Attachment IX (I) - PWS.docx

N35C TANKER PROJECT OFFICE FUTURE OPERATIONS

TANKER PERFORMANCE WORK STATEMENT

MSC TANKTIME

VESSEL(S) REQUIRED:

This service is the primary shallow-draft marine transportation method for Defense Logistics Agency - Energy fuels throughout the INDOPACOM AOR for the replenishment of Defense Fuel Support Pipelines (DFSP) and therefore mission essential to the US Navy and Department of Defense.

Two, clean, approved, U.S. Flag or foreign flag to be reflagged prior to delivery, tanker, with Segregated Ballast Tanks (SBT) that is capable of carrying a minimum of 40,000 bbls of clean product (intentions F76, JP5, JP8, or JA1) within vessel’s natural segregation in designated cargo tanks with double valve isolation and with the following minimum particulars:

(COVID-19 Language)

a) 1) Owner/Offeror will provide the MSC Area Commander with any report required under U.S. Coast Guard Marine Safety Information Bulletin 02-20 (Change 7) (requiring hazardous conditions be reported), prior to entering the port.

2) Owner / Offeror shall provide in its proposal its company’s health and safety plans for its crew, related to the novel coronavirus for this mission. The plan will become part of the contract.

3) Owner / Offeror is advised that due to the time-sensitive and critical nature of the mission, including environmental factors, the Excusable Delay provision shall not apply if delay was caused by a breach of Owner’s Health and Safety Plan cited above, or was otherwise reasonably preventable by following U.S. Coast Guard or Center for Disease Control COVID-19 guidelines in publication at the time of breach.

(Vessel Requirements Due with Offer)

b) Owner/Offeror warrants its understanding that vessel crew and other embarked personnel may be ordered by the charterer to stay aboard the vessel during port visits under this charter as deemed necessary by the charterer or local government authorities. Further, the Owner/Offeror agrees that the charterer may limit access to the vessel by any shore-side personnel upon the vessel’s port calls during this charter.

c) Owner/Offeror warrants that vessel is a party to the Ship Inspection Report (SIRE) System, and offerors must provide a copy of the current Q-88 with offer (no more than 60 days old). In the event that a new construction is offered, the Owner/Offeror warrants that vessel will be a party to the Ship Inspection Report (SIRE) System, and offerors must provide a copy of the current reportas soon as possible post-award.

d) The Q-88 provided in c) shall detail current acceptances and dates of inspection. In the event that a new construction is offered, and the vessel has not entered commercial service, only requirements in c) are to be provided.

e) Owner/Offeror warrants that the vessel has not been rejected or refused by any Charterer since the inspections leading to the said SIRE report in c). In the event that a new construction is offered, and the vessel has not entered commercial service, only requirements in c) are to be provided.

f) Owner/Offeror warrants the availability of a vessel throughout the whole charter period. For vessels that will exceed 15 years during the charter period, the vessel shall be enrolled in their classification society’s Condition Assessment Program (CAP) and be rated CAP 2 or better before commencement of vessel’s (15th) year.

1) For those tankers whose vessel’s age will exceed 20 years during the charter period, the Owner/Offeror must provide a suitable like substitute vessel that shall possess the shall possess the same or greater characteristics as the Vessel being replaced. The charter rate shall remain unchanged from that contained in this charter. Approval of a Vessel substitution is a matter for the Charterer's sole discretion.

a. Under this substitution, Contracting Officer shall be provided vessel characteristics and full information sufficiently in advance to permit the Charterer to determine acceptability of the substitute vessel suitability in accordance with the Substitution section of this charter, and at least 18 months (new-build) and 12 months (reflagged) prior to providing NOR and delivery of the substitute vessel.

i. Information shall include, but not be limited to:

1. Statement as to whether replacement vessel will be a new build or reflagged existing vessel.

2. Details of the substitute vessel’s technical characteristics

3. Plans and general arrangements of the substitute vessel

4. For new build, the Owner/Offeror shall provide the building plans and notice from shipyard of intent to build replacement vessel.

5. Timeline for delivery of vessel, to include all necessary modification to meet MSC required programs for ATFP, CBRD-N and classified communication suite.

