CSS-FD SIR Section C - PWS_DRAFT_v2.0.pdf

FEDERAL AVIATION ADMINISTRATION

COMMON SUPPORT SERVICES – FLIGHT DATA (CSS-FD)

SECTION C: PERFORMANCE WORK STATEMENT

Federal Aviation Administration

800 Independence Avenue, SW

Washington, DC 20591

SECTION C Solicitation #

PERFORMANCE WORK STATEMENT CSS-FD

C - ii

TABLE OF CONTENTS

C.1 INTRODUCTION

C.1.1 SCOPE OF WORK

C.2 APPLICABLE DOCUMENTS

C.2.1 Order of Precedence Between the PWS and Applicable Documents

C.2.2 Availability of Documents

C.3 GOVERNMENT FURNISHED ITEMS AND GOVERNMENT RESPONSIBILITIES

C.3.1 GOVERNMENT FURNISHED ITEMS

C.3.1.1 Government Furnished Information

C.3.1.2 Government Sponsored Cloud Environment (GSCE)

C.3.1.3 Government Furnished Laptops

C.3.2 GOVERNMENT RESPONSIBILITIES

C.3.2.1 Program Management

C.3.2.2 Test and Verification

C.3.2.3 Security Authorization

C.4 CONTRACTOR REQUIREMENTS

C.4.1 PROGRAM MANAGEMENT

C.4.1.1 Program Management

C.4.1.2 Quality Management

C.4.1.3 Risk Management

C.4.1.4 Configuration Management

C.4.1.5 Records Management

C.4.2 SOLUTION DEVELOPMENT

C.4.2.1 Systems Engineering

C.4.2.2 Requirements Review(s)

C.4.2.3 Software Documentation

C.4.2.4 Software Design Reviews (SDR)

C.4.2.5 Software Application Development

C.4.2.6 Test and Evaluation

C.4.2.7 System Safety

C.4.3 SECURITY

C.4.3.1 Security Program

C.4.3.2 Security Authorization

C.4.3.3 System Authorization Documentation

C.4.3.4 Security Assessments and Continuous Monitoring

C.4.3.5 Security of Test Environment

C.4.3.6 Incident Response

C.4.3.7 Cybersecurity Exercises

C.4.3.8 Facility Security

C.4.3.9 Personnel Security

C.4.3.10 Protecting Sensitive Unclassified Information (SUI)

C.4.3.11 Supply Chain Risk Management (SCRM)

C.4.3.12 Insider Threat Prevention Program

C.4.4 SOLUTION IMPLEMENTATION AND INTEGRATION

C.4.5 IN-SERVICE MANAGEMENT

C.4.5.1 Software Maintenance

C.4.5.2 CSS-FD Jumpstart Kit (CJK)

C - iii

C.4.5.3 Software Delivery

C.4.5.4 Tier Support

C.4.5.5 Technical Documentation

C.4.5.6 Training

C.4.5.7 General Engineering and Technical Support Services

TABLE OF CDRLS

CDRL CSS-FD-PM01 PROGRAM MANAGEMENT PLAN (PMP)

CDRL CSS-FD-PM02 MONTHLY STATUS REPORT (MSR)

CDRL CSS-FD-PM03 INTEGRATED PROGRAM MANAGEMENT REPORT (IPMR)

CDRL CSS-FD-PM04 INTEGRATED MASTER SCHEDULE (IMS)

CDRL CSS-FD-CM01 CONFIGURATION AUDIT PLAN (CAP)

CDRL CSS-FD-CM02 CONFIGURATION AUDIT SUMMARY REPORT (CASR)

CDRL CSS-FD-CM03 CONFIGURATION STATUS ACCOUNTING REPORT (CSAR)

CDRL CSS-FD-CM04 ENGINEERING CHANGE PROPOSAL (ECP)

CDRL CSS-FD-SE01 SYSTEMS ENGINEERING MANAGEMENT PLAN (SEMP)

CDRL CSS-FD-SE02 DATA MANAGEMENT PLAN (DMP)

CDRL CSS-FD-SD01 SOFTWARE DEVELOPMENT PLAN (SDP)

CDRL CSS-FD-SD02 SOFTWARE REQUIREMENTS SPECIFICATION (SRS)

CDRL CSS-FD-SD03 INTERFACE REQUIREMENTS SPECIFICATION (IRS)

CDRL CSS-FD-SD04 SERVICE REQUIREMENTS DOCUMENT (SRD)

CDRL CSS-FD-SD05 WEB SERVICE DESCRIPTION DOCUMENTS (WSDD)

CDRL CSS-FD-SD06 JAVA MESSAGING SERVICE DESCRIPTION DOCUMENTS (JMSDD)

CDRL CSS-FD-SD07 SOFTWARE DESIGN DESCRIPTION (SDD)

CDRL CSS-FD-CD01 BUSINESS RULES DOCUMENT

CDRL CSS-FD-CD02 FLIGHT OBJECT (FO) WORKBOOK

CDRL CSS-FD-HF01 HUMAN FACTORS PROGRAM PLAN (HFPP)

CDRL CSS-FD-TE01 CONTRACTOR MASTER TEST PLAN (CMTP)

CDRL CSS-FD-TE02 VERIFICATION REQUIREMENTS TRACEABILITY MATRIX (VRTM)

CDRL CSS-FD-TE03 ACCEPTANCE TEST PROCEDURES (ATP)

CDRL CSS-FD-TE04 TEST REPORTS

CDRL CSS-FD-SRM01 SYSTEM SAFETY PROGRAM PLAN (SSPP)

CDRL CSS-FD-SRM02 SUB-SYSTEM HAZARD ANALYSIS (SSHA)

CDRL CSS-FD-SRM03 SYSTEM HAZARD ANALYSIS (SHA)

CDRL CSS-FD-SRM04 OPERATING AND SUPPORT HAZARD ANALYSIS (O&SHA)

CDRL CSS-FD-ISS01 SYSTEM SECURITY PLAN (SSP)

CDRL CSS-FD-ISS02 SYSTEM CHARACTERIZATION DOCUMENT (SCD)

CDRL CSS-FD-ISS03 PRIVACY THRESHOLD ASSESSMENT (PTA)

