Atch1_DCD_PWS.pdf

Attachment 1

PERFORMANCE WORK STATEMENT (PWS)

Defense Courier Scheduled Air Transportation Service

06 March 2014

1.0 DESCRIPTION OF SERVICES

1.1 Background. USTRANSCOM Defense Courier Division (DCD) requires air transportation via scheduled commercial service routes to augment its global transportation network. The DCD will use a system of travel and recovery couriers to monitor containerized courier material transported over commercial air routes. Two DOD travel couriers will transport container(s) to planeside and monitor the container(s) until loaded and aircraft doors are sealed. The DOD travel couriers will then board the aircraft transporting the container(s). Two DOD recovery couriers shall be escorted at destination to pre-stage and meet inbound aircraft planeside to observe the aircraft cargo doors being unsealed and container(s) offloading. Recovery couriers will accept the container(s) planeside, verifying integrity of the seal(s)/lock(s).

1.2 Scope of Work. The contractor shall provide passenger seats for two (2) travel couriers with carry-on baggage and cargo space for containerized courier materials as described in this PWS. Service will be within the Continental United States (CONUS) and between CONUS and Alaska, Hawaii, Germany and England. On occasion service may be needed from the CONUS to other Outside Continental United

States (OCONUS), OCONUS to CONUS (retrograde routes), and OCONUS to OCONUS locations

(lateral routes).

1.3. General Requirements. Except as otherwise stated in this contract, the contractor shall provide all personnel, equipment, tools, facilities, supervision, and direct materials necessary for the performance of the air transportation of two (2) DOD couriers with carry-on baggage and classified/sensitive material in contractor provided containers on scheduled service air routes as specified. Contractor is not authorized to subcontract the airlift portion of the mission. The contractor shall transport launch couriers together with the container(s) during ground handling operations and allow launch couriers to continually observe aircraft and container(s) as described below. When contractor personnel require access to the cargo bay after it has been sealed, couriers shall be permitted access planeside in a position which allows them to observe and monitor the status of container(s), except in cases where courier observation would seriously jeopardize safety.

1.3.1 Passenger Seating. The contractor shall provide travel couriers with passenger seating that meets or exceeds the standards provided to economy class passengers on scheduled service airlines and shall permit pre-boarding of the travel couriers. Travel couriers shall be seated in close proximity of one another (side by side or separated by no more than one seat or one row; across aisle seating is acceptable. Seating shall be positioned to allow safe passage as couriers enter and exit the aircraft and shall be unencumbered by cargo or baggage. Air carriers shall charge no more than the Government fare per seat.

1.4 Specific Tasks.

1.4.1 Containerized/Palletized Material. Containers (igloo) or pallets provided by the contractor will be used for containerized transportation of material. The contractor shall provide pre-staged, airworthy/inspected, airline containers/pallets as requested by regional Defense Courier Stations.

Individual Courier Stations will pick up containers/pallets and transport them between Courier Station and contractor’s facility. For stations that do not have transport capability of containers/pallets, the contractor shall provide temporary secure/weather protected space for Defense couriers to load containers at the contractor location. Containers will be of various sizes based on material weight with doors properly aligned to permit couriers to apply lock/security seals. Contractor shall replace any containers that do not meet these standards at no cost to the Government. Palletized material will be secured by shrink wrap or nets provided by the defense couriers. Any required contractor-unique pallet nets shall be provided by the contractor.

1.4.2 Ground Handling. For containerized operations, the contractor shall transport two couriers along with the container(s) to and from aircraft during ground handling operations. If, for any reason, recovery couriers are not present at the time offloading operations begin, the travel couriers shall be immediately deplaned before doors are unsealed and any courier material is removed from the aircraft.

