DRAFT SIR CSS-FD Sect C.pdf

FEDERAL AVIATION ADMINISTRATION

COMMON SUPPORT SERVICES – FLIGHT DATA (CSS-FD)

SECTION C: PERFORMANCE WORK STATEMENT

Federal Aviation Administration 800 Independence Avenue, SW

Washington, DC 20591

SECTION C Solicitation #

PERFORMANCE WORK STATEMENT CSS-FD

C - ii

TABLE OF CONTENTS

C.1 INTRODUCTION

C.1.1 SCOPE OF WORK

C.2 APPLICABLE DOCUMENTS

C.2.1 Order of Precedence Between the PWS and Applicable Documents C.2.2 Availability of Documents

C.3 GOVERNMENT FURNISHED ITEMS AND GOVERNMENT RESPONSIBILITIES

C.3.1 GOVERNMENT FURNISHED ITEMS

C.3.1.1 Documentation C.3.1.2 Government Sponsored Cloud Environment C.3.1.3 Government Furnished Laptops

C.3.2 GOVERNMENT RESPONSIBILITIES

C.3.2.1 Program Management C.3.2.2 Test and Verification C.3.2.3 Security Authorization

C.4 CONTRACTOR REQUIREMENTS

C.4.1 PROGRAM MANAGEMENT

C.4.1.1 Program Management C.4.1.2 Quality Management C.4.1.3 Risk Management C.4.1.4 Configuration Management

C.4.2 SOLUTION DEVELOPMENT

C.4.2.1 Systems Engineering C.4.2.2 Requirements Review(s) C.4.2.3 Software Documentation C.4.2.4 Software Design Reviews (SDR) C.4.2.5 Software Application Development C.4.2.6 Test and Evaluation C.4.2.7 System Safety

C.4.3 SECURITY

C.4.3.1 Security Program C.4.3.2 Security Authorization C.4.3.3 System Authorization Documentation C.4.3.4 Security Assessments and Continuous Monitoring C.4.3.5 Security of Test Environment C.4.3.6 Incident Response C.4.3.7 Cybersecurity Exercises C.4.3.8 Facility Security C.4.3.9 Personnel Security C.4.3.10 Protecting Sensitive Unclassified Information (SUI) C.4.3.11 Supply Chain Risk Management (SCRM) C.4.3.12 Insider Threat Prevention Program

C.4.4 SOLUTION IMPLEMENTATION AND INTEGRATION

C.4.5 IN-SERVICE MANAGEMENT

C.4.5.1 Software Maintenance C.4.5.2 CSS-FD Jumpstart Kit (CJK) C.4.5.3 Software Delivery

C - iii

C.4.5.4 Tier Support C.4.5.5 Technical Documentation C.4.5.6 Training C.4.5.7 General Engineering and Technical Support Services

TABLE OF CDRLS

CDRL CSS-FD-PM01 PROGRAM MANAGEMENT PLAN (PMP)

CDRL CSS-FD-PM02 MONTHLY STATUS REPORT (MSR)

CDRL CSS-FD-PM03 INTEGRATED PROGRAM MANAGEMENT REPORT (IPMR)

CDRL CSS-FD-PM04 INTEGRATED MASTER SCHEDULE (IMS)

CDRL CSS-FD-CM01 CONFIGURATION AUDIT PLAN (CAP)

CDRL CSS-FD-CM02 CONFIGURATION AUDIT SUMMARY REPORT (CASR)

CDRL CSS-FD-CM03 CONFIGURATION STATUS ACCOUNTING REPORT (CSAR)

CDRL CSS-FD-CM04 ENGINEERING CHANGE PROPOSAL (ECP)

CDRL CSS-FD-SE01 SYSTEMS ENGINEERING MANAGEMENT PLAN (SEMP)

CDRL CSS-FD-SD01 SOFTWARE DEVELOPMENT PLAN (SDP)

CDRL CSS-FD-SD02 SOFTWARE REQUIREMENTS SPECIFICATION (SRS)

CDRL CSS-FD-SD03 INTERFACE REQUIREMENTS SPECIFICATION (IRS)

CDRL CSS-FD-SD04 SERVICE REQUIREMENTS DOCUMENT (SRD)

CDRL CSS-FD-SD05 WEB SERVICE DESCRIPTION DOCUMENTS (WSDD)

CDRL CSS-FD-SD06 JAVA MESSAGING SERVICE DESCRIPTION DOCUMENTS (JMSDD)

CDRL CSS-FD-SD07 SOFTWARE DESIGN DESCRIPTION (SDD)

CDRL CSS-FD-CD01 BUSINESS RULES DOCUMENT

CDRL CSS-FD-HF01 HUMAN FACTORS PROGRAM PLAN (HFPP)

CDRL CSS-FD-TE01 CONTRACTOR MASTER TEST PLAN (CMTP)

CDRL CSS-FD-TE02 VERIFICATION REQUIREMENTS TRACEABILITY MATRIX (VRTM)

CDRL CSS-FD-TE03 ACCEPTANCE TEST PROCEDURES (ATP)

CDRL CSS-FD-TE04 TEST REPORTS

CDRL CSS-FD-SRM01 SYSTEM SAFETY PROGRAM PLAN (SSPP)

CDRL CSS-FD-SRM02 SUB-SYSTEM HAZARD ANALYSIS (SSHA)

CDRL CSS-FD-SRM03 SYSTEM HAZARD ANALYSIS (SHA)

CDRL CSS-FD-SRM04 OPERATING AND SUPPORT HAZARD ANALYSIS (O&SHA)

CDRL CSS-FD-ISS01 SYSTEM SECURITY PLAN (SSP)

CDRL CSS-FD-ISS02 SYSTEM CHARACTERIZATION DOCUMENT (SCD)