CDRL CSS-FD-ISS04 PRIVACY IMPACT ASSESSMENT (PIA)

CDRL CSS-FD-ISS05 PRIVACY CONTINUOUS MONITORING (PCM) DOCUMENTATION

CDRL CSS-FD-ISS06 RECORDS MANAGEMENT SCHEDULE

CDRL CSS-FD-ISS07 INFORMATION SYSTEM CONTINGENCY PLAN (ISCP)

CDRL CSS-FD-ISS08 INFORMATION SYSTEM CONTINGENCY TEST PLAN

CDRL CSS-FD-ISS09 INFORMATION SYSTEM CONTINGENCY TEST RESULTS REPORT

CDRL CSS-FD-ISS10 SYSTEM AUTHORIZATION BRIEFING (SAB)

CDRL CSS-FD-IM01 IMPLEMENTATION AND INTEGRATION PLAN

CDRL CSS-FD-ISM01 SOFTWARE MAINTENANCE PLAN (SMP)

CDRL CSS-FD-ISM02 SOFTWARE VERSION DESCRIPTION (SVD)

CDRL CSS-FD-ISM03 CSS-FD REFERENCE MANUAL

CDRL CSS-FD-ISM04 TECHNICAL INSTRUCTION MANUAL

CDRL CSS-FD TNG01 PERSONNEL QUALIFICATION REPORT (PQR)

CDRL CSS-FD TNG02 TRAINING DEVELOPMENT PLAN (TDP)

C - iv

CDRL CSS-FD TNG03 TASK AND SKILLS ANALYSIS REPORT

CDRL CSS-FD TNG04 COURSE DESIGN GUIDE (CDG)

CDRL CSS-FD TNG05 WEB BASED CSS-FD SYSTEM MONITORING AND MANAGEMENT

TRAINING CONTENT

CDRL CSS-FD TNG06 WEB-BASED SWIM ENTERPRISE DATA SERVICES (EDS)

TRAINING CONTENT

CDRL CSS-FD TNG07 CONTRACTOR’S PRESENTATION MATERIAL

CDRL CSS-FD TNG08 OPERATIONAL TRYOUT REPORT

CDRL CSS-FD TNG09 FIRST COURSE CONDUCT REPORT

C - 1

C.1 INTRODUCTION

The Common Support Services – Flight Data (CSS-FD) program is the FAA implementation of the International Civil Aviation Organization (ICAO) Flight & Flow Information for a

Collaborative Environment (FF-ICE) Release 1. The strategy for CSS-FD is contained in

Attachment J-0, CSS-FD Strategy, and describes the approach for CSS-FD and its alignment with

Attachment J-8, Automation Evolution Strategy (AES), interdependencies on other NAS systems and capabilities.

The purpose of CSS-FD is to enhance flight planning and filing as well as provide enterprise-level services that support flexible, accurate, and timely access to common flight information across domains, flight operators, and the Air Traffic Management (ATM) community. The CSS-FD program will work towards standardization of flight information exchange in the National

Airspace System (NAS) by defining and delivering a service that updates exchanges between operators and the FAA, using FF-ICE, Flight Information Exchange Model (FIXM), and the Flight

Object.

C.1.1 SCOPE OF WORK

The scope of CSS-FD includes Phases 1 and 2 capabilities identified in Table C-1. This

Performance Work Statement (PWS) identifies requirements for Program Management, Solution

Development, Security, Solution Implementation and Integration, and In-Service Management for

Phase 1 capabilities only. The Contractor must provide all software applications, licenses, tools, personnel, supervision, and other items necessary to perform all work efforts identified in this

PWS.

Work efforts associated with Phase 2 capabilities will be definitized and authorized under a separate task order.

Table C-1: CSS-FD Capabilities

Capability Description

Phase 1

1 Data Management and Security Framework: Enables flight planning, flight plan filing, and flight data sharing to include global flight data management functions (e.g., standardization, translation, reconciliation, and validation along with reconstitution) as well as security elements required for identity and access management.

2 Flight Planning and Flight Plan Filing: Supports the ingestion and routing of appropriate responses to submitted filing of a flight plan by enhanced Airspace

Users (eAUs) via the FF-ICE method (enhanced flight plans (eFPLs)) as well as ingesting flight plans submitted by AUs via the legacy method. Also supports the

Flight Planning trial requests functionality for eAUs to explore “what-if” scenarios regarding their plan.

3 Feedback by Reference: Provides information on airspace constraints or other restrictions for flight plans as part of the filing status and for trial requests.

C - 2

Capability Description

4 Return ATC Preferences: Provides information and notification about changes impacting a flight that are made either manually or by automation to apply ATC preferences and/or Air Route Traffic Control Centers (ARTCC) adaptations.

Phase 2

5 Preliminary Flight Plan (PFP) Submission and Planning Status Response:

Supports the ingestion of PFPs and provides feedback based on known constraints.

6 Preliminary Flight Information Distribution: Provides preliminary flight plan filing information to Traffic Flow Management (TFM) automation.

7 Return ATC Preferences Enhancements: Enhances the Phase 1 Capability 4 to provide flight plan feedback from all ARTCCs on the flight plan trajectory for filed flight plans as well as for trial requests and PFPs.

8 Notification Service: Provides departure and arrival messages to the eAU.

C.2 APPLICABLE DOCUMENTS

Services provided under this contract must comply with the applicable orders, directives, standards, and policies (collectively referred to as “applicable documents”) listed in this section.

The applicable documents consist of both Government and non-Government documents. The

Contractor is responsible for reviewing all applicable documents, understanding their impact on the delivery of the required services, and complying with the applicable requirements. When and if updates are made to applicable documents during the contract period of performance, the contract will be modified to incorporate the update(s).

