Page | 1

Statement of Work FAALC Data Modernization and AI Integration

Draft 2025

1. Background

To sustain the Federal Aviation Administration’s (FAA) global leadership in advancing aviation safety and to enable greater organizational agility in a dynamic operational environment, the Federal Aviation Administration Logistics Center (FAALC) requires a secure, scalable, and interoperable data integration and analytics platform in support of FAALC modernization objectives. The platform shall be implemented in full compliance with applicable federal policies governing Artificial Intelligence (AI) adoption, use, and governance, including Executive Orders 13859, 13960, and 14319, as well as Office of Management and Budget (OMB) Memoranda M-21-06 and M-26-04, ensuring that all AI-enabled capabilities are lawful, trustworthy, purpose-driven, performance-based, accurate, explainable, secure, and resilient, with comprehensive auditability, risk management, and governance controls, while adhering to federal principles of truth-seeking, transparency, and ideological neutrality. The platform must facilitate rapid and efficient decision-making for the FAALC by enabling comprehensive data analysis to monitor, review, and analyze logistics, financial, systems engineering, and program management data. It should support FAALC processes that address urgent requirements in aviation safety, airspace sovereignty, homeland security, and the monitoring and maintenance of communications and surveillance technology for various federal entities both within the continental United States (CONUS) and outside (OCONUS). Furthermore, the tool must meet FAALC's needs while ensuring the availability and reliability of surveillance platforms critical to partner agencies involved in homeland security.

The tool, henceforth referred to as the “platform,” must be available and ready for deployment at the time of contract issuance and have evidence of successful, similar deployments. It should demonstrate platform capabilities and features for evaluating and socializing aerospace, communications, and surveillance systems engineering, in addition to financial, logistics, and program management data across the organization, as defined in this Statement of Work (SOW).

2. Scope of Work

The Contractor must furnish all necessary software licenses/cores (PT-PG-TERM current level is initially estimated at 20) and services (CES: Core Engineer Services) to perform the following tasks. All services and software licenses provided by the Contractor (including access for up to 100 Certification Service users (“users”) to the platform) must be in accordance with the terms and conditions of the Contractor’s License and Services Agreement. The FAA shall retain ownership rights, as outlined below, to all FAA Owned Data. The primary focus areas are as follows but not limited to:

• Dashboards, Reporting and Validation

• Funds Utilization

• Estimates

• Service Order Profiles

• Business Plan Automation (Revenue)

Draf t

Page | 2

a) a) Any data that is provided or uploaded by the FAA (including FAA authorized users) for transmission, storage, integration, import, display, distribution, or use in or through the platform, including any modified, aggregated, or transformed versions, data integration and transformation logic, and analytical outputs thereof.

b) b) Models, algorithms, analyses, or logic authored solely and independently by the FAA or its Authorized Users.

The contractor must be able to provide an appropriate FDE Model (Forward-Deployed Engineers) to understand their unique problems and build tailored solutions on the spot, acting as a consultant as well as a tech provider. In addition, the system should act as an ontology-driven operating system for data, unifying complex, siloed data into a single, actionable model.

The proposed solution is a proprietary OTS platform built on a foundry-based data architecture that integrates ingestion, governance, analytics, and operational workflows within a single environment. The foundry framework and supporting software are exclusively owned and licensed by a single commercial entity and are not available for third-party replication or redistribution.

The Contractor must grant the FAA “Unlimited rights,” in accordance with the definition contained in Acquisition Management System 3.5-13 “Rights in Data-General,” for all FAA Owned Data as a requirement under this SOW. The clause defines “Unlimited rights” as the right of the Government to use, disclose, reproduce, prepare derivative works, distribute copies to the public, and perform publicly and display publicly, in any manner and for any purpose, and to have or permit others to do so. As outlined below, the platform must provide the FAA with capabilities to access and export FAA Owned Data in common and open formats. For the avoidance of doubt, FAA Owned Data must not include any Contractor software or the platform, and the scope of work will not include replication of platform capabilities on non- Contractor systems.

3. Data Integration Expectations

3.1 Derived Data Product Storage

The Contractor must make available its standard APIs, platform documentation, and all transformation logic for FAA data sources to facilitate data access and connectivity to other systems within forty-five (45) days. These features will allow the FAA to identify derived data products created from FAA data sources on the Contractor's platform and will provide the necessary means to transfer and manage those FAA-specified derived data sources. The identification and review of derived data sources must occur once per quarter. Using standard APIs and transformation logic, the agency will be able to achieve the goal of having the data source available within 60 days.

