693KA8-24-DRAFTSIR-INVERSE_Section C SOW.pdf

DRAFT

Invoice Validation and Expense Reconciliation Services

(INVERSE)

SECTION C

STATEMENT OF WORK

June 20, 2024

Federal Aviation Administration

800 Independence Avenue, SW

Washington, DC 20591

INVERSE DRAFT SIR 693KA8-24-R-XXXXX

SECTION C - SOW

Contents C. Statement of Work

C.1 Introduction

C.1.1 Background

C.1.2 Scope

C.1.3 Magnitude of Effort

C.2 Applicable Documents

C.2.1 Order of Precedence Between the SOW and Applicable Documents

C.2.2 Availability of Documents

C.3 Government-furnished Items and Government Responsibilities

C.3.1 Government-Furnished Items (GFI)

C.4 Contractor-Provided Services and Functions

C.4.1 INVERSE Program Management

C.4.2 INVERSE User Portal and Data Repository

C.4.3 Invoice Review and Reconciliation

C.4.4 Payment Reconciliation and Expensing

C.4.5 Budget Tracking, Analysis and Forecasting

C.4.6 Data Tracking and Analysis

C.4.7 Security Management

C.4.8 User Orientation

C. STATEMENT OF WORK

C.1 INTRODUCTION

C.1.1 BACKGROUND

The Federal Aviation Administration (FAA) acquires telecommunications services and equipment to support the nation’s air traffic control system, known as the National Airspace

System (NAS), as well as to support administrative and other non-NAS functions. The FAA has established the FAA Enterprise Network Services (FENS) program to ensure that the FAA’s needs for telecommunications services will continue to be met in a cost-effective manner through

September 2038. In addition, the FAA purchases administrative services from the

FAA/Enterprise Infrastructure Solutions (EIS) contract and may purchase telecommunications services through other contract vehicles in the future. Although the FAA is currently processing

FAA/EIS bills, the FENS schedule currently assumes the first telecommunications invoice will need to be processed by [TBD].

The FENS contract will be the primary vehicle through which the FAA acquires a broad range of telecommunications services and telecommunications support services. The FENS contractor will submit invoices for the services monthly and charges must be reviewed and validated prior to final payment. The FAA/EIS contract will be a secondary vehicle for which the FAA procures telecommunication services. The FAA intends to procure the required invoice review validation, and reconciliation services under a new contract vehicle for the above-mentioned services. The contractor will be responsible for verifying that all invoiced charges have been ordered, priced, billed, and expensed correctly. The objectives of this effort are to improve control and oversight of telecommunications costs, facilitate budgeting and planning, and support the implementation of a fee-for-service program to allocate telecommunications costs to users.

C.1.2 SCOPE

C.1.2.1 Overview

This Statement of Work (SOW) describes the functions and services to be provided by the

INvoice Validation and Expense Reconciliation SErvices (INVERSE) contractor to assist the

FAA in the financial management of the FENS and FAA/EIS contract.

The following paragraphs identify the required work elements to be performed by the INVERSE contractor.

I. Program Management - Manage the INVERSE contract to ensure that all required functions are performed according to the program schedule and within the allocated cost.

Conduct program status reviews and participate in technical interchange meetings related to the INVERSE.

II. User Portal and Data Repository- Develop and maintain the INVERSE USER portal for information exchange, CDRL workflow, and reporting capability in addition to a secure on-line repository of all order, invoice, contract data, CDRLs and reports.

III. Invoice Review and Reconciliation - Review all invoices submitted by the FENS and

FAA EIS contractor to ensure that invoiced items and the associated charges are consistent with the current active service orders and quantities, contractual prices, and

Service Level Agreement (SLA) credits due. Identify and notify the FAA of any discrepancies. Coordinate the resolution of discrepancies with the FENS and FAA EIS contractor and notify the FAA of the outcome of the discrepancy resolution process.

IV. Payment Reconciliation and Expensing - Based on government provided payment rules, provide government with detailed payment record of accounting codes used for each invoice and review government accounting reports to ensure that specific charges were expensed to the appropriate accounting and appropriation accounts. Identify discrepancies and required account adjustments.

V. Budget Tracking, Analysis and Forecasting - Track all FENS and FAA EIS charges by accounting and appropriation code, type of funds, and fiscal year of funds. Compare the actual expenses to the amount of funds budgeted and obligated for the associated services. Develop projections of future costs and advise the FAA of potential variances between obligations and projected costs.

VI. Data Tracking and Analysis - Conduct analyses of invoice data, associated funding and usage data to identify trends and cost drivers. Prepare cost forecasts and advise the FAA of potential issues.

VII. Security Management - Provide the requisite security measures to interface with FAA systems, ensure data integrity, and protect FAA data from unauthorized access.

VIII. User Instruction – Provide instruction and documentation to provide adequate training for using the INVERSE User Portal.

Sections C.4 of this SOW elaborate upon the required functions to be performed by the

INVERSE contractor within each work element.

C.1.3 MAGNITUDE OF EFFORT

The magnitude of effort on the INVERSE contract will be a function of the number of services ordered, the number of CLINs per order, the number of discrepancies identified, and other factors. The actual quantities experienced under the FENS and FAA/EIS contract will vary over time.

