Attachment 1 - SoW_DO200B_20221129.docx

UNCLASSIFIED APPENDIX A

NATIONAL GEOSPATIAL INTELLIGENCE AGENCY

AERONAUTICAL NAVIGATION OFFICE

DO-200B/AC-20-153B Assessment/Compliance Audit

Statement of Work 29 November 2022

UNCLASSIFIED

Attachment 1

8 | Page

1.0 INTRODUCTION

1.1 The National Geospatial-Intelligence Agency (NGA) delivers Geospatial Intelligence (GEOINT) and Aeronautical Safety of Navigation information that provides a decisive advantage to policymakers, warfighters, intelligence professionals, humanitarian efforts, and first responders. NGA supports the National System for Geospatial Intelligence (NSG), which supports the U.S. Department of Defense (DoD), Department of Homeland Security, and the Intelligence Community (IC). NGA is a unique combination of intelligence agency and combat support agency and leads the world in providing timely, relevant, accurate and actionable GEOINT.

1.2 Communication, Navigation, Surveillance/Air Traffic Management (CNS/ATM) requirements drive toward an accepted standard used by the aeronautical community throughout the aeronautical data chain process. Demonstrating compliance to these requirements as well as continually improving those aeronautical data processes is a continued effort by the NGA.

2.0 SCOPE

2.1 The intent of this Statement of Work (SoW) is specifically related to observing the Aeronautical Navigation Office’s (SFA) system of organization for processing worldwide aeronautical data elements or creating aeronautical products provided to its customer group –the Department of Defense, IC, and the aeronautical international community. This Statement of Work is focused on the SFA’s aeronautical data chain processes from receipt of source to dissemination to the end user.

CNS/ATM requirements incudes guidance published by Radio Technical Commissions for Aeronautics (RTCA) in Document (DO)-200B, “Standards for Processing Aeronautical Data” and the Federal Aviation Administration (FAA) Advisory Circular (AC) 20-153B, “Acceptance of Aeronautical Data Processes and Associated Data.” These requirements provide the baseline for which CNS/ATM requirements are applicable to processing aeronautical data. These standards provide recommended minimum requirements for the processing of aeronautical data. The emphasis for this SoW is for a 3rd party organization to observe and document findings of compliance or deviations of compliance according to the guidance found in DO-200B, AC-20-153B, and other related industry standards. Additionally, several key activities listed in Section 4.0 of this SoW describe NGA’s expectations and deliverables from the contractor.

2.2 DO-200B, para 3.2 lays out objectives for compliance audits (abbreviated from DO-200B):

2.2.1 Authorized versions of plans and procedures are available.

2.2.2 Controls exist to ensure that plans and procedures are followed.

2.2.3 The Quality Management System (QMS) meets all requirements and compliance deviations are being managed appropriately.

2.2.4 Procedures exist for the management of changes to the data processing procedures to meet QMS requirements.

3.0 AUDITING REQUIREMENTS

3.1 Although the NGA Aeronautical Navigation Office operates at two sites in the St Louis metropolitan area, the primary site for processing aeronautical data is the South Second Street location. The scope of this audit is to provide feedback for compliance to DO-200B and AC 20-153B. The audit activities required to assess this compliance will likely be accomplished at the site located on South Second Street. There may be times the audit activities will include a site visit to the secondary location in Arnold, MO.

National Geospatial-Intelligence Agency Aeronautical Navigation Office (SFA) 3200 South Second Street St. Louis, MO 63118

National Geospatial-Intelligence Agency Aeronautical Navigation Office (SFA) 3838 Vogel Road Arnold, MO 63010

The St. Louis, MO and Arnold, MO locations for the Aeronautical Navigation Office operate with one shift.

3.2 The Aeronautical Navigation Office has a current multi-site Certificate of Registration that is in conformance with the International Quality System Standard: ISO 9001:2015.

3.3 Audit Activities

3.3.1 The Contractor must be an independent, primary audit firm. The subcontracting of auditing services is not authorized.

