DRAFT_PWS.pdf

Page 1 of 53 HTC711-18-Q-D020

PERFORMANCE WORK STATEMENT (PWS)

FOR

UNITED STATES TRANSPORTATION COMMAND (USTRANSCOM)

MISSION ASSURANCE (MA) SUPPORT

1 October 2018

1. DESCRIPTION OF SERVICES

1.1. Background

In accordance with the Mission Assurance Strategy, the Department of Defense (DoD) Directive (DoDD) 3020.40, Mission Assurance, and DoD Instruction (DoDI) 3020.45, Mission Assurance (MA) Construct, the Commander USTRANSCOM shall designate a MA OPR to identify command missions, decompose those missions into required capabilities, identify and assess DoD, commercial, and foreign transportation-related strategic risk issues that support mission execution, and support development, and management of command mitigation plans as necessary prioritizing those requirements based on command priorities, and assist other DoD Components’ efforts with transportation-related analysis. Provide authorities and appropriate resources through the MA program element (PE) to accomplish assigned MA implementation and risk management responsibilities.

The Commander USTRANSCOM assigned MA responsibilities to the TCJ3 Operations and Plans Directorate and further identifies the TCJ3-M Chief, Mission Assurance Division, as the MA Office of Primary Responsibility (MA OPR). The TCJ3-MA Mission Assurance Programs Branch Chief serves as the Mission Assurance Program Manager, and Contracting Officer Representative (COR).

The COR is supported by the alternate CORs as recommended by the MA OPR, and appointed by the Contracting Officer. The TCJ3-M Mission Assurance Division will synchronize risk management activities across multiple risk management programs within the command.

The TCJ3 Director, Operations and Plans Directorate, has directed that the TCJ3-M Mission Assurance Division take responsibility for and manage the following risk management programs/activities to meet the responsibilities assigned in the MA Construct: Antiterrorism (AT);

Defense Critical Infrastructure (DCI); Mission Assurance (MA); Mission Relevant Terrain - Cyberspace (MRT-C), Cyber Risk Assessments (CS), Insider Threat (InT); Emergency Management (EM); Continuity of Operations Program (COOP); Information Operations (IO);

Operational Security (OPSEC); Foreign Entity Vetting (FEV); Chemical Biological Radiological Nuclear and Explosives (CBRNE); Physical Security; Personnel Security; Industrial Security; and Information Security Programs referred to as Defense Security Enterprise (DSE). The MA OPR requires Contractor support to execute assigned MA responsibilities specifically for AT, DCI, MA, CS, MRT-C, InT, EM, FEV, and COOP responsibilities defined in the DoDI 3020.45 MA Construct, and Chairman of the Joint Chiefs of Staff Instruction (CJCSI) Mission Assurance.

MA is an all-threats and hazards, risk management activity that analyzes transportation missions and functions while collaborating with the other risk management programs and activities to accomplish MA related responsibilities identifying unacceptable risk of physical and cyber capabilities deemed critical to DoD, USTRANSCOM, and USTRANSCOM Transportation Component mission accomplishment. The Contractor will support the MA OPR to accomplish these responsibilities through the Command Staff and it’s Transportation Component Commands (TCCs): Military Surface Deployment and Distribution Command (SDDC), Military Sealift

Command (MSC), and Air Mobility Command (AMC), and Subordinate Command (SC), Joint Enabling Capabilities Command (JECC). The Contractor will support the MA OPR in synchronizing efforts to identify risk and associated mitigation measures available and employed offering analysis, and vetted recommendations to senior leaders in the form of Risk to Mission and Risk to Force assessments along with recommended risk decisions. The effort includes worldwide physical and cyber transportation-related capabilities; aviation; highway; rail; and maritime transportation-related infrastructures that support DoD contingency, wartime, and peacetime requirements. This responsibility includes the research, analysis, policy and operational development necessary to execute MA tasks as a means to ensure the availability and resilience of strategic transportation capabilities on a global scale.

MA is an operational element of the J3 and supports current operations as well as planned operations. The primary customers of the USTRANSCOM MA are the USTRANSCOM Commander, the Director of Operations and Plans (TCJ3), TCJ3 Global Operations Center (GOC) Chief supporting other Combatant Command’s (CCMDs), and DoD Agencies operational requirements, the Joint Staff J33 MA OPR, and Office of the Assistant Secretary of Defense (ASD) Homeland Defense and Global Security (HD&GS).

USTRANSCOM Deputy Commander serves as the Mission Assurance - Executive Steering Group (MA-ESG) representative; Director, Operations and Plans serves as the Mission Assurance

– Senior Steering Group (MA-SSG) representative; Chief, Mission Assurance Division serves as the MA planner level OPR and the Chief, Mission Assurance Programs Branch executes responsibilities as the action officer level OPR.

1.2. Scope

This PWS contains the requirement’s necessary to provide support to the accomplishment of MA responsibilities assigned to USTRANSCOM in applicable DoD Policy, and TCJ3-M Chief, Mission Assurance Division as the command MA OPR. The Contractor shall interact with the MA OPR, and individuals and organizations involved in MA activities, including but not limited to OASD(HD&GS) Mission Assurance Staff, Joint Staff J33 MA Staff, other CCMDs, military services, DoD Agencies, USTRANSCOM staff, TCJ3 GOC, TCCs, Department of Homeland Security (DHS), Transportation Security Administration (TSA), U.S. Coast Guard (USCG)), Department of Transportation (DOT), Federal Bureau of Investigations (FBI), private industry, and foreign/commercial/civil asset owner staff.