C.2 APPLICABLE DOCUMENTS

Services provided under this contract must comply with the applicable orders, directives, standards, and policies (collectively referred to as “applicable documents”) listed in Section 2 of the INVERSE Functional and Performance Specification (IFPS) Attachment J-1.

The applicable documents consist of Government documents as well as non-Government documents. The Contractor is responsible for reviewing all applicable documents, understanding their impact on the delivery of the required services, and complying with the applicable requirements. The most current version of each document at time of contract award will be the applicable version at the beginning of contract performance. When and if updates are made to applicable documents during the contract period of performance, the Contractor will be allowed to assess the update for any effect on contract performance before it is incorporated into the contract.

C.2.1 ORDER OF PRECEDENCE BETWEEN THE SOW AND APPLICABLE DOCUMENTS

If the requirements of this SOW and the Applicable Documents referenced in IFPS Section 2, the

SOW has precedence.

If the Contractor identifies a potential conflict between the SOW and the Applicable Documents, the Contractor must advise the FAA Contracting Officer (CO) for resolution in accordance with the conditions specified in Section H.5.

C.2.2 AVAILABILITY OF DOCUMENTS

Copies of FAA orders, directives, and policies may be obtained from the FAA Contracting

Officer as identified in Section G of this contract. Requests must clearly identify the title and/or number of the document.

C.3 GOVERNMENT-FURNISHED ITEMS AND GOVERNMENT RESPONSIBILITIES

C.3.1 GOVERNMENT-FURNISHED ITEMS (GFI)

To enable the INVERSE contractor to perform the required functions, the government or its designee will provide the following data:

(1) Service order data, service acceptance dates, and service discontinuation dates;

(2) FENS and FAA/EIS CLIN structure and pricing;

(3) Thresholds for usage-based CLINs;

(4) Funds obligation data by delivery order modification number, including the accounting and appropriation codes;

(5) FENS and FAA/EIS monthly invoices including invoice detail records and other supporting information;

(6) Invoice discrepancies resolved by the FAA;

(7) FENS and FAA/EIS service level agreements (SLAs);

(8) Outage data (for determining when SLA credits are due);

(9) FAA payment data.

The FAA will provide the INVERSE contractor with a secure electronic interface to the FENS and EIS Online Portals. The INVERSE contractor will be granted the appropriate privileges to obtain read-only access to service order data and monthly invoices from FENS and EIS. The

INVERSE contractor must develop their systems to use Application Programing Interfaces

(APIs) to the greatest extend possible to reduce manual transfer of electronic data.

If apparent errors are detected within input data for which the government is the source, the

INVERSE contractor must notify the Contracting Officer and COR via e-mail notification or

USER Portal notifications. Multiple errors may be compiled in a single notification and must be made within one business day when errors are detected. The notification must either contain the below information or point to the location within the INVERSE User Portal that contains the following information at a minimum:

(1) the source of the data, e.g., the FENS Program Office, FAA/EIS Program office;

(2) the category of source data;

(3) the date the source data was received by the INVERSE contractor;

(4) a description of the source data error; and

(5) the correct value(s) if identifiable.

The interval at which the data will be updated varies among the items. Service order information and funds obligation data may be updated as often as once per week. The invoice data, outage data, and payment data will be provided monthly. The usage thresholds, SLA, and reference cost data should be relatively static; updates will be provided as necessary. The CLIN pricing will change periodically, and it may be updated due to:

(1) the start of an option year;

(2) the introduction of a new service type; or

(3) the modification of an existing service type.

C.4 CONTRACTOR-PROVIDED SERVICES AND FUNCTIONS

This portion of the SOW defines specific requirements that must be met by the Contractor when providing the scope of services identified in SOW Paragraph C.1.2.

The Contractor must provide the services and perform the efforts described in this SOW within the timeframes specified in Section F of this contract or as otherwise specified at the time of order. The Contractor is responsible for providing all items necessary to meet the requirements of this contract except for those items identified as Government-furnished in Paragraph C.3.1

C.4.1 INVERSE PROGRAM MANAGEMENT

C.4.1.1 Program Management Organization

The INVERSE contractor must establish a program management office at their own premises to support and manage the delivery of INVERSE services throughout the life of the contract. The

INVERSE contractor must ensure that sufficient resources are available to provide the INVERSE services required by the FAA. The INVERSE contractor must coordinate with the FAA on the plans and schedule to resolve any programmatic issues that may arise. While resolving issues, the INVERSE contractor must adhere to the schedule agreed upon by FAA and must advise the

FAA on the status of the issue resolution.

The INVERSE contractor must maintain clear and effective lines of authority, coordination, communication, and accountability between their INVERSE contract team organization and the

FAA. To facilitate communication and coordination, the INVERSE contractor must provide a

Program Manager to interface with the FAA. The INVERSE contractor’s Program Manager or his or her designated alternate must be available for consultation with the Government on weekdays from 8:00am to 5:00pm in the Eastern time zone (except for Federal holidays).

Contractor may be required to attend meetings at the FAA Program Office site located in

Washington, DC.

