Atch 1 - PMPATS_PWS_9Apr2025.pdf

PERFORMANCE WORK STATEMENT

FOR

PASSENGER AIR TRANSPORTATION SERVICES

AT NAVAL BASE VENTURA COUNTY (NBVC) POINT MUGU TO SAN NICOLAS

ISLAND (SNI)

AND NAVAL AIR WEAPONS STATION (NAWS) CHINA LAKE

9 April 2025

1.0 SCOPE. Except as otherwise stated in this contract, Contractor shall provide all personnel, equipment, tools, materials, supervision, and other items and services necessary to perform air transportation services for passenger movement between Point Mugu Naval Air Station (NAS), CA (International Civil Aviation Organization (ICAO) Code: KNTD) and Naval Outlying Landing Field (NOLF) San Nicolas Island (SNI), CA (ICAO Code: KNSI), and between Point Mugu, CA and Naval Air Weapons Station (NAWS) China Lake, CA (ICAO Code: KNID), five days a week (See PWS para. 1.9).1 Additional missions between these locations may be scheduled by mutual agreement during the week, weekends, and holidays (See para. 1.8.4 After-Hours Flights) as well as to other off-line locations within a 500 Nautical Miles (NM) radius of Point Mugu. (See PWS para. 1.8.5 Off-Line Missions).

1.1 AIRCRAFT.

Contractor shall provide air transportation services utilizing aircraft that are Instrument Flight Rules (IFR) equipped, multi-engine, and turbine powered to include the following capabilities:

1.1.1 Communicate using Very High Frequency (VHF) radios along with Beyond Line of Site communication Technology (voice) out to 500 nautical miles (KNSI does not have a manned tower, so Contractor must be able to maintain communications with KNTD throughout all flights).

1.1.2 Equipment enabling inflight weather updates such as Doppler RADAR.

1.1.3 Equipped with TSO-129A Global Positioning System or better enabling Area Navigation (RNAV)/Localizer Performance with Vertical Guidance (LPV) precision approaches. Periodic upgrades to Global Positioning system (GPS) and navigation systems to adapt to evolving airspace standards may be required during performance. KNSI currently has RNAV/LPV, which is the only available precision approach.

1.1.4 For KNID routes, utilized aircraft must be pressurized with a temperature-controlled cabin to account for the required flight altitude and summer heat.

1.1.5 Minimum Payload: For KNSI routes, utilized aircraft must have a minimum payload of 4,750 lbs. For KNID routes, utilized aircraft must have a minimum payload of 3,990 lbs.

1.2 ALTERNATE/SPARE/REPLACEMENT AIRCRAFT. Contractor shall identify alternate/spare aircraft to be utilized in reserve of primary aircraft on the Aircraft Information Sheet (AIS) attached to the resulting contract. No alternate/spare aircraft may be utilized for performance without agreement from the Contracting Officer (CO).

Replacement aircraft may be added to the AIS with approval from the CO, subject to compliance with other contract terms.

1.3 AIRCRAFT MAINTENANCE. Contractor shall perform all scheduled and unscheduled maintenance consistent with the air carrier’s approved Federal Aviation Authority (FAA) Continuous Airworthiness Maintenance Program (CAMP) authorization and manufacturer’s recommended servicing intervals and service bulletins. Contractor will provide all parts, tools, equipment, labor and expertise necessary to complete required maintenance tasks.

Maintenance scheduling and downtime shall be coordinated with the Contracting Officer’s Representative (COR) and include communication of established timetable for scheduled maintenance and an estimated completion time for unscheduled maintenance. NOTE: Aircraft X-Ray’s or heavy scheduled maintenance requiring a hangar will not be permitted at Point Mugu NAS, NOLF San Nicholas Island or NAWS China Lake.

1 Point Mugu NAS and NOLF San Nicolas Island are part of Naval Base Ventura County (NBVC).

1.3.1 Contractor shall submit a monthly scheduled maintenance plan to the COR no later than the 15th calendar day of the month prior. Scheduled maintenance plan shall indicate anticipated downtime and the effect on regularly scheduled operations, if any. For example, if depot-level maintenance is required, plan should detail duration and mitigation actions to ensure continued full performance.

1.3.2 Contractor shall submit a get-well plan for any unscheduled maintenance within six hours of the occurrence, including identification of issue(s), estimated timeline to correct and plans to mitigate or otherwise ensure continued operations should the maintenance be anticipated to exceed 24 hours

1.4 AIR CARRIER REQUIREMENTS

1.4.1 All aircraft utilized must be licensed, operated, and maintained in accordance with (IAW) all applicable rules, regulations, and standards of the FAA Federal Aviation Regulations, Department of Transportation (DoT), Department of Defense (DoD), and 14 CFR Part 135 Air Carrier and Operator Certification, as applicable, giving particular attention to the responsibility of the air carrier to perform air transportation with the highest degree of safety. The carrier shall have a current FAA Air Operator’s Certificate to operate over routes and into the airfields specified under Instrument Flight Rules and/or Visual Flight Rules (VFR) conditions.