The Task Areas of this effort are:

1.3.1. Task Area 1, Task Order Management

1.3.2. Task Area 2, Mission Assurance Program Support

1.3.3. Task Area 3, Mission Assurance Operations Support

1.3.4. Task Area 4, Foreign Entity Vetting Program Support

1.3.5. Task Area 5, Emergency Management Program Support

1.3.6. Task Area 6, Insider Threat Program Support

1.3.7. Task Area 7, Continuity of Operations Program Support

1.3.8. Task Area 8, Protection Program Support

1.3.9. Task Area 9, Mission Relevant Terrain – Cyberspace Support

The Term “MA OPR” referred to throughout this document includes the TCJ3-M Chief, Mission Assurance Division, TCJ3-MA Chief, Mission Assurance Programs Branch, and as approved and assigned by the Contracting Officer, COR and Alternate CORs.

MA actions are conducted at the Unclassified level on the Non-secure Internet Protocol Router Network (NIPRNET), SECRET level on the Secret Internet Protocol Router Network (SIPRNET), and TOP SECRET/Sensitive Compartmented Information (TS/SCI) level on the Joint Worldwide Intelligence Communications System (JWICS). All Contractor personnel working on this contract shall have a TOP SECRET clearance and be eligible for SCI access at contract award. It is acceptable for those personnel executing work in support of Task Area 1, 5, 7, and 8, to have at least a SECRET clearance at contract award and obtain a TOP SECRET clearance and be eligible for SCI access within 120 days. The Contractor also has 120 days to execute actions to gain TOP SECRET clearances for new Contractor staff when filling personnel vacancies; these members must have at minimum a SECRET clearance before starting work.

1.3. Specific Tasks

The Contractor shall provide technical assistance/analysis/recommendations and accomplish tasks supporting the MA OPR. The contractors draft recommendations shall be written from the perspective of what the USTRANSCOM MA OPR will do, not the contractor. This support will include short and no-notice preparation of memos, papers, letters, presentations/briefings, and other correspondence. In addition to participating in activities addressed in these noted task areas, the Contractor will also attend MA related meetings and other collaboration events not listed at the request of the MA OPR to evaluate the potential synchronization with assigned MA OPR responsibilities. In meeting the requirements of this effort the Contractor will at no time represent or present the appearance of speaking for USTRANSCOM and will provide recommendations directly to the MA OPR.

1.3.1. Task Area 1 – Task Order Management

This task consists of the functional activities relating to the administration and management of the MA responsibilities not addressed in other Task Areas. This task area includes, contract support activities and subtasks providing support to command directed activities within all Task Areas for activities such as KM, Information Sharing, Presentations, Process Improvement, Meeting Summaries, and Trip reports. The Contractor shall be responsible for administrative oversight of Contractor personnel performing tasks outlined in this PWS.

1.3.1.1. Subtask 1 - Task Order Management Plan (Data Item Number (DIN) A001)

The Contractor shall develop and provide a Task Order Management Plan (TOMP) describing the Contractor’s functional approach, resources, and management controls to support functional management consistent with the tasks and deliverables herein. The Contractor shall submit the plan within ten (10) working days from the start of the base period of performance. The contractor will offer recommended updates to the TOMP within a suspense established by the MA OPR when the current TOMP no longer represents the contractors approach, controls and or resources, such as in response to a contract modification, or change in program policy.

1.3.1.2. Subtask 2 – Performance Metrics

1.3.1.2.1. MA Report (DIN A002)

The Contractor shall collect performance data throughout the period, draft the MA Report, and deliver to the USTRANSCOM MA OPR quarterly, not later than ten (10) working days into the following quarter, with the final quarterly report of the performance period no less than five (5) days before the end of the period of performance. The report will be in Microsoft (MS) Office Word or Excel format and include tasks assigned in the Contractor PWS displaying baseline assigned tasks, deliverables, and quarterly accomplishments.

1.3.1.2.2. In-Progress Reviews (IPRs) (DIN A003)

Government/Contractor IPRs will be held quarterly to assess performance under this task. The MA OPR will establish and schedule the date, time, and location of all IPRs. Unless otherwise determined and stated by the MA OPR, the IPRs for a given quarter will be conducted not later than ten (10) working days into the following quarter, with the final quarterly IPR of the performance period no less than five (5) days before the end of the period of performance. The IPR is not to be used to brief the quarterly MA report. The IPR will allow the Contractor, and the Government mutual opportunity to address/discuss significant issues (positive or negative) reported in the MA Report and or discuss contract concerns or risks.

1.3.1.2.3. USTRANSCOM MA Program Review

The Contractor will draft, collect, and maintain documents in support of higher headquarters, program reviews addressing program accomplishments, shortfalls, challenges and recommendations for improvement utilizing the Mission Assurance Program Review as a checklist providing these recommendations to the USTRANSCOM MA OPR for consideration.

1.3.1.2.3.1. MA Program Reviews could include AT, DCI, CS, COOP, InT, FEV, and MA Program/Activity requirements. The Contractor will be prepared to support individual program reviews annually. The Contractor will provide assistance to meet all requirements throughout the period as well as providing recommended presentations, staffing requirements throughout the command, and assisting the MA OPR throughout the actual Program Review as needed. The Contractor will provide an After Action report (AAR) (DIN A004) summarizing all actions taken to support the individual MA Program Review to the MA OPR not later than five (5) working days from event conclusion. If the higher headquarters executes a combined program review the Contractor will capture what was executed in the AAR.