C.4.1.2 Program Management Functions

To ensure compliance with all requirements of the contract, the INVERSE contractor must be responsible for the management and control of all personnel assigned to the INVERSE contract including subcontractors/team members. The INVERSE contractor must provide a Program

Management Plan briefing within 30 days of contract award in accordance with CDRL F001.

In performing the INVERSE program management functions, the INVERSE contractor must provide a Program Master Schedule within 30 days of contract award that addresses the first year of the contract in accordance with CDRL F002. To ensure the FAA’s awareness of all activities and progress, the INVERSE contractor must report the status of the INVERSE program in a

Monthly Status Report as described in CDRL F003.

The INVERSE contractor must conduct quarterly Program Management Reviews (PMRs) as prescribed in CDRL F004 until the INVERSE User Portal and system is completed or as requested by the Government. The Government may also request the Contractor must attend and participate in technical, contractual, and programmatic meetings to address specific issues. The

Government will indicate whether the meeting will be held at a Government facility or a

Contractor facility. In addition, the Government will indicate whether Contractor participation must be in-person or whether it may be via video teleconference depending on the nature of the meeting. The personnel representing the Contractor must have the requisite knowledge, skills, experience to discuss the topics identified on the meeting agenda. As requested by the

Government, the Contractor must coordinate the scheduling of meetings with required participants, issue calendar invitations, and prepare agendas. In addition the Contractor must prepare presentation materials, meeting minutes, and action item lists to support the conduct of the meetings.

C.4.1.3 Financial Analysis

The INVERSE contractor must assist the FAA in ad hoc analysis as needed. The analysis may include but is not limited to:

(1) Analyzing the amount of Interest paid associated with late payments.

(2) Analyzing the Return on Investment for implementing new service requirements on

FENS and/or EIS and documenting the comparison of FENS/EIS actual costs to the reference cost.

(3) Specific customer funding status on specific programs within the FAA that have unique

CLINs

(4) Costs by Facility Type and Region

(5) Providing a customized history by service or CLIN or DO for a specific period of time.

C.4.2 INVERSE USER PORTAL AND DATA REPOSITORY

C.4.2.1 Establish and Maintain INVERSE User Portal

The INVERSE contractor must establish and maintain a User Portal as specified the IFPS. The portal will be the primary interface for information and will enable Government-designated role-based users to access: (1) Contractor-provided applications and tools that support required processes (2) Automated workflow of approvals for all CDRLS allowing accepting or rejecting with comments; (3) Access to invoices and related reports; (4) access to government furnished data.

C.4.2.2 Establish Repository for INVERSE Data and Report Generation Capability

The INVERSE contractor must establish a repository within the INVERSE User Portal of all order, invoice, and financial data received from the government (or its designee) to support the performance of the work elements described in this Statement of Work. The INVERSE contractor also must store within the repository all data produced to satisfy the reporting requirements specified in this SOW (referred to as INVERSE-generated data).

The INVERSE contractor must provide authorized users with on-line access to the INVERSE

User Portal repository so that data stored within repository is available to users per the specifications contained in the IFPS. The INVERSE contractor must provide authorized users with the ability to browse and query the data repository and obtain pre-defined and ad hoc reports.

Users accessing the data repository and INVERSE User Portal will be geographically dispersed and will include both FAA employees and its support contractors. The INVERSE contractor must establish and maintain an INVERSE User Portal and data repository in accordance with

IFPS Section 5.1. The INVERSE contractor must maintain all software and product licenses required to develop, operate, and maintain the INVERSE User Portal and on-line data repository.

The INVERSE contractor must control access to the data stored in the repository and protect its integrity in accordance with the security requirements defined in the IFPS and provide monthly a recuring list of users, both new and removed.

The efforts to customize existing tools and/or establish and maintain new tools for invoice reconciliation are covered under CLIN 0001. The efforts to establish and maintain the

INVERSE USER Portal and data repository that meet the FAA’s requirements for on-line data access, report generation, and data analysis capabilities are covered under CLIN X008. The combination of tools provided for Government use and tools used solely on an internal basis by the INVERSE contractor is referred to as the INVERSE tool suite.

The INVERSE contractor must conduct one or more system-level reviews of the INVERSE tool suite so that the FAA may assess:

(1) whether input data are interpreted and manipulated properly;

(2) the readability of data and report presentation formats;

(3) the user-friendliness of tools provided for Government use; and

(4) overall compliance with requirements.

The INVERSE contractor must provide a System-Level Design Review Data Package to the

FAA in accordance with CDRL F005. The number of reviews and the timeframe for the review(s) relative to the INVERSE Contract Award date are to be proposed (TBP). The

INVERSE contractor must test the tool suite to demonstrate its compliance with the requirements defined in the IFPS. The testing of the tool suite may be witnessed by the Government. Test results must be supplied to the Government (regardless of whether the tests are witnessed by the government). The INVERSE tool suite will be deemed ready for use upon approval of the final submission of the System Test and Acceptance Report per CDRL F006.

C.4.2.3 Maintain INVERSE User Portal and Data Repository

C.4.2.3.1 General

The INVERSE Contractor must maintain the INVERSE User Portal and Data Repository in accordance with the requirements in IFPS Section 5.1.