1.5 Desired Routes. The Government desires round trip transportation on the following routes:

Baltimore (BWI) to Sacramento (SMF) or Oakland (OAK)

Baltimore (BWI) to San Antonio (SAT)

Baltimore (BWI) to Denver (DEN)

Baltimore (BWI) to Omaha (OMA)

Baltimore (BWI) to Cologne

Baltimore (BWI) to London

Denver (DEN) to Omaha (OMA)

Sacramento (SMF) or Oakland (OAK) to Seattle (SEA)

Seattle (SEA) to Oakland (OAK) or Sacramento (SMF)

Seattle (SEA) to Anchorage (ANC)

Sacramento (SMF) to Honolulu (HNL)

Denver (DEN) to Sacramento (SMF)

1.5.1 The following routes must use sealable containers loaded into the aircraft:

Baltimore to Sacramento or Oakland

Sacramento or Oakland to Baltimore

Baltimore to Cologne

Cologne to Baltimore

Baltimore to London

London to Baltimore

Seattle to Anchorage

Anchorage to Seattle

Sacramento to Honolulu

Honolulu to Sacramento

Baltimore to San Antonio

San Antonio to Baltimore

Baltimore to Denver

Denver to Baltimore

Baltimore to Omaha

Omaha to Baltimore

Sacramento or Oakland to Seattle

Seattle to Oakland or Sacramento

Denver to Omaha

Omaha to Denver

Denver to Sacramento

Sacramento to Denver

1.6 Loading and Security.

1.6.1 Access. The contractor shall permit couriers access to planeside for loading and offloading of container(s) to ensure couriers have visibility of all courier container(s) during transfer, onload, and offload. The contractor shall assist couriers in gaining unescorted airport access at each contracted airport location. In the event unescorted access is not available, the contractor shall escort couriers and container(s) planeside. On departing flights the container(s) must be under constant observation of traveling couriers until the aircraft door is sealed. On arriving flights, recovery couriers must be prepositioned to view the cargo doors prior to opening and must observe container(s) offload. The container(s) must be kept in constant view of the couriers at all times.

1.6.2 Diversions. In the event of a diversion, the two travel couriers on board must be permitted to deplane and preposition planeside prior to the aircraft cargo doors being opened. The couriers must maintain visibility over the cargo doors whether opened or closed and if opened must maintain constant visibility over container(s).

1.6.3 Missing/Damaged Material. In the event pieces of courier material are missing or damaged, contractor personnel shall cooperate fully with courier requests for rechecking aircraft cargo/baggage compartments and shall provide couriers with requested information to the best of their ability. In the event actual classified information is exposed to contractor personnel, the affected individuals may be asked to sign an Inadvertent Disclosure agreement to document understanding of their obligation to safeguard any sensitive information gained by the inadvertent exposure in accordance with Sections 793 and 794 of title 18, United States Code.

1.7 Hours of Operation and Ordering.

1.7.1 Government Liaison. Prior to the start of the contract, the contractor shall furnish the

Contracting Officer Representative (COR) with the name, address, e-mail address, and phone number of the agent(s) who will serve as liaison between the contractor and the Defense Courier Division identified by the COR. The agent(s) must have authority to book seating and cargo space on contracted routes and make decisions pertinent to the airlift service for the contractor. The agent(s) must be available during regular business hours and must provide an after-hour’s phone number to be used in the event of emergency.

1.7.2 Hours of Operation. Contractor liaison and the COR will work in concert to establish best mission hours for courier requirements.

1.7.3 Mission Ordering. All ordering, movement forecasts, and changes will be made by the COR.

The COR will order the transportation (passenger and material) a minimum of five days prior to execution and will provide finalized weight and requested container size no less than 48 hours prior to ordered flight (unless mutually agreed to between the contractor and Government). Whenever possible, roundtrip missions will be ordered. The contractor shall reserve sufficient aircraft space to accommodate the quantity of material agreed upon during ordering and shall guarantee seat availability for couriers. Contractor caused changes to the order within 72 hours of execution will be considered in the performance metrics at paragraph 3.0.

1.7.4 Delays. The contractor shall notify the regional Defense Courier Stations immediately when any positioning or arrival times will vary by more than 30 minutes from established times. A list of contacts will be provided by the COR. A departure time that varies by more than 30 minutes for a contractor-controllable reason shall be considered in the reliability metrics at paragraph 3.0.

1.7.5 Cancellations.

1.7.5.1 Route Cancellations. There will be no penalty for route cancellations as long as the contractor provides the Contracting Officer with 90 days written notice that the route is being eliminated from scheduled service operations of the airline.

1.7.5.2 Trip Cancellations. In the event an individual trip is cancelled after ordering, rescheduling shall be as agreed to by the Government.