2) Failure to provide a vessel acceptable to the charterer may be considered a breach of this charter and subject to all the rights and remedies of the Government herein are in addition to any other rights and remedies provided by law or under this Contract.

g) Owner/Offeror warrants the vessel will comply with all applicable USCG regulations.

h) Owner/Offeror warrants the vessel is approved for non-coastwise voyages or in the event that a new construction is offered, the Owner/Offeror warrants that the vessel will be approved for non-coastwise voyages.

i) Owner/Offeror warrants vessel will have the ability to load a minimum of 28,000 bbls JP8, JP5, JA1 OR F76 while not to exceeding a laden draft of 5.49 meters. Owner shall provide stowage plans for each cargo.

j) Owner/Offeror confirms vessel will not exceed a maximum LOA of 108 meters.

k) Owner/Offeror warrants vessel will not exceed a maximum deadweight tonnage (DWT) of 8,000 MT (Re-measuring DWT is allowed at Owner/Offeror’s expense).

l) Owner/Offeror confirms vessel will have Segregated Ballast Tanks (SBT).

m) Owner/Offeror warrants vessel will have a bow thruster or jet thruster.

n) The vessel shall possess a boom or crane rated to at least 3 Tons and is capable of reaching both port and starboard that is of sufficient strength to safely lift cargo hoses. Vessel shall be fitted with cruciform bits at the manifold. -

o) Owner/Offeror confirms vessel will have a minimum of three segregations with double valve isolation between each segregation.

p) Owner/Offeror warrants vessel will be able to machine-wash cargo tanks, as applicable, while underway.

q) Owner/Offeror warrants vessel will be able to clean, mop, dry and inert cargo tanks within three (3) days’ notice by the Government during performance of the charter when required.

r) Owner/Offeror warrants vessel will be able to perform cargo operations at offshore petroleum facility.

s) Owner/Offeror warrants vessel will be able and equipped to perform cargo operations pier side.

t) Owner/Offeror warrants vessel will be able to perform cargo operations at anchorage (lightering).

u) Vessel shall be fitted with a minimum of four mooring lines on power drums at each end of vessel for a minimum total of eight.

v) Owner / Offeror must warrant that the vessel meets the mooring requirements to perform tanker cargo operation at the Chimu Wan offshore discharge facility at Okinawa, Japan. Mooring at Chimu Wan requires 12 mooring lines leads to six mooring buoys. Each must be at least 260 meters in length.

w) The vessel must have a discharging hose with a minimum length of 17 meters with a six-inch flange, eight holes and ANSI.

x) Owner/Offeror warrants vessel will be capable of maintaining a minimum Speed of Advance (SOA) of 12 knots in moderate weather (Force 5) while laden.

y) Owner/Offeror shall provide a copy of vessel’s current Class Society issued Safety Management Certificate or in the event that a new construction is offered, the Owner/Offeror warrants the vessel will be issued a Safety Management Certificate and the Owner/Offeror will provide a copy after award immediately upon its issuance.

z) Owner/Offeror shall provide a copy of vessel’s current Flag State issued International Ship Security Certificate or in the event that a new construction is offered, the Owner/Offeror warrants the vessel will be issued an International Ship Security Certificate and the Owner/Offeror will provide a copy after award immediately upon its issuance.

aa) Owner/Offeror shall provide a copy of Certificate of Inspection (COI) ) or equivalent Safe Manning Document (SMD) in lieu of a COI is acceptable in the event that a new construction is offered or until the foreign vessel has been reflagged to be US flagged.. After reflagging of foreign vessel to US flagged the COI will be required for Owner/Offeror to provide.

ab) Owner/Offeror will provide, if vessel cargo tanks will have heating coils, coil type or composition (such as stainless steel, copper, etc.).

ac) Owner/Offeror will provide a listing of all cargoes carried for the previous six months and the refineries at which the cargoes were loaded.

ad) Owner/Offeror will provide, if vessel cargo tanks are or will be internally coated, the coating type (epoxy, inorganic zinc, etc.). Coal tar coating is not acceptable. If tanks are not or will not be coated then state “none”. Vessels with coatings that are incompatible with the fuel to be carried will be rejected.

ae) Owner/Offeror warrants vessel will be able to take upper, middle, lower, bottom, and all level samples of the cargo (to include OBQ & ROB) without contaminating them from the sampling location. If unable to do so or if the sampling location is contaminated or suspected to be contaminated, Owner/Offerors agree, Charterer will require open sampling on a tank-by-tank basis, consistent with safety and local terminal regulations.

af) Reserved

ag) Owner/Offeror warrants agreement to all other terms and conditions as per TANKTIME 2022 (Rev.3 (09-22)). Counters to TANKTIME 09/22 terms are not acceptable until written confirmation is provided by the charterer.