CDRL CSS-FD-ISS03 PRIVACY THRESHOLD ASSESSMENT (PTA)

CDRL CSS-FD-ISS04 PRIVACY IMPACT ASSESSMENT (PIA)

CDRL CSS-FD-ISS05 PRIVACY CONTINUOUS MONITORING (PCM) DOCUMENTATION

CDRL CSS-FD-ISS06 RECORDS MANAGEMENT SCHEDULE

CDRL CSS-FD-ISS07 INFORMATION SYSTEM CONTINGENCY PLAN (ISCP)

CDRL CSS-FD-ISS08 INFORMATION SYSTEM CONTINGENCY TEST PLAN

CDRL CSS-FD-ISS09 INFORMATION SYSTEM CONTINGENCY TEST RESULTS REPORT

CDRL CSS-FD-ISS10 SYSTEM AUTHORIZATION BRIEFING (SAB)

CDRL CSS-FD-IM01 IMPLEMENTATION AND INTEGRATION PLAN

CDRL CSS-FD-ISM01 SOFTWARE MAINTENANCE PLAN (SMP)

CDRL CSS-FD-ISM02 SOFTWARE DELIVERY

CDRL CSS-FD-ISM03 CSS-FD REFERENCE MANUAL

CDRL CSS-FD-ISM04 TECHNICAL INSTRUCTION MANUAL

CDRL CSS-FD TNG01 TRAINING DEVELOPMENT PLAN (TDP)

CDRL CSS-FD TNG02 TASK AND SKILLS ANALYSIS REPORT

CDRL CSS-FD TNG03 COURSE DESIGN GUIDE (CDG)

CDRL CSS-FD TNG04 CLASSROOM TRAINING MATERIAL

CDRL CSS-FD TNG05 STUDENT TESTS FOR INSTRUCTOR-LED TRAINING (ILT) ONLY

C - iv

CDRL CSS-FD TNG06 CONTRACTOR’S PRESENTATION MATERIAL

CDRL CSS-FD TNG07 OPERATIONAL TRYOUTS REPORT

CDRL CSS-FD TNG08 FIRST COURSE CONDUCT REPORT

CDRL CSS-FD TNG09 END OF COURSE (EOC) EVALUATION

CDRL CSS-FD TNG10 CLASS ROSTER REPORT

CDRL CSS-FD TNG11 CERTIFICATE OF TRAINING

CDRL CSS-FD TNG12 FAMILIARIZATION TRAINING MATERIAL

CDRL CSS-FD TNG13 WEB-BASED OPERATIONS AND MAINTENANCE TRAINING CONTENT

C - 1

C.1 INTRODUCTION

The Common Support Services – Flight Data (CSS-FD) program is the FAA implementation of the International Civil Aviation Organization (ICAO) Flight & Flow Information for a Collaborative Environment (FF-ICE) Release 1 that will enhance flight planning and filing as well as provide enterprise-level services that support flexible, accurate, and timely access to common flight information across domains, flight operators, and the Air Traffic Management (ATM) community. The CSS-FD program will work towards standardization of flight information exchange in the National Airspace System (NAS) by defining and delivering a service that updates exchanges between operators and the FAA, using FF-ICE, Flight Information Exchange Model (FIXM), and the Flight Object.

C.1.1 SCOPE OF WORK

The scope of work required under this Performance Work Statement (PWS) includes all elements necessary for the development, test, deployment, and in-service support of the CSS-FD system.

The scope of CSS-FD includes the seven capabilities identified in the following table.

Capability Description

Phase 1

1 Data Management and Security Framework (for flight planning and filing):

Enables flight planning, flight plan filing, and flight data sharing to include global flight data management functions (e.g., standardization, translation, reconciliation, and validation along with reconstitution) as well as security elements required for identity and access management.

2 Flight Planning and Flight Plan Filing: Supports the ingestion and routing of appropriate responses to submitted filing of a flight plan by enhanced Airspace Users (eAUs) via the FF-ICE method as well as ingesting flight plans submitted by AUs via a legacy method. Also supports the Flight Planning trial requests functionality for eAUs to explore “what-if” scenarios regarding their plan.

3 Feedback by Reference: Provides information on airspace constraints or other restrictions for flight plans in the filing status responses and in trial responses for trial requests.

4 Return ATC Preferences: Provides information and notification about changes that impact a flight that are made either manually by Air Traffic Control (ATC) personnel or by automation.

Phase 2

5 Preliminary Flight Plan Submission: Supports the ingestion of Preliminary Flight Plans, provides feedback based on known constraints, and distributes flight planning information as appropriate.

6 Consumer-Specified Data Filtering: Provides information to users based on requests from consumers with data filtering criteria and subscription.

7 Preliminary Flight Plan Integration with TFMS/FMDS: Provides preliminary

C - 2

Capability Description flight plan filing information to Traffic Flow Management (TFM) automation.

The work efforts areas identified in this PWS include: Program Management, Solution Development, Security, Solution Implementation and Integration, and In-Service Management for Phase 1 capabilities.

Note: The FAA is considering inclusion of Phase 2 within the scope of this procurement.

The Contractor must provide all software applications, licenses, tools, personnel, supervision, and other items necessary to perform all work efforts defined in this PWS. Work efforts and/or deliverables to be produced are included in the scope of this PWS.

C.2 APPLICABLE DOCUMENTS

Services provided under this contract must comply with the applicable orders, directives, standards, and policies (collectively referred to as “applicable documents”) listed in this section.

The applicable documents consist of both Government and non-Government documents. The Contractor is responsible for reviewing all applicable documents, understanding their impact on the delivery of the required services, and complying with the applicable requirements. The most current version of each document at time of contract award will be the applicable version at the beginning of contract performance. When and if updates are made to applicable documents during the contract period of performance, the contract will be modified to incorporate the update(s).

