Attachment J.3.4 TASK ORDER NO. 4.docx

Draft October 2015

ATTACHMENT J.3.4

Performance Work Statement Project: Engaging Fleet Operators on Cybersecurity

1.0 Overview

The Advanced Technology Division of Federal Motor Carrier Safety Administration (FMCSA) has a requirement to promote cybersecurity best practices, increase cybersecurity awareness for carriers and industry and to provide tools and resources to improve commercial motor vehicle cybersecurity posture.

2.0 Background: Cybersecurity is of critical importance in the trucking industry due to the increasing reliance on technology and interconnected systems that facilitate modern logistics and transportation. With the advent of telematics, electronic logging devices (ELDs), advanced driver-assistance systems (ADAS), and the emergence of automated driving system (ADS)- equipped commercial motor vehicles (CMVs), and expanding Artificial Intelligence (AI), the industry has become more efficient and data-driven. However, this technological evolution has also exposed trucking companies to a range of cyber threats that can compromise the safety and security of operations. The consequences of a cyber-attack could be detrimental to a business. In 2023, ORBCOMM, an ELD provider, experienced a ransomware attack which led to widespread outages for many ELDs.

FMCSA is interested in engaging the trucking industry and promoting the adoption of good cybersecurity practices and identifying the gaps in the adoption of these practices. This stakeholder engagement effort shall focus on the following topics withing cybersecurity:

· Organizational cybersecurity

· ADAS

· Aftermarket devices that fall into the internet of things (IoT)

· ADS

· AI

· Smart trailer technologies

· Other emerging technologies and potential threats that could create cybersecurity risks in the trucking industry

The end goal of this effort is to promote cybersecurity best practices, increase cybersecurity awareness for carriers and industry and to provide tools and resources to improve cybersecurity posture. There are a number of industry associations that are conducting work in this space. For example, American Trucking Association (ATA) and National Motor Freight Traffic Association (NMFTA) are both organizations that provide resources, training materials and other tools to provide carriers with information on how to have good cybersecurity posture in addition to spreading awareness. This task order is not in place to compete with these organizations. Instead, this project serves to bolster and extend the efforts to engage as many carriers as possible. The Contractor could even consider working with these organizations to access their network of carriers to increase the reach of this effort.

3.0 Overall Objective: The objective of this task order is to promote cybersecurity best practices within the commercial motor vehicle industry by:

1) Engaging and educating motor carriers and other industry stakeholders through innovative means on the tools and resources available to improve cybersecurity posture.

2) Developing a webpage where useful information, tools, training materials and other information can be accessed and utilized.

To achieve the objectives outlined above, the work performed by the Contractor must meet the minimum criteria described in this statement of work.

4.0 Scope: The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to conduct this project, to include those necessary for the experiment described in this document.

FMCSA is seeking creative and innovative approaches to achieve the overall project objectives listed above. With this understanding, FMCSA has developed a high-level project management plan (PMP) for consideration by Offerors that describes key tasks. This suggested PMP should not be considered complete, sufficient nor denote minimum requirements. Offerors are encouraged to modify this plan as appropriate to best accomplish the project objectives.

Suggested key tasks:

Task 1: Project Management Plan and Monthly Reporting Task 2: Kick-Off Meeting and Finalize the PMP Task 3: Conduct Cybersecurity Engagement Activities Task 4: Cybersecurity Website Content Development Task 5: Draft Final Report Task 6: Final Briefing Task 7: Submit Final Report and Research Brief Goal: The goal of this task order is to promote cybersecurity best practices within the trucking industry. The project seeks to educate carriers on the tools and resources that are available to carriers, and other industry stakeholders, that can improve cybersecurity posture. The project seeks to conduct this engagement through innovative means. Lastly, the project seeks to develop a website where useful information, tools, training materials and other information can be accessed and utilized. The effort is looking to answer the following questions:

· What are the current levels of awareness and understanding of cybersecurity risks amongst stakeholders?

· How can FMCSA bolster the efforts of industry organizations without duplicating work?

· Are there common knowledge gaps amongst stakeholders that can be addressed by the efforts of this task order?

· How much of an impact are cybersecurity attacks having on carriers and carrier safety?

· Can innovative, user-friendly, tools be developed that will help to engage stakeholders?

· What are the most effective methods for educating and training carriers on cybersecurity best practices?