(Vessel Requirements Post Award)

ah) Owner/Offerror is expected to comply with the.following attachments and provide reporting as detailed in the Contractor Data Requirement List (CDRL).

(1) Attachment IX(A) - Guidelines for Full/Partial Off-Hire Percentages on Readiness Issues

(2) Attachment IX(B) - US Department of Labor Wage Determination

(3) Attachment IX (E) - Government Furnished Property (GFP) and Directives

(4) Attachment IX (H) - DD Form 254, Contract Security Classification Specification

(5) Attachment IX (I) - Vessel Requirements & Performance Work Statement (PWS)

(6) Attachment IX (K) - Anti-Terrorism/Force Protection (AT/FP) Training Requirements

(7) Attachment IX (L) - CRBN Requirement

(8) Attachment IX (M) - Specifications for Chemical, Biological and Radiological Defense (CBRN-D) Decontamination Station

(9) Attachment IX (N) - Shipboard Security System (SSS) Requirements

(10) Attachment IX (R) - Contract Data Requirement List (CDRL)

(11) Attachment IX (S) - MSC SOM

ai) Per Owner/Offeror’s warrant in f), the Owner/Offeror will provide 1) for new-build replacement vessel a POAM of major milestones for the construction of the vessel to delivery of the vessel to MSC no later than 18 months ) prior to providing NOR and delivery of the substitute vessel, and 2) for reflagged replacement vessel a POAM of major milestones for the reflagging of the vessel to the delivery to MSC no later than 12 months ) prior to providing NOR and delivery of the substitute vessel.

aj) Per Owner/Offeror’s submission of a Q88 in d), the Owner/Offeror will provide at least one SIRE inspection result not more than six months prior to the commencement of laydays under this charter; offeror shall warrant that such inspections were satisfactory.

ak) Per Owner/Offeror’s response to y), if vessel cargo tanks have heating coils, Owner/Offeror shall provide the date heating coils were last pressure tested and the results of the test (passed or failed). Date of last pressure test cannot exceed 12 months for duration of this charter. Vessel tanks with copper or yellow metal compounds are not acceptable for Jet Fuel cargoes.

al) Owner/Offeror shall provide copies of Certificates of Quality (COQ) for last three cargoes. In the event that a new construction is offered, and no cargoes have been carried in any cargo or slop tanks, the Owner/Offeror will not have to provide COQs at time of offer but must comply with requirements in kkThese Certificates shall contain all test data required by specification for the products that were previously loaded (last three). Vessel Certificates of Quality from vessel post-load samples are preferred, but if unavailable, shore tank Certificates of Quality representing quality of product loaded are acceptable. The Certificates of Quality shall contain the test data required by the specification for the product which were loaded. They shall be submitted for each shore tank as well as the vessel tanks after loading (composite sample). MSDS or product specification sheets with results of “typical” are not acceptable. Additionally, the following are required for the specific products mentioned:

1. Naphtha / Condensates: Mercaptan Sulphur, reported in “parts per million” (ppm) or “mass percent”, or Doctor Test (ASTMD 4952). Otherwise, Certificates of Quality should contain the test data required by the specification for the products which were loaded.

2. Gasoline (Motor or Aviation): It must be stated whether the previous product was “leaded” or “unleaded”. This is needed to determine cargo tank “safe entry” testing requirements.

