Atch 1 - PMRATS PWS_16 April 2026.pdf

HTC71126RE137

Attachment 1

PERFORMANCE WORK STATEMENT (PWS)

FOR

POINT MUGU RANGE AIR TRANSPORTATION SERVICES (PMRATS)

HTC71126RE137

16 April 2026

1. Description of Services.

1.1. Background. The Naval Base Ventura County, Point Mugu, California (CA) operates and maintains station facilities and provides logistics services. Naval Air Warfare Center, Weapons Division (NAWCWD) at Point Mugu, CA and the Point Mugu Sea Range (PMSR) have defined the mission and requirements for this contract. Naval Test Wing Pacific (NTWP) and Air Test and Evaluation Squadron 30 have been assigned to monitor and schedule activities in support of NAWCWD and PMSR. In support of this mission, commercial services are required to support air transportation of passengers, personal baggage, and/or cargo in and around Point Mugu as well as drone recovery operations, and range test support, to include radar surveillance and clearance (RS&C), on the PMSR as described below.

1.2. Scope. Except as otherwise stated, the contractor shall provide all personnel, facilities, equipment, supplies, materials, and services necessary for air transportation of passengers with personal baggage and/or cargo, drone recovery services, range test support, and RS&C operated in the local area, within 1 hour flight time, of NAWCWD, Point Mugu, CA. Fixed-wing transportation is required in and around the Southern CA area within a 200 nautical mile radius of Point Mugu, CA. Rotary-wing transportation is required between Ventura County airports (Naval Base Ventura County, Point Mugu, CA and Oxnard Airport, Oxnard, CA), San Nicolas Island, CA, and Santa Cruz Island, CA, within a 1.5 flight hour duration of Point Mugu. Drone recovery operations will be performed on the NAWCWD Point Mugu Sea Test Range and other ranges as required. Range test support may include surveillance and clearance of marine vessels on the Sea Test Range, marine mammal monitoring, and the carriage of electronic test equipment and tracking devices as required.

1.3. Specific Tasks.

1.3.1. Aircraft.

1.3.1.1. Fixed Wing. Fixed-wing aircraft providing range test support are required as follows:

1.3.1.1.1. At least one fixed-wing aircraft with a minimum payload (passengers and cargo) capability of 800 lbs. and flight range of 200 nautical miles and the capability of carrying up to four passengers, cargo, or any combination up to the capacity (weight and volume limitations) of the aircraft are required.

1.3.1.1.2. At least one fixed-wing aircraft with a minimum payload (passengers and cargo) capability of 1600 lbs. and flight range of 200 nautical miles and the capability of carrying up to eight passengers, cargo, or any combination up to the capacity (weight and volume limitations) of the aircraft are required.

1.3.1.1.3. The Contractor shall provide fixed-wing aircraft with a separate cargo area suitable for large, bulky cargo, as well as a System for Naval Targets Control (SNTC) Relay REF;

NAVAIR16-30SNTC600RL-1.

1.3.1.1.4. The aircraft shall be equipped to operate Ultra High Frequency (UHF) radios capable of transmitting and receiving on Navy frequencies.

1.3.1.1.5. Radar Range Surveillance. The Contractor shall provide a single aircraft to support NTWP and PMSR operational requirements, specifically for air operations in accordance with (IAW) priorities established by the Government. The Contractor shall provide a fixed wing aircraft, radar, and radar operators capable of meeting the requirements of Table 1 and shall be certified by PMSR for range clearance. For aircraft and radar systems not currently certified, the contractor and PMSR will work together to determine the flight profiles required to demonstrate the Radar System Capabilities of Table 1 for certification. For Radar Range Surveillance missions, aircrew will support Pre-Flight and Post-Flight briefings. Telephone support may be acceptable for aircrew experienced in supporting at PMSR, but in-person briefs will occasionally be required.

Table 1: Radar Range Surveillance Requirements

Attribute Threshold Objective Aircraft Capabilities

Ceiling/Visibility Minimums for Operation 200ft / 0.5mi N/A

Radar System Capabilities Positional Accuracy of Track at Probability of Detection (Pdet) Range

0.5 NM N/A

Pdet on the first pass 90% N/A Sea State 3 N/A Target Size 3 m2 N/A PD Range 20 NM 25 NM Surveillance Rate 3,600 NM2/hr > 5,200 NM2/hr

Other Aircraft System Capabilities

Persistence 4 hours continuous flight time when surveillance area is 40 nm from Point Mugu

8 hours total flight time with refueling when surveillance area is > 40 nm from Point

Mugu or when tasked with multiple sorties in a single day

Satellite Communications

(SATCOM)

No Yes

Attribute Threshold Objective Vessel Classification Yes N/A Maritime VHF Radio Yes N/A Very High Frequency (VHF) radios Yes N/A

UHF radios Yes N/A

1. UHF and VHF backup (can be single dual band radios)

Yes N/A

High Frequency (HF) radio No Yes

Automatic Identification System (AIS)

Yes. AIS tracks should be able to be correlated to the radar tracks real-time onboard N/A

1.3.1.2. Rotary-Wing. Rotary-wing aircraft shall be capable and equipped to support operations during non-daylight hours and have the capability of landing on pitching and rolling decks of ships at sea. Contractor operations to shipboard landings shall comply with all requirements of OPNAV Instruction 3100.8C. Rotary-wing aircraft shall have the capability to be equipped with UHF radios capable of transmitting and receiving Navy frequencies. The UHF radio will be contractor-provided. Rotary-wing aircraft providing test range support are required as follows:

1.3.1.2.1. At least one rotary-wing aircraft with a minimum payload capability of 1000 lbs. and flight duration at least 1.5 hours and the capability of carrying up to five passengers, cargo, or any combination up to the capacity of the aircraft are required.

