OIC_2024_PWS_20240103.docx

DOCX document 54 KB Posted

Attached to
Operation Ice Camp (OIC) 2024 Federal contract opportunity
Solicitation number
TRANSCOM24CC02
Issued by
Department of Defense United States Transportation Command

About this file

This performance work statement describes air charter services required to support Operation Ice Camp 2024. USTRANSCOM seeks aircraft including two ski-equipped aircraft for pioneering landings and general transport between Deadhorse, Alaska and an ice camp 125-225 nautical miles offshore. A rear-loading cargo aircraft is required to transport at least 4000 pounds with a 19-foot capacity. A rotary-wing aircraft must conduct sling loads of 2000 pounds and transport seven passengers between the ice camp and remote ice locations. The period of performance is February 22 to March 25, 2024. Evaluation criteria include air operator experience, pilot qualifications, aircraft capabilities, and price. Cybersecurity requirements address NIST SP 800-171 controls and incident reporting.

View the file

Other files for this federal contract opportunity

Other files attached to Operation Ice Camp (OIC) 2024, newest first.
File Type Posted
RFI_OIC_2024_TRANSCOM24CC02_20240104.docx DOCX document

On GovTribe

Work with this file on GovTribe

  • Download the original file
  • Contacts named in this file
  • Similar government files
  • Ask GovTribe AI about this file

Text version

Performance Work Statement (PWS) For Operation Ice Camp (OIC) 2024 Air Charter Services To Undersea Warfighting Development Center Detachment Arctic Submarine Laboratory

6 October 2023

UWDC Detachment Arctic Submarine Laboratory Performance Work Statement

Table of Contents

1Scope1
2References1
2.1Reference Documents1
3Requirements1
3.1Charter Aircraft Services1
4Government Furnished5
4.1Government Furnished Equipment / Services5
4.2Government Furnished Information5
5Period of Performance6
6Contractor Key Personnel6
6.1Aircraft Pilot6
7Evaluation Criteria6
7.1Air Operator Capability and Experience6
7.2Pilot Experience6
7.3Aircraft Capability6
7.4Price7
8Service Delivery Summary…………………………………………………………………………….7

9 Cybersecurity Requirements…………..……...……………………………………………………….7

BACKGROUND

The U.S. Navy’s Undersea Warfighting Development Center (UWDC) Detachment Arctic Submarine Laboratory’s mission is to support the fleet as the “center of excellence” for Arctic matters to enable the submarine force to safely and effectively operate in the unique Arctic Ocean environment, develop and train forces in the tactics, techniques, and procedures required for Arctic operations and exercises; develop and maintain personnel with expertise in Arctic-specific knowledge, skills, and capabilities; plan and coordinate technical development, operations test and evaluations and employment of systems that assure access for Navy forces to engage in the Arctic region; and coordinate with organizations on Arctic-related matters.

A primary means to meet this mission is through an Ice Exercise (ICEX) or Operation Ice Camp (OIC). ICEX/OIC is the Navy's RDT&E exercise used to validate and assess operational readiness of the submarine force in the Arctic while continuing research and military training in extreme cold conditions and the undersea environment. The U.S. Navy has been conducting Arctic and undersea exercises since the 1940's, to include the first under-ice dive by the USS Boarfish (SS 327) in 1947. These exercises extended to arctic exploring and submarine operations under the polar ice canopy became known as Ice Exercises. The frequency and scope of these ice exercises have changed over the years to include a more robust submarine support capability on the ice through an "ice station" or "ice camp." Aircraft that can take off and land on drifting sea ice is required to support these ice camps.

1 Scope This performance work statement (PWS) describes the tasks required of the contractor to support the Undersea Warfighting Development Center Detachment Arctic Submarine Laboratory by providing air charter services to the drifting ice camp. INTERESTED AIR OPERATORS ARE NOT REQUIRED TO PROVIDE ALL SERVICES IN THE PWS. AIR OPERATORS MAY PROPOSE TO MEET ANY AIRCRAFT REQUIREMENT IN THE PWS.