1.4.2 DoD Commercial Airlift Review Board (CARB) Approval. IAW 10 U.S.C. § 2640, Charter Air Transportation of Members of the Armed Forces or Cargo; 32 Code of Federal Regulations (CFR) Part 861, DoD Commercial Air Transportation Quality and Safety Review Program; and DoD Instruction (DoDI) 4500.53, DoD Commercial Air Transportation Quality and Safety Review Program, the CARB will evaluate and approve air carriers to perform air transportation services for the DoD. The CARB has the final authority to determine an air carrier’s approval to perform the air transportation services sought by the DoD and will evaluate and approve an air carrier to perform the tasks identified under this requirement as part of the source selection process. Similarly to FAA Air Operator’s Certificate issuance, CARB’s determination of air carrier suitability is not subject to redetermination by other authorities (including the CO) except as identified in 32 CFR Part 861 (g)(4) Appeal of CARB decisions.

1.4.3 DOD ADDITIONAL STANDARDS

1.4.3.1 IAW 32 CFR Part 861, contractor operating the aircraft must be an approved DoD air carrier, as determined by the CARB and must maintain this approval throughout the performance of this contract. Contractor shall comply with all FAA, Department of Transportation and DoD requirements and additional standards, including those established by DoD Commercial Airlift Division (i.e., the Air Mobility Command (AMC)/A3B) as published on the following website: https://www.amc.af.mil/Home/AMC-Commercial-Services/ .

1.4.3.2 Pilot Training. Pilots must be trained and proficient with RNAV GPS Category LPV Decision Altitude (DA).

The only approach with low (200’-3/4) minimums will be the RNAV GPS Category LPV DA on KNSI.

1.5 CORPORATE LIAISON. Prior to the start of the contract, Contractor shall furnish the name, address, and telephone number of the agent who serves as liaison between Contractor and the COR. The agent must be on site during normal duty hours and have authority to dispatch aircraft, adjust schedules, provide substitute service, and make decisions pertinent to airlift service in the name of Contractor. The agent shall notify the Government within 15 minutes in the event of a delay or cancellation becomes known, including the reason for the delay or cancellation. The agent shall be available in-person during normally scheduled working hours Monday through Friday and via voice or electronic means after hours/weekends.

1.6 BASING LOCATION. Contractor may base operations at (NBVC), Point Mugu NAS, CA. If the Contractor chooses to not base aircraft at NBVC, the Contractor must use a base location that was proposed to and accepted by the Government during source selection and that provides dedicated service to the areas and within the parameters identified in this PWS throughout performance. Any subsequent change in basing location shall be coordinated and negotiated under clause FAR 52.212-4(c), Changes. Regardless of basing location, Contractor is required to have aircraft positioned for scheduled operations at NBVC (subject to an eight-hour return call window).

1.7 FIXED WING (FW) AIRCRAFT POSITIONING AND DE-POSITIONING. Contractor shall position personnel, equipment, and aircraft IAW the positioning plan proposed and approved for this contract. Aircraft and crew must be positioned and fully mission capable, as defined in PWS para. 4.3, on 1 October 2025. Positioning https://www.amc.af.mil/Home/AMC-Commercial-Services/ prior to 1 October 2025 is not authorized unless notified in writing by CO. Such costs will not be paid. Unless otherwise approved by the CO, de-positioning of personnel, equipment, and aircraft shall occur no later than 30 calendar days after the last day of performance under this contract or notification from the CO, whichever occurs first. The CO will notify Contractor to deposition only when the Government no longer has a need for services to continue through the performance periods of this contract.

1.8 SCHEDULE. Regarding actual flights, the Contractor shall position the aircraft for boarding 30 minutes prior to the scheduled aircraft departure time. Government will coordinate a rolling four-week flight schedule with contractor throughout performance.

1.8.1 PASSENGER SERVICES POINT MUGU – SAN NICOLAS ISLAND. The contractor shall transport passengers and baggage from NVBC Point Mugu to NOLF San Nicolas Island within the timeframes detailed below. If more than one aircraft is scheduled, departure times will be staggered at each location between 5–30-minute intervals, e.g., 0700, 0705, 0715, 0730. The planning weight for each passenger with baggage is 250 pounds collectively. The daily flight schedules are as follows and the contractor shall alternate each week between Schedule A and B throughout the year (starting with Schedule A for the first week of the contract):

*Due to SNI manning turnovers every week, the first workday and last workday of the week will require dedicated aircraft. (e.g., any two aircraft flying the below flight windows). Tuesday through Thursday can generally be done by one aircraft unless range operational tempo is increased.