1.3.1.2.2. At least one rotary-wing aircraft with a minimum payload capability of 2500 lbs. and flight duration at least 2.0 hours and the capability of carrying up to nine passengers, cargo, or any combination up to the capacity of the aircraft are required.

1.3.1.2.3. Rotary-wing aircraft is required for locating, recovering, and transporting 500 lb. and 2500 lb. drones from open sea environments. The aircraft crew shall be capable of drone recovery and lifting, utilizing required equipment operating approximately three feet above the water, in accordance with Federal Aviation Regulation (FAR) Part 133 (codified at 14 Code of Federal Regulations (CFR) Part 133)1, and transporting recovered drones to Naval Air Station (NAS) Point Mugu, CA. Drone recovery missions are estimated to take 1 to 1.5 hours for target location and hook-up. An additional 20-30 minutes is the average time for return transport of the drones to NAS Point Mugu, CA. Total drone recovery operations must be completed within two hours of target splash time. Some missions will require all drone recovery crew to have a SECRET clearance. Missions requiring all drone recovery crew to have a SECRET clearance are estimated to be approximately one per quarter; however, this may fluctuate based on mission needs. These missions will be identified by the Contracting Officer’s Representative (COR)

1 The Federal Aviation Regulation is codified at the Code of Federal Regulations, Title 14. The PWS will use citations interchangeably between for example FAR Part 133 and/or 14 CFR Part 135. Where a specific section is required, it will be cited. To the extent that the Federal Acquisition Regulation (FAR) or Defense FAR Supplement (DFARS) is cited, it will typically be to a clause and not a “Part”.

during scheduling. Storage of classified materials at a contractor facility is not required.

1.3.2. Commercial Airlift Review Board (CARB).

1.3.2.1. Department of War (DoW) Approval and Additional Standards. Any carrier operating aircraft to transport DoW personnel and cargo must be an approved DoW air carrier, as determined by the DoW CARB pursuant to 32 CFR Part 861, and must maintain this approval throughout the performance of this contract. The contractor shall comply with all Federal Aviation Administration (FAA) requirements or equivalent CAA requirements, and with all DoD additional standards including those established by DoD Commercial Airlift Division (i.e., the Air Mobility Command (AMC)/A3B) as published on the following website:

https://www.amc.af.mil/Home/AMC-Commercial-Services/.

1.3.2.2. CARB approval is not required for Radar Range Surveillance so long as there are no government equipment, cargo, or personnel onboard. If government intends to carry equipment, cargo, or personnel onboard during Radar Range Surveillance flights, then sufficient notice will be provided for the flight operator to obtain CARB approval, if such approval has not already been obtained.

1.3.3. Scheduling.

1.3.3.1. Prior to the start of the contract, the contractor shall furnish to the Contracting Officer (CO) and the COR the contract liaison, e.g., agent or point of contact (POC) including name, address, telephone number and e-mail address who shall serve as a liaison between the contractor and the COR. This person must have authority to adjust schedules, engage substitute airlift, and make decisions pertinent to the airlift for the contractor. The Contractor shall provide updated POC information to the CO and COR within 24 hours of change in POC information to include providing alternate POC when primary POC will be unavailable due to planned or unplanned leave. In addition, the contractor will provide a telephone number that shall be manned from 0700 to 1700 on all workdays.

1.3.3.2. Supporting operations is unique in nature, with each requirement having its own need and support. Radar Range Surveillance and Clearance are typically more consistent with service historically two to three times per week; however, Fixed-Wing Aircraft performing a radar range surveillance mission cannot be used simultaneously for other mission sets. Other fixed wing and rotary wing support can be scheduled with aircraft that are not dedicated to this contract.

Simultaneous scheduling of multiple rotary wing aircraft is not expected. Simultaneous scheduling of fixed wing aircraft (excluding Fixed-Wing Radar Range Surveillance mission) is not expected.

1.3.3.3. Expected timeline for scheduling will be as follows:

1.3.3.3.1. Preliminary long-term schedule - Two weeks out.

1.3.3.3.2. Weekly schedule will be published prior to the start of the new week.

1.3.3.3.3. Late add-ons will be allowed when the aircraft and crew are available up to 24 hours prior to an event.

https://www.amc.af.mil/Home/AMC-Commercial-Services/

1.3.3.4. Normal duty hours are from 0600 to 1800 local time, Monday through Friday.

Occasional (historically less than once per month) flights may be required during the nighttime hours, holidays, and weekends.

1.3.3.5. The contractor’s aircraft shall be in position, unless unavoidably delayed by inclement weather or air traffic control delays, to depart on time. The contractor shall give timely notification to the Government’s flight scheduler of all delays in excess of 30 minutes of accomplishing the scheduled flight, including cancellations.

1.3.3.6. When directed by the Government, the contractor may be required to periodically stand by for flights performed under the air transportation requirements set forth in this PWS. The first hour of standby time, for each standby period, will be at no cost to the Government. Standby time shall commence one hour after the scheduled departure time or one hour after the aircraft is in place ready for loading, whichever is later. Standby time shall commence one hour after the aircraft is offloaded at the destination and shall end when the authorized government representative releases the aircraft for departure, makes the determination that the aircraft will remain overnight, or the COR cancels the flight. Standby time will not be chargeable to the Government for contractor-controlled delays or for those caused by Acts of God or weather conditions below minimums, which preclude takeoff or flight to the destination. For payment purposes, standby time will be computed to the nearest one-tenth hour increment.