2 References Reference Documents

a. CFR Title 32 Part 861, DOD Commercial Air Transportation Quality and Safety Review Program.

b. DOD Instruction 4500.3, DOD Commercial Air Transportation Quality and Safety Review Program.

3 Requirements Charter Aircraft Services Contracts for Air Charter Services will be contingent upon air operator’s approval from the DoD Commercial Airlift Review Board (CARB) in accordance with References 2.1.a and 2.1.b. Air Operators do not need to be DoD approved to submit proposals for chartered air services but they may need to go through the DoD approval process and get DoD approval in order to conduct the work. DoD Approval requirement is contingent upon the support the aircraft will provide to the DoD. Two pilots are required for all flights, even with single engine aircraft if that aircraft supports a second pilot.

All aircraft will conduct operations from Deadhorse, Alaska Airport (ICAO: PASC, IATA: SCC) and support a drifting ice camp approximately 125 NM to 225 NM from the airport. All aircraft must be equipped with GPS, navigation, and communication equipment. The ice camp will have VHF and Iridium communications, heated shelters, electrical power, real-time weather observations and forecasts, berthing, and food as required. Air Operators are expected to procure fuel for their aircraft.

The projected dates, service periods, service durations, and flight hours are notional and subject to change pending planning during the duration of the contract. All listed preferences are not requirements and aircraft that do not meet preferences will still be evaluated.

Ski-Wheel Equipped Aircraft #1 (Pioneering Landings, General Purpose) (CLIN 0001) Contractor shall conduct Pioneering Landings. The Pioneering Landing flight is the aircraft that conducts the initial landing on the sea-ice; there is no person on the ice at this time, no physically measured ice thickness, and no groomed runway. The plane may use wheels, skis, or a combination and have endurance minimum of five hours to travel to various ice floes selected by the Navy through satellite imagery analysis, approximately 125 NM to 200 NM from Deadhorse Airport (SCC) in Prudhoe Bay, Alaska. The aircraft must be able to operate without a groomed runway. The aircraft operator and pilot must have experience with Pioneering Landings. The aircraft must be able to take off and land on the sea-ice in under 2000 feet but a distance of 1500 feet or less is highly preferred. It is anticipated that this aircraft will support up to five planned Pioneering Landings on drifting sea ice to conduct pioneering efforts to select a suitable location to build an ice camp. It is expected that the aircraft will remain on the sea-ice for approximately 1 – 2 hours during Pioneering Flights to conduct ice surveys.

The aircraft shall accommodate at least the pilot and four passengers during Pioneering Landing flights. The experienced pilot will select a suitable landing site on the ice floe with guidance and concurrence from Operation Ice Camp personnel. Pilot must be capable of landing the aircraft on first year sea ice. Passengers will carry approximately 250 lbs. of ice auger equipment and emergency survival gear. Aircraft capacity to support at least 2000 lbs. payload while in ski-wheel configuration with 200 NM range (i.e., 200 NM from airport to sea ice and then 200 NM from the sea ice back to the airport without refueling) is required. Ability to take extra fuel and refuel on the drifting sea ice is preferred (up to 100 gallons of fuel).

After the pioneering stage, the ice runway will be built, and these aircraft will continue to support the ice camp by utilizing the ice runway. The ski-wheel configuration is still required throughout the duration of the period of performance as a contingency for ice breakups where landing on ungroomed ice may be required until a new ice runway is built. When operating from a runway, the aircraft must be able to operate from a 1500 ft. compacted snow or ice runway for both takeoff and landings with a payload of at least 2000 lbs. and seating capability for at least nine passengers. Aircraft must be able to support at least two round trips to the ice camp each day; three round trips per day capability is preferred assuming the ice camp is 225 nautical miles from Deadhorse Airport.