3.4 Auditor Qualifications

3.4.1 The Certification Body (Audit Firm) must have credentials recognized by the Federal Aviation Administration (FAA) for the purpose of performing a DO-200B/AC 20-153B Assessment/Compliance audit.

3.4.2 The Certification Body must have a process to determine competence of its auditors. The Aeronautical Navigation Office has a unique mission of providing worldwide aeronautical data to a wide range of users (DoD). The auditors are required to possess appropriate aeronautical data management knowledge.

3.4.3 The contractor will assign a certified lead auditor to lead all audit activities accompanied by certified audit team members (as needed). The lead auditor shall have a minimum of three years of experience and be identified by name in the proposal.

3.4.4 Each audit team member assigned to this contract shall have a minimum of one year of experience as a certified auditor. Any proposed change of key personnel and the reasons for the change must be coordinated with the Contracting Officer prior to execution of the audit. Changes to the audit team must be coordinated with the COR at least 21 calendar days prior to the scheduled audit.

3.5 Arbitration Process

3.5.1 The auditor shall have a process for handling appeals by the Government arising from the audits. Appeals are to be filed with the auditor within 30 days of receipt of audit report. A review is to be accomplished by a disinterested individual not involved in the audit activity.

3.6 Period of Performance

3.6.1 This delivery order will have a Period of Performance (PoP) of 29 June 2023 – 31 March 2024, plus an additional four (4)- twelve (12) month option periods.

4.0 AERONAUTICAL NAVIGATION OFFICE PERFORMANCE SUMMARY

a) Audit schedule

b) Audit plan

c) Audit

d) Audit report

a) Observation Report

a) Agenda in the form of a Microsoft Word or PDF via Email

b) Minutes in the form of a Microsoft Word or PDF, Provided via Email

a) Training Schedule

b) Training Plan

c) Training Material

d) Training Report

4.6 Conduct a yearly CNS/ATM Assessment/Compliance audit within the Period of Performance

4.6.1 Audit scheduling will be coordinated between the Contractor and NGA through the Contracting Officer Representative (COR).

4.6.2 Activities that will be performed as part of the audit performed by the Contractor:

4.6.2.1 Review of previous audit findings delivered by the Contractor.

4.6.2.2 Audit against the applicable objectives of DO-200B Appendices D and F.

4.6.2.3 Audit against the applicable objectives of AC 20-153B Appendix 3.

4.6.2.4 Creation of an objectives-based compliance matrix to record results, which uses either the audit classifications defined in RTCA DO-200B, section 3.4 or the audit classifications defined in FAA Order 8110.55B

4.6.2.5 Final report, which provides explanatory text for compliance matrix results.

4.6.2.6 Upon completion of any audit activity, the auditor will provide a closing meeting detailing the audit activities and findings.

4.6.2.7 Due to any restriction that prevents on-site visitors, the audit will be conducted via remote methods.

4.6.2.8 Determining the remote platform will be a coordinated agreement between NGA and the Contractor.

4.6.3 Audit activities may include necessary Contractor and NGA follow-up events with the FAA Issuer of the NGA Type I LOA to address audit activities and audit findings. Refer to the activity listed in Section 4.7.

4.6.4 Proof of the deliverables will be given to the COR to demonstrate completed tasks prior to payment.

4.7 Participate in the yearly CNS/ATM: Type I LOA Issuer 3rd Party Audit by the regulatory authorities for issuance of the NGA Type I Letter of Acceptance (LOA) with in the Period of Performance.

4.7.1 Upon coordination with NGA, the Contractor shall attend, support as needed, and provide written observations as applicable.

4.7.1.1 The Contractor will attend the full duration of the audit.

4.7.1.2 The audit will not extend more than 5 days in duration and more than 10-hour days.

4.7.1.3 The Contractor’s participation may include reviewing and answering questions from the Issuer of the Type I LOA concerning previous audit activities and findings.

4.7.2 This will include observing the entire audit from the opening meeting to the closing meeting.

4.7.3 If the audit is on-site, the contractor shall be on-site unless travel restrictions limit this capability the contractor participant will dial-in remotely.

