GBFMD_Performance Work Statement (PWS).docx

Global Bulk Fuel Management and Delivery (GBFMD) Exhibit 1, Performance Work Statement Effective 30-September-2025

Performance Work Statement (PWS) United States Transportation Command Directorate of Acquisition Specialized Transportation Division, TCAQ-IL

Global Bulk Fuel Management and Delivery (GBFMD) Data Analysis

30 September 2025 to 29 September 2028

Table of Contents

SECTION 1 Purpose This Performance Work Statement (PWS) details the requirements for contractor support in conducting classified data-driven analyses of DoD requirements to inform the integration of these capabilities into USTRANSCOM's Global Bulk Fuel Management and Delivery (GBFMD) operations. Addressing the challenge goal of developing a resilient and adaptable bulk fuel supply chain in a dynamic global threat environment necessitates rigorous data analysis. Under this contract, the contractor will perform data analysis generating critical, data-backed reports to assist USTRANSCOM’s GBFMD operations. This data will be used to enhance GBFMD operations, especially during crisis and contingency operations. Specifically, the analysis will directly support the Global Petroleum Integration Cell (GPIC) by providing the data analytics necessary to develop proactive, data-informed strategies for ensuring uninterrupted fuel support to military operations worldwide.

SECTION 2 Scope 2.A. Overview 2.A.1. This contract provides a comprehensive suite of services designed to assist USTRANSCOM in analyzing DoD requirements and developing data-driven strategies for their integration into GBFMD operations. Recognizing that expertise relevant to GBFMD resides across multiple sectors, the Contractor must be familiar with the global energy environment, logistics, information technology (IT), and supply chain management; and must analyze DoD data in that context. The Contractor will conduct in-depth research, gather and analyze relevant data from a variety of sources, including classified DoD data, and provide data analytics reports in support of USTRANSCOM’s GBFMD operation. The Contractor will participate in relevant planning and operational events (including classified discussions and planning events, as appropriate), provide subject matter expertise to USTRANSCOM staff, and develop tailored reports, presentations, white papers, and other materials as requested.

2.A.2. This contract explicitly excludes activities that fall outside the core focus of commercial energy sector capabilities analysis and integration. Specifically, the contractor will not conduct financial audits of commercial entities, perform physical security data analysis of facilities, provide legal advice or interpretation of regulations, or engage in any activities involving the physical handling, storage, or transportation of bulk fuel 2.A.3. All work under this contract will be performed through individual Task Orders. Each Task Order will detail specific data analysis activities based on USTRANSCOM's evolving needs and priorities related to GBFMD. Task Orders may focus on specific geographic regions, operational scenarios (e.g., contested logistics environments), functional areas within GBFMD (e.g., storage, distribution, contingency planning), or specific emerging challenges and opportunities within the commercial energy sector. Each Task Order will include the following:

2.A.3.1. Statement of Objectives: Clearly defined goals and objectives for the data analysis, outlining the specific information and insights USTRANSCOM seeks to obtain.

2.A.3.2. Scope of Work: A detailed description of the tasks to be performed by the Contractor, including data analysis of DoD requirements (as identified by USTRANSCOM), the specific capabilities to be evaluated, and the methodologies to be employed.

2.A.3.3. Performance Requirements: Measurable performance standards and metrics for evaluating the Contractor's performance, including specific timelines for deliverables and quality criteria for data analysis.

2.A.3.4. Deliverables: A comprehensive list of all required deliverables, including reports, presentations, data analyses, and other documentation, specifying format, content, and delivery schedules.

2.A.3.5. Period of Performance: A defined timeframe for completing the Task Order, including start and end dates and any milestones or interim deadlines.

2.A.3.6. Security Requirements: Specific security requirements, including required clearance levels, handling procedures for classified information (if applicable), Operational Security (OPSEC) requirements and cybersecurity requirements. The required FCL will be identified at the Task Order level. Task Orders will require access to include classified information to facilitate a comprehensive data analysis of commercial capabilities in relation to DoD's operational requirements and vulnerabilities. The Government will determine the appropriate level of security clearance and access required for each Task Order. The DD254 will be provided at the Task Order level.

