, and cyber mission partners (e.g. Cyber Protection Teams, USCYBERCOM, JFHQ DODIN, DISA, peer CSSPs, etc.)

• Ensure compliance with latest Evaluator Scoring Metrics and other applicable cybersecurity guidance

• Develop and implement formal processes and procedures to support the CSSP Process Improvement

Program which include but not limited to, incorporating lessons learned into current processes and procedures; communicating relationships and trends; identifying potential gaps in cybersecurity (e.g.

countermeasures, policies/procedures, infrastructure defenses, etc.)

• The Principal Technical Writer will be required to generate documents that communicate the installation, configuration, and operations.

2.3.1.1 Task 3 Subtask 1.1: Cybersecurity Technical Writing Support

The Contractor shall manage and produce technical documentation and guidelines based on Federal and

DOD policies, and industry best practices.

The Contractor shall produce and maintain technical documentation and guidelines based on Federal and

DOD policies, and industry best practices. At a minimum the contractor shall perform the following tasks in support of the objective:

• Produce and maintain concise and effective documentation. including but not limited to

USTRANSCOM business correspondence, online content, whitepapers, instruction manuals, design specifications, standard operating procedures, service catalogs, memorandums of agreement, and step-by-step “checklists” that document the processes and procedures for providing cybersecurity services to USTRANSCOM.

• Edit USTRANSCOM documentation considering style, grammar, purpose, and audience in accordance with DoD Plain Language standards as defined in http://www.dtic.mil/whs/directives/plainlanguage.html.

• Contractor shall provide recommendations to government to help improve the readability and usability of documents by shaping the content, tone, design, and presentation.

• Document current work processes and procedures by writing and compiling technically accurate content utilizing various methods, including but not limited to visual diagrams.

• Maintain current copies of government approved CSSP deliverables on the authorized

USTRANSCOM CSSP knowledge management portal.

2.3.1.2 Task 3 Subtask 1.2: Cybersecurity Operations and Defense Task Lead Metrics and

Process/Procedure Documentation

The contractor shall collect and provide the Government with metrics on cybersecurity defense activity to include:

• Monthly list of cybersecurity support tool suite rule/policy modifications implemented

(i.e. firewalls and proxy capabilities)

• Monthly uptime statistics based on service availability for all cybersecurity support tool suite

(i.e. firewalls, proxy servers, EDR, HBSS, WAF, SIEM, NIDS, etc.) based on service assurance monitoring

• Weekly Activity Report which includes, but is not limited to, incidents worked, cyber alerts/tippers created and disseminated, signatures updated, etc.

• Consolidated list of all monthly on call activity for Task 3. Report shall include time notified, time tech arrived on station, and time issue was resolved. If tech was able to resolve issue without reporting on station, include only time notified and time resolved

• Monthly audit report of all privileged accounts on the cybersecurity defense tools and devices.

• The Principal Technical Writer will be required to generate documents that communicate the installation, configuration, and operations.

The contractor shall also maintain current documentation on cybersecurity defense processes and procedures and provide the following deliverable…