20R4143 Attachment E PWS 3-31-21.docx

N321B TANKER PROJECT OFFICE FUTURE OPERATIONS

TANKER PERFORMANCE WORK STATEMENT

MSC TANKTIME

VESSEL(S) REQUIRED:

One clean, approved, double hull tanker with an Inert Gas System (IGS) and Segregated Ballast Tanks (SBTs) that is capable of carrying a minimum of 250,000 BBLS of clean petroleum products (intention JP8, JP5, F76) within the vessel’s Natural segregation in designated cargo tanks with double valve isolation and with the following minimum particulars:

(COVID-19 Language)

a) 1) Owner shall provide the MSC Area Commander with any report required under U.S. Coast Guard Marine Safety Information Bulletin 02-20 (Change 3) (requiring hazardous conditions be reported), prior to entering the port.

2) Owner shall provide in its proposal its company’s health and safety plans for its crew related to the novel coronavirus for this mission. While not evaluated, upon award, this plan shall become contractually binding on the owner.

3) Owner is advised that due to the time-sensitive and critical nature of the mission, including environmental factors, the Excusable Delay provision shall not apply if delay was caused by a breach of Owner’s Health and Safety Plan cited above or was otherwise reasonably preventable by following U.S. Coast Guard or Center for Disease Control COVID-19 guidelines in publication at the time of breach.

4) The ship-owner agrees that crew and other embarked personnel may be ordered by the charterer to stay aboard the vessel during port visits under this charter as deemed necessary by the charterer or local government authorities. Further, the ship-owner agrees that the charterer may limit access to the vessel by any shore-side personnel upon the vessel’s port calls during this charter.

(Vessel Requirements Language)

b) Vessel must be a party to the Ship Inspection Report (SIRE) System, and offerors must provide a copy of the current Q-88 with offer (no more than 60 days old).

c) Vessel’s Q-88 must detail current acceptances and dates of inspection. There shall be at least one SIRE inspection not more than six months prior to the commencement of laydays under this charter; offerors shall confirm that such inspections were satisfactory.

d) Owner must confirm that the vessel has not been rejected or refused by any Charterer since the inspections leading to the said SIRE report.

e) Vessel’s age shall be less than 20 years for the duration of the charter, vessels that will exceed 15 years during the charter period must be enrolled in their classification society’s Condition Assessment Program (CAP) and be rated CAP 2 or better

f) Owner must confirm the vessel shall have a minimum Ice-Class rating of GL-E2, ABS-B0, F-S-1B, or equivalent.

g) Vessel shall be twin-screw or have a bowthruster.

h) Owner must confirm the vessel shall be MARPOL/SOLAS compliant with the IMO Polar Code, and owner must provide supporting documentation in offer including a present copy of the vessel’s IMO Polar ship certification.

i) Owner must confirm the vessel shall comply with the requirement to burn clean fuels in ECA and Polar regions as required by law understanding there is no IFO allowed on board when in Polar regions.

j) Owner must confirm the vessel shall be able to call on McMurdo, Antarctica.

k) Owner must confirm the vessel shall comply with all applicable USCG regulations.

l) Owner must confirm the vessel shall be approved for non-coastwise voyages.

m) Vessel cannot exceed a maximum LOA of 200.00 meters.

n) Vessel cannot exceed a maximum Beam of 50.00 meters

o) Vessel cannot exceed a maximum deadweight tonnage (DWT) of 40,000 MT (Re-measuring DWT is allowed at owner’s expense).

p) Vessel cannot exceed a maximum displacement of 50,000 MT at the loading terminal.

q) Vessel must have SBTs.

r) Vessel must have an IGS.

s) Vessel cannot exceed a maximum manifold height above water line of 15.60 meters while fully laden with cargo upon departure from the load port.

t) Vessel must have the ability to load a minimum of 188,000 bbls JP8 (assume JP8 with an average API of 37.0-51.0 @ 15℃) while not to exceeding a laden draft of 8.5 meters with Max DWT of 40,000 MT.