Table C-2: Applicable Documents

FAA Orders, FAA Standards, Other FAA Documents, Other Documents

Document ID Number Title

FAA Orders

FAA Order JO 1000.37C

Oct 1, 2021

FAA Order – Air Traffic Organization Safety Management

System

FAA Order 1100.161B

Apr 12, 2024

FAA Order – Air Traffic Safety Oversight

FAA Order 1350.14.B

Dec 24, 2013

FAA Order – Records Management

FAA Order 1370.121B

Apr 25, 2022

FAA Order – FAA Information Security and Privacy: Policy and

Supplemental Implementing Directives (Governance, FAA

Implementation of NIST Controls, FAA Supplemental Security

Controls, User Responsibilities and Obligations, Protection of

Sensitive Unclassified Information (SUI) on Federal and non-

Federal Information Systems and Services by External Entities)

C - 3

Document ID Number Title

FAA Order 1375.1F

Nov 4, 2021

FAA Order – Data and Information Management Policy

FAA Order 1600.1F

Nov 4, 2021

FAA Order – Personnel Security Program

FAA Order 1600.75

Feb 1, 2005

FAA Order – Protecting Sensitive Unclassified Information (SUI)

FAA Order 1800.66A

Aug 10, 2022

FAA Order – Configuration Management Policy

FAA Order 4600.27D

Dec 29, 2021

FAA Order – Personal Property Asset Lifecycle Management

FAA Order 8040.4C

Sep 29, 2023

FAA Order – FAA Safety Risk Management Policy

FAA Standards

FAA HF-STD-001B

Dec 30, 2016

FAA Standard – Human Factors Design Standard (HFDS)

FAA HF-STD-004A

Sep 27, 2016

FAA Standard – Standard Practice: Human Factors Engineering

Requirements

FAA-STD-013D

Jun 15, 1994

FAA Standard – Quality Control Program Requirements

FAA-STD-016A

Sep 21, 1987

FAA Standard – Quality Control System Requirements

FAA-STD-021A

Mar 6, 1990

FAA Standard – Configuration Management (Contractor

Requirements)

FAA-STD-025F

Nov 30, 2007

FAA Standard – Preparation of Interface Documentation

FAA-STD-028C

Nov 16, 2000

FAA Standard – Contract Training Programs

FAA-STD-064

May 1, 2009

FAA Standard – Web Service Registration

FAA-STD-065B

Jul 15, 2019

FAA Standard – Preparation of Web Service Description

Documents

FAA-STD-066

Feb 26, 2010

FAA Standard – Web Service Taxonomies

FAA-STD-073A

Dec 9, 2019

FAA Standard – Preparation of JAVA Messaging Service

Description Documents

FAA-STD-074

Jul 20, 2020

FAA Standard – Preparation of Service Requirements Documents

FAA-STD-075

Jun 29, 2021

FAA Standard – Creating Service Identifiers

Other FAA Documents

FAA AIT-AIS-004

Oct 30, 2015

FAA Cyber Incident Response Process

FAA ATO SMS Manual

Dec 19, 2022

FAA Manual – FAA Air Traffic Organization (ATO) Safety

Management System (SMS) Manual

C - 4

Document ID Number Title

FAA ATO SRMGSA

Oct 2022

FAA Guide – FAA ATO Safety Risk Management Guidance for

System Acquisitions (SRMGSA)

FAA Security Authorization

Handbook

FAA Security Authorization Handbook

FAA T&E Handbook, v5.0

Dec 18, 2020

FAA Test and Evaluation Handbook

SWIM Governance Policies

Version 3.1

Feb 6, 2020

FAA Policy – SWIM Governance Policies

How to Write a Service

Requirements Document

Feb 11, 2021

FAA Instructional Example – How to Write a Service

Requirements Document

SWIM-002, Syntax and Processing of XML-Based Documents in the

Context of SWIM-Enabled

Services, Software Specification

Version 1.0

Jun 16, 2015

FAA SWIM Specification – Syntax and Processing of XML-

Based Documents in the Context of SWIM-Enabled Services, Software Specification Version 1.0

SWIM-005, Artifacts Versioning for SWIM-enabled Services, Software Specification, Version

1.0.0

Dec 18, 2015

FAA SWIM Specification – Artifacts Versioning for SWIM-enabled Services, Software Specification, Version 1.0.0

Other Documents

EIA-748-D Commercial Standard - Electronic Industries Alliance Standard

748-D, Earned Value Management Systems

ISO 9001:2015 – Sept 15, 2015 American Society for Quality (ASQ)/ ANSI/ International

Organization for Standardization (ISO) Quality Management

Systems

ISO/IEC 90003-2014 International Organization for Standardization (ISO) Software

Engineering

NDIA IBR Guide National Defense Industrial Association (NDIA) Integrated

Baseline Review (IBR) Guide

NIST FIPS 199 – Feb 2004 National Institute of Standards – Federal Information Processing

Standards Publication – Standards for Security Categorization of

Federal Information and Information Systems

NIST SP 800-18 Rev. 1

Feb 24, 2006

National Institute of Standards and Technology Special

Publication – Guide for Developing Security Plans for Federal

Information Systems, Rev 1

NIST SP 800-53 Rev. 5

Sep 23, 2020

National Institute of Standards and Technology Special

Publication – Security and Privacy Controls for Information

Systems and Organizations, Rev. 5

Sharable Content Object Reference

Model (SCORM) Ver 1.2”

Sharable Content Object Reference Model (SCORM) is a set of technical standards for eLearning software products. SCORM provides requirements for programmers on coding so that it can provide interoperability with the FAA eLMS eLearning software.

C - 5

C.2.1 ORDER OF PRECEDENCE BETWEEN THE PWS AND APPLICABLE

DOCUMENTS

If the requirements of this PWS and the Applicable Documents referenced in Section C.2 are in conflict, the PWS takes precedence.

If the Contractor identifies a potential conflict between the PWS and the Applicable Documents, the Contractor must advise the FAA Contracting Officer (CO). Any inconsistency in this contract will be resolved by giving precedence in the following order: (a) Section B, Supplies or Services and Prices/Cost, (b) Section C, Performance Work Statement (PWS), (c) Section H, Special

Contract Requirements, (d) Attachment J-1, Functional and Performance Specification, (e)

Sections D, E, F, G, I, and K, (f) Other Section J attachments, and (g) Other sections not listed above.

C.2.2 AVAILABILITY OF DOCUMENTS

Copies of FAA orders, directives, and policies may be obtained from the FAA Contracting Officer identified in Section G of this contract. Requests must clearly identify the title and/or number of the document.

C.3 GOVERNMENT FURNISHED ITEMS AND GOVERNMENT

RESPONSIBILITIES

C.3.1 GOVERNMENT FURNISHED ITEMS

This section identifies items that the Government will furnish to the Contractor to support the delivery of the CSS-FD capabilities.

