Attachment E - Performance Work Statement Rev.pdf

MILITARY SEALIFT COMMAND

DRY CARGO TIME CHARTER (DRYTIME – LONG TERM CHARTER)

RFP N32205-22-R-4021

Performance Work Statement for Diego Garcia Shuttle Vessel Charter

1. Overview: Contractor shall provide and safely operate one U.S. Flag self-sustaining combination container/breakbulk vessel that has the ability to lift and transport containerized cargo, refrigerated containers, flatracks, breakbulk, hazardous cargo and rolling stock to support military sustainment on the island of Diego Garcia. It is estimated without guarantee that the vessel will be in port 50% of the time and underway laden 50% of the time. This service is the primary transportation method for Naval Base Diego Garcia, a remote base located in the middle of the Indian Ocean and there for mission essential to the US Navy and Department of Defense.

2. Vessel Requirements:

• Speed of Advance (SOA). Vessels with a speed of 16.0 knots or faster SOA are not required to have hydraulic hatch covers. Vessel with a maximum speed less than 16 knots SOA are required to have hydraulic hatch covers.

• Minimum operating range of 8000 nautical miles.

• Maximum draft shall not exceed 35 feet.

• Minimum accommodations for two Supercargo.

• Owner to provide Ship’s characteristic Card, General Arrangement drawings, cargo

Capacity drawings

• Offeror shall include within its Technical Proposal copies of current Certificates and

Inspections as follows: International Ship Security Certificate, Safety Management Certificate, Applicable inspection and survey certificates (USCG, ABS, DNV, GL, etc.), An ISO 9001 Compliant QMS that has been certified by an accredited organization.

3. Cargo Requirements:

• Container capacity. The vessel shall accommodate a minimum of 230 twenty-foot equivalent unit (TEU) containers. Within the specified 230 TEU capacity, the vessel shall be able to accommodate various combinations of twenty-foot and forty-foot containers with the ability to carry a combination of at least 80 forty-foot containers and 70 twenty-foot containers.

• Vessel shall be capable of carrying a maximum load averaging 14 metric tons per container, 100 of which may weigh 22 metric tons, within acceptable limits for overall displacement (load line), trim, stability and hull stress as specified by the regulatory agency for that vessel.

• Vessel shall be capable of carrying 100,000 cubic feet of cargo with a minimum 10ft overhead clearance. Note: TEU and cubic feet requirements are exclusive of each other, i.e. ship shall be capable of 230 TEUs or 100,000 cubic feet of cargo.

• Refrigerated Cargo. Within the 230 TEU capacity specified above, vessel shall accommodate a minimum of 50 reefer containers, twenty-foot or forty-foot, with outlets, supplied from the ship’s internal electrical distribution system, capable of sustaining refrigerated TEU containers operating on:

• 200 VAC, 3 phase, 50/60 HZ

• 220 VAC, 3 phase, 60 HZ

• 380-415 VAC, 3 phase, 50 HZ

• 440 VAC, 3 phase, 60 HZ

• Vessel shall be capable of carrying all types of hazardous cargo with proper segregations and in compliance with IMDGC and CFR 49.

• Vessel shall be capable of carrying breakbulk ammunition with proper segregation. The government will sheath holds as required.

• Cargo stowage. The vessel shall be able to accommodate all standard types of dry cargo containers, refrigerated containers, flatracks and ISO tank containers. Vessel shall be equipped with sufficient quantities of matching stacking cones, automatic twist locks, container deck sockets, “D” ring fittings for container deck sockets capable of lashing breakbulk cargo, chains and binders for lashing breakbulk cargo and bar type lashing gear for carriage and securing of all containers in stacks of two-high minimum on deck. All lashing and securing gear shall be provided by the vessel owner.

• Cargo Handling. Vessel shall be self-sustaining for the loading and discharging of breakbulk, containerized and vehicle cargoes. Vessel shall be equipped with at least two cranes with a minimum of 30 LT SWL lifting capacity at all hatches where twenty or forty foot containers are stowed and have the capability of lifting 50 LT SWL in tandem.

Vessel shall be equipped with certified a twenty-foot and a forty-foot spreader bar for each cargo crane. Spreader bars shall be supplied by the vessel owner.

