Attachment 1 - Performance Work Statement (PWS).pdf

PERFORMANCE WORK STATEMENT

FOR

595th TRANSPORTATION SURFACE

BRIGADE LOGISTICS SUPPORT

SERVICES DEPLOYMENT AND

DISTRIBUTION SERVICE SUPPORT

11 March 2026

Prepared by

UNITED STATES TRANSPORTATION COMMAND

DIRECTORATE OF ACQUISITION

AND

ARMY TRANSPORTATION COMMAND (ARTRANS)

Logistics Support Services Deployment and Distribution Service Support

Attachment 1, Performance Work Statement

11 March 2026

TABLE OF CONTENTS

SECTION 1 DESCRIPTION OF SERVICES

1.1 Background

1.2 Scope of Contract

1.3 Hours of Operation

1.4 Place of Performance

1.5 Specific Deployment and Distribution Service Support Tasks

1.6 Quality Control Plan (QCP)

1.7 Deliverables

SECTION 2 SERVICE DELIVERY SUMMARY (SDS)

SECTION 3 GOVERNMENT-FURNISHED PROPERTY AND SERVICES

SECTION 4 GENERAL INFORMATION

4.1 Transition of Operations

4.2 Identification of Contractor Personnel

4.3 Contractor Responsibilities

4.4 Security

4.5 Cybersecurity

4.6 Safety

4.7 Non-Disclosure Agreements ............................................................................................................................. 1664.8

............................................................................................................................................ Vendor Threat Mitigation

APPENDIX A: USCENTCOM AO PORTS

APPENDIX B: NON-DISCLOSURE AGREEMENT

18 February 2026

SECTION 1 DESCRIPTION OF SERVICES

1.1 Background

The 595th Transportation Surface Brigade (TSB) provides United States Army Transportation Command

(ARTRANS) forward presence in order to coordinate redeployment support, container and cargo/freight management, and door-to-door/door-to-port/port-to-port/port-to-door surface distribution operations in the United

States Central Command (USCENTCOM) area of responsibility (AOR). The brigade manages Universal Services

Contract (USC), Multi-Modal (MM), and Military Sealift Command (MSC) Chartered, cargoes entering and exiting the Theater of Operations (TO). In support of this critical task, the 595th TSB requires contract deployment and distribution service support for traffic management services, related vessel services support, documentation not limited to Global Air Transportation Execution System (GATES) transaction (e.g. Cargo Manifest (DD Form 1385), Working/Final Vessel Papers, tally transactions, reconciliation, etc.), USCENTCOM Custom Clearance support

(e.g. AK-302, JOC-I, MOFA, MAP Memo, etc.), and Track and Trace system and report capability (Daily ITV reports, yard reports, booked cargo reports, etc.). Coordination with the operations, yard, and vessel team members is critical to ensure data accuracy.

1.2 Scope of Contract

1.2.1 This contract’s purpose is to provide contract deployment and distribution services in support of the 595th

TSB and subordinate units’ operations missions throughout the USCENTCOM AOR. Contractor shall provide support, ensuring completion of suspense actions and compliance with regulatory guidance, beginning 45 calendar days after receipt of the Notice to Proceed. In accordance with Federal Acquisition Regulations (FAR) section

7.503, the Contractor shall not perform inherently governmental functions. Contract services provided are not active duty or services under 38 United States Code (USC) §106 and Department of Defense Directive (DoDD)

1000.20, Active Duty Service Determinations for Civilian or Contractual Groups. This effort shall be limited to non-personal services that include, but are not limited to, activities described in the following paragraphs for the

Installations, Seaports, Airports within the USCENTCOM Area of Operations (AO), Appendix A.

1.2.2 Terms such as “manage,” “administer,” and “oversee” as used in this contract shall not be taken to mean that contractor personnel can perform inherently governmental functions. Decision making, supervision, and directing US Government employees (hereafter referred to as Government) are examples of inherently governmental functions and are not authorized under this contract. Contractor personnel shall only provide recommendations to

595th TSB management and cannot make final decisions in any manner.

1.2.3 The contractual work requires knowledge in transportation, logistics to include cargo and freight tracking using DOD Defense Transportation System (DTS) systems (i.e. Global Air Transportation Execution

System (GATES), Integrated Booking System (IBS), Business Support and Container Management (BSCM)), port cargo management/operations, customs clearance in accordance with Defense Transportation Regulation

(DTR) Part V Chapter 512 USCENTCOM and ARTRANS Country Customs Customer and Carrier Advisories, and documentation procedures

1.2.4 Contractor personnel should be proficient in Microsoft Office Suite Programs (Word, Excel, Power

Point, Outlook, Teams, etc.).

1.3 Hours of Operation

The Contractor shall ensure that all work hours, including any overtime, fully comply with applicable Host Nation Labor

Laws and any relevant labor standards. Operations at the ports identified in this PWS may be required seven (7) calendar days per week, 365 days per year. The standard workweek consists of 40 hours, scheduled Sunday through Saturday, with daily hours of operation from 0700 to 1700. The Contractor shall provide continuous coverage throughout the week to meet operational requirements.

1.4 Place of Performance

1.4.1 The Contractor will manage all port operation documentation within the USCENTCOM AOR, in accordance with the Defense Transportation Regulation (DTR) and as specified in but not limited to

Appendix A. Specific responsibilities for each port will depend on the overall scope and guidance provided by the Command Group (USCENTCOM AOR) for import/export cargo tracking. The Contractor's primary place of performance will be at the Military port of Shuaiba, otherwise known as Camp Spearhead.

1.5 Specific Deployment and Distribution Service Support Tasks

1.5.1 The Contractor shall maintain constant communication with the designated Point of Contact (POC) and carriers to proactively identify and resolve potential operational problems, ensuring uninterrupted service delivery from commencement. Prompt submission of exception reports is required for any issues impacting service continuity.