3.2 Data Agnostic Platform

Data-agnostic integration methods are designed to minimize the burden of data integration on the FAA and its stakeholders by automating the ingestion of data at scale and in any format from upstream sources, including those external to the FAA. Upstream sources may include Amazon Simple Storage Service (S3), Hadoop Distributed File System (HDFS), local file systems, JavaScript Object Notation (JSON), Application Programming Interfaces (APIs), and all common Relational Database Management Systems (RDBMS), including but not limited to Oracle, DB2, Teradata, Structured Query Language (SQL) Server, spreadsheets, and SAP/Sybase. The platform must securely capture data and metadata from source systems and seamlessly integrate them while providing a clear data connection lineage.

Page | 3

Additionally, the front-end import capabilities must allow authorized users to add large data sets directly into the system.

The platform must integrate both structured and unstructured data and make all data types usable throughout the platform. Unstructured data, such as HTML, free text, XML files, PDFs, or images, must be accessible to add context (e.g., viewing the PDF of an incident report) to analyses and enhance the abilities of data personnel to provide additional information. Users must be able to extract information of interest from unstructured data, using user-created custom logic or FAA’s third-party tools, and generate structured data that enriches the data layer.

The platform must be readily deployable, available, and capable of user or service provider uploading of—but not limited to—the items listed under Section 23.0. The FAA will work with the contractor to identify data streams listed in Section 23.0, determine the usefulness of the information, and set priorities for uploading, cleaning, and making information available in a central data lake.

For the purposes of this SOW:

Data cleansing, or data cleaning, is the process of detecting and correcting (or removing) corrupt or inaccurate records from a record set, table, or database. It involves identifying incomplete or irrelevant parts of the data and then replacing, modifying, or deleting the dirty or coarse data. Data cleansing can be performed interactively using data wrangling tools or as batch processing through scripting. After cleansing, a data set should be consistent with other similar data sets in the system. The inconsistencies detected or removed may have been originally caused by user entry errors, corruption during transmission or storage, or different data dictionary definitions of similar entities in different stores.

A data lake is a system or repository where data is stored in its natural/raw format, typically as object blobs or files. It often serves as a single store of data, including raw copies from source systems, sensor data, social data, and transformed data used for tasks such as reporting, visualization, advanced analytics, and machine learning. A data lake can encompass structured data from relational databases (rows and columns), semi-structured data (such as CSV, logs, XML, JSON), and unstructured data (such as emails, documents, PDFs, images).

This platform must support processes designed to promote data-driven, risk-based decision-making for overseeing products throughout their life cycle. The centralized platform must monitor clean safety data and provide analytical visualization and socialization tools created through machine learning. These tools should be integrated seamlessly into FAA processes to support cross-divisional fleet safety oversight.

4. Scalability

The solution’s cloud architecture should provide:

• Separated Networks: Separated cloud, customer, and management networks to ensure security and efficiency.

• Isolated Virtual Private Clouds (VPCs): VPCs that prevent the commingling of data.

• Hardened Entry and Egress Points: Hardened and filtered entry and egress points between cloud, customer, and management networks.

• Provisioning and Monitoring: Sophisticated provisioning, patching, and monitoring tools.

• Automated Backups and Disaster Recovery: Automated backups and robust disaster recovery solutions.

• Event Logging and Aggregation: Event logging and log aggregation from services across hosts.

Page | 4

• Consolidated Logs and Metrics Interface: An interface providing access to consolidated logs and performance metrics, allowing standardized monitoring and tuning of services.

• Horizontal Scalability: All components of the solution should be horizontally scalable, accommodating additional user scale, data scale, data complexity, and computational complexity.

• High Availability: All core services should operate in a high-availability clustered environment using commodity hardware or cloud node hosting.

• Distributed Data Stores: All data should be stored in highly available and redundant distributed data stores.

• Cluster Computing Frameworks: Computations should be scheduled and run on open-source cluster-computing frameworks and schedulers, with wrapper libraries and appropriate APIs to allow any plugin or integrated application to run on the same infrastructure.

• Scalable Applications: Scalable platform applications that respond to resource adjustments, enabling management of increases in data, user, and workflow volume while remaining responsive for users.

The platform must support future growth of the FAA's technology landscape through the application of open Application Programming Interfaces (APIs) and other plugin points.

• Alternative Architecture Agreement: If the Government and Contractor agree to alternative Contractor-provided architecture, they will mutually agree to and incorporate necessary terms into this contract.

5. Data Transformation

Once data has been ingested into the platform, data cleaning and pipeline construction capabilities must allow users to set up data integrations and transform/normalize data into a dynamic data taxonomy. This taxonomy should represent a chosen set of terms used for retrieving data and facilitating other workflows. The data taxonomy must use accessible, easy-to-understand concepts such as Site ID, Primary Equipment, Secondary Equipment, Structure, Infrastructure, Maintenance Event, Planned Revenue, Actual Revenue, Cost, Funds Utilization, Category, Milestones, Tasks, and Customer as headings and organizational constructs. This setup should present information clearly and enable users to view all integrated data in one place.