Point Mugu NAS – NOLF San Nicolas Island

NOLF San Nicolas Island – Point Mugu

NAS

SNI Schedule A* Minimum Passengers (may be multiple flights)

Flight Window Minimum passengers (may be multiple flights)

Flight Window

Monday 95 0700‐1130 60 1300‐1700 Tuesday 60 0700‐1100 60 1300‐1700

Wednesday 60 0700‐1100 60 1300‐1700 Thursday 60 0700‐1100 60 1300‐1700

Friday 95 0700‐1100 95 1130-1600

Point Mugu NAS– NOLF San Nicolas

Island NOLF San Nicolas Island – Point Mugu

NAS

SNI Schedule B* Minimum Passengers (may be multiple flights)

Flight Window Minimum passengers (may be multiple flights)

Flight Window

Monday 95 0700‐1130 60 1300‐1700 Tuesday 60 0700‐1100 60 1300‐1700

Wednesday 60 0700‐1100 60 1300‐1700 Thursday 60 0700‐1130 95 1230‐1700

1.8.2 PASSENGER SERVICES POINT MUGU NAS – NAWS CHINA LAKE. The contractor shall transport passengers and baggage from Point Mugu NAS to NAWS China Lake within the timeframes detailed below. The planning weight for each passenger with baggage is 210 pounds collectively. Aircraft utilized for this route must be pressurized and temperature-controlled due to altitude and summer heat considerations. The daily flight schedules are as follows:

*During the summer months, additional flights may be needed if aircraft performance affects the “minimum passenger capability”. Despite triple digit heat affecting engine performance, passenger loads must remain as noted below.

Point Mugu NAS ‐ NAWS China Lake NAWS China Lake ‐ Point Mugu NAS Morning Minimum Passengers Flight Window Minimum passengers Flight Window

Monday 19 0700‐1000 19 0700‐1000

Tuesday 19 0700‐1000 19 0700‐1000 Wednesday 19 0700‐1000 19 0700‐1000 Thursday 19 0700‐1000 19 0700‐1000

Working Friday 19 0700‐1000 19 0070‐1000

Midday* Minimum Passengers Flight Window Minimum passengers Flight Window Tuesday 19 1200‐1430 19 1200‐1430

Wednesday 19 1200‐1430 19 1200‐1430 Thursday 19 1200‐1430 19 1200‐1430

Afternoon* Minimum Passengers Flight Window Minimum passengers Flight Window

Monday 19 1500‐1730 19 1500‐1700 Tuesday 19 1500‐1730 19 1500‐1730

Wednesday 19 1500‐1730 19 1500‐1730 Thursday 19 1500‐1730 19 1500‐1730

Working Friday 19 1400‐1630 19 1400‐1630

1.8.3 CHANGES TO REGULAR SCHEDULE. During periods of inclement weather or weather conditions that limit normal aircraft passenger loads as noted above, the regular scheduled flights may be supplemented and/or delayed, but the passenger airlift requirement must still be met as soon as practical. Flight schedules to NOLF SNI and NAWS China Lake are subject to change during federal holidays and the holiday seasons and will be adjusted to meet customer requirements within airfield hours of operations upon coordination with Contractor.

1.8.4 AFTER-HOURS FLIGHTS. In addition to the regular schedule, additional missions may be required to meet user requirements. Weekend, evening (after 1730), and/or holiday service may be required for flights between NOLF SNI and Point Mugu NAS and between NAWS China Lake and Point Mugu NAS. For example, a test operation may be scheduled for Friday with a weather or operational back-up date scheduled for the following Saturday and/or Sunday. If the test operation is not performed on Friday, Contractor may be required to fly on Saturday or Sunday, at the completion of the operation, to transport passengers as necessary. The estimated NM per year for passengers using a round/ trip Point Mugu NAS – NOLF SNI route, is 5,000. This will be mutually agreed upon with Contractor.

1.8.5 OFF-LINE MISSIONS. The government may request additional contractor-provided airlift service for mission requirements between Point Mugu NAS and other destinations within 500 NM (outside of NAWS China Lake and NOLF SNI) by mutual agreement.

1.9 DELIVERABLES SCHEDULE TABLE. All deliverables shall be submitted directly to the COR electronically in Microsoft Office format (e.g., Word, Excel, Power Point, Project). Deliverables shall be identified by contract number and deliverable title. All deliverables must meet professional standards and comply with the requirements set forth in this PWS.

PWS

PARA.

