Sealift_PWS_-_DRAFT_12Oct18.pdf

Performance Work Statement (PWS) Thule Air Base Sealift

20 Sep 2018

Table of Contents 1 Background and Scope

2 General Requirements

2.1 Non-Personal Services

2.2 Vessel Registry

2.3 Government Multifunctional Team (MFT) Members

2.4 Standards and Publications

2.5 Business Relations

2.6 Contract Administration

2.7 Contractor Personnel, Disciplines, and Specialties

3 Performance Requirements

3.1 General

3.2 Cargo Receipt, Processing, Loading, Transport and Offloading

4 Cyber Security and Foreign Entity Vetting

4.1 General Cyber Security Requirements

4.2 Cyber Security Assessments and Mitigation Plans

4.3 Cyber Incident Reporting

4.4 Foreign Entity Vetting

5 Deliverables

6 Services Summary

Appendix 1 - Abbreviations and Acronyms

Appendix 2 - Definitions

Appendix 3 – NIST SP 800-171 Self-Assessment Modified Controls

Appendix 4 – Cyber Security Plan of Action Template

Thule Air Base Sealift Contract

1 Background and Scope The United States Air Force (USAF) has a recurring requirement for ocean charter transportation to Thule Air Base (AB), Greenland. Thule AB is located 695 miles north of the Arctic Circle and 947 miles south of the North Pole on the Northwest side of the island.

The scope of this requirement is all management, labor and services to accomplish the functions and responsibilities of receiving cargo from vendors, providing in-transit origin storage, loading/offloading and the ocean transport of United States (US) Government and US Government Sponsored cargo to and from Denmark and Thule AB, Greenland. Cargo types include, but are not limited to, general dry cargo, lumber, cement, dangerous cargo, iron pipe, insulation, frozen cargo, chilled/refrigerated cargo, vehicles, heavy machinery, and full 20 and 40 foot containers.

2 General Requirements The requirements have been organized in a manner that facilitates clear and concise description. The grouping of requirements is not intended to imply a preferred organizational structure. In addition, the requirements of one section may apply to some or all contractor operations.

Any reference to “Government” within this Performance Work Statement (PWS) is intended to be reference to the Government of the United States of America unless otherwise specified.

In any dispute arising out of this contract, the decision of which requires consideration of questions of law, the rights and obligations of the parties shall be interpreted in accordance with the substantive laws of the United States of America.

2.1 Non-Personal Services

This is a non-personal services contract as defined in Federal Acquisition Regulation (FAR)

37.101. The Government shall neither supervise contractor employees nor control the method by which the contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual contractor employees. It shall be the responsibility of the contractor to manage its employees and to guard against any actions that are of the nature of personal services, or give the perception of personal services. If the contractor believes that any actions constitute, or are perceived to constitute personal services, it is the contractor’s responsibility to notify the Contracting Officer (CO) in writing immediately.

2.2 Vessel Registry

In accordance with the Cargo Preference Act of 1904 (10 U.S.C. 2631) only US flag vessels shall be used for the ocean transport of US Government or US Government sponsored cargo between Denmark and Greenland. If the use of a US flag vessel is not proposed during the solicitation phase, only Danish flag vessels shall be used for the ocean transport of cargo between Denmark and Greenland.

2.3 Government Multifunctional Team (MFT) Members

The Government MFT manages the contract, assesses performance and works to improve customer support. The MFT is comprised of Government representatives including the Program Manager (PM), Contracting Officer (CO), Quality Assurance Manager (QAM), and Contracting Officer’s Representative (COR).

CORs from the functional area receiving the contract services will participate in the administration of this contract specifically to evaluate contractor performance, inspect the services for the Government, and provide a report of inspection to the CO. This designation does not include authority to direct and/or authorize the contractor to make changes in the scope or terms of the contract without the written authority of the CO. The contractor will be notified in writing by the CO of the names, duties, and limitations of the CORs.

Inspection and acceptance of the services required by the PWS will be performed at contractor’s origin storage facilities in Denmark and at Thule AB.

2.4 Standards and Publications

The contractor shall comply with all directives listed as standards (STD) in this PWS under paragraph 3. If a referenced directive requires compliance with one or more secondary directives, those secondary directives shall be used as guidance and are not mandatory unless specifically required within this PWS. If no standard is explicitly listed for a requirement, contractor operations will comply with industry or commercial standards.

When directive chapters, paragraphs, appendices, attachments, etc are referenced, the STD shall be inclusive of all subordinate paragraphs unless specifically excluded. For example, if the PWS STD lists paragraph 1.2 and paragraph 1.2 has subparagraphs 1.2.1, 1.2.1.1 and 1.2.1.2, those subparagraphs are directive.

The contractor shall stay up to date on all directive updates. All contractor operations shall comply with the current version of the directives. The contractor shall notify the CO in writing within 30 days of directive revisions, changes, supplements and rescissions. If there is any cost impact resulting from such revisions, changes, supplements and rescissions the contractor shall provide the cost information with the notification. If the CO is not notified in writing within 30 days, the contractor shall perform in accordance with directive revisions, changes, supplements and rescissions at no increase to contract price.

Days referenced in this PWS shall be calendar days, unless otherwise noted. Cargo referenced in this PWS is US Government or US Government sponsored cargo.