3. Fatty Acid Methyl Esters (FAME): The provisions of DLA “Minimum Requirements for Preparation of Cargo Tanks Table 9-30-2021,” note 5 apply. When any of the last three non-DLA-ENERGY cargoes have consisted of diesel or heating oil products, FAME test (EN 14078 and ASTM D7371) results shall be provided for each applicable cargo; examples of diesel or heating oil products include, but are not limited to, ULSD, DF1, DF2, DS1, DS2, DSS, DSW, MGO, Gasoil, FS1, FS2, FS4, FS5, FS6, and IFO. In scenarios where FAME testing is not available for non-DLA-ENERGY cargoes, the applicable cargo shall be deemed to have contained FAME greater than 5 vol % and evaluation will be conducted under the Minimum Requirements for Preparation of Cargo Tanks Table 9-30-2021 under procedures for biodiesel blends greater than B5.

am) The Owner/Offeror will provide within 30 days of award the following supporting information:

1. Delivery Schedule/Progress Chart. The Owner/Offeror will provide an initial Plan of Action and Milestones (POAM) in Microsoft Project compatible format. The POAM Gantt chart shall include the major tasks affecting delivery of the vessel including all modifications or reflagging requirements if applicable. Each task shall contain the below information with a projected delivery date shall be provided.

A) The anticipated start date, end date and overall duration

B) Task dependencies, usually indicated by arrows on the Gantt chart (“x” must be completed before/after “y” starts, milestone “a” must be passed before task “b” starts, etc.)

C) The critical path, typically defined as the sequence of project activities , which add up to the longest overall duration. This determines the shortest time possible to complete the project. Any delay of an activity on the critical path directly affects the planned project completion date.

2. QMS Certification. The operating company of the vessel will be an ISO 9001 Compliant organization that has a functioning Quality Management System (QMS) and has been certified by an accredited organization.

(Vessel Requirements Due At Delivery)

an) Owner / Offeror agrees where cargo is carried after contract award and prior to delivery to provide cargo type/description prior to loading, and applicable Certificates of Quality (to include all test data required in the initial RFP) for the last three cargoes for review. Test shall be on a sample taken from the ship versus a representative sample from a shore facility. Any rejection of the Certificates of Quality by the Government may result in the Government cancelling this contract at no cost to the Government. This compatibility will be assessed using the DLA-E Minimum Requirements for Preparation of Cargo Tanks Table 9-30-2021, hereby incorporated into the RFP and available upon request. Owner / Offeror agrees that were no cargo is carried after contract award and prior to delivery the last three cargoes carried prior to delivery shall be compatible with the DLA-E Minimum Requirements for Preparation of Cargo Tanks Table 9-30-2021, hereby incorporated into the RFP and available upon request. Incompatible cargoes may result in the Government cancelling this contract at no cost to the Government.

ao) The vessel will be in a clean, gas-free condition and ready for internal tank inspection of the cargo tanks, which will be used to carry this product. These tanks and all additional cargo tanks, ballast tanks, slop tanks and/or void spaces adjacent to these tanks shall be clean and certified as gas free by a Certified Marine Chemist for the tank inspection prior to the ship being allowed to load the Government’s cargo. The Offeror shall provide at the Owner/Offeror’s expense a Certified Marine Chemist to certify the ship’s tanks are safe for entry for the internal tank inspection by the Government and/or Charterer representative. The Certified Marine Chemist must enter all the ship’s cargo tanks in advance of the Quality Assurance Representative (QAR) and perform a full four-corner entry inspection. Certified Marine Chemist’s inspection must include all tank pockets identified by the QAR to the satisfaction of the QAR. If a prior (last, 2nd to last, or 3rd to last) cargo contained a percentage of benzene, the Owner/Offeror’s Certified Marine Chemist must arrive to the vessel equipped with benzene detection tubes to measure toxicity for benzene content. Acceptable benzene levels are as follows: (1) the maximum time-weighted average (TWA) exposure limit is 1 part of benzene vapor per million parts of air (1 ppm) average for an 8-hour workday and (2) the maximum short-term exposure limit (STEL) is 5 ppm for any 15-minute period. Gasoline tanks, after cleaning should be ventilated with forced air or acceptable means for as long as possible to ensure levels are reduced enough to allow entry. All safe for entry / toxicity / flammability assessments shall be performed in the presence of the inspecting QAR. Contractor shall provide time needed to re-inert after inspection.

ap) Vessel will meet all MSC requirements for reporting. Vessel will provide position/status reports in-port and at-sea every six (6) hours daily at 0000, 0600, 1200, and 1800 hours local Washington, DC time (GMT-5 EST/GMT-4 EDT) and 72/48/24/12 hour pre-arrival notifications for all ports to Area Command and COMSC TANKERS. Reports will be sent to the following email addresses:

1. MSC_BWC@US.NAVY.MIL

2. COMSC.TANKERS@NAVY.MIL

3. CTF73.BATTLE.WATCH@FE.NAVY.MIL

4. MSCSSUJAPANOPSGROUP@FE.NAVY.MIL

5. M-KO-MSC-OPS@FE.NAVY.MIL

6. DESC-BIT@DLA.MIL

aq) Vessel will submit a MONTHLY VOYAGE ABSTRACT form on a monthly basis and emailed to COMSC.TANKERS@NAVY.MIL no later than the 1st day of the month following the month of performance. For time charters that complete prior to the end of the month, the report must be received no later than two calendar days after completion of charter (off-hire). Entries must start with the date the ship presents NOR and is accepted on hire. All columns must be completed as noted. Pull down menus for columns C, X and Y are the only comments to be use. Built in macros/formulas are not to be altered.

ar) Vessel will maintain fuel oil reports (Monitoring and Consumption) and will be recorded daily and submitted monthly in compliance with the Navy Energy Usage Reporting System (NEURS). NEURS reports shall be submitted in the required format by email to MSC_N7_NEURS@US.NAVY.MIL and COMSC.TANKERS@NAVY.MIL on a monthly basis, no later than the third day after the end of the reporting period.

as) Owner/Offeror will submit estimated port expenses on a monthly basis and emailed to COMSC.TANKERS@NAVY.MIL no later than the 1st day of the month following the month of performance.

at) COMMUNICATIONS

Vessel shall provide an operational commercial wideband satellite communications (SATCOM) system to provide a communications transport path from ship to shore. The minimum committed information rate (CIR) for the installed satellite communications capability shall be 2048/2048 Kbps to support connection of DoD embarked unclassified and classified voice and data communications capabilities. Vessel shall provide an Ethernet network connection point and routable IP address, within a secure space as defined in paragraph (b), to support establishing a connection and communication transport path for DoD embarked communications capabilities.

Personnel Clearances. The vessel's Master and one additional crew member shall be eligible for access to classified information up to and including SECRET based upon a favorably adjudicated investigation meeting at a minimum National Agency Check with Law and Credit (NACLC) or equivalent. If Contractor is not able to provide a Master and one additional crew member eligible to meet the above requirement, the Contractor, with Contracting Officer concurrence, shall provide a two contractor employees eligible for access to classified information under this contract with the same availability as a vessel’s Master while underway and in port. The two crew members or contractor employees with clearances may also be the persons designated and trained to meet the EKMS requirements listed in this section. All crewmembers shall be U.S. citizens with valid U.S. passports for the full length of their assignment and shall be required to submit to terrorist watch list checks.

1. Control of Secure Communications. The Contractor shall obtain and maintain DoD Secret security clearances for contractor employees, ship officers and/or crewmembers whose duties under this contract require access to classified material, communications, and equipment. The contractor shall operate DoD embarked communications capabilities for sending and receiving secure (encrypted) communications IAW all applicable regulatory access and physical security requirements, which include but are not limited to:

(a) Current version of DoD Manual 5220.22 (series) (Industrial Security Manual for Safeguarding Classified Information) and DoD 5220.22 (series) (COMSEC supplement)

(b) Current version of SECNAVINST 5510.30 (series) and 5510.36 (series) (DON Personnel Security Manuals)

(c) Current version of Communication Security Material System (CMS-1 series), Department of the Navy (DON) COMSEC Policy and Procedures Manual, Dated 08 Mar 2021

(d) Current version of COMSCINST 2280.3 (series), Policy and Procedures for Handling, Distribution, and Control of Communications Security Material within Military Sealift Command

2. Access to Secure Communications. All contractor employees, ship officers and/or crewmembers whose duties under this contract require access to DoD and MSC unclassified and classified Information Systems shall complete a SAAR-N in accordance with the current version of MSC QMS Procedure N6.62-5239-1-Q, System Authorization Access Request Navy Procedures. Additionally, these personnel shall obtain and use digital certificates issued from a DoD approved source on a DoD issued identification card or token. DoD issued Common Access Card (CAC) and DoD issued SIPRNet Token shall be used for authentication and access to DoD and MSC unclassified and classified Information Systems respectively. Government sponsorship for obtaining DoD issued identification cards or tokens shall be provided by the COR. If administrator level access is required by a contract employee, the contractor shall include identification of required access on the SAAR-N and the employee shall submit a CAC digitally signed Privileged Access Agreement (PAA) form, SECNAV 5239/1 (dated May 2017 or current version). In addition, the contractor shall submit the DoD approved training certification for Privileged Access with the PAA form.