u) Vessel must have the ability to load a minimum of 250,000 bbls JP5 (assume JP5 with an average API of 36.0-48.0 @ 15℃) while not to exceeding a laden draft of 12.0 meters with Max DWT of 40,000 MT.

v) Equipped with a minimum of a 10-ton boom lift capacity at the manifold for lifting cargo hoses.

w) Minimum of three segregations with double valve isolation between each segregation.

x) Vessel must be able to machine-wash cargo tanks, as applicable, while underway.

y) Vessel must be able to clean, mop, dry and inert cargo tanks within three (3) days’ notice by the Government during performance of the charter when required.

z) Ability to perform Cargo Operations at offshore petroleum facility.

aa) Vessel must be able and equipped to perform cargo operations pier side.

ab) Ability and equipped to perform Cargo Operations at anchorage (lightering).

ac) Ability and equipped to perform Cargo Operation via Refueling at Sea (CONSOL).

ad) Vessel must be capable of maintaining a minimum Speed of Advance (SOA) of 13 knots in moderate weather (Force 5) while laden.

ae) Must have a minimum of 5 berths available for additional government embarked personnel.

af) Owner must provide a copy of vessel’s current Class Society issued Safety Management Certificate.

ag) Owner must provide a copy of vessel’s current Flag State issued International Ship Security Certificate.

ah) Owner must confirm upon arrival at the load port, the vessel shall be in a clean, gas-free condition and ready for internal tank inspection of the cargo tanks, which will be used to carry this product. These tanks and all additional cargo tanks, ballast tanks, slop tanks and/or void spaces adjacent to these tanks shall be clean and certified as gas free by a Certified Marine Chemist for the tank inspection prior to the ship being allowed to load the Government’s cargo. The Offeror shall provide at the owner’s expense a Certified Marine Chemist to certify the ship’s tanks are safe for entry for the internal tank inspection by the Government and/or Charterer representative. The Certified Marine Chemist must enter all the ship’s cargo tanks in advance of the Quality Assurance Representative (QAR) and perform a full four-corner entry inspection. Certified Marine Chemist’s inspection must include all tank pockets identified by the QAR to the satisfaction of the QAR. If a prior (last, 2nd to last, or 3rd to last) cargo contained a percentage of benzene, the Owner’s Certified Marine Chemist must arrive to the vessel equipped with benzene detection tubes to measure toxicity for benzene content. Acceptable benzene levels are the maximum time-weighted average (TWA) exposure limit is 1 part of benzene vapor per million parts of air (1 ppm) average for an 8-hour workday and the maximum short-term exposure limit (STEL) is 5 ppm for any 15-minute period. Gasoline tanks, after cleaning should be ventilated with forced air or acceptable means for as long as possible to ensure levels are reduced enough to allow entry. All safe for entry / toxicity / flammability assessments will be performed in the presence of the inspecting QAR. Contractor will provide time needed to re-inert after inspection.

ai) Owner must provide, if vessel cargo tanks have heating coils, coil type or composition (such as stainless steel, copper, etc.).

aj) If vessel cargo tanks have heating coils, owner must provide the date heating coils were last pressure tested and the results of the test (passed or failed). Date of last pressure test cannot exceed 12 months for duration of this charter. Vessel tanks with copper or yellow metal compounds are not acceptable for Jet Fuel cargoes.

ak) Owner must provide, if vessel cargo tanks are internally coated, provide the coating type (epoxy, inorganic zinc, etc.). Coal tar coating is not acceptable. If tanks are not coated then state “none”. Coatings that are incompatible with the fuel to be carried will be rejected.

al) Owner must provide copies of Certificates of Quality for vessel’s last three cargoes. These Certificates should contain all test data required by specification for the products that were previously loaded (last three). Vessel Certificates of Quality from vessel post-load samples are preferred, but if unavailable shore tank Certificates of Quality representing quality of product loaded are acceptable. The Certificates of Quality should contain the test data required by the specification for the product which were loaded. They shall be submitted for each shore tank as well as the vessel tanks after loading (composite sample). Results of “typical” are not acceptable. Additionally the following are required for the specific products mentioned:

1. Naphtha / Condensates: Mercaptan Sulphur, reported in “parts per million” (ppm) or “mass percent”, or Doctor Test (ASTMD 4952). Otherwise, Certificates of Quality should contain the test data required by the specification for the products which were loaded.