2.5 Business Relations

The contractor shall integrate and coordinate all activity needed to execute the requirement. The contractor shall manage the timeliness, completeness and quality of problem identification and resolution. The contractor shall provide corrective action plans, proposal submittals, and timely identification of issues. The contractor shall seek to ensure customer satisfaction and professional and ethical behavior of all contractor personnel.

2.6 Contract Administration

The following subsections specify requirements for contract requests and contracted rates and basis.

2.6.1 Contract Requests

The contractor shall respond to Government requests for contractual actions as defined by the CO.

The contractor shall have a single point of contact for contract administrative duties.

2.6.2 Contracted Rates and Basis

Services on this contract shall be provided to the Government at the rates stipulated in Section B –

Price Schedule. The shipping rates listed in Section B – Price Schedule shall include all costs incident to delivery from "dock-to-dock." Whereas the Sealift contractor performs offloading and loading of all vessels at Thule AB during established port season/hours, the Government shall not be charged separately for such offloading and loading.

The applicable shipping rates charged will be determined on the basis of cubic measure (cubic meter - M³) when the cargo weighs less than six hundred (600) kilos (approximately 1,320 pounds) per cubic meter and on the basis of weight measure (kilograms - KG) when a cubic meter weighs six hundred (600) kilos or more EXCEPT that the ratio for lumber is eight hundred (800) kilos per cubic meter.

2.7 Contractor Personnel, Disciplines, and Specialties

The contractor shall accomplish the assigned work by employing and utilizing qualified personnel with education, certifications, training, and experience IAW the International Code for Ships Operating in Polar Waters (Polar Code).

2.7.1 Employee Identification

Employees will, while on duty at a Government installation, wear in plain view on the upper portion of the outer garment a metal or plastic identification badge to be furnished by the contractor containing the company name, employee's name, and company identification number of employee, if any. Departure from ship by contractor personnel onto main base shall be coordinated prior with Danish Liaison Officer.

2.7.2 Security Clearance

The work associated with this PWS for the contractors is at the UNCLASSIFIED level. At no time will contractors be authorized to transport classified/sensitive material that will require a national security determination (security clearance).

Additionally, the contractor shall not divulge any Government financial, planning, programming, or budgeting information without the express consent of the Government as outlined in Operational Security (OPSEC) and Information Security regulations. UNLCLASSIFIED//For Official Use Only material will not be released without the approval of the CO.

2.7.3 Country Clearances

All US personnel must acquire a country clearance per 821 SPTS/LG requirements in order to qualify for employment. Evidence of screening will be provided annually by the contractor to the CO by 1 Jun and will be in the possession of the contractor when in port at Thule AB and available for Government review.

2.7.4 Language

All information and documentation required to be generated or maintained (to include Government-furnished documents) by this contract are in English.

2.7.5 Security, Cyber Security and Force Protection

The contractor will comply with all requirements in Appendix 3.

3 Performance Requirements The following section specifies the performance requirements for the contract.

3.1 General

3.1.1 Designate the port(s) of embarkation in Denmark and location of origin storage.

Port and storage location could be same location. For all cargo shipments to Thule AB.

Deliverables A001, Port of Embarkation and Origin Storage

3.1.2 Provide most recent and complete copies of the vessel Polar Ship Certificate, Safety Management Certificate (SMC), the Company Document of Compliance, the vessel International Ship Security Certificate (ISSC), the vessel Document of Compliance for the Carriage of Dangerous Goods (IMDG) certificate and most recent and complete Certificate of Inspection (COI).

Performance Standards

a) STD: In accordance with (IAW) the International Code for Ships Operating in Polar Waters (Polar Code) paragraph 1.3 Deliverables A002, Vessel Certificates

3.1.3 Secure and protect all cargo while in the custody of the contractor.

Includes the origin storage, port(s) in Denmark, ocean freight transport and destination handling during loading/offloading.

Performance Standards

a) STD: From loss, theft and/or any other damage, including adequate protection of cargo against inclement or unusually severe weather

3.1.3.1 Provide proof of insurance.

Performance Standards

a) STD: IAW DFARS 252.247-7007 Deliverables A003, Proof of Insurance

3.1.4 Report Contractor direct labor hours and dollars (to include Subcontractor hours and dollars) required for performance of services provided under this contract.

Fill in all required data fields. Information provided is considered to be proprietary in nature when the contract number and Contractor identity are associated with the direct labor hours and direct labor dollars.

Performance Standards

a) STD: Annually; NLT end of fiscal year (EOFY) + 30 days

b) STD: Using Electronic Contractor Manpower Reporting Application (eCMRA) at https://afcmra.hgda.pentagon.mil/

3.1.5 Establish, document, implement and maintain a Quality Program in a Quality Program Plan (QPP).

Deliverables

A004, QPP

3.1.5.1 Correct contractor-controlled performance deficiencies Identify the root cause, corrective actions, timelines for corrective actions, and preventive actions to prevent recurrence.

3.1.5.2 Determine and document impacts of conditions outside contractor control that effect the ability to meet contractual requirements.

Performance Standards

a) STD: Provide in writing to the CO, PM, QAM and COR

3.2 Cargo Receipt, Processing, Loading, Transport and Offloading

3.2.1 Establish fixed arrival and departure dates for all vessels.

Estimate of projected quantities/types of cargo, by CLIN, will be Government-furnished annually by 1 Apr by the CO in writing.