The INVERSE Contractor must obtain approval from the FAA COR prior to commencing any

Planned Outages.

C.4.2.3.2 Data Storage

The INVERSE contractor must maintain within the repository all order, invoice, and financial data received from the government (or its designee) to support the performance of the work elements described in this Statement of Work. In addition, the INVERSE contractor must maintain all INVERSE generated data produced to satisfy the reporting requirements specified in this SOW. The INVERSE contractor must maintain the complete FENS and FAA/EIS program history of all service orders, invoice charges, discrepancies, and payment information per the data storage requirements listed in the IFPS. FENS and FAA/EIS data must be segregated in a manner that allows separate or combined access to the data based on government direction.

C.4.2.3.3 Data Accessibility

The IFPS allows for the data repository to be partitioned into an on-line portion and an off-line archive. The INVERSE contractor must make all INVERSE data accessible to authorized users in accordance with the timeliness of data requirements defined in the IFPS and based on users access to FENS, FAA/EIS or both. The INVERSE contractor also must establish a back-up data repository that can be accessed by users within 2 business days of the unavailability of the primary data repository.

The INVERSE contractor must provide the solution where the INVERSE User Portal, on-line data repository, the off-line archive, and the back-up data repository reside.

C.4.2.3.4 Maintenance of User Accounts

The INVERSE contractor must manage role-based user accounts for the duration of the contract.

The INVERSE contractor must establish accounts for new users within one week of receiving a request for a new user account. The INVERSE contractor must maintain user passwords and notify users when passwords are due to be updated to meet the security requirements specified in future J attachment. The INVERSE contractor must close user accounts within 2 business days of receiving a request to close an account.

C.4.2.3.5 Upgrade the INVERSE Data Repository and Report Generation Capability

As ordered, the INVERSE contractor must upgrade the INVERSE data repository and report generation capability in the event that it becomes necessary to modify existing capabilities, add new capabilities, accommodate additions and changes to the data stored within the repository, or make other upgrades to meet the SOW. When changes are made to the INVERSE data repository and report generation capability, the INVERSE contractor must perform regression testing and document the results in a revised delivery of CDRL F006.

C.4.2.3.6 Report Generation

The INVERSE contractor must provide the FAA with on-line access to all report generation capabilities via the INVERSE User Portal. CDRL reports identified in Attachment J-2 are to follow a prescribed format identified in associated Data Item Descriptions (DIDs) provided in

Attachment J-3. With respect to reports described in this SOW or requested by the FAA for which there is no CDRL, the INVERSE contractor must provide the FAA with an on-line capability to define the format of a report and to generate the report on an as needed basis. The

INVERSE contractor must ensure that the data contained in on-line reports reflect the most current invoice and accounting data available. The INVERSE contractor must provide the FAA with the ability to download any report from the INVERSE User Portal.

C.4.3 INVOICE REVIEW AND RECONCILIATION

The INVERSE contractor must review all invoices submitted by the FENS and FAA/EIS contractor for accuracy and consistency with the ordered services and Service Level Agreements.

The FENS and FAA/EIS invoice data will be made available to the INVERSE contractor in a commercially available electronic format. The INVERSE contractor must obtain the FENS invoice data from the associated online portals of FENS and FAA/EIS. All service order information required to perform the invoice review will be made available to the INVERSE contractor by the FAA. In performing the invoice review and reconciliation process, the

INVERSE contractor must follow the business rules defined by the FAA.

The following subsections further elaborate upon the actions required on the part of the

INVERSE contractor when reviewing and reconciling invoices.

C.4.3.1 Consistency with CLIN List and Pricing Data

Invoices will be submitted by the FENS and FAA/EIS contractors monthly for all delivered services. The INVERSE contractor must review each invoice to ensure that it matches the

FAA’s order for each service in terms of the quantities and types of CLINs. Multiple service order numbers (SONs) may be associated with a particular service based on revisions of that service. The INVERSE contractor must confirm that all invoiced CLINs reflect the cumulative effect of all associated SONs.

The INVERSE contractor must review each invoice to ensure that the charges on an invoice are consistent with the prices are in accordance with the associated contract. CLINs for FENS and

FAA/EIS telecommunications services may be firm fixed price (FFP), usage sensitive, or mileage based. For usage sensitive CLINs, the FAA will define thresholds so that the INVERSE

Contractor can identify when usage was not within the expected range.

C.4.3.2 Review of non-CLIN Items

The INVERSE contractor must review items listed on invoices for which there are no CLINs.

These items may include, but are not necessarily limited to:

(1) taxes;

(2) surcharges;

(3) pre-subscribed interexchange carrier charges (PICCs); and

(4) universal service fees (USFs);

The INVERSE Contractor must identify any instances where the amounts are inappropriate, point out any trending issues that could indicate an error, or not properly applied.

C.4.3.3 Confirmation of SLA Credits and Billing Adjustments

Under the FENS and FAA/EIS contract, the FAA may receive credits from the contractors as a result of service outages. The outages and SLA credits will be associated with an individual service. The FAA will provide the INVERSE contractor with the information required to determine the value and due date of the credit.

