Attach-1_Sealift_PWS.pdf

Performance Work Statement (PWS) Thule Air Base Sealift

14 Dec 2018

Table of Contents 1 Background and Scope

2 General Requirements

2.1 Non-Personal Services

2.2 Vessel Registry

2.3 Government Multifunctional Team (MFT) Members

2.4 Standards and Publications

2.5 Business Relations

2.6 Contract Administration

2.7 Contractor Personnel, Disciplines, and Specialties

3 Performance Requirements

3.1 General

3.2 Cargo Receipt, Processing, Loading, Transport and Offloading

4 Cyber Security and Foreign Entity Vetting

4.1 General Cyber Security Requirements

4.2 Cyber Security Assessments and Mitigation Plans

4.3 Cyber Incident Reporting

4.4 Foreign Entity Vetting

5 Deliverables

6 Services Summary

Appendix 1 - Abbreviations and Acronyms

Appendix 2 - Definitions

Appendix 3 – NIST SP 800-171 Self-Assessment Modified Controls

Appendix 4 – Cyber Security Plan of Action Template

Thule Air Base Sealift Contract 1 Background The United States Air Force (USAF) has a recurring requirement for ocean charter transportation to Thule Air Base (AB), Greenland. Thule AB is located 695 miles north of the Arctic Circle and 947 miles south of the North Pole on the Northwest side of the island.

The scope of this requirement is all management, labor and services to accomplish the functions and responsibilities of receiving cargo from vendors, providing in-transit origin storage, loading/offloading and the ocean transport of United States (US) Government and US Government Sponsored cargo to and from Denmark and Thule AB, Greenland. Cargo types include, but are not limited to, general dry cargo, lumber, cement, dangerous cargo, iron pipe, insulation, frozen cargo, chilled/refrigerated cargo, vehicles, heavy machinery, and full 20 and 40 foot containers.

2 General Requirements The requirements have been organized in a manner that facilitates clear and concise description.

Any reference to “Government” within this Performance Work Statement (PWS) is intended to be reference to the Government of the United States of America unless otherwise specified.

In any dispute arising out of this contract, the decision of which requires consideration of questions of law, the rights and obligations of the parties shall be interpreted in accordance with the substantive laws of the United States of America.

2.1 Non-Personal Services

This is a non-personal services contract as defined in Federal Acquisition Regulation (FAR)

37.101. The Government shall neither supervise contractor employees nor control the method by which the contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual contractor employees. It shall be the responsibility of the contractor to manage its employees and to guard against any actions that are of the nature of personal services, or give the perception of personal services. If the contractor believes that any actions constitute, or are perceived to constitute personal services, it is the contractor’s responsibility to notify the Contracting Officer (CO) in writing immediately.

2.2 Vessel Registry

In accordance with the Cargo Preference Act of 1904 (10 U.S.C. 2631) only US flag vessels shall be used for the ocean transport of US Government or US Government sponsored cargo between Denmark and Greenland.

2.3 Government Multifunctional Team (MFT) Members

Solely, the contracting officer is responsible for administering the contract, the MFT supports the contracting officer to manage the contract through assessing contractor performance and working to improve customer support. The MFT is comprised of Government representatives including the Program Manager (PM), Contracting Officer (CO), Quality Assurance Manager (QAM), and Contracting Officer’s Representative (COR).

CORs from the functional area receiving the contract services will participate in the administration of this contract specifically to evaluate contractor performance, inspect the services for the Government, and provide a report of inspection to the CO. This designation does not include authority to direct and/or authorize the contractor to make changes in the scope or terms of the contract without the written authority of the CO. The contractor will be notified in writing by the CO of the names, duties, and limitations of the CORs.

Inspection and acceptance of the services required by the PWS will be performed at the ports of embarkation and debarkation in Denmark and at Thule AB.

2.4 Standards and Publications

The contractor shall comply with all directives listed as standards (STD) in this PWS under paragraph 3. If a referenced directive requires compliance with one or more secondary directives, those secondary directives shall be used as guidance and are not mandatory unless specifically required within this PWS. If no standard is explicitly listed for a requirement, contractor operations will comply with industry or commercial standards.

When directive chapters, paragraphs, appendices, attachments, etc. are referenced, the STD shall be inclusive of all subordinate paragraphs unless specifically excluded. For example, if the PWS STD lists paragraph 1.2 and paragraph 1.2 has subparagraphs 1.2.1, 1.2.1.1 and 1.2.1.2, those subparagraphs are directive.

The contractor shall comply with the most recent directive. All contractor operations shall comply with the current version of the directives. The contractor shall notify the CO in writing within 30 days of directive revisions, changes, supplements and rescissions. If there is any cost impact resulting from such revisions, changes, supplements and rescissions the contractor shall provide the cost information with the notification. If the CO is not notified in writing within 30 days, the contractor shall perform in accordance with directive revisions, changes, supplements and rescissions at no increase to contract price.

Days referenced in this PWS shall be calendar days, unless otherwise noted. Cargo referenced in this PWS is US Government or US Government sponsored cargo.

2.5 Business Relations

The contractor shall integrate and coordinate all activity needed to execute the requirement. The contractor shall manage the timeliness, completeness and quality of problem identification and resolution. The contractor shall provide corrective action plans, proposal submittals, and timely identification of issues. The contractor shall seek to ensure customer satisfaction and professional and ethical behavior of all contractor personnel.