1.3.3.7. If the requirement changes after the confirmed schedule is provided to the contractor, the flight scheduler may cancel or reschedule flights. A notice of cancellation may be given to the contractor at any time prior to departure. The contractor shall be reimbursed for one hour of flight time if a flight is cancelled after departure from base of operation. All efforts will be made by the government’s flight scheduler to provide the contractor with ample notice of changes or cancellations in the flight schedule. No changes in the prescribed flight schedule will be made without the authorization of the government’s flight scheduler. Any verbal changes made after hours by the flight scheduler will be confirmed in writing the next day.

1.3.4. Additional Requirements.

1.3.4.1. The government shall be entitled to transport passengers (including their personal baggage) and/or cargo up to the entire capacity of the aircraft without reconfiguration from what is required for normal contract performance. To compute aircraft payload, the contractor will use Federal Aviation Administration (FAA) approved weight and balance methods and procedures, ensuring that all operations are conducted within FAA approved limits and IAW all required operational authorizations, including CARB approval. Prime contractor is responsible for subcontractor(s) and must ensure that subcontractor(s) has capability to meet all performance requirements, subcontractor has operational control of the aircraft utilized, aircraft is on subcontractor(s)’ FAA OpSpec, and subcontractor is CARB approved (except for in performance of Radar Range Surveillance (PWS paragraph 1.3.1.1.4.).

1.3.4.2. The contractor shall comply with all pertinent military regulations and/or directives, which pertain to the conduct of contractor personnel in military flight patterns and on military installations as well as maintaining required FAA certifications. Regulations can be obtained from the Airfield Operations Manager at Naval Base Ventura County Air Operations Department

(805) 989-8521, https://www.airnav.com/airport/KNTD or NBVCINST 3710.7(Air Operations Manual).

1.3.4.3. The contractor shall provide an Aircraft Sortie report monthly within seven calendar days of the conclusion of the month, which includes type and total number flights scheduled as well as flights completed to include duration and standby time. This report will also include names of passengers carried if required by the government.

1.3.4.4. Emergency survival equipment must be carried on aircraft as outlined in 14 CFR §

135.167. The contractor shall comply with FAR Part 135 concerning emergency equipment over extended overwater operations.

1.3.4.5. Unauthorized Personnel. The contractor shall not permit unauthorized persons to board the aircraft. At each departure airfield the contractor shall ensure that an accurate passenger manifest is left with appropriate airfield authorities, e.g. military air operators or civilian Fixed Base Operators (FBO) personnel.

1.3.4.6. Baggage. The contractor is responsible for the loss and/or damage to passenger baggage and personal equipment while such items are in contractor’s custody or on-board contractor’s aircraft. Liability for these items is limited to the actual value thereof, coverage commensurate with the commercial standard.

2. Deliverables Schedule and Service Delivery Summary.

2.1. Deliverables Schedule. All deliverables shall be submitted directly to the COR electronically in Microsoft Office (e.g., Word, Excel, Power Point, Project) format. Deliverables shall be identified by contract number, PWS task/subtask number, and deliverable title. All deliverables must meet professional standards and comply with the requirements set forth in this

PWS.

Table 2: Deliverable Schedule PWS Para Deliverable

Title Initial Delivery Due

Date Government

Review Timeframe

Final Delivery Due Date

1.3.2.1 Contractor

Liaison Information

Prior to contract start date

N/A Prior to start of contract, as needed, for POC information changes or Alternate POC when Primary POC is unavailable

1.3.3.3 Sortie Report Within seven calendar

days from the conclusion of each

Ongoing, monthly review

Within two work days of contractor or Government identified discrepancy https://www.airnav.com/airport/KNTD month

3.7 Incident

Report

Within 24 hours of accident or incident

Ongoing until after action is resolved, if any

Within 24 hours of accident or incident

3.4 Verification

of Insurance Coverage

Written verification of insurance coverage to be provided to the CO prior to contract award, annually thereafter, or within 30 days of cancellation or material change in coverage

Annually with additional updates as required per paragraph 3.4.2

N/A

4.2.2 System

Security Plan

(SSP)

Immediate Upon Award

4.3 Cybersecurity

Incident Reporting

As soon as practical but no later than 72 hours after discovering a reportable cyber-incident

Ongoing until cyber incident resolved

Follow-on cyber incident report, if necessary, within five calendar days of becoming aware of a reportable cyber incident

2.2. Service Delivery Summary (SDS). The SDS summarizes desired outcomes and identifies the performance thresholds/metrics that will be tracked to determine whether the desired outcomes are being achieved. Although not all PWS requirements are listed in the SDS, the Contractor is fully expected to comply with all requirements in the PWS and elsewhere in the contract (e.g., contract clauses).

Table 3: SDS

Desired Outcome

PWS

Para

Performance Threshold (Metric)

Source of Data

How Often

Collected

Calculation

Provide and maintain fixed-and rotary-wing aircraft, and range test support as required

1.3.1.1 1.3.1.2

No more than one instance per month of fixed and rotary-wing aircraft not provided or maintained.

Sortie Report Monthly Sortie report with more than one recorded cancelation.

