Atch_1_-_DCD_PWS_FY20-AMD1.pdf

HTC711-19-R-R007/Atch - 1

PERFORMANCE WORK STATEMENT (PWS)

Defense Courier Scheduled Air Transportation Service

15 May 2019

1.0 DESCRIPTION OF SERVICES

1.1 Background. USTRANSCOM Defense Courier Division (DCD) requires air transportation via commercial scheduled service routes to augment its global transportation network. The DCD will use a system of travel and recovery couriers to monitor courier material transported over commercial air routes. Two Department of Defense (DoD) travel couriers will transport material to planeside and monitor the material until it is loaded and aircraft doors are sealed. The DoD travel couriers will board the aircraft transporting the material. Two DoD recovery couriers will be escorted at destination to pre-stage and meet inbound aircraft planeside to observe the aircraft cargo doors being unsealed and material offloading. Recovery couriers willaccept the material planeside and conduct a piece count.

The services provided within the scope of this contract are considered Covered Defense Information (CDI) as defined in DFARS 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting.

1.2 Scope of Work. The contractor will provide seats for two (2) travel couriers with personal carry-on baggage and cargo space for containerized and/or loose loaded courier materials as described in this PWS. Service will be within the Continental United States (CONUS) and between CONUS and Alaska and Hawaii.

1.3. General Requirements. Except as otherwise stated in this contract, the contractor shall provide all personnel, equipment, tools, facilities, supervision, and direct materials necessary for the performance of the air transportation for two (2) DoD couriers with personal carry-on baggage and classified/sensitive material on scheduled service air routes as specified. The contractor will transport launch couriers together with the courier material during ground handling operations and allow launch couriers to continually observe aircraft and material as described below. When contractor personnel require access to the cargo bay after it has been sealed, couriers will be permitted access planeside in a position which allows them to observe and monitor the status of courier material, except in cases where courier observation would seriously jeopardize safety.

1.3.1 Passenger Seating. The contractor shall provide travel couriers with passenger seating that is no less than folding observer seating. Passenger based airlines shall permit pre-boarding of travel couriers.

Courier pre-boarding requirements for cargo based carriers will not apply. Travel couriers shall be seated in close proximity of one another (side by side or separated by no more than one seat or one row;

across aisle seating is acceptable on narrow-body aircraft). Seating shall be positioned to allow safe passage as couriers enter and exit the aircraft and shall be unencumbered by cargo or baggage.

Passenger air carriers will charge no more than the Government fare per seat. Cargo air carriers will charge no more than the average commercial airfare cost between major north east airports and the San Francisco/Oakland/Sacramento area.

1.4 Specific Tasks.

1.4.1 Containerized/Palletized Material. Containers (igloo/cans) or pallets provided by the airline will be used when containerized transportation of material is needed. The contractor will provide pre-staged, airworthy/inspected, airline containers/pallets as requested by regional Defense Courier Stations.

Individual Courier Stations will pick up containers/pallets and transport them between Courier Station and contractor’s facility. For stations that do not have transport capability of containers/pallets, the contractor will provide temporary space for Defense couriers to load containers at the contractor location. Containers will be of various sizes based on material weight with doors properly aligned to permit couriers to apply lock/security seals. Contractor will replace any containers that do not meet these standards at no cost to the Government. Palletized material will be secured by shrink wrap or nets provided by the defense couriers. Any required contractor-unique pallet nets shall be provided by the contractor.

1.4.1.2 Loose Loaded Material. DoD courier material will not be loose loaded on aircraft unless it is in direct possession of the travel couriers for the duration of the flight.

1.4.1.3 Ground Handling. The contractor will transport two couriers along with the container(s) to and from aircraft during ground handling operations.