• Deck Capacity. Tank tops intended for stowage shall be designed to accommodate heavy vehicles, up to and including the M-1 tank with a uniformly distributed load of minimum 525 PSF. Decks shall be capable of supporting local loads imposed by such vehicles without recourse to mandatory parking patterns. These decks shall also be capable of supporting lighter vehicles with smaller footprints, which may impose more severe local loading and specific deck structures such as fully loaded 2.5-ton trucks or forklift trucks.

No grating is permitted on decks intended for cargo stowage.

4. Special Requirements:

A. Operational Metric Reporting Requirements. the Contractor shall provide quarterly reports that include the following information as instructed per Attachment M – Contract Data Requirements List (CDRL), a.Time On Hire.

b. Time Off Hire with explanation including analysis of root cause(s) and by what means such off hire will be prevented in the future.

c. Condition of Class or USCG CG-835F reports resolved during the quarter, including any remaining open reports at time of quarterly report submission along with estimated date of completion.

d. Date of last inspection performed by Contractor management staff including a summary of any findings or observations that may impact future vessel operations or schedule integrity.

e. This quarterly report is due to the Contracting Officer Representative on 01OCT, 01JAN, 01APR and 01JUL within the contract period of performance.

B. Secure Communications. Satellite Communications. Vessel shall provide an operational FLEET Broadband (FBB) 500 Terminal FBB Sim Chip provisioned to allow dedicated ISDN 64K Universal Dynamic Interface (UDI) 3.1khz for voice and facsimile.

The Vessel shall be equipped with a separate, suitable, and securable communication space designated and equipped for the Government to operate and maintain special communications equipment. The space, at a minimum shall have adequate square footage in which Contractor-furnished and MSC-furnished equipment can be operated and maintained.

While MSC furnished equipment is installed, the Vessel shall be capable of supporting secure (encrypted) communication equipment by complying with DOD and DON guidance on proper access, handling and disposition of classified material. The Contractor shall comply with physical security requirements in the following publications, available upon request:

DOD Manual 5220.22-M (Industrial Security Manual for Safeguarding Classified E- Information) and DOD 5220.22-S (COMSEC supplement) SECNAVINSTs 5510.30 (series) and 5510.36 (series) COMSCINST 2280.3 (series) (COMSEC and EKMS Policy)

C. Safeguarding Covered Defense Information and Cyber Incident Reporting.

The following language shall be used to supplement DFARS Clause 252.204-7012 entitled, "Safeguarding Covered Defense Information and Cyber Incident Reporting".

1. System Security Plan and Plans of Action and Milestones (SSP/POAM) Reviews

a) Within thirty (30) days of contract award, the Contractor shall make its System Security Plan(s) (SSP(s)) for its covered contractor information system(s) available for review by the Government at the contractor's facility. The SSP(s) shall implement the security requirements in Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, which is included in this contract. The Contractor shall fully cooperate in the Government's review of the SSPs at the Contractor's facility.

b) If the Government determines that the SSP(s) does not adequately implement the requirements of DFARS clause 252.204-7012 then the Government shall notify the Contractor of each identified deficiency. The Contractor shall correct any identified deficiencies within thirty (30) days of notification by the Government. The contracting officer may provide for a correction period longer than thirty (30) days and, in such a case, may require the Contractor to submit a plan of action and milestones (POAM) for the correction of the identified deficiencies. The Contractor shall immediately notify the contracting officer of any failure or anticipated failure to meet a milestone in such a

POAM.

c) Upon the conclusion of the correction period, the Government may conduct a follow-on review of the SSP(s) at the Contractor's facilities.

The Government may continue to conduct follow-on reviews until the Government determines that the Contractor has corrected all identified deficiencies in the SSP(s).

d) The Government may, in its sole discretion, conduct subsequent reviews at the Contractor's site to verify the information in the SSP(s). The Government will conduct such reviews at least every three (3) years (measured from the date of contract award) and may conduct such reviews at any time upon thirty (30) days' notice to the Contractor.