1.5.2 Global Air Transportation Execution System (GATES) Operations

1.5.2.1 Operate the Global Air Transportation Execution System (GATES) - Surface for seaport operations within the 595th

TSB AOR

1.5.2.2 Coordinate with the 595 TSB to ensure all cargo entering or exiting the port is accurately tallied in GATES. For cargo discharged from vessels, GATES data shall be updated within 48 hours of discharge.

1.5.2.3 Receive, build/create, verify, correct, and process GATES files and transmit reports.

1.5.2.4 Generate and provide vessel documents, including GATES Working/Final Vessel Papers and cargo manifests (DD

1385), to 595th TSB Operations and Vessel Representatives.

1.5.2.5 Provide daily In-Transit Visibility (ITV) update reports for cargo moving within the DTS. These reports shall include information regarding export/import cargo entering or exiting the USCENTCOM area of responsibility. The contractor shall coordinate the content and data included in the reports with the Contracting Officer’s Representative (COR) or other designated government personnel to ensure accuracy and relevance. The contractor shall distribute the reports via email to a designated distribution list, which shall be managed and kept up to date by the contractor in coordination with the

COR or other designated government personnel.

1.5.2.6 The contractor shall prepare accurate import and export summary reports. The content and data included in these reports shall be coordinated with the Contracting Officer’s Representative (COR) or other designated government personnel to ensure accuracy, completeness, and alignment with operational requirements.

1.5.2.7 Provide at hoc reports and Requests for Information (RFI) to the authorized US Government representative either via electronic or hard copy, as needed.

1.5.2.8 The contractor shall promptly report any system issues to the 595th TSB Operations representative to ensure timely resolution and minimal disruption to operations.

1.5.3 Integrated Booking System (IBS) and Business Support and Container Management (BSCM)

Operations

1.5.3.1 Cargo Management and Reporting

1.5.3.1.1. Operate and maintain IBS and BSCM, including the Pipeline Asset Tool (PAT) and Joint Container Management

(JCM).

1.5.3.1.2 Prepare and provide import/export summary reports, inventory reports, daily on-hand reports for both import and export cargo, aged cargo reports, weekly open transfer reports, and other reports as directed by the COR to ensure command visibility of all commercial cargo (import and export) including cargo on hand, receiving, or shipped, and upon completed of any cargo movement.

1.5.3.1.3 Reconcile cargo and container statuses with shipping documentation and port records.

1.5.3.1.4 Advise the Government, (595th TSB), of any potential issues affecting the ability to book cargo commercially via strategic contracts such as MM and USC, or via Military Sealift Command (MSC) chartered or activated vessels in accordance with the DTS requirements.

1.5.3.2 Cargo Documentation and Customs Clearance

1.5.3.2.1 When Contractor-arranged Cargo Clearance is ordered by the Government, the Contractor shall assume principal responsibility for all cargo clearance activities. These activities shall include all services required by local practices, such as:

1.5.3.2.1.1 Coordinating with the shipper/consignee and local customs authorities to obtain and/or prepare all necessary documentation for cargo clearance (excluding signatures).

1.5.3.2.1.2 Preparing and providing required forms/documents to the receiver or Government for signature.

1.5.3.2.1.3 Delivering completed documentation to the customs office and ensuring all required documentation is provided to local entities to facilitate the release and on-carriage of cargo to its final destination.

1.5.3.3 Cargo Coordination and Movement

1.5.3.3.1 Ensure the coordination of cargo pickup, cargo booking, reconciliation of lift on Board (LOB).

1.5.3.3.2 Coordinate with the CORs to ensure that necessary import cargo is exported properly.

1.5.3.3.3. Coordinate the onward movement of commercial cargo and promptly notify the Government of any risks related to

Cargo Left on Port (CLOP). Identify and resolve potential issues and submit exception reports as required

1.5.3.4 Cargo Tracking and Tracing (Within the USCENTCOM AOR)

1.5.3.4.1 Track and trace cargo from origin to final destination for ports in the USCENTCOM AOR.

1.5.3.4.2 Verify and document all cargo details at the point of origin to ensure accurate tracking initiation.

1.5.3.4.3 Maintain real-time visibility and accurate inventory of all cargo and containers from arrival through departure by utilizing approved tracking systems, including RFID and electronic tracking tools, and ensuring updates at each transit point.

1.5.3.4.4 Input and maintain current cargo status in designated systems such as GATES, IBS, and BSCM to provide accurate and timely information.

1.5.3.4.5 Identify and report any discrepancies, delays, or issues encountered during transit to appropriate

Government personnel immediately.

1.5.3.4.6 Liaise with port authorities and customs officials within the USCENTCOM AOR to facilitate smooth cargo handling and clearance.

1.5.3.4.7 Confirm arrival and condition of cargo at the final destination, documenting any damages or irregularity.

1.5.3.4.8 Prepare and submit comprehensive tracking reports in accordance with contract requirements and the Service

Delivery Summary (SDS). Reports shall emphasize accurate documentation and be delivered on time to meet performance standards outlined in the SDS. As part of this requirement, the contractor shall also:

1.5.3.4.9 Provide Import/Export Cargo Analysis reports on a monthly basis, submitted no later than three (3) calendar days after the end of each month.

1.5.3.4.10 Provide Container Management reports on a daily basis, submitted three (3) times per day.

1.5.4 Government Bill of Lading Management

1.5.4.1 The Contractor is responsible for managing the customs clearance process for USG cargo moving to/from designated USCENTCOM AOR seaports (and airports when utilizing MM).

1.5.4.2 Ensure a GBL is received for all containers and cargo on the carrier’s pre-arrival notice

1.5.4.3 Review shipment documentation for completeness and accuracy (e.g., commodity descriptions, delivery addresses).

1.5.4.4 Request corrections to GBLs from commercial carriers when inaccuracies are identified in cargo descriptions or other information and escalate uncorrectable issues to the USG.