FAA Orders, FAA Standards, Other FAA Documents, Other Documents

Document ID Number Title

FAA Orders FAA Order JO 1000.37C Oct 1, 2021

FAA Order – Air Traffic Organization Safety Management System

FAA Order 1100.161A Feb 28, 2020

FAA Order – Air Traffic Safety Oversight

FAA Order 1370.121B Apr 25, 2022

FAA Order – FAA Information Security and Privacy: Policy and Supplemental Implementing Directives (Governance, FAA Implementation of NIST Controls, FAA Supplemental Security Controls, User Responsibilities and Obligations, Protection of Sensitive Unclassified Information (SUI) on Federal and non- Federal Information Systems and Services by External Entities)

FAA Order 1600.1F Nov 4, 2021

FAA Order – Personnel Security Program

FAA Order 1600.75 Feb 1, 2005

FAA Order – Protecting Sensitive Unclassified Information (SUI)

FAA Order 1800.66A Aug 10, 2022

FAA Order – Configuration Management Policy

FAA Order 4600.27D Dec 29, 2021

FAA Order – Personal Property Asset Lifecycle Management

C - 3

Document ID Number Title FAA Order 8040.4B May 2, 2017

FAA Order – FAA Safety Risk Management Policy

FAA Standards

FAA HF-STD-001B

Dec 30, 2016

FAA Standard – Human Factors Design Standard (HFDS)

FAA HF-STD-004A

Sep 27, 2016

FAA Standard – Standard Practice: Human Factors Engineering Requirements

FAA-STD-013D

Jun 15, 1994

FAA Standard – Quality Control Program Requirements

FAA-STD-016A

Sep 21, 1987

FAA Standard – Quality Control System Requirements

FAA-STD-021A

Mar 6, 1990

FAA Standard – Configuration Management (Contractor Requirements)

FAA-STD-025F

Nov 30, 2007

FAA Standard – Preparation of Interface Documentation

FAA-STD-028C

Nov 16, 2000

FAA Standard – Contract Training Programs

FAA-STD-064

May 1, 2009

FAA Standard – Web Service Registration

FAA-STD-065B

Jul 15, 2019

FAA Standard – Preparation of Web Service Description Documents

FAA-STD-066

Feb 26, 2010

FAA Standard – Web Service Taxonomies

FAA-STD-073A

Dec 9, 2019

FAA Standard – Preparation of JAVA Messaging Service Description Documents

FAA-STD-074

Jul 20, 2020

FAA Standard – Preparation of Service Requirements Documents

FAA-STD-075

Jun 29, 2021

FAA Standard – Creating Service Identifiers

Other FAA Documents

FAA AIT-AIS-004

Oct 30, 2015

FAA Cyber Incident Response Process

FAA ATO SMS Manual Dec 19, 2022

FAA Manual – FAA Air Traffic Organization (ATO) Safety Management System (SMS) Manual

FAA ATO SRMGSA

Oct 2022

FAA Guide – FAA ATO Safety Risk Management Guidance for System Acquisitions (SRMGSA)

FAA Security Authorization Handbook

FAA Security Authorization Handbook

FAA T&E Handbook, v5.0 Dec 18, 2020

FAA Test and Evaluation Handbook

SWIM Governance Policies Version 3.1 Feb 6, 2020

FAA Policy – SWIM Governance Policies

C - 4

Document ID Number Title How to Write a Service Requirements Document Feb 11, 2021

FAA Instructional Example – How to Write a Service Requirements Document

SWIM-002, Syntax and Processing of XML-Based Documents in the Context of SWIM-Enabled Services, Software Specification Version 1.0 Jun 16, 2015

FAA SWIM Specification – Syntax and Processing of XML- Based Documents in the Context of SWIM-Enabled Services, Software Specification Version 1.0

SWIM-005, Artifacts Versioning for SWIM-enabled Services, Software Specification, Version 1.0.0 Dec 18, 2015

FAA SWIM Specification – Artifacts Versioning for SWIM-enabled Services, Software Specification, Version 1.0.0

Other Documents EIA-748-D Commercial Standard - Electronic Industries Alliance Standard

748-D, Earned Value Management Systems ISO 9001:2015 – Sept 15, 2015 American Society for Quality (ASQ)/ ANSI/ International

Organization for Standardization (ISO) Quality Management Systems

ISO/IEC 90003-2014 International Organization for Standardization (ISO) Software Engineering

NDIA IBR Guide National Defense Industrial Association (NDIA) Integrated Baseline Review (IBR) Guide

NIST FIPS 199 – Feb 2004 National Institute of Standards – Federal Information Processing Standards Publication – Standards for Security Categorization of Federal Information and Information Systems

NIST SP 800-18 Rev. 1 Feb 24, 2006

National Institute of Standards and Technology Special Publication – Guide for Developing Security Plans for Federal Information Systems, Rev 1

NIST SP 800-53 Rev. 5 Sep 23, 2020

National Institute of Standards and Technology Special Publication – Security and Privacy Controls for Information Systems and Organizations, Rev. 5

RTCA DO-278A Software Integrity Assurance Considerations for Communication, Navigation, Surveillance and Air Traffic Management (CNS/ATM) Systems

C.2.1 ORDER OF PRECEDENCE BETWEEN THE PWS AND APPLICABLE

DOCUMENTS

If the requirements of this PWS and the Applicable Documents referenced in Section C.2 are in conflict, the PWS takes precedence.

If the Contractor identifies a potential conflict between the PWS and the Applicable Documents, the Contractor must advise the FAA Contracting Officer (CO) for resolution in the following order:

(a) Section B, Price Schedule, (b) Section C, Performance Work Statement (PWS), (c) Section H, C - 5

Special Contract Requirements, (d) Attachment J-1, Functional and Performance Specification, (e) Sections D, E, F, G, I, and K, (f) Other Section J attachments, and (g) Other sections not listed above.

