25R0002 - Attachment IX(I) - PWS.docx

N351B TANKER PROJECT OFFICE FUTURE OPERATIONS

TANKER PERFORMANCE WORK STATEMENT

US WEST COAST JONES ACT TANKER REPLACEMENT

MSC TANKTIME

VESSEL(S) REQUIRED:

This service is the primary transportation method for Defense fuels along the US West Coast including Hawaii and therefore mission essential to the US Navy and the Department of Defense.

One, clean, approved, U.S. flag Jones Act compliant tanker, with Segregated Ballast Tanks (SBT) and Inert Gas System (IGS) that is capable of carrying a minimum of 280,000 BBLs of clean product (intentions F76, JP5, JP8, or JA1) within vessel’s natural segregation in designated cargo tanks with double valve isolation and with the following minimum particulars:

a) Health and Safety: Vessel crew and other embarked personnel may be ordered by the charterer to stay aboard the vessel during port visits under this charter as deemed necessary by the charterer or local government authorities. Further, the Contractor agrees that the charterer may limit access to the vessel by any shore-side personnel upon the vessel’s port calls during this charter.

b) Vessel shall be capable of non-coastwise voyages.

c) Vessel shall have the ability to load a minimum of 280,000 BBLs JP8, JP5, JA1 or F76 while not to exceeding a laden draft of 12.47 meters.

d) Vessel shall not exceed a maximum LOA of 204 meters.

e) Vessel shall not exceed a maximum beam of 32.20 meters.

f) Vessel shall not exceed a maximum deadweight tonnage (DWT) of 50,000 MT (Re-admeasuring DWT is allowed at Contractor’s expense).

g) The vessel shall possess a 10-Ton boom or crane that is capable of reaching both port and starboard side that is of sufficient strength to lift cargo hoses safely. Vessel shall be fitted with cruciform bits at the manifold.

h) Vessel shall have a minimum of three segregations with double valve isolation between each segregation.

i) Vessel shall be able to machine-wash cargo tanks, as applicable, while underway.

j) Vessel shall be able to perform cargo operations at offshore petroleum facility.

k) Vessel shall be able to perform cargo operations at anchorage (lightering).

l) Vessel shall be capable of maintaining a minimum Speed of Advance (SOA) of 13 knots in moderate weather while laden.

m) Contractor shall provide at least one passing SIRE inspection in accordance with the schedule in Attachment IX(R)

n) Contractor shall provide upon contract award copies of Certificates of Quality for last three cargoes. If the three last cargoes were DLA-Energy cargoes then only the DD 250-1, Tanker/Barge Material Inspection and Receiving Report, shall be provided. These Certificates must contain all test data required by specification for the products that were previously loaded (last three). Vessel Certificates of Quality from vessel post-load samples are preferred, but if unavailable shore tank Certificates of Quality representing quality of product loaded are acceptable. They shall be submitted for each shore tank as well as the vessel tanks after loading (composite sample). Results of “typical” are not acceptable. Additionally, if any of the three provided COQs are for the following product types, the below requirements apply and must be addressed in the offer:

1. Naphtha / Condensates: Mercaptan Sulphur, reported in “parts per million” (ppm) or “mass percent”, or Doctor Test (ASTMD 4952). Otherwise, Certificates of Quality must contain the test data required by the specification for the products that were loaded.

1. Gasoline (Motor or Aviation): It must be stated whether the previous product was “leaded” or “unleaded”. This is needed to determine cargo tank “safe entry” testing requirements.

1. Fatty Acid Methyl Esters (FAME): The provisions of DLA “Minimum Requirements for Preparation of Cargo Tanks Table 9-30-2021,” note 5 apply. When any of the last three non-DLA Energy cargoes have consisted of diesel or heating oil products, FAME test (EN 14078 and ASTM D7371) results shall be provided for each applicable cargo; examples of diesel or heating oil products include, but are not limited to, ULSD, DF1, DF2, DS1, DS2, DSS, DSW, MGO, Gasoil, FS1, FS2, FS4, FS5, FS6, and IFO. In scenarios where FAME testing is not available for non-DLA Energy cargoes, the applicable cargo shall be deemed to have contained FAME greater than 5 vol % and evaluation will be conducted under the Minimum Requirements for Preparation of Cargo Tanks Table 9-30-2021 under procedures for biodiesel blends greater than B5.