DELIVERABLE

TITLE

INITIAL DELIVERY

DUE DATE

GOVERNMENT

REVIEW TIME

FRAME

FINAL

DELIVERY

DUE DATE

1.6 Contractor Prior to contract start date N/A As needed with

Liaison Information or when the liaison information changes changes in liaison information

1.3.1 Scheduled

Maintenance Plan

Due monthly, no later than 15th calendar day of the month prior

NLT 3 business days after receipt of schedule

Ongoing, monthly review

1.3.2 Unscheduled

Maintenance Plan

Within 6 hours of the occurrence of unscheduled maintenance

Ongoing until maintenance event resolved

Within initial delivery date or immediately when plan is revised

4.5 Incident Report Within 24 hours of

accident or incident

Ongoing until after actions resolved, if any

Within 24 hours of accident or incident

4.7 Sortie Report Within one week from the

conclusion of the first month of performance, repeating each succeeding month

Ongoing, monthly review

Within one week from the conclusion of the first month of performance, repeating each succeeding month

6.4.3 Cybersecurity

Incident

Reporting

As soon as practical but no later than 72 hours after discovering a reportable cyber-incident

Ongoing until cyber-incident resolved

Follow-on cyber-incident report, if necessary, within 5 calendar days of becoming aware of a reportable cyber-incident

2.0 SERVICE DELIVERY SUMMARY. The SDS summarizes desired outcomes and identifies the performance thresholds/metrics that will be tracked to determine whether the desired outcomes are being achieved. The SDS does not identify every Contractor requirement, but only those requirements considered most important for mission accomplishment. Although not all PWS requirements are listed in the SDS, the Contractor is fully expected to comply with all requirements in the PWS and elsewhere in the contract (e.g., contract clauses).

Desired

Outcome

PWS

Para

PERFORMANCE

THRESHOLD

(Metric)

Source of Data

How Often

Collected

CALCULATION

Operational Reliability

1.6 No more than two

reported instances of untimely notification of schedule delay

Flight Logs

Monthly # of reported incidents more than two in a twelve-month period.

Operational Reliability

1.9 Maintain 90% on-time

flight schedule measured monthly for contractor

Flight Logs Monthly Successful instances of performance

(x) will be divided by the total number of required instances of related delays. performance (y) to equal the percentage of successful performance instances (z): x/y = z.

Operational Readiness Rate

4.3.1 Maintain 95% of

regularly scheduled transports.

Flight Logs Monthly Successful instances of performance

(x) will be divided by the total number of required instances of performance (y) to equal the percentage of successful performance instances (z): x/y = z.

Operational Readiness

1.9.4, 1.9.5

No more than one missed after-hours or off-line mission after mutual agreement.

Flight Logs As required

# of missed events per twelvemonth period

Cyber- Incident Reporting

6.4.3 No more than one late

cyber-incident report or unreported cyber-incident in a twelvemonth period

Submitted / Discovered

Cyber- Incident Report

As required

# of late reports or unreported cyber-incidents per twelvemonth period

3.0 GOVERNMENT FURNISHED EQUIPMENT, FACILITIES AND SERVICES.

3.1 GOVERNMENT FURNISHED EQUIPMENT. The government will provide aircraft parking at NBVC Point Mugu NAS, CA as well as office space for operational/paperwork requirements and a lockable, secure area for dry storage of spare aircraft parts. The Naval base’s air terminal personnel (military or civil servants), IAW Office of the Chief of Naval Operations (OPNAV) 4660.3B, manifest passengers and load baggage. Manifests containing passenger information are controlled unclassified information regarding appropriate safeguard IAW DFARS 252.204-7012. Fueling at Point Mugu NAS and NAWS China Lake will be by government contracted fueling services; however, the actual line services (attaching of fueling hose to the aircraft) must be performed by Contractor. Fueling at NOLF SNI is on an urgent need-only basis as the fuel supplies are extremely limited. The government will not supply tow tractors, tow bars, aircraft starting units or any other types of common or aircraft specific Ground Support Equipment at any facility. Servicing of lavatory facilities will not be accommodated by the government at any facility.

3.2 REIMBURSABLE SERVICES AND COSTS. The Government will provide Defense Logistics Agency (DLA)-sourced fuel at the main operating location of NBVC, Point Mugu NAS. Contractor may purchase fuel at off-station sites as mission requirements dictate; however, DLA is preferred source of fuel. Fuel costs that exceed DLA prices, when DLA-sourced fuel is reasonably available, will only be reimbursed at the DLA-source rate. Fuel purchased for contract flights will be on a cost-reimbursable expense. Fuel for noncontract flights should be purchased by Contractor and will not be reimbursed by the government. The contractor must ensure it keeps accurate logs to segregate fuel used costs for contract flights from noncontract flights. Contractor flights not directed by the Government are non-billable, e.g., flights to an offsite maintenance location.