C.2.2 AVAILABILITY OF DOCUMENTS

Copies of FAA orders, directives, and policies may be obtained from the FAA Contracting Officer identified in Section G of this contract. Requests must clearly identify the title and/or number of the document.

C.3 GOVERNMENT FURNISHED ITEMS AND GOVERNMENT

RESPONSIBILITIES

C.3.1 GOVERNMENT FURNISHED ITEMS

This section identifies items that the Government will furnish to the Contractor to support the delivery of the CSS-FD capabilities.

C.3.1.1 Documentation The Government will provide the currently available TBD documentation to support the delivery of CSS-FD capabilities within the Government Sponsored Cloud Environment (GSCE).

C.3.1.2 Government Sponsored Cloud Environment (GSCE) A GSCE will be provided to support Contractor development, testing, and deployment in the Government’s operational environment, as defined in Attachment J-8, AES Technical Architecture and Attachment J-9, FAA Cloud Architecture.

C.3.1.3 Government Furnished Laptops The FAA will provide Government-issued laptops for use to support system design, development, and testing activities. The Contractor must use Government-issued laptops to access the Government-provided infrastructure. The FAA will provide Personal Identity Verification (PIV) cards that must be used to access the Government-issued laptops and networks.

The Contractor must not install any tools, products, and/or services that are not approved for use on the Government Furnished Equipment laptops without approval by the Government. If the Contractor augments the Government identified toolset with additional software and tools, the Contractor must provide justification and deliver all software development tools (SDT) used to develop/modify the software under this contract, with instructions necessary to configure, and optimize CSS-FD to ensure the maintainability of the system. All Contractor provided software, tools, and simulators must be validated, approved, and accredited by the Government prior to installation. Only fully licensed software will be considered.

C.3.2 GOVERNMENT RESPONSIBILITIES

C.3.2.1 Program Management The Government Program Office is responsible for the management of the CSS-FD program. The Government Program Office will coordinate interaction within the FAA to support the development, test and evaluation, and delivery of CSS-FD.

C - 6

C.3.2.2 Test and Verification The Government may conduct independent operational test and verification activities to confirm interoperability of the Contractor-provided application with other Government systems. The Government reserves the right to witness Contractor-conducted test and verification activities.

C.3.2.3 Security Authorization The Government is responsible for managing all activities necessary to obtain the security authorization of Contractor-provided solution as required by FAA Order 1370.121B, FAA Information Security and Privacy Program & Policy. The Government will authorize Contractor-provided solution prior to operation. The Government will conduct independent security assessments and report on the security posture through testing and evaluating compliance with security requirements and satisfying Federal Information Security Management Act (FISMA) security authorization reporting requirements.

C.4 CONTRACTOR REQUIREMENTS

C.4.1 PROGRAM MANAGEMENT

C.4.1.1 Program Management The Contractor must plan, organize, direct, and control all the activities necessary to satisfy the requirements of this contract. The Contractor must assign a Program Manager (PM) who has overall responsibility for contract performance and who serves as the Contractor’s focal point for interactions with the Government Program Office for the contract. The Contractor’s PM must possess the knowledge and skill to meet the Program Management requirements of the contract.

The Contractor must prepare, submit, and maintain a Program Management Plan (PMP) describing its approach to managing the work efforts required under the CSS-FD contract.

CDRL CSS-FD-PM01 PROGRAM MANAGEMENT PLAN (PMP)

C.4.1.1.1 Program Control and Status Reporting The Contractor must track, control, and report the performance of all activities required by this PWS. The Contractor must assess the progress of ongoing activities, identify problems encountered or foreseen, update the program schedule and risks, and provide the Government with the status of any open action items assigned to the Contractor. In addition to formal monthly reporting as described in the following subsections, the Contractor must provide the Government with timely assessments of program progress and ongoing issues.

The Contractor must respond to informal requests from Government POCs via e-mail or verbally, as applicable, regarding program status and any issues affecting the performance under this contract.

C.4.1.1.1.1 Monthly Status Reports The Contractor must continuously monitor performance under this contract to provide the Government with a timely assessment of program progress or problems, and to control all contract

C - 7 activities. The Contractor must prepare a Monthly Status Report (MSR) that provides an assessment of the program's progress, identifies problems encountered, an updated program schedule, risks, and provides the status of any open action items assigned to the Contractor.

CDRL CSS-FD-PM02 MONTHLY STATUS REPORT (MSR)

C.4.1.1.1.2 Earned Value Management The Contractor must implement and utilize a certified Earned Value Management System (EVMS) that complies with EIA-748-D, Earned Value Management Systems.

The Contractor must use its EVMS to plan, integrate, and control project scope, schedule, costs, resources, to measure performance, and to identify cost and schedule variances.

The Contractor must provide an Integrated Program Management Report (IPMR) that provides sufficient information to predict early indications of cost and schedule problems, and their relationship to any technical progress affected.

The Contractor must participate in EVM surveillance from Contract Award through delivery of a Full Operational Capability (FOC) for CSS-FD.

The Contractor must establish an EVMS no later than 90 days after contract award.

CDRL CSS-FD-PM03 INTEGRATED PROGRAM MANAGEMENT REPORT (IPMR)

C.4.1.1.1.3 Contract Work Breakdown Structure Using the FAA’s WBS as a guide, the Contractor must develop and submit a Contract Work Breakdown Structure (CWBS) and associated dictionary as part of the PMP. The Contractor must use the CWBS as the basis for contract planning, budgeting, reporting program costs, EVM reporting, and schedule status.

The Contractor must maintain the CWBS throughout the required Earned Value Management (EVM) reporting period as defined in Paragraph C.4.1.1.1.2.