1.5 Required Routes. The Government requires round trip transportation on the following routes:

Baltimore (BWI) to San Francisco (SFO), Oakland (OAK) or Sacramento (SMF) Baltimore (BWI) to San Antonio (SAT) Baltimore (BWI) to Denver (DIA) Baltimore (BWI) to Omaha (OMA) Denver (DIA) to Omaha (OMA) Denver (DIA) to San Antonio (SAT) San Francisco (SFO), Oakland (OAK) or Sacramento (SMF) to San Antonio (SAT) San Francisco (SFO), Oakland (OAK) or Sacramento (SMF) to Honolulu (HNL) San Francisco (SFO), Oakland (OAK) or Sacramento (SMF) to Anchorage (ANC) San Francisco (SFO), Oakland (OAK) or Sacramento (SMF) to Denver (DIA) San Francisco (SFO), Oakland (OAK) or Sacramento (SMF) to Seattle (SEA) San Francisco (SFO), Oakland (OAK) or Sacramento( SMF) to San Diego (SAN) Seattle (SEA) to Anchorage (ANC)

1.5.1 All routes must use sealable containers loaded into the aircraft.

1.5.2 Material cannot be loose loaded into the belly of aircraft for any routes.

1.6 Loading and Security.

1.6.1 Access. The contractor will permit couriers access to planeside for loading and offloading of material to ensure couriers have visibility of all courier material during transfer, onload, and offload.

The contractor will assist couriers in gaining unescorted airport access at each contracted airport location. In the event unescorted access is not available, the contractor will escort couriers and material planeside. On departing flights the containers/loose loaded material must be under constant observation of traveling couriers until the aircraft door is sealed. On arriving flights, recovery couriers must be prepositioned to view the cargo doors prior to opening and must observe container/material offload. The container(s)/material must be kept in constant view of the couriers at all times. If couriers and courier material are transiting through a location, the contractor will be responsible to provide a secure, temporary holding area for couriers to be out of the elements but be able to have constant surveillance of the sealed containers.

1.6.2 Diversions. In the event of a diversion, the two travel couriers on board must be permitted to deplane and preposition planeside prior to the aircraft cargo doors being opened. The couriers must maintain visibility over the cargo doors whether opened or closed and if opened must maintain constant visibility over material.

1.6.3 Missing/Damaged Material. In the event pieces of courier material are missing or damaged, contractor personnel will cooperate fully with courier requests for rechecking aircraft cargo/baggage compartments and will provide couriers with requested information to the best of their ability. In the event actual classified information is exposed to contractor personnel, the affected individuals may be required to sign an Inadvertent Disclosure agreement to document understanding of their obligation to safeguard any sensitive information gained by the inadvertent exposure in accordance with 18 United States Code Sections 793 and 794.

1.7 Hours of Operation and Scheduling.

1.7.1 Government Liaison. Prior to the start of the contract, the contractor shall furnish the Contracting Officer Representative (COR) with the name, address, e-mail address, and telephone number of the agent(s) who will serve as liaison between the contractor and the Defense Courier Division identified by the COR. The agent(s) must have authority to book seating and cargo space on contracted routes and make decisions pertinent to the airlift service for the contractor. The agent(s) must be available during regular business hours and must provide an after-hour’s phone number to be used in the event of emergency.

1.7.2 Hours of Operation. Contractor liaison and the COR will work in concert to establish best mission hours for courier requirements.

1.7.3 Mission Scheduling. All scheduling, movement forecasts, and changes will be made by the Defense Courier COR or Ordering Officer (OO). The COR or OO is responsible for evaluating individual transportation requirements and making an independent best value decision prior to scheduling the transportation. The COR or OO will first consider required delivery date/time (which includes coordination of the couriers’ follow-on truck segment) when making a scheduling decision that provides the best value to the Government, price and other factors considered. The COR or OO will schedule the transportation (passenger and material) a minimum of five business days prior to execution and will provide finalized weight and requested container size no less than 48 hours prior to scheduled flight (unless mutually agreed to between the contractor and Government). Whenever possible, roundtrip missions will be scheduled. The contractor will reserve sufficient aircraft space to accommodate the quantity of material agreed upon during scheduling and will guarantee seat availability for couriers. Contractor caused changes to the schedule within 72 hours of execution will be considered in the performance metrics at paragraph 3.0. The contractor shall only invoice for completed missions.

1.7.4 Delays. The contractor shall notify the regional Defense Courier Stations and the on call OO immediately when any positioning or arrival times will vary by more than 1 hour from established times.

A list of contacts will be provided by the COR. A departure time that varies by more than 1 hour for a contractor-controllable reason shall be considered in the reliability metrics at paragraph 3.0.

1.7.5 Cancellations.

1.7.5.1 Route Cancellations. In the event of route cancellation, within 90 business days, the contractor must provide the Contracting Officer written notice that the route is being eliminated from scheduled service operations of the airline and must provide alternate routes.