2. Compliance to NIST 800-171

a) The Contractor shall fully implement the CUI Security Requirements (Requirements) and associated Relevant Security Controls (Controls) in NIST Special Publication 800-171 (Rev. 1) (NIST SP 800-171), or establish a SSP(s) and POA&Ms that varies from NIST 800-171 only in accordance with DFARS clause 252.204-7012(b)(2), for all covered contractor information systems affecting this contract.

b) Notwithstanding the allowance for such variation, the contractor shall identify in any SSP and POA&M their plans to implement the following, at a minimum:

(1) Implement Control 3.5.3 (Multi-factor authentication). This means that multi-factor authentication is required for all users, privileged and unprivileged accounts that log into a network. In other words, any system that is not standalone should be required to utilize acceptable multi-factor authentication. For legacy systems and systems that cannot support this requirement, such as CNC equipment, etc., a combination of physical and logical protections acceptable to the Government may be substituted;

(2) Implement Control 3.1.5 (least privilege) and associated Controls, and identify practices that the contractor implements to restrict the unnecessary sharing with, or flow of, covered defense information to its subcontractors, suppliers, or vendors based on need-to-know principles;

(3) Implement Control 3.1.12 (monitoring and control remote access sessions) - Require monitoring and controlling of remote access sessions and include mechanisms to audit the sessions and methods.

(4) Audit user privileges on at least an annual basis;

(5) Implement:

i. Control 3.13.11 (FIPS 140-2 validated cryptology or implementation of NSA or NIST approved algorithms (i.e. FIPS 140-2 Annex A:

AES or Triple DES) or compensating controls as documented in a SSP and POAM); and,

ii. NIST Cryptographic Algorithm Validation Program (CAVP) (see https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program);

(6) Implement Control 3.13.16 (Protect the confidentiality of CUI at rest) or provide a POAM for implementation which shall be evaluated by the Navy for risk acceptance.

(7) Implement Control 3.1.19 (encrypt CUI on mobile devices) or provide a plan of action for implementation which can be evaluated by the Government Program Manager for risk to the program.

3. Cyber Incident Response:

a) The Contractor shall, within fifteen (15) days of discovering the cyber incident (inclusive of the 72-hour reporting period), deliver all data used in performance of the contract that the Contractor determines is impacted by the incident and begin assessment of potential warfighter/program impact.

b) Incident data shall be delivered in accordance with the Department of Defense Cyber Crimes Center (DC3) Instructions for Submitting Media available at http://www.acq.osd.mil/dpap/dars/pgi/docs/Instructions_for_Submitting_Media.

docx. In delivery of the incident data, the Contractor shall, to the extent practical, remove contractor-owned information from Government covered defense information.

c) If the Contractor subsequently identifies any such data not previously delivered to DC3, then the Contractor shall immediately notify the contracting officer in writing and shall deliver the incident data within ten (10) days of identification.

In such a case, the Contractor may request a delivery date later than ten (10) days after identification. The contracting officer will approve or disapprove the request after coordination with DC3.

4. Naval Criminal Investigative Service (NCIS) Outreach

The Contractor shall engage with NCIS industry outreach efforts and consider recommendations for hardening of covered contractor information systems affecting DON programs and technologies.

5. NCIS/Industry Monitoring

a) In the event of a cyber incident or at any time the Government has indication of a vulnerability or potential vulnerability, the Contractor shall cooperate with the Naval Criminal Investigative Service (NCIS), which may include cooperation related to: threat indicators; pre-determined incident information derived from the Contractor's infrastructure systems; and the continuous provision of all Contractor, subcontractor or vendor logs that show network activity, including any additional logs the contractor, subcontractor or vendor agrees to initiate as a result of the cyber incident or notice of actual or potential vulnerability.

b) If the Government determines that the collection of all logs does not adequately protect its interests, the Contractor and NCIS will work together to implement additional measures, which may include allowing the installation of an appropriate network device that is owned and maintained by NCIS, on the Contractor's information systems or information technology assets. The specific details (e.g., type of device, type of data gathered, monitoring period) regarding the installation of an NCIS network device shall be the subject of a separate agreement negotiated between NCIS and the Contractor.

In the alternative, the Contractor may install network sensor capabilities or a network monitoring service, either of which must be reviewed for acceptability by NCIS. Use of this alternative approach shall also be the subject of a separate agreement negotiated between NCIS and the Contractor.

c) In all cases, the collection or provision of data and any activities associated with this statement of work shall be in accordance with federal, state, and non- US law.