Drone Recovery Schedule

1.3.1.2.3 No more than one

instance per month of drone recovery missions after 2 hour BQM splash time.

Sortie Report Monthly Sortie report with more than one reported delay completing drone pickup in under 2 hours.

Maintain on-time Schedule

1.3.2 No more than one

instance per month of delayed missions reported.

Sortie Report Monthly Sortie report with more than one delay longer than 30 min reported.

Provide timely Cyber-incident reporting

4.3 No more than one

late cyber-incident report or unreported cyber-incident in a twelve (12) month period.

Incident Report

As Required

# of late reports or unreported cyber-incidents per 12-month period

3. General Information.

3.1. Postaward Preperformance Conference. The Contractor shall attend a postaward conference to be conducted remotely via Microsoft Teams by the CO, if such a conference is held prior to the start of performance. The Contractor shall be represented by a designated agent, at a minimum. The Contracting Officer will provide the date and time of the conference at least seven (7) days in advance, along with any necessary Teams meeting link or access information.

The Contractor is responsible for ensuring they have the necessary internet connectivity and Teams access to participate effectively.

3.2. Government-Furnished Property and Services.

3.2.1. When the contractor is directed to land at Government installations, the following Government services will be received at these stations at no cost to the contractor: ground handling of aircraft, air traffic control, and airfield safety protection.

3.2.2. The Government shall provide the contractor with a list of personnel authorized to schedule and request flights. While performing the services set forth in this contract, the contractor shall not permit any person to board the aircraft unless authorized by the COR.

3.3. Billing Information.

3.3.1. Except when otherwise noted at time of mission scheduling, billing will begin and end at Point Mugu, CA.

3.3.2. The contractor shall submit invoices in accordance with Defense Federal Acquisition

Regulation Supplement (DFARS) 252.232-7006, Wide Area WorkFlow (WAWF) Payment Instructions. A detailed breakdown shall be submitted in the Miscellaneous Information area of WAWF as an attachment.

3.3.3. Reimbursable Services and Cost.

3.3.3.1. Reimbursable expenses, listed in the Schedule, shall be identified as separate items and shall be supported by paid receipts.

3.3.3.2. The Government will reimburse the Contractor, at cost, for airport fees assessed as a result of authorized performance under this contract. Examples of airport fees include landing and parking fees.

3.3.3.3. If the contractor’s crew is required to remain overnight on a mission, the contractor will be reimbursed per diem rates consistent with PL 99-234, Federal Civilian Employees and Contractor Travel Expenses Act of 1985 and Federal Acquisition Regulation (FAR) 31.205- 46(a)(2), during the performance period of this contract for each authorized overnight lodging.

Food and lodging arrangements are the contractor’s responsibility. Claims for food/lodging expenses shall be supported by paid receipts to the maximum extent possible. In the event paid receipts cannot be furnished, other documentation must be submitted.

3.3.4. Economic Price Adjustment. Economic Price Adjustment based on Actual Cost of Fuel – Airlift: In order to protect the contractor and the government from significant market fluctuations in the price of fuel, an adjustment will be made based on actual costs incurred.

3.3.4.1. Economic price adjustment (EPA) is limited to changes in the contractor’s cost for fuel only.

3.3.4.2. Allowable fuel adjustments will be made upward or downward only if the price of fuel varies by more than one cent per gallon from the following pegged rate for fuel:

FUEL TYPE PEGGED RATE (Base Price)

JP-8 $4.03

JET-A $4.03

JET-A-1 $4.03

Av Gas 100LL $4.03

3.3.4.3. When the average price per gallon paid by the contractor is greater than the established base price indicated above, the government will reimburse the contractor the difference between the price paid and the established base price.

3.3.4.4. When the average price per gallon paid by the contractor is below the established base price indicated above, the contractor will reimburse the government the difference between the price paid and the established base price. Under these circumstances, the Contracting Officer will issue a demand letter and funds will be reimbursed as directed.

3.3.4.5. Reporting requirements for adjustments are as stated in the contract, but no later than 30 days after month’s end.

3.3.4.6. The actual average cost per gallon under this EPA clause shall be rounded to four decimal positions (e.g., $2.3699).

3.3.4.7. For the CO to consider any request for adjustment, the contractor shall submit data that clearly supports any request for adjustment. At a minimum, the contractor shall submit: 1) total mileage and time flown in performance of the contract; 2) fuel costs associated with that performance; and 3) associated financial data or receipts, as required by the contract.

3.3.4.8. Fuel adjustments will be made using the CLIN titled “X003 Fuel”. The following steps will be taken to determine the adjustment:

3.3.4.8.1. The contractor’s fuel burn rate, established in the List of Aircraft in the contract, is multiplied by the total hours flown in performance of the contract.

3.3.4.8.2. The product is then multiplied by the difference between the average price per gallon paid and the established base price in the contract (also known as the variance).

Example Hours flown in support of the contract = 23,654 Burn rate for aircraft type (in schedule) = 4.21 gallons per hour Base price of fuel established in the contract = $2.50 Actual average cost per gallon = $2.6308

Calculation

Hours * Burn Rate * EPA Price Variance = Adjustment 23,654 * 4.21 = 99,583.34* $0.1308 = $13,025.50

3.4. Air Carrier Insurance Requirements.

3.4.1. Prior to performance of any services hereunder, the contractor shall, at its own expense procure and maintain during the entire performance period of this contract, with a financially and legally responsible insurance company, at least minimum insurance coverage as required by FAA and Department of Transportation (DOT).