Taxonomy research must auto-populate, providing users with common word strings, typically related to the subject of interest, to guide them toward useful information. Users must be able to easily define a target data model (such as a use case or defined safety issue) within the taxonomy and set up validations. These validations are automated triggers that alert users to data corruption or output errors, ensuring the model remains consistent and consistently enforced.

The Contractor must make available its standard APIs, platform documentation, and all transformation logic for FAA data sources for use by the FAA.

6. Data Lineage, Traceability, and Versioning

The platform is required to monitor specific types of information accessible to all users, governed by access controls. This includes data streams outlined in Section 22, data lineage, and comprehensive version information. The FAA must be able to utilize the platform both as a valuable data resource and to foster best practices in data governance.

Versioning: The platform's versioning system must preserve data and associated metadata at specific points in time, enabling users to reconstruct organizational knowledge at any historical moment. This functionality is essential for historical analysis and for managing information or designations that evolve over time (such as Period of Performance, Assigned POC, financial record status) while other identifiers (such as site coordinates, part numbers, primary equipment) remain static. Additionally, it facilitates the retrieval of information available to the FAA during specified dates or events.

Page | 5

Data Lineage: The platform must document dataset transformations across applications hosted on the platform, providing insight into the dependencies and derivations resulting from these transformations. By keeping a record of the information and logic used to generate each output, the platform must ensure reproducibility and proactively address data quality concerns

Data Traceability: The platform must maintain comprehensive records of all data integration activities, including the time of ingestion, sources, and revision history.

7. Data Entry

The platform must feature a highly configurable application that is agile enough to support data entry by both the FAA and authorized industry users, effectively meeting FAA data entry requirements. This application should accommodate multiple input formats and enforce rigorous input validation to ensure data cleanliness and compliance. Furthermore, the application must facilitate routing to specific users or groups based on user metadata present in the system.

8. Data Push

The platform must automatically monitor specified events within the FAA's systems, including the National Airspace System, Safety and Management Information System, and Logistics Management Systems. It should be capable of sending automated email notifications to FAA staff and management when critical events require immediate communication.

9. Search & Exploration

The platform's search functionality must support complex, web-based, user-defined queries across all data and metadata, regardless of scale. Searches should operate across all raw and transformed datasets, allowing global searches by category names to locate specific information. The platform's search and analytical capabilities should promote data democratization, providing immediate access to currently disparate sources, tools, and visualizations for staff, Subject Matter Experts (SMEs), data scientists, engineers, management, and senior leadership. This feature should empower data-literate SMEs, even those without programming expertise, to easily access relevant data and analytical tools.

In addition to curating datasets in a central data catalog, the platform's workflows must include indexed analyses and reports, enabling users to discover data and insights about topics of interest without prior navigation knowledge. Search features should auto-populate with common FAA and industry terms and taxonomy, guiding users toward effective queries. Over time, the tool must integrate autofill features informed by user input and machine learning, providing typical terms used by SMEs and search strings pertinent to specific use case investigations. For instance, typing "Auto" should yield options like "Auto Throttle" or "Auto Throttle Uncommanded Disconnect." These terms must be common across various groups (e.g., engineers, technicians, mechanics, inspectors, financial analysts, program and project managers) to foster a comprehensive understanding of issues from multiple perspectives.

After performing a search, users should be able to browse related information, such as for a specific part, maintenance event, labor hour entry, or financial record. The platform must allow users to view related documentation for additional context in an object view application. It should also enable the exploration of related objects linked by properties, such as the maintenance and repair history of assets at a site, changes to a service order agreement, variances from a project roadmap and their reasons, and upcoming expiration of safety certifications for technicians scheduled for maintenance at a site.

Page | 6

10. Security

The contractor is required to obtain approval from AJW-L500 before making any modifications to the platform.

This stipulation applies to changes involving user controls, permissions, data ontologies, and any other aspect of the platform's functionality or structure.

The contractor must follow all FAA security requirements as defined by:

10.1 Confidential Treatment of Sensitive Information

In accordance with AMS Clause 3.13-15, "Confidentiality of Data and Information" (November 2016), which is incorporated by reference into this contract, the contractor may require access to, and use of various data and information held by the Government. This data and information may have been acquired under conditions that limit the Government's rights to use and disclose it, or its dissemination might adversely affect the interests of the Government or other parties if used outside the scope of this contract.

Therefore, the contractor and its subcontractors (if applicable) agree to comply with any restrictive use conditions attached to such data and not to:

a) knowingly disclose such data and information to others without written authorization from the Contracting Officer, unless it is already publicly available; or

b) use for any purpose other than the performance of this contract any data or information which bears a restrictive marking or legend which the contractor has gained access to through the performance of this contract, or information that should be marked according to FAA Order

1600.75 "Protecting Sensitive Unclassified Information (SUI)".