2.6 Contract Administration

The following subsections specify requirements for contract requests and contracted rates and basis.

2.6.1 Contract Requests

The contractor shall have at least one point of contact for contract administrative duties. This contact(s) will be provided to the Government immediately following contract award.

2.6.2 Contracted Rates

Services on this contract shall be provided to the Government at or below the rates stipulated in Section B – Price Schedule. The shipping rates listed in Section B – Price Schedule shall include all costs incident to delivery from "dock-to-dock." Whereas the Sealift contractor performs offloading and loading of all vessels at Thule AB during established port season/hours, the Government shall not be charged separately for such offloading and loading.

2.7 Contractor Personnel, Disciplines, and Specialties

The contractor shall accomplish the assigned work by employing and utilizing qualified personnel with education, certifications, training, and experience IAW the International Code for Ships Operating in Polar Waters (Polar Code).

2.7.1 Employee Identification

Employees will, while on duty at a Government installation, wear in plain view on the upper portion of the outer garment a metal or plastic identification badge to be furnished by the contractor containing the company name, employee's name, and company identification number of employee, if any. Departure from ship by contractor personnel onto main base shall be coordinated prior with Danish Liaison Officer.

2.7.2 Security Clearance

The work associated with this PWS for the contractors is at the UNCLASSIFIED level. At no time will contractors be authorized to transport classified/sensitive material that will require a national security determination (security clearance).

Additionally, the contractor shall not divulge any Government financial, planning, programming, or budgeting information without the express consent of the Government as outlined in Operational Security (OPSEC) and Information Security regulations. UNLCLASSIFIED//For Official Use Only material will not be released without the approval of the CO.

2.7.3 Country Clearances

All US personnel must acquire a country clearance per 821 SPTS/LG requirements in order to qualify for employment. Evidence of screening will be provided annually by the contractor to the CO by 1 Jun and will be in the possession of the contractor when in port at Thule AB and available for Government review.

2.7.4 Language

All information and documentation required to be generated or maintained (to include Government-furnished documents) by this contract are in English.

2.7.5 Security, Cyber Security and Force Protection

The contractor will comply with all requirements in Appendix 3.

3 Performance Requirements The following section specifies the performance requirements for the contract.

3.1 General

3.1.1 Designate the port(s) of embarkation in Denmark and location of origin storage.

Port and storage location could be same location. For all cargo shipments to Thule AB.

Deliverables A001, Port of Embarkation and Origin Storage

3.1.2 Provide most recent and complete copies of the following certificates:

1) The vessel Polar Ship Certificate,

2) The Safety Management Certificate (SMC),

3) The Company Document of Compliance,

4) The vessel International Ship Security Certificate (ISSC),

5) The vessel Document of Compliance for the Carriage of Dangerous Goods

(IMDG) certificate and,

6) The most recent and complete Certificate of Inspection (COI)

Performance Standards

a) STD: In accordance with (IAW) the International Code for Ships Operating in Polar Waters (Polar Code) paragraph 1.3

A002, Vessel Certificates

3.1.3 Secure and protect all cargo while in the custody of the contractor.

Includes the origin storage, port(s) in Denmark, ocean freight transport and destination handling during loading/offloading.

Performance Standards

a) STD: From loss, theft and/or any other damage, including adequate protection of cargo against inclement or unusually severe weather

3.1.3.1 Provide proof of insurance.

Performance Standards

a) STD: IAW DFARS 252.247-7007

A003, Proof of Insurance

3.1.4 Report Contractor direct labor hours and dollars (to include Subcontractor hours and dollars) required for performance of services provided under this contract.

Fill in all required data fields. Information provided is considered to be proprietary in nature when the contract number and Contractor identity are associated with the direct labor hours and direct labor dollars.

Performance Standards

a) STD: Annually; NLT end of fiscal year (EOFY) + 30 days

b) STD: Using Electronic Contractor Manpower Reporting Application (eCMRA) at https://afcmra.hgda.pentagon.mil/

3.1.5 Develop a Quality Program Plan (QPP).

A004, QPP

3.1.5.1 Implement and maintain a Quality Management System

Robust enough and resourced adequately to execute four key functions: 1) Detection of quality program problems and defects; 2) Identification of root causes for quality related problems/defects;

3) Correction of root causes related to detected problems/defects; and, 4) Follow-up to ensure quality related problems/defects do not recur.

Performance Standards

a) STD: Quality Program Plan

b) STD: To proactively handle quality issues

3.1.5.2 Report impacts of conditions outside contractor control that effect the ability to meet contractual requirements or schedules.

a) STD: Written notification to the CO, PM, QAM and COR within 24 hours of occurrence

3.2 Cargo Receipt, Processing, Loading, Transport and Offloading

3.2.1 Establish fixed arrival and departure dates for all vessels.

Estimate of projected quantities/types of cargo, by CLIN, will be Government-furnished annually by 1 Apr by the CO in writing.