1.3.1.2.3.2. TCC/SC MA Program Reviews. The Contractor will assist the MA OPR in scheduling and executing an annual program review of the TCC/SC MA programs. MA Programs include AT, DCIP, CS, COOP, InT, FEV, and MA Program requirements. The TCC/SC MA Program review will synchronize execution with other USTRANSCOM risk management programs; at minimum the AT, DCI, CS, and Insider Threat programs. The Contractor will provide a recommended schedule to the MA OPR not later than sixty (60) working days from the start of the period of performance (DIN A005). The Contractor will assist the MA OPR in performing scheduled annual program reviews producing an AAR within five (5) working days following the completion of the TCC/SC program review (DIN A006) and include recommendations for the assessed component to take for action.

1.3.1.3. Subtask 3 – Project Assessment Report (PAR) (DIN A007)

The Contractor shall develop and provide a PAR not later than ten (10) working days prior to the end of the base period of performance and subsequent exercised period of performance options.

The report will address the following:

- Description of progress in meeting deliverables

- List of meetings supported

- List and description of documents reviewed

- Summary of invoices submitted (labor, other direct cost (ODC) and travel)

- Recommendations for methods of enhancing the MA Program, including resource requirements and proposed courses of action

1.3.1.4. Subtask 4 – Meeting Support

Although not empowered to make decisions for the Government or to represent an official Government position, the Contractor will participate with, or in place of the MA OPR at appropriate meetings. The Contractor will ensure the attendees understand the Contractor is not speaking for the Government or USTRANSCOM.

1.3.1.4.1. Local Meeting Summaries

For meetings not requiring travel or not identified in other task areas requiring an AAR, the Contractor will provide meeting summaries within one (1) working day of the meeting (approximately fifteen to twenty (15-20) per week). Meeting summaries will be submitted in MS Outlook (e-mail), MS Word, MS PowerPoint, or MS Excel format, or in some cases due to content or urgency verbally to the MA OPR. Due to the expected high frequency of meetings, Meeting Summaries will not be monitored as deliverables but instead reported by exception, i.e., evaluated for meeting the required timeframe, format, and recommendations provided.

1.3.1.4.2. Meetings requiring travel.

When meeting participation requires travel and the event is not assigned a DIN requiring an AAR, the same rules apply for conduct of that meeting as noted in the above; Local Meeting subtask.

The Contractor will submit a Trip Report (DIN A008) completed in MS Office Word and submit to the MA OPR within five (5) working days of the Contractor’s return. The Contractor shall provide the current status of all Trip Reports in the MA Report, and shall include a summary of findings and recommendations in the PAR.

1.3.1.5. Subtask 5 – Documentation Reviews

The Contractor shall review MA related documents originating within, and external to, the DoD (approximately two (2) per week). The Contractor shall submit to the MA OPR proposed responses/comments within established suspense and format set by the originating organization and MA OPR. The Contractor will provide meeting summaries as defined in paragraph 1.3.1.4.1., when participating in actions in support of this subtask. Contractor shall provide the current status in the MA Report, and shall include a summary of findings and recommendations in the PAR.

1.3.1.6. Subtask 6 - Presentations

The Contractor will develop recommended presentations, point papers, and or talking points in support of task areas when required to satisfy action officer through general officer level events not already addressed in each Task Area. Most presentations will be in MS Office products (MS Word, MS Outlook, MS PowerPoint). The Contractor will prepare the presentations in the format specified by the MA OPR and deliver the presentation to the MA OPR by their established suspense. The Contractor will provide meeting summaries as defined in paragraph 1.3.1.4.1., when participating in actions in support of this subtask. Contractor shall provide the current status of this subtask in the MA Report, and include a summary of findings and recommendations in the PAR.

1.3.1.7. Subtask 7 - MA Routine Reoccurring Functions

- The Contractor will monitor the TCJ3 List M Watch-Cell organizational electronic accounts, TCJ3-

M Knowledge Management sites on both Non-secure Internet Protocol Router Network (NIPRNET), Secret Internet Protocol Router Network (SIPRNET), command directed KM application and Joint Worldwide Intelligence Communications System (JWICS) notifying MA OPR of actions required including recommendations:

- The Contractor will monitor the DoD recognized MA/DCI/MRT-C, CS, AT/EM/COOP/FEV/InT portal’s or database’s notifying MA OPR of actions required.

- The Contractor will provide daily submission of the “Morning Muster Report” to the designated recipients within TCJ3-M, by the Division designated time, strictly for accountability of Contractor personnel working in and outside USTRANSCOM facilities such as TDY’s, off-site training, and or personal time off.

- The Contractor will monitor and complete actions assigned in the NIPRNET and SIPRNET, Task Management Tool; as well as actions submitted through, Strategic Mission Assurance Data System (SMADS), Strategic Knowledge Web (SKIWeb), Mission Assurance Decision Support System (MADSS), Global Mission Assurance Portal (GMAP), Mission Assurance Risk Management System (MARMS), Operational Orders, Task Orders, and/or validated requests via NIPRNET, SIPRNET, and JWICS MS Outlook, submitted or assigned to the MA OPR.

- The Contractor will monitor and provide recommendations to the MA OPR regarding requests for information related to MA responsibilities within this PWS. Actions supporting these activities will be provided in accordance with Meeting Summaries as defined in paragraph 1.3.1.4.1.