Performance Standards

a) STD: Mutually agreed to between contractor and CO Deliverables A005, Sealift Schedule

3.2.1.1 Establish the final date(s) of acceptance of cargo for each vessel.

Deliverables A005, Sealift Schedule

3.2.1.2 Notify the Thule BMC of estimated time of arrival for all cargo vessels.

BMC contact information will be Government-furnished annually by 1 Apr by the CO in writing.

Performance Standards

a) STD: In writing NLT 72 hours in advance of vessel arrival at Thule AB

3.2.1.3 Make notifications of any schedule or cost impact resulting from weather conditions, real-world security conditions, or declared crises and states of emergencies.

Performance Standards

a) STD: Written notification to CO and PM immediately upon occurrence

3.2.1.4 Report problems affecting mission accomplishment or schedule adherence.

Performance Standards

a) STD: Written notification to the CO and PM within 24 hours of occurrence

3.2.2 Receive and book cargo at origin storage in Denmark.

Cargo will be duly packed by the vendor for export shipment by ocean vessel and will be marked, labeled, and accompanied by freight warrant(s) and export certificate(s) at time of delivery to the origin storage.

Performance Standards

a) STD: All cargo received IAW final acceptance dates established in A005, Sealift Schedule, that is accompanied by the required paperwork

a) STD: Coordinate delivery/receipt schedule with the vendor after receipt of documentation, such as bills of lading

b) STD: Notify vendor and CO in writing within 48 hours of any cargo that is damaged upon receipt

c) STD: Notify vendor and CO in writing within 48 hours of any cargo that is improperly packed for ocean transportation or not accompanied by the required documentation

3.2.3 Store cargo at origin storage location.

Performance Standards

a) STD: From time of delivery from the vendor until time of shipment

b) STD: Includes all types of cargo to include, but not limited to, general cargo, construction materials, frozen and chilled cargo

3.2.4 Process, handle and prepare necessary cargo documentation prior to loading cargo for shipment.

Includes manifests, bill of ladings, booking requests, stowage plans and receiving reports.

Performance Standards

a) STD: For cargo shipments to Thule AB and cargo return to Denmark

3.2.4.1 Provide final ship manifests.

Deliverables A006, Final Ship Manifests

3.2.4.2 Provide a pre-stowage plan.

Deliverables A007, Pre-Stowage Plan

3.2.5 Load and secure cargo destined for Thule AB into containers and onto ocean vessel.

Containers with clearly marked container numbers that are clean, dry, empty, odor free, suitable for protecting cargo from damage.

Performance Standards

a) STD: Manufacturer’s recommendations and commercial standards

b) STD: Containers comply with International Standards Organization (ISO), International Maritime Organization (IMO), and Convention of Safe Containers (CSC) standards

c) STD: Refrigerated containers that maintain a temperature within three degrees Fahrenheit of the in-transit temperature specified for controlled atmosphere and straight chill, and five degrees Fahrenheit for frozen

d) STD: Refrigerated containers have continuous measurement of internal temperature using a Ryan-type recorder or equivalent capable of continuous recording from availability date for a minimum period of 90 days

e) STD: Containers must be packed as full as possible and by the most economical method

f) STD: To the extent possible containers must be packed with contents from the same vendor

3.2.5.1 Provide listing of all Department of Defense (DoD) owned or DoD leased containers Deliverables A008, DoD Owned/Leased Container Listing

3.2.5.2 Maintain documented inventory of vessel supplies and lashing gear Includes items such as, but not limited to, chains, binders, straps, and rods.

Performance Standards

a) STD: Sufficient to cover contracted load

3.2.6 Transport cargo via ocean vessel.

a) STD: Using vessels appropriately rated for the severe ice conditions present in the Greenland waters

b) STD: Using vessels operated and maintained IAW the International Code for Ships Operating in Polar Waters (Polar Code)

c) STD: IAW the International Code for Ships Operating in Polar Waters (Polar Code)

3.2.6.1 Provide Departure, Movement, Position, Arrival report.

Performance Standards

a) STD: Initiated when the vessel leaves port concluding upon arrival at destination Deliverables A009, Departure/Movement/Position/Arrival Report

3.2.6.2 Identify and report vessel equipment casualties.

Performance Standards

a) STD: Affecting vessel’s proper operation, vessel’s ability to meet the agreed upon schedule, or the loading/discharging of the cargo Deliverables A010, Vessel Equipment Casualties

3.2.6.3 Maintain cargo containers while in transit.

Performance Standards

a) STD: Manufacturers recommendations and commercial standards

b) STD: Continuous operation of refrigerated containers to maintain temperatures

3.2.6.4 Maintain all material handling equipment (MHE) and cargo gear.

Performance Standards

a) STD: Manufacturer’s recommendations and commercial standards

b) STD: Ability to perform 24-7 cargo operations

3.2.7 Deliver and offload cargo at Thule AB.

Exact dates and hours of port operation at Thule AB will be Government-furnished annually by 1 May by the CO in writing. Thule AB port operates approximately 60 days normally between 1 July and 1 September.