1.5.4.5 Generate customs clearance forms for USG signature and subsequent processing. The USG will provide approved forms and return signed forms to the Contractor.

1.5.4.6 Process all customs clearance activities in coordination with Host Nation officials and USG representatives, ensuring compliance with all applicable local and USG regulations.

1.5.4.7 When requested, handle any additional customs documentation required for import/export clearance.

1.5.4.8 Utilize unclassified ARTRANS Transportation Engineering Agency (TEA) publications provided by the USG to perform contract requirements

1.6 Quality Control Plan (QCP)

1.6.1 The contractor shall establish and maintain a QCP. The contractor's QCP shall explain how the contractor will complete contract tasks in an acceptable manner. The contractor shall submit their QCP to the Contracting Officer

Representative (COR) for review within 30 calendar days after contract award. The COR will review the contractor’s QCP.

1.6.2 Quality Control Files (QCF). The contractor shall maintain a file of all contractor inspections or tests, to include any corrective actions taken. The Government may review the contractor’s QCF at the Contracting Officer (KO’s) discretion during the contract term, to include any extensions of contract term. The contractor’s QCF is Government property and turned over to the Government upon completion or termination of the contract.

1.7 Deliverables

1.7.1 All deliverables shall be submitted directly to the COR and as deemed necessary by the COR, electronically in

Microsoft Office (Word, Excel, Power Point, Outlook, etc.) and via the DTS systems of records (i.e.: GATES, IBS, BSCM).

All deliverables must meet professional standards and comply with the requirements set forth in this PWS.

PWS

Para

Deliverable Title Deliverable Schedule Recipient

1.5.2.2 Discharge and disposition of cargo in GATES Daily 595th/

USCENTCOM

AOR

1.5.2.4 GATES Manifest (DD1385) As required (5 calendar days after sail for long, 3 calendar days after sail for short sail IAW DTR Chapter 203)

595th/

USCENTCOM

AOR

1.5.2.4 GATES Working/Final Vessel Papers As required (within 4 hours of final lifted piece for Final Vessel Papers that include Dangerous Good Manifest)

595th/

USCENTCOM

AOR

1.5.2.5 TCN ITV update reports Daily 595th/

USCENTCOM

AOR

1.5.2.6 & 1.5.3.1.2

Import/Export Summary Report for ports in the 595th AOR: include inventory of cargo on hand, received or shipped and upon completion of any cargo movement.

Daily, End of Day 595th/

USCENTCOM

AOR

1.5.2.7 At Hoc Reports and RFIs As needed 595th/

USCENTCOM

AOR

1.5.3.2.1 USUSCENTCOM Customs Clearance

Documents

Daily 595th/

USCENTCOM

AOR

1.5.3.2.1 IBS Screen Grabs for Customs Clearance As required 595th/

USCENTCOM

AOR

1.5.3.3.1 Lift on Board (LOB) Reconciliation Daily (within 5 calendar days of LOB upload by the carrier)

595th/

USCENTCOM

AOR

1.5.3.4.9 Import/Export Cargo Analysis Monthly (3 calendar days after the end of the month)

595th/

USCENTCOM

AOR

1.5.3.4.10 Container Management Reports Daily (3 times per day) 595th/

USCENTCOM

AOR

1.6 Quality Control Plan 30 Calendar Days after Contract Award COR

4.1.1 Transition Plan 5 Working Days after Contract Award KO and COR

4.1.3 Transition Plan Update 3 Working Days after 595th TSB CDR and COR’s review

CDR and COR

4.3.2 Written Certifications that Contractor

Personnel meet mandatory qualifications

(IBS, BSCM and GATES.)

45 calendar days prior to the base year period of performance

COR

4.3.3 Name of Contractor Personnel 45 calendar days prior to the base year period of performance

KO and COR

4.3.8.1 Designate Supervisor 45 calendar days prior to the base year period of performance

KO and COR

4.3.8.3 Completed Personnel Documentation

Notification

Prior to start work COR

4.3.8.1.7 Mandatory Training Completion List for all

Contractor Personnel

Annually COR

4.4.4. List of Names of Contractor Personnel who

will require access to installations and facilities, and unclassified DoD NIPRNET computer network and systems

45 calendar days prior to the base year period of performance

KO and COR

4.4.6 Government Information Assurance and

Awareness Training

As required KO and COR

4.7 Non-Disclosure Agreement Within one week of contract award COR

4.8 Vendor Threat Mitigation Initial report is due 30 calendar days after contract award and every 6 months thereafter.

KO and COR

SECTION 2 SERVICE DELIVERY SUMMARY (SDS).

The SDS represents important contract objectives that, when met, will ensure contract performance is satisfactory.

Although not all PWS requirements are listed in the SDS, the contractor is fully expected to comply with all requirements in the PWS. The SDS serves as a point of reference for the contractor and Government to measure the services provided.

Desired

Outcome

PWS

Para

Performance

Threshold

(Metric)

Source of Data How Often

Collected

Calculation

Accurate

Documentation

1.5.2.3, 1.5.2.5, 1.5.2.6, 1.5.2.7, 1.5.3.1.2, 1.5.3.2.1.1, 1.5.3.2.1.2

1.5.3.4.2, 1.5.3.4.4, 1.5.3.4.7

1.5.3.4.8

1.5.3.4.9

1.5.3.4.10

1.5.4.5

No more than two sets of corrections per month

Submitted

Documents

As required per applicable

PWS Para.

As documented per applicable

PWS Para.

Timely

Reporting

1.5.2.3, 1.5.2.5, 1.5.2.6, 1.5.2.7, 1.5.3.1.2, No more than two late reports per year

Submitted

Reports

As required per applicable

PWS Para.

As documented per applicable

PWS Para.

1.5.3.2.1.1, 1.5.3.2.1.2

1.5.3.4.2, 1.5.3.4.4, 1.5.3.4.7

1.5.3.4.8

1.5.3.4.9

1.5.3.4.10

1.5.4.5

Timely cyber-incident reporting.