C.3.1.1 Government Furnished Information

The Government will provide the currently available related technical documentation to support the delivery of CSS-FD capabilities within the Government Sponsored Cloud Environment

(GSCE).

C.3.1.2 Government Sponsored Cloud Environment (GSCE)

A GSCE will be provided to support Contractor development, testing, and deployment in the

Government’s operational environment, as defined in Attachment J-8, Automation Evolution

Strategy (AES) Technical Architecture and Attachment J-9, FAA Cloud Architecture.

C.3.1.3 Government Furnished Laptops

The FAA will provide Government-issued laptops for use to support system design, development, and testing activities. As required, the Contractor must use Government-issued laptops to access the GSCE. The FAA will provide Personal Identity Verification (PIV) cards that must be used to access the Government-issued laptops and networks.

C - 6

The Contractor must not install any tools, products, and/or services that are not approved for use on the Government Furnished Equipment laptops without approval by the Government. If the

Contractor augments the Government identified toolset with additional software and tools, the

Contractor must provide justification and deliver all software development tools (SDT) used to develop/modify the software under this contract, with instructions necessary to configure, and optimize CSS-FD to ensure the maintainability of the system. All Contractor provided software, tools, and simulators must be validated, approved, and accredited by the Government prior to installation. Only fully licensed software will be considered.

C.3.2 GOVERNMENT RESPONSIBILITIES

C.3.2.1 Program Management

The Government Program Office is responsible for the management of the CSS-FD program. The

Government Program Office will coordinate interaction within the FAA to support the development, test and evaluation, and delivery of CSS-FD.

C.3.2.2 Test and Verification

The Government may conduct independent operational test and verification activities to confirm interoperability of the Contractor-provided application with other Government systems. The

Government reserves the right to witness Contractor-conducted test and verification activities.

C.3.2.3 Security Authorization

The Government is responsible for managing all activities necessary to obtain the security authorization of the Contractor-provided solution as required by FAA Order 1370.121B, FAA

Information Security and Privacy Program & Policy. The Government will authorize the

Contractor-provided solution prior to operation. The Government will conduct independent security assessments and report on the security posture through testing and evaluating compliance with security requirements and satisfying Federal Information Security Management Act (FISMA) security authorization reporting requirements.

The Government will provide approval for all connections to the Government-provided test environment. The Government will review security documentation to assess changes to the test environment.

C.4 CONTRACTOR REQUIREMENTS

C.4.1 PROGRAM MANAGEMENT

C.4.1.1 Program Management

The Contractor must plan, organize, direct, and control all the activities necessary to satisfy the requirements of this contract. The Contractor must assign a Program Manager (PM) who has overall responsibility for contract performance and who serves as the Contractor’s focal point for

C - 7 interactions with the Government Program Office for the contract. The Contractor’s PM must possess the knowledge and skill to meet the Program Management requirements of the contract.

The Contractor must prepare, submit, and maintain a Program Management Plan (PMP) describing its approach to managing the work efforts required under the CSS-FD contract.

CDRL CSS-FD-PM01 PROGRAM MANAGEMENT PLAN (PMP)

C.4.1.1.1 Program Control and Status Reporting

The Contractor must track, control, and report the performance of all activities required by this

PWS. The Contractor must assess the progress of ongoing activities, identify problems encountered or foreseen, update the program schedule and risks, and provide the Government with the status of any open action items assigned to the Contractor. In addition to formal monthly reporting as described in the following subsections, the Contractor must provide the Government with timely assessments of program progress and ongoing issues.

The Contractor must respond to informal requests from Government POCs via e-mail or verbally, as applicable, regarding program status and any issues affecting the performance under this contract.

C.4.1.1.1.1 Monthly Status Reports

The Contractor must continuously monitor performance under this contract to provide the

Government with a timely assessment of program progress or problems, and to control all contract activities. The Contractor must prepare a Monthly Status Report (MSR) that provides an assessment of the program's progress, identifies problems encountered, provides an updated program schedule, risks, and provides the status of any open action items assigned to the

Contractor.

CDRL CSS-FD-PM02 MONTHLY STATUS REPORT (MSR)

C.4.1.1.1.2 Earned Value Management

The Contractor must implement and utilize a certified Earned Value Management System (EVMS) that complies with Electronic Industries Alliance (EIA) EIA-748-D, Earned Value

Management Systems.

The Contractor must use its EVMS in accordance with EIA-748-D to plan, integrate, and regularly monitor and measure the progress of project scope, schedule, cost, and resource application. The

Contractor must identify cost and schedule variances of the performance of these elements as compared to a controlled project baseline.

The Contractor must provide an Integrated Program Management Report (IPMR) that provides sufficient information to predict early indications of cost and schedule problems, and their relationship to any technical progress affected.

The Contractor must participate in Earned Value Management (EVM) surveillance from Contract

Award through delivery of a Full Operational Capability (FOC) for CSS-FD.

C - 8

The Contractor must establish an EVMS no later than 90 days after contract award.

CDRL CSS-FD-PM03 INTEGRATED PROGRAM MANAGEMENT REPORT (IPMR)

C.4.1.1.1.3 Contract Work Breakdown Structure

The Contractor must develop and submit a Contract Work Breakdown Structure (CWBS) and associated dictionary as part of the PMP. The Contractor must use the CWBS as the basis for contract planning, budgeting, reporting program costs, EVM reporting, and schedule status.

The Contractor must maintain the CWBS throughout the required EVM reporting period as defined in Paragraph C.4.1.1.1.2.

C.4.1.1.1.4 Integrated Master Schedule

The Contractor must develop and maintain an Integrated Master Schedule (IMS) to plan, manage, and control all program activities throughout the required EVM reporting period as defined in

Paragraph C.4.1.1.1.2.

The IMS must align with the CWBS and the IPMR. The IMS must identify all Contractor and

Government activities, contract deliverables identified in Attachment J-4, Contract Data

Requirements Listing (CDRLs), and milestones identified in Section F.