3. Maintenance of Secure Communications. Contract employees assigned to operate communications equipment shall be qualified to perform maintenance at a Tier 0 (self-help) level. They shall have basic trouble-shooting capability to include but not limited to, retrieving support information from web and mobile pages or apps, including FAQs, detailed product and technical information, manuals, and interacting with distance support via phone. Contract employees shall perform patching activities as directed by DoDI 8531.01 DoD Vulnerability Management and report completion to the cognizant Information Systems Security Manager (ISSM) on a monthly basis or when otherwise directed. MSC HQ will provide patches to shipboard personnel. It is recommended that assigned contract employees attend MSC provided training for DoD embarked communications capabilities.

4. Cybersecurity. Contract employees are required to follow DoD, Navy, and MSC cybersecurity policies and procedures while operating MSC networks. Contract employees shall report all possible cybersecurity incidents on DoD embarked communications capabilities to the MSC ISSM and Cybersecurity team IAW applicable policies and guidance, which include but are not limited to:

(a) Current version of COMSCINST 5239.3C, MSC Cybersecurity Policy

(b) Current version of MSC N6.N62-5239-3-Q, MSC Cybersecurity Manual.

uu) SECURE SPACE

Vessel shall provide a secure space dedicated for the use of designated supercargo/government representatives with the capability of connecting DoD communication equipment as described in paragraph (a). The space must meet the Controlled Access Area (CAA) physical security requirements for operating and handling classified material in accordance with United States Navy Information Assurance (IA) Publication 5239-22 and the CAA Checklist, provided upon request. The secure space must be of sufficient size for a contractor provided desk to accommodate a government provided standard computer workstation, monitor, and government provided GSA safe securely mounted to the deck or bulkhead and must have a 110VAC, 15 Amp outlet for use.

vv) Safeguarding Covered Defense Information and Cyber Incident Reporting

The following language shall be used to supplement DFARS Clause 252.204-7012 entitled, "Safeguarding Covered Defense Information and Cyber Incident Reporting".

1. System Security Plan and Plans of Action and Milestones (SSP/POAM) Reviews

a) Within thirty (30) days of contract award, the Contractor shall make System Security Plan(s) (SSP(s)) for its covered contractor information system(s) available for review by the Government at the contractor's facility. The SSP(s) shall implement the security requirements in Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, which is included in this contract. The Contractor shall fully cooperate in the Government's review of the SSPs at the Contractor's facility.

b) If the Government determines that the SSP(s) does not adequately implement the requirements of DFARS clause 252.204-7012 then the Government shall notify the Contractor of each identified deficiency. The Contractor shall correct any identified deficiencies within thirty (30) days of notification by the Government. The contracting officer may provide for a correction period longer than thirty (30) days and, in such a case, may require the Contractor to submit a plan of action and milestones (POAM) for the correction of the identified deficiencies. The Contractor shall immediately notify the contracting officer of any failure or anticipated failure to meet a milestone in such a POAM.

c) Upon the conclusion of the correction period, the Government may conduct a follow-on review of the SSP(s) at the Contractor's facilities.

The Government may continue to conduct follow-on reviews until the Government determines that the Contractor has corrected all identified deficiencies in the SSP(s).

d) The Government may, in its sole discretion, conduct subsequent reviews at the Contractor's site to verify the information in the SSP(s). The Government will conduct such reviews at least every three (3) years (measured from the date of contract award) and may conduct such reviews at any time upon thirty (30) days' notice to the Contractor.