4.5.3 No more than

one late cyber-incident report or unreported cyber-incident in a twelve (12) month period.

Submitted (or

Discovered)

Cyber-Incident

Reports

As required # of late or unreported cyber-incidents per 12 month period

SECTION 3 GOVERNMENT-FURNISHED PROPERTY AND SERVICES

3.1.1 The Government will provide office space, chairs, desks, adequate phone service, and desktop computers for contractor personnel while performing these duties. Administrative and office supplies such as pens, pencils, papers, folders, etc. will be provided to the contractors.

3.1.2 The Government shall provide all Government Furnished Equipment (GFE) to include color printers, maintenance contract and software associated with performing specific duties.

3.1.3 The Government will not provide personal mobile phones. The 595th TSB will provide Government phones on an as-available and as-required basis to perform official Government business only.

SECTION 4 GENERAL INFORMATIONTransition of Operations

4.1.1 The contractor shall submit a detailed draft Transition Plan within 5 working days after contract award to ensure continued contract services for the 595th TSB mission. Transition Plan will be submitted to the KO and

COR.

4.1.2 The 595th TSB Commander (CDR) and COR will review the contractor’s draft Transition Plan and notify the contractor of material weaknesses.

4.1.3 The contractor shall correct material weaknesses and re-submit the Transition Plan within 3 working days after the 595th TSB CDR and COR’s review.

4.1.4 The contractor will coordinate development of the final Transition Plan with the 595th TSB CDR and

COR.

4.1.5 The contractor shall complete and implement the final Transition Plan within 30 calendar days after 595th

TSB CDR and COR approval. Implementation will include training of all contractor personnel for deployment and distribution service support to the 595th TSB.

4.1.6 The COR is responsible for training all current contractor personnel of roles and responsibilities for deployment and distribution service support to the 595th TSB for implementation of the final Transition Plan.

4.1.7 The contractor is responsible for training replacement contractor personnel to the full performance level within 30 calendar days.

4.2 Identification of Contractor Personnel

4.2.1 The contractor shall provide legible Government-issued identification to contractor personnel by start date.

4.2.2 Contractor personnel shall wear Government-issued identification in a conspicuous place on front of exterior clothing and above the waist at all times, while performing contract tasks, except when prohibited for safety or health reasons.

4.2.3 Contractor personnel should identify themselves as such in all official communications, to include meetings, telecommunications, and emails.

4.2.4 Contractor personnel will include the standard disclaimer below on all written communications.

NOTICE: The information contained in this communication is intended for the sole use of the named addresses/recipients to whom it is addressed, in their conduct of official business of the United States

Government. This communication may contain information that is exempt from disclosure under the Freedom of

Information Act, 5 U.S.C. §552 and the Privacy Act, 5 U.S.C. §552a. Addressees/recipients are not to disseminate this communication to individuals other than those who have an official need to know the information in the course of their official government duties. If you received this communication in error, please do not examine, review, print, copy, forward, disseminate, or otherwise use the information. Please immediately notify the sender and delete the copy received.

(Insert Name) is a contracted employee entrusted with programs and projects on behalf of the (Insert Customer.)

He/she may not direct policy and he/she cannot legally bind the U.S. Government to any contract or fiscal responsibility.

4.3 Contractor Responsibilities

4.3.1 The contractor is responsible for the conduct of contractor personnel. The 595th TSB reserves the right to identify contractor personnel for removal for safety or security reasons. The contractor will remove (and replace when needed) contractor personnel upon the COR’s request at no cost to the Government should a safety or security concern be identified.

4.3.2 The contractor shall provide to the COR written certification that contractor personnel meet mandatory qualifications 45 calendar days prior to the base year period of performance and prior to beginning work thereafter.. Contractors shall be qualified in IBS, BSCM and GATES.

4.3.3 The contractor shall submit the names of contractor personnel in writing to the KO and COR 45 calendar days prior to the base year period of performance and prior to beginning work thereafter.

4.3.4 All contractor personnel shall demonstrate fluency and comprehension in the English language including reading, writing, and speaking.

4.3.5 Contractor personnel may be required to drive commercially-leased vehicles for completion of tasks. All contractor personnel shall comply with license requirements outlined in AR 600-55 (The Army Driver and Operator

Standardization Program). Contractor personnel must possess a valid and current US driver’s license or Host

Nation equivalent motor vehicle driving permit. The contractor will coordinate with the COR to obtain a license in accordance with US Army Forces, USCENTCOM (United States Army Central (USARCENT)) policy at the supported installation or camp.

4.3.6 The contractor is responsible for property accountability of Government-issued expendable and non-expendable equipment, which includes, but is not limited to, safeguarding, exercising reasonable practice, due diligence and care.

4.3.7 The contractor shall ensure all contractor personnel meet business integrity and Organizational Conflict of

Interest (OCI) requirements IAW FAR Part 9.5.

4.3.8 Management of Contractor Personnel

4.3.8.1 The contractor shall designate a supervisor in writing to the KO and COR 45 calendar days prior to the base year period of performance. The supervisor will serve as primary interface to the KO and COR. The supervisor shall be directly responsible for the overall supervision and performance of contractor personnel working under this contract. The supervisor shall identify to the COR an alternate within 10 working days prior to any scheduled absence. The supervisor (or alternate) shall be available as necessary during normal duty hours. The supervisor (or alternate) shall have authority to meet with the KO and/or COR to discuss and resolve contract matters. Contractor supervisor shall possess skills to:

4.3.8.1.1 Plan, coordinate, direct, and supervise contractor personnel within the section.

4.3.8.1.2 Exercise supervisory authority over assigned contractor personnel. When necessary, provide recommendations on procedural changes within the purview of their respective mission area.