C.4.1.1.1.4 Integrated Master Schedule The Contractor must develop and maintain an Integrated Master Schedule (IMS) to plan, manage, and control all program activities throughout the required EVM reporting period as defined in Paragraph C.4.1.1.1.2.

The IMS must align with the CWBS and the IPMR. The IMS must identify all Contractor and Government activities, contract deliverables identified in Attachment J-4, Contract Data Requirements Listing (CDRLs), and milestones identified in Section F.

CDRL CSS-FD-PM04 INTEGRATED MASTER SCHEDULE (IMS)

C.4.1.1.1.5 Integrated Baseline Review The Contractor must participate in a joint Government/Contractor Integrated Baseline Review (IBR) for the purpose of reviewing the Contractor's planned efforts to satisfy contractual

C - 8 requirements. The Contractor must utilize the National Defense Industrial Association (NDIA) IBR Guide to prepare for the IBR. The Contractor must coordinate the scheduling of the initial IBR with the Government so that it occurs no later than 120 calendar days after contract award.

The Government will require the Contractor to support additional IBRs to support future development, test & evaluation, and deployment work activities.

C.4.1.1.2 Meetings and Reviews As a part of its program management responsibilities, the Contractor must plan, support, and participate in CSS-FD-related meetings and reviews as described in the following subparagraphs.

C.4.1.1.2.1 Post Award Conference The Contractor must host and conduct a Post Award Conference (PAC) within thirty (30) calendar days of contract award to ensure that both the Contractor and the Government have a clear and mutual understanding of the contract requirements. Briefing materials must be provided two (2) business days prior to the PAC. At a minimum, the PAC must include a discussion of the following:

• Contractor’s organization (including subcontractors) and team member roles and responsibilities

• Program management approach

• Contract requirement clarifications

• Proposed Schedule and Key Milestones

• Deliverables and delivery schedules

• Special contract clauses

• Government Furnished Information (GFI), and services, if applicable

• Requested waivers and deviations, if any

C.4.1.1.2.2 Recurring Meetings As requested by the Government, the Contractor must participate in technical, contractual, and programmatic meetings to discuss specific topics and issues. The Government will indicate whether the meeting will be held at a Government or Contractor facility. In addition, the Government will indicate whether Contractor participation must be in-person or whether it may be virtual. The personnel representing the Contractor must have the requisite knowledge, skills, and experience to discuss the topics identified on the meeting agenda. As requested by the Government, the Contractor must coordinate the scheduling of meetings with required participants, issue calendar invitations, and prepare agendas, presentation materials, meeting minutes, and action item lists to support the conduct of the meetings.

C.4.1.1.2.3 Program Management Reviews The Contractor must conduct quarterly Program Management Reviews (PMRs) to provide status of technical activities, schedule, and cost of the CSS-FD program. PMRs will be conducted at a mutually agreed-upon location. The Contractor must provide agenda and briefing materials at least three (3) business days prior to the start of the PMR. The Contractor format may be used for the PMR briefing materials. The Contractor must provide meeting minutes five (5) business days after

C - 9 completion of the PMR. Topics to be addressed at the PMRs must include, but are not limited to the following:

• Contractor’s accomplishments since the last PMR

• Contractor’s plans for the next 90 days

• Review of actions from previous PMR

• Detailed status of software development activities

• Status of safety risk management activities

• Status of information security activities and deliverables.

• Status of test and verification activities

• Status of Deliverables

• Status of IMS activities

• EVM status

• Status of program risks and associated mitigation activities

C.4.1.2 Quality Management The Contractor must establish and maintain a Quality Control / Quality Assurance (QC/QA) program to ensure quality products and deliverables are provided under this contract. The Contractor must describe their approach to QC/QA in the PMP (CDRL CSS-FD-PM01).

The Contractor’s QC/QA program must be compliant with:

• The inspection requirements defined in Section E of this contract (Inspection and Acceptance)

• American Society for Quality (ASQ)/ ANSI/ International Organization for Standardization (ISO) 9001:2015, Quality Management Systems

• FAA-STD-013D, Quality Control Program Requirements

• FAA-STD-016A, Quality Control System Requirements

All QC/QA functions performed by the Contractor are subject to Government verification at any time. Verification may consist of, but is not limited to:

• Surveillance of all Contractor activities to determine that practices, methods and procedures of the QC/QA program are being properly applied

• Government inspection to measure quality of the services offered for acceptance

C.4.1.3 Risk Management The Contractor must support the FAA’s Risk, Issue, Opportunity (RIO) management process. The Contractor must participate in monthly joint FAA/Contractor risk meetings. The Contractor must report on any RIO items including the status of the associated mitigation plans during PMRs and include this in the MSR. The Contractor must describe their risk management approach and methodology in the PMP (CDRL CSS-FD-PM01).

C - 10

C.4.1.4 Configuration Management The Contractor must establish and maintain a Configuration Management (CM) program that details the processes that ensure that all elements of CSS-FD are identified, controlled, and maintained in accordance with FAA Order 1800.66A, Configuration Management Policy and FAA-STD-021A, Configuration Management (Contractor Requirements).

The Contractor must participate in the CSS-FD Configuration Control Board (CSS-FD CCB). The Contractor must seek Government approval prior to implementing any changes and releasing operational software updates to CSS-FD.

The Contractor must describe their approach to configuration management in the PMP (CDRL

CSS-FD-PM01).

C.4.1.4.1 Configuration Audits The Contractor must conduct Functional Configuration Audit(s) (FCA) and Physical Configuration Audit(s) (PCA) in accordance with FAA Order 1800.66A, Configuration Management Policy. The Contractor must prepare and submit a Configuration Audit Plan (CAP) which describes the Contractor’s audit approach.