1.3.1.8. Subtask 8 – Cooperative Research and Development Agreement (CRADA)

The Contractor will support the MA OPR in furthering current opportunities under the CRADA with the University of Illinois managed Critical Infrastructure Resilience Institute (CIRI) with specific attention to identifying opportunities to identify information sharing, and risk assessment options with the transportation commercial providers referred to as the Fourth (4th) Component, and other federal agencies. The Contractor will support this subtask through review of existing MA processes, and requirements through synchronization of risk management program activities in accordance with the current OASD (HD&GS) Mission Assurance Strategy, DoDD 3020.40 Mission Assurance, DoDI 3020.45 MA Construct and USTRANSCOM Mission Assurance Instruction to identify existing gaps in accessing required capabilities controlled by the non-DoD entity. Executing this task area requires robust collaboration with the USTRANSCOM TCJ3-F, TCJ3-O, TCJ3-S, TCJ3-Y, TCJ5 Plans, TCJ5/4 Infrastructure, TCJ6, TCAC Infrastructure, TCJ2- W Intel Watch, TCJ2-X Counterintelligence, TCJ3-MP, TCJ3-MI, and TCJ3-MO, as well as like program SMEs at the TCCs, JECC, other CCMDs, Service Headquarters, commercial contract carriers, and other Federal Agencies.

The MA OPR will rely on the Contractor to provide recommendations to engage CIRI in future experiments and study efforts. When solutions are discovered the Contractor will offer recommendations to the MA OPR to engage with the TCJ5 RDT&E OPR to seek technical transfer actions. Actions supporting these activities will be provided in accordance with Meeting Summaries as defined in paragraph 1.3.1.4.1.. Contractor shall provide the current status of this subtask in the MA Report, and include a summary of findings and recommendations in the PAR.

1.3.1.9. Subtask 9 - Knowledge Management (KM)

KM consists of efforts to create information sharing opportunities, leverage sharing opportunities with other USTRANSCOM Directorates, Divisions, Branches, TCCs, SC, and MA Community programs, as well as other Federal Agencies and transportation partners. It also includes activities to make data more secure, resilient, relevant, timely and discoverable.

1.3.1.9.1. KM Program Activities

The Contractor will participate in, and comply with USTRANSCOM and DoD level KM requirements and activities in support of Task Areas 1-9. The Contractor will leverage existing Command level KM practices, applications, and processes when accomplishing the tasks described in the PWS in all environments (NIPRNET, SIPRNET, and JWICS). The Contractor will support MA OPR KM requirements providing recommendations to the MA OPR with the suspense assigned to the MA OPR in and/or from authoritative taskings (JSAP, TMT, Command KM OPR, etc..) as they relate to MA OPR program requirements. Potential recommendations include update to: KM Plan, KM Governance Plan, KM Training, KM Content Management, KM applications and resources. The Contractor shall support, but not be assigned or appointed roles or responsibilities (specific positions) within or outside the TCJ3-M deemed inherent governmental (i.e. Knowledge Manager Representative, etc...). The Contractor will provide meeting summaries, as defined in paragraph 1.3.1.4.1., when participating in KM specific actions and working groups.

The Contractor will provide the current status in the MA Report, and include a summary of

1.3.1.9.2. Alternate Business Practices (ABPs) and Standard Operating Procedures (SOPs)

The Contractor will review current ABPs and SOPs resident in the supported Task Areas within the first forty (40) working days of the period of performance, providing recommended updates to these procedures to the MA OPR in the current format for MA related programs and activities assigned to the MA OPR. The ABPs and SOPs are complimentary and will serve to define process to meet established DoD and USTRANSCOM Instruction responsibilities. The Contractor will be prepared to support ABPs when necessary or during network outages and scheduled exercises providing an AAR (DIN A009) to the MA OPR within five (5) working days of executing the ABP. The Contractor will provide meeting summaries, as defined in paragraph 1.3.1.4.1., when participating in actions in support of this task not requiring an AAR. Contractor shall provide the current status of this subtask in the MA Report, and include a summary of findings and recommendations in the PAR.

1.3.1.9.3. Mission Assurance Database Support

The Contractor serves as the primary technical advisor to the MA OPR with regard to GMAP SMADS, MARMS, MADSS, WebEOC, IP Gateway, or other databases and information tools to be named by the Joint Staff MA OPR. Contractor shall comply with all database, Security and Information Assurance policies and guidance. The Contractor will provide meeting summaries as defined in paragraph 1.3.1.4.1., when participating in actions in support of this subtask.

Contractor shall provide the current status of this subtask in the MA Report, and include a summary of findings and recommendations in the PAR.

1.3.1.9.4. Cross Domain Transfer

The contractor will support the MA OPR in identifying and executing when approved, cross domain transfer requirements and capabilities required to support MA OPR responsibilities to include: recommending positions required to have the capability, drafting requests for authorized positions and workstations, and submitting requests when approved to the appropriate office and tracking authorizations. The Contractor will provide meeting summaries as defined in paragraph 1.3.1.4.1., when participating in actions in support of this subtask. Contractor shall provide the current status of this subtask in the MA Report, and include a summary of findings and recommendations in the PAR.

1.3.10.1. Subtask 10 - Process Improvement

The Contractor will identify and offer recommendations to the MA OPR on process improvement actions for consideration across all Task Areas. Recommendations will be provided in the format described in paragraph 1.3.1.4.1., when participating in actions in support of this subtask.