4.3.8.1.3 Direct, coordinate, organize, and oversee daily workload activities. Distribute workload to assigned contractor personnel. Task and supervise contractor personnel in accomplishing projects, programs, and responsibilities within deadlines. Evaluate performance of assigned contractor personnel. Maintain contractor personnel time and attendance records and leave requests.

4.3.8.1.4 Maintain analytical import/export traffic data for Terminal Operations. Review assigned projects and daily work for completeness and accuracy.

4.3.8.1.5 Communicate daily with 595th TSB and subordinate battalions to manage and ensure accuracy and completion of all work tasks.

4.3.8.1.6 Report to the COR regularly on contractor personnel matters related to work, processes, tasks assignments, and individual and team training needs.

4.3.8.1.7 Ensure contractor personnel complete all current annual mandatory Government Furnished Training courses. As required by the theater operations command, contractor personnel may be required to take additional training. The contractor supervisor shall provide notification and written documentation to the Contracting Officer and the COR upon completion of all mandatory Government training for contractor personnel.

4.3.8.1.8 Participate in meetings and teleconferences as required by the theater operations command.

4.3.8.1.9 Coordinate presentations, cargo analysis, cargo manifests, and other documentation with 595th TSB and subordinate battalions Terminal Operations management.

4.3.8.1.10 Replace contractor personnel demonstrating insufficient knowledge, inadequate skills and/or unsatisfactory performance within 30 calendar days of initial notice.

4.3.8.1.11 Coordinate cross-training and replacement of contractor personnel with the COR.

4.3.8.1.12 Contract Supervisor’s duty location will be at the Military Sea Port of Debarkation (SPOD)- Shuaiba in Kuwait also referred to as Camp Spearhead, Kuwait.

4.3.8.2 The contractor shall develop and maintain a flexible hierarchal management structure that will allow adequate oversight of both contractor personnel’s’ activities and work products.

4.3.8.3 The contractor shall ensure all personnel documentation, including visas, security clearances, Government- issued identification, smart cards, and port passes are complete prior to starting work and shall provide notification to the COR as such.

4.3.8.4 The contractor shall provide the 595th TSB with replacement personnel within 30 calendar days of written notification from the COR.

4.4 Security

4.4.1 Contractor personnel shall read and comply with applicable DoD security regulations, policies, and procedures for access to installations and facilities, and unclassified DoD Non-Classified Internet Protocol Router

Network (NIPRNet) computer network and systems.

4.4.2 DoDM 1000.13-M, Volume 1 will determine contractor personnel eligibility for Government-issued DoD

CAC for access to installations, facilities, and unclassified DoD NIPRNet computer network and systems.

4.4.3 The Government will provide the contractor access to installations and facilities, and unclassified DoD

NIPRNet computer network and systems to complete contract tasks. The COR will sponsor contractor personnel access to installations and facilities, and unclassified DoD NIPRNet computer network and systems. The COR may authorize access to additional systems for the contractor to complete contract tasks.

4.4.4 The contractor shall provide the KO and COR the names of contractor personnel who will require access to installations and facilities, and unclassified DoD NIPRNet computer network and systems 45 calendar days prior to the base year period of performance. The contractor will be responsible for monitoring appropriate use of the unclassified DoD NIPRNet computer network and systems. The contractor will ensure contractor personnel meet all access requirements as defined by the respective ARTRANS functional managers.

4.4.5 Personnel and Physical Security. Contractor personnel must successfully obtain a National Agency Check

Inquiry (NACI) background investigation IAW US and Coalition security policies (DoDM 1000.13, Volume 1 DoD

Identification (ID) Cards: ID Card Life-Cycle, Enclosure 2, paragraph 3) prior to gaining access to installations and facilities. Contractor personnel will present Government-issued identification to access installations and facilities as required.

4.4.6 Information Systems Security. Contractor personnel shall obtain a locally produced PKI smart card or token. Prior to receiving access to the DoD NIPRNet, contractor personnel shall complete DD Form 2875

(System Authorization Access Request) and sign the US Army Central (USARCENT) Acceptable Use Policy

(AUP) IAW DA PAM 25-2-18 (Foreign Personnel Access to Information Systems). The COR will ensure contractor personnel complete annual mandatory Government DoD Cyber Awareness Challenge and Personally

Identifiable Information (PII) training to obtain and maintain access authorization.

The contractor shall furnish, to the KO and COR, written documentation confirming contractor personnel completed

Government Information Assurance and Awareness training. The COR will load contractor personnel information into the NACI Trusted Associate Sponsorship System (TASS) to obtain PKI smart cards or tokens. 595th TSB will verify contractor personnel information prior to the COR loading TASS.

4.4.6.1 The contractor is accountable for Government PKI smart cards and tokens and shall return this property to the COR upon completion of contractor personnel employment. The contractor will not allow contractor personnel to share PKI smart cards and tokens to access information systems of any capacity. The contractor shall report violations to the COR.

4.4.6.2 Contractor personnel shall protect privacy, sensitive, and “For Official Use Only” data during the performance of work.

4.4.7 Operations Security (OPSEC). The Contractor shall comply with Army Regulation (AR) 381-12, Threat

Awareness and Reporting Program. The OPSEC process identifies the critical information of military plans, operations, supporting activities, and indicators that can reveal it and then develop measures to eliminate, reduce, or conceal those indicators. The contractor shall ensure any Government information intended for public release is reviewed and approved by the 595th TSB OPSEC Officer prior to release in any forum (i.e., Internet web-pages, professional publications, company newsletters). For clarification on any OPSEC questions or issues, the contractor shall coordinate with the COR to contact the 595th TSB OPSEC Officer for assistance.

4.5 Cybersecurity

4.5.1 Operationally Critical Support

4.5.1.1 The services provided within the scope of this contract are considered "operationally critical support" as defined in DFARS 252.204-7012.