· If money were not a barrier to adoption, would carriers care about cybersecurity?

· How can stakeholders be made more aware of potential cybersecurity risks that could impact operations?

· How is the cybersecurity landscape changing with the development and deployment of AI?

TASK DESCRIPTIONS

4.1 Task 1: Project Management Plan and Monthly Reporting

Project Management Plan The Contractor will draft a PMP which includes basic descriptions of the tasks, procedures, and timelines for this project. The Contractor will deliver the draft PMP for FMCSA review within 1 week of project award.

The draft PMP must include the following details, at a minimum:

The PMP should be updated as appropriate (e.g., in response to feedback) throughout the period of performance. The Contractor will deliver subsequent edits of the PMP to FMCSA for review throughout the period of performance.

Monthly Reports In addition to the draft PMP, the Contractor will submit monthly progress reports to FMCSA no later than the 10th the following month. The reports will be submitted electronically in Microsoft Word format to FMCSA. Each report should summarize the achievements of the project for the previous month. The reports should also report any challenges that could potentially impact the timing of deliverables. Each report shall include the following at a minimum:

1. Progress update on the high-level tasks

a. This shall include a percent completion value for each task, deliverable and/or milestone

2. Planned next steps for the next month

3. Explanation of tasks not met and why (If any)

4. Detailed explanation of issues occurred, risk mitigation plan and resolutions

5. Chart summarizing total costs incurred for the month, cumulative costs up to the reporting period and remaining balance of the project funding

6. A chart that summarizes the following for each month

a. Invoice

b. Invoice date

c. Invoice total

d. Amount paid

e. Activity timeframe

f. Total charges to date

7. Note of any tasks that FMCSA needs to complete

Bi-weekly Status Meetings The Contractor shall establish a bi-weekly meeting schedule between the FMCSA and the Contractor at a time approved by the COR. This meeting schedule shall be established within one month of contract award and will occur virtually or in-person. The bi-weekly meeting will cover topics overall project status, deliverable progress, potential issues, topics requiring feedback from the FMCSA and other relevant topics. The meeting occurrences can become more frequent if agreed upon between the Contractor and the COR.

Quarterly Status Briefings The Contractor shall establish a schedule of quarterly status briefings between the FMCSA and the Contractor within one month of contract award. The purpose of the quarterly briefings will be to provide a briefing to U.S. Department of Transportation (DOT) staff on the progress of the project, get feedback and discuss issues that need the be resolved. The primary audience for the quarterly briefings is DOT management. The Contractor and the COR will coordinate to schedule the quarterly briefings at an agreed upon time when key project personnel and DOT staff are available.

Task 1 Deliverables

· Deliver preliminary PMP

· Deliver monthly status reports

· Bi-weekly status meetings

· Deliver draft quarterly briefing slides

· Quarterly status briefings

4.2 Task 2: Kick-Off Meeting and Finalize the PMP

The Contractor and FMCSA will hold a kick-off meeting either virtually or at FMCSA headquarters in Washington, D.C. within two months of bilateral execution of this Agreement. The kick-off meeting will involve the key research team partners from each organization, and, at a minimum, the Contractor’s project lead will attend the kick-off (whether virtually or in-person). The meeting will provide an opportunity for these key staff to meet and discuss project details.

The Contractor will prepare a briefing for the meeting which reviews the draft PMP, including the project tasks and timelines. Upon request by the Contractor, FMCSA will provide the Contractor with a briefing on report-formatting and Section 508 compliance for reference.

After the kick-off meeting, the Contractor will finalize the PMP by making any necessary updates, including the incorporation of feedback from FMCSA. The Contractor will submit the written, finalized PMP to the contracting officer’s representative for FMCSA.

Task 2 Deliverables

· Schedule kickoff meeting

· Deliver finalized PMP

4.3 Task 3: Develop and Execute Industry Engagement Plan

The Contractor shall work with the COR to develop an innovative industry engagement plan. The goal of this plan is to create awareness of cybersecurity vulnerabilities and to either reference existing tools or to create tools and resources for carriers to use. The content developed under the engagement plan can be used on popular social media platforms (including, but not limited to Facebook, Instagram and LinkedIn). These social media post will include videos, recommendations, best practices, testimonials and other information to improve stakeholder understanding of CMV cybersecurity. For example, posts could include short video interviews with carriers, fleet managers or drivers describing how following cybersecurity best practices helped to prevent their organization from experiencing a cyber-attack.