CDRL CSS-FD-PM04 INTEGRATED MASTER SCHEDULE (IMS)

C.4.1.1.1.5 Integrated Baseline Review

The Contractor must participate in a joint Government/Contractor Integrated Baseline Review

(IBR) for the purpose of reviewing the Contractor’s planned efforts to satisfy contractual requirements. The Contractor must utilize the National Defense Industrial Association (NDIA)

IBR Guide to prepare for the IBR. The Contractor must coordinate the scheduling of the initial

IBR with the Government so that it occurs no later than 120 calendar days after contract award.

As requested, the Government may require the Contractor to support additional IBRs to support future development, test and evaluation, and deployment work activities.

C.4.1.1.2 Meetings and Reviews

As a part of its program management responsibilities, the Contractor must plan, support, and participate in CSS-FD-related meetings and reviews as described in the following subparagraphs.

C.4.1.1.2.1 Post Award Conference

The Contractor must host and conduct a Post Award Conference (PAC) within thirty (30) calendar days of contract award to ensure that both the Contractor and the Government have a clear and mutual understanding of the contract requirements. Briefing materials must be provided two (2) business days prior to the PAC. At a minimum, the PAC must include a discussion of the following:

• Contractor’s organization (including subcontractors) and team member roles and responsibilities

C - 9

• Program management approach

• Contract requirement clarifications

• Proposed Schedule and Key Milestones

• Deliverables and delivery schedules

• Special contract clauses

• Government Furnished Information (GFI), and services (if applicable).

• Requested waivers and deviations (if any)

C.4.1.1.2.2 Recurring Meetings

As requested by the Government, the Contractor must participate in technical, contractual, and programmatic meetings to discuss specific topics and issues. The Government will indicate whether the meeting will be held at a Government or Contractor facility. In addition, the

Government will indicate whether Contractor participation must be in-person or whether it may be virtual. The personnel representing the Contractor must have the requisite knowledge, skills, and experience to discuss the topics identified on the meeting agenda. As requested by the

Government, the Contractor must coordinate the scheduling of meetings with required participants, issue calendar invitations, and prepare agendas, presentation materials, meeting minutes, and action item lists to support the conduct of the meetings.

C.4.1.1.2.3 Program Management Reviews

The Contractor must conduct quarterly Program Management Reviews (PMRs) to provide status of technical activities, schedule, and cost of the CSS-FD program. PMRs will alternate between the FAA and Contractor’s facilities, with the location subject to change as determined by the

Government. The Contractor must provide agenda and briefing materials at least three (3) business days prior to the start of the PMR. The Contractor format may be used for the PMR briefing materials. The Contractor must provide meeting minutes five (5) business days after completion of the PMR. Topics to be addressed at the PMRs must include, but are not limited to the following:

• Contractor’s accomplishments since the last PMR

• Contractor’s plans for the next 90 days

• Review of actions from previous PMR

• Detailed status of software development activities

• Status of safety risk management activities

• Status of information security activities and deliverables.

• Status of test and verification activities

• Status of Deliverables

• Status of IMS activities

• EVM status

• Status of program risks and associated mitigation activities

C - 10

C.4.1.2 Quality Management

The Contractor must establish and maintain a Quality Control/Quality Assurance (QC/QA) program to ensure quality products and deliverables are provided under this contract. The

Contractor must describe their approach to QC/QA in the PMP (CDRL CSS-FD-PM01).

The Contractor’s QC/QA program must be compliant with:

• The inspection requirements defined in Section E of this contract (Inspection and

Acceptance)

• American Society for Quality (ASQ)/ ANSI/ International Organization for

Standardization (ISO) 9001:2015, Quality Management Systems

• FAA-STD-013D, Quality Control Program Requirements

• FAA-STD-016A, Quality Control System Requirements

All QC/QA functions performed by the Contractor are subject to Government verification at any time. Verification may consist of, but is not limited to:

• Surveillance of all Contractor activities to determine that practices, methods and procedures of the QC/QA program are being properly applied

• Government inspection to measure quality of the services offered for acceptance

C.4.1.3 Risk Management

The Contractor must support the FAA’s Risk, Issue, Opportunity (RIO) management process. The

Contractor must participate in monthly joint FAA/Contractor risk meetings. The Contractor must report on any RIO items including the status of the associated mitigation plans during PMRs and include this in the MSR. The Contractor must describe their risk management approach and methodology in the PMP (CDRL CSS-FD-PM01).

C.4.1.4 Configuration Management

The Contractor must establish and maintain a Configuration Management (CM) program that details the processes that ensure that all elements of CSS-FD are identified, controlled, and maintained in accordance with FAA Order 1800.66A, Configuration Management Policy and

FAA-STD-021A, Configuration Management (Contractor Requirements).

The Contractor must participate in the CSS-FD Configuration Control Board (CSS-FD CCB). The

Contractor must seek Government approval prior to implementing any changes and releasing operational software updates to CSS-FD.

The Contractor must describe their approach to configuration management in the PMP (CDRL

CSS-FD-PM01).

C.4.1.4.1 Configuration Audits

The Contractor must conduct Functional Configuration Audit(s) (FCA) and Physical

Configuration Audit(s) (PCA) in accordance with FAA Order 1800.66A, Configuration

C - 11

Management Policy. The Contractor must prepare and submit a Configuration Audit Plan (CAP) which describes the Contractor’s audit approach.

During the FCA, the Contractor must verify that each Computer Software Configuration Item

(CSCI) satisfies the functional and performance requirements in Attachment J-1, Functional and

Performance Specification.

During the PCA, the Contractor must verify that each CSCI aligns with the software documentation identified in Section C.4.2.3.

The Contractor must document the results of the FCA/PCA in a Configuration Audit Summary

Report (CASR). FCA/PCA is considered complete once all action items are dispositioned or closed and approved by the Government.

Upon successful completion of the FCA/PCA, the Contractor must establish and maintain a product baseline for CSS-FD.

CDRL CSS-FD-CM01 CONFIGURATION AUDIT PLAN (CAP)

CDRL CSS-FD-CM02 CONFIGURATION AUDIT SUMMARY REPORT (CASR)

C.4.1.4.2 Configuration Status Accounting (CSA)

The Contractor must generate Configuration Status Accounting Report (CSAR) to ensure the configuration of development and implemented software systems and that delivered documentation accurately describes the configuration. The Contractor must provide traceability of any change through the change control process. The Contractor must present status at PMRs as updates occur.