o) The Contractor will provide within 30 days after award the following supporting information:

1. Delivery Schedule/Progress Chart. The Owner/Offeror will provide an initial Plan of Action and Milestones (POAM) in Microsoft Project compatible format. The POAM Gantt chart shall include the major tasks affecting delivery of the vessel including all modifications or reflagging requirements, if applicable, as identified in Attachments IX (K)-(L)-(M)-(N) and (O). Each task shall contain the below information with a projected delivery date shall be provided.

A) The anticipated start date, end date and overall duration

B) Task dependencies, usually indicated by arrows on the Gantt chart (“x” must be completed before/after “y” starts, milestone “a” must be passed before task “b” starts, etc.)

C) The critical path, typically defined as the sequence of project activities that add up to the longest overall duration. This determines the shortest time possible to complete the project. Any delay of an activity on the critical path directly affects the planned project completion date.

2. QMS Certification. The operating company of the vessel will be an ISO 9001 Compliant organization that has a functioning Quality Management System (QMS) that is certified by an accredited organization.

p) Contractor agrees where cargo is carried after contract award and prior to delivery to provide cargo type/description prior to loading, and applicable Certificates of Quality (to include all test data required in the initial RFP) for the last three cargoes for review. Test shall be on a sample taken from the ship versus a representative sample from a shore facility. Any rejection of the Certificates of Quality by the Government shall result in the Government cancelling this contract at no cost to the Government. This compatibility will be assessed using the DLA-E Minimum Requirements for Preparation of Cargo Tanks Table 9-30-2021, hereby incorporated into the RFP and available upon request.

q) The vessel will be in a clean, gas-free condition and ready for internal tank inspection of the cargo tanks, which will be used to carry this product. These tanks and all additional cargo tanks, ballast tanks, slop tanks and/or void spaces adjacent to these tanks shall be clean and certified as gas free by a Certified Marine Chemist for the tank inspection prior to the ship being allowed to load the Government’s cargo. The Offeror shall provide at the Owner/Offeror’s expense a Certified Marine Chemist to certify the ship’s tanks are safe for entry for the internal tank inspection by the Government and/or Charterer representative. The Certified Marine Chemist must enter all the ship’s cargo tanks in advance of the Quality Assurance Representative (QAR) and perform a full four-corner entry inspection. Certified Marine Chemist’s inspection must include all tank pockets identified by the QAR to the satisfaction of the QAR. If a prior (last, 2nd to last, or 3rd to last) cargo contained a percentage of benzene, the Owner/Offeror’s Certified Marine Chemist must arrive to the vessel equipped with benzene detection tubes to measure toxicity for benzene content. Acceptable benzene levels are as follows: (1) the maximum time-weighted average (TWA) exposure limit is 1 part of benzene vapor per million parts of air (1 ppm) average for an 8-hour workday and (2) the maximum short-term exposure limit (STEL) is 5 ppm for any 15-minute period. Gasoline tanks, after cleaning should be ventilated with forced air or acceptable means for as long as possible to ensure levels are reduced enough to allow entry. All safe for entry / toxicity / flammability assessments shall be performed in the presence of the inspecting QAR. Contractor shall provide time needed to re-inert after inspection.

r) The vessel’s cargo tanks shall be compatible with the intended cargo. This compatibility will be assessed using the DLA Energy Minimum Requirements for Preparation of Cargo Tanks Table 9-30-2021, hereby incorporated into the contract and available upon request. The assessment for compatibility will be conducted based on the Certificates of Quality for the vessel’s last three cargoes.

s) Vessel will meet all MSC requirements for reporting. Vessel will provide position/status reports in port and at-sea every six (6) hours daily at 0000, 0600, 1200, and 1800 hours local Washington, DC time (GMT-5 EST/GMT-4 EDT) and 72/48/24/12 hour pre-arrival notifications for all ports to Area Command and COMSC TANKERS. Reports will be sent to the following email addresses:

1. MSC(underscore)BWC@US.NAVY.MIL

2. COMSC.TANKERS@NAVY.MIL

3. VICTOR.J.CIRILO.CIV@US.NAVY.MIL

4. THADDEUS.REAP.CIV@US.NAVY.MIL

5. DLA(underscore)Tanker(underscore)POSITION(underscore)REPORT@DLA.MIL

t) Vessel will submit a MONTHLY VOYAGE ABSTRACT form on a monthly basis and emailed to COMSC.TANKERS@NAVY.MIL no later than the 1st day of the month following the month of performance. For time charters that complete prior to the end of the month, the report must be received no later than two calendar days after completion of charter (off-hire). Entries must start with the date the ship presents NOR and is accepted on hire. All columns must be completed as noted. Columns C, X and Y are the only comments to be used. Built in macros/formulas are not to be altered.

u) Vessel will maintain fuel oil reports (Monitoring and Consumption) and will be recorded daily and submitted monthly in compliance with the Navy Energy Usage Reporting System (NEURS). NEURS reports shall be submitted in the required format by email to MSC_N7_NEURS@US.NAVY.MIL and COMSC.TANKERS@NAVY.MIL on a monthly basis, no later than the third day after the end of the reporting period.

v) Owner/Offeror will submit estimated port expenses on a monthly basis and emailed to COMSC.TANKERS@NAVY.MIL no later than the 1st day of the month following the month of performance.

w) SUPPLEMENT DFARS CLAUSE 252.204-7012 “SAFEGUARDING COVERED DEFENSE INFORMATION AND CYBER INCIDENT REPORTING”

1. System Security Plan and Plans of Action and Milestones (SSP/POAM) Reviews

a) Within thirty (30) days of contract award, the Contractor shall make its System Security Plan(s) (SSP(s)) for its covered contractor information system(s) available for review by the Government at the contractor’s facility. The SSP(s) shall implement the security requirements in Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, which is included in this contract. The Contractor shall fully cooperate in the Government’s review of the SSPs at the Contractor’s facility.

b) If the Government determines that the SSP(s) does not adequately implement the requirements of DFARS clause 252.204-7012 then the Government shall notify the Contractor of each identified deficiency. The Contractor shall correct any identified deficiencies within thirty (30) days of notification by the Government. The contracting officer may provide for a correction period longer than thirty (30) days and, in such a case, may require the Contractor to submit a plan of action and milestones (POAM) for the correction of the identified deficiencies. The Contractor shall immediately notify the contracting officer of any failure or anticipated failure to meet a milestone in such a POAM.

c) Upon the conclusion of the correction period, the Government may conduct a follow-on review of the SSP(s) at the Contractor’s facilities. The Government may continue to conduct follow-on reviews until the Government determines that the Contractor has corrected all identified deficiencies in the SSP(s).

d) The Government may, in its sole discretion, conduct subsequent reviews at the Contractor’s site to verify the information in the SSP(s). The Government will conduct such reviews at least every three (3) years (measured from the date of contract award) and may conduct such reviews at any time upon thirty (30) days’ notice to the Contractor.

2. Compliance to NIST 800-171

a) The Contractor shall fully implement the CUI Security Requirements (Requirements) and associated Relevant Security Controls (Controls) in NIST Special Publication 800-171 (Rev. 1) (NIST SP 800-171), or establish a SSP(s) and POA&Ms that varies from NIST 800-171 only in accordance with DFARS clause 252.204-7012(b)(2), for all covered contractor information systems affecting this contract.

b) Notwithstanding the allowance for such variation, the contractor shall identify in any SSP and POA&M their plans to implement the following, at a minimum:

(1) Implement Control 3.5.3 (Multi-factor authentication). This means that multi-factor authentication is required for all users, privileged and unprivileged accounts that log into a network. In other words, any system that is not standalone should be required to utilize acceptable multi-factor authentication. For legacy systems and systems that cannot support this requirement, such as CNC equipment, etc., a combination of physical and logical protections acceptable to the Government may be substituted;

(2) Implement Control 3.1.5 (least privilege) and associated Controls, and identify practices that the contractor implements to restrict the unnecessary sharing with, or flow of, covered defense information to its subcontractors, suppliers, or vendors based on need-to-know principles;

(3) Implement Control 3.1.12 (monitoring and control remote access sessions) - Require monitoring and controlling of remote access sessions and include mechanisms to audit the sessions and methods.