Performance Standards

a) STD: Mutually agreed to between contractor and CO

b) STD: First vessel shall arrive at Thule AB prior to 7 July

c) STD: Second vessel shall arrive at Thule AB after 15 August and depart Thule AB prior to 1 September

A005, Sealift Schedule

3.2.1.1 Establish the final date(s) of acceptance of cargo for each vessel.

A005, Sealift Schedule

3.2.1.2 Notify the Thule BMC of estimated time of arrival for all cargo vessels.

BMC contact information will be Government-furnished annually by 1 Apr by the CO in writing.

a) STD: In writing NLT 72 hours in advance of vessel arrival at Thule AB

3.2.1.3 Make notifications of any schedule or cost impact resulting from weather conditions, real-world security conditions, or declared crises and states of emergencies.

a) STD: Written notification to CO and COR immediately upon occurrence

3.2.2 Receive and book cargo at origin storage in Denmark.

Cargo will be duly packed by the vendor for export shipment by ocean vessel and will be marked, labeled, and accompanied by freight warrant(s) and export certificate(s) at time of delivery to the origin storage.

Performance Standards

a) STD: All cargo received IAW final acceptance dates established in A005, Sealift Schedule, which is accompanied by the required paperwork

a) STD: Coordinate delivery/receipt schedule with the vendor after receipt of documentation, such as bills of lading

b) STD: Notify vendor and CO in writing within 48 hours of any cargo that is damaged upon receipt

c) STD: Notify vendor and CO in writing within 48 hours of any cargo that is improperly packed for ocean transportation or not accompanied by the required documentation

3.2.3 Store cargo at origin storage location.

a) STD: From time of delivery from the vendor until time of shipment

b) STD: Includes all types of cargo to include, but not limited to, general cargo, construction materials, frozen and chilled cargo

3.2.4 Process, handle and prepare necessary cargo documentation prior to loading cargo for shipment.

Includes manifests, bill of ladings, booking requests, stowage plans and receiving reports.

a) STD: For cargo shipments to Thule AB and cargo return to Denmark

3.2.4.1 Provide final ship manifests.

A006, Final Ship Manifests

3.2.4.2 Provide a pre-stowage plan.

A007, Pre-Stowage Plan

3.2.5 Load and secure cargo destined for Thule AB into containers and onto ocean vessel.

Containers with clearly marked container numbers; containers are clean, dry, empty, odor free, suitable for protecting cargo from damage.

Performance Standards

a) STD: Manufacturer’s recommendations and commercial standards

b) STD: Containers comply with International Standards Organization (ISO), International Maritime Organization (IMO), and Convention of Safe Containers (CSC) standards

c) STD: Refrigerated containers that maintain a temperature within three degrees Fahrenheit of the in-transit temperature specified for controlled atmosphere and straight chill, and five degrees Fahrenheit for frozen

d) STD: Refrigerated containers have continuous measurement of internal temperature using a Ryan-type recorder or equivalent capable of continuous recording from availability date for a minimum period of 90 days

e) STD: Cargo to be containerized to the maximum extent possible, vice using break bulk

f) STD: Containers shall be packed as full as possible and by the most economical method to the Government

g) STD: To the extent possible containers must be packed with contents from the same vendor

3.2.5.1 Provide listing of all Department of Defense (DoD) owned or DoD leased containers

A008, DoD Owned/Leased Container Listing

3.2.5.2 Maintain documented inventory of vessel supplies and lashing gear Includes items such as, but not limited to, chains, binders, straps, and rods.

a) STD: Sufficient to cover contracted load

3.2.6 Transport cargo via ocean vessel.

a) STD: Using vessels appropriately rated for the severe ice conditions present in the Greenland waters

b) STD: Using vessels operated and maintained IAW the International Code for Ships Operating in Polar Waters (Polar Code)

c) STD: IAW the International Code for Ships Operating in Polar Waters (Polar Code)

3.2.6.1 Provide Departure, Movement, Position, Arrival report.

a) STD: Initiated when the vessel leaves port concluding upon arrival at destination

A009, Departure/Movement/Position/Arrival Report

3.2.6.2 Identify and report vessel equipment casualties.

a) STD: Affecting vessel’s proper operation, vessel’s ability to meet the agreed upon schedule, or the loading/discharging of the cargo

A010, Vessel Equipment Casualties

3.2.6.3 Maintain cargo containers while in transit.

a) STD: Manufacturers recommendations and commercial standards

b) STD: Continuous operation of refrigerated containers to maintain temperatures

3.2.6.4 Maintain all material handling equipment (MHE) and cargo gear.

a) STD: Manufacturer’s recommendations and commercial standards

b) STD: Ability to perform 24-7 cargo operations

3.2.7 Deliver and offload cargo at Thule AB.

Exact dates and hours of port operation at Thule AB will be Government-furnished annually by 1 May by the CO in writing. Thule AB port operates approximately 60 days normally between 1 July and 1 September.