SECTION 3 Tasks 3.A. Task 1 - Data Analysis 3.A.1. The Contractor shall perform data analysis, at the classified level, for USTRANSCOM based on the following categories:

3.A.1.1. Analyze Current Fuel Logistics Capacity: Assess existing fuel movement, storage capacity and network capabilities within the DoD.

3.A.1.2. Define Required Fuel Logistics Capacity: Determine the necessary fuel movement and storage capacity and network capabilities required to meet DoD operational demands.

3.A.1.3. Identify Challenges to Capacity Acquisition and Sustainment: Identify and analyze the challenges associated with obtaining and maintaining the required fuel logistics capacity and network capabilities to support DoD needs.

3.B. Task 2 – Planning 3.B.1. The contractor shall participate in relevant planning and operational events, including classified discussions. As part of integrated planning and operational support, the contractor will provide requested materials, including reports and presentations. The contractor will coordinate all travel requirements with the Contracting Officer Representatives (COR) for approval.

3.C. Task 3 – Reports 3.C.1. The Contractor shall deliver comprehensive data analysis reports, structured to address the data points specified in this PWS and each individual task order. These reports will meticulously present the data required by the task order and, critically, will include actionable recommendations outlining how the presented data can be effectively applied to enhance the GBFM mission. Reports will emphasize clear data visualization and concise summaries of key findings to facilitate informed decision-making.

SECTION 4 Constraints and Risks 4.A. Non-Disclosure Agreements The Contractor will have access to sensitive, non-public information during the performance of this contract. The Contractor agrees to the following:

(a) Protect such information from unauthorized disclosure in accordance with DoDI 8582.01 Series, Security of Unclassified DoD Information on Non-DOD Information Systems. (b) Use and disclose such information solely for performing this contract and not for any personal or commercial purpose. (c) Obtain prior written Government authorization before disclosing or discussing such information with any third party. (d) Return or electronically purge all non-public, sensitive information no longer required for contract performance upon Government request. (e) Immediately notify the Government of any unauthorized release of such information.

Within one week of contract award, the Contractor shall provide the Government with executed Non-Disclosure Agreements (NDAs) (Attachment 2) for all Contractor personnel assigned to this contract. The Contractor is responsible for obtaining and maintaining these NDAs, which restrict disclosure of information to authorized individuals identified on the NDA form. The Contractor shall also secure and provide to the Contracting Officer with fully executed NDAs with any other contractors whose proprietary information is accessed during the performance of this contract, protecting such information from unauthorized use or disclosure for as long as it remains proprietary. The Contractor is solely responsible for obtaining and ensuring proper execution of these agreements.

4.B. Copyright and Intellectual Property Ownership Rights In accordance with DFARS 252.227-7020, all deliverables, including reports, assessments, supporting materials, and related documentation created by the Contractor under this agreement, are considered "Works Made for Hire" as defined in 17 U.S.C. §101 and are the exclusive property of USTRANSCOM. USTRANSCOM shall hold all rights, titles, and interest therein, including all copyrights and other proprietary rights. The Contractor agrees to execute any necessary assignments to confirm USTRANSCOM's ownership. The Contractor shall also ensure that all employees, subcontractors, and subcontractor employees engaged in performing work under this agreement execute agreements transferring all rights in any deliverables they create to the Contractor prior to commencing work. Upon completion of this agreement, the Contractor shall provide USTRANSCOM with fully executed assignment documents confirming the transfer of all rights from all individuals who contributed to the deliverables.

4.C. Indemnity Contractor shall indemnify and hold harmless the United States Government, its agents, and employees from and against any and all claims, demands, liabilities, costs, expenses, and losses (including reasonable attorneys' fees and expenses) arising out of, relating to, or resulting from Contractor's performance of this contract, including but not limited to the cybersecurity assessment and analysis of the assessed contractor's computer and information technology systems, specifically including claims based on: (1) acts or omissions of Contractor, its agents, employees, or subcontractors; (2) the unauthorized disclosure of any information obtained or created during the performance of the cybersecurity assessment and analysis; or (3) any breach of confidentiality obligations by Contractor, its agents, employees, or subcontractors. Contractor's obligation to indemnify under this clause shall not extend to claims arising solely from the gross negligence or willful misconduct of the Government.