4.7.3.1 NGA shall ensure remote dial-in is coordinated with the contractor.

4.7.4 Any observations the contractor may have as a result of the audit will be provided to NGA within 30 days.

4.7.5 Proof of the deliverables will be given to the COR to demonstrate completed tasks prior to payment.

4.8 Participate in Technical Exchange Meetings (TEM)

4.8.1 NGA and the Contractor shall meet once a month to discuss internal and external CNS/ATM relatable discussion points, such as previous audit findings, upcoming audit or training events, or topics for discussion. These TEMS shall include support with reviewing processes and updating relevant documents, such as the CNS/ATM Compliance Plan.

4.8.1.1 The schedule and agenda will be a coordinated effort between NGA and the Contractor.

4.8.1.2 An agenda will be provided by the Contractor no later than 7 days prior to the scheduled TEM.

4.8.2 Technical Exchange Meetings will be conducted via remote methods between NGA and the Contractor.

4.8.3 This type of meeting will be coordinated in advance with all participants and will not last more than 3 hours.

4.8.4 Minutes will be captured by the Contractor after each TEM and forwarded within 3 working days of the conclusion of the meeting.

4.9 If requested by NGA, the contractor will conduct a yearly training event

4.9.1 The NGA and the Contractor shall coordinate and determine the best method(s) to conduct the training.

4.9.2 The event will not last more than 3 days and 8-hour days.

4.1.1.1 If travel restrictions limit on-site visits, the training event will occur remotely via a coordinated platform that NGA and the Contractor have agreed upon.

4.9.3 The scope of the training event will be determined by NGA with recommendations by the Contractor.

4.9.4 The Contractor will provide appropriate forms of media that supports the training event.

4.9.5 The event will include opening and closing meetings.

4.9.6 A training report describing the events will be provided to NGA within 30 days of the end of the training event.

4.9.7 Proof of the deliverables will be given to the COR to demonstrate completed tasks prior to payment.

5.0 REPORTING

Communication between NGA and the Contractor is essential to achieving success in meeting the mission, conducting business, and advancing our abilities. To achieve this success, the following requirements are included in this SOW:

5.6 In support of 4.2:

5.6.1 the Contractor shall submit an audit plan to the designated Contracting Officer’s Representative (COR) 14 days prior to audit activities.

5.6.2 The Contractor shall provide a draft copy of the audit report prior to exiting the audit location.

5.6.3 A finalized audit report is to be delivered within 30 days after completion of the audit, sent to the COR.

5.6.4 NGA has 30 days to respond to the final report. Upon acceptance, NGA shall return a copy of the audit report with an original signature from the Contractor Management Representative and the Aeronautical Navigation Office. The signed audit report will constitute acceptance by NGA, at which time the Contractor shall invoice for services provided.

5.7 The vendor shall invoice NGA at a minimum every quarter from the start of the Period of Performance.

6.0 SECURITY

6.6 Contractors must abide by all applicable security policies and regulations.

6.7 Work associated with this contract is limited to UNCLASSIFIED, UNCLASSIFIED/FOUO, or UNCLASSIFIED/LIMDIS. The contractor shall not release to anyone outside the Contractor’s organization any unclassified information, regardless of medium (e.g., film, tape, document), pertaining to any part of this contract or any program related to this contract, unless the Contracting Officer has given prior written approval or in performance of a project that has been scoped and negotiated by NGA with the contractor. Release and disclosure guidance provided to subcontractors shall be ‘all release and disclosure requests shall be submitted through the prime contractor to NGA.’

6.8 The contractor resources provided for maintenance and data delivery are not required to hold security clearances given that the nature of the data will be UNCLASSIFIED/FOUO and UNCLASSIFIED/LIMDIS. A classified environment is not required at the contractor facility and an Automated Information System (AIS) is not required for this effort.