Performance Standards

a) STD: During the port season and port operating hours

b) STD: IAW fixed arrival and departure dates established in A005, Sealift Schedule

c) STD: Delivery point at Thule AB is “on the pier”

d) STD: All offloading will be performed by the Sealift contractor IAW manufacturer’s recommendations and commercial standards

e) STD: For any services rendered by the Thule BMC outside the normal port season or operating hours, the reimbursement for direct labor, material, equipment or vehicle charges are a matter between the BMC and the Sealift contractor, and are not billed against this contract

3.2.8 Load cargo destined for Denmark onto ocean vessel.

a) STD: Manufacturer’s recommendations and commercial standards

3.2.9 Deliver and offload cargo at port in Denmark.

a) STD: Delivery point in Denmark is the port of embarkation as defined in PWS para 3.1.1

b) STD: All offloading will be performed by the Sealift contractor IAW manufacturer’s recommendations and commercial standards

c) STD: Coordinate delivery/pickup schedule with the vendor

4 Cyber Security and Foreign Entity Vetting

4.1 General Cyber Security Requirements

4.1.1 Handling and Protection of Non-Public Information.

In performance of this contract, the contractor may have access to DoD Transactional Information (DTI), which for the purposes of this section shall mean any information developed or received in the course of planning, ordering, shipping, tracking, and invoicing in support of the requirements of this contract. To adequately protect this DTI, contractor information systems (IS) involved in the performance of this contract shall comply with the security requirements in the current version of the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations.” Compliance with NIST SP 800-171 measures is required at the prime contractor level and does not apply to subcontractors and other entities that the prime contractor engages with in order to meet the requirements of this contract.

Additionally, the contractor agrees to use such information only for the purposes of fulfilling the contracted requirements and to protect such information from unauthorized release or disclosure.

Protection of the DTI does not abrogate any responsibilities of the contractor to comply with or implement additional cyber security requirements as part of generally accepted system security principles or as required by other categories of information that may be co-resident with the DTI on the contractor’s IS.

4.2 Cyber Security Assessments and Mitigation Plans

4.2.1 Self-Assessment

The contractor shall provide a Self-Assessment of its compliance with NIST SP 800-171.

Attachment 3 provides modified requirements of Controlled Unclassified Information (CUI) and Covered Defense Information (CDI) (CUI/CDI) specific controls from NIST SP 800-171 that will be used to evaluate compliance in a non-CUI/CDI environment. Any requests to vary from NIST SP 800-171 shall be submitted to the Government for consideration and approval. The Contractor need not implement any security requirement determined by the Government to be non-applicable or to have an equally effective alternative security measure implemented in its place.

A011, Cyber Security Self-Assessment

4.2.2 Plan of Action

At any time during the period of performance, when a contractor determines it is non-compliant with a NIST SP 800-171 requirement or an approved alternate means of compliance resulting in a High or Moderate Potential Impact as defined in Federal Information Processing Standards Publication (FIPS PUB) 199, “Standards for Security Categorization of Federal Information and Information Systems,” the contractor shall submit a Plan of Action.

A012, Cyber Security Plan of Action

4.2.3 Site Visit

The CO or COR may conduct an on-site visit to a contractor's facility or request a third-party assessment (Government agency or Government funded commercial entity) to review progress towards meeting their Plan of Action, evaluate any proposed variances to NIST SP 800-171 requirements, and to assess residual risk to the DTI resulting from the non-compliance. Date and time of on-site visits will be mutually agreed-upon by the CO or COR and the contractor in advance.

4.3 Cyber Incident Reporting

When the contractor discovers a cyber incident, as defined in DFARS Clause 252.204-7012, that affects the contractor’s ability to perform the operationally critical support as identified in the contract, the contractor shall, as soon as practicable, but no later than 72 hours after discovering the incident, notify the CO and COR in writing. The contractor shall provide an initial description of the incident that will include the information known at the time of the notification and shall provide a company POC who shall work with the CO and COR through the resolution of the incident. The contractor shall also report the incident as outlined in DFARS 252.204-7012.

The CO or COR may conduct an on-site review to assist the contractor in evaluating the extent of the incident and to share information in an effort to minimize the impact to both parties. Date and time of on-site visits will be mutually agreed-upon by the CO or COR and the contractor in advance.

4.4 Foreign Entity Vetting

4.2.2 Subcontractor Suitability

Contractors shall submit a semi-annual report to the Government for each first-tier foreign transportation service provider, operating as a separate legal entity, contracting directly with contractor or its commonly owned legal affiliate which has employees who may have physical contact with Government shipments in the ordinary course of contract performance. First tier foreign transportation service providers within scope include, but are not limited to: freight forwarders, customs brokers, stevedoring service providers, other brokers, and trucking companies.

A013, Foreign Entity Information Sheet

The Contractor is not required to limit reporting solely to subcontractors used for services under the contract, but rather, may provide a complete list of subcontractors within scope in contractor’s network. Additionally, the contractor shall be held to a collection and reporting standard measured by customary commercial practices; the Government acknowledges that this is a cooperative effort.

The contractor is responsible for appropriately marking sensitive information as proprietary/trade secret. The Government will handle proprietary/trade secret information within the applicable statutes, rules, and regulations regarding the handling and release of such information.

5 Deliverables Deliverables are referenced in applicable line items under paragraph 3 and 4 of this PWS and detailed in the table below. The Contractor shall deliver the Deliverables as specified in the following table. If there is any conflict between the Deliverable reference in paragraph 3 of this PWS and the Deliverable specifics in the following table; the table in PWS paragraph 5 takes precedence. Days referenced shall be calendar days, unless otherwise noted. For recurring Deliverables, if the due date falls on a holiday or a weekend the Deliverable may be sent on the following business day. Contractor format is acceptable unless a specific format is identified.

However, Contractor name and logos may not be used on any Deliverable except for a cover-page or letter of transmittal.