Contractor shall provide the current status of this subtask in the MA Report, and include a

1.3.2. Task Area 2 – Mission Assurance Program Support

MA processes are identification, assessment, risk management, and monitoring of capabilities required by USTRANSCOM and its components to execute the missions assigned to USTRANSCOM. This task area is in support of the MA OPR responsibilities, at the action officer, planner and General Officer level, and ultimately to the Commander USTRANSCOM. The Contractor will support the MA processes, and DCI requirements through synchronization of other risk management program activities in accordance with the current OASD (HD&GS) Mission Assurance Strategy, DoDD 3020.40 Mission Assurance, DoDI 3020.45 MA Construct and USTRANSCOM Mission Assurance Instruction. Executing this task area requires robust collaboration with the USTRANSCOM TCJ3-F, TCJ3-O, TCJ3-S, TCJ3-Y, TCJ5 Plans, TCJ5/4 Infrastructure, TCAC Infrastructure, TCJ2-W Intel Watch, TCJ2-X Counterintelligence, TCJ3- MP, TCJ3-MI, and TCJ3-MO, as well as like program SMEs at the TCCs, JECC, other CCMDs, Service Headquarters, and other Federal Agencies.

The MA OPR will rely on the Contractor to provide recommended draft USTRANSCOM instructions, plans, standard operating procedures (SOPs), alternate business procedures (ABPs), point papers, TMTs, and briefs to implement MA at USTRANSCOM. The Contractor will provide meeting summaries as defined in paragraph 1.3.1.4.1., when participating in actions in support of this task area when an AAR is not required. Contractor shall provide the current status of this subtask in the MA Report, and include a summary of findings and recommendations in the

PAR.

1.3.2.1. Subtask 1 – USTRANSCOM MA Instruction

The USTRANSCOM MA Instruction supports the USTRANSCOM MA responsibilities and provides guidance to the USTRANSCOM Staff, the TCCs (SDDC, MSC, and AMC), and its subordinate command (JECC). The Contractor shall execute a review of the USTRANSCOM MA Instruction when required by the USTRANSCOM Instruction OPR and communicated through TMT. The contractor will submit recommendations to the MA OPR within the suspense established in TMT in the form of a revision of the MA Instruction. If there are no updates recommended the contractor will respond through a meeting summary as defined in paragraph

1.3.1.4.1.. If updates are required the Contractor will assist the MA OPR to collect comments on the Instruction from USTRANSCOM Staff providing a final updated MA Instruction within normal suspense timelines established by the Instruction OPR on adjudicated comments. The Contractor shall assist the MA OPR in coordinating the final draft MA Instruction with appropriate directorates and TCCs via standard USTRANSCOM staffing processes through signature providing an AAR of the MA Instruction validation process within the stated suspense in TMT publishing the updated Instruction (DIN A010). Contractor shall provide current status in the MA Report, and shall include a summary of findings and recommendations in the PAR.

1.3.2.2. Subtask 2 – MA Plan

The Contractor will identify and develop a recommended MA Plan to provide a holistic risk analysis and information sharing approach for executing responsibilities assigned within the Command Mission Assurance Instruction. The MA Plan could include documented processes for leveraging command B2C2WG activities, and other actions synchronizing operational joint planning team and operational planning team activities; other command Global Campaign Plan activities; etc… to achieve command priorities. Risk Management activities at a minimum include; AT, CS, DCI, FEV, InT, COOP, DSE, CBRNE, and operational planning activities. The MA Plan is a living document that will be updated as recommended actions are completed, or when operational requirements change. The Contractor shall provide the recommended MA Plan (baseline document) (DIN A011) within forty (40) working days from the start of the period of performance and provide updates to the plan when required throughout the life of the contract.

Updates to the MA Plan will be provided using the same process as submitting meeting summaries as noted in paragraph 1.3.1.4.1.. The Contractor shall provide the current status in the MA Report, and shall include a summary of findings and recommendations in the PAR.

1.3.2.3. Subtask 3 - USTRANSCOM 7-Minute Drill

The Contractor shall develop, review, update, and provide recommendations to the MA OPR responsible 7-Minute Drill’s when policy, procedures, or missions change, and at minimum annually (from the last update). Potential activities include the Mission Assurance Working Group; Insider Threat Working Group; Foreign Entity Vetting Working Group, and others as may be recommended by the MA OPR or contractor. The Contractor will submit recommendations (DIN A012) to the MA OPR for consideration not later than ninety (90) days after the start of the base period of performance and updates as noted above. The Contractor shall assist the MA OPR in coordinating the new or updated document with the USTRANSCOM Staff. Contractor shall provide current status in the MA Report, document required changes in the MA Instruction when required and shall include a summary of actions in the PAR. Additional reviews may be required to update the specific 7-minute drill as deemed necessary by the MA OPR or USTRANSCOM policy with additional review recommendations submitted within the established suspense set by the MA OPR.

1.3.2.4. Subtask 4 – MA Process

The goal of MA Process is synchronizing the various MA related programs and activities to identify mission essential capabilities as well as a tiered list of DCI, and resulting risk management activities. The Contractor will support the execution of mission owner responsibilities identified in DoDD 3020.40, DoDI 3020.45, and pending CJCSI for Mission Assurance to accomplish these responsibilities. The Contractor will execute support to MA OPR to satisfy tasking’s by the Joint Staff as well as in support of GCP, MRT-C, KT-C, commercial partner requirements, and other related efforts, and or requirements that may be communicated from appropriate DoD organizations.