6.9 For access to NGA facilities during audit, contractor personnel must be escorted.

6.10 The contractor shall follow all applicable NGA, IC, and DoD information security and operational security policies and guidance when accessing and transmitting data over networks during performance of contractual requirements.

6.11 Only United States personnel (foreign nationals are prohibited from working on this contract) are authorized to perform work on this contract.

6.12 Auditors may have access to information of a sensitive nature. Therefore, it will be a requirement that auditors shall sign an NGA Form 5210-18, Nondisclosure Agreement prior to audit activities (See Appendix A). To gain access to privileged information requires that information be protected and not be disclosed to outside entities.

6.13 All Contractor visits to Government facilities for onsite audits must be coordinated in advance with the COR. Work hours will be planned in advance and notification to NGA will be accomplished by a Visit Request according to NGA guidelines. Work areas, including walking paths, will be sanitized from classified material prior to the auditor’s arrival. Expect that auditors will have to be escorted at all times.

6.14 The Contractor shall inform the Government when their employees no longer support the contract.

6.15 All government furnished information released to the contractor or created in the performance of this contract (UNCLASSIFIED/FOUO or UNCLASSIFIED/LIMDIS) will be destroyed by the contractor or returned to the NGA upon termination of the contract or when no longer required in the performance of the contract.

6.16 Contractor personnel are forbidden from bringing in prohibited, unauthorized, and/or Portable Electronic Devices (PEDs) into any NGA installation or any office/working location covered under this contract. A list of PEDs includes, but is not limited to, cell phones, cameras, two-way pagers, laptops, recorders (digital, tape, etc.), flash drives, or any other kind of removable media. See NGA instructions/regulations/policy for a full list of prohibited and unauthorized items. Security violations will be determined on the severity of the violation.

6.17 If the Contractor chooses to initiate security protocols to access the Sensitive But Unclassified (SBU) network while on-site at the NGA facilities all required steps, time, and financial obligations to complete this process is the Contactor’s responsibility.

6.18 Contractor employees shall comply with all applicable rules and regulations while on NGA premises and handling NGA information/material, which includes providing proper identification for entrance and vehicle passes, obeying posted signs, displaying the issued badge, and observing smoking restrictions.

6.19 The Contractor shall not possess weapons, firearms, or ammunition on themselves or within their Contractor-owned vehicle or privately-owned vehicle while on any NGA installation or any office/working location covered under this contract. Possession of weapons, firearms, or ammunition while on an installation is considered a major security violation.

Note: While Contractor employees will be provided viewing access to controlled workstations for document and Quality Management System component viewing, it is the responsibility of the Aeronautical Safety of Navigation Office personnel to ensure that only the appropriate documents are displayed (no document that is classified higher than UNCLASSIFIED/FOUO OR UNCLASSIFIED/LIMDIS). Documents may be printed for auditor reference, but review of any document will include the assurance that no classified portion is made available without the proper clearance and need to know.

7.0 TRAVEL

Travel may be required by the contractor in support of NGA requirements. All travel will be priced on a cost reimbursable (NTE) basis (no profit/fee). All travel shall be pre-approved by the NGA CO and COR. The travel must occur during the base period of performance.

7.6 Conduct a yearly CNS/ATM audit per Section 4.6

7.6.1 The agency will authorize one round trip to the locations listed above for no more than the length of 5 days for one auditor.

7.6.2 If the yearly CNS/ATM audit is conducted remotely/virtually, travel will not be authorized.

7.7 Participate in the CNS/ATM: Type I LOA Issuer 3rd Party Audit per Section 4.7

7.7.1 The agency will authorize one round trip to the locations listed above for no more than the length of 5 days for one auditor.

7.7.2 If the CNS/ATM: Type I LOA Issuer 3rd Party Audit is conducted remotely/virtually, travel will not be authorized.

7.8 Conduct a Training Event per Section 4.8

7.8.1 The agency will authorize one round trip to the locations listed above for the length of 3 days for one auditor.

7.8.2 Dependent on the scope of the training event, if NGA determines that the event can be completed through remote capabilities, travel will not be authorized.