3.4.2. The contractor will provide written verification of insurance coverage to the CO at USTRANSCOM TCAQ-CR, 508 Scott Dr, Scott AFB IL 62225-5357 prior to the contract award. The contractor shall provide annual proof of insurance from the insurance provider to the CO. In the event of a planned cancellation or material change in policy coverage, thirty (30) days prior written notice shall be given to the CO. In the event of an unplanned cancellation or material change in policy coverage, notice shall be given to the CO as soon as possible.

3.5. Landing Permits. To permit the use of military installations, the contractor must obtain landing permits following service specific instructions no later than 30 days prior to required approval date. The contractor shall begin the renewal process at least 60 days prior to expiration to allow for any delays in processing and to avoid a suspension on operator.

3.5.1. AIR FORCE and SPACE FORCE BASES. Pursuant to AFI 10-1001, a Landing Permit (DD Form 2401) may be obtained from USTRANSCOM/TCAQ-C at Scott AFB, IL. In addition, a Hold Harmless Agreement (DD Form 2402) and the Certificate of Insurance (DD Form 2400) must be completed and forwarded to the CO at USTRANSCOM TCAQ-C, Scott AFB, IL. The Contractor shall submit these completed forms along with the DD Form 2401.

3.5.2. NAVY/MARINE CORP AIR STATIONS. Call Ms. Audrey Taylor for instructions at

(202) 685-9202, audrey.taylor@navy.mil or access https://portal.navfac.navy.mil/portal/page/portal/extranet/afl/afl_airfields_tab Begin the process no later than 60 days prior to required approval date.

3.5.3. ARMY INSTALLATIONS. POC: Corey Howard - corey.d.howard8.civ@mail.mil

3.5.4. Contractors shall ensure that aircrews are adequately briefed on all restrictions at applicable airfields, including certification airfields, and properly trained before performing any DOW contract mission into these airfields.

3.6. Notice of Accidents or Incidents. All Carrier Operations (both Commercial and Government customers). When a Contractor’s aircraft is involved in any accident, DOW or otherwise, the Contractor shall transmit the information in paragraph #1-8 below to Headquarters AMC, via HQ AMC/A3B, Scott AFB IL (618) 229-4801/DSN 779-4801 or the HQ AMC/A3B Safety Manager at 618-229-2106/DSN 779-2106 and to the CO and the COR. Accident and incident information shall be provided to HQ AMC, the CO and the COR/ACOR by the most expeditious means available within 24 hours of accident or incident. Accidents and incidents are defined in 49 CFR Part 830.

3.6.1. Event schedule identifier

3.6.2. Aircraft type and number

3.6.3. Date and time of the accident or incident

3.6.4. Last point of departure and point of intended landing of the aircraft, as applicable

3.6.5. Nature of the accident or incident and extent of known damage to the aircraft, if any

3.6.6. Total number of crew members and passengers on board

3.6.7. Number of injured and fatalities aboard the aircraft

3.6.8. Condition of baggage or Government-owned material, if any, on board

4. Security (Industrial, Personnel, Physical, Information, and Antiterrorism/Force Protection).

4.1. General Security Requirements Information/Applicability. The majority of daily work associated with this PWS/SOW is at the unclassified level, but contractor personnel may be required to access classified information/systems at the SECRET level, and/or classified areas at the SECRET level, during the performance of this contract/task order. FAR Clause 52.240-92, Security Requirements, applies to the extent of this contract/task order involving access to information, areas, or material classified “CONFIDENTIAL” or “SECRET”. Specific security mailto:corey.d.howard8.civ@mail.mil protocols for contracted companies are outlined in 32 CFR Part 117, National Industrial Security Program Operating Manual (NISPOM), identified in this section of the PWS/SOW, and the DD Form 254 (DoD Contractor Security Classification Specification). A completed/signed DD Form 254 will be attached to the contract/task order.

4.2. Citizenship and Clearance Requirements. All personnel that will have Information Technology (IT)/Automated Data Processing (ADP) privileged access (i.e. Privileged Users) to US Information Systems (IS), and/or classified information, classified systems, or classified areas, shall be US citizens. Foreign Nationals or Local Nationals employed by the DoD are not authorized to have privileged access to US Information Systems. Overall, all contractor’s, subcontractors’ and/or partner’s personnel shall possess the appropriate personnel security investigation for the position(s) occupied. Contractor personnel shall be required to have a background investigation that corresponds with the sensitivity level of the tasks to be performed.

Non-US citizens are not eligible for Common Access Cards (CACs) unless they meet the parameters stated in Department of Defense Manual (DoDM) 1000.13, Volume 1.

4.3. Information Systems (IS) Roles/Categories and Associated Suitability Requirements (Federal Investigative Standards). Contractor personnel with IA administrative privileges and/or who will monitor DoD IT systems or software as designated by DoD Instruction 8500.01 and DoD Manual 5200.02 may be rated at the various levels listed below. The IS roles/categories and the number of personnel assigned to each role is approved by the COR or the CO before the start of the contract/task order. The contractor shall comply with the appropriate provisions of applicable security regulations while assigned to this contract/task order for DOD and USTRANSCOM. The following guidance will be followed when determining background investigation levels for this contract/task order depending on requirements:

IS Role/Category Classified Access Required Investigation General User (Non-Privileged Access) (IT/ADP-III, Non-Sensitive)

NO Tier 1 (T1)

General User (Non-Privileged Access) (IT/ADP-II, Non-Critical Sensitive)

YES Tier 3 (T3)

Privileged User (e.g. System Administrator) (IT/ADP-I, Critical Sensitive)

NO Tier 5 (T5)

Privileged User (IT/ADP-I, Critical Sensitive)

YES Tier 5 (T5)

NOTE: USTRANSCOM Joint Security Office (TCCS-S) will initiate/administer Tier 1 investigations to determine CAC eligibility only, classified access will not be granted based on the Tier 1 investigation. Tier 3 and Tier 5 investigations are the responsibility of the contractor. It is incumbent upon the contractor to have the appropriate investigations completed upon the start of the contract/task order.