In addition to SLA outage credits, the FAA may be due billing adjustments as a result of the invoice review and discrepancy resolution process. As part of the invoice review process, the

INVERSE contractor must determine whether the proper credits and billing adjustments were received. If not, the INVERSE contractor must reconcile the discrepancy in the same manner as other billing errors.

The FENS and FAA/EIS contractors are required to provide the FAA with credits as a function of the applicable monthly recurring charges if the service due date is missed. The FENS and

FAA/EIS contractor is deemed to have missed the service due date if the service acceptance occurs after the service due date cited in the service order. The FAA/EIS Contractor credit schedule has not yet been determined but may be implemented in the future. The INVERSE contractor must identify these instances based upon the service due dates and actual service acceptance dates provided by the FAA, calculate the amount of the credit due to the FAA, and confirm that it is properly reflected on the FENS or FAA/EIS invoice for all affected CLINs.

C.4.3.4 Accuracy of Billing Period

The INVERSE contractor must also review each invoice to ensure that any prorating of costs for any individual service order was done in an accurate manner in accordance with the business rules defined in Attachment J-4. For new service orders with recurring costs, the INVERSE contractor must ensure that the billing of the monthly recurring charges did not start prior to the

FAA’s acceptance date for the service. In the same manner, when a service is being discontinued, the INVERSE contractor must confirm that billing did not continue beyond the date that the service was directed to be discontinued.

C.4.3.5 Identification of Invoice Discrepancies

The INVERSE contractor must identify all invoice discrepancies outside the range of the thresholds listed in Table C.4-1. The thresholds are to be applied to the difference of the invoiced price and the CLIN price.

Table C.4-1 Potential Thresholds for What Constitutes an Invoice Discrepancy

Invoice Item Threshold

Fixed price CLIN’s 0%

Usage-based CLIN’s + 10%

Mileage-based CLINs + 10%

Service Billing Date 0%

Credits, i.e., appropriate credits not shown, incorrect credit value or no credit when credit was due

0%

Adjustments 0%

Taxes, USFs, and PICCs + 15%

CLINs are billed up to an accuracy of $0.000001 depending on the CLIN. A threshold of 0% implies that dollar amount at the unit level on the invoice must identically match the CLIN price.

The INVERSE contractor must categorize all invoice discrepancies based upon whether they appear to be administrative errors or whether further investigation with the contractor is required.

Categories of discrepancies may include (but are not necessarily limited to) those listed in Table

C.4-2.

Table C.4-2 Categories of Invoice Discrepancies

Administrative Resolve with Contractor

Computational error Usage not within projected range

Incorrect fixed unit cost applied Service order number not recognized

Incorrect quantity CLIN not listed on service order

Incorrect mileage Credit not received

Billing started before service acceptance date

Billing continued after service discontinuance date

The INVERSE contractor must assign a unique identification number to each invoice discrepancy and a code indicating the type of discrepancy. The INVERSE contractor must provide an itemized listing of all discrepancies to the FAA and the FENS or FAA/EIS contractor.

When computing the net amount of an invoice to be paid, the INVERSE contractor must deduct the total value of discrepancies categorized as administrative and discrepancies resolved with the contractor since the previous invoice. The net amount to be paid by Funding Account Number

(FAN) must be identified in the INVERSE Certification and Expense Recommendation Report in accordance with CDRL F007. The INVERSE contractor must identify all items in the

“Resolve with Contractor” category as Disputed Payment (DP) and when the dispute is resolved, the INVERSE contractor must reflect the associated adjustments in the next delivery of the

CDRL F007.

To support the payment provisions of the FENS and FAA/EIS contracts, the INVERSE contractor must provide the Invoice Certification Document to the FAA no later than 20 days after the date that the invoice is made available to the INVERSE contractor.

The requirements associated with the discrepancy resolution process are described in the next section.

C.4.3.6 Discrepancy Resolution

Along with notifying the FAA, the INVERSE contractor must be responsible for notifying the

FENS and FAA/EIS contractors of all billing discrepancies identified during the invoice review process via the INVERSE User Portal. The INVERSE contractor must be responsible for coordinating with the contractor and working to resolve all discrepancies. The INVERSE contractor must provide an itemized listing of all discrepancies in accordance Discrepancies

Recommendation Report CDRL F008. The INVERSE contractor must provide the FAA with a list of all discrepancies via the INVERSE User Portal, regardless of type, that are not resolved within two billing cycles. The report must be a single report that each month has all discrepancies not resolved within two months. The FAA will take final action to resolve discrepancies that remain in dispute after three billing cycles. The FAA will notify the

INVERSE contractor of the outcome of discrepancies resolved by the FAA and the INVERSE contractor is responsible for updating the report on the INVERSE User Portal.

C.4.4 PAYMENT RECONCILIATION AND EXPENSING

On a monthly basis, the FAA will provide the INVERSE contractor with the detailed payment record of Accounting Classification Codes (ACC) used on each invoice via the INVERSE User

Portal. The INVERSE contractor must compare the payment record with the data compiled in the INVERSE Certification and Expense Recommendation Report CDRL F007 to ensure that charges were expensed to the appropriate ACCs. The INVERSE contractor must verify that the proper delivery order and delivery order modification numbers were cited on the service order and the invoice. The INVERSE contractor must identify all discrepancies to the FAA and must provide the FAA with the supporting data required to reconcile the accounts in accordance with

CDRL F008. The INVERSE contractor also must conduct a follow-up review of ACCs to ensure that any required adjustments have been made based upon previously identified discrepancies. The INVERSE must include its findings of the follow-up review in its monthly delivery of CDRL F008.