Performance Standards

a) STD: During the port season and port operating hours

b) STD: IAW fixed arrival and departure dates established in A005, Sealift Schedule

c) STD: Delivery point at Thule AB is “on the pier”

d) STD: All offloading will be performed by the Sealift contractor IAW manufacturer’s recommendations and commercial standards

e) STD: For any services rendered by the Thule BMC outside the normal port season or operating hours, the reimbursement for direct labor, material, equipment or vehicle charges are a matter between the BMC and the Sealift contractor, and are not billed against this contract

3.2.8 Load cargo destined for Denmark onto ocean vessel.

Performance Standards

a) STD: Manufacturer’s recommendations and commercial standards

3.2.9 Deliver and offload cargo at port in Denmark.

a) STD: Delivery point in Denmark is the port of embarkation as defined in PWS para 3.1.1

b) STD: All offloading will be performed by the Sealift contractor IAW manufacturer’s recommendations and commercial standards

c) STD: Coordinate delivery/pickup schedule with the vendor

4 Cyber Security and Foreign Entity Vetting

4.1 General Cyber Security Requirements

4.1.1 Handling and Protection of Non-Public Information.

In performance of this contract, the contractor may have access to DoD Transactional Information (DTI), which for the purposes of this section shall mean any information developed or received in the course of planning, ordering, shipping, tracking, and invoicing in support of the requirements of this contract. To adequately protect this DTI, contractor information systems (IS) involved in the performance of this contract shall comply with the security requirements in the current version of the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations.” Compliance with NIST SP 800-171 measures is required at the prime contractor level and does not apply to subcontractors and other entities that the prime contractor engages with in order to meet the requirements of this contract.

Additionally, the contractor agrees to use such information only for the purposes of fulfilling the contracted requirements and to protect such information from unauthorized release or disclosure.

Protection of the DTI does not abrogate any responsibilities of the contractor to comply with or implement additional cyber security requirements as part of generally accepted system security principles or as required by other categories of information that may be co-resident with the DTI on the contractor’s IS.

4.1.2 Operationally Critical Support

The services designated under this contract are “operationally critical support” as defined in DFARS 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting.

4.2 Cyber Security Assessments and Mitigation Plans

4.2.1 Self-Assessment

The contractor shall provide a Self-Assessment of its compliance with NIST SP 800-171.

Attachment 3 provides modified requirements of Controlled Unclassified Information (CUI) and Covered Defense Information (CDI) (CUI/CDI) specific controls from NIST SP 800-171 that will be used to evaluate compliance in a non-CUI/CDI environment. Any requests to vary from NIST SP 800-171 shall be submitted to the CO for consideration and approval. The Contractor need not implement any security requirement determined by the CO to be non-applicable or to have an equally effective alternative security measure implemented in its place.

Deliverables A011, Cyber Security Self-Assessment

4.2.2 Plan of Action

At any time during the period of performance, when a contractor determines it is non-compliant with a NIST SP 800-171 requirement or an approved alternate means of compliance resulting in a High or Moderate Potential Impact as defined in Federal Information Processing Standards Publication (FIPS PUB) 199, “Standards for Security Categorization of Federal Information and Information Systems,” the contractor shall submit a Plan of Action.

Deliverables A012, Cyber Security Plan of Action

4.2.3 Site Visit

The CO may conduct an on-site visit to a contractor's facility or request a third party assessment (Government agency or Government funded commercial entity) to review progress towards meeting their Plan of Action, evaluate any proposed variances to NIST SP 800-171 requirements, and to assess residual risk to the DTI resulting from the non-compliance. Date and time of on-site visits will be mutually agreed-upon by the CO and the contractor in advance.

4.3 Cyber Incident Reporting

When the contractor discovers a cyber incident, as defined in DFARS Clause 252.204-7012, that affects the contractor’s ability to perform the operationally critical support as identified in the contract, the contractor shall, as soon as practicable, but no later than 72 hours after discovering the incident, notify the CO in writing. The contractor shall provide an initial description of the incident that will include the information known at the time of the notification and shall provide a company POC who shall work with the CO through the resolution of the incident. The contractor shall also report the incident as outlined in DFARS 252.204-7012.

The CO may conduct an on-site review to assist the contractor in evaluating the extent of the incident and to share information in an effort to minimize the impact to both parties. Date and time of on-site visits will be mutually agreed-upon by the CO and the contractor in advance.

4.4 Foreign Entity Vetting

4.2.2 Subcontractor Suitability

Contractors shall submit a semi-annual report to the CO for each first tier foreign transportation service provider, operating as a separate legal entity, contracting directly with contractor or its commonly owned legal affiliate which has employees who may have physical contact with Government shipments in the ordinary course of contract performance. First tier foreign transportation service providers within scope include, but are not limited to: freight forwarders, customs brokers, stevedoring service providers, other brokers, and trucking companies.

Deliverables A013, Foreign Entity Information Sheet

The Contractor is not required to limit reporting solely to subcontractors used for services under the contract, but rather, may provide a complete list of subcontractors within scope in contractor’s network. Additionally, the contractor shall be held to a collection and reporting standard measured by customary commercial practices; the Government acknowledges that this is a cooperative effort.

The contractor is responsible for appropriately marking sensitive information as proprietary/trade secret. The Government will handle proprietary/trade secret information within the applicable statutes, rules, and regulations regarding the handling and release of such information.