The contractor must also follow all FAA sensitive information requirements as defined by:

• FAA Order 1370.121, FAA Information Security and Privacy Program and Policy

• FISMA-Federal Information Security Management Act, https://www.dhs.gov/publication/fy17-fisma-documents

10.2 System Configuration Security

The platform’s Federal Cloud System must possess a current Federal Risk and Authorization Management Program (FedRAMP) moderate level authorization and comply with all relevant regulatory requirements. The contractor is responsible for maintaining their FedRAMP certification throughout the duration of the contract and must adhere to continuous FAA monitoring to ensure the security posture of the certified Cloud Service Provider (CSP) remains robust throughout the lifecycle of the service agreement. CSP’s security posture involves the implementation of security controls necessary to safeguard the information contained within and the infrastructure of CSP systems, which must be preserved throughout the contract.

The platform must integrate FAA security controls as outlined on the FedRAMP website, applicable FAA Policy, and the Department of Transportation (DOT) Departmental Cybersecurity Compendium to ensure secure operation in accordance with current DOT and FAA policies. This includes, but is not limited to, implementing comprehensive protective measures to establish administrative, technical, and physical safeguards that ensure confidentiality, integrity, and availability of information in all forms, while adhering to all relevant laws, regulations, rules, and mandates. The contractor must also meet the following standards during the performance of this contract: [The specific standards would need to be listed here, following this introduction.]

Draf t https://www.dhs.gov/publication/fy17-fisma-documents https://www.dhs.gov/publication/fy17-fisma-documents

Page | 7

Contractor & Industrial Security Program:

http://www.faa.gov/regulations_policies/orders_notices/index.cfm/go/document.i information/documentid/15573

NIST 800.53 Security & Privacy Controls for Information Systems & Organizations:

https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final

10.3 Single Sign On (SSO)

The platform's authentication process must allow users to access multiple applications using a single set of login credentials. It is required to implement two-factor authentication to enhance security. This authentication process must comply with the security requirements outlined in the FedRAMP security assessment for integration, ensuring robust protection of user access and data integrity across the platform.

10.4 Access Controls

The platform must establish and manage privileged user accounts according to everyone’s role within the system. All system access must be role-based, justified, and restricted using the principle of least privilege. Privileged user accounts are to be verified annually and automatically deactivated after six weeks of inactivity. The platform must support granular control restrictions, allowing access to data to be tailored based on specific data sources.

The platform must enable the FAA to apply highly granular permissions, including row-level access control, significantly reducing the risk of inappropriate data use. At the application level, the platform's policy engine must integrate authentication and authorization functionalities, allowing the FAA to create and enforce access control policies programmatically. This ensures that only authorized users can interact with data as permitted by the FAA's access restrictions. Permission levels must include discovery, read, write, and owner, and the access controls must facilitate the transfer of responsibilities between authorized managers and organizations.

Additionally, the platform must allow the FAA to create and define custom hierarchies that reflect its organizational structure, enabling dataset access restrictions based on a user's position within this hierarchy.

11. Analytical Capabilities, Including Reporting & Dashboarding

11.1 Reports & Dashboards

The platform must enable the generation and export of reports, as well as provide live, highly configurable dashboards featuring pre-set calculations, filters, and drill-down capabilities. This functionality allows users to explore both summary and detailed information, along with specific metric calculations that automatically update as new data enters the system. Nontechnical and casual users, such as FAA executives, must be able to access the platform with minimal training and view information through intuitive, easy-to-understand dashboards.

In addition to live, in-platform reports, the platform must facilitate the easy sharing and exporting of data.

It should support open API file formats and allow data to be exported in several widely used formats, including XML, CSV, XLS, PPT, and PDF, as well as other common file formats upon request.

11.2 Other Analytical Capabilities

Draf t http://www.faa.gov/regulations_policies/orders_notices/index.cfm/go/document.i%20nformation/documentid/15573 http://www.faa.gov/regulations_policies/orders_notices/index.cfm/go/document.i%20nformation/documentid/15573 https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final

Page | 8

The platform must offer both technical and nontechnical users a diverse range of highly configurable analytical workflows that deliver proactive information and safety insights. Nontechnical users should have the ability to conduct broad analyses through front-end reporting using intuitive point-and-click operations. Meanwhile, analytical users should be empowered to write code in languages such as SQL, Python, R, Java, and others, with the capability to import any open-source packages, thereby facilitating advanced data analysis and customization.

• Tabular—The platform must allow for the use of collaborative spreadsheet applications and allow users to search and query datasets, apply standard cell-level functions, sync results for further analysis elsewhere in the platform, and save their results back to the platform.