4.5.2 Cybersecurity Incident Reporting

4.5.2.1 In addition to the DFARS 252.204-7012 reporting requirements for unclassified systems and DoD

Manual (DoDM) 5220.22, National Industrial Security Program Operating Manual (NISPOM) for classified systems, reportable cyber-incidents include, but are not limited to, the following:

4.5.2.1.1 Cyber-incidents as defined in Table 1.

4.5.2.1.1 Notifications by a federal, state, or local law enforcement agency or cyber-center (i.e., National Cyber

Investigative Joint Task Force (NCIJTF), National Cybersecurity & Communications Integration Center (NCCIC)) of being a victim of a successful or unsuccessful cyber-event, anomaly, incident, insider threat, breach, intrusion, or exfiltration.

Table 1.

Incident Category Description

Root Level Intrusion Unauthorized privileged access to an IS. Privileged access, often referred to as administrative or root access, provides unrestricted access to the IS. This category includes unauthorized access to information or unauthorized access to account credentials that could be used to perform administrative functions (e.g., domain administrator). If the IS is compromised with malicious code that provides remote interactive control, it will be reported in this category.

User Level Intrusion Unauthorized non-privileged access to an IS. Non-privileged access, often referred to as user level access, provides restricted access to the IS based on the privileges granted to the user. This includes unauthorized access to information or unauthorized access to account credentials that could be used to perform user functions such as accessing Web applications, Web portals, or other similar information resources. If the IS is compromised with malicious code that provides remote interactive control, it will be reported in this category.

Denial of Service Denial of Service (Incident)—Activity that denies, degrades, or disrupts normal functionality of an IS or DoD information network.

Malicious Logic Installation of software designed and/or deployed by adversaries with malicious intentions for the purpose of gaining access to resources or information without the consent or knowledge of the user. This only includes malicious code that does not provide remote interactive control of the compromised IS. Malicious code that has allowed interactive access should be categorized as Root or User Level

Intrusion incidents. Interactive active access may include automated tools that establish an open channel of communications to and/or from an IS.

Ransomware Malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable. Malicious actors then demand ransom in exchange for decryption. Ransomware actors often target and threaten to sell or leak exfiltrated data or authentication information if the ransom is not paid. Ransomware is a reportable incident that may be associated with multiple incident categories depending on the attack vector and execution.

4.5.2.2 If the cyber-incident affects a classified system, vulnerabilities associated with the incident will be classified per the current version of USTRANSCOM Instruction 31-02, Security Classification Guide.

4.5.3 Cybersecurity Incident Reporting Timelines

4.5.3.1 In addition to providing the notification required by DFARS 252.204-7012, the contractor is required to notify USTRANSCOM as soon as practical, but no later than 72 hours after discovering a reportable cyber-incident. The reporting timeline begins when the incident is discovered or reported to the company, its employees, contractors, or cybersecurity firm responsible for providing cybersecurity and response for the company. The contractor shall contact the USTRANSCOM Cyber Operations Center (CyOC) via phone at 618-817-4222. If the contractor does not immediately reach the CyOC via phone, the contractor shall send an email notification to transcom.scott.tcj6.mbx.cyoc-dodin-operations@mail.mil.

4.5.4 Mandatory Reporting Data

4.5.4.1 The contractor shall work with the USTRANSCOM CyOC through resolution of the incident. Within 72 hours of becoming aware of a reportable cyber-incident, the contractor shall provide an initial notification of the incident, even if some details are not yet available, which includes, but is not limited to, the following information:

(a) Company Name

(b) Who will be the POC with contact information

(c) Contracting Officer POC (name, telephone, email)

(d) Overall Assessment –Description of incident, data at risk, mitigations applied

(e) Indicators of compromise

(f) Vector of attack (if known)

(g) Estimated time of attack (if known)

4.5.4.2 The contractor shall provide a follow-on cyber-incident report to the USTRANSCOM CyOC within 5 days of becoming aware of a reportable cyber-incident, which includes, but is not limited to, the following information:

(a) Contractor unique Commercial and Government Entity (CAGE) code

(b) Contract numbers affected

(c) Facility CAGE code where the incident occurred if different than the prime Contractor location

(d) POC if different than the POC recorded in the System for Award Management (name, address, position, telephone, email)

(e) Contracting Officer POC (name, telephone, email)

(f) Contract clearance level

(g) DoD programs, platforms, systems, or information involved

(h) Location(s) of compromise

(i) Date incident discovered

(j) Type of compromise (e.g., unauthorized access, inadvertent release, other)

(k) Description of technical information compromised

(l) Any additional information relevant to the information compromise

4.5.5 Incident Reporting Coordination

4.5.5.1 In the event of a cyber-incident, USTRANSCOM may conduct an on-site review of network or information systems where DoD information is resident on or transiting to assist the contractor in evaluating the extent of the incident and to share information in an effort to minimize the impact to both parties. Date and time of on-site visits will be mutually agreed upon by USTRANSCOM and the contractor in advance.

4.5.5.2 The contractor agrees to allow follow-on actions by the Government (e.g., USTRANSCOM, Federal

Bureau of Investigation, Department of Homeland Security, DC3, etc.) to further characterize and evaluate the suspect activity. The contractor acknowledges that damage assessments might be necessary to ascertain an incident methodology and identify systems compromised as a result of the incident. Once an incident is identified, the contractor agrees to take all reasonable and appropriate steps to preserve any and all evidence, information, data, logs, electronic files and similar type information (reference NIST Special Publication 800-61, Computer

Security Incident Handling Guide, (current version)) related to the incident for subsequent forensic analysis so that an accurate and complete damage assessment can be accomplished by the Government.

4.5.5.3 The contractor is not required to maintain an organic forensic capability, but must ensure data is preserved

(e.g., remove an affected system, while still powered on, from the network) and all actions documented until forensic analysis can be performed by the Government or, if the Government is unable to conduct the forensic analysis, a mutually agreed upon third party (e.g., Federally Funded Research and Development Center (FFRDC), commercial security contractor, etc.). Any follow-on actions shall be coordinated with the contractor via the

Contracting Officer.