When there are multiple ACCs associated with a particular service order, the FAA will provide the INVERSE contractor with the payment rules for distributing the costs among the ACCs. As part of the account review, the INVERSE contractor must identify all instances where the payment rules were not followed.

If an ACC is used to pay non-Contractor related expenses as well as Contractor charges, the

FAA may elect to provide that information to the INVERSE contractor. In those instances, the

INVERSE contractor must provide the FAA with a roll-up of the total expenses and a breakdown of the portion that were Contractor-related and non-Contractor related. The INVERSE contractor will not be responsible for validating non-Contractor related expenses.

C.4.5 BUDGET TRACKING, ANALYSIS AND FORECASTING

The INVERSE contractor must provide the FAA with the capability to track actual Contractor costs against the amounts budgeted. To facilitate this process, the FAA will provide the

INVERSE contractor with funding source data associated with individual Contractor service orders. The information may include (and is not necessarily limited to), delivery order modifications, organization codes, ACCs and their components (CAF, CCC, JON), types of funds (R,E, & D, F&E, and OPS). The INVERSE contractor must provide the FAA the ability to view cost itemizations and roll-ups for each of these designations.

For each service order, the INVERSE contractor must track the actual expensed charges against the amount of funds obligated by ACC. Upon the first indication of the potential for a shortfall of funds, the INVERSE contractor must notify the FAA via the INVERSE User Portal. The

INVERSE contractor must provide a summary report of actual versus obligated costs in accordance with FAN Status and Expensing Summary Report CDRL F009. The report must reflect the most recent invoice data that has been reconciled in addition to cumulative contract values.

The FAA has a requirement to project its OPS Funding requirements for up to two fiscal years in advance based upon the transition of costs from F&E funding accounts. This budgeting process is referred to as the Transfer to O&M (TOM) Process The INVERSE contractor must support the TOM Process by identifying all OPS funding requirements down to the level of an individual service order. The INVERSE contractor must identify funding requirements by service order number along with the date that the transfer to O&M will occur. In addition, the INVERSE contractor must provide reporting capability that aggregate the OPS funding requirements based on user specified criteria. The INVERSE contractor must also produce a summary OPS Funding and Budget Projection Report in accordance with CDRL F010.

The FAA recovers the cost of some telecommunications services from other Federal agencies

(e.g., DoD) and non U.S.-entities (NAV Canada and the Government of Bermuda) through reimbursable agreements. The FAA will provide the INVERSE contract with copies of the reimbursable agreements. As part of the expensing recommendations, the Contractor must review and validate all charges, identify those charges against the associated reimbursable agreement, and prepare an invoice to bill the charges to the Federal agency or non – U.S.-entity.

Invoices for these agreements must be sent monthly in accordance with FAA Invoice to

Organizations with Reimbursable Agreements CDRL F011 which will have a unique letter after

F011 for each unique agency or non U.S-entities (ie F011a F011b etc.) In addition, the

Contractor must track available funds on the reimbursable agreements and advise the INVERSE

COR when the funds remaining on a reimbursable agreement are less than 4 months’ based on the past 12-month period.

C.4.6 DATA TRACKING AND ANALYSIS

The INVERSE contractor must analyze all data within the INVERSE database to identify trends, cost drivers, and future budget requirements. The INVERSE contractor must provide the FAA with the ability to view, sort, filter, and summarize the data as described in Data Tracking and

Analysis Report CDRL F012 via the INVERSE User Portal.

The INVERSE contractor must provide cost tracking reports on the Portal based upon the actual amounts paid on invoices taking into account any credits, including SLA credits or adjustments that have been applied. For all tracking reports on cost and usage data, the INVERSE contractor must provide the FAA with capability to designate:

(1) The resolution of the data analysis indicating whether statistics should be compiled on a daily, monthly, or yearly basis; for individual services or specific categories of services;

and other subsets and groupings that may be suggested by the INVERSE contractor.

(2) The interval for the summary, i.e., monthly, by fiscal year, from inception of billing, the most recent user-specified number of months, and other intervals that may be suggested by the INVERSE contractor.

The INVERSE contractor also must provide the FAA with the capability to project costs and usage for future time periods.

For usage based CLINs that have been in-service for more than three months, the INVERSE contractor must provide the FAA with the capability to specify a percentage threshold (e.g., +15%) and identify instances where usage in a given month exceeds the previous month’s level by an amount outside the threshold range.

C.4.7 SECURITY MANAGEMENT

The Contractor must provide the security management functions identified in the following subparagraphs.

C.4.7.1 General

(1) The Contractor must implement, operate and maintain security functions and conduct security assurance activities to protect INVERSE Infrastructure (System, Software, INVERSE User Portal) as required by the IFPS and other provisions of this contract.