Total Projected Service Period: 22 February – 25 March 2024 Projected Flight Hours: 157 total flight hours Minimum Flight Hours: 118 total flight hours

Ski-Wheel Equipped Aircraft #2 (Pioneering Landings, General Purpose) (CLIN 0002) Contractor shall conduct Pioneering Landings. The Pioneering Landing flight is the aircraft that conducts the initial landing on the sea-ice; there is no person on the ice at this time, no physically measured ice thickness, and no groomed runway. The plane may use wheels, skis, or a combination and have endurance minimum of five hours to travel to various ice floes selected by the Navy through satellite imagery analysis, approximately 125 NM to 200 NM from Deadhorse Airport (SCC) in Prudhoe Bay, Alaska. The aircraft must be able to operate without a groomed runway. The aircraft operator and pilot must have experience with Pioneering Landings. The aircraft must be able to take off and land on the sea-ice in under 2000 feet but a distance of 1500 feet or less is highly preferred. It is anticipated that this aircraft will support up to five planned Pioneering Landings on drifting sea ice to conduct pioneering efforts to select a suitable location to build an ice camp. It is expected that the aircraft will remain on the sea-ice for approximately 1 – 2 hours during Pioneering Flights to conduct ice surveys.

The aircraft shall accommodate at least the pilot and four passengers during Pioneering Landing flights, although the capability to accommodate five or more passengers is preferred. The experienced pilot will select a suitable landing site on the ice floe with guidance and concurrence from Operation Ice Camp personnel. The aircraft must also provide capacity for 250 lbs. of ice auger equipment and emergency survival gear; capacity to support higher payload is preferred. Ability to take extra fuel and refuel on the drifting sea ice is preferred.

After the pioneering stage, the ice runway will be built and aircraft will continue to support the ice camp by utilizing the ice runway. The aircraft may switch (highly preferred) to a wheel configuration (i.e. remove skis) after the ice runway is built and keep the skis in the Operation Ice Camp hangar in Deadhorse, AK to allow for higher payload capacity. When operating from a runway, the aircraft must be able to operate from a 1500 ft. compacted snow or ice runway for both takeoff and landings with a payload of at least 2000 lbs. and seating capability for at least nine passengers. Aircraft must be able to support at least two round trips to the ice camp each day; three round trips per day capability is preferred assuming the ice camp is 225 nautical miles from Deadhorse Airport.

Total Projected Service Period: 22 February – 25 March 2024 Projected Flight Hours: 167 total flight hours Minimum Flight Hours: 125 total flight hours

Rear Loading Aircraft (Personnel and Cargo) (CLIN 0003) Contractor shall conduct charter aircraft service for a Rear Loading Aircraft to transport cargo and personnel. This aircraft will be required to support the ice camp to include the ice camp deployment, heavy load operations, and the ice camp demobilization. The aircraft must be able to operate from a 2500 feet compacted snow or ice runway for both takeoff and landings with a payload capacity of at least 4000 lbs.; 5000 lbs. payload capacity is preferred. Rear loading ramp and rollers (internal and rear ramp) are preferred. Aircraft must be able to transport objects with lengths up to 19 feet.

Aircraft will be used primarily for cargo and secondarily for personnel transport. Removable aircraft seating required for at least 16 passengers for occasional personnel transport. Ability to support aerial delivery operations is preferred (e.g. dropping small Ice Tracker buoys from the aircraft or parachute rigged pallets/equipment). Aircraft must be able to support at least two round trips to the ice camp each day; three round trips per day capability is preferred assuming the ice camp is 225 nautical miles from Deadhorse Airport.

Projected Service Periods: 27 February – 25 March 2024 Projected Flight Hours: 180 total flight hours* Minimum Flight Hours: 135 total flight hours

*Project Flight Hours for Cargo Aircraft based on capability of a Casa 212 aircraft. Other aircraft may provide different cargo transport capability (higher or lower), which accounts for the spread between minimum and projected flight hours for this requirement.