Periodically throughout contract performance, the CO will make available to the contractor the name of active or potential subcontractors determined to be unsuitable. The contractor shall not allow named entities to perform any role in performance under this contract. If the contractor chooses to terminate the unsuitable subcontractor, the Government shall not be liable for any costs incurred by the contractor in establishing or terminating use of the unsuitable subcontractor. The contractor may choose not to terminate the unsuitable subcontractor for use on its commercial contracts.

An unsuitable determination does not preclude the contractor from nominating an unsuitable entity for reconsideration during the contract performance period. The contractor is encouraged to provide the CO additional relevant information that may affect the subcontractor's suitability. Any entity listed in the US Government Consolidated Screening List (http://export.gov/ecr/eg_main_023148.asp) or otherwise prohibited per FAR Subpart 25.7, Prohibited Sources, will not be reconsidered.

5 Deliverables Deliverables are referenced in applicable line items under paragraph 3 and 4 of this PWS and detailed in the table below. The Contractor shall deliver the Deliverables as specified in the following table. If there is any conflict between the Deliverable reference in paragraph 3 of this PWS and the Deliverable specifics in the following table; the table in PWS paragraph 5 takes precedence. Days referenced shall be calendar days, unless otherwise noted. For recurring Deliverables, if the due date falls on a holiday or a weekend the Deliverable may be sent on the following business day. Contractor format is acceptable unless a specific format is identified.

However, Contractor name and logos may not be used on any Deliverable.

All Deliverable distribution shall be by an electronic method unless otherwise specified. Email subject line will read as “Report Number (Submission Date) Title” for example “A001 (1 Jun 19) TTLE.” Email documents in a Microsoft Office or Adobe Acrobat-compatible format.

Since points of contact within the offices identified in the “Distribution” block may change, the CO will assist the Contractor and maintain a current e-mail address listing.

Deliverable Table

Identifier Name PWS # Schedule Distribution A001 Port of

Embarkation and Origin Storage

3.1.1 30 days after contract award

21 CONS/DET 1

21 SW/PMD

21 LRS/LGRD

Description:

A002

Vessel Certificates

3.1.2 Annually; no later than

(NLT) 1 June

21 CONS/DET 1

21 SW/PMD

Description:

Required for all vessels to be used. Certificate and any associated survey must consider the intended route/locations established by the requirements of this contract. Must either be English or include a translation into English.

A003 Proof of

Insurance

3.1.3.1 Annually; NLT 1 June 21 CONS/DET 1

21 SW/PMD

A004 Quality Program

Plan (QPP)

3.1.5 NLT 30 days prior to

contract performance start date and within 14 days of changes occurring thereafter

21 CONS/DET 1

21 SW/PMD

21 LRS/LGRD

Description:

As a minimum, ensure the QPP addresses the following processes: control of documents, control of records, internal audits and inspections, process to correct non-conforming services, and process to prevent non-conforming services from recurrence.

A005 Sealift Schedule 3.2.1 and 3.2.1.1

Annually; NLT 1 May 21 CONS/DET 1

21 SW/PMD

21 LRS/LGRD

Description:

Include fixed arrival and departure dates as well as final dates of acceptance of cargo for each vessel.

A006 Final Ship

Manifests

3.2.4.1 NLT 1 week prior to

vessel arrival at port

21 CONS/DET 1

21 SW/PMD

21 LRS/LGRD

821 SPTS/LG

BMC contractor

Required for each vessel, each direction.

A007 Pre-Stowage

Plan

3.2.4.2 NLT 2 days prior to

ship arrival in port

21 CONS/DET 1

21 SW/PMD

21 LRS/LGRD

821 SPTS/LG

MSCLANT N32

Required for each vessel, before cargo is loaded in Denmark or Thule

A008 DoD

Owned/Leased Container Listing

3.2.5.1 Annually; 1 September 21 CONS/DET 1

21 SW/PMD

21 LRS/LGRD

21 SW Traffic Management Officer

Description:

Listing to include container number, received (loaded) and delivered (offloaded) date, and nomenclature. If no DoD owned/leased containers were received/delivered, provide email confirmation of such in place of this deliverable.

A009 Departure/

Movement/ Position/ Arrival Report

3.2.6.1 Initiated when the

vessel leaves port, submitted every 6 hours, and concluding upon arrival at destination

21 CONS/DET 1

21 SW/PMD

21 LRS/LGRD

821 SPTS/LG

BMC contractor

MSCLANT N32

Documenting the vessel’s movements.

A010 Vessel

Equipment Casualties

3.2.6.2 Within 1 hour of

identification

21 CONS/DET 1

21 SW/PMD

821 SPTS/LG

BMC contractor

MSCLANT N32

A011 Cyber Security

Self- Assessment

4.2.1 Within 60 days of

contract award and then annually thereafter

21 CONS/DET 1

Self-assessment of the contractor’s compliance with all of the requirements in NIST SP 800-171. Attachment 3 provides modified requirements of CUI/CDI specific controls from NIST SP 800-171 that will be used to evaluate compliance in a non-CUI/CDI environment.