During the FCA, the Contractor must verify that each Computer Software Configuration Item (CSCI) satisfies the functional and performance requirements in Attachment J-1, Functional and Performance Specification.

During the PCA, the Contractor must verify that each CSCI aligns with the software documentation identified in Section C.4.2.3.

The Contractor must document the results of the FCA/PCA in a Configuration Audit Summary Report (CASR). FCA/PCA is considered complete once all action items are dispositioned or closed and approved by the Government.

Upon successful completion of the FCA/PCA, the Contractor must establish and maintain a product baseline for CSS-FD.

CDRL CSS-FD-CM01 CONFIGURATION AUDIT PLAN (CAP)

CDRL CSS-FD-CM02 CONFIGURATION AUDIT SUMMARY REPORT (CASR)

C.4.1.4.2 Configuration Status Accounting (CSA) The Contractor must generate Configuration Status Accounting Report (CSAR) to ensure the configuration of development and implemented software systems and that delivered documentation accurately describes the configuration. The Contractor must provide traceability of any change through the change control process. The Contractor must present status at PMRs as updates occur.

CDRL CSS-FD-CM03 CONFIGURATION STATUS ACCOUNTING REPORT (CSAR)

C - 11

C.4.1.4.3 Waivers and Deviations The Contractor must submit a Request for Deviation or Waiver for Government review and approval any time the Contractor wishes to request temporary relief or permanent relief from a requirement.

C.4.1.4.4 Engineering Change Proposal (ECP) The Contractor must submit Engineering Change Proposals (ECPs) for approval prior to implementation and incorporation of a change to the baselined program requirements defined in Attachment J-1, Functional and Performance Specification.

CDRL CSS-FD-CM04 ENGINEERING CHANGE PROPOSAL (ECP)

C.4.2 SOLUTION DEVELOPMENT

C.4.2.1 Systems Engineering The Contractor must establish and maintain a system engineering program to ensure successful design, development, integration, and testing of CSS-FD to satisfy the requirements identified in Attachment J-1, Functional and Performance Specification.

The Contractor must designate a Chief Systems Engineer to serve as the primary interface for the Government Functional Leads. The Contractor’s Chief Systems Engineer must possess the knowledge and skill to meet the programmatic requirements of the contract.

The Contractor must document their approach to systems engineering in a Systems Engineering Management Plan (SEMP).

CDRL CSS-FD-SE01 SYSTEMS ENGINEERING MANAGEMENT PLAN (SEMP)

C.4.2.2 Requirements Review(s) The Contractor must conduct Requirements Review(s) to demonstrate an understanding of all requirements contained in this PWS and Attachment J-1, Functional and Performance Specification. The Contractor must conduct the Requirements Review(s) consistent with their software development approach and schedule milestones in Section F. The Requirements Review(s) must address the following at a minimum:

• The Contractor’s understanding of all requirements identified in this PWS and Attachment J-1, Functional and Performance Specification

• Any derived requirements

• Design-driving/cost-driving requirements

• Contract Deliverables

• An assessment of risk to satisfying requirements

C.4.2.3 Software Documentation The Contractor must prepare and maintain a Software Development Plan (SDP) that describes their approach to developing CSS-FD. The SDP must include the plans, processes, and procedures for requirements management, software engineering management, software design, software

C - 12 development, software test, and human factors. The Contractor must use a software design standard consistent with their software development approach, in establishing a software development process and to ensure the software lifecycle process used is compliant with ISO/IEC 90003-2014, Software Engineering. The Contractor must define its software development environment utilized to develop CSS-FD.

CDRL CSS-FD-SD01 SOFTWARE DEVELOPMENT PLAN (SDP)

C.4.2.3.1 Software Requirements Specification (SRS) The Contractor must develop a Software Requirements Specification (SRS) that identifies detailed requirements for each CSCI. The Contractor must use the SRS as the basis for design and subsequent qualification testing of a CSCI. The SRS must include specifications for all interactions between CSS-FD and its users, external systems, and data sources. The SRS must provide the detail and clarity needed to guide software design, implementation, and test (such as performance requirements, security requirements, extensibility requirements, quality standards, or design constraints). The SRS must define the rules, calculations, data manipulations, limits, exceptions, human factors, and software standards needed to fulfill the CSS-FD requirements. The SRS must include specifications for COTS and non-developmental software (NDS), if applicable, and provide traceability to software and interface requirements.

CDRL CSS-FD-SD02 SOFTWARE REQUIREMENTS SPECIFICATION (SRS)

C.4.2.3.2 Interface Requirements Specification (IRS) The Contractor must develop an Interface Requirements Specification (IRS) to include both internal and external interface system/subsystem requirements. The IRS must identify the requirements imposed on systems, subsystems, CSCIs, or other system components to achieve one or more interfaces among these entities.

CDRL CSS-FD-SD03 INTERFACE REQUIREMENTS SPECIFICATION (IRS)

C.4.2.3.3 SWIM Services Requirements Documents The Contractor must adhere to the policies, rules, and standards for identifying, designing, implementing, deploying, and managing the resources, assets, and processes that are enabled and/or supported by SWIM in accordance with FAA SWIM Governance Policies Version 3.1 and SWIM-002, Syntax and Processing of XML-Based Documents in the Context of SWIM- Enabled Services, Software Specification Version 1.0. All service identifiers defined as a part of implementing SWIM services must be in accordance with FAA-STD-075, Creating Service Identifiers.

The Contractor must develop Service Requirements Documents (SRDs), Web Service Description Documents (WSDD) and/or JAVA Messaging Service Description Documents (JMSDD).

Separate SRDs and WSDDs and/or JMSDDs must be prepared for each service.

SRDs must be prepared in accordance with FAA-STD-074, Preparation of Service Requirements Documents, utilizing How to Write a Service Requirements Document as a guide.