Rotary Wing Aircraft (Personnel and Cargo) (CLIN 0004) Contractor shall conduct charter aircraft service for helicopter services at the ice camp. This shall include helicopter transport of personnel and equipment between the ice camp and remote ice locations (e.g. several miles from the ice camp), emergency medical evacuations (from ice camp back to Prudhoe Bay, Alaska or Utqiagvik, Alaska depending upon location of the ice camp), and recovery of exercise equipment. Helicopter must be able to conduct sling load with at least 2000 lbs. Helicopters must have passenger capacity of at least seven passengers comfortably with passengers wearing Arctic grade clothing, although eight-passenger capacity is highly preferred. For reference, a Bell 212 and Bell 412 helicopter have provided adequate support for these requirements in the past. Rotary aircraft must be able to fly to the ice camp without refueling enroute, assuming the ice camp is 225 nautical miles from Deadhorse Airport. Rotary aircraft will be able to refuel at the ice camp.

The ice camp can provide fuel containment for the helicopter fuel at the ice camp along with other aircraft support equipment (e.g. berms, generator, aircraft heater). The air operator is required to procure the helicopter fuel; the Navy can transport the fuel to the ice camp (see PWS 4.1.a). Recommend air operator provide their own aviation-grade fuel transfer pump at the ice camp. The ice camp will provide lodging and food on the ice for the helicopter crews, at no cost.

Projected Service Periods: 1 March – 22 March 2024 Projected Flight Hours: 52 total flight hours Minimum Flight Hours: 39 total flight hours 4 Government Furnished Government Furnished Equipment/Services

a. The government will provide fuel containment systems (i.e. berms) for the helicopter fuel at the ice camp. The government will transport the Air Charter Service-procured helicopter fuel to the ice camp if it is in 55 gallon drums or other similarly sized containers. The government can assist in fuel movements at the ice camp if required. Helicopter crew should bring an aviation fuel transfer pump.

b. The government will provide a heated working space at least 100 square feet at the ice camp for the helicopter crew equipment.

c. The government will provide 2KW portable inverter generators at the ice camp. The government may provide a higher rated portable inverter generator at the ice camp (e.g. 7 kW) if required. The government will also provide the fuel to run these portable generators as necessary to support aircraft electrical requirements.

d. The government will provide lodging and sustenance for helicopter personnel while at the ice camp. Lodging will be provided at the ice camp through tents that are shared with other ice camp personnel. All meals will be provided for the helicopter crew at the ice camp.

e. The government will rent a hangar facility in Deadhorse, Alaska. All aircraft supporting the ice camp will be able to utilize the hangar apron, and supplied electrical power, for the aircraft. Limited space in the hangar may be provided for aircraft maintenance equipment. Hangar may be utilized temporarily for short duration aircraft repairs or maintenance. Limited space in the hangar facility may be utilized daily as office space for personnel.

Government Furnished Information

a. The government will provide information suitable for the ice camp operations. This information may include radar and satellite imagery, meteorological observations and forecasts, and sea ice measurements.

5 Period of Performance The overall projected period of performance is 22 February 2022 through 25 March 2024 but each aircraft requirement has its own period of performance as delineated in PWS 3.1.1 – 3.1.4.

6 Contractor Key Personnel Aircraft Pilot The aircraft pilot is considered Key Personnel. Any proposal must include a resume or CV which provides evidence of expertise and experience landing the proposed aircraft on drifting sea-ice.

7 Evaluation Criteria The contractor will be evaluated on the following criteria using a Best Value Continuum Tradeoff Process (IAW FAR 15.101-1). Section 7.1 (Air Operator Capability and Experience), Section7.2 (Pilot Experience), and Section 7.3 (Aircraft Capability) are equally weighted and are weighted higher than Section 7.4 (Price).

Air Operator Capability and Experience Describe the aircraft operator experience in operating aircraft on sea-ice.

Describe the aircraft operator experience conducting Pioneering Landings on drifting ice floes (for Pioneering Landing PWS 3.1.1 requirement only).

The aircraft operator must provide evidence of past performance with references. Complete Attachment A, Past Performance.

Describe the air operator’s capability to provide a backup aircraft in the event that the designated aircraft becomes unavailable.

For rotary aircraft (CLIN 0004), state total number of personnel required to overnight at the ice camp.

State any limiting factors that may limit operational support during the period of performance. For example, daily/weekly crew rest requirements, flight hour limitations, other aircraft tasking during the event, known maintenance requirements during the period of performance, etc.