4.4. Security Clearance and Special Access Requirements. All positions on this contract/task order, require a minimum of either an interim SECRET granted by the Defense Counterintelligence and Security Agency (DCSA) Adjudication & Vetting Services (AVS), or a completed adjudication of SECRET granted by the DCSA AVS.

4.4.1. Facilities Clearance (FCL). The contractor must have a valid FCL at the SECRET level.

FCL procedures and security guidelines for adjudicative requirements are outlined in 32 CFR, Part 117. FCLs must be awarded by the Defense Counterintelligence and Security Agency (DCSA) Entity Vetting Branch.

4.4.2. Personnel and Facilities Clearance Validation. Upon contract/task order award, the USTRANSCOM contracting team will send TCCS-S the contractor CAGE code for FCL verification via the National Industrial Security System (NISS). The contractor will submit names of the contractor personnel performing on the contract/task order to the USTRANSCOM contracting team, who will provide to TCCS-S for vetting through the DoD personnel security system of record to ensure investigative and clearance requirements have been satisfied. This shall be completed before the COR/Mission Partner Affiliation Sponsor (MPAS) accesses the Mission Partner Identity, Credential, and Access Management (MP ICAM) system and creates CAC applications for contractor personnel. If a contractor’s employee does not have the required investigative or security clearance level based on the Government’s determination, the contractor’s employee will be denied the ability to work in support of this contract/task order.

4.4.3. Common Access Card (CAC) Issuance Procedures.

4.4.3.1. Facility Security Officer (FSO) will verify, via the DOD personnel security system of record, contractors on the contract/task order have the required background investigation to obtain a CAC and provide those names to the CO/COR. Contractors that require a Tier 3 or Tier 5 investigation are the responsibility of the contractor. Contractors that only require a Tier 1 as determined by the FSO will submit to the TCCS-S Personnel Security Program Manager (through the CO or COR) an OF Form 306 (Declaration for Federal Employment) and a MP ICAM Form 1 with Section 1 completed. TCCS-S will initiate the SF-85 (questionnaire for Non- Sensitive Positions) via the National Background Investigation Services (NBIS) for completion and submission to DCSA, for Tier 1 investigations only.

4.4.3.2. At the same time, the contractor company will coordinate and obtain electronic fingerprinting for their employee. The third-party company will “electronically” capture the applicant’s fingerprints, using the USTRANSCOM (Submitting Office (SON), Security Office (SOI), and Agency Location Code (ALC)). Hardcopy fingerprint cards are NOT acceptable.

These steps shall be completed before the COR/MPAS accesses MP ICAM to create a CAC application.

4.4.3.3. Basic US Citizen Contractor CAC Requirements:

4.4.3.3.1. Requires access on a continual basis of 6 months or more.

4.4.3.3.2. Contractor personnel require access to a DoD facility or networks, either on-site or from a remote location.

4.4.3.3.3. Users need access to systems for platforms that requires CAC login or user authentication.

4.4.3.4. Basic Non-US Citizen Contractor CAC Requirements:

4.4.3.4.1. Meet (as direct/indirect DoD hire personnel), as identified in the DoDM 1000.13, Volume 1, the investigative requirements for DoD employment as recognized through international agreements pursuant to DoDI 1400.25, Civilian Personnel Management, Volume 1231. In addition to these investigative requirements, a fingerprint check against the FBI criminal history database, an FBI investigations files (name check search), and a name check against the Terrorist Screening Database shall be required prior to CAC issuance IAW Office of Personnel Management Memorandum, “Final Credentialing Standards for Issuing Personal Identity Verification Cards under HSPD-12”, July 31, 2008.

4.4.3.4.2. Possess (as foreign military, employee, or contract support personnel), a visit status and security assurance that has been confirmed, documented, and processed IAW international agreements pursuant to DoDI 1400.25, Civilian Personnel Management.

4.4.3.5. CAC Applications:

4.4.3.5.1. The CAC applications (MP ICAM Form 1 with Section 1 completed) must have an adjudication Tier 1, Tier 3, or Tier 5 background investigation posted in the DoD personnel security system of record, or

4.4.3.5.2. An interim CAC may be approved when the contractor employee has a favorable fingerprint, name and criminal records check completed and has either a Tier 1, Tier 3, or Tier 5 background check “open” with DCSA.

4.4.3.5.3. The MP ICAM MPAS will not approve the CAC applications in MP ICAM until that MPAS has verified, with a member of USTRANSCOM TCCS-S, one of the above requirements.