• Graphical—The platform's analysis functionality must allow technical and non-technical users to conduct point-and-click analysis. It must allow users to examine a summary of massive-scale datasets and then isolate patterns and drill down into details of these datasets with a variety of platform generated visualizations, including histograms, statistical bar/line charts, heat maps, and more. Users must be able to save their work in the application and share their analysis, including any applied filters, directly within the platform. Users must be able to seamlessly duplicate their analyses to explore various hypotheses.

• Proactive/Rule-Based—The platform must feature automated alerting capabilities for platform user to improve decision-making and data quality and give users faster access to information.

Furthermore, the platform must enable users to proactively identify invalid data through customizable business rules at a user-specific or organization-wide level. The platform must allow users to create alerts to individuals or groups via email, or other identified FAA notice in the platform, based on established conditional triggers.

11.3 Interoperability with Third-Party Tools

The platform must feature a modular architecture to facilitate easy customization for both current and future workflow requirements. It must support data integration with third-party tools through a robust collection of Representational State Transfer (REST) APIs, ensuring that the platform remains future-proof and interoperable with an organization's existing technology infrastructure.

The platform should offer multiple "push" and "pull" mechanisms for interacting with external applications, including file transfers and connections via common standards. These connections should support structured data set connectivity providers such as Oracle, OleDB, ODATA, ADO.net, ODBC, JSON, and XML, enabling integration with systems like SQL Server instances or databases.

Moreover, external systems must be able to "pull" data from the platform using methods such as common drivers, REST Web Service APIs, and by connecting directly to the Distributed File System where the data resides. This ensures seamless data flow and interoperability between the platform and external systems.

12. Advanced Analytics

12.1 Open & Accessible Iteration

The "Workbooks" application must provide advanced analytical users with an environment to conduct technical analyses, construct workflows, generate visualizations, and author or edit code in their preferred programming language. Users should be able to integrate pluggable modules, allowing them to write data transformation code in languages such as Java, Python, R, SQL, and others.

Page | 9

Additionally, users must be able to branch data and code within an isolated "sandbox" environment, ensuring that their work does not affect data across the platform until it is published to the production environment. This functionality is crucial for maintaining data integrity and allowing experimentation without impacting ongoing operations.

The "Workbooks" application must also support the testing and validation of existing and future predictive models, incorporating "model drift" adjustments to maintain the accuracy of predictions over time. To ensure the stability of any given model, a tracking error feature must be enabled, allowing users to quickly and effectively keep a model's predictive capabilities within an acceptable range of tolerance as defined by the user.

12.2 Compounding Organizational Value

Users must be able to conduct analytics directly from the central data and information source, eliminating the need to source and manipulate data from disparate sources before beginning their work. The platform must ensure that the work of advanced analytical users immediately influences the workflows of less technical users and Subject Matter Experts (SMEs), facilitating a seamless flow of insights across the organization.

"Workbooks" users must have the capability to template their logic and translate it using defined input parameters into languages other than the one in which they initially wrote their analysis. This feature ensures that their models are accessible to other technical users and the broader organization, promoting collaboration and wider utilization of analytical insights.

These capabilities should be designed to foster integration and communication between technical and nontechnical users, allowing everyone in the organization to benefit from advanced analytics without requiring deep technical expertise. As outlined in the next section, these features are integral to maximizing the platform's effectiveness and ensuring cohesive teamwork across various user roles.

12.3 Machine Learning (ML)

ML The platform's machine learning (ML) capabilities must support a wide range of advanced analytical techniques, enabling users to derive meaningful insights from large volumes of data. Key ML capabilities should include:

Topic Modeling Algorithms: Implement models that can analyze high-volume unstructured data to identify common issues and themes, such as trends and root causes of surveillance system failures.

These algorithms should help users quickly extract and synthesize critical information from extensive reports and statements.

Supervised Learning Algorithms: Facilitate the development of classification and regression models that predict data values based on training datasets. The platform should support the application of these models to new datasets, using pre-trained algorithms to make accurate predictions and comparisons.

Unsupervised Learning Algorithms: Equip the platform with algorithms that can discover hidden structures in unlabeled datasets. These capabilities allow users to identify patterns and insights without predefined labels, enabling the exploration of previously unnoticed data structures.

Semi-Supervised Learning Algorithms: Support the integration of semi-supervised learning models that leverage both labeled and unlabeled datasets, with input from Subject Matter Experts (SMEs) to enhance model training. This approach allows the application of trained models to large, unlabeled datasets.

Page | 10

Environmental Interaction Algorithms: Implement algorithms that enable machines and software agents to interact with their environments, autonomously determining optimal behaviors to maximize performance in specific contexts. These algorithms should include simple reward feedback mechanisms to help the agent learn and refine its actions.