C - 13

WSDDs must be prepared in accordance with FAA-STD-065B, Preparation of Web Service Description Documents.

JMSDD must be prepared in accordance with FAA-STD-073A, Preparation of JAVA Message Service Description Documents.

Web services must be developed in accordance with FAA-STD-064, Web Service Registration, and FAA-STD-066, Web Service Taxonomies.

CDRL CSS-FD-SD04 SERVICE REQUIREMENTS DOCUMENT (SRD)

CDRL CSS-FD-SD05 WEB SERVICE DESCRIPTION DOCUMENTS (WSDD)

CDRL CSS-FD-SD06 JAVA MESSAGING SERVICE DESCRIPTION DOCUMENTS (JMSDD)

C.4.2.3.4 Software Design Description (SDD) The Contractor must develop a Software Design Description (SDD) to describe the software design of the CSS-FD. The SDD must capture the system and software architecture; software decomposition, component design and overview of functions and features; rationale for design decisions, assumptions, dependencies, constraints, guidelines, and goals; data design including data description and data dictionary; user interface and human factors design; and testing and software/system monitoring design elements. The SDD must also include details for the design of processing (business) rules; data governance, provenance, migration and data management;

external interface exchanges; security, reliability, maintainability availability; and other performance areas. The SDD must provide traceability between its specified components and design elements/approaches and the related system, software, interface, and data migration requirements captured in the SRS (CDRL CSS-FD-SD02), IRS (CDRL CSS-FD-SD03) and the SWIM services documents SRD (CDRL CSS-FD-SD04), WSDD (CSS-FD-SD05), JMSDD

(CDRL CSS-FD-SD06).

CDRL CSS-FD-SD07 SOFTWARE DESIGN DESCRIPTION (SDD)

C.4.2.4 Software Design Reviews (SDR) The Contractor must conduct Software Design Reviews (SDRs) to provide the Government with assurance that the Contractor’s proposed solution for CSS-FD will satisfy all applicable requirements and facilitate FAA acceptance. The Contractor must conduct the Software Design Review(s) at a cadence and frequency consistent with the software development approach, and defined in the SDP, schedule milestones in Section F. At a minimum, an SDR must address the following:

• Software design elements and how they will satisfy the requirements contained in Attachment J-1, Functional and Performance Specification.

• How the software complies with the design requirements in Section C.4.2.5.1.

• How the solution complies with the information security requirements.

• The allocation and satisfaction of functional requirements to CSCIs and/or individual software build release plans, if applicable

• Graphical user interface design considerations

C - 14

• Human Factors strategy and program planning

• Quality Assurance approach

• Test and Verification strategy and planning

• In-Service Management requirements

• Schedule and key milestones

• Compliance with and/or implementation of elements of the following Contractor

Deliverables:

o Systems Engineering Management Plan (SEMP) (CDRL CSS-FD-SE01) o Software Development Plan (SDP) (CDRL CSS-FD-SD01) o Software Requirements Specification (SRS) (CDRL CSS-FD-SD02) o Interface Requirements Specification (IRS) (CDRL CSS-FD-SD03) o Service Requirements Document (SRD) (CDRL CSS-FD-SD04) o Web Service Description Documents (WSDD) (CDRL CSS-FD-SD05) o JAVA Messaging Service Description Documents (JMSDD) (CDRL CSS-FD-

SD06)

o Software Design Description (SDD) (CDRL CSS-FD-SD07)

C.4.2.5 Software Application Development The Contractor must develop, test, and deliver CSS-FD consistent with their software development approach defined in the SDP that satisfies the requirements of Attachment J-1, Functional and Performance Specification.

The Contractor must define its software development environment utilized to develop CSS-FD.

The Contractor must utilize the Government-provided hosting environment to perform all test and evaluation activities in accordance with section C.4.2.8.

C.4.2.5.1 Software Application Design The Contractor’s software design approach and methodology must use a modular design, standards-based interfaces, and Industry recognized software development standards. The Contractor’s design must include the following characteristics:

• Open Architecture – The Contractor’s design must include capabilities for re-configurability, portability, maintainability, technology insertion, vendor independence, reusability, scalability, interoperability, upgradeability, and long-term supportability.

• Modular, Open Design – The Contractor’s design must be layered and modular and use standards-based COTS/Non-Development Item (NDI) software, operating systems, and/or middleware that all utilize either non-proprietary or non-vendor unique key Application Programming Interfaces (APIs).

• Inter-Component Dependencies – The Contractor’s design must result in a layered system design, maximizing software independence from the hardware. The design must isolate the application software layers from the infrastructure software (such as the operating system) to enhance portability. The design must be able to survive a change to the computing infrastructure with minimal or no changes required to the application logic. The interfaces

C - 15 between the layers must be built to open standards or available to the Government with at least Government Purpose Rights.

• Modular Open Systems Approach (MOSA) – The Contractor’s design must produce a solution that consists of hierarchical collections of software configuration items (components). The contractor’s design must emphasize the selection of components that are available commercially.

• Treatment of Proprietary or Vendor-Unique Elements – The Contractor must explain the use of proprietary, vendor-unique, closed components, or interfaces. If applicable, the contractor will define its process for identifying and justifying proprietary, vendor-unique or closed interfaces, code modules, hardware, firmware, or software to be used. When interfaces, hardware, firmware, or modules that are proprietary or vendor-unique are required, the contractor must demonstrate to the Government that those proprietary elements do not preclude or hinder other component or module developers from interfacing with or otherwise developing, replacing, or upgrading open parts of the system.

C.4.2.5.2 Collaborative Design Workshops (CDW) The Contractor must establish a program whose objective is to promote effective collaboration and facilitate Government acceptance. The Contractor must conduct and utilize Collaborative Design Workshops (CDWs) as a means to facilitate iterative collaboration with the Government.