4.5.5.4 The contractor agrees to indemnify and hold the government harmless for following any recommendations to remedy or mitigate the cyber-incident following the actions under 4.5.5.1. and 4.5.5.2.

4.5.6 Confidentiality and Non-Attribution Statement

4.5.6.1 The Government may use and disclose reported information as authorized by law and will only provide attribution information on a need-to-know basis to authorized persons for cybersecurity and related purposes (e.g., in support of forensic analysis, incident response, compromise or damage assessments, law enforcement, counterintelligence, threat reporting, and trend analysis). The Government may share threat information with other

USTRANSCOM industry partners without attributing or identifying the affected contractor.

4.6 Safety

The contractor is directly responsible for the safety and occupational health (SOH) standards for its employees and must comply with The Occupational Safety and Health Act of 1970; or any other applicable Federal, State, and local laws, codes, ordinances, and regulations.

4.6.1 The Contractor shall provide and maintain work environments and procedures which will safeguard the public and Government personnel, property, materials, supplies, and equipment exposed to Contractor operations and activities.

4.6.2 The Contractor shall provide prevention plans and accident investigation procedures upon request from the COR within seven days.

4.6.3 In all instances where damage to government property/equipment or any injuries occur, the

Contractor shall submit a preliminary investigation report to the COR within 24 hours. The Contractor shall follow-up with a full incident/accident investigation report identifying all root causes and corrective actions provided to the COR within 30 calendar days of occurrence.

4.7 Non-Disclosure Agreements

In performance of this contract, the Contractor shall have access to sensitive, non-public information. The contractor agrees (a) to use and protect such information from unauthorized disclosure IAW DoDI 8582.01 (Series), Security of Unclassified DOD Information on Non-DOD Information Systems; (b) to use and disclose such information only for the purpose of performing this contract and to not use or disclose such information for any personal or commercial purpose; (c) to obtain permission of the Government before disclosing/discussing such information with a third party; (d) to return and/or electronically purge, upon Government request, any non-public, sensitive information no longer require for contractor performance; and (e) to advise the Government of any unauthorized release of such information. The Government will require contractor personnel to sign a non-disclosure agreement (NDA) to protect non-public information of other contractors and/or the Government. The

NDA shall be signed and provided to the Government within one week of contract award. The Contractor shall be responsible for obtaining and maintaining NDAs for each Contractor employee assigned to the contract.

Information may only be discussed with those persons outlined on the non-disclosure form. In addition, frequent interactions with other Contractors and contractor proprietary information may be required. The contractor must agree with the other companies to protect their information from unauthorized use or disclosure for as long as it remains proprietary and refrain from using the information for any purpose other than that for which it was furnished. The contractor shall provide copies of those agreements to the contracting officer and ensure that they are properly executed. The execution of said agreements shall be the sole responsibility of the Contractor. The

NDA is located in the Appendix.

4.8 Vendor Threat Mitigation

Subcontractor Suitability. The Contractor shall submit a semi-annual report to the Contracting Officer for each first-tier foreign service provider, operating as a separate legal entity, contracting directly with the Contractor. This includes the foreign service provider’s commonly-owned legal affiliate (if applicable) which has employees who may have physical contact with Government shipments or access to Government systems or information in the ordinary course of contract performance. First-tier foreign service providers within scope include, but are not limited to, freight forwarders, information and technology and system support, compliance and regulatory consultants, and administrative support firms. The initial report is due 30 calendar days after contract award and every six months thereafter.

4.8.1 The report shall include the following information:

4.8.1.1 Legal Company Name (in native language if known)

4.8.1.2 Complete Address including Country

4.8.1.3 Name, phone number and e-mail address of at least one point of contact at the company

4.8.1.4 Any Previous or Alternate Company Names

4.8.1.5 Fax number

4.8.1.6 Website URL

4.8.1.7 International Civil Aviation Organization (ICAO) or equivalent designator (if applicable)

4.8.1.8 Owner(s)/Director(s) name(s) and e-mail address(es)

4.8.1.9 Manager(s) name(s) and e-mail address(es)

4.8.1.10 Frequency of use during reporting period

4.8.2 For foreign subcontractors that fall within the scope of the reporting requirement, the Contractor shall provide a copy of business licenses required for the subcontractor to legally operate in that country.

4.8.3 The Contractor is not required to limit reporting solely to the in-scope foreign subcontractors used during the reporting period, but rather, may provide a complete list of foreign subcontractors in the Contractor’s network. If providing foreign subcontractors that are not used during the reporting period, but are within the network, submissions shall differentiate between those that have been used during the reporting period and those that are only in the network.

4.8.4 The Contractor is responsible for appropriately marking sensitive information as proprietary/trade secret. The

Government will handle proprietary/trade secret information within the applicable statutes, rules, and regulations regarding the handling and release of such information.

4.8.5 Prior to contract performance and periodically throughout performance, the Contracting Officer shall make available to the Contractor the name of active or potential subcontractors determined to be unsuitable. The Contractor shall not allow named entities to perform any role in performance under this contract. If the Contractor chooses to terminate the unsuitable subcontractor, the Government shall not be liable for any costs incurred by the Contractor in establishing or terminating use of the unsuitable subcontractor. The Contractor may choose not to terminate the unsuitable subcontractor for use on its commercial contracts.

4.8.6 An unsuitable determination does not preclude the Contractor from nominating an unsuitable entity for reconsideration during the contract performance period. The Contractor is encouraged to provide the Contracting

Officer additional information that may affect the subcontractor's suitability. Any entity listed in the U.S.

Government Consolidated Screening List (http://export.gov/ecr/eg_main_023148.asp) or otherwise prohibited per

FAR Subpart 25.7, Prohibited Sources, will not be reconsidered.