Pilot Experience Provide a resume or CV for all pilots. Include applicable experience and expertise landing the proposed aircraft on ice floes.

Describe the aircraft operator capability to provide an alternative pilot in the event that the pilot becomes unavailable.

Aircraft Capability Provide information to include manufacturer, model, age, cruising speed, and condition of the aircraft proposed.

For all aircraft, provide the payload capability in regards to number of personnel (passengers) and/or equipment (pounds) and the take-off and landing distances on the sea-ice (for fixed wing aircraft only). Shorter take-off and landing distances are preferred and higher passenger and payload capacity is preferred.

Provide the operational range (distance for each leg of a round trip without refueling at the ice camp) capability in regards to varying payloads (in pounds). For example, the range of the aircraft is 200 nautical miles when transporting XXX lbs. payload (cargo or personnel); with an operational range of 200 nautical miles, the aircraft can carry XXX payload. A chart depicting these values is recommended. Values should assume the aircraft is equipped for ice landings (i.e. ski-wheel configured for Pioneering Landings and wheel configured for runway landings as appropriate).

Provide minimum ice thickness required to land and take off from the sea ice.

Provide information on any additional support equipment or requirements if available, such as a powered winch (for Cargo air craft), cargo ramp (for side loading aircraft), sling/rigging equipment (for rotary aircraft), or any other equipment that may be useful for operations on the ice.

PRICE

The contractor shall provide a proposal in accordance with the attached pricing sheet for CLIN 0001 through 0004. Prices shall include all costs associated with performing the missions, to include aircraft relocation fees, incidentals (e.g. equipment rentals, room and board in Prudhoe Bay, Alaska, etc.), fuel costs, and other fees as appropriate.

Interested contractors are not required to provide all services in the PWS. Air operators may propose to meet any aircraft requirement in the PWS.

8SERVICE DELIVERY SUMMARY (SDS)
Performance Objectives
PWS Paragraph (s)
Performance Threshold
All aircraft arrive within one (1) hour after the scheduled arrival time.
3.1.1, 3.1.2, 3.1.3, and 3.1.4
95% or higher computed on average of all flights
Carry the scheduled loads of passengers/cargo on each flight.
3.1.3
100% of the time
Provide aircraft and services free of discrepancies.
3.1
95% of the time
Provide timely cyber-incident reporting.
9.1
No more than one late cyber-incident report or unreported cyber-incident.

9 CYBERSECURITY REQUIREMENTS

9.0 In performance of this contract, the contractor may have access to Controlled Unclassified Information (CUI), which for the purposes of this section shall mean any information developed or received in the course of planning, ordering, shipping, tracking, and invoicing in support of the requirements of this contract. To adequately protect this CUI, contractor information systems (IS) involved in the performance of this contract shall comply with the security requirements in the current version of the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations.”

9.1 Cybersecurity Incident Reporting

9.1.1 In addition to the DFARS 252.204-7012 reporting requirements for unclassified systems and DoD Manual (DoDM) 5220.22, National Industrial Security Program Operating Manual (NISPOM) for classified systems, reportable cyber-incidents include, but are not limited to, the following:

9.1.1.1 Cyber-incidents as defined in Table 1.

9.1.1.2 Notifications by a federal, state, or local law enforcement agency or cyber-center (i.e., National Cyber Investigative Joint Task Force (NCIJTF), National Cybersecurity & Communications Integration Center (NCCIC)) of being a victim of a successful or unsuccessful cyber-event, anomaly, incident, insider threat, breach, intrusion, or exfiltration.

Table 1

Incident Category
Description
Root Level Intrusion
Unauthorized privileged access to an IS. Privileged access, often referred to as administrative or root access, provides unrestricted access to the IS. This category includes unauthorized access to information or unauthorized access to account credentials that could be used to perform administrative functions (e.g., domain administrator). If the IS is compromised with malicious code that provides remote interactive control, it will be reported in this category.
User Level Intrusion
Unauthorized non-privileged access to an IS. Non-privileged access, often referred to as user level access, provides restricted access to the IS based on the privileges granted to the user. This includes unauthorized access to information or unauthorized access to account credentials that could be used to perform user functions such as accessing Web applications, Web portals, or other similar information resources. If the IS is compromised with malicious code that provides remote interactive control, it will be reported in this category.
Denial of Service
Denial of Service (Incident)—Activity that denies, degrades, or

disrupts normal functionality of an IS or DoD information network.