1.3.2.4.1. Mission Decomposition

Mission Decomposition is a living process and is not a one-and-done task. Mission decomposition changes due to changes in requirements, changes to environment, changes to infrastructure, and sometimes changes to mission priorities. Executing and maintaining awareness of the requirements to execute the CCMD level task requires near constant actions requiring extensive transportation mission knowledge and operational planning collaboration with multiple entities.

DCI includes Task Assets, Task Critical Assets (TCAs) level 1 and 2, and Defense Critical Assets (DCAs) and is identified through execution of the DoD mandated Critical Asset Identification Process (CAIP). Documenting and mapping results of the Mission Decomposition Process is imperative to synchronizing MA across the command. The Contractor will develop a SOP for executing and documenting Mission Decomposition, and sharing this analysis with other MA related activities to ensure that all risk management activities are executing actions based on the same mission relevant data. The contractor will identify a recommended repository and process to execute this task and complete it within suspense dates established by the MA OPR and Project Manager for use by other risk management activities. The Contractor will provide meeting summaries as defined in paragraph 1.3.1.4.1., when participating in actions in support of this subtask. Contractor shall provide the current status of this subtask in the MA Report, and include a summary of findings and recommendations in the PAR.

1.3.2.4.2. Identification of Defense Critical Infrastructure (DCI)

Identification of DCI is a complex action requiring extensive transportation mission knowledge and operational planning collaboration with multiple entities. The Contractor will identify DCI as required. DCI includes Task Assets, Task Critical Assets (TCAs) level 1 and 2, and Defense Critical Assets and is identified through execution of the DoD mandated Critical Asset Identification Process (CAIP). Included in performing the CAIP is executing, documenting, and mapping the mission decomposition actions to identify required capabilities, dependencies, and related linkages, and relevant task assets. Collaboration with key stakeholders, and populating dependency data in the DoD recognized repository is a complex task that requires detailed analysis and data collection. The Contractor will execute criticality assessments of the task assets identified and document to offer DCI recommendations to the MA OPR at the Action Officer (AO) level in a format to be specified based on suspense’s established by the Joint Staff MA OPR, or at the request of the MA OPR during Operational Planning or OPLAN reviews. The Contractor will provide recommended Transportation related DCI when required to the MA OPR in response to Higher Headquarters taskers. All collaboration with other MA OPRs, the USTRANSCOM staff, the TCCs, Mission Owners, and non DoD asset owners (also known as key stakeholders) will be documented and available upon request. When released by OASD (HD&GS) and Joint Staff J33 MA OPR, the Contractor will utilize the MA program of record for data repository and data management of MA Baseline Elements of Information (BEI). This support will entail extensive and recurring interaction with key stakeholders for the analysis of the USTRANSCOM missions to result in the accurate and complete identification and validation of Mission Mapping and identified DCI recommendations. Critical asset identification, validation, and recommendations will be accomplished in consonance with the referenced MA Construct, CJCSI Mission Assurance, USTRANSCOM Mission Assurance Instruction, and USTRANSCOM Plans. To obtain key stakeholder collaboration, the Contractor will prepare official staff coordination documents and submit to the USTRANSCOM MA OPR in accordance with his established suspense. The Contractor will also participate in other CCMD, service, and military department efforts at the AO level to characterize the infrastructure and assets that apply to their missions, providing recommendations to the USTRANSCOM MA OPR for formal submissions. While there is no anticipated travel in support of this task area the contractor may recommend travel to complete this complex task. The Contractor will provide meeting summaries as defined in paragraph 1.3.1.4.1., when participating in actions in support of this subtask. Contractor shall provide the current status of this subtask in the MA Report, and include a summary of findings and recommendations in the PAR. Contractor shall provide the current status in the MA Report, and shall include a summary of findings and recommendations in the PAR.

1.3.2.4.3. The Contractor will assist the MA OPR in collaboration with command staff sections involved in the identification of Mission relevant Terrain – Cyber (MRT-C), Key Terrain - Cyber (KT-C) and its integration with current DoD MA policy providing recommendations to the MA OPR in the format and suspense established by the MA OPR in the form of a meeting summary in accordance with paragraph 1.3.1.4.1..

1.3.2.5. Subtask 5 – MA Assessment (MAA)

1.3.2.5.1. MAA Planning

The MAA process focuses on defining the risk to DoD, and DoD Component Missions (Risk to Mission). The MAA will include identifying risk to infrastructure, forces, and information (to include DCI) through an all-threats hazards assessment approach. MAAs may be executed at DoD and Non-DoD locations. Assessment activities are executed in an integrated manner across appropriate MA disciplines by SMEs. MAAs identify likelihood for threats, natural disasters and accidents at the asset level based on unique conditions of infrastructure relied upon to satisfy mission requirements. Executing and reporting MAAs is a very complex and detailed process requiring an extensive level of collaboration among willing participants. Relationship building is paramount. MAAs will include DoD, Service, Agency, and CCMD led assessment teams. The Contractor shall interact with the Joint Staff MA OPR, asset owners, Defense Threat Reduction Agency, Mission Assurance Division, DHS, USCG, DOT, as well as State and Federal Agencies researching existing vulnerability and risk assessment reports prepared by other assessing organizations, offer recommendations to the USTRANSCOM MA OPR of the appropriate agency to partner with on assessments. The Contractor will identify, develop/update, and provide a recommended MAA Plan (DIN A013) to include collecting and tracking other MA related assessments scheduled such as AT, CCRI’s, and, INSER assessments for the current period of performance within twenty (20) working days from the start of the period of performance, and update when new information is made available to the Contractor for posting updates to the identified KM site. When accepted by the MA OPR, the Contractor will put the plan into action.