Decision Support Models: Facilitate continuous learning from human expert judgment, enabling models to improve their capabilities in identifying and resolving systematic defects quickly and accurately.

Key features that enhance the value of "Workbooks" include:

Integration of Pluggable Modules: Allow users to author or edit code in their preferred programming language and integrate pluggable modules to extend the functionality of their analyses. This feature should make models accessible to other technical users and the wider organization.

Iteration and Reproducibility: Enable users to rapidly iterate on analyses with point-and-click operations, ensuring transformations are repeatable and can be applied to other tools within the platform.

Isolated Sandbox Environment: Provide a secure, isolated "sandbox" environment where users can experiment with data and models without affecting the broader platform, ensuring data integrity until work is ready for production.

Interactive Interface: Offer a simplified interface for handling complex and domain-specific logic, utilizing transformation templates to streamline the creation of analytical workflows.

Collaboration and Security: Allow users to share logic and outputs within a secure environment that maintains comprehensive access controls, facilitating collaboration while protecting sensitive data.

Graphical User Interface (GUI) Pipeline Builder: Feature an intuitive pipeline builder that visually represents data pipelines as graphs and nodes, illustrating relationships between data tables and transformations, and supporting tasks across logistics, services, program management, and other domains.

These capabilities ensure that the "Workbooks" application provides a robust and flexible platform for both technical and non-technical users, enhancing their ability to perform analyses and share insights across the organization.

13. Collaboration

The platform must facilitate secure collaboration among FAA users while ensuring the integrity and confidentiality of data are maintained. It should enable users across the FAA Logistics Center (FAALC) who are involved in installation, maintenance, repair, and other activities to collaborate seamlessly without compromising data security or integrity.

Key features must include:

• Role-Based Access Control: The platform should allow users across different FAA teams to collaborate by sharing data securely, ensuring that access is role-based and adheres to the principle of least privilege. Only authorized stakeholders should access specific datasets, in alignment with FAA's established access restrictions and policies.

• Data Sharing and Analysis: Users must be able to share datasets with colleagues across different teams, allowing them to conduct their analyses or create derived datasets. The platform must enable this seamless sharing while maintaining data integrity and security.

Page | 11

• Stakeholder Consideration: The platform should intelligently account for user roles and responsibilities, ensuring that collaboration and access are appropriate for the specific Logistics and Services use cases, as mutually agreed upon by all relevant parties. This aligns with the practices of other open FAA platforms.

• Internal Task Management: The platform must support internal platform analytic tasks and assignment tracking, facilitating collaboration on scheduled and unscheduled maintenance events, financial records, and program tasks. This includes the ability to connect Subject Matter Experts (SMEs) to issues based on their known office or personal assignments and responsibilities.

• Collaborative Features: The platform should enhance integration across different offices and roles by providing cross-product model interconnections and easy access to data streams, their stewards, and SME contacts. This will streamline the evaluation of products, maintenance events, program tasks, or financial records and their interrelationships.

• Assignment Distribution: The platform should support the routing of tasks to specific users or shared inboxes, where managers can distribute assignments efficiently among team members, ensuring that the right expertise is applied to each task.

These features aim to enhance collaboration, improve the integration of various FAA offices with products and services, and ensure the security and integrity of data across the organization.

14. Program Management & Contractor Staff Support

The contractor must demonstrate a history of proven technical, operational, and leadership excellence in deploying Software as a Service (SaaS) platform. Key expectations and requirements include:

• Continuous Platform Improvement: The FAA expects the contractor to maintain an active and creative implementation posture, continually enhancing the deployment approach for FAA needs.

Product Development Teams must regularly develop and release new features, allowing the FAA to submit feedback consistently to guide these improvements.

• Unique Engagement Model: The contractor's project team must effectively implement, configure, and provide training on platform features. They must offer services that engage stakeholders at all levels— from leadership to end-users—to thoroughly understand challenges and scope solutions rigorously for the FAA.

• Agile Teams that Iterate Rapidly: The contractor must employ an agile methodology characterized by flexibility and incremental progress, ensuring the platform and services are responsive and adaptive to FAA needs.

• Fast, Low-Risk, High-Quality Implementation: Out-of-the-box, the platform should offer robust capabilities in data integration, analytics, alerting, and reporting, facilitating quick and effective results with minimal risk.

In addition to managing technological configurations, the contractor must coordinate implementation efforts and collaborate with assigned FAA staff by:

• Iterating with FAA SMEs: Collaborate with FAA Subject Matter Experts (SMEs) to map user workflows before and after platform implementation, identifying gaps, opportunities, and risks.

• Engaging with FAA Users: Conduct workshops and meetings to assess user satisfaction, incorporating feedback into workflow and product configurations to enhance the user experience.