2. Gasoline (Motor or Aviation): It must be stated whether the previous product was “leaded” or “unleaded”. This is needed to determine cargo tank “safe entry” testing requirements.

am) Vessel shall either (1) not have carried Fatty Acid Methyl Esters (FAME) within its last three cargo or (2) have had its cargo tanks cleaned and conditioned in accordance with the guidance in Energy Institute HM50 if its tanks contained Fatty Acid Methyl Esters (FAME) within its last three cargo carries. Offeror shall either state, with the submission of its offer, that (1) the last three cargos were FAME-free or that (2) the aforementioned cleaning has or will occur prior to loading the government’s cargo.

an) Owner must confirm vessel must be able to take upper, middle, lower, bottom, and all level samples of the cargo (to include OBQ & ROB) without contaminating them from the sampling location. If unable to do so or if the sampling location is contaminated or suspected to be contaminated, Charterer will require open sampling on a tank-by-tank basis, consistent with safety and local terminal regulations.

ao) Owner agrees where cargo is carried after contract award and prior to delivery to provide cargo type/description prior to loading, and applicable Certificates of Quality (to include all test data required in the initial RFP) for review within 48 hours after loading said cargo. Test shall be on a sample taken from the ship versus a representative sample from a shore facility. Any rejection of the Certificates of Quality by the Government shall result in the Government cancelling this contract at no cost to the Government.

ap) Vessel must meet all MSC requirements for reporting. Vessel shall provide position/status reports in-port and at-sea every six (6) hours daily at 0000, 0600, 1200, and 1800 hours local Washington, DC time (GMT-5 EST/GMT-4 EDT) and 72/48/24/12 hr pre-arrival notifications for all ports to Area Command and COMSC TANKERS. Reports shall be sent to the following email addresses:

1. MSCHQ.BWC.FCT@NAVY.MIL

2. COMSC.TANKERS@NAVY.MIL

3. DESC-BIT@DLA.MIL

aq) Vessel will be required to submit a MONTHLY VOYAGE ABSTRACT form on a monthly basis and emailed to COMSC.TANKERS@NAVY.MIL no later than the 1st day of the month following the month of performance. For time charters that complete prior to the end of the month, the report must be received no later than two calendar days after completion of charter (off-hire). Entries must start with the date the ship presents NOR and is accepted on hire. All columns must be completed as noted. Pull down menus for columns C, X and Y are the only comments to be use. Built in macros/formulas are not to be altered. Contractor Facility Clearance.

ar) Fuel oil reports (Monitoring and Consumption) shall be recorded daily and submitted monthly in compliance with the Navy Energy Usage Reporting System (NEURS). NEURS reports shall be submitted in the required format by email to MSCHQ-NEURS@NAVY.MIL and COMC.TANKERS@NAVY.MIL on a monthly basis, no later than the third day after the end of the reporting period.

as) Confirm that owners agree to all other terms and conditions as per TANKTIME 08/20. Counters to TANKTIME 08/20 terms are not acceptable until written confirmation is provided by the charterer.

at) RESERVED

au) The Vessel shall be equipped with a separate, suitable, and securable communication space designated and equipped for the Government to operate and maintain special communications equipment.

1)The space, at a minimum shall have adequate square footage in which Contractor-furnished and MSC-furnished equipment can be operated and maintained. While MSC furnished equipment is installed, the Vessel shall be capable of supporting secure (encrypted) communication equipment by complying with DOD and DON guidance on proper access, handling and disposition of classified material.