4.0 GENERAL INFORMATION.

4.1 CONTRACTOR PERSONNEL. All contractor personnel shall comply with all pertinent military regulations and/or directives when in military base flight patterns, and on military installations. NASNI will provide specific airspace training instructions prior to the first flight. Contractor personnel will be required to attend special briefings as needed to affect smooth Government/contractor operations. Compliance with regulations include, but are not limited to, presenting valid identification for installation entrance, obtaining vehicle use passes for all contractor-owned and/or privately-owned vehicles, obeying all posted directives, providing strict adherence to security police direction in instances where security police have been dispatched to a particular location.

4.2 HEALTH AND SAFETY ON GOVERNMENT INSTALLATIONS. In performing work under this contract on a Government installation, the contractor shall:

4.2.1 Take all reasonable steps and precautions to prevent accidents and preserve the health and safety of contractor and Government personnel performing or in any way coming in contact with the performance of this contract; and

4.2.2 Take such additional immediate precautions, as the contracting officer may reasonably require, for health and safety purposes.

4.2.3 The contracting officer may, by written order, direct health/safety standards as may be required in the performance of this contract and any adjustments resulting from such direction will be in IAW with the Changes clause of this contract.

4.2.4 Any violation of these health and safety rules and requirements, unless promptly corrected as directed by the contracting officer, shall be grounds for termination of this contract IAW the Default clause of this contract.

4.3 OPERATIONAL READINESS.

4.3.1 Operational Readiness. Contractor shall ensure each aircraft maintains an Operational Readiness (OR) rate of 95% or better, which equates to two or less non mission capable (NMC) days per month (including February).

The OR rate is calculated by dividing the number of fully mission capable (FMC) days for each particular aircraft by the number of days in the month. A month begins on the 1st day of the month and ends on the last day of that month, unless there is a partial month of service (i.e., contract period of performance starts on 16 Sep or ends on 15 July). For partial months of services, the OR will be calculated using the day the period of performance starts through the last day of the month or using the first day of the month through the last day of the period of performance.

4.3.2 NMC is defined as any day the aircraft cannot fly due to carrier-controlled reasons (e.g., maintenance, operations, crew availability). The aircraft will be considered FMC if it is available for flight as scheduled by the Tasking Authority. An aircraft is not to be considered available unless both the aircraft and the aircrew is available for air transportation as defined by the FAA or comparable regulations. In addition, the aircrew must be co-located (same hub) with the aircraft and be in stand-by status for the aircraft to be considered FMC. If an aircraft is reported as FMC and launches on a tasked sortie but returns to base for carrier-controlled reasons without completing a mission leg, and without completing any legs for that day, then the aircraft will be considered NMC for that entire day. Any day an aircraft is NMC for carrier-controlled reasons, it will be factored into the carrier’s OR rate and could impact the monthly Billable Amount. If there are extenuating circumstances, the NMC days can be waived on a case-by-case basis by the USTC-CO after coordination with the COR.

4.4 BILLING.

4.4.1 Invoices will be submitted monthly and consistent with clause DFARS 252.232-7006 through Procurement Integrated Enterprise Environment (PIEE) Wide Area WorkFlow (WAWF) e-Business Suite.

4.4.2 Contractor shall bill for actual hours flown. Estimated Point Mugu NAS - NOLF SNI round trip is 128 nm and equal to an average transit time of 20-25 minutes. The estimated Point Mugu NAS - NAWS China Lake round trip is 270 nm and equal to an average transit time of 40-50 minutes.

4.4.3 Fixed Wing Flight Hour Calculations. Contractors will only be paid for flight hours flown in support of missions as assigned by the Tasking Authority. Flight hours are calculated from the moment the aircraft moves under its own power (block out) and ends when the aircraft engines are shut down after landing (block in). In no event shall the flight hour calculation include time when the aircraft’s engine(s) are shutdown, or the aircraft is not being flown in support of missions directed by the Tasking Authority. Contractor flights not directed by the Government are non-billable, e.g., flights to an offsite maintenance location.

4.4.4 Flight hours shall be reported and billed in hours and tenths of hours. When entering hours or tenths of hours on forms and reports, a zero is entered on either side of the decimal (i.e., 2.0 when entering two full hours of flight time or 0.7 when entering 38 minutes of flight time). Fractions of flight hours shall be determined using the following table.

Minutes Parts of hour 0 0.0 1-6 0.1 7-12 0.2 13-18 0.3 19-24 0.4 25-30 0.5 31-36 0.6 37-42 0.7 43-48 0.8 49-54 0.9 55-60 1.0

4.4.5 Monthly Billable Service. The monthly basing service rate billed by the Contractor is based upon the mission status of each aircraft; FMC or NMC. Billable days for each aircraft will be calculated using formulas in the table below:

2 or less days NMC Billable Amount = Full Monthly Service Rate

3-5 days NMC Billable Amount = Full Monthly Service Rate (Anything below 95% standard may impact

CPARS)