• Flagging Workflow Risks and Training Challenges: Quickly address workflow risks and training challenges as user groups transition to the platform, leveraging support from FAA SMEs and leadership to resolve blockers.

Page | 12

• Sharing and Implementing Best Practices: Where possible, apply lessons learned and best practices from other government deployments of similar platform technologies, ensuring a high standard of service delivery and implementation success.

These expectations are designed to ensure that the contractor provides a high-quality, responsive, and effective SaaS solution that meets the evolving needs of the FAA.

15. Training Solutions

The platform must offer comprehensive training and support solutions tailored to all applicable FAA staff, ensuring ease of use and rapid proficiency, even for non-technical users. The platform should be intuitive enough so that new users can gain working knowledge within a few hours. Training should be versatile and accommodate various formats, including remote or in-person user-centric classrooms, online, on-call, face-to-face, and on-demand instructional videos.

Training solutions must be customizable to FAA's needs across several functional areas:

• Delivery: The platform must provide training materials suitable for both virtual and in-person formats.

Virtual training should be conducted through online webinars, while in-person group training sessions should be available on-site or virtually in a classroom format. Alternatively, training can be delivered externally through Train-the-Trainer programs. FAA may also choose to incorporate this training into its existing platforms, such as eLMS or others.

• Type: Training must be adaptable to accommodate different types and numbers of users according to FAA training requirements. The platform should facilitate SME training, targeting small groups of users designated as SMEs by FAA for advanced training on platform features and applications.

• Duration & Frequency: In-depth training sessions should be conducted at appropriate durations and frequencies to effectively identify, train, and onboard FAA SMEs. Additional training sessions should be offered as they need to accommodate ongoing or evolving training requirements.

These comprehensive training solutions aim to ensure that FAA staff can efficiently utilize the platform's capabilities, foster effective use and maximize the benefits of the platform's features across the organization.

16. Support Services & System Maintenance Capabilities

The platform must provide a comprehensive array of support services and system maintenance capabilities to ensure uninterrupted access to technical expertise and resources. Key components include:

16.1 Implementation Support:

• The Contractor Project Team is responsible for implementing, configuring, monitoring, and testing all aspects of the platform system to ensure correct operation within the Contractor-managed Cloud environment.

• A dedicated support team must collaborate closely with core user groups, IT staff, and other stakeholders during the initial installation and integration phase.

• Post-deployment, the Contractor will coordinate ongoing support as mutually agreed upon, working with the FAA to identify and train local knowledge experts who can provide effective supplemental support.

16.2 Online Support:

• The platform must feature an online support portal providing FAA users and stakeholders with 24/7/365 access to support for security incidents.

Page | 13

• The portal should also offer access to essential platform documentation, such as user guides and troubleshooting resources, to assist users with any queries or issues.

16.3 Remote Support:

• In line with the Contractor’s standard support terms, direct access to the platform support team must be available through multiple channels, including phone, email, video conference, and, when necessary, in-person support.

• Real-time general technical support must be accessible via email or phone to promptly triage and troubleshoot issues, ensuring swift resolution of incidents.

• Technical support personnel should work closely with both customers and internal teams to optimize first-contact incident resolution.

16.4 Release Management & Preventative Maintenance:

• The platform must conduct regular preventative and corrective maintenance, including patches and bug fixes, to maintain proper and reliable operation.

• Maintenance activities should encompass:

1. New platform releases to enhance functionality and performance.

2. Releases addressing high-priority issues to ensure continuous service quality.

3. Ongoing preventative maintenance following FedRAMP requirements to uphold security and compliance standards.

These support and maintenance strategies are designed to provide FAA users with reliable, efficient, and secure access to the platform, ensuring its optimal performance and usability throughout its lifecycle.

17. Contract Closeout Assessment

A contract close-out assessment must be conducted annually at the FAA's discretion, with comprehensive support from the contractor. This assessment is crucial for evaluating data access and determining the steps necessary to close or modify the contract. The assessment should cover, at a minimum, the following aspects:

• Data Access and Control: Evaluate the FAA's ability to access, control, and document processes at all stages of the data platform lifecycle, including data ingestion, data cleaning, data connections, and analysis methods.

• Interoperability: Ensure the platform can interoperate with both existing and future systems via open REST APIs.

• Component Interchangeability: Verify support for interchangeable components, allowing the FAA to utilize different tools as needed.

• Knowledge Transfer Artifacts: Assess the completeness and usability of knowledge transfer artifacts, ensuring they:

o Preserve data and document associated transformation steps and logic in an open-source format, enabling users to access usable data even if the platform is "turned off."

o Are accessible to any FAA user, with data democratized to require no proprietary or specialized skills for interaction.

o Allow all data to be exported and stored in various open formats.

• Open API Capability: Evaluate the platform’s open API capability in relation to other FAA technologies and architectural plugin platforms.