1.7.5.2 Trip Cancellations. In the event an individual trip is cancelled after scheduling, rescheduling shall be as agreed to by the Government.

1.7.6 Ad Hoc Missions. The Government will coordinate with contractor when service to or from locations outside of normal established routes is required within 8 business days to establish contacts and pricing. Contractor refusal to support ad hoc missions may be considered in the reliability metrics at paragraph 3.0.

1.8 Definitions and applicable publications.

Reserved.

2.0 DELIVERABLES

Reserved.

3.0 SERVICE DELIVERY SUMMARY

Performance Objective PWS Paragraph Performance Threshold

Airworthy/inspected containers provided 1.4.1 100% of the time Visibility of cargo as required 1.6.1 100% of the time Scheduling Reliability 1.7.3 100% of the time Operational Reliability 1.7.4 95% of the time Rescheduling of cancelled trip 1.7.5.2 100% of the time Support Ad Hoc mission request 1.7.6 95% of the time Resolution of QAE complaints 5.4 95% of the time

4.0 GOVERNMENT FURNISHED EQUIPMENT (GFE) AND SERVICES

4.1 Seals and shrink wrap will be provided by the Government. In the event carrier unique pallet nets are required, they shall be contractor furnished.

5.0 GENERAL INFORMATION

5.1 Only DoD Approved Air carriers who are members of the Civil Reserve Air Fleet (CRAF) or DoD Approved Air carriers issued a Letter of Technical Ineligibility for CRAF Participation may receive a contract award.

5.2 Transportation of hazardous material will not be required.

5.3 Aircraft Operator Standard Security Program exempts Government material from opening or x-ray screening. Bomb dogs or drug dogs are permitted for screening.

5.4 Quality complaints shall be resolved within 30 business days from the end of the month in which the complaint is received.

5.5 Contractor will submit invoices for material net weight (not to include container weight) and passenger movement fees through the same billing system.

5.6 Information Assurance

5.6.1 Requirement for Contractor Information Assurance (IA) Report

The contractor shall provide an Information Assurance Report to describe its environment’s safeguarding of DoD non-public information resident on or transiting the contractor's unclassified information systems from unauthorized access and disclosure. Protection measures applied should consider the risks (i.e., consequences and their probability) of loss, misuse, unauthorized access, or modification of information. The report shall address the SANS (SysAdmin, Audit, Network, Security) Institute's Twenty Critical Security Controls for Effective Cyber Defense: Consensus Audit Guidelines (http://www.sans.org/critical-security-controls) and be provided in accordance with the attached template at Attachment 01 to the PWS. The contractor is encouraged to provide additional information above and beyond what is outlined in the SANS guidelines to enhance the government’s understanding of the contractor’s information security posture. The report will be updated 30 days prior to exercise of an option period, if applicable.

5.6.2 Cyber Security Incidents

5.6.2.1 Reporting Requirements

The contractor shall report to the following two Government organizations as soon as possible upon discovery of any suspected cyber intrusion events that affect DoD information resident on or transiting the contractor's unclassified information systems.

1. USTRANSCOM Global Command, Control, Communications and Computers (C4) Coordination Center (GCCC) E-mail: ustcJ6-gccc@ustranscom.mil Commercial Phone: 618-229-4222

2. USTRANSCOM Deployment and Distribution Operation Center (DDOC)

E-mail: ustc-ddocchief@ustranscom.mil Commercial Phone: 618-220-7700

Initial report shall be provided even if some details are not yet available, with follow-on detailed reporting within 72 hours. Reportable cyber intrusion events include the following:

1. A cyber intrusion event appearing to be an advanced persistent threat

2. A cyber intrusion event involving data exfiltration or manipulation or other loss of any DoD information resident on or transiting the contractor's, or its subcontractors', unclassified information systems

3. Intrusion activities that allow unauthorized access to an unclassified information system on which DoD information is resident or transiting

Definition of advanced persistent threat: An extremely proficient, patient, determined, and capable adversary, including two or more of such adversaries working together.

5.6.2.2 Incident Report Content

The incident report shall include, at a minimum, the following information:

1. Applicable dates (date of suspected compromise and date of discovery)

2. Threat methodology (all known resources used such as Internet Protocol (IP) addresses, domain names, copies malware, etc.)