6-10 days NMC Billable Amount = 80% of Full Monthly Service

Rate

11-15 days NMC Billable Amount = 50% of Full Monthly Service

Rate

16 or more days NMC Billable Amount = 20% of Full Monthly Service

Rate

4.5 ACCIDENT OR INCIDENT REPORTING. When a Contractor’s aircraft is involved in any accident, DoD or otherwise, the Contractor shall transmit the information in paragraph above to Headquarters Air Mobility Command (AMC), via HQ AMC/A3B, Scott AFB IL (618) 229-4801/DSN 779-4801 or the HQ AMC/A3B Safety Manager at 618-2292106/DSN 779-2106. Accident and incident information shall be provided to HQ AMC (amc.a3b.flightmishapreport@us.af.mil), CO, and the COR on the next business day by the most expeditious means available. Accidents and incidents are defined in 49 CFR, Part 830. Reporting shall include the following information:

4.5.1. Contractor and trip number

4.5.2. Aircraft type and number

4.5.3. Date and time of the accident or incident

4.5.4. Last point of departure and point of intended landing of the aircraft, as applicable

4.5.5. Nature of the accident or incident and extent of known damage to the aircraft, if any

4.5.6. Total number of crewmembers and passengers on board

4.5.7. Number of injured and fatalities aboard the aircraft

4.5.8. Condition of baggage or Government-owned material, if any, on board

4.6 RECOVERY. The Contractor is responsible for recovering disabled, damaged, or destroyed aircraft. The Government may, at its discretion, assist if resources and time are available. Contractor shall delay recovery to the mailto:amc.a3b.flightmishapreport@us.af.mil extent necessary to support crash investigations directed by the DoD. Any recoverable cargo will be returned to the Government.

4.7 INSURANCE Contractor must maintain insurance liability coverage IAW FAR 28.307-2 and any other applicable Federal or State law. Minimum coverage includes:

4.7.1 Employer’s liability (standalone coverage only): $100,000, except were prohibited by State law

4.7.2 Aircraft public and passenger liability: $200,000 per person and $500,000 per occurrence for bodily injury, other than passenger liability, and $200,000 per occurrence for property damage. Coverage for passenger liability bodily injury shall be at least $200,000 multiplied by the number of seats or passengers, whichever is greater.

4.8 MONTHLY SORTIE REPORTING. Contractor shall maintain a monthly sortie report and transmit it via email to the USTC-CO and COR on the first week of the month following the end of the prior month. Sortie report will be in a Microsoft Excel format, filterable by date, filtered by column and include, at a minimum:

4.7.1 a row entry for each calendar day (separated by aircraft and legs flown)

4.7.2 aircraft tail number

4.7.3 aircraft status (FMC/NMC)

4.7.4 starting (departure) location

4.7.5 ending (arrival) location

4.7.6 passengers carried (onloaded, offloaded and continued through)

4.7.7 cargo carried (in pounds)

4.7.8 flight hours flown (rounded to tenths of an hour)

4.7.9 delays (with reason code, e.g., maintenance, weather, government directed, etc.)

4.7.10 cancellations (with reason code, e.g., maintenance, weather, government directed, etc.)

4.7.11 fuel added (in gallons)

4.7.12 a comment block, primarily used to annotate reasons for delays and cancellations

4.7.13 cumulative totals of sorties flown, flight hours flown, passenger carried, cargo carried, delays, and cancellations

4.7.14 Operational Readiness Rate, as calculated under the formula defined in para. 2.0

4.7.15 NOTE: calendar days in which there are no scheduled flights may be excluded (e.g. weekends)

5.0 SECURITY

5.1 OPERATIONS SECURITY (OPSEC). OPSEC must be included in contracts to ensure that critical information is protected. Disclosing this information to the adversary could potentially affect mission success and cause harm to military members, civilians, and contractors and their families. OPSEC is a process used to protect unclassified sensitive information from exploitation by an adversary. Sensitive unclassified information—which is also referred to as critical information or critical program information (CPI)—is defined as information that is not classified but which needs to be protected from unauthorized disclosure. Examples are information labeled CUI, such as proprietary information, contractor sensitive information, limited distribution information, or PII.

5.1.1 This contract includes “controlled defense information” as defined in DFARS 252.204-7012, which must be safeguarded accordingly. This includes:

5.1.1.1 passenger manifests;

5.1.1.2 all other CUI described in the CUI Registry at http://www.archives.gov/cui/registry/category-list.html, that requires safeguarding or dissemination controls

5.2 OPERATIONS SECURITY REQUIREMENTS. The prime contractor and all subcontractors shall provide protection for sensitive unclassified information to limit unauthorized disclosures of critical information. The prime contractor and all subcontractors shall employ the countermeasures listed below to protect that information.

These OPSEC requirements will be in effect throughout the life of the procurement from award through the conclusion of services at the end of the period of performance or other procurement termination. In any case where uncertainty or ambiguity regarding OPSEC measures exists, the contractor shall consult the requirements or contracting office’s OPSEC coordinator as soon as possible.