Malicious Logic
Installation of software designed and/or deployed by adversaries with malicious intentions for the purpose of gaining access to resources or information without the consent or knowledge of the user. This only includes malicious code that does not provide remote interactive control of the compromised IS. Malicious code that has allowed interactive access should be categorized as Root or User Level Intrusion incidents. Interactive active access may include automated tools that establish an open channel of communications to and/or from an IS.
Ransomware
Malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable. Malicious actors then demand ransom in exchange for decryption. Ransomware actors often target and threaten to sell or leak exfiltrated data or authentication information if the ransom is not paid. Ransomware is a reportable incident that may be associated with multiple incident categories depending on the attack vector and execution.

9.1.2 If the cyber-incident affects a classified system, vulnerabilities associated with the incident will be classified per the current version of USTRANSCOM Instruction 31-02, Security Classification Guide.

9.2 Cybersecurity Incident Reporting Timelines

In addition to providing the notification required by DFARS 252.204-7012, the contractor is required to notify USTRANSCOM as soon as practical, but no later than 72 hours after discovering a reportable cyber-incident. The reporting timeline begins when the incident is discovered or reported to the company, its employees, contractors, or cybersecurity firm responsible for providing cybersecurity and response for the company. The contractor shall contact the USTRANSCOM Cyber Operations Center (CyOC) via phone at 618-817-4222. If the contractor does not immediately reach the CyOC via phone, the contractor shall send an email notification to transcom.scott.tcj6.mbx.cyoc-dodin-operations@mail.mil.

9.3 Mandatory Reporting Data

9.3.1 The contractor shall work with the USTRANSCOM CyOC through resolution of the incident. Within 72 hours of becoming aware of a reportable cyber-incident, the contractor shall provide an initial notification of the incident, even if some details are not yet available, which includes, but is not limited to, the following information:

(a) Company Name

(b) Who will be the POC with contact information

(c) Contracting Officer POC (name, telephone, email)

(d) Overall Assessment –Description of incident, data at risk, mitigations applied

(e) Indicators of compromise

(f) Vector of attack (if known)

(g) Estimated time of attack (if known)

9.3.2 The contractor shall provide a follow-on cyber-incident report to the USTRANSCOM CyOC within 5 days of becoming aware of a reportable cyber-incident, which includes, but is not limited to, the following information:

(a) Contractor unique Commercial and Government Entity (CAGE) code

(b) Contract numbers affected

(c) Facility CAGE code where the incident occurred if different than the prime Contractor location

(d) POC if different than the POC recorded in the System for Award Management (name, address, position, telephone, email)

(e) Contracting Officer POC (name, telephone, email)

(f) Contract clearance level

(g) DoD programs, platforms, systems, or information involved

(h) Location(s) of compromise

(i) Date incident discovered

(j) Type of compromise (e.g., unauthorized access, inadvertent release, other)

(k) Description of technical information compromised

(l) Any additional information relevant to the information compromise

9.4 Incident Reporting Coordination

9.4.1 In the event of a cyber-incident, USTRANSCOM may conduct an on-site review of network or information systems where DoD information is resident on or transiting to assist the contractor in evaluating the extent of the incident and to share information in an effort to minimize the impact to both parties. Date and time of on-site visits will be mutually agreed upon by USTRANSCOM and the contractor in advance.

9.4.2 The contractor agrees to allow follow-on actions by the Government (e.g., USTRANSCOM, Federal Bureau of Investigation, Department of Homeland Security, DC3, etc.) to further characterize and evaluate the suspect activity. The contractor acknowledges that damage assessments might be necessary to ascertain an incident methodology and identify systems compromised as a result of the incident. Once an incident is identified, the contractor agrees to take all reasonable and appropriate steps to preserve any and all evidence, information, data, logs, electronic files and similar type information (reference NIST Special Publication 800-61, Computer Security Incident Handling Guide, (current version)) related to the incident for subsequent forensic analysis so that an accurate and complete damage assessment can be accomplished by the Government.