A012 Cyber Security

Plan of Action

4.2.2 Within 15 days of the

determination of non-compliance

21 CONS/DET 1

Plan of Action shall address all of the requirements in NIST SP 800-171. Identifies any deviations, non-compliance, or proposed alternative means of compliance as well as plans for correcting non-compliant requirements. The Plan of Action shall follow the template provided in Appendix 4. Alternate formats for the Plan of Action may be proposed and must be approved by the CO.

A013 Foreign Entity

Information Sheet

4.2.2 Within 90 days of

contract award and then every 6 months thereafter

21 CONS/DET 1

The report shall include the following information regarding the subcontractor:

• Legal Company Name (in native language if known)

• Complete Address including Country

• Name, phone number and email address of at least one point of contact at the company

6 Services Summary The Services Summary (SS) is a summary of the major performance objectives and performance thresholds required by the Government in Contractor performance. The absence of any contract requirements from the SS shall not detract from its enforceability nor limit the rights or remedies of the Government under any other provision of the contract. The Government has the right to inspect all services required in the contract.

SS Requirement PWS Para Threshold

1.1 Secure and protect all cargo 3.1.3 Performance is acceptable when:

a) Cargo is secured and protected from loss, theft and other damage at origin storage

b) Cargo is secured and protected from loss, theft and other damage at the port in Denmark

c) Cargo is secured and protected from loss, theft and other damage during ocean transport

d) Cargo is secured and protected from loss, theft and other damage at destination during loading/offloading

1.2 Transport cargo 3.2.5 Performance is acceptable when:

a) Vessels used are appropriately rated for the location

b) Vessels used are operated and maintained IAW the Polar Code

c) Transport is IAW the Polar Code

Appendix 1 - Abbreviations and Acronyms

821 SPTS/LG 821st Support Squadron, Logistics AB Air Base BMC Base Maintenance Contractor CDI Covered Defense Information CO Contracting Officer COR Contracting Officer’s Representative CUI Controlled Unclassified Information DFARS Defense Federal Acquisition Regulation Supplement DoD Department of Defense DTI DoD Transactional Information eCMRA Electronic Contractor Manpower Reporting Application EOFY End of Fiscal Year FAR Federal Acquisition Regulation FIPS Federal Information Processing Standards IAW In Accordance With IS Information Systems KG Kilograms Kilos Kilograms M³ Cubic Meter MFT Multi-Functional Team MHE Material Handling Equipment NIST National Institute of Standards and Technology NLT No Later Than PM Program Manager PWS Performance Work Statement QAM Quality Assurance Manager SP Special Publication STD Standard US United States

Appendix 2 - Definitions

CARGO: US Government and US Government sponsored cargo

CEMENT: Cement, sand and other heavy products packed in sacks with a weight of more than 1,000 kilograms per cubic meter.

CHILLED CARGO: Subsistence items that require a temperature of between 2 and 5 degrees Celsius during transportation.

DANGEROUS/HAZARDOUS CARGO: Certain types of paint, turpentine, asphalt products, dynamite, etc.

DEMURRAGE: (1) The detention of a ship or vessel by the US Government beyond the time allowed for offloading and loading at ports in Greenland. (2) The charge(s) for the detention of a ship or vessel caused by the US Government beyond the maximum time allowed for offloading and loading at ports in Greenland.

FROZEN CARGO: Frozen subsistence items that require a temperature lower than -18 degrees Celsius during transportation.

GENERAL CARGO: Cargo that is not separately listed below.

IRON: Iron or steel in various lengths and sheets.

LUMBER: Beams, two by fours, rafters and braces.

“ON THE PIER”: All cargo being off/on loaded by the Sealift Contractor is placed directly on the pier or placed on trailer by direction of port master.

PIPES: All types of various size metal and/or plastic pipe with or without insulation.

US GOVERNMENT AND US GOVERNMENT SPONSORED CARGO: All cargo purchased by US Government and contractors in direct support of US Government contracts.

VENDOR: The supplier entity that delivers US Government and US Government sponsored cargo to the port of embarkation to be sent from Denmark to Greenland.

Appendix 3 – NIST SP 800-171 Self-Assessment Modified Controls

Req # NIST SP 800-171 Requirement Modified Requirement

3.1.3 Control the flow of CUI in accordance with

approved authorizations.

Limit the flow of DoD information to organizations or individuals necessary for the performance of the operationally critical requirements of this contract.

3.1.9 Provide privacy and security notices

consistent with applicable CUI rules.

Provide privacy and security notices consistent with US Government and/or local governmental regulations.

3.1.19 Encrypt CUI on mobile devices and mobile

computing platforms.

Provide adequate technical protections on mobile devices and computing platforms that process and/or store contractual information.

3.1.22 Control CUI posted or processed on publicly

accessible systems.

Control DoD information posted or processed on publically accessible systems.

3.7.3 Ensure equipment removed for off-site

maintenance is sanitized of any CUI.

Ensure equipment removed for off-site maintenance is sanitized of DoD information.

3.8.1 Protect (i.e., physically control and securely

store) system media containing CUI, both paper and digital.

Protect (i.e., physically control and securely store) system media containing DoD information, both paper and digital.

3.8.2 Limit access to CUI on system media to

authorized users.

Limit access to DoD information on system media to authorized users.

3.8.3 Sanitize or destroy system media containing

CUI before disposal or release for reuse.