The Contractor shall conduct a market scan to identify existing efforts, tools and resources that are already available for carriers. The intent is not to duplicate existing work but to compliment these efforts. The Contractor is encouraged to schedule interviews, meetings and briefings with industry stakeholders. The market scan could include engaging carriers, technology providers, other DOT modes and industry organizations to identify potential gaps in cybersecurity knowledge. The Contractor shall deliver a draft report summarizing the findings from the market scan for possible inclusion on the website content developed in a later task. This market scan may also inform the cybersecurity engagement plan.

The Contractor is encouraged to collaborate with organizations that promote cybersecurity within the trucking industry such as National Motor Freight Traffic Association (NMFTA)[footnoteRef:2] and American Trucking Associations (ATA)[footnoteRef:3] Technology Maintenance Council (TMC). [2: NMFTA, see https://nmfta.org/ ] [3: American Trucking Association, see https://www.trucking.org/ ]

This engagement task is not limited to only social media. The Contractor shall consider developing other innovative methods to promote and inform industry on cybersecurity best practices, education and safety. The Contractor shall develop materials for distribution at conferences and other industry events (upon request from the COR).

Engagement activities should include but not be limited to:

· Fireside chats

· Demonstrations

· Training courses

· Animated training videos

· Development of cybersecurity tools and resources for carriers to use

· Interviews (maximum of 9)

· Workshops

· Aftermarket device penetration testing and reporting

· Revisiting outdated best practices

· Cybersecurity conference representation for FMCSA (upon request)

· Other innovative types of events and engagement activities not mentioned above but proposed by the Contractor

The Contractor shall submit media (images, animations, videos, shorts etc.,) for potential use on FMCSA social media posts. Suggested posts may include:

· Industry updates

· Success stories (interview or testimonial)

· Stories about experiences after an attack (i.e., testimonial)

· Cybersecurity best practice tips

· Cybersecurity statistics within the trucking industry

· References to standards and best practices

· Other topics not mentioned above but proposed to the Contractor

The Contractor shall deliver material for 8 social media posts per year- 2 per quarter. At a minimum, 2 of the 8 annual posts will include videos. Duration of video posts shall consider the maximum time allowed by social media sites for such postings (Especially if the video is used for a “story” versus a typical post.) The intention is for the videos to be short but impactful. The maximum length of any video shall be 90 seconds. Upon request from the COR, the Contractor shall make edits to any of the social media materials within 1 week. The format of this content will be determined through discussions between the Contractor and the COR.

The Contractor shall develop methodologies for assessing the effectiveness of the engagement efforts developed in this task. The Contractor shall develop surveys for events organized and hosted during this task to get feedback from participants on the effectiveness of the event, event messaging, materials etc. The surveys for the events carried out for this task order shall not exceed 9 total participants. The Contractor and the COR will work to identify participants, at random, for feedback from specific events. The Contractor shall compile the evaluation data and highlight key achievements, challenges and lessons learned from each event. The Contractor shall use this feedback to adjust the engagement plan throughout the period of performance. If the engagement plan is to be updated, the revisions shall be reviewed and approved by the COR. The Contractor shall maintain a change log documenting the details of each revision of the cybersecurity engagement plan.

4.3.1 Task 3.1: Tabletop Exercise

The Contractor shall organize and host one virtual or in-person tabletop exercise. The COR will determine if the event will be virtual or in person within 6 months of the task order being awarded. For the tabletop exercise, the Contractor shall implement a virtual environment to help engage the participants. The Contractor will host planning meetings between FMCSA, key stakeholders and all relevant parties to define the objective and scope of the tabletop exercise, identify the platform and define requirements for the virtual platform etc., The Contractor shall also consider backup plans, to mitigate risk, in the event that there are technological failures or difficulties. The Contractor shall not develop the tabletop exercise from scratch. The Contractor is encouraged to work with an organization that has previously conducted tabletop exercises. The Contractor shall conduct verification testing to make sure that the tabletop exercise program functions as specified by the requirements. Lastly, the Contractor shall conduct a demonstration (dry run) of the tabletop exercise for FMCSA at least 1 month prior to the actual event involving carriers. This is to allow time for modifications after feedback from FMCSA.