CDRL CSS-FD-CM03 CONFIGURATION STATUS ACCOUNTING REPORT (CSAR)

C.4.1.4.3 Waivers and Deviations

The Contractor must submit a Request for Deviation or Waiver for Government review and approval any time the Contractor wishes to request temporary relief or permanent relief from a requirement.

C.4.1.4.4 Engineering Change Proposal (ECP)

The Contractor must submit Engineering Change Proposals (ECPs) for approval prior to implementation and incorporation of a change to the baselined program requirements defined in

Attachment J-1, Functional and Performance Specification.

CDRL CSS-FD-CM04 ENGINEERING CHANGE PROPOSAL (ECP)

C.4.1.5 Records Management

The Contractor must create and maintain files that document the processing of work and other associated information pertaining to work performed under this contract. The files must be in an electronic format from a commercially available software application. The Contractor must

C - 12 maintain files in accordance with FAA Order 1350.14B, Records Management. The Contractor must manage data in accordance with their data management plan, developed and delivered as part of the overall PMP (CDRL CSS-FD-PM01).

C.4.2 SOLUTION DEVELOPMENT

Solution Development addresses all aspects of systems engineering, requirements reviews, software documentation, software design reviews, software application development, test and evaluation, and system safety.

C.4.2.1 Systems Engineering

The Contractor must establish and maintain a system engineering program to ensure successful design, development, integration, and testing of CSS-FD to satisfy the requirements identified in

Attachment J-1, Functional and Performance Specification.

The Contractor must designate a Chief Systems Engineer to serve as the primary interface for the

Government Functional Leads. The Contractor’s Chief Systems Engineer must possess the knowledge and skill to meet the programmatic requirements of the contract.

The Contractor must document their approach to systems engineering in a Systems Engineering

Management Plan (SEMP).

The Contractor must develop and implement a Data Management Plan (DMP) in accordance with

FAA Order 1375.1F.

CDRL CSS-FD-SE01 SYSTEMS ENGINEERING MANAGEMENT PLAN (SEMP)

CDRL CSS-FD-SE02 DATA MANAGEMENT PLAN (DMP)

C.4.2.2 Requirements Review(s)

The Contractor must conduct Requirements Review(s) to demonstrate an understanding of all requirements contained in this PWS and Attachment J-1, Functional and Performance

Specification. The Contractor must conduct the Requirements Review(s) consistent with their software development approach and schedule milestones in Section F. The Requirements

Review(s) must address the following at a minimum:

• The Contractor’s understanding of all requirements identified in this PWS and

Attachment J-1, Functional and Performance Specification

• Any derived requirements

• Design-driving/cost-driving requirements

• Contract Deliverables

• An assessment of risk to satisfying requirements

C.4.2.3 Software Documentation

The Contractor must prepare and maintain a Software Development Plan (SDP) that describes their approach to developing CSS-FD. The SDP must include the plans, processes, and procedures

C - 13 for requirements management, software engineering management, software design, software development, software test, and human factors. The Contractor must use a software design standard consistent with their software development approach, in establishing a software development process and to ensure the software lifecycle process used is compliant with ISO/IEC

90003-2014, Software Engineering. The Contractor must define its software development environment utilized to develop CSS-FD (i.e., Contractor development environment or GSCE).

CDRL CSS-FD-SD01 SOFTWARE DEVELOPMENT PLAN (SDP)

C.4.2.3.1 Software Requirements Specification (SRS)

The Contractor must develop a Software Requirements Specification (SRS) that identifies detailed requirements for each CSCI. The Contractor must use the SRS as the basis for design and subsequent qualification testing of a CSCI. The SRS must include specifications for all interactions between CSS-FD and its users, external systems, and data sources. The SRS must provide the detail and clarity needed to guide software design, implementation, and test (such as performance requirements, security requirements, extensibility requirements, quality standards, or design constraints). The SRS must define the rules, calculations, data manipulations, limits, exceptions, human factors, and software standards needed to fulfill the CSS-FD requirements. The SRS must include specifications for COTS and non-developmental software (NDS), if applicable, and provide traceability to software and interface requirements.

CDRL CSS-FD-SD02 SOFTWARE REQUIREMENTS SPECIFICATION (SRS)

C.4.2.3.2 Interface Requirements Specification (IRS)

The Contractor must develop an Interface Requirements Specification (IRS) to include both internal and external interface system/subsystem requirements. The IRS must identify the requirements imposed on systems, subsystems, CSCIs, or other system components to achieve one or more interfaces among these entities.

CDRL CSS-FD-SD03 INTERFACE REQUIREMENTS SPECIFICATION (IRS)

C.4.2.3.3 SWIM Services Documents

The Contractor must adhere to the policies, rules, and standards for identifying, designing, implementing, deploying, and managing the resources, assets, and processes that are enabled and/or supported by SWIM in accordance with FAA SWIM Governance Policies Version 3.1 and SWIM-002, Syntax and Processing of XML-Based Documents in the Context of SWIM-

Enabled Services, Software Specification Version 1.0. All service identifiers defined as a part of implementing SWIM services must be in accordance with FAA-STD-075, Creating Service

Identifiers.

C - 14

The Contractor must develop Service Requirements Documents (SRDs)1, Web Service

Description Documents (WSDD), and/or JAVA Messaging Service Description Documents

(JMSDD). Separate SRDs, WSDDs, and/or JMSDDs must be prepared for each service.

SRDs must be prepared in accordance with FAA-STD-074, Preparation of Service

Requirements Documents, utilizing How to Write a Service Requirements Document as a guide.

WSDDs must be prepared in accordance with FAA-STD-065B, Preparation of Web Service

Description Documents.

JMSDD must be prepared in accordance with FAA-STD-073A, Preparation of JAVA Message

Service Description Documents.

Web services must be developed in accordance with FAA-STD-064, Web Service Registration, and FAA-STD-066, Web Service Taxonomies.