D. Delivery Schedule/Progress Chart. The Offeror shall provide an initial Plan of Action and

Milestones (POAM) in Microsoft Project compatible format. The POAM Gantt chart shall include the major tasks affecting delivery of the vessel including all modifications or reflagging requirements if applicable. Each task shall contain the below information. A projected Delivery date shall be provided.

A) The anticipated start date, end date and overall duration B) Task dependencies, usually indicated by arrows on the Gantt chart (“x” must be completed before/after “y” starts, milestone “a” must be passed before task “b” starts, etc.)

C) The critical path, typically defined as the sequence of project activities which add up to the longest overall duration. This determines the shortest time possible to complete the project. Any delay of an activity on the critical path directly impacts the planned project completion date.

D) Post award changes to the critical path that will cause delay to delivery date needs to be provided to MSC along with corrected plan to meet delivery date.

E. Vessel Accounting Report. Vessel owner shall provide an accounting report to the COR for each month on hire and no later than by the 5th of the following month. This report shall include description and dollar amounts of cost incurred that month to include; invoice with item/ description and pending invoiced amount with clin numbers.

F. CAC Reporting. A report shall be made to the Contracting Officer within 24 hours of discovering any CAC is lost, stolen, or destroyed. The Contracting Officer will then generate a report to 1) the Trusted Agent for cancellation of the card, 2) the local U.S. Military Security Office, and 3) the appropriate MSC Area Command and MSC Headquarters N3 (Operations).

G. Custody of Medical Items Including Controlled Substances. The Master shall ensure all medical equipment is maintained in good working order at all times. The Master shall establish and maintain adequate and reasonable controls and procedures for the custody and safekeeping of all medical supplies and equipment. The quantity and type of controlled medicinal substances are limited to the AMAL (Authorized Medical Allowance List) requirements. The Master shall maintain and inventory controlled substances (e.g. narcotics) IAW COMSCINST 6000.1 (series) and NAVMED P-117 and include, as a minimum, the following steps:

• The Master shall designate in writing an “Inventory Board” to include the Master and one (1) or two (2) other officers not directly involved with procurement.

• The Inventory Board shall conduct a quarterly inventory of all controlled substances and sign a written record of such inventory for the file.

• Upon the relief of one (1) Master by another Master, the two (2) shall conduct, record and sign a full inventory of the controlled substances.

• The Contractor shall report to the Contracting Officer any unauthorized use of controlled substances or any discovered discrepancy and record in the Ship’s Log and Medical Journal.

H. Reports and Documentation. The Master shall make regular reports directly to the applicable MSC Area Commander and MSC Headquarters N3 (Operations) in regards to all matters that affect the Vessel’s readiness and ability to get underway. Equipment casualties, fuel consumption and personnel problems affecting the Vessel's readiness shall be reported. The Vessel shall arrive on-station with a complete set of operating instructions, books, and technical manuals.

I. Quality Management System (QMS). The Contractor shall, within six (6) months of contract award, have and maintain a certified Quality Management System. The QMS shall include an assessment of the Contractor’s quality management process, process controls, inspections, tests, and should be focused on preventing, controlling, and detecting defects. The QMS will be ISO-9000 (or equivalent) certified by an independent external body that has audited the Contractor’s management system and verified that it conforms to the requirements specified in the standard. The Contractor shall maintain full and continuous quality system certification for the entire period of performance of the contract. The Contractor shall notify the Contracting Officer within 24 hours if for any reason their QMS certification is revoked. Costs associated with the QMS shall be included in the fixed price per diem.

J. DFARS Compliance Certification. The contractor’s InfoSec measures shall be certified to be in compliance with DFARS 252.204-7012 by an accredited third party organization. The Contractor shall attain DFARS compliance certification within 60 days of commencement of performance under the contract, and shall maintain it continuously for the entire remaining period of performance. The Contractor shall notify the Contracting Officer within 24 hours if for any reason the certification is revoked. Costs associated with attaining and/or maintaining certification will not be reimbursed by the Government.