2) The Contractor shall comply with physical security requirements in the following publications, available upon request:

A) DOD Manual 5220.22-M (Industrial Security Manual for Safeguarding Classified Information) and DOD 5220.22-S (COMSEC supplement) B) SECNAVINSTs 5510.30 (series) and 5510.36 (series)C C) COMSCINST 2280.3 (series) (COMSEC and EKMS Policy)

av) The Offeror shall include within their Proposal the following supporting information:

1)Delivery Schedule/Progress Chart. The Offeror shall provide an initial Plan of Action and Milestones (POAM) in Microsoft Project compatible format. The POAM Gantt chart shall include the major tasks affecting delivery of the vessel including all modifications or reflagging requirements if applicable. Each task shall contain the below information. A projected Delivery date shall be provided.

A)The anticipated start date, end date and overall duration B)Task dependencies, usually indicated by arrows on the Gantt chart (“x” must be completed before/after “y” starts, milestone “a” must be passed before task “b” starts, etc.)

C)The critical path, typically defined as the sequence of project activities which add up to the longest overall duration. This determines the shortest time possible to complete the project. Any delay of an activity on the critical path directly impacts the planned project completion date.

2) General Arrangement Drawings. The Offeror shall include within their Proposal a complete set of General Arrangement drawings.

3)Previous Voyage Itinerary. The Offeror shall include within their Proposal a list of overseas countries and ports the Vessel has called at within the past five (5) years of RFP issuance, duration of stay and general purpose of visit.

4) Certificates and Inspections. The Offeror shall include within their Proposal copies of current Certificates and Inspections as follows: Applicable inspection and survey certificates (USCG, ABS, DNV, GL, etc.)An ISO 9001 Compliant QMS that has been certified by an accredited organization.

(Safeguarding Covered Defense Information and Cyber Incident Reporting)

The following language shall be used to supplement DFARS Clause 252.204-7012 entitled, "Safeguarding Covered Defense Information and Cyber Incident Reporting".

1. System Security Plan and Plans of Action and Milestones (SSP/POAM) Reviews

a) Within thirty (30) days of contract award, the Contractor shall make its System Security Plan(s) (SSP(s)) for its covered contractor information system(s) available for review by the Government at the contractor's facility. The SSP(s) shall implement the security requirements in Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, which is included in this contract. The Contractor shall fully cooperate in the Government's review of the SSPs at the Contractor's facility.

b) If the Government determines that the SSP(s) does not adequately implement the requirements of DFARS clause 252.204-7012 then the Government shall notify the Contractor of each identified deficiency. The Contractor shall correct any identified deficiencies within thirty (30) days of notification by the Government. The contracting officer may provide for a correction period longer than thirty (30) days and, in such a case, may require the Contractor to submit a plan of action and milestones (POAM) for the correction of the identified deficiencies. The Contractor shall immediately notify the contracting officer of any failure or anticipated failure to meet a milestone in such a POAM.

c) Upon the conclusion of the correction period, the Government may conduct a follow-on review of the SSP(s) at the Contractor's facilities.

The Government may continue to conduct follow-on reviews until the Government determines that the Contractor has corrected all identified deficiencies in the SSP(s).

d) The Government may, in its sole discretion, conduct subsequent reviews at the Contractor's site to verify the information in the SSP(s). The Government will conduct such reviews at least every three (3) years (measured from the date of contract award) and may conduct such reviews at any time upon thirty (30) days' notice to the Contractor.