4.3.2 Task 3.2: Virtual Webinar

The Contractor shall also organize and host one virtual webinar on cybersecurity. The scope of the webinar shall be agreed upon by the Contractor and the COR during the development of the engagement plan.

Task 3 Deliverables

· Conduct market scan for existing efforts

· Deliver draft report on market research

· Tabletop exercise planning meetings

· Develop industry engagement plan

· Define scope for tabletop exercise

· Deliver requirements for tabletop exercise

· Conduct tabletop exercise verification testing

· Tabletop exercise dry run

· Host tabletop exercise

· Virtual cybersecurity webinar for carriers

· Develop conference materials

· Submit materials for social media postings

4.4 Task 4: Cybersecurity Website Content Development

The contractor shall develop content for the FMCSA cybersecurity website. The Contractor shall propose an initial website page design, layout and content for review by the COR. The website content shall meet FMCSA branding and style requirements. The COR will provide the latest requirements with the Contractor.

Content for the website shall include but not be limited to:

· References to trainings, best practices, guides, infographics, checklists etc.

· Threat intelligence feed/information regarding the latest cybersecurity threats

· Draft calendar showing industry related cybersecurity workshops, conferences, events etc.,

· Industry news updated at a frequency agreed upon between the COR and the Contractor

· Other relevant content not mentioned above but proposed by the Contractor and approved by the COR

Task 4 Deliverables

· Develop Cybersecurity Website content

· Update website content

4.5 Task 5: Draft Final Report

The Contractor will draft and submit to the contracting officer’s representative for FMCSA a final written report detailing the Contractor’s findings following the analyses. The final report will detail the datasets used, analysis methodologies, findings, limitations, recommendations, and any other pertinent information.

Task 5 Deliverables

· Deliver draft final report

The Contractor should operationalize the findings in a manner that allows FMCSA to interpret and apply the findings in a straightforward fashion. For example, the Contractor might present the examined variables in terms of the proportion of variance accounted for in any analyzed relationships or in terms of the size of the effects.

4.6 Task 6: Final Briefing

The Contractor will conduct a final briefing for FMCSA staff either virtually or at the FMCSA offices in Washington, DC. The Contractor will deliver a draft of the briefing to FMCSA for review two weeks before the final briefing is set to occur. This briefing will provide an opportunity for FMCSA to address questions that arise during its review of the report.

Task 6 Deliverables

· Deliver final briefing

4.7 Task 7: Submit Final Report and Research Brief

The Contractor will submit a Section 508-compliant final report and a two-page research brief summarizing the report to FMCSA. The final report will incorporate all previously received feedback from both FMCSA and the peer review.

Task 7 Deliverables

· Deliver final report and research briefing

5.0 Deliverables and Milestones

The timeline below is a suggested timeline. The Contractor shall propose their own timeline so long as all deliverables are met. The COR shall approve the Contractor’s proposed timeline for milestones and deliverables if it is different from what is in the chart below:

6.0 Period of Performance

The period of performance shall be 36 months.

7.0 1252.237-73 Key Personnel

(a) The personnel as specified below are considered essential to the work being performed under this contract and may, with the consent of the contracting parties, be changed from time to time during the contract by adding or deleting personnel, as appropriate.

(b) Before removing, replacing, or diverting any of the specified individuals, the Contractor shall notify the contracting officer, in writing, before the change becomes effective. The Contractor shall submit information to support the proposed action to enable the contracting officer to evaluate the potential impact of the change on the contract. The Contractor shall not remove or replace personnel under this contract until the Contracting Officer approves the change.

The Key Personnel under this contract are:

Senior Technical Program Manager Senior Research Associate Computer Programmer

Key Personnel Recommended Minimum Qualifications

Senior Technical Program Manager:

· B.S in EE or a related field

· 4 years of experience as a Program Manager or PI in the field

· Knowledge of AI, cybersecurity, ADAS and ADS

Senior Research Associate

· B.S. in EE, IT or related field

· Knowledge and understanding of ADAS, ADS, telematics and IoT

· Knowledge of cybersecurity best practices and frameworks (NIST, CISA, NMFTA etc.,)

· Extensive knowledge of ADAS, ADS, telematics systems and IoT

Computer Programmer

· B.S. or M.S. in computer science, electrical engineering or related field

· 5+ years of experience

· Proficiency in HTML5 and Java script

· Extensive experience with both front end and back-end development

· Experience development in virtual environments

· Experience developing APIs