4.5. Non-Disclosure Agreement for Contractor Employees. In performance of this contract, the Contractor shall have access to sensitive, non-public information. The contractor agrees (a) to use and protect such information from unauthorized disclosure IAW DoDI 8582.01 - Security of Unclassified DOW Information on Non-DOW Information Systems; (b) to use and disclose such information only for the purpose of performing this contract and to not use or disclose such information for any personal or commercial purpose; (c) to obtain permission of the Government before disclosing/discussing such information with a third party; (d) to return and/or electronically purge, upon Government request, any non-public, sensitive information no longer require for contractor performance; and (e) to advise the Government of any unauthorized release of such information. Upon request, the contractor shall have its employees assigned to this contract and execute a non-disclosure agreement for delivery to the Government. The Government will require contractor personnel to sign a non-disclosure statement to protect non-public information of other contractors and/or the Government.

4.6. Derogatory Information. Any member of the contracted company team (Program Manager, FSO, or other supervisory staff) aware of pending human resource activity of consequence (to include termination or suspension), behaviors or patterns of concern, or misconduct, to include reporting requirements in accordance with Security Executive Agent Directive (SEAD)3 (for contractors with classified security eligibility), for any contractors supporting this contract/task order during the established period of performance, will immediately contact the USTRANSCOM Joint Security Office (TCCS-S) Attn: Industrial Security Program Manager. If the Government notifies the contractor that the employment or the continued employment of any contractor personnel is prejudicial to the interests or endangers the security of the United States of America and/or USTRANSCOM personnel, information, or assets; that employee shall be removed and barred from the worksite. This includes security deviations/incidents and credible derogatory information on contractor personnel as noted in the DoD personnel security system of record. Personnel who have incident reports posted in the DoD personnel security system of record will be denied the ability to support the contract/task order until the issues have been resolved and the incident has been removed in the DoD personnel security system of record. The Contractor shall make any changes necessary in the appointment(s), at no additional cost to the Government. If any incident involves or may involve the mishandling of classified information or a potential Negligent Discharge of Classified Information, the USTRANSCOM Joint Security Office Attn: Industrial Security Program Manager, will be notified within 24 hours during the normal work week and within 72 hours if the incident occurs over the weekend.

5. CYBER SECURITY

5.1. Operationally Critical Support

The services designated under this contract are “operationally critical support” as defined in

DFARS 252.204-7012.

5.2. Cybersecurity Incident Reporting

5.2.1. In addition to the DFARS 252.204-7012 reporting requirements for unclassified systems and 32 CFR Part 117 for classified systems, reportable cyber-incidents (regardless of whether the information system contains covered defense information (CDI) or there is an impact to performance such as delivery schedule delay), include, but are not limited to, the following:

5.2.2. Cyber-incidents as defined in Cyber Security Table 1.

5.2.2.1. Notifications by a federal, state, or local law enforcement agency or cyber-center (e.g., National Cyber Investigative Joint Task Force (NCIJTF), National Security & Communications Integration Center (NCCIC), Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Department of Defense Cyber Crime Center (DC3)) of being a victim of a successful or unsuccessful cyber-event, anomaly, incident, insider threat, breach, intrusion, or exfiltration.

Cyber Security Table 1:

Incident Category Description Root Level Intrusion Unauthorized privileged access to an IS. Privileged access, often referred to as administrative or root access, provides unrestricted access to the IS. This category includes unauthorized access to information or unauthorized access to account credentials that could be used to perform administrative functions (e.g., domain administrator). If the IS is compromised with malicious code that provides remote interactive control, it will be reported in this category.

User Level Intrusion Unauthorized non-privileged access to an IS. Non-privileged access, often referred to as user level access, provides restricted access to the IS based on the privileges granted to the user. This includes unauthorized access to information or unauthorized access to account credentials that could be used to perform user functions such as accessing Web applications, Web portals, or other similar information resources. If the IS is compromised with malicious code that provides remote interactive control, it will be reported in this category.

Denial of Service Denial of Service (Incident)—Activity that denies, degrades, or disrupts normal functionality of an IS or DoW information network.

Malicious Logic Installation of software designed and/or deployed by adversaries with malicious intentions for the purpose of gaining access to resources or information without the consent or knowledge of the user. This only includes malicious code that does not provide remote interactive control of the compromised IS. Malicious code that has allowed interactive access should be categorized as Root or User Level Intrusion incidents. Interactive active access may include automated tools that establish an open channel of communications to and/or from an IS.

Ransomware Malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable. Malicious actors then demand ransom in exchange for decryption. Ransomware actors often target and threaten to sell or leak exfiltrated data or authentication information if the ransom is not paid. Ransomware is a reportable incident that may be associated with multiple incident categories depending on the attack vector and execution.

5.2.3. To comply with DFARS clause 252.204-7012, contractor is required to develop a System Security Plan (SSP) detailing the policies and procedures their organization has in place to comply with National Institute of Standards & Technology (NIST) Special Publication (SP) 800-

171. The SSP serves as a foundational document for the required NIST SP 800-171 self-assessment as required by the Cybersecurity Maturity Model Certification Level 2 (Self), which applies IAW DFARS 252.204-7021.

5.2.4. If the cyber-incident affects a classified system, vulnerabilities associated with the incident will be classified per the current version of USTRANSCOM Instruction 31-02, Security Classification Guide.

5.3. Cybersecurity Incident Reporting Timelines. In addition to providing the notification required by DFARS 252.204-7012, the contractor is required to notify USTRANSCOM as soon as practical, but no later than 72 hours after discovering a reportable cyber-incident. The reporting timeline begins when the incident is discovered or reported to the company, its employees, contractors, or cybersecurity firm responsible for providing cybersecurity and response for the company. The contractor shall contact the USTRANSCOM Cyber Operations Center (CyOC) via phone at 618-817-4222. If the contractor does not immediately reach the CyOC via phone, the contractor shall send an email notification to transcom.scott.tcj6.mbx.cyoc-dodin-operations@mail.mil.