Page | 14

• Industry Standards Compatibility: Assess compatibility with industry standards such as continuous integration, automated testing, Spark, and Git. This ensures that customers or third-party vendors can administer and configure the platform independently, without needing contractor support.

• Data Query, Copy, and Export: Evaluate the FAA's ability to query, copy, and export all its data, including history, provenance, and associated logic. Ensure user access to data and applications within the platform-managed cloud hosting is access-controlled and fully logged for auditing purposes. This includes providing complete FAA data and logic exports at the conclusion of all contracts.

• Additional Considerations: Address any other items deemed necessary by the FAA to enhance their agility in maintaining, augmenting, or exiting the contract.

This thorough assessment ensures the FAA maintains control and flexibility over its data and platform use, while also preparing for potential contract modifications or termination.

18. Place of Performance

The primary place of performance for this contract will be offsite at the contractor's facilities. Remote work is authorized, allowing for flexibility in operations and collaboration. Additionally, visits to FAA facilities may occur for training purposes, ensuring effective communication and knowledge transfer between the contractor and FAA personnel.

19. Deliverables

Item Deliverable(s) Format Cadence 1 Project Management Monthly Report to FAA Project PM summarizing progress, issues, challenges, and anticipated mitigations

Electronic Report Monthly

2 Team access to Contractor’s Commercial License as specified herein: PT-PG-TERM is estimated at 100.

Commercial License

At Contract Award

3 Project schedule with work breakdown schedule, as required to deploy platform

Electronic Report Award +30 days

4 Platform Documentation Electronic Manual At Contract Award 5 Operation & Maintenance General Technical Support Electronic Manual At Contract Award 6 Data Source status/exceptions list:

List of all data sources used and status Electronic Award +90 days, updated quarterly 7 Data Source ingestion & transformation documentation

(All data sources and data source transformation that occur on the Contractor platform; includes identification of derived data products)

Electronic Award +90 days, updated quarterly

8 Contract Closeout Agreement – Section 18 Electronic Report Annually 10 Prioritized Use Cases

The agency will define and provide five (5) prioritized use cases, including objectives, key stakeholders, and success criteria to guide MVP scoping and implementation.

Electronic Report Award +15 days

11 MVP Scope and Implementation Timeline Contractor will define the minimal viable product (MVP) scope and delivery timeline for each of the five agency-defined use cases, outlining priority features, data needs, and phased milestones for implementation.

Electronic Report Award + 45 days

Page | 15

20. Government Furnished Property (GFP)

The Government Furnished Property (GFP) for this contract includes Government Furnished Information (GFI). The FAA will provide all existing and relevant GFI, which encompasses documents and procedures essential for the performance of this contract, within 45 calendar days following the contract award.

The Contractor is responsible for tracking the distribution, location, and inventory of all GFP. This tracking information must be made available to the FAA as needed. Unless otherwise specified, the Contractor is required to return all GFP upon the completion of the contract. If the Contractor identifies a need for any additional GFP, a request must be submitted to the Contracting Officer’s Representative (COR) within 30 calendar days after the contract award.

The FAA will provide the following data streams and information:

• FAA Data Streams: Relevant data streams necessary for the performance of the contract.

• Information from the FAA Regulatory & Guidance Library: Documents and guidelines that pertain to regulatory and guidance information.

• External, Third-Party Controlled, or Publicly Available Data Streams: Data streams that are controlled by external entities or are publicly accessible, as required for contract performance.

• Additional Data Streams: Any other data streams needed to integrate logistics and services data into the broader ontology model.

21. References

The contractor must ensure all work is in full compliance with the regulations expressed in the following procedures, orders, and programs unless otherwise directed by the COR:

• FAA Acquisition Management Policy: http://fast.faa.gov/AMP_TOC.cfm

• FAA Acquisition Toolset: http://fast.faa.gov/

• ID Badge Online Application: https://employees.faa.gov/org/staffoffices/ash/id_badge/

• Contractor & Industrial Security Program:

http://www.faa.gov/regulations_policies/orders_notices/index.cfm/go/document.information/documentid/ 15573

• Orders & Notices:

http://www.faa.gov/regulations_policies/orders_notices/index.cfm/go/document.list/parent TopicID/184

• Forms: http://www.faa.gov/library/forms/ http://fast.faa.gov/AMP_TOC.cfm http://fast.faa.gov/ https://employees.faa.gov/org/staffoffices/ash/id_badge/ http://www.faa.gov/regulations_policies/orders_notices/index.cfm/go/document.information/documentid/15573 http://www.faa.gov/regulations_policies/orders_notices/index.cfm/go/document.information/documentid/15573 http://www.faa.gov/regulations_policies/orders_notices/index.cfm/go/document.list/parent%20TopicID/184 http://www.faa.gov/library/forms/