K. Certification Documentation. The Contractor shall provide a copy of the third-party DFARS 252.204-7012 compliance certification to the Contracting Officer and COR(s) in accordance with the below schedule. The Government reserves the right to contact the certifying institution directly to obtain additional information or to confirm the validity of the certificate or certification process.

• Initial certification to be provided to the Government upon receipt.

• If base period is six months or less, the initial certification is considered valid for both the base and first option periods.

• Thereafter, the Government requires the contractor to submit annual recertification documentation no later than 14 days prior to end of current performance period, except if it is the last performance period of the contract.

L. Ship Physical Security Equipment. The Government will furnish the Vessel physical security equipment per FP AEL 2-32MSC4362 upon Vessel delivery. The Contractor shall designate a separate space for stowage and maintain equipment in accordance with COMSCINST 5530.3 (series). An itemized listing of specific quantities will accompany the equipment and will be presented for custody receipt. The Master shall maintain a current inventory of this equipment, shall inventory monthly and submit the inventories on an annual basis to MSCHQ N321 or as requested by the Government. See Attachment H for additional information.

M. Small Arms and Ammunition. The Government will outfit the Vessel with small arms and ammunition for use by the Ship’s crew to provide Force Protection (FP) within the lifelines of the Vessel. The Master shall be responsible for the custody of all small arms and shall maintain custodial control and accountability, by serial number. Small arms shall only be utilized onboard the Vessel to protect MSC assets and crew. The Master is authorized to issue small arms to crewmembers that are trained in their use IAW OPNAVINST 5530.13 (series) and COMSCINST 5530.3 (Series). MSCHQ N47 will coordinate for a small arms inventory annually in accordance with NAVSEAINST 8370.2 (series). See Attachment H for additional information.

N. Ammunition Allowance. The Government will issue ammunition in accordance with the Ship's (classified) SHIPFILL allowance listing. The Ordnance Accounting Ashore (OAA) will be responsible for all Ammunition Accounting Reporting, and Periodic Lot Reporting (PLR).

The Vessel’s Master shall receive ammo and notify OAA via email at msc_ordnance@navy.mil or by phone (per phone numbers in the OAA Handbook) of all ammo transactions. See Attachment H for additional information.

O. The follow Appendix’s are applicable to this contract. Each attachment describes specific duties and responsibilities of the contractor under this contract or requests information on the offered vessel.

a) Attachment IX (A) - Government Furnished Property (GFP) and Directives- provides the listing of government property for this contract.

(b) Attachment IX (D) - DD Form 254, Contract Security Classification Specification

(c) Attachment IX (E) - Vessel Requirements & Performance Work Statement (PWS)- provides technical details for this particular charter including minimum requirements for vessel and related cargo requirements

(d) Attachment IX (H) - Anti-Terrorism/Force Protection (AT/FP) Requirements- provide operator and crew’s responsibilities, training, and reporting for AT/FP for the vessel.

(e) Attachment IX (I) - Specifications for Chemical, Biological and Radiological Defense (CBR-D) Decontamination Station- provides design and operations requirements

(f) Attachment IX (J) - Shipboard Security System (SSS) Requirements – Outlines Shipboard Security System (SSS). Include the following components:. Hull Perimeter Lighting (HPL), Closed Circuit TV (CCTV), Intrusion Detection System (IDS), Audible Warning System

(AWS).

(h) Attachment IX (K) – Chemical, Biological, Radiological and Nuclear Defense Requirements

(CBRN)

(i) Attachment IX (L) - COMSCINST 3121.9 Series, MSC Standard Operating Manual (SOM)- Outlines operation requirements, processes and reporting for MSC ships.

(j) Attachment IX (M) - Contract Data Requirement List (CDRL)- Provides a list of reports and data required under this contract.

(k) Attachment IX (Q) - Technical Evaluation Worksheet- provides technical data for this requirement that that will be used to determine vessel’s technical acceptability.

(l) Attachment IX (S) – Drawings Decontamination Stations- Outlines the needed drawing requirements for the vessels decontamination stations

(m) Attachment IX (T) – Ships Characteristics Card- Document that provides technical characteristics of the vessel, such as vessels size and capacities, crane characteristics, hold capacities and other vessel data.