9.4.3 The contractor is not required to maintain an organic forensic capability, but must ensure data is preserved (e.g., remove an affected system, while still powered on, from the network) and all actions documented until forensic analysis can be performed by the Government or, if the Government is unable to conduct the forensic analysis, a mutually agreed upon third party (e.g., Federally Funded Research and Development Center (FFRDC), commercial security contractor, etc.). Any follow-on actions shall be coordinated with the contractor via the Contracting Officer.

9.4.4 The contractor agrees to indemnify and hold the government harmless for following any recommendations to remedy or mitigate the cyber-incident following the actions under 9.4.1. and 9.4.2.

9.5 Confidentiality and Non-Attribution Statement

The Government may use and disclose reported information as authorized by law and will only provide attribution information on a need-to-know basis to authorized persons for cybersecurity and related purposes (e.g., in support of forensic analysis, incident response, compromise or damage assessments, law enforcement, counterintelligence, threat reporting, and trend analysis). The Government may share threat information with other USTRANSCOM industry partners without attributing or identifying the affected contractor.

9.6 NIST SP 800-171 Requirements

Req #
NIST SP 800-171 Requirement
USTRANSCOM Modified Requirement
3.1.3
Control the flow of CUI in accordance with approved authorizations.
Limit the flow of DoD information to organizations or individuals necessary for the performance of the operationally critical requirements of this contract.
3.1.9
Provide privacy and security notices consistent with applicable CUI rules.
Provide privacy and security notices consistent with U.S. Government and/or local governmental regulations.
3.1.19
Encrypt CUI on mobile devices and mobile computing platforms.
Provide adequate technical protections on mobile devices and computing platforms that process and/or store contractual information.
3.1.22
Control CUI posted or processed on publicly accessible systems.
Control DoD information posted or processed on publicly accessible systems.
3.7.3
Ensure equipment removed for off-site maintenance is sanitized of any CUI.
Ensure equipment removed for off-site maintenance is sanitized of DoD information.
3.8.1
Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.
Protect (i.e., physically control and securely store) system media containing DoD information, both paper and digital.
3.8.2
Limit access to CUI on system media to authorized users.
Limit access to DoD information on system media to authorized users.
3.8.3
Sanitize or destroy system media containing CUI before disposal or release for reuse.
Sanitize or destroy system media containing DoD information before disposal or release for reuse.
3.8.4
Mark media with necessary CUI markings and distribution limitations.
Mark media with privacy and security notices consistent with U.S. Government and/or local government regulations.
3.8.5
Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.
Control access to and maintain accountability for media containing DoD information.
3.8.9
Protect the confidentiality of backup CUI at storage locations.
Provide information backup procedures (frequency, timeframe for storage, etc.) for DoD data located on contractor systems. Protect the confidentiality of backup materials containing DoD information.
3.9.1
Screen individuals prior to authorizing access to organizational systems containing CUI.
Screen individuals prior to authorizing access to organizational systems containing DoD information.
3.9.2
Ensure that CUI and organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers.
Ensure that DoD information and organizational systems containing DoD information are protected during and after personnel actions such as terminations and transfers.
3.10.6
Enforce safeguarding measures for CUI at alternate work sites (e.g., telework sites).
Enforce safeguarding measures for DoD Information at alternate work sites (e.g., telework sites).
3.11.1
Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.
Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of DoD information.
3.13.8
Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
Implement cryptographic mechanisms to prevent unauthorized disclosure of DoD information during transmission when possible unless otherwise protected by alternate physical safeguards.
3.13.11
Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.
Employ FIPS-validated cryptography when used to protect the confidentiality of DoD information within the organization’s systems and when possible when transmitting to external entities.
3.13.16
Protect the confidentiality of CUI at rest.
Protect the confidentiality of DoD information at rest.

File details come from the government source that posted it. Updated .