1. Organizational Conflict of Interest (OCI) As required by FAR 9.5, the Government will ensure no organizational conflicts of interest are present. If any such conflict of interest is found to exist, the Contracting Officer may disqualify the Offeror or determine that it is otherwise in the best interests of the United States to contract with the Offeror and include the appropriate provisions to avoid, neutralize, mitigate, or waive such conflict in the contract awarded. The Offeror shall provide the Contracting Officer with complete information of any previous or ongoing work that is in any way associated with this acquisition, or related acquisitions. The Offeror shall submit a mitigation plan that addresses actual or perceived conflicts of interest related to the services required by this effort for Government review. The Government will conduct an independent assessment review of any submitted OCI Mitigation Plan to determine if any actual or perceived OCI exists and what further actions are necessary, if any. Additionally, the Government will monitor contract performance for emerging areas of conflict of interest and take action considered necessary to avoid, neutralize, or mitigate conflicts. If the Offeror believes there is no OCI, a statement as such shall be included.

SECTION 5 Task Order Evaluation Task Orders issued under this contract will be evaluated based on the demonstrated experience, expertise, and capabilities related to the data analysis areas outlined in Section 3 of this PWS. Specific evaluation criteria and their relative importance (weighting) will be detailed in each individual Task Order. Offerors should demonstrate their ability to:

5.A. Adapt to Diverse Requirements Tailor data analysis methodologies and approaches to the unique requirements of each Task Order, including specific operational scenarios, geographic locations, fuel types, and scales of operation.

5.B. Conduct Comprehensive Data Analysis Perform rigorous analysis of DoD data related to petroleum storage, distribution, and operations, as specified in individual Task Orders. This includes the ability to gather and analyze data from multiple sources, apply appropriate statistical and analytical techniques, and provide clear, concise, and well-supported findings and recommendations.

5.C. Facilitate Collaboration Effectively collaborate with USTRANSCOM personnel and other DoD stakeholders as required by each Task Order. This includes clear communication, effective coordination, and the ability to foster productive working relationships.

SECTION 6 General and Administrative 6.A. Use of English Language All communication and documentation related to this contract shall be conducted and provided in the English language. Any supporting documentation or materials originally produced in a foreign language shall be accompanied by a certified English translation.

6.B. Invoicing and Payment The contractor shall submit invoices electronically in accordance with the procedures and format specified in the contract. Invoices shall be detailed, clearly itemizing all costs incurred, and supported by appropriate documentation. Payment will be made by the Government upon verification and approval of the submitted invoices.

6.C. Point of Contact The contractor shall designate a primary and an alternate point of contact responsible for all communication and coordination with the Government. Contact information shall include names, titles, email addresses, and telephone numbers. The designated points of contact shall be readily available during normal business hours and provide prompt responses to Government inquiries.

SECTION 7 Security 7.A. Cyber Security 7.A.1. General Cyber Security Requirements 7.A.1.1. Handling and Protection of Non-Public Information 7.A.1.1.1. For unclassified systems, in performance of this contract, the Contractor may have access to DoD Transactional Information (DTI), which for the purposes of this section shall mean any information developed or received in the course of planning, ordering, shipping, tracking, and invoicing in support of the requirements of this contract. To adequately protect this DTI, the Contractor information systems (IS) involved in the performance of this contract shall comply with the security requirements in the current version of the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations.” Unless Covered Defense Information (CDI) (as defined in DFARS 252.204-7012) is identified, present, processed, stored, or for, a Contractor compliance with NIST SP 800-171 measures is required at the prime contractor level and does not apply to subcontractors and other entities that the prime contractor engages with in order to meet the requirements of this contract. CDI must be protected in accordance with DFARS 252.204-7012.

7.A.1.1.2. Additionally, the Contractor agrees to use such information only for the purposes of fulfilling the contracted requirements and to protect such information from unauthorized release or disclosure. Protection of the DTI does not abrogate any responsibilities of the Contractor to comply with or implement additional cyber security requirements as part of generally accepted system security principles or as required by other categories of information that may be co-resident with the DTI on the Contractor’s IS.