CDRL CSS-FD-SD04 SERVICE REQUIREMENTS DOCUMENT (SRD)

CDRL CSS-FD-SD05 WEB SERVICE DESCRIPTION DOCUMENTS (WSDD)

CDRL CSS-FD-SD06 JAVA MESSAGING SERVICE DESCRIPTION DOCUMENTS (JMSDD)

C.4.2.3.4 Software Design Description (SDD)

The Contractor must develop a Software Design Description (SDD) to describe the software design of the CSS-FD. The SDD must capture the system and software architecture; software decomposition, component design and overview of functions and features; rationale for design decisions, assumptions, dependencies, constraints, guidelines, and goals; data design including data description and data dictionary; user interface and human factors design; and testing and software/system monitoring design elements. The SDD must also include details for the design of processing (business) rules; data governance, provenance, migration and data management;

external interface exchanges; security, reliability, maintainability availability; and other performance areas. The SDD must provide traceability between its specified components and design elements/approaches and the related system, software, interface, and data migration requirements captured in the SRS (CDRL CSS-FD-SD02), IRS (CDRL CSS-FD-SD03) and the

SWIM services documents SRD (CDRL CSS-FD-SD04), WSDD (CSS-FD-SD05), JMSDD

(CDRL CSS-FD-SD06).

CDRL CSS-FD-SD07 SOFTWARE DESIGN DESCRIPTION (SDD)

1 Attachment J-7, CSS-FD Service Requirements Document (SRD) is the initial draft of the CDRL

CSS-FD-SD04, for the Contractor to update and finalize.

C - 15

C.4.2.4 Software Design Reviews (SDR)

The Contractor must conduct Software Design Reviews (SDRs) to provide the Government with assurance that the Contractor’s proposed solution for CSS-FD will satisfy all applicable requirements and facilitate FAA acceptance. The Contractor must conduct the Software Design

Review(s) at a cadence and frequency consistent with the software development approach, and as defined in the SDP schedule milestones in Section F. At a minimum, an SDR must address the following:

• Software architecture and design and how they will satisfy the requirements contained in

Attachment J-1, Functional and Performance Specification

• How the solution integrates into and uses the GSCE

• How the software complies with the design requirements in Section C.4.2.5.1

• How the solution complies with the information security requirements

• The allocation and satisfaction of functional requirements to CSCIs and/or individual software build release plans, if applicable

• Graphical user interface design considerations

• Human Factors strategy and program planning

• Quality Assurance approach

• Test and Verification strategy and planning

• In-Service Management requirements

• Schedule and key milestones

• Compliance with and/or implementation of elements of the following FAA-approved

Contractor Deliverables:

o Systems Engineering Management Plan (SEMP) (CDRL CSS-FD-SE01) o Software Development Plan (SDP) (CDRL CSS-FD-SD01) o Software Requirements Specification (SRS) (CDRL CSS-FD-SD02) o Interface Requirements Specification (IRS) (CDRL CSS-FD-SD03) o Service Requirements Document (SRD) (CDRL CSS-FD-SD04) o Web Service Description Documents (WSDD) (CDRL CSS-FD-SD05) o JAVA Messaging Service Description Documents (JMSDD) (CDRL CSS-FD-

SD06)

o Software Design Description (SDD) (CDRL CSS-FD-SD07)

C.4.2.5 Software Application Development

The Contractor must develop, test, and deliver CSS-FD consistent with their software development approach defined in the SDP that satisfies the requirements of Attachment J-1, Functional and

Performance Specification.

C - 16

C.4.2.5.1 Software Application Design

The Contractor’s software design approach and methodology must use a modular design, standards-based interfaces, and Industry recognized software development standards. The

Contractor’s design must include the following characteristics:

• Open Architecture – The Contractor’s design must include capabilities for re-configurability, portability, maintainability, technology insertion, vendor independence, reusability, scalability, interoperability, upgradeability, and long-term supportability.

• Modular, Open Design – The Contractor’s design must embody a layered and modular approach, leveraging standards-based Commercial Off-The-Shelf (COTS), open-source, and/or Non-Development Item (NDI) software. The architecture must use open-source components and operating systems, along with middleware that supports non-proprietary or non-vendor unique key Application Programming Interfaces (APIs).

• Inter-Component Dependencies – The Contractor’s design must result in a layered system design, maximizing software independence from the hardware. The design must isolate the application software layers from the infrastructure software (such as the operating system) to enhance portability. The design must be able to survive a change to the computing infrastructure with minimal or no changes required to the application logic. The interfaces between the layers must be built to open standards or available to the Government with at least Government Purpose Rights.

• Modular Open Systems Approach (MOSA) – The Contractor’s design must produce a solution that consists of hierarchical collections of software configuration items

(components). The Contractor’s design must emphasize the selection of components that are available commercially.

• Treatment of Proprietary or Vendor-Unique Elements – The Contractor must explain the use of proprietary, vendor-unique, closed components, or interfaces. If applicable, the

Contractor will define its process for identifying and justifying proprietary, vendor-unique or closed interfaces, code modules, hardware, firmware, or software to be used.

When interfaces, hardware, firmware, or modules that are proprietary or vendor-unique are required, the Contractor must demonstrate to the Government that those proprietary elements do not preclude or hinder other component or module developers from interfacing with or otherwise developing, replacing, or upgrading open parts of the system.

• Scalability, Fault Tolerance, and Cost Optimization – The Contractor must design the application to automatically scale resources on demand, ensuring resilience to failures, optimizing GSCE resources, and minimizing GSCE infrastructure costs. The Contractor must implement monitoring and logging mechanisms to track demand.

C.4.2.5.2 Collaborative Design Workshops (CDW)

The Contractor must establish a program whose objective is to promote effective collaboration and facilitate Government acceptance. The Contractor must conduct and utilize Collaborative Design

Workshops (CDWs) to facilitate iterative collaboration with the Government.

C - 17

The CDWs must also elicit and clarify requirements, user scenarios, business rules, interface needs, design preferences, at a minimum, to facilitate Government acceptance. The Contractor must describe their approach to conducting CDWs in the SEMP (CDRL CSS-FD-SE01).

C.4.2.5.2.1 Business Rules

The Contractor must utilize CDWs to support the development of and updates to the business rules

(Attachment J-10, CSS-FD Business Rules) to satisfy the requirements of Attachment J-1, Functional and Performance Specification. The Contractor must document and provide the results in the Business Rules Document.