1.7.6 Ad Hoc Missions. The Government will coordinate with contractor when service to or from locations outside of normal established routes is required within 8 working days to establish contacts and pricing. Contractor refusal to support ad hoc missions may be considered in the reliability metrics at paragraph 3.0.

1.8 Definitions and applicable publications.

Reserved.

2.0 DELIVERABLES

Reserved.

3.0 SERVICE DELIVERY SUMMARY

Performance Objective

PWS

Paragraph

Performance

Threshold

Airworthy/inspected containers provided 1.4.1

100% of the time, monthly

Visibility of cargo as required 1.6

Schedule Reliability 1.7.3

Operational Reliability 1.7.4

95% of the time, Rescheduling of cancelled trip 1.7.5.2 100% of the time

Support Ad Hoc mission request

1.7.6

100% of the time

Resolution of QAE complaints 5.4 95% of the time

4.0 GOVERNMENT FURNISHED EQUIPMENT (GFE) AND SERVICES

Seals, shrink wrap and nets will be provided by the Government. In the event carrier unique pallet nets are required, they shall be contractor furnished.

5.0 GENERAL INFORMATION

5.1 Only a DOD Approved Air carrier who is a participant in the Civil Reserve Air Fleet (CRAF) or a

DOD Approved Air carrier who has been determined Technically Ineligible for the CRAF may receive a contract award.

5.2 Transportation of hazardous material will not be required.

5.3 Aircraft Operator Standard Security Program exempts Government material from opening or x-ray screening. Bomb dogs or drug dogs are permitted for screening.

5.4 Quality complaints shall be resolved to the customer’s satisfaction within 30 days from the end of the month in which the complaint is received.

5.5 Information Assurance

5.5.1 Requirement for Contractor Information Assurance (IA) Report

The Contractor shall provide an Information Assurance Report to describe their environment that safeguards DOD non-public information resident on or transiting the contractor's unclassified information systems from unauthorized access and disclosure. Protection measures applied should consider the risks (i.e. consequences and their probability) of loss, misuse, unauthorized access, or modification of information. The report shall address the SANS (SysAdmin, Audit, Network, Security)

Institute's Twenty Critical Security Controls for Effective Cyber Defense: Consensus Audit Guidelines

(http://www.sans.org/critical-security-controls) and be provided in accordance with the attached template at Attachment 01 to the PWS. The contractor is encouraged to provide additional information above and beyond what is outlined in the SANS guidelines to enhance the government’s understanding of their information security posture. The report will be updated 30 days prior to exercise of an option period, if applicable.

5.5.2 Cyber Security Incidents

5.5.2.1 Reporting Requirements

The contractor shall report to the following two Government organizations as soon as possible upon discovery of any suspected cyber intrusion events that affect DOD information resident on or transiting the contractor's unclassified information systems.

1. USTRANSCOM Global Command, Control, Communications and Computers (C4)

Coordination Center (GCCC)

E-mail: ustcJ6-gccc@ustranscom.mil

Commercial Phone: 618-229-4222

2. USTRANSCOM Deployment and Distribution Operation Center (DDOC)

E-mail: ustc-ddocchief@ustranscom.mil

Commercial Phone: 618-220-7700

Initial report shall be provided even if some details are not yet available, with follow-on detailed reporting within 72 hours. Reportable cyber intrusion events include the following:

1. A cyber intrusion event appearing to be an advanced persistent threat

2. A cyber intrusion event involving data exfiltration or manipulation or other loss of any DOD information resident on or transiting the contractor's, or its subcontractors', unclassified information systems

3. Intrusion activities that allow unauthorized access to an unclassified information system on which DOD information is resident or transiting

Definition of advanced persistent threat: An extremely proficient, patient, determined, and capable adversary, including two or more of such adversaries working together.

5.5.2.2 Incident Report Content

The incident report shall include, at a minimum, the following information:

1. Applicable dates (date of suspected compromise and date of discovery)

2. Threat methodology (all known resources used such as Internet Protocol (IP) addresses, domain names, copies malware, etc.)