4.8.7 Except as authorized by the Office of Foreign Assets Control (OFAC) in the Department of the Treasury, Contractors and subcontractors must not acquire any supplies or services if any proclamation, Executive Order, or statute administered by OFAC, or if OFAC’s implementing regulations at 31 Code of Federal Regulation (CFR)

Chapter V, would prohibit such a transaction by a person subject to the jurisdiction of the United States. Most transactions involving Cuba, Iran, and Sudan are prohibited, as are most imports from Burma or North Korea into the United States or its outlying areas. Lists of entities and individuals subject to economic sanctions are included in

OFAC’s List of Specially Designated Nationals and Blocked Persons. More information about these restrictions, as well as updates, is available in OFAC’s regulations at 31 CFR Chapter V and/or on OFAC’s website at http://export.gov/ecr/eg_main_023148.asp. Specific questions about restrictions should be made to the Department of the Treasury Office of Foreign Assets Control, Washington, DC 20220 (Telephone (202) 622-2490)).

Appendix A, USCENTCOM AO Ports

APPENDIX A: USCENTCOM AO PORTS

PORT NAME

SITRA, EGYPT

BEIRUT, LEBANON

JUNIYAH, LEBANON

SAYDA, LEBANON

HAIFA, ISRAEL

TEL AVIV, ISRAEL

EILAT, ISRAEL

ASHDOD, ISRAEL

DAMIETTA, EGYPT

ALEXANDRIA, EGYPT

CAIRO, EGYPT

PORT SAID, EGYPT

SUEZ, EGYPT

RAS SHUKHEIR, EGYPT

JABAL AT THAIR ISLAND, EGYPT

BURSA SAFAGO, EGYPT

TEWFIK, EGYPT

EL BALLAH, EGYPT

BITTER LAKES, EGYPT

SITRA, EGYPT

EL DIKHEILA, EGYPT

ADABIYA, EGYPT

SOKHNA, EGYPT

ALEXANDRIA, EGYPT (BRIGHTSTAR EXERCISE ONLY)

TURKMENBASY, TURKMENISTAN

AKTAU, KAZAKHSTAN

MAZAR-E-SHARIF, AFGHANISTAN

NAIBABAD, AFGHANISTAN

AQABA, JORDAN

AQABA, JORDAN (AERIAL SURFACE - MULTI-MODAL)

RAS AT TANNURA, SAUDI ARABIA

DHAHRAN, SAUDI ARABIA

ASHSHUQAYQ, SAUDI ARABIA

RAS AL MISHAB, SAUDI ARABIA

AD DAMMAM, SAUDI ARABIA

AL KHOBAR, SAUDI ARABIA

AL JUBAYL, SAUDI ARABIA

DAMMAM (KING ABDUL AZIZ PORT), SAUDI ARABIA

QUATAR, SAUDI ARABIA

SAFE HAVEN, SAUDI ARABIA

HODEIDAH, YEMEN

MOCHA, YEMEN

ADEN, YEMEN

SALEEF, YEMEN

MUSCAT, OMAN

MINAN AL FAHAL, OMAN

MINA AL RAYSUT, OMAN

MINA QABOOS, OMAN

SHARJAH (MINA KHALID), OMAN

MASIRAH ISLAND, OMAN

MATRAH, OMAN

SALALAH (MINA RAYSUT), OMAN

SHUWAIKH, KUWAIT

PORT SULTAN, OMAN

MINA SULMAN, BAHRAIN

HALUL ISLAND, QATAR

BAHRAIN ISLAND (ANCHORAGE)

DOHA, QATAR

KHALIFA BIN SALMAN, BAHRAIN

UMM SAID, QATAR

ABO HAMOR, QATAR

RAS LAFFAN, QATAR

BASRA, IRAQ

UMM QASR, IRAQ

KOHR AL AUBAIR, IRAQ

SOUTH PORT UMM QASR, IRAQ

SOHAR, OMAN

BANDAR KHOMEYNI, IRAN

KHORRAMSHAIHR, IRAN

ABADAN, IRAN

BANDAR ABBAS, IRAN

BANDAR-E MAHSHAHR, IRAN

BUSHEHR, IRAN

KHARAG ISLAND, IRAN

ASH SHUWAIKH, KUWAIT --COMMERCIAL CONTAINER

VESSELS

ASH SHUAIBAH, KUWAIT--COMMERCIAL CONTAINER

VESSELS

KUWAIT NAVAL BASE (MSC/CHARTERED VESSELS), KUWAIT

ASH SHUAYBAH (MILITARY VESSELS), KUWAIT

JEDDAH, SAUDI ARABIA

YANBU, SAUDI ARABIA

YANBO, SAUDI ARABA

GIZAN, SAUDI ARABIA

RABIGH, SAUDI ARABIA

DUBAI, UNITED ARAB EMIRATES

ABU DHABI, UNITED ARAB EMIRATES

DUBAI (AERIAL/SURFACE MULTI MODAL)

FUJAIRAH, UNITED ARAB EMIRATES

KHOR FAKKAN, UNITED ARAB EMIRATES

ZIRKU ISLAND, UNITED ARABED ARAB EMIRATES

JEBEL ALI, UNITED ARAB EMIRATES

SAS AL NAKHL, UNITED ARAB EMIRATES

KARACHI, PAKISTAN

MUHAMMAD BIN QASIM, PAKISTAN

GWADAR, PAKISTAN

Appendix B: Non-Disclosure Agreement

APPENDIX B: NON-DISCLOSURE AGREEMENT

NONDISCLOSURE AGREEMENT AND AGREEMENT TO DISCLOSE POTENTIAL CONFLICTS OF INTEREST

FOR CONTRACTOR EMPLOYEES ON USTRANSCOM CONTRACTS

NOTE: This Agreement is a standard agreement designed for use by contractor (including sub-contractor) employees assigned to work on USTRANSCOM contracts.