All Deliverable distribution shall be by an electronic method unless otherwise specified. Email subject line will read as “Report Number (Submission Date) Title” for example “A001 (1 Jun 19) TTLE.” Email documents in a Microsoft Office or Adobe Acrobat-compatible format.

Since points of contact within the offices identified in the “Distribution” block may change, the CO will assist the Contractor and maintain a current e-mail address listing.

Deliverable Table

Identifier Name PWS # Schedule Distribution A001 Port of

Embarkation and Origin Storage

3.1.1 30 days after contract award

21 CONS/DET 1

21 SW/PMD

21 LRS/LGRD

Description:

Identifier Name PWS # Schedule Distribution A002 Vessel

Certificates

3.1.2 Annually; no later than

(NLT) 1 June

21 CONS/DET 1

21 SW/PMD

21 LRS/LGRD

Description:

Required for all vessels to be used. Certificate and any associated survey must consider the intended route/locations established by the requirements of this contract. Must either be English or include a translation into English.

Identifier Name PWS # Schedule Distribution A003 Proof of

Insurance

3.1.3.1 Annually; NLT 1 June 21 CONS/DET 1

21 SW/PMD

21 LRS/LGRD

Description:

A004 Quality Program

Plan (QPP)

3.1.5 NLT 30 days prior to

contract performance start date and within 14 days of changes occurring thereafter

21 CONS/DET 1

21 SW/PMD

21 LRS/LGRD

Description:

As a minimum, ensure the QPP addresses the following processes: control of documents, control of records, internal audits and inspections, process to correct non-conforming services, and process to prevent non-conforming services from recurrence.

Identifier Name PWS # Schedule Distribution A005 Sealift Schedule 3.2.1 and

3.2.1.1 Annually; NLT 1 May 21 CONS/DET 1

21 SW/PMD

21 LRS/LGRD

821 SPTS/LG

Description:

Include fixed arrival and departure dates as well as final dates of acceptance of cargo for each vessel.

Identifier Name PWS # Schedule Distribution A006 Final Ship

Manifests

3.2.4.1 NLT 1 week prior to

vessel arrival at port

21 CONS/DET 1

21 SW/PMD

21 LRS/LGRD

821 SPTS/LG

BMC contractor

Description:

Required for each vessel, each direction.

Identifier Name PWS # Schedule Distribution A007 Pre-Stowage

Plan

3.2.4.2 NLT 2 days prior to

ship arrival in port

21 CONS/DET 1

21 SW/PMD

21 LRS/LGRD

821 SPTS/LG

MSCLANT N32

Description:

Required for each vessel, before cargo is loaded in Denmark or Thule

Identifier Name PWS # Schedule Distribution A008 DoD

Owned/Leased Container Listing

3.2.5.1 Annually; 1 September 21 CONS/DET 1

21 SW/PMD

21 LRS/LGRD

21 SW Traffic Management Officer

Description:

Listing to include container number, received (loaded) and delivered (offloaded) date, and nomenclature. If no DoD owned/leased containers were received/delivered, provide email confirmation of such in place of this deliverable.

A009 Departure/

Movement/ Position/ Arrival Report

3.2.6.1 Initiated when the

vessel leaves port, submitted every 6 hours, and concluding upon arrival at destination

21 CONS/DET 1

21 SW/PMD

21 LRS/LGRD

821 SPTS/LG

BMC contractor

MSCLANT N32

Description:

Documenting the vessel’s movements.

Identifier Name PWS # Schedule Distribution A010 Vessel

Equipment Casualties

3.2.6.2 Within 1 hour of

identification

21 CONS/DET 1

21 SW/PMD

21 LRS/LGRD

Description:

Identifier Name PWS # Schedule Distribution A011 Cyber Security

Self- Assessment

4.2.1 Within 60 days of

contract award and then annually thereafter

21 CONS/DET 1

21 SW/PMD

21 LRS/LGRD

Description:

Self-assessment of the contractor’s compliance with all of the requirements in NIST SP 800-171. Attachment 3 provides modified requirements of CUI/CDI specific controls from NIST SP 800-171 that will be used to evaluate compliance in a non-CUI/CDI environment.

Identifier Name PWS # Schedule Distribution A012 Cyber Security

Plan of Action

4.2.2 Within 15 days of the

determination of non-compliance

21 CONS/DET 1

21 SW/PMD

21 LRS/LGRD

Description:

Plan of Action shall address all of the requirements in NIST SP 800-171. Identifies any deviations, non-compliance, or proposed alternative means of compliance as well as plans for correcting non-compliant requirements. The Plan of Action shall follow the template provided in Appendix 4. Alternate formats for the Plan of Action may be proposed and must be approved by the CO.

Identifier Name PWS # Schedule Distribution A013 Foreign Entity

Information Sheet

4.2.2 Within 90 days of

contract award and then every 6 months thereafter

21 CONS/DET 1

21 SW/PMD

21 LRS/LGRD

Description:

The report shall include the following information regarding the subcontractor:

• Legal Company Name (in native language if known)

• Complete Address including Country

• Name, phone number and email address of at least one point of contact at the company

6 Services Summary The Services Summary (SS) is a summary of the major performance objectives and performance thresholds required by the Government in Contractor performance. The absence of any contract requirements from the SS shall not detract from its enforceability nor limit the rights or remedies of the Government under any other provision of the contract. The Government has the right to inspect all services required in the contract.