3. An account of what actions the threat(s) may have taken on the victim system/network and what information may have been accessed

4. A description of the roles and functions of the threat-accessed system

5. An initial list of potentially impacted government programs and each program’s classification

6. What information may have been exfiltrated that may impact government programs

7. A list of all employees and subcontracted employees who work or have worked with the victim system/network

8. A point of contact to coordinate damage assessment activities

5.6.2.3 Incident Report Submission

The contractor will submit unclassified network cyber incident reports to the USTRANSCOM Technical Information Analysis Center (TIAC) and USTRANSCOM designated government personnel via encrypted email or another mutually agreed upon secure communications method. Copies of malware require special handling and pre-coordination must be accomplished prior to submission.

Attachment 01 to the PWS

Vendor Assessment Guidelines for Twenty Critical Security Controls for Effective

Cyber Defense: Consensus Audit Guidelines (CAG)

General. Organizations should compare all 20 control areas against their current status.

The 20 Critical Controls are:

1. Critical Control 1: Inventory of Authorized and Unauthorized Devices

2. Critical Control 2: Inventory of Authorized and Unauthorized Software

3. Critical Control 3: Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers

4. Critical Control 4: Continuous Vulnerability Assessment and Remediation

5. Critical Control 5: Malware Defenses

6. Critical Control 6: Application Software Security

7. Critical Control 7: Wireless Device Control

8. Critical Control 8: Data Recovery Capability

9. Critical Control 9: Security Skills Assessment and Appropriate Training to Fill Gaps

10. Critical Control 10: Secure Configurations for Network Devices such as Firewalls, Routers, and

Switches

11. Critical Control 11: Limitation and Control of Network Ports, Protocols, and Services

12. Critical Control 12: Controlled Use of Administrative Privileges

13. Critical Control 13: Boundary Defense

14. Critical Control 14: Maintenance, Monitoring, and Analysis of Audit Logs

15. Critical Control 15: Controlled Access Based on the Need to Know

16. Critical Control 16: Account Monitoring and Control

17. Critical Control 17: Data Loss Prevention

18. Critical Control 18: Incident Response and Management

19. Critical Control 19: Secure Network Engineering

20. Critical Control 20: Penetration Tests and Red Team Exercises

The entire text of the 20 Critical Security Controls is available for reference at:

http://www.sans.org/critical-security-controls/

Procedures:

1. Review each control.

2. Determine what procedures and tools exist within your organization to meet this control.

http://www.sans.org/cag/control/1.php http://www.sans.org/cag/control/2.php http://www.sans.org/cag/control/3.php http://www.sans.org/cag/control/3.php http://www.sans.org/cag/control/4.php http://www.sans.org/cag/control/5.php http://www.sans.org/cag/control/6.php http://www.sans.org/cag/control/7.php http://www.sans.org/cag/control/8.php http://www.sans.org/cag/control/9.php http://www.sans.org/cag/control/10.php http://www.sans.org/cag/control/10.php http://www.sans.org/cag/control/11.php http://www.sans.org/cag/control/12.php http://www.sans.org/cag/control/13.php http://www.sans.org/cag/control/14.php http://www.sans.org/cag/control/15.php http://www.sans.org/cag/control/16.php http://www.sans.org/cag/control/17.php http://www.sans.org/cag/control/18.php http://www.sans.org/cag/control/19.php http://www.sans.org/cag/control/20.php http://www.sans.org/critical-security-controls/

3. Document the result of 1-2 using the suggested template provided.

4. Provide any additional information about your company’s cyber security posture.

Company (Name): Information Assurance Report

Executive Summary: (descriptive self-assessment of the company’s overall information security posture)

A. Assessment of Twenty Critical Security Controls for Effective Cyber Defense: Consensus Audit Guidelines (CAG)

1. Control 1. Inventory of Authorized and Unauthorized Devices

a. Procedures and Tools supporting this control:

(List the procedures and tools used in your organization for this control)

b. Method to achieve control metric:

2. (Continue for remaining 19 controls).

If a particular control does not exist or is not used within your organization, please state this.

B. Assessment of Additional Security Measures for Effective Cyber Defense

1. Measure. (Title of additional measure/control)

a. Procedures and Tools supporting this measure/control:

(List the procedures and tools used in your organization)

b. Method to achieve measure/control metric:

2. (Continue for remaining measures/controls)

5.6 Information Assurance