3. An account of what actions the threat(s) may have taken on the victim system/network and what information may have been accessed

4. A description of the roles and functions of the threat-accessed system

5. An initial list of potentially impacted government programs and each program’s classification

6. What information may have been exfiltrated that may impact government programs

7. A list of all employees and subcontracted employees who work or have worked with the victim system/network

8. A point of contact to coordinate damage assessment activities

5.5.2.3 Incident Report Submission

The contractor will submit unclassified network cyber incident reports to the USTRANSCOM Technical

Information Analysis Center (TIAC) and USTRANSCOM designated government personnel via encrypted email or another mutually agreed upon secure communications method. Copies of malware require special handling and pre-coordination must be accomplished prior to submission.

Attachment 01 to the PWS

Vendor Assessment Guidelines for Twenty Critical Security Controls for Effective

Cyber Defense: Consensus Audit Guidelines (CAG)

General. Organizations should compare all 20 control areas against their current status.

The 20 Critical Controls are:

1. Critical Control 1: Inventory of Authorized and Unauthorized Devices

2. Critical Control 2: Inventory of Authorized and Unauthorized Software

3. Critical Control 3: Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers

4. Critical Control 4: Continuous Vulnerability Assessment and Remediation

5. Critical Control 5: Malware Defenses

6. Critical Control 6: Application Software Security

7. Critical Control 7: Wireless Device Control http://www.sans.org/cag/control/1.php http://www.sans.org/cag/control/2.php http://www.sans.org/cag/control/3.php http://www.sans.org/cag/control/3.php http://www.sans.org/cag/control/4.php http://www.sans.org/cag/control/5.php http://www.sans.org/cag/control/6.php http://www.sans.org/cag/control/7.php

8. Critical Control 8: Data Recovery Capability

9. Critical Control 9: Security Skills Assessment and Appropriate Training to Fill Gaps

10. Critical Control 10: Secure Configurations for Network Devices such as Firewalls, Routers, and

Switches

11. Critical Control 11: Limitation and Control of Network Ports, Protocols, and Services

12. Critical Control 12: Controlled Use of Administrative Privileges

13. Critical Control 13: Boundary Defense

14. Critical Control 14: Maintenance, Monitoring, and Analysis of Audit Logs

15. Critical Control 15: Controlled Access Based on the Need to Know

16. Critical Control 16: Account Monitoring and Control

17. Critical Control 17: Data Loss Prevention

18. Critical Control 18: Incident Response and Management

19. Critical Control 19: Secure Network Engineering

20. Critical Control 20: Penetration Tests and Red Team Exercises

The entire text of the 20 Critical Security Controls is available for reference at:

http://www.sans.org/critical-security-controls/

Procedures:

1. Review each control.

2. Determine what procedures and tools exist within your organization to meet this control.

3. Document the result of 1-2 using the suggested template provided.

4. Provide any additional information about your company’s cyber security posture.

http://www.sans.org/cag/control/8.php http://www.sans.org/cag/control/9.php http://www.sans.org/cag/control/10.php http://www.sans.org/cag/control/10.php http://www.sans.org/cag/control/11.php http://www.sans.org/cag/control/12.php http://www.sans.org/cag/control/13.php http://www.sans.org/cag/control/14.php http://www.sans.org/cag/control/15.php http://www.sans.org/cag/control/16.php http://www.sans.org/cag/control/17.php http://www.sans.org/cag/control/18.php http://www.sans.org/cag/control/19.php http://www.sans.org/cag/control/20.php http://www.sans.org/critical-security-controls/

Company (Name): Information Assurance Report

Executive Summary: (descriptive self-assessment of the company’s overall information security posture)

A. Assessment of Twenty Critical Security Controls for Effective Cyber Defense: Consensus Audit

Guidelines (CAG)

1. Control 1. Inventory of Authorized and Unauthorized Devices

a. Procedures and Tools supporting this control:

(List the procedures and tools used in your organization for this control)

b. Method to achieve control metric:

2. (Continue for remaining 19 controls).

If a particular control does not exist or is not used within your organization, please state this.

B. Assessment of Additional Security Measures for Effective Cyber Defense

1. Measure. (Title of additional measure/control)

a. Procedures and Tools supporting this measure/control:

(List the procedures and tools used in your organization)

b. Method to achieve measure/control metric:

2. (Continue for remaining measures/controls)