All thresholds are 100% unless otherwise stated

SS Requirement PWS Para Threshold

1.1 Secure and protect all cargo at

origin

3.1.3 Performance is acceptable when:

Cargo is secured and protected from loss, theft and other damage at origin storage

1.2 Secure and protect all cargo at

Denmark port

3.1.3 Cargo is secured and protected from loss, theft and other damage at the port in Denmark

1.3 Secure and protect all cargo

during transport

3.1.3 Cargo is secured and protected from loss, theft and other damage during ocean transport

1.4 Secure and protect all cargo at

destination

3.1.3 Cargo is secured and protected from loss, theft and other damage at destination during loading/offloading

1.5 Transport cargo with capable

equipment

3.2.5 Performance is acceptable when:

a) Vessels used are appropriately rated for the location

b) Vessels used are operated and maintained IAW the Polar Code

1.6 Transport IAW Polar Code 3.2.5 Transport is IAW the Polar Code

Appendix 1 - Abbreviations and Acronyms

821 SPTS/LG 821st Support Squadron, Logistics AB Air Base BMC Base Maintenance Contractor CDI Covered Defense Information CO Contracting Officer COR Contracting Officer’s Representative CUI Controlled Unclassified Information DFARS Defense Federal Acquisition Regulation Supplement DoD Department of Defense DTI DoD Transactional Information eCMRA Electronic Contractor Manpower Reporting Application EOFY End of Fiscal Year FAR Federal Acquisition Regulation FIPS Federal Information Processing Standards IAW In Accordance With IS Information Systems KG Kilograms Kilos Kilograms M³ Cubic Meter MFT Multi-Functional Team MHE Material Handling Equipment NIST National Institute of Standards and Technology NLT No Later Than PM Program Manager PWS Performance Work Statement QAM Quality Assurance Manager SP Special Publication STD Standard US United States

Appendix 2 - Definitions

BREAK BULK: Packages of materials that are handled individually, palletized, or unitized for purposes of transportation as opposed to bulk and containerized freight

CARGO: US Government and US Government sponsored cargo

CEMENT: Cement, sand and other heavy products packed in sacks with a weight of more than 1,000 kilograms per cubic meter.

CHILLED CARGO: Subsistence items that require a temperature of between 2 and 5 degrees Celsius during transportation.

DANGEROUS/HAZARDOUS CARGO: Hazardous material means a substance or material that the Secretary of Transportation has determined is capable of posing an unreasonable risk to health, safety, and property when transported in commerce, and has designated as hazardous under section 5103 of Federal hazardous materials transportation law (49 U.S.C. 5103). The term includes hazardous substances, hazardous wastes, marine pollutants, elevated temperature materials, materials designated as hazardous in the Hazardous Materials Table (see 49 CFR 172.101), and materials that meet the defining criteria for hazard classes and divisions in 49 CFR

173. The term does not include petroleum, including crude oil or any fraction thereof which is not otherwise specifically listed or designated as a hazardous substance in appendix A to 49 CFR 172.101, and the term does not include natural gas, natural gas liquids, liquefied natural gas, or synthetic gas usable for fuel (or mixtures of natural gas and such synthetic gas).

DEMURRAGE: (1) The detention of a ship or vessel by the US Government beyond the time allowed for offloading and loading at ports in Greenland. (2) The charge(s) for the detention of a ship or vessel caused by the US Government beyond the maximum time allowed for offloading and loading at ports in Greenland.

FROZEN CARGO: Frozen subsistence items that require a temperature lower than -18 degrees Celsius during transportation.

GENERAL CARGO: Cargo that is not separately listed below.

IRON: Iron or steel in various lengths and sheets.

LUMBER: Beams, two by fours, rafters and braces.

“ON THE PIER”: All cargo being off/on loaded by the Sealift Contractor is placed directly on the pier or placed on trailer by direction of port master.

PIPES: All types of various size metal and/or plastic pipe with or without insulation.

US GOVERNMENT AND US GOVERNMENT SPONSORED CARGO: All cargo purchased by US Government and contractors in direct support of US Government contracts.

VENDOR: The supplier entity that delivers US Government and US Government sponsored cargo to the port of embarkation to be sent from Denmark to Greenland.

Appendix 3 – NIST SP 800-171 Self-Assessment Modified Controls

Req # NIST SP 800-171 Requirement Modified Requirement

3.1.3 Control the flow of CUI in accordance with

approved authorizations.

Limit the flow of DoD information to organizations or individuals necessary for the performance of the operationally critical requirements of this contract.

3.1.9 Provide privacy and security notices

consistent with applicable CUI rules.

Provide privacy and security notices consistent with US Government and/or local governmental regulations.

3.1.19 Encrypt CUI on mobile devices and mobile

computing platforms.

Provide adequate technical protections on mobile devices and computing platforms that process and/or store contractual information.

3.1.22 Control CUI posted or processed on publicly

accessible systems.

Control DoD information posted or processed on publicly accessible systems.

3.7.3 Ensure equipment removed for off-site

maintenance is sanitized of any CUI.

Ensure equipment removed for off-site maintenance is sanitized of DoD information.

3.8.1 Protect (i.e., physically control and securely

store) system media containing CUI, both paper and digital.

Protect (i.e., physically control and securely store) system media containing DoD information, both paper and digital.