5.3 COUNTERMEASURES TO UNAUTHORIZED DISCLOSURE OF CRITICAL INFORMATION.

Countermeasures are required to negate the susceptibility of critical information to exploitation by an adversary or competitor. The contractor shall protect all critical information listed in a manner appropriate to the nature of the information, including use of the necessary countermeasures as listed below applicable to specific items:

5.3.1 Refrain from including critical information in contract and budget documents, presentations, press releases, and other publications to that which is essential to the performance of this requirement.

5.3.2 Encryption or password protection of electronically stored critical information.

5.3.3 Encryption or password protection of e-mail containing critical information.

5.3.4 Storage of hard copy critical information and storage media in locked containers when not in use.

5.3.5 Transmission of critical information to the minimum set of recipients with a need to know.

5.3.6 Immediate and appropriate destruction in a manner precluding reconstruction of all critical information no longer needed under this contract.

5.3.7 Restricting verbal discussion of critical information to venues and circumstances that prevent the monitoring and interception of the discussion by unauthorized personnel.

5.3.8 Refraining from the use of unencrypted telephones to transmit critical information.

5.3.9 Refraining from the use of foreign postal systems to ship critical information.

5.3.10 Promptly retrieving documents containing critical information printed on printers accessible by persons without a need to know the critical information.

5.3.11 Use of cover pages or other appropriate means to prevent the viewing of critical information by unauthorized persons.

5.3.12 The contractor shall notify the COR and USTRANSCOM security office immediately of all known and suspected compromises of critical information. If the COR cannot be reached, the contractor shall notify the supported command duty officer if after normal work hours.

5.4 CYBERSECURITY

5.4.1 OPERATIONALLY CRITICAL SUPPORT. The services designated under this contract are not “operationally critical support” as defined in DFARS 252.204-7012.

5.4.2 CYBERSECURITY INCIDENT REPORTING

5.4.2.1 In addition to the DFARS 252.204-7012 reporting requirements for unclassified systems and 32 Code of Federal

Regulations (CFR) Part 117, National Industrial Security Program Operating Manual (NISPOM) for classified systems, reportable cyber-incidents (regardless of whether the information system (IS) contains covered defense information (CDI) or there is an impact to performance such as delivery schedule delay) include, but are not limited to, the following::

5.4.2.1.1 Cyber-incidents as defined in Table 1.

5.4.2.1.2 Notifications by a federal, state, or local law enforcement agency or cyber-center (e.g., National Cyber

Investigative Joint Task Force (NCIJTF), National Security & Communications Integration Center (NCCIC), Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Department of Defense Cyber Crime Center (DC3)) of being a victim of a successful or unsuccessful cyber-event, anomaly, incident, insider threat, breach, intrusion, or exfiltration.

Table 1.

Incident Category Description Root Level Intrusion Unauthorized privileged access to an IS. Privileged access, often referred to as administrative or root access, provides unrestricted access to the IS.

This category includes unauthorized access to information or unauthorized access to account credentials that could be used to perform administrative functions (e.g., domain administrator). If the IS is compromised with malicious code that provides remote interactive control, it will be reported in this category.

User Level Intrusion Unauthorized non-privileged access to an IS. Non-privileged access, often referred to as user level access, provides restricted access to the IS based on the privileges granted to the user. This includes unauthorized access to information or unauthorized access to account credentials that could be used to perform user functions such as accessing Web applications, Web portals, or other similar information resources. If the IS is compromised with malicious code that provides remote interactive control, it will be reported in this category.

Denial of Service Denial of Service (Incident)—Activity that denies, degrades, or disrupts normal functionality of an IS or DoD information network.

Malicious Logic Installation of software designed and/or deployed by adversaries with malicious intentions for the purpose of gaining access to resources or information without the consent or knowledge of the user. This only includes malicious code that does not provide remote interactive control of the compromised IS. Malicious code that has allowed interactive access should be categorized as Root or User Level Intrusion incidents.

Interactive active access may include automated tools that establish an open channel of communications to and/or from an IS.

Ransomware Malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable. Malicious actors then demand ransom in exchange for decryption. Ransomware actors often target and threaten to sell or leak exfiltrated data or authentication information if the ransom is not paid. Ransomware is a reportable incident that may be associated with multiple incident categories depending on the attack vector and execution.

5.4.2.2 If the cyber-incident affects a classified system, vulnerabilities associated with the incident will be classified per the current version of USTRANSCOM Instruction 31-02, Security Classification Guide (copies available on request).