CDRL CSS-FD-CD01 BUSINESS RULES DOCUMENT

C.4.2.5.2.2 Flight Object

The Contractor must utilize CDWs to support the development of and updates to the Flight Object

(FO) Workbook (Attachment J-12, Flight Object (FO) Workbook) to satisfy the requirements of

Attachment J-1, Functional and Performance Specification. The Contractor must document and provide the results in the Flight Object Workbook.

CDRL CSS-FD-CD02 FLIGHT OBJECT (FO) WORKBOOK

C.4.2.5.3 Human Factors

The Contractor must implement a Human Factors program to comply with FAA HF-STD-004A, Standard Practice: Human Factors Engineering Requirements and FAA HF-STD-001B, Human Factors Design Standard (HFDS). The Contractor must prepare and submit a Human

Factors Program Plan (HFPP) which describes how human factors will be addressed during the software development lifecycle.

CDRL CSS-FD-HF01 HUMAN FACTORS PROGRAM PLAN (HFPP)

C.4.2.6 Test and Evaluation

C.4.2.6.1 Test and Evaluation Management

The Contractor must plan, manage, document, and conduct a Test and Evaluation (T&E) program to verify that CSS-FD satisfies the requirements contained in Attachment J-1, Functional and

Performance Specification. The Contractor must incorporate a comprehensive quality assurance program to ensure discovery and correction of problems prior to conducting formal tests.

The Contractor must conduct and support meetings, reviews, and working groups with the FAA during test and evaluation planning and execution activities.

The Contractor must conduct test and evaluation activities consistent with their software development approach, and schedule milestones in Section F.

C - 18

C.4.2.6.2 Test and Evaluation Planning

The Contractor must prepare and submit a Contractor Master Test Plan (CMTP) that describes their approach to supporting the full scope of CSS-FD test and evaluation activities inclusive of

Contractor-conducted and Government-conducted testing.

The Contractor must prepare and maintain a Master Verification Requirements Traceability Matrix

(VRTM) that lists all requirements subject to verification. The Master VRTM must contain, at a minimum, all requirements identified in the CSS-FD VRTM. The Contractor must maintain the

Master VRTM within a Requirements Configuration Management Tool that is accessible to the

Government.

CDRL CSS-FD-TE01 CONTRACTOR MASTER TEST PLAN (CMTP)

CDRL CSS-FD-TE02 VERIFICATION REQUIREMENTS TRACEABILITY MATRIX (VRTM)

C.4.2.6.3 Test Capability Accreditation

The Contractor must verify to the Government that the planned test capabilities for each

Contractor-conducted test are acceptable for the intended purpose and will yield accurate test results. The Government reserves the right to witness the test capability accreditation. The

Contractor must describe their approach and plan for Test Capability Accreditation in the CMTP

(CDRL CSS-FD-TE01).

C.4.2.6.4 Program Trouble Reports

The Contractor must document each occurrence of failure of a test case, i.e., when it does not satisfy the associated requirement(s) addressed by the test procedure. The Contractor must propose corrective action for each Program Trouble Report (PTR) and identify the planned regression testing and any modifications to the Government-provided test environment required to demonstrate compliance with the specification. The Contractor must track all PTRs in a database that is accessible to the Government. The Contractor must address PTRs for both Contractor and

FAA-conducted testing, in accordance with each PTR’s corrective action plan.

C.4.2.6.5 Contractor Conducted Tests

The Contractor must conduct test and evaluation to validate the CSS-FD software design and associated software documentation identified in Section C.4.2.3 satisfies the requirements contained in Attachment J-1, Functional and Performance Specification and Attachment J-2, Security Controls.

The Contractor must utilize the GSCE and furnish any required test tools and personnel for the successful completion of Contractor conducted tests. The Contractor must identify all GFI necessary for the successful completion of Contractor conducted tests.

Prior to performing any formal tests, the Contractor must conduct Test Readiness Review(s) (TRR) to demonstrate readiness and preparedness. The Contractor must address all items contained in

Section 6.3.2 of the FAA Test and Evaluation Handbook, v5.0. The Contractor must provide

TRR materials to the Government at least five (5) working days in advance of the meeting. The

C - 19

Contractor must receive the Government’s approval at the conclusion of the TRR before beginning formal tests.

Prior to the start of each test, the Contractor must conduct a Pre-Test briefing to ensure readiness to begin the respective test. The Pre-Test briefing must address all items contained in Section 6.3.3 of the FAA Test and Evaluation Handbook, v5.0.

Upon completion of any formal test, the Contractor must conduct a Post-test review to provide the outcome of the test activity. The Post-Test review must address all items contained in Section 6.3.5 of the FAA Test and Evaluation Handbook, v5.0.

The Contractor must conduct regression testing when results do not satisfy requirements or are otherwise unacceptable to the Government. In addition, the Contractor must perform regression testing when changes are made to previously tested items.

Regression Testing may also be required when a corrective action has been identified as a result of previous testing. If required, the Contractor must recommend to the Government the level of regression testing.

The Contractor must update the Test Report to document the outcome of any regression testing.

C.4.2.6.5.1 Development Test (DT)

The Contractor must conduct Development Testing (DT) to verify the solution satisfies the requirements contained in Attachment J-1, Functional and Performance Specification. The

Contractor must obtain Government approval of the CMTP (CDRL CSS-FD-TE01) prior to the submittal of Test Procedures. DT must consist of Component, Integration, and System Tests.

The Contractor must conduct DT in the GSCE test environment. The Contractor must prepare and submit, for Government approval, Acceptance Test Procedures (ATP) that address the full scope of the required DT activities.

The Contractor must prepare and submit Test Reports to document the outcome of all Test

Procedures performed during all Contractor conducted tests.

The Contractor must deliver to the GSCE test environment all applications and/or source code in support of DT.

Prior to entering DT, the Contractor must satisfy all criteria identified in Section 6.2.7 of the FAA

Test and Evaluation Handbook, v5.0.

Prior to exiting DT, the Contractor must satisfy all criteria identified in Section 6.2.8 of the FAA

Test and Evaluation Handbook, v5.0.

CDRL CSS-FD-TE03 ACCEPTANCE TEST PROCEDURES (ATP)

CDRL CSS-FD-TE04 TEST REPORTS

C - 20

C.4.2.6.5.1.1 Component Test

T…