7.A.1.2. Operationally Critical Support The services designated under this contract are “operationally critical support” as defined in DFARS 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting.

7.A.2. Cyber Security Self-Assessment and Plan of Action 7.A.2.1. The Contractor shall provide a Self-Assessment of its compliance with NIST SP 800-171 and present a Plan of Action that identifies any deviations, non-compliance, or proposed alternative means of compliance as well as plans for correcting non-compliant requirements to the Contracting Officer within 60 calendar days of contract award and then annually thereafter. The Self-Assessment and Plan of Action shall address all of the requirements in NIST SP 800-171.

7.A.2.2. Table 7.A.2 provides modified requirements of CUI/CDI specific controls from NIST SP 800-171 that will be used to evaluate compliance in a non-CUI/CDI environment. Additionally, at any time during the period of performance, when a Contractor determines it is non-compliant with a NIST SP 800-171 requirement or an approved alternate means of compliance resulting in a High or Moderate Potential Impact as defined in Federal Information Processing Standards Publication (FIPS PUB) 199, “Standards for Security Categorization of Federal Information and Information Systems,” the Contractor shall submit a Plan of Action within 15 calendar days of the determination of non-compliance.

7.A.2.3. Plans of Action and any requests to vary from NIST SP 800-171 shall be submitted to the Contracting Officer for consideration and approval by USTRANSCOM. The Contractor need not implement any security requirement determined by USTRANSCOM to be non-applicable or to have an equally effective alternative security measure implemented in its place. The Plan of Action shall follow the template provided (PWS Attachment 9). Alternate formats for the Plan of Action may be proposed and must be approved by USTRANSCOM.

7.A.2.4. USTRANSCOM may conduct an on-site visit to a contractor’s facility or request a third-party assessment (Government agency or Government funded commercial entity) to review progress towards meeting their Plan of Action, evaluate any proposed variances to NIST SP 800-171 requirements, and to assess residual risk to the DTI resulting from the non-compliance. Date and time of on-site visits will be mutually agreed-upon by USTRANSCOM and the Contractor in advance.

Table 7.A.2 Modified NIST SP 800-171 Requirements

7.A.3. Cyber Incident Reporting 7.A.3.1. In addition to the DFARS 252.204-7012 reporting requirements for unclassified systems and DoD Manual (DoDM) 5220.22, National Industrial Security Program Operating Manual (NISPOM) for classified systems, reportable cyber-incidents (regardless of whether the information system contains CDI or there is an impact to performance such as delivery schedule delay), include, but are not limited to, the following:

7.A.3.1.1. Cyber-incidents as defined in Table 7.A.3 7.A.3.1.2. Notifications by a federal, state, or local law enforcement agency or cyber-center (i.e., National Cyber Investigative Joint Task Force (NCIJTF), National Cybersecurity & Communications Integration Center (NCCIC) of being a victim of a successful or unsuccessful cyber-event anomaly, incident, insider threat, breach, intrusion, or exfiltration.

Table 7.A.3.

disrupts normal functionality of an IS or DoD information network.

7.A.3.2. If the cyber-incident affects a classified system, vulnerabilities associated with the incident will be classified per the current version of USTRANSCOM Instruction 31-02, Security Classification Guide.

7.A.4. Cybersecurity Incident Reporting Timelines In addition to providing the notification required by DFARS 252.204-7012, the Contractor is required to notify USTRANSCOM as soon as practical, but no later than 72 hours after discovering a reportable cyber-incident. The reporting timeline begins when the incident is discovered or reported to the company, its employees, contractors, or cybersecurity firm responsible for providing cybersecurity and response for the company. The Contractor shall contact the USTRANSCOM Cyber Operations Center (CyOC) via phone at 618-817-4222. If the Contractor does not immediately reach the CyOC via phone, the Contractor shall send an email notification to transcom.scott.tcj6.mbx.cyoc-dodin-operations@mail.mil.