3.8.2 Limit access to CUI on system media to

authorized users.

Limit access to DoD information on system media to authorized users.

3.8.3 Sanitize or destroy system media containing

CUI before disposal or release for reuse.

Sanitize or destroy system media containing DoD information before disposal or release for reuse.

3.8.4 Mark media with necessary CUI markings

and distribution limitations.

Mark media with privacy and security notices consistent with US Government and/or local government regulations.

3.8.5 Control access to media containing CUI and

maintain accountability for media during transport outside of controlled areas.

Control access to and maintain accountability for media containing DoD information.

3.8.9 Protect the confidentiality of backup CUI at

storage locations.

Provide information backup procedures (frequency, timeframe for storage, etc.) for DoD data located on contractor systems. Protect the confidentiality of backup materials containing DoD information.

3.9.1 Screen individuals prior to authorizing

access to organizational systems containing

CUI.

Screen individuals prior to authorizing access to organizational systems containing DoD information.

3.9.2 Ensure that CUI and organizational systems

containing CUI are protected during and after personnel actions such as terminations and transfers.

Ensure that DoD information and organizational systems containing DoD information are protected during and after personnel actions such as terminations and transfers.

3.10.6 Enforce safeguarding measures for CUI at

alternate work sites (e.g., telework sites).

Enforce safeguarding measures for DoD Information at alternate work sites (e.g., telework sites).

3.11.1 Periodically assess the risk to organizational

operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.

Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of DoD information.

3.13.8 Implement cryptographic mechanisms to

prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.

Implement cryptographic mechanisms to prevent unauthorized disclosure of DoD information during transmission when possible unless otherwise protected by alternate physical safeguards.

3.13.11 Employ FIPS-validated cryptography when

used to protect the confidentiality of CUI.

Employ FIPS-validated cryptography when used to protect the confidentiality of DoD information within the organization’s systems and when possible when transmitting to external entities.

3.13.16 Protect the confidentiality of CUI at rest. Protect the confidentiality of DoD information at rest.

Appendix 4 – Cyber Security Plan of Action Template

Compliant (Yes/No)

NIST

800-171 Control Number

Family

Control Text

Type

Non- Compliance Detection

Date

Scheduled Completion

Actual Completion

Original Impact Level

Adjusted

Level

Adjusted

Rationale (If

Applicable)

Supporting Docs / System

Controls

Status / Comments

3.1.1

Access

Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

Basic

3.1.2

Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

Derived

3.1.3 Access

Control the flow of CUI in accordance with approved authorizations.

3.1.4

Separate the duties of individuals to reduce the risk of malevolent activity without collusion.

3.1.5

Employ the principle of least privilege, including for specific security functions and privileged accounts.

3.1.6

Use non-privileged accounts or roles when accessing nonsecurity functions.

3.1.7

Prevent non-privileged users from executing privileged functions and audit the execution of such functions.

3.1.8 Access

Limit unsuccessful logon attempts. Derived

3.1.9

Provide privacy and security notices consistent with applicable CUI rules.

3.1.10

Use session lock with pattern-hiding displays to prevent access/viewing of data after period of inactivity.

3.1.11

Terminate (automatically) a user session after a defined condition.

3.1.12 Access

Monitor and control remote access sessions. Derived

3.1.13

Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.

3.1.14 Access

Route remote access via managed access control points.

3.1.15

Authorize remote execution of privileged commands and remote access to security-relevant information.

3.1.16 Access

Authorize wireless access prior to allowing such connections.

3.1.17 Access

Protect wireless access using authentication and encryption.

3.1.18 Access

Control connection of mobile devices. Derived

3.1.19 Access

Control

Encrypt CUI on mobile devices. Derived

3.1.20

Verify and control/limit connections to and use of external information systems.

3.1.21

Limit use of organizational portable storage devices on external information

3.1.22

Control information posted or processed on publicly accessible information systems.

Ensure that managers, systems administrators, and users of organizational information systems are made aware of the

3.2.1 Awareness

and Training security risks associated with their activities and Basic of the applicable policies, standards, and procedures related to the security of organizational information systems.

Ensure that organizational personnel

3.2.2 Awareness

and Training are adequately trained to carry out their assigned information security-related duties and responsibilities.

Provide security awareness training on

3.2.3 Awareness

and Training recognizing and reporting potential Derived indicators of insider threat.

Create, protect, and retain information system audit records to the extent needed to

3.3.1 Audit and

Accountability enable the monitoring, analysis, investigation, and reporting of unlawful, unauthorized, or inappropriate information system activity.

Ensure that the actions of individual information

3.3.2 Audit and

system users can be uniquely traced to those users so they can be held accountable for their actions.

3.3.3 Audit and

Review and update audited events. Derived

3.3.4 Audit and

Accountability

Alert in the event of an audit process failure. Derived

3.3.5

Audit and

Use automated mechanisms to integrate and correlate audit review, analysis, and reporting processes for investigation and response to indications of inappropriate, suspicious, or unusual activity.

3.3.6

Provide audit reduction and report generation to support on-demand analysis and reporting.

3.3.7

Provide an information system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records.

3.3.8

Protect audit information and audit tools from unauthorized access, modification, and deletion.

3.3.9

Limit management of audit functionality to a subset of privileged users.

3.4.1

Configuration Management

Establish and maintain baseline configurations and inventories of organizational information systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.