Sanitize or destroy system media containing DoD information before disposal or release for reuse.

3.8.4 Mark media with necessary CUI markings

and distribution limitations.

Mark media with privacy and security notices consistent with US Government and/or local government regulations.

3.8.5 Control access to media containing CUI and

maintain accountability for media during transport outside of controlled areas.

Control access to and maintain accountability for media containing DoD information.

3.8.9 Protect the confidentiality of backup CUI at

storage locations.

Provide information backup procedures (frequency, timeframe for storage, etc.) for DoD data located on contractor systems. Protect the confidentiality of backup materials containing DoD information.

3.9.1 Screen individuals prior to authorizing

access to organizational systems containing

CUI.

Screen individuals prior to authorizing access to organizational systems containing DoD information.

3.9.2 Ensure that CUI and organizational systems

containing CUI are protected during and after personnel actions such as terminations and transfers.

Ensure that DoD information and organizational systems containing DoD information are protected during and after personnel actions such as terminations and transfers.

3.10.6 Enforce safeguarding measures for CUI at

alternate work sites (e.g., telework sites).

Enforce safeguarding measures for DoD Information at alternate work sites (e.g., telework sites).

3.11.1 Periodically assess the risk to organizational

operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.

Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of DoD information.

3.13.8 Implement cryptographic mechanisms to

prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.

Implement cryptographic mechanisms to prevent unauthorized disclosure of DoD information during transmission when possible unless otherwise protected by alternate physical safeguards.

3.13.11 Employ FIPS-validated cryptography when

used to protect the confidentiality of CUI.

Employ FIPS-validated cryptography when used to protect the confidentiality of DoD information within the organization’s systems and when possible when transmitting to external entities.

3.13.16 Protect the confidentiality of CUI at rest. Protect the confidentiality of DoD information at rest.

Appendix 4 – Cyber Security Plan of Action Template

Compliant (Yes/No)

NIST

800-171 Control Number

Control Family Control Text Control

Type

Non- Compliance Detection

Date

Scheduled Completion

Date

Actual Completion

Date

Original Impact Level

Adjusted Impact Level

Adjusted Impact

Rationale (If

Applicable)

Supporting Docs / System

Controls

Status / Comments

3.1.1 Access

Control

Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

Basic

3.1.2 Access

Control

Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

Derived

3.1.3 Access

Control

Control the flow of CUI in accordance with approved authorizations.

Derived

3.1.4 Access

Control

Separate the duties of individuals to reduce the risk of malevolent activity without collusion.

Derived

3.1.5 Access

Control

Employ the principle of least privilege, including for specific security functions and privileged accounts.

Derived

3.1.6 Access

Control

Use non-privileged accounts or roles when accessing nonsecurity functions.

Derived

3.1.7 Access

Control

Prevent non-privileged users from executing privileged functions and audit the execution of such functions.

Derived

3.1.8 Access

Control

Limit unsuccessful logon attempts. Derived

3.1.9 Access

Control

Provide privacy and security notices consistent with applicable CUI rules.

Derived

3.1.10 Access

Control

Use session lock with pattern-hiding displays to prevent access/viewing of data after period of inactivity.

Basic

3.1.11 Access

Control

Terminate (automatically) a user session after a defined condition.

Derived

3.1.12 Access

Control

Monitor and control remote access sessions. Derived

3.1.13 Access

Control

Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.

Derived

3.1.14 Access

Control

Route remote access via managed access control points.

Derived

3.1.15 Access

Control

Authorize remote execution of privileged commands and remote access to security-relevant information.

Derived

3.1.16 Access

Control

Authorize wireless access prior to allowing such connections.

Derived

3.1.17 Access

Control

Protect wireless access using authentication and encryption.

Derived

3.1.18 Access

Control

Control connection of mobile devices. Derived

3.1.19 Access

Control

Encrypt CUI on mobile devices. Derived

3.1.20 Access

Control

Verify and control/limit connections to and use of external information systems.

Derived

3.1.21 Access

Control

Limit use of organizational portable storage devices on external information systems.

Derived

3.1.22 Access

Control

Control information posted or processed on publicly accessible information systems.

Derived

3.2.1 Awareness

and Training

Ensure that managers, systems administrators, and users of organizational information systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of organizational information systems.

Basic

3.2.2 Awareness

and Training

Ensure that organizational personnel are adequately trained to carry out their assigned information security-related duties and responsibilities.

Basic

3.2.3 Awareness

and Training

Provide security awareness training on recognizing and reporting potential indicators of insider threat.

Derived

3.3.1 Audit and

Accountability

Create, protect, and retain information system audit records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful, unauthorized, or inappropriate information system activity.

Basic

3.3.2 Audit and

Accountability

Ensure that the actions of individual information system users can be uniquely traced to those users so they can be held accountable for their actions.

Basic

3.3.3 Audit and

Accountability

Review and update audited events. Derived

3.3.4 Audit and

Accountability

Alert in the event of an audit process failure. Derived

3.3.5 Audit and

Accountability

Use automated mechanisms to integrate and correlate audit review, analysis, and reporting processes for investigation and response to indications of inappropriate, suspicious, or unusual activity.

Derived

3.3.6 Audit and

Accountability

Provide audit reduction and report generation to support on-demand analysis and reporting.