5.4.3 CYBERSECURITY INCIDENT REPORTING TIMELINES. In addition to providing the notification required by DFARS 252.204-7012, the contractor is required to notify USTRANSCOM as soon as practical, but no later than 72 hours after discovering a reportable cyber-incident. The reporting timeline begins when the incident is discovered or reported to the company, its employees, contractors, or cybersecurity firm responsible for providing cybersecurity and response for the company. The contractor shall contact the USTRANSCOM Cyber Operations Center (CyOC) via phone at 618-817-4222. If the contractor does not immediately reach the CyOC via phone, the contractor shall send an email notification to transcom.scott.tcj6.mbx.cyoc-dodin-operations@mail.mil.

5.4.4 MANDATORY REPORTING DATA

5.4.4.1 The contractor shall work with the USTRANSCOM CyOC through resolution of the incident. Within 72 hours of becoming aware of a reportable cyber-incident, the contractor shall provide an initial notification of the incident, even if some details are not yet available, which includes, but is not limited to, the following information:

mailto:transcom.scott.tcj6.mbx.cyoc-dodin-operations@mail.mil mailto:transcom.scott.tcj6.mbx.cyoc-dodin-operations@mail.mil

5.4.4.1.1 Company Name

5.4.4.1.2 Who will be the POC with contact information

5.4.4.1.3 Contracting Officer POC (name, telephone, email)

5.4.4.1.4 Overall Assessment –Description of incident, data at risk, mitigations applied

5.4.4.1.5 Indicators of compromise

5.4.4.1.6 Vector of attack (if known)

5.4.4.1.7 Estimated time of attack (if known)

5.4.4.2 The contractor shall provide a follow-on cyber-incident report to the USTRANSCOM CyOC within 5 calendar days of becoming aware of a reportable cyber-incident, which includes, but is not limited to, the following information:

5.4.4.2.1 Contractor unique Commercial and Government Entity (CAGE) code

5.4.4.2.2 Contract numbers affected

5.4.4.2.3 Facility CAGE code where the incident occurred if different than the prime Contractor location

5.4.4.2.4 POC if different than the POC recorded in the System for Award Management (name, address, position, telephone, email)

5.4.4.2.5 Contracting Officer POC (name, telephone, email)

5.4.4.2.6 Contract clearance level

5.4.4.2.7 DoD programs, platforms, systems, or information involved

5.4.4.2.8 Location(s) of compromise

5.4.4.2.9 Date incident discovered

5.4.4.2.10 Type of compromise (e.g., unauthorized access, inadvertent release, other)

5.4.4.2.11 Description of technical information compromised

5.4.4.2.12 Any additional information relevant to the information compromise

5.4.5 INCIDENT REPORTING COORDINATION

5.4.5.1 In the event of a cyber-incident, USTRANSCOM may conduct an on-site review of network or information systems where DoD information is resident on or transiting to assist the contractor in evaluating the extent of the incident and to share information in an effort to minimize the impact to both parties. Date and time of on-site visits will be mutually agreed upon by USTRANSCOM and the contractor in advance.

5.4.5.2 The contractor agrees to allow follow-on actions by the Government (e.g., USTRANSCOM, FBI, CISA, DC3) to further characterize and evaluate the suspect activity. The contractor acknowledges that damage assessments might be necessary to ascertain an incident methodology and identify systems compromised as a result of the incident. Once an incident is identified, the contractor agrees to take all reasonable and appropriate steps to preserve any and all evidence, information, data, logs, electronic files and similar type information (reference NIST Special Publication (SP) 800-61, Computer Security Incident Handling Guide, (current version)) related to the incident for subsequent forensic analysis so that an accurate and complete damage assessment can be accomplished by the Government.

5.4.5.3 The contractor is not required to maintain an organic forensic capability, but must ensure data is preserved (e.g., remove an affected system, while still powered on, from the network) and all actions documented until forensic analysis can be performed by the Government or, if the Government is unable to conduct the forensic analysis, a mutually agreed upon third party (e.g., Federally Funded Research and Development Center (FFRDC), commercial security contractor). Any follow-on actions shall be coordinated with the contractor via the Contracting Officer.

5.4.5.4 The contractor agrees to indemnify and hold the government harmless for following any recommendations to remedy or mitigate the cyber-incident following the actions under 5.4.5.1 and 5.4.5.2.

5.4.6 CONFIDENTIALITY AND NON-ATTRIBUTION STATEMENT. The Government may use and disclose reported information as authorized by law and will only provide attribution information on a need-to-know basis to authorized persons for cybersecurity and related purposes (e.g., in support of forensic analysis, incident response, compromise or damage assessments, law enforcement, counterintelligence, threat reporting, and trend analysis). The Government may share threat information with other USTRANSCOM industry partners without attributing or identifying the affected contractor.

1.9 DELIVERABLES SCHEDULE TABLE. All deliverables shall be submitted directly to the COR electronically in Microsoft Office format (e.g., Word, Excel, Power Point, Project). Deliverables shall be identified by contract number and deliverable title