Contractor shall provide the current status in the MA Report, and shall include a summary of findings and recommendations in the PAR. The Contractor will periodically provide recommended responses to the MA OPR when tasked by the Joint Staff MA OPR for Joint Mission Assurance Assessments (JMAAs), other CCMDs, and Service Headquarters for queries, schedule recommendations, and or analysis based on suspense established by the MA in the format and suspense established by the MA OPR in the form of a meeting summary in accordance with paragraph 1.3.1.4.1.. This action will be provided in meeting summaries or an AAR if applicable providing the current status in the MA Report, and shall include a summary of findings and recommendations in the PAR.

1.3.2.5.2. MAA Support

MAAs will include virtual and boots-on-ground assessments based on the required level of fidelity and opportunity available. For those instances that must be performed on-site the Contractor will support the MA OPR with Transportation MA subject matter experts when travel funds are available. The DoD released JMAA Benchmarks and Standards will be applied in all instances. It is estimated that there may be at least one (2) OCONUS and (5) CONUS assessments supporting the USTRANSCOM Missions per period of performance. MA Assessment support includes JMAAs, Balanced Survivability Assessments (BSAs), Service, Agency and/or CCMD led MAAs, and Cyber related assessments. In addition, it is anticipated that the Contractor will support three (3) additional USTRANSCOM led/supported MA Assessments during each period of performance in support of the Ports for National Defense (PND) Program. Regardless of the assessment supported, the Risk Analyst will provide analysis, pre-assessment research and boots-on-ground support to the assessment, and offer recommendations to the assessment report when serving as a member of the assessment team. The Contractor will prepare and deliver a recommended MAA AAR (DIN A014) to address findings and recommendations discovered during the assessment to the MA OPR for submission to the lead assessment agency based on their required timeline, template and content of the supported assessment agency or asset/mission owner. The Contractor will input assessment data into the Joint Staff recognized system of record, USTRANSCOM KM repository, and common operating picture when applicable. When the lead assessment agency does not require input to the assessment, the Contractor will provide the AAR to the MA OPR by suspense to be determined by the MA OPR.

1.3.2.6. Subtask 6 – Synchronize Risk under Command MA Effort

The Contractor will support the MA OPR in meeting DoD policy requiring Combatant Commanders to synchronize MA through an integrated risk-management methodology. A key activity under MA is synchronizing requirements through planning. The Contractor will support the MA OPR in synchronizing and integrating MA actions with command risk management programs/activities, and planning activities conducted within the J2, J3, J4/5, and J6 with dedicated attention to activities focusing on risks in the cyber domain. Other actions executed under this task area will be delivered through other supported DIN’s such as support to exercises, and assessments.

Contractor shall provide the current status in the MA Report, and shall include a summary of

1.3.2.6.1. The Contractor will support the MA OPR in planning activities to include Global Campaign Plan (GCP) 9033, subsequent annexes, Force Flow Conference tasks for supported Geographic CCMD Operational Plans (OPLANs), and related 2+3 GCP’s. The Contractor will participate in and support the MA OPR in GCP LOE actions when assigned to TCJ3-M. The requirement is not to replicate efforts executed by planning staff but serve as a J3-M point of contact to synchronize MA activities with USTRANSCOM planning staff to consider MA Program actions and satisfy command Risk to Mission and Risk to Force assessments. The Contractor will participate in Command plans development, to include Sustainment planning efforts, all GCP LOE’s Working Groups, ERIMP planning, and TCAC analysis efforts for key transportation nodes, and validated input to the command input to the Annual Joint Assessment reporting. The Contractor will provide recommended written inputs in accordance with the MA OPR established format and suspense producing a meeting summary or trip report in accordance with paragraphs 1.3.1.4.1 or 1.3.1.4.2.

1.3.2.6.2. A significant portion of the planning and coordination of USTRANSCOM mobility operations are conducted via unclassified networks and with commercial providers. This open collaborative environment increases opportunities for exploiting vulnerabilities in and through the cyberspace domain that could result in mission impacts. The Contractor will assist the MA OPR during collaborative actions to understand, monitor, and respond to mission risks to capabilities, assets, and dependencies within the technology areas of Information Technology, Operational Technology, Defensive Cyber Operations and Mission IT Platforms and Systems; the requirement is not to replicate efforts executed by the JCC or J6 staff but serve as a J3-M point of contact to synchronize cybersecurity risks within the Command MA Program. The Contractor will participate in Global Campaign Plan development, cyber fusion working group, and Key Terrain -Cyber efforts, providing recommended written inputs in accordance with the MA OPR established format and suspense producing a meeting summary or trip report in accordance with paragraphs 1.3.1.4.1 or

1.3.1.4.2. The Contractor will assist the MA OPR in collaboration with command staff sections involved in the identification of MRT-C and KT-C, and its integration with current DoD MA policy providing recommendations to the MA OPR in the format and suspense established by the MA OPR through a meeting summary in accordance with paragraph 1.3.1.4.1..

1.3.2.6.3. The Contractor will support the MA OPR in providing input to the Command submission to the Annual Joint Assessment process identifying Risk to Mission and Risk to Force data in addition to other routine MA OPR requirements in the format and suspense established by the MA OPR through a meeting summary in accordance with paragraph 1.3.1.4.1..