(2) The Contractor must designate a Security Lead to serve as the focal point for all security-related activities and act in a counterpart role to the Government Security Lead. The

Contractor’s Security Lead must meet the criteria defined in Section H.2 for the Security

Lead role. The Contractor’s Security Lead must provide reports to the Government

Security Lead on the status of security-related activities and support meetings as requested to ensure that security implications are considered when technical issues and candidate solutions are being discussed.

(3) The Contractor must manage user access to INVERSE User Portal Functions and the enforcement of all applicable security controls.

(4) The Contractor must ensure that all personnel who have access to INVERSE User Portal and System are authorized to work on FENS services.

C.4.7.2 Information Systems Security

(1) The Contractor must establish and maintain an information security management program to support the activities necessary to achieve annual system authorization by the

ATO Authorizing Official (AO) and re-authorization when major system changes occur by in accordance with Attachments J-5 and with FAA Order 1370.121B, FAA

Information Security and Privacy Program and Policy, Appendix 1, FAA Information

Security and Privacy Program Management.

(2) The Contractor must comply with the FAA Security Authorization Handbook, FAA

Order 1370.121B, National Institute of Standards and Technology (NIST) Special

Publication (SP) 800-18, Guide for Developing Security Plans for Federal Information

Systems, and NIST SP 800-53, Security and Privacy Controls for Federal Information

Systems and Organizations.

(3) The Contractor must provide access to INVERSE Infrastructure to support the FAA in annual and ongoing security assessments that performed to ensure the system is authorized to operate. The FAA may conduct penetration testing on Contractor-provided systems under negotiated rules of engagement.

(4) The Contractor must implement security controls based on Federal Information

Publication Standard 199 (FIPS-199) Moderate Security Categorization level.

(5) The Contractor must implement security controls as documented in Attachment J-5 for all

INVERSE Infrastructure that utilizes shared infrastructure not dedicated to INVERSE.

The Contractor must provide a detailed description of the shared infrastructure technologies used and the associated service agreements for the purpose of identifying risks to the FAA.

(6) The Contractor must document the implementation of security controls relative to

INVERSE dedicated and shared infrastructure in the System Security Plan (CDRL F014) and the System Characterization Document (CDRL F015). The Contractor must update the security documentation following any architectural changes, software modifications, additions, and updates. The Contractor must also provide support to assist with

Government-conducted vulnerability assessments, risk and requirements analysis, and design reviews.

(7) The Contractor must assist FAA efforts to implement continuous system security monitoring to address requirements of the Information Security Continuous Monitoring

(ISCM) process, which may include measures for automated system scanning to determine the system’s security posture at scheduled intervals.

(8) The Contractor must assist the Government with independent risk assessments as requested. The Contractor must implement all required documentation updates resulting from the risk assessment. As requested by the Government, the Contractor must provide cost estimates to address recommended system changes resulting from the risk assessment.

(9) The Contractor must address and resolve system vulnerabilities when identified. The

Contractor must ensure that the system is configured to allow only authorized individuals access to the system. The Contractor must ensure that all delivered software is free of malicious code and promptly install security-relevant software updates (e.g., patches, service packs, and hot fixes). Vulnerabilities discovered during security assessments, continuous monitoring, incident response activities, or information system error handling, must also be addressed. The Contractor must inform the Government of the methods used to identify and test for new and/or additional vulnerabilities that appear during the system’s full life cycle.

(10) The Contractor must remediate identified vulnerabilities according to the remediation time frames specified in Attachment J-5.

C.4.7.3 Cybersecurity Exercises

The Contractor must support cybersecurity exercises conducted by the Government as a mechanism to assess the preparedness of the FAA’s cyber response capability and its ability to withstand technology failures and cyber incidents.

C.4.7.4 Security Authorization Documentation

The Contractor must use the current ATO-provided templates, which are updated annually, and the tailored security controls in Attachments J-5 as a basis for the preparation of the following documentation to support the FAA’s Security Authorization of INVERSE. A System

Authorization Briefing (CDRL F013) must be provided to the FAA. The purpose of the System

Authorization Briefing is to provide a high-level description of the system, its mission, functions, and users to support the security authorization of the system. The System Authorization Briefing is required for the initial authorization for the INVERSE system and when there are substantial changes to the system’s operational, support, development, monitoring, or test environment

(1) System Security Plan (CDRL F014);

(2) System Characterization Document (CDRL F015);

(3) System Privacy Documentation (CDRL F016);

(4) Information System Contingency Plan (CDRL F017);

(5) Information System Contingency Test Plan (CDRL F018);

(6) Information System Contingency Test Results Report (CDRL F019); and

(7) Information Systems Decommissioning and Disposal Plan (CDRL F020).

C.4.7.5 Personnel Security

(1) The Contractor must comply with the personnel security requirements as specified in

FAA Order 1600.1E, Personnel Security Program, FAA Order 1600.72A, Contractor and

Industrial Security Program, FAA Order 1370.121B FAA Information Security and

Privacy Program and Policy Appendix 14, Personnel Security, and Attachment J-5.

(2) The Contractor must ensure that all personnel who occupy positions designated to support INVERSE must be appropriately cleared and granted access prior to occupying such a position, in accordance with AMS Policy 3.14.2.1.1.