(4) Audit user privileges on at least an annual basis;

(5) Implement:

i. Control 3.13.11 (FIPS 140-2 validated cryptology or implementation of NSA or NIST approved algorithms (i.e. FIPS 140-2 Annex A: AES or Triple DES) or compensating controls as documented in a SSP and POAM); and,

ii. NIST Cryptographic Algorithm Validation Program (CAVP) (see https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program);

(6) Implement Control 3.13.16 (Protect the confidentiality of CUI at rest) or provide a POAM for implementation which shall be evaluated by the Navy for risk acceptance.

(7) Implement Control 3.1.19 (encrypt CUI on mobile devices) or provide a plan of action for implementation which can be evaluated by the Government Program Manager for risk to the program.

3. Cyber Incident Response:

a) The Contractor shall, within fifteen (15) days of discovering the cyber incident (inclusive of the 72-hour reporting period), deliver all data used in performance of the contract that the Contractor determines is impacted by the incident and begin assessment of potential warfighter/program impact.

b) Incident data shall be delivered in accordance with the Department of Defense Cyber Crimes Center (DC3) Instructions for Submitting Media available at http://www.acq.osd.mil/dpap/dars/pgi/docs/Instructions_for_Submitting_Media.docx. In delivery of the incident data, the Contractor shall, to the extent practical, remove contractor-owned information from Government covered defense information.

c) If the Contractor subsequently identifies any such data not previously delivered to DC3, then the Contractor shall immediately notify the contracting officer in writing and shall deliver the incident data within ten (10) days of identification. In such a case, the Contractor may request a delivery date later than ten (10) days after identification. The contracting officer will approve or disapprove the request after coordination with DC3.

d) In addition to the reporting requirements contained in DFARS 252.204-7012, the contractor must immediately notify MSC of all cyber incidents or compromises, as defined in DFARS 252.204-7012(d)(2). The contractor shall also immediately notify MSC of all incidents involving classified information spillage onto unclassified networks or Personally Identifiable Information (PII) breaches. If immediate notification is not possible, then notification must be made no later than 24 hours after an incident has been identified or suspected. Initial cyber incident and compromise reports shall contain as much of the information required in DFARS 252.204-7012(d)(1) as can reasonably be provided in a timely manner. Submit initial and subsequent reports via encrypted email to the MSC Command Security Manager as well as the COR. To the greatest extent practicable, MSC IA Ops and the COR shall be copied on all correspondence with non-MSC Government agencies regarding reported incidents.

4. Naval Criminal Investigative Service (NCIS) Outreach The Contractor shall engage with NCIS industry outreach efforts and consider recommendations for hardening of covered contractor information systems affecting DON programs and technologies.

5. NCIS/Industry Monitoring

a) In the event of a cyber incident or at any time the Government has indication of a vulnerability or potential vulnerability, the Contractor shall cooperate with the Naval Criminal Investigative Service (NCIS), which may include cooperation related to: threat indicators; pre-determined incident information derived from the Contractor's infrastructure systems; and the continuous provision of all Contractor, subcontractor or vendor logs that show network activity, including any additional logs the contractor, subcontractor or vendor agrees to initiate as a result of the cyber incident or notice of actual or potential vulnerability.

b) If the Government determines that the collection of all logs does not adequately protect its interests, the Contractor and NCIS will work together to implement additional measures, which may include allowing the installation of an appropriate network device that is owned and maintained by NCIS, on the Contractor's information systems or information technology assets. The specific details (e.g., type of device, type of data gathered, monitoring period) regarding the installation of an NCIS network device shall be the subject of a separate agreement negotiated between NCIS and the Contractor. In the alternative, the Contractor may install network sensor capabilities or a network monitoring service, either of which must be reviewed for acceptability by NCIS. Use of this alternative approach shall also be the subject of a separate agreement negotiated between NCIS and the Contractor.

c) In all cases, the collection or provision of data and any activities associated with this statement of work shall be in accordance with federal, state, and non-US law.