APPENDIX A: REFERENCES

FAA AC-20-153B – Acceptance of Aeronautical Data Processes and Associated Data RTCA DO-200B – Standards for Processing Aeronautical Data FAR 52.204-2 – Security Requirements NGA Form 5210-18 – Non-Disclosure Agreement

ISO 9001:2015 Certificate of Registration image1.jpeg image2.emf

NGA Form 5210_18.pdf

NGA FORM 5210-18, Dec 06

NONDISCLOSURE AGREEMENT

(Revision July 2006)

National Geospatial-Intelligence Agency Contracts

[This is agreement is to be signed by all contractor employees who in the course of performing contract work for NGA may be disclosed, or have access to, Protected Information and Computer Software as defined below.]

I, ________________________________________, the employee of ___________________________________________________________understand in the course of my work for the National Geospatial-Intelligence Agency (NGA) under various contracts that Protected Information and computer software may be disclosed to me and I may otherwise have access to such items on NGA information technology networks or in NGA workspaces. I agree to abide by all terms and obligations contained in this agreement regarding the protection of such items.

1. Definition.

a. Unless specifically excluded by paragraph 1.c, “Protected information and computer software” means all information and computer software regardless of its form that in the course of performing work for the National Geospatial-Intelligence Agency (NGA) under various contracts is disclosed orally, in writing or in any other media to me, or to which I am otherwise given access to, by (i) NGA, (ii) other government agencies, (iii) foreign governments or (iv) other contractors while directly supporting NGA, which is accompanied by written legends identifying use or disclosure restrictions or disclosed under circumstances that I know are subject to use or disclosure restrictions established in writing by the Government.

b. Protected Information and Computer Software includes by way of illustration, but is not limited to: (i) geospatial-intelligence products and data marked Limited Distribution (LIMDIS);

(ii) information marked For Official Use Only (FOUO), (iii) personnel data protected by the Privacy Act; (iv) data, information and material (including software documentation and computer databases) of a technical, scientific, or government predeliberative nature;

(v) contractor proposals, acquisition plans, government cost estimates draft statements of work, source selection plans, and evaluations of contractor proposals; (vi) financial and management data used for contract award or administration purposes; (vii) test reports; (viii) government requirements documents; (ix) financial statements and reports; (x) manpower reports;

(xi) planning, cost and program development documents, resource forecasts, National Intelligence Program/Military Intelligence Program (NIP/MIP) data, Program Objective

Memorandums (POM), Program Budget Submissions/Intelligence Program and Budget Submissions (PBS/IPBS), Congressional Budget Justification Books/Congressional Justification Books (CBJB/CJB), President’s Budget Submissions, Program Budget Decisions (PBD), and Five Year Plans; and (xii) computer programs, source code, source code listings, object code listings, design details, algorithms, processes, flow charts, formulae, and related material that would enable the software to be reproduced, recreated, or recompiled.

c. Protected Information and Computer Software does not include information that:

(1) Has fallen into the public domain by operation of law or through no action of the undersigned in breach of this agreement or any other party in breach of any other obligation of confidentiality owing to the Government or the owner of the protected information or computer software;

(2) Has been lawfully obtained by the recipient outside the course of the performance of a government contract;

(3) Has been properly licensed or provided directly by the owner (or other authorized source) of the information or computer software to the recipient to the extent so licensed or provided;

(4) Is owned by the recipient or was developed independently of the disclosure hereunder;

(5) Has been used or disclosed by the recipient in response to an order of a court or administrative body of competent jurisdiction to the extent permitted by that authority; or

(6) Has been disclosed to the recipient by the Government who has explicitly authorized the recipient to use or disclose the information for another purpose, to the extent so authorized.