1.3.2.7. Subtask 7 – Risk Management

Deputy Secretary of Defense has Risk Decision authority for Defense Critical Assets (DCAs) supporting Department Level Missions, and Combatant Commanders have the risk decision authority for Tiers I and II TCAs supporting CCMD Missions. Risk Management actions at USTRANSCOM include all Transportation Infrastructure, not just DCI, and under Mission Assurance all dependencies are included across risk management programs. Remediation is a primary function of asset owners at the Component and Service Level. The Contractor will assist the MA OPR in performing the functions associated with developing, collaborating, staffing and submitting remediation and mitigation plans when required. The Contractor will synchronize risk management activities resulting in Risk to Mission and Risk to Force assessments with the Mission Assurance Operations Branch for briefing to the USTRANSCOM MAWG.

1.3.2.7.1. Develop mitigation plans for identified DCI

The Contractor will at the AO level interact with TCJ3 Division SMEs and planners, Risk Analysts, SDDC-TEA, TCJ5/4 Infrastructure and component command Critical Asset Risk Management (CARM), CIP and Critical Infrastructure Risk Management (CIRM) staff to develop mitigation plans for Transportation DCI supporting USTRANSCOM Missions. The Contractor will submit mitigation plan recommendations in the Joint Staff MA OPR directed format. DCA Mitigation Plans are the priority followed by Tier 1 TCAs, and then Tier 2 TCAs.

The Contractor will interact directly with the MA OPR to determine the priority, number of, and suspense for completion of these plans. The Contractor will assist the MA OPR with staffing recommended Mitigation Plans for approval at the J3 level and maintain the same in DoD databases up to and at the TS/SCI level. The Contractor will support coordination to incorporate DCI Mitigation plans incorporated into applicable Appendix14/15 of Annex C for related OPLANs and CONPLANs. When developing Mitigation Plans the Contractor will also provide recommended residual risk incurred when implementing this plan. Actions taken will be reported through a meeting summary in accordance with paragraph 1.3.1.4.1..

1.3.2.7.2 Risk Decision Packages (RDPs)

The Contractor shall in compliance with DoDD 3020.40, DoDI 3020.45, Chairman Joint Chief of Staff Instruction’s (CJCSIs) and other applicable MA programmatic documents (e.g., Instructions and Manuals), interacting with stakeholders for developing recommendations to the MA OPR on infrastructure that USTRANSCOM relies on as the mission/function owner. Within a suspense established as needed by the MA OPR, and based on Joint Staff assigned suspense, the Contractor will provide reviews of DoD owned RDPs, and will develop RDPs for Non DoD owned Transportation DCI. Recommended RDPs of DCI supporting USTRANSCOM Missions will be provided by the Contractor for all Transportation Tier I TCAs within one-hundred and twenty

(120) days of the JMAAs / MAAs being completed. Working at the AO Level, the Contractor will assist the MA OPR to ensure that the mission and function owner concerns are satisfied. The Contractor will assist in staffing completed RDPs involving transportation missions or functions through the MA OPR to the TCJ3 for approval via a USTRANSCOM staffing process within a suspense established by the MA OPR. The Contractor will develop a process for monitoring and reporting recommended course of action identified during MAAs, and also tracking and reporting of accepted remediation and mitigation actions. Actions taken will be reported through a meeting summary in accordance with paragraph 1.3.1.4.1.. Updates will be provided during quarterly IPRs and included in the PAR.

1.3.2.7.3. Manage MA and DCI Information

The Contractor shall monitor current transportation related Defense Critical Infrastructure entered in SMADS, SKIWeb, GMAP, MADSS or other DoD or USTRANSCOM repository providing recommendations to the MA OPR when changes are made by other asset and mission owners.

When approved by the MA OPR, the Contractor will enter and update DCI BEI into the MA program of record (currently Strategic Mission Assurance Data System (SMADS)) as necessary.

Actions taken will be reported through a meeting summary in accordance with paragraph 1.3.1.4.1.. Updates will be provided during quarterly IPRs and included in the PAR.

1.3.2.7.4. Risk to Mission and Risk to Force

The Contractor will support the MA OPR in requirements to contribute Risk to Mission and Risk to Force assessments into USTRANSCOM readiness efforts as well as input to Command submission of the Annual Joint Assessment reporting when required. The Contractor will be prepared to contribute this data to other command efforts when applicable. Actions taken will be reported through a meeting summary in accordance with paragraph 1.3.1.4.1.. Updates will be provided during quarterly IPRs and included in the PAR.

1.3.2.8. Subtask 8 - MA Information Sharing

1.3.2.8.1. MA Information Sharing with Non-DoD Agencies and Transportation Partners

The Contractor will assist the MA OPR to establish the necessary lines of communication with Non-DoD (National and Foreign owned) entities and promote opportunities for information sharing. The Contractor will provide recommendations to the MA OPR when opportunities are identified to share MA related data with Federal departments and agencies; State, Local, Regional, territorial, and tribal entities; the private sector; and foreign countries, as appropriate building relationships with these asset owners. The Contractor will provide meeting summaries, as defined in paragraph 1.3.1.4.1., when participating in actions in support of this subtask. The Contractor shall provide status in the MA Report. A summary of actions taken will be included in

PAR.

1.3.2.8.2. Coordination with Infrastructure Databases

MA OPR has determined that SMADS, and MADSS on SIPR, and GMAP on JWICS are the…