(3) All Contractor and subcontractor personnel must complete FAA Security Awareness

Training (SAT) and FAA Security and Hazardous Materials Safety Organization (ASH)

Security Awareness Virtual Initiative (SAVI) Training on an annual basis.

a. Contractor personnel issued FAA Personal Identity Verification (PIV) credentials and FAA e-mail accounts must complete the training in the FAA Electronic

Learning Management System (eLMS).

b. For personnel that support the FAA, but do not have FAA-issued PIV credentials and FAA e-mail accounts, the Contractor must certify to the Government that the personnel have taken equivalent security and privacy awareness training.

c. The Contractor must retain the training records for at least three years and provide evidence of completion upon the Government’s request.

C.4.7.6 Insider Threat Prevention Program

(1) The Contractor must establish and execute an insider threat program to protect the

INVERSE Infrastructure. The sources of insider threats are inclusive of Contractor personnel (as defined in Section H.10) and other individuals who are authorized to access systems, equipment, and other resources upon which the operation, monitoring, and control of INVERSE Infrastructure are dependent. The Contractor must document its

Insider Threat Prevention Program within the INVERSE PMP (CDRL F001).

(2) The insider threat program must include controls to deter, detect, prevent, and mitigate malicious insider activity as well as inadvertent and negligent acts through centralized integration and analysis of both technical and non-technical information to identify potential insider threat concerns.

(3) The Contractor must monitor and audit information for insider threat detection and mitigation. Critical program requirements include but are not limited to: (1) monitoring user activity on computer networks; (2) evaluation of personnel security information; (3) employee awareness training of the insider threat and employees’ reporting responsibilities; and (4) gathering information for a centralized analysis, reporting, and response capability.

(4) The Contractor must immediately notify the Government of any attempted or successful insider attack that impacts or has the potential to impact INVERSE Infrastructure. At least once per year within the Quarterly Program Reviews, the Contractor must provide the Government with status updates regarding its Insider Threat Prevention Program including, but not limited to, new risks identified, and new mitigation strategies employed.

(5) The Contractor must implement policies and procedures whereby the organization’s insider threat program accesses, shares, and integrates information and data derived from offices across the organization, including counterintelligence, security, information assurance, and human resources offices.

(6) The Contractor insider threat program must conduct host-based user monitoring of individual employee activities on INVERSE Infrastructure; provide insider threat awareness training to employees that includes the ability to recognize cyber threats such as email and malicious web site phishing which can pose unintentional insider threats and ways to recognize and report actions of employees who may be insider threats; receive access to information from all offices within the organization for insider threat analysis;

and conduct self-assessments of the organization’s insider threat posture.

C.4.7.7 Security Operations

(1) The Contractor must monitor the security posture of all INVERSE Infrastructure System components on a real-time basis.

(2) When requested by the Government, the Contractor must provide INVERSE Security

Information and Event Management (SIEM) data to support the Government’s security event monitoring and analysis.

(3) The Contractor must continuously track security-related patches and updates as released by the original equipment manufacturers (OEMs), assess their criticality and potential impact on INVERSE operations, and provide a recommended course of action to the

Government.

(4) The Contractor must implement Government-approved security-related patches and updates in accordance with the requirements in Attachment J-5.

C.4.7.8 Security Event Management and Data Analysis

(1) The Contractor must provide an Audit and Accountability function in accordance with

Attachment J-5.

(2) On a continuous basis, the Contractor must review/analyze event data, alerts, and system audit records for indications of inappropriate or unusual activity; investigate suspicious activity or suspected violations; report findings to the designated Government points-of-contact; and take necessary actions to mitigate any security threat.

(3) The Contractor must coordinate with designated Government POCs on all Cyber Threat

Intelligence, obtained from any internal or external sources, that is relevant to the protection of INVERSE Infrastructure.

(4) The Contractor must review the list of auditable events as defined in Attachment J-5 at a frequency of at least once per week and update it as necessary.

(5) The Contractor must retain audit records for Government-designated source or destination addresses for up to six years when requested by the Government.

C.4.7.9 C.4.2.12.11 Security Reporting and Event Analysis

(1) The Contractor must collaborate with FAA personnel to develop a process for requesting/performing changes to the configuration of the receiver to support receipt and parsing of events from FAA devices.

(2) The Contractor must implement a formal, documented, incident response policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.

(3) The Contractor must document security incidents affecting the INVERSE Infrastructure in the Security Incident Report (CDRL F021). The Contractor must also report security incidents to the Department of Transportation (DOT) Security Operations Center (SOC).

The Contractor must log all security incidents in the Contractor’s tracking system and update the log records until the incident is closed.

(4) The Contractor must initiate service recovery action immediately after any incident and coordinate with and obtain approval from the Government prior to implementing new countermeasures.

(5) The Contractor must immediately implement all Government-approved information security countermeasures as directed by the Government.

(6) The Contractor must test and/or demonstrate the incident response capability semi-annually using inserted alert data to determine the incident response effectiveness and document the results. The outcome of the test/demonstration must be conveyed to the

Government in a Security Incident…