7.A.5. Mandatory Reporting Data 7.A.5.1. The Contractor shall work with the USTRANSCOM CyOC through resolution of the incident. Within 4 hours of becoming aware of a reportable cyber-incident, the Contractor shall provide an initial notification of the incident, even if some details are not yet available, which includes, but is not limited to, the following information:

7.A.5.1.1. Company Name 7.A.5.1.2. Who will be the POC with contact information 7.A.5.1.3. Contracting Officer POC (name, telephone, email) 7.A.5.1.4. Overall Assessment –Description of incident, data at risk, mitigations applied 7.A.5.1.5. Indicators of compromise 7.A.5.1.6. Vector of attack (if known) 7.A.5.1.7. Estimated time of attack (if known) 7.A.5.2. The Contractor shall provide a follow-on cyber-incident report to the USTRANSCOM CyOC within 24 hours of becoming aware of a reportable cyber-incident, which includes, but is not limited to, the following information:

7.A.5.2.1. Contractor unique Commercial and Government Entity (CAGE) code 7.A.5.2.2. Contract numbers affected 7.A.5.2.3. Facility CAGE code where the incident occurred if different than the prime Contractor location 7.A.5.2.4. POC if different than the POC recorded in the System for Award Management (name, address, position, telephone, email) 7.A.5.2.5. Contracting Officer POC (name, telephone, email) 7.A.5.2.6. Contract clearance level 7.A.5.2.7. DoD programs, platforms, systems, or information involved 7.A.5.2.8. Location(s) of compromise 7.A.5.2.9. Date incident discovered 7.A.5.2.10. Type of compromise (e.g., unauthorized access, inadvertent release, other) 7.A.5.2.11. Description of technical information compromised 7.A.5.2.12. Any additional information relevant to the information compromise 7.A.6. Incident Reporting Coordination 7.A.6.1. In the event of a cyber-incident, USTRANSCOM may conduct an on-site review of network or information systems where DoD information is resident on or transiting to assist the Contractor in evaluating the extent of the incident and to share information in an effort to minimize the impact to both parties. Date and time of on-site visits will be mutually agreed upon by USTRANSCOM and the Contractor in advance.

7.A.6.2. The Contractor agrees to allow follow-on actions by the Government (e.g., USTRANSCOM, Federal Bureau of Investigation, Department of Homeland Security, DC3, etc.) to further characterize and evaluate the suspect activity. The Contractor acknowledges that damage assessments might be necessary to ascertain an incident methodology and identify systems compromised as a result of the incident. Once an incident is identified, the Contractor agrees to take all reasonable and appropriate steps to preserve any and all evidence, information, data, logs, electronic files and similar type information (reference NIST Special Publication 800-61: Computer Security Incident Handling Guide, (current version)) related to the incident for subsequent forensic analysis so that an accurate and complete damage assessment can be accomplished by the Government.

7.A.6.3. The Contractor is not required to maintain an organic forensic capability, but must ensure data is preserved (e.g., remove an affected system, while still powered on, from the network) and all actions documented until forensic analysis can be performed by the Government or, if the Government is unable to conduct the forensic analysis, a mutually agreed upon third party (e.g., Federally Funded Research and Development Center , commercial security contractor, etc.). Any follow-on actions shall be coordinated with the Contractor via the Contracting Officer.

7.A.6.4. The Contractor agrees to indemnify and hold the Government harmless for following any recommendations to remedy or mitigate the cyber-incident following the actions under paragraphs 11.A.6.1 and 11.A.6.2.

7.A.6.5. Contractors are encouraged to work with government entities in voluntary programs that help prevent incidents and can support investigation and risk management during an incident.

7.A.7. Confidentiality and Non-Attribution Statement The Government may use and disclose reported information as authorized by law and will only provide attribution information on a need-to-know basis to authorized persons for cybersecurity and related purposes (e.g., in support of forensic analysis, incident response, compromise or damage assessments, law enforcement, counterintelligence, threat reporting, and trend analysis). The Government may share threat information with other USTRANSCOM industry partners without attributing or identifying the affected contractor.