2. Compliance to NIST 800-171

a) The Contractor shall fully implement the CUI Security Requirements (Requirements) and associated Relevant Security Controls (Controls) in NIST Special Publication 800-171 (Rev. 1) (NIST SP 800-171), or establish a SSP(s) and POA&Ms that varies from NIST 800-171 only in accordance with DFARS clause 252.204-7012(b)(2), for all covered contractor information systems affecting this contract.

b) Notwithstanding the allowance for such variation, the contractor shall identify in any SSP and POA&M their plans to implement the following, at a minimum:

(1) Implement Control 3.5.3 (Multi-factor authentication). This means that multi-factor authentication is required for all users, privileged and unprivileged accounts that log into a network. In other words, any system that is not standalone should be required to utilize acceptable multi-factor authentication. For legacy systems and systems that cannot support this requirement, such as CNC equipment, etc., a combination of physical and logical protections acceptable to the Government may be substituted;

(2) Implement Control 3.1.5 (least privilege) and associated Controls, and identify practices that the contractor implements to restrict the unnecessary sharing with, or flow of, covered defense information to its subcontractors, suppliers, or vendors based on need-to-know principles;

(3) Implement Control 3.1.12 (monitoring and control remote access sessions) - Require monitoring and controlling of remote access sessions and include mechanisms to audit the sessions and methods.

(4) Audit user privileges on at least an annual basis;

(5) Implement:

i. Control 3.13.11 (FIPS 140-2 validated cryptology or implementation of NSA or NIST approved algorithms (i.e. FIPS 140-2 Annex A:

AES or Triple DES) or compensating controls as documented in a SSP and POAM); and,

ii. NIST Cryptographic Algorithm Validation Program (CAVP) (see https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program);

(6) Implement Control 3.13.16 (Protect the confidentiality of CUI at rest) or provide a POAM for implementation which shall be evaluated by the Navy for risk acceptance.

(7) Implement Control 3.1.19 (encrypt CUI on mobile devices) or provide a plan of action for implementation which can be evaluated by the Government Program Manager for risk to the program.

3. Cyber Incident Response:

a) The Contractor shall, within fifteen (15) days of discovering the cyber incident (inclusive of the 72-hour reporting period), deliver all data used in performance of the contract that the Contractor determines is impacted by the incident and begin assessment of potential warfighter/program impact.

b) Incident data shall be delivered in accordance with the Department of Defense Cyber Crimes Center (DC3) Instructions for Submitting Media available at http://www.acq.osd.mil/dpap/dars/pgi/docs/Instructions_for_Submitting_Media.

docx. In delivery of the incident data, the Contractor shall, to the extent practical, remove contractor-owned information from Government covered defense information.

c) If the Contractor subsequently identifies any such data not previously delivered to DC3, then the Contractor shall immediately notify the contracting officer in writing and shall deliver the incident data within ten (10) days of identification. In such a case, the Contractor may request a delivery date later than ten (10) days after identification. The contracting officer will approve or disapprove the request after coordination with DC3.

4. Naval Criminal Investigative Service (NCIS) Outreach

The Contractor shall engage with NCIS industry outreach efforts and consider recommendations for hardening of covered contractor information systems affecting DON programs and technologies.

5. NCIS/Industry Monitoring

a) In the event of a cyber incident or at any time the Government has indication of a vulnerability or potential vulnerability, the Contractor shall cooperate with the Naval Criminal Investigative Service (NCIS), which may include cooperation related to: threat indicators; pre-determined incident information derived from the Contractor's infrastructure systems; and the continuous provision of all Contractor, subcontractor or vendor logs that show network activity, including any additional logs the contractor, subcontractor or vendor agrees to initiate as a result of the cyber incident or notice of actual or potential vulnerability.

b) If the Government determines that the collection of all logs does not adequately protect its interests, the Contractor and NCIS will work together to implement additional measures, which may include allowing the installation of an appropriate network device that is owned and maintained by NCIS, on the Contractor's information systems or information technology assets. The specific details (e.g., type of device, type of data gathered, monitoring period) regarding the installation of an NCIS network device shall be the subject of a separate agreement negotiated between NCIS and the Contractor. In the alternative, the Contractor may install network sensor capabilities or a network monitoring service, either of which must be reviewed for acceptability by NCIS. Use of this alternative approach shall also be the subject of a separate agreement negotiated between NCIS and the Contractor.

c) In all cases, the collection or provision of data and any activities associated with this statement of work shall be in accordance with federal, state, and non-US law.