Derived

3.3.7 Audit and

Accountability

Provide an information system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records.

Derived

3.3.8 Audit and

Accountability

Protect audit information and audit tools from unauthorized access, modification, and deletion.

Derived

3.3.9 Audit and

Accountability

Limit management of audit functionality to a subset of privileged users.

Derived

3.4.1 Configuration

Management

Establish and maintain baseline configurations and inventories of organizational information systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.

3.4.2 Configuration

Management

Establish and enforce security configuration settings for information technology products employed in organizational information systems.

Basic

3.4.3 Configuration

Management

Track, review, approve/disapprove, and audit changes to information systems.

Derived

3.4.4 Configuration

Management

Analyze the security impact of changes prior to implementation.

Derived

3.4.5 Configuration

Management

Define, document, approve, and enforce physical and logical access restrictions associated with changes to the information system.

Derived

3.4.6 Configuration

Management

Employ the principle of least functionality by configuring the information system to provide only essential capabilities.

Derived

3.4.7 Configuration

Management

Restrict, disable, and prevent the use of nonessential programs, functions, ports, protocols, and services.

Derived

3.4.8 Configuration

Management

Apply deny-by-exception (blacklist) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software.

Derived

3.4.9 Configuration

Management

Control and monitor user-installed software. Derived

3.5.1 Identification and Authentication

Identify information system users, processes acting on behalf of users, or devices.

3.5.2 Identification and Authentication

Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

Basic

3.5.3 Identification and Authentication

Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.

Derived

3.5.4 Identification and Authentication

Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.

Derived

3.5.5 Identification and Authentication

Prevent reuse of identifiers for a defined period.

Derived

3.5.6 Identification and Authentication

Disable identifiers after a defined period of inactivity.

Derived

3.5.7 Identification and Authentication

Enforce a minimum password complexity and change of characters when new passwords are created.

Derived

3.5.8 Identification and Authentication

Prohibit password reuse for a specified number of generations.

Derived

3.5.9 Identification and Authentication

Allow temporary password use for system logons with an immediate change to a permanent password.

Derived

3.5.10 Identification and Authentication

Store and transmit only encrypted representation of passwords.

Derived

3.5.11 Identification and Authentication

Obscure feedback of authentication information.

3.6.1 Incident

Response

Establish an operational incident-handling capability for organizational information systems that includes adequate preparation, detection, analysis, containment, recovery, and user response activities.

Basic

3.6.2 Incident

Response

Track, document, and report incidents to appropriate officials and/or authorities both internal and external to the organization.

Basic

3.6.3 Incident

Response

Test the organizational incident response capability.

Derived

3.7.1 Maintenance

Perform maintenance on organizational information systems.

Basic

3.7.2 Maintenance

Provide effective controls on the tools, techniques, mechanisms, and personnel used to conduct information system maintenance.

Basic

3.7.3 Maintenance

Ensure equipment removed for off-site maintenance is sanitized of any CUI.

Derived

3.7.4 Maintenance

Check media containing diagnostic and test programs for malicious code before the media are used in the information system.

Derived

3.7.5 Maintenance

Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete.

3.7.6 Maintenance

Supervise the maintenance activities of maintenance personnel without required access authorization.

Derived

3.8.1 Media

Protection

Protect (i.e., physically control and securely store) information system media containing CUI, both paper and digital.

Basic

3.8.2 Media

Protection

Limit access to CUI on information system media to authorized users.

Basic

3.8.3 Media

Protection

Sanitize or destroy information system media containing CUI before disposal or release for reuse.

Basic

3.8.4 Media

Protection

Mark media with necessary CUI markings and distribution limitations.

Derived

3.8.5 Media

Protection

Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.

Derived

3.8.6 Media

Protection

Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.

Derived

3.8.7 Media

Protection

Control the use of removable media on information system components.

Derived

3.8.8 Media

Protection

Prohibit the use of portable storage devices when such devices have no identifiable owner.

3.8.9 Media

Protection

Protect the confidentiality of backup CUI at storage locations.

Derived

3.9.1 Personnel

Security

Screen individuals prior to authorizing access to information systems containing CUI.

Basic

3.9.2 Personnel

Security

Ensure that CUI and information systems containing CUI are protected during and after personnel actions such as terminations and transfers.

Basic

3.10.1 Physical

Protection

Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.

Basic

3.10.2 Physical

Protection

Protect and monitor the physical facility and support infrastructure for those information systems.

Basic

3.10.3 Physical

Protection

Escort visitors and monitor visitor activity. Derived

3.10.4 Physical

Protection

Maintain audit logs of physical access. Derived

3.10.5 Physical

Protection

Control and manage physical access devices. Derived

3.10.6 Physical

Protection

Enforce safeguarding measures for CUI at alternate work sites (e.g., telework sites).

Derived

3.11.1 Risk

Assessment

Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational information systems and the associated processing, storage, or transmission of CUI.

3.11.2 Risk

Assessment

Scan for vulnerabilities in the information system and applications periodically and when new vulnerabilities affecting the system are identified.

Derived

3.11.3 Risk

Assessment

Remediate vulnerabilities in accordance with assessments of risk.

Derived

3.12.1 Security

Assessment

Periodically assess the security controls in organizational information systems to determine if the controls are effective in their application.

Basic

3.12.2…