Statement of Work for DOT DCIITP.docx

Statement of Work (SOW) Defensive Counterintelligence and Insider Threat Program (DCIITP) Support Services U.S. Department of Transportation (DOT) Office of Intelligence, Security, and Emergency Response (S-60)

1.0 Background and Objectives

In accordance with Executive Order (E.O.) 13587, the National Insider Threat Policy, and DOT Order 1642.1A, the DOT requires professional and technical support services for the DCIITP to maintain a secure operating environment against foreign intelligence entity (FIE) collection, unauthorized disclosures, and insider threats.

The DCIITP is a centralized, department-wide program managed within the Office of Intelligence, Security, and Emergency Response (S-60). It works in close coordination with the Office of Security (M-40), the Office of the Chief Information Officer (S-80), and the Office of the General Counsel (OGC). The program is responsible for protecting classified national security information, Sensitive Security Information (SSI), and proprietary data across all DOT Operating Administrations (OAs).

The purpose of this contract is to acquire professional, technical, and analytical support services for the U.S. Department of Transportation (DOT) Defensive Counterintelligence and Insider Threat Program (DCIITP). The Contractor shall provide specialized expertise in counterintelligence (CI) analysis, insider threat detection, user activity monitoring (UAM), policy development, and security education to safeguard DOT assets, personnel, networks, and classified national security information.

The DCIITP is responsible for protecting DOT's personnel, classified information, and sensitive technical research against foreign intelligence entity (FIE) collection and exploitation. This includes monitoring and responding to patterns of unauthorized solicitation, academic poaching, and attempts to acquire sensitive software or data assets.

2.0 Scope

The Contractor shall provide qualified personnel to support the DCIITP Hub operations. The scope follows a two-phased modernization approach designed to transition the program from policy compliance toward a mature, data-enabled operation.

1. Phase I (Months 1-6) - Program Design: Focuses on comprehensive enterprise assessment, development of an operational Concept of Operations (CONOPS), and a structured technology evaluation to identify interoperable and cost-efficient solutions.

2. Phase II (Months 7-12) - Roadmap Preparation: Focuses on technology optimization, stakeholder engagement, and the modernization of policy and governance frameworks to align with federal mandates.

3.0 Applicable Documents

The following documents are applicable to this Statement of Work and are incorporated by reference: Executive Order (E.O.) 13587, Structural Reforms to Safeguard Classified Networks, DOT Order 1642.1A, Insider Threat Program, and 49 CFR.

4.0 Performance Requirements

Task 4.1: Program Design and Maturity Assessment Services The Contractor shall establish a baseline maturity level and define the future operating model for the DCIITP.

· Enterprise Program Assessment: Conduct a comprehensive assessment across people, processes, technology, and culture to identify gaps relative to EO 13587 and NITTF maturity metrics.

· Concept of Operations (CONOPS): Develop a detailed operational framework defining roles, escalation logic, interagency coordination pathways, and specific protocols for the intake, triage, and reporting of unsolicited foreign outreach and research solicitations directed toward DOT staff.

· Technology Evaluation: Evaluate existing and emerging technologies (UAM, SIEM, Analytics) to recommend a phased modernization roadmap that balances innovation and fiscal responsibility.

Task 4.2: Roadmap Implementation and Operational Optimization Services The Contractor shall translate Phase I findings into actionable optimizations and governance updates.

· Technology Optimization: Enhance performance of existing security tools and document implementation steps for long-term roadmap solutions.

· Stakeholder Engagement and Training: Develop a communications strategy, training framework, and targeted counter-elicitation awareness programs for research-heavy Operating Administrations (e.g., FHWA) to recognize and report suspicious academic or foreign research inquiries.

· Policy and Governance Update: Modernize DOT directives, SOPs, and charters to align with DITMAC, IC, and DHS best practices.

5.0 Deliverables

The Contractor shall provide the deliverables schedule outlined below. All deliverables must be submitted to the Task Order Monitor (TOM) and Contracting Officer’s Representative (COR) in a mutually acceptable digital format.

6.0 Period of Performance

· Period of Performance: The period of performance shall include a base period of twelve (12) months, with four (4) subsequent twelve (12) month option periods, which may be exercised at the sole discretion of the Government.

7.0 Place of Performance

· Place of Performance: The primary place of performance will be on-site at the U.S. Department of Transportation Headquarters, Washington, DC, within designated office spaces. Remote or telework execution will be strictly limited and requires prior written approval from the COR due to information classification limitations.

8.0 Key Personnel Requirements

The contractor shall provide resumes demonstrating the following minimum qualifications and specialized experience for key personnel roles:

8.1 Program Manager / Senior Policy Lead (1 position)

· Experience: Demonstrated capability or equivalent experience typically represented by a minimum of 8 years within a federal Intelligence Community, Department of Homeland Security, Department of Defense, or Civil Agency Insider Threat Program.

· Desired Experience: Demonstrated experience in identifying and triaging foreign intelligence threats, including suspicious academic solicitations, research data requests, and unauthorized technology transfer attempts.

· Qualifications: Certified Insider Threat Program Manager (ITPM) or equivalent credential. Proven experience leading technical triage teams and interacting with executive-level agency stakeholders.

8.2 Technical User Activity Monitoring (UAM) Specialist (2 positions)

· Experience: Demonstrated capability or equivalent experience typically represented by a minimum of 5 years configuring and operating enterprise-level UAM, SIEM, or data analytics platforms.

· Qualifications: Relevant technical certifications (e.g., CISSP, CEH, or vendor-specific UAM platform certifications). Experienced in drafting behavioral analytics indicators and rule-sets.

9.0 Security Requirements

Security Standards: To perform the required tasks, assigned personnel must meet the minimum standards for access to classified national security information up to, and including, Top Secret / Sensitive Compartmented Information (TS/SCI).

· Personnel Clearances: All contractor personnel assigned to core analytical tasks must possess an active, adjudicated TS/SCI clearance at the time of award and maintain eligibility throughout contract execution.

· Non-Disclosure Agreements (NDAs): All contractor personnel shall execute standard DOT and Intelligence Community non-disclosure agreements before being granted access to DCIITP systems.

· Information Handling: Contractor personnel shall manipulate, store, and transmit data strictly in compliance with Federal Information Security Modernization Act (FISMA) regulations, NIST SP 800-53 controls, and DOT information security policies.

10.0 Inspection and Acceptance

Deliverables will be inspected and accepted by the Contracting Officer’s Representative (COR).