2. Use and Disclosure Obligations. I will use and disclose Protected Information and Computer Software only as necessary for the performance of the requirements of the underlying contract(s) under which the information or computer software is furnished. I understand Protected Information and Computer Software may not be used or disclosed for any other purpose, including bid or proposal preparation or business marketing, without the written approval of the cognizant government contracting officer. I will comply with all restrictions set forth in any legends, licenses or instructions provided to me or accompanying the Protected Information or Computer Software or other written directives of my employer or the Government known to me. The use and disclosure obligations imposed by this paragraph shall expire as follows:

a. There shall be no expiration date for the following Protected Information and Computer Software, (i) technical data or computer software containing Limited Rights, Restricted Rights, Government Purpose Rights, Special License Rights, or Unlimited Rights legends; (ii) information or software marked Limited Distribution (LIMDIS); (iii) information or software marked Source Selection Information; (iv) contract proposal information marked pursuant to FAR 52.215-1(c) limiting its use for proposal evaluation purposes only; (v) information and computer software marked Contractor Proprietary or with a similar legend; (vi) data known by me to be protected by the Privacy Act; and (vii) information marked For Official Use Only (FOUO).

b. For other information or software accompanied at time of disclosure by a written legend identifying use or disclosure restriction time periods, the expiration date shall be as stated in or derived from the legend.

c. For all other Protected Information and Computer Software, the expiration date shall be 3 years from the date the information or software is first disclosed to me.

3. Unauthorized Use or Disclosures. I will immediately notify my employer of the circumstances of any unauthorized use or disclosures known to me of Protected Information and Computer Software in violation of the obligations contained in this agreement.

4. Disposition. At the termination of my employment or when I no longer perform contract work for NGA, I agree to immediately return (or destroy if directed by my employer) all Protected Information and Computer Software in my possession. Furthermore, if I am dedicated to support a specific NGA Office or Directorate or NGA program and am reassigned to support another NGA Office or Directorate or NGA program, I will immediately return (or destroy if directed by my employer) all Protected Information or Computer Software in my possession previously furnished by the prior NGA Office or Directorate or NGA program.

5. Duration. The above obligations imposed by this agreement shall survive termination of my employment or the expiration or termination of the underlying contract(s) under which the protected information or computer software was furnished to me.

6. Classified Information. This agreement is in addition to and in no manner abrogates requirements, obligations or remedies regarding the protection of classified information and does not supersede the requirements of any laws, regulations, other directives or nondisclosure agreements regarding classified information.

7. Other Restrictions. This agreement does not abrogate any other obligations currently placed upon me or which may be imposed upon me in the future by my employer, NGA or other entities; or remedies afforded those entities regarding those obligations.

8. Provided. I acknowledge I have been provided a copy of this agreement.

Signature

Date the employee of:

understand in the:

Date:

image3.emf

National Geospatial ISO 9001 Certificate Sept 2021signed.pdf

American Systems Registrar, LLC, a provider of third-party system registration and accredited by the ANSI National Accreditation Board attests that:

CERTIFICATE OF REGISTRATION

5281 Clyde Park Ave. SW, Suite 1 Wyoming, MI 49509 USA www.asrworldwide.com

616-942-6273

NATIONAL GEOSPATIAL-INTELLIGENCE AGENCY

AERONAUTICAL NAVIGATION OFFICE

3200 SOUTH SECOND STREET

ST. LOUIS, MO 63118

3838 VOGEL ROAD

ARNOLD, MO 63010

with a scope of:

THE PROVISION OF TIMELY, RELEVANT, VALIDATED, AND ACCESSIBLE AERONAUTICAL

FOUNDATIONAL GEOSPATIAL INTELLIGENCE (GEOINT) THAT MEETS SPECIFIED

CUSTOMER REQUIREMENTS TO ENABLE SAFETY OF NAVIGATION, DEPARTMENT OF

DEFENSE (DOD) MILITARY OPERATIONS, AND SUPPORT OF NATIONAL SECURITY

OBJECTIVES

has established a quality management system that is in conformance with the International Quality System Standard

ISO 9001:2015

ASR Certificate Number: 8164 Date of Certification: September 14, 2021 Date of Certification Expiration: September 13, 2024 Date of Initial Registration: April 12, 2007 Revision:

Re-Issue Date:

President