7.B. Industrial Security Information 7.B.1. Security Requirements Applicability. FAR Clause 52.204-2, Security Requirements, applies to the extent that this contract involves access to information, areas or material classified “Confidential” or “Secret.” Specific security protocols for contracted companies are outlined in 32 CFR Part 117, National Industrial Security Program Operating Manual (NISPOM).

7.B.2. The majority of daily work associated with this PWS is at the UNCLASSIFIED level, but Task Orders/Bookings may be issued requiring cleared contracted companies to access classified information, areas or systems up to the Sensitive Compartmented Information (SCI)/TOP SECRET (TS) level, or transport classified military equipment or materials during performance of this contract. Companies without a Final or Interim Facility Security Clearance (FCL) are not eligible to receive Task Orders/Bookings requiring access to classified information, areas or systems up to the SCI/TS level, or transport classified military equipment or materials. The following security requirements under this subsection apply to cleared USC-10 carriers who receive Task Orders/Bookings requiring access to classified information, areas or systems up to the SCI/TS level, or transport classified military equipment or materials:

7.B.2.1. An active FCL granted by the Defense Counterintelligence Security Agency (DCSA), validated by the USTRANSCOM Office of Protection and Response (TCCS-PR) and enumerated via a DD Form 254, Contract Security Classification Specification. Whether Final or Interim, only contracted companies with a valid FCL up to SCI/TS level are authorized to access classified information, areas or systems up to the SCI/TS level, or transport classified military equipment or materials. If the company does not hold an active FCL at the appropriate level at the time of contract award, the company must be sponsored for the FCL or FCL upgrade by the Government contracting activity (GCA).

7.B.2.2. Final/certified DD Form 254s will be processed at the time of award for GBFMD that have an existing valid FCL.

7.B.3. Citizenship and Personnel Clearance Requirements 7.B.3.1. Citizenship Requirements. Only contractor employees that are U.S. citizens are able to obtain security clearances and access classified information, areas or systems up to the SCI/TS level, or transport classified military equipment or materials.

7.B.3.2. Personnel Clearance Level. Only contractor employees with a personnel security clearance working for contractor companies with an active FCL granted by DCSA at the SECRET or higher level are eligible for access to classified information, areas, systems, or military equipment and material.

7.B.4. Contractor Facility Security Officer (FSO). The Contractor will forward the name, address, email address and telephone number of the Company FSO and backup to both offices below at the time of award, and if any changes occur.

USTRANSCOM Office of Protection and Response (Industrial Security) Points of Contact:

USTRANSCOM

Attn: TCCS-PR 508 Scott Drive Scott AFB IL 62225 Email: transcom.scott.tccs.mbx.industrial-security@mail.mil 7.C. Operational Security (OSPEC) 7.C.1. Protecting critical information (friendly activities, intentions, capabilities, or limitations) is crucial to prevent adversaries from gaining advantage. Therefore, contractors must adhere to OPSEC requirements throughout the contract lifecycle. All information provided is for official use only. Additionally, mandatory initial and annual OPSEC training is required after contract award for all contractors working on-site at a DoD facility or off-site accessing a Federally controlled information system. Proof of completion must be available to the COR/CO. Training can be accessed at the following website: (https://securityawareness.usalearning.gov/opsec/index.htm ).

7.C.2. Immediately consult the contracting office’s OPSEC coordinator regarding the MSDDC Critical Information and Indicators List (CIIL) and any OPSEC questions. Protect critical information (e.g., mission details, units, cargo) from unauthorized disclosure and coordinate with the government to minimize shared information. Report suspected/known compromises immediately to the COR and security office. Safeguard information (including FOUO and CUI) per the CIIL using measures like: encryption; locked storage; restricted distribution; secure destruction; limiting verbal discussions; avoiding unencrypted phones/foreign mail; prompt document retrieval; cover pages; and minimizing public disclosure. Contact the COR/CO for clarification.

SECTION 8 Deliverables All deliverables shall be submitted directly to the Contracting Officer Representative (COR) electronically in Microsoft Office (e.g., Word, Excel, Power Point, Project). Deliverables shall be identified by contract number/task order number, PWS task/subtask number, and deliverable title. All deliverables must meet professional standards and comply with the requirements set forth in this PWS.

image1.jpeg