2. Compliance to NIST 800-171

a) The Contractor shall fully implement the CUI Security Requirements (Requirements) and associated Relevant Security Controls (Controls) in NIST Special Publication 800-171 (Rev. 1) (NIST SP 800-171), or establish a SSP(s) and POA&Ms that varies from NIST 800-171 only in accordance with DFARS clause 252.204-7012(b)(2), for all covered contractor information systems affecting this contract.

b) Notwithstanding the allowance for such variation, the contractor shall identify in any SSP and POA&M their plans to implement the following, at a minimum:

(1) Implement Control 3.5.3 (Multi-factor authentication). This means that multi-factor authentication is required for all users, privileged and unprivileged accounts that log into a network. In other words, any system that is not standalone should be required to utilize acceptable multi-factor authentication. For legacy systems and systems that cannot support this requirement, such as CNC equipment, etc., a combination of physical and logical protections acceptable to the Government may be substituted;

(2) Implement Control 3.1.5 (least privilege) and associated Controls, and identify practices that the contractor implements to restrict the unnecessary sharing with, or flow of, covered defense information to its subcontractors, suppliers, or vendors based on need-to-know principles;

(3) Implement Control 3.1.12 (monitoring and control remote access sessions) - Require monitoring and controlling of remote access sessions and include mechanisms to audit the sessions and methods.

(4) Audit user privileges on at least an annual basis;

(5) Implement:

i. Control 3.13.11 (FIPS 140-2 validated cryptology or implementation of NSA or NIST approved algorithms (i.e. FIPS 140-2 Annex A:

AES or Triple DES) or compensating controls as documented in a SSP and POAM); and,

ii. NIST Cryptographic Algorithm Validation Program (CAVP) (see https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program);

(6) Implement Control 3.13.16 (Protect the confidentiality of CUI at rest) or provide a POAM for implementation which shall be evaluated by the Navy for risk acceptance.

(7) Implement Control 3.1.19 (encrypt CUI on mobile devices) or provide a plan of action for implementation which can be evaluated by the Government Program Manager for risk to the program.

3. Cyber Incident Response:

a) The Contractor shall, within fifteen (15) days of discovering the cyber incident (inclusive of the 72-hour reporting period), deliver all data used in performance of the contract that the Contractor determines is impacted by the incident and begin assessment of potential warfighter/program impact.

b) Incident data shall be delivered in accordance with the Department of Defense Cyber Crimes Center (DC3) Instructions for Submitting Media available at http://www.acq.osd.mil/dpap/dars/pgi/docs/Instructions_for_Submitting_Media.

docx. In delivery of the incident data, the Contractor shall, to the extent practical, remove contractor-owned information from Government covered defense information.

c) If the Contractor subsequently identifies any such data not previously delivered to DC3, then the Contractor shall immediately notify the contracting officer in writing and shall deliver the incident data within ten (10) days of identification. In such a case, the Contractor may request a delivery date later than ten (10) days after identification. The contracting officer will approve or disapprove the request after coordination with DC3.

4. Naval Criminal Investigative Service (NCIS) Outreach

The Contractor shall engage with NCIS industry outreach efforts and consider recommendations for hardening of covered contractor information systems affecting DON programs and technologies.

5. NCIS/Industry Monitoring

a) In the event of a cyber incident or at any time the Government has indication of a vulnerability or potential vulnerability, the Contractor shall cooperate with the Naval Criminal Investigative Service (NCIS), which may include cooperation related to: threat indicators; pre-determined incident information derived from the Contractor's infrastructure systems; and the continuous provision of all Contractor, subcontractor or vendor logs that show network activity, including any additional logs the contractor, subcontractor or vendor agrees to initiate as a result of the cyber incident or notice of actual or potential vulnerability.

b) If the Government determines that the collection of all logs does not adequately protect its interests, the Contractor and NCIS will work together to implement additional measures, which may include allowing the installation of an appropriate network device that is owned and maintained by NCIS, on the Contractor's information systems or information technology assets. The specific details (e.g., type of device, type of data gathered, monitoring period) regarding the installation of an NCIS network device shall be the subject of a separate agreement negotiated between NCIS and the Contractor. In the alternative, the Contractor may install network sensor capabilities or a network monitoring service, either of which must be reviewed for acceptability by NCIS. Use of this alternative approach shall also be the subject of a separate agreement negotiated between NCIS and the Contractor.

c) In all cases, the collection or provision of data and any activities associated with this statement of work shall be in accordance with federal, state, and non-US law.