5.4. Mandatory Reporting Data.

5.4.1. The contractor shall work with the USTRANSCOM CyOC through resolution of the incident. Within 72 hours of becoming aware of a reportable cyber-incident, the contractor shall provide an initial notification of the incident, even if some details are not yet available, which includes, but is not limited to, the following information:

5.4.1.1. Company Name

5.4.1.2. Who will be the POC with contact information

5.4.1.3. Contracting Officer POC (name, telephone, email)

5.4.1.4. Overall Assessment –Description of incident, data at risk, mitigations applied

5.4.1.5. Indicators of compromise

5.4.1.6. Vector of attack (if known)

5.4.1.7. Estimated time of attack (if known)

5.4.2. The contractor shall provide a follow-on cyber-incident report to the USTRANSCOM CyOC within five days of becoming aware of a reportable cyber-incident, which includes, but is not limited to, the following information:

5.4.2.1. Contractor unique Commercial and Government Entity (CAGE) code

5.4.2.2. Contract numbers affected

5.4.2.3. Facility CAGE code where the incident occurred if different than the prime Contractor location

5.4.2.4. POC if different than the POC recorded in the System for Award Management (name, address, position, telephone, email)

5.4.2.5. Contracting Officer POC (name, telephone, email)

5.4.2.6. Contract clearance level

5.4.2.7. DoW programs, platforms, systems, or information involved

5.4.2.8. Location(s) of compromise

5.4.2.9. Date incident discovered

5.4.2.10. Type of compromise (e.g., unauthorized access, inadvertent release, other)

5.4.2.11. Description of technical information compromised

5.4.2.12. Any additional information relevant to the information compromise

5.5. Incident Reporting Coordination.

5.5.1. In the event of a cyber-incident, USTRANSCOM may conduct an on-site review of network or information systems where DoW information is resident on or transiting to assist the contractor in evaluating the extent of the incident and to share information in an effort to minimize the impact to both parties. Date and time of on-site visits will be mutually agreed upon by USTRANSCOM and the contractor in advance.

5.5.2. The contractor agrees to allow follow-on actions by the Government (e.g., USTRANSCOM, FBI, CISA, DC3.) to further characterize and evaluate the suspect activity.

mailto:transcom.scott.tcj6.mbx.cyoc-dodin-operations@mail.mil

The contractor acknowledges that damage assessments might be necessary to ascertain an incident methodology and identify systems compromised as a result of the incident. Once an incident is identified, the contractor agrees to take all reasonable and appropriate steps to preserve any and all evidence, information, data, logs, electronic files and similar type information (reference NIST SP 800-61, Computer Security Incident Handling Guide, (current version)) related to the incident for subsequent forensic analysis so that an accurate and complete damage assessment can be accomplished by the Government.

5.5.3. The contractor is not required to maintain an organic forensic capability, but must ensure data is preserved (e.g., remove an affected system, while still powered on, from the network) and all actions documented until forensic analysis can be performed by the Government or, if the Government is unable to conduct the forensic analysis, a mutually agreed upon third party (e.g., Federally Funded Research and Development Center (FFRDC), commercial security contractor, etc.). Any follow-on actions shall be coordinated with the contractor via the Contracting Officer.

5.5.4. The contractor agrees to indemnify and hold the government harmless for following any recommendations to remedy or mitigate the cyber-incident following the actions under 4.3.1. and 4.3.2.

5.6. Confidentiality and Non-Attribution Statement. The Government may use and disclose reported information as authorized by law and will only provide attribution information on a need-to-know basis to authorized persons for cybersecurity and related purposes (e.g., in support of forensic analysis, incident response, compromise or damage assessments, law enforcement, counterintelligence, threat reporting, and trend analysis). The Government may share threat information with other USTRANSCOM industry partners without attributing or identifying the affected contractor.

5.7. Controlled Unclassified Information (CUI):

5.7.1. There are two types of controlled unclassified information that the contractor will have access to under this contract. Any contractor covered information systems that process, transmit or store CUI must protect said information from unauthorized disclosure. CUI is information that the U.S. Government creates or possesses, or that an entity creates or possesses on behalf of the U.S. Government, which requires safeguarding or dissemination controls as mandated by law, regulation, or U.S. Government-wide policy. See 32 CFR 2002.4(h).

5.7.2. The contractor will have access to a specific category of CUI known as General Privacy (PRVCY) information, such as passenger manifests.2 This pertains to personal information, often called Personally Identifiable Information (PII). PII is any information about an individual maintained by an agency (in this case an air carrier operating on behalf of an agency), including

(1) any information that can be used to distinguish or trace an individual‘s identity, such as name, social security number (SSN), DoW ID (DODID) numbers, driver’s license or state identification number, date and place of birth, mother’s maiden name, or biometric records (e.g., fingerprint, voiceprint, iris scan), or ; and (2) any other information that is linked or linkable to

2 Note the requirements to protect CUI IAW NIST SP 800-171 include physical media. Physical media includes both digital media as well as paper records.

an individual, such as medical, educational, financial, employment information, and/or system authentication information (passwords, PINs).

5.7.3. Operations Security (OPSEC). OPSEC information, a category of CUI, may be included during performance. OPSEC procedures must be included in contracts to ensure that critical information is protected. The contractor shall be responsible for OPSEC procedures when operating missions for the DoW to include safeguarding critical information.