3.4.2

Establish and enforce security configuration settings for information technology products employed in organizational

3.4.3

Track, review, approve/disapprove, and audit changes to

3.4.4 Configuration

Analyze the security impact of changes prior to implementation.

3.4.5

Define, document, approve, and enforce physical and logical access restrictions associated with changes to the information system.

3.4.6

Employ the principle of least functionality by configuring the information system to provide only essential capabilities.

3.4.7

Restrict, disable, and prevent the use of nonessential programs, functions, ports, protocols, and services.

3.4.8

Apply deny-by-exception (blacklist) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software.

3.4.9 Configuration

Control and monitor user-installed software. Derived

3.5.1

Identification and Authentication

Identify information system users, processes acting on behalf of users, or devices.

3.5.2

Authentication

Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational

3.5.3

Authentication

Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.

3.5.4

Authentication

Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.

3.5.5 and Authentication

Prevent reuse of identifiers for a defined period.

3.5.6 and Authentication

Disable identifiers after a defined period of inactivity.

3.5.7

Authentication

Enforce a minimum password complexity and change of characters when new passwords are created.

3.5.8 and Authentication

Prohibit password reuse for a specified number of generations.

3.5.9

Authentication

Allow temporary password use for system logons with an immediate change to a permanent password.

3.5.10 and Authentication

Store and transmit only encrypted representation of passwords.

3.5.11

Authentication

Obscure feedback of authentication information.

3.6.1

Incident Response

Establish an operational incident-handling capability for organizational information systems that includes adequate preparation, detection, analysis, containment, recovery, and user response activities.

3.6.2

Incident

Track, document, and report incidents to appropriate officials and/or authorities both internal and external to the organization.

3.6.3 Incident

Test the organizational incident response capability.

3.7.1

Maintenance

Perform maintenance on

3.7.2

Provide effective controls on the tools, techniques, mechanisms, and personnel used to conduct information system maintenance.

3.7.3

Ensure equipment removed for off-site maintenance is sanitized of any CUI.

3.7.4

Check media containing diagnostic and test programs for malicious code before the media are used in the information system.

3.7.5

Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete.

3.7.6

Supervise the maintenance activities of maintenance personnel without required access authorization.

Protect (i.e., physically control and securely

3.8.1 Media

Protection store) information system media containing Basic

CUI, both paper and digital.

Limit access to CUI on

3.8.2 Media

Protection information system media to authorized Basic users.

Sanitize or destroy

3.8.3 Media

Protection information system media containing CUI before disposal or release for reuse.

Mark media with

3.8.4 Media

Protection necessary CUI markings and distribution Derived limitations.

Control access to media containing CUI and

3.8.5 Media

Protection maintain accountability for media during Derived transport outside of controlled areas.

Implement cryptographic mechanisms to protect the confidentiality of CUI

3.8.6 Media

Protection stored on digital media during transport unless Derived otherwise protected by alternative physical safeguards.

Control the use of

3.8.7 Media

Protection removable media on information system Derived components.

Prohibit the use of

3.8.8 Media

Protection portable storage devices when such devices have Derived no identifiable owner.

3.8.9

Media

Protect the confidentiality of backup CUI at storage locations.

3.9.1

Personnel Security

Screen individuals prior to authorizing access to information systems containing CUI.

3.9.2

Personnel Security

Ensure that CUI and information systems containing CUI are protected during and after personnel actions such as terminations and transfers.

3.10.1

Physical

Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.

3.10.2

Protect and monitor the physical facility and support infrastructure for those information

3.10.3 Physical

Escort visitors and monitor visitor activity. Derived

3.10.4 Physical

Protection

Maintain audit logs of physical access. Derived

3.10.5 Physical

Protection

Control and manage physical access devices. Derived

3.10.6

Enforce safeguarding measures for CUI at alternate work sites (e.g., telework sites).

3.11.1

Risk Assessment

Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational information systems and the associated processing, storage, or transmission of CUI.

Scan for vulnerabilities in the information

3.11.2 Risk

system and applications periodically and when new vulnerabilities affecting the system are identified.

Remediate

3.11.3 Risk

Assessment vulnerabilities in accordance with Derived assessments of risk.

Periodically assess the security controls in

3.12.1 Security

organizational information systems to determine if the controls are effective in their application.

Develop and implement plans of action designed

3.12.2 Security

to correct deficiencies and reduce or eliminate vulnerabilities in information systems.

Monitor information system security controls

3.12.3 Security

Assessment on an ongoing basis to ensure the continued Basic effectiveness of the controls.

Monitor, control, and protect organizational communications (i.e., information transmitted System and or received by

3.13.1 Communicatio organizational Basic

ns Protection information systems) at the external boundaries and key internal boundaries of the information systems.

Employ architectural designs, software development System and techniques, and systems

3.13.2 Communicatio engineering principles Basic

ns Protection that promote effective information security within organizational information systems.

Separate user System and functionality from

3.13.3 Communicatio information system Derived

ns Protection management functionality.

Prevent unauthorized System and and unintended

3.13.4 Communicatio information transfer via Derived

ns Protection shared system resources.

Implement subnetworks

3.13.5 System and Communicatio ns Protection

for publicly accessible system components that are physically or logically separated from internal networks.

Deny network communications traffic System and by…