The Contractor must utilize CDWs to support the development of the business rules to satisfy the requirements of Attachment J-1, Functional and Performance Specification. The Contractor must document and provide the results in a Business Rules Document.

The CDWs must also elicit and clarify requirements, user scenarios, business rules, interface needs, design preferences, at a minimum, as a means to facilitate Government acceptance. The Contractor must describe their approach to conducting CDWs in the SEMP (CDRL CSS-FD-

SE01).

CDRL CSS-FD-CD01 BUSINESS RULES DOCUMENT

Note: The Government will provide additional information on business rules as part of the final

SIR.

C.4.2.5.3 Human Factors The Contractor must implement a Human Factors program to comply with FAA HF-STD-004A, Standard Practice: Human Factors Engineering Requirements and FAA HF-STD-001B, Human Factors Design Standard (HFDS). The Contractor must prepare and submit a Human Factors Program Plan (HFPP) which describes how human factors will be addressed during the software development lifecycle.

CDRL CSS-FD-HF01 HUMAN FACTORS PROGRAM PLAN (HFPP)

C.4.2.6 Test and Evaluation

C - 16

C.4.2.6.1 Test and Evaluation Management The Contractor must plan, manage, document, and conduct a Test and Evaluation (T&E) program to verify that CSS-FD satisfies the requirements contained in Attachment J-1, Functional and Performance Specification. The Contractor must incorporate a comprehensive quality assurance program to ensure discovery and correction of problems prior to conducting formal tests.

The Contractor must conduct and support meetings, reviews and working groups with the FAA during test and evaluation planning and execution activities.

The Contractor must conduct test and evaluation activities consistent with their software development approach, and schedule milestones in Section F.

C.4.2.6.2 Test and Evaluation Planning The Contractor must prepare and submit a Contractor Master Test Plan (CMTP) that describes their approach to supporting the full scope of CSS-FD test and evaluation activities inclusive of Contractor-conducted and Government-conducted testing.

The Contractor must prepare and maintain a Master Verification Requirements Traceability Matrix (VRTM) that lists all requirements subject to verification. The Master VRTM must contain, at a minimum, all requirements identified in the CSS-FD VRTM. The Contractor must maintain the Master VRTM within a Requirements Configuration Management Tool that is accessible to the Government.

CDRL CSS-FD-TE01 CONTRACTOR MASTER TEST PLAN (CMTP)

CDRL CSS-FD-TE02 VERIFICATION REQUIREMENTS TRACEABILITY MATRIX (VRTM)

C.4.2.6.3 Test Capability Accreditation The Contractor must verify to the Government that the planned test capabilities for each Contractor-conducted test are acceptable for the intended purpose and will yield accurate test results. The Government reserves the right to witness the test capability accreditation. The Contractor must describe their approach and plan for Test Capability Accreditation in the CMTP

(CDRL CSS-FD-TE01).

C.4.2.6.4 Program Trouble Reports The Contractor must document each occurrence of failure of a test case, i.e., when it does not satisfy the associated requirement(s) addressed by the test procedure. The Contractor must propose corrective action for each Program Trouble Report (PTR) and identify the planned regression testing and any modifications to the Government-provided test environment required to demonstrate compliance with the specification. The Contractor must track all PTRs in a database that is accessible to the Government.

C.4.2.6.5 Contractor Conducted Tests The Contractor must conduct test and evaluation to validate the CSS-FD software design and associated software documentation identified in Section C.4.2.3 satisfies the requirements contained in Attachment J-1, Functional and Performance Specification and Attachment J-2, Security Controls.

C - 17

The Contractor must utilize the Government-provided infrastructure and furnish any required test tools and personnel for the successful completion of Contractor conducted tests. The Contractor must identify all GFI necessary for the successful completion of Contractor conducted tests.

Prior to performing any formal tests, the Contractor must conduct Test Readiness Review(s) (TRR) to demonstrate readiness and preparedness. The Contractor must address all items contained in Section 6.3.2 of the FAA Test and Evaluation Handbook, v5.0. The Contractor must provide TRR materials to the Government at least five (5) working days in advance of the meeting. The Contractor must receive the Government’s approval at the conclusion of the TRR before beginning formal tests.

Prior to the start of each test, the Contractor must conduct a Pre-Test briefing to ensure readiness to begin the respective test. The Pre-Test briefing must address all items contained in Section

6.3.3 of the FAA Test and Evaluation Handbook, v5.0.

Upon completion of any formal test, the Contractor must conduct a Post-test review to provide the outcome of the test activity. The Post-Test review must address all items contained in Section

6.3.5 of the FAA Test and Evaluation Handbook, v5.0.

The Contractor must conduct regression testing when results do not satisfy requirements or are otherwise unacceptable to the Government. In addition, the Contractor must perform regression testing when changes are made to previously tested items.

Regression Testing may also be required when a corrective action has been identified as a result of previous testing. If required, the Contractor must recommend to the Government the level of regression testing.

The Contractor must update the Test Report to document the outcome of any regression testing.

C.4.2.6.5.1 Development Test (DT) The Contractor must conduct Development Testing (DT) to verify the solution satisfies the requirements contained in Attachment J-1, Functional and Performance Specification. The Contractor must obtain Government approval of the CMTP (CDRL CSS-FD-TE01) prior to the submittal of Test Procedures. DT must consist of Component, Integration, and System Tests.

The Contractor must conduct DT in the Government-provided test environment. The Contractor must prepare and submit, for Government approval, Acceptance Test Procedures (ATP) that address the full scope of the required DT activities.

The Contractor must prepare and submit Test Reports to document the outcome of all Test Procedures performed during all Contractor conducted tests.

Prior to entering DT, the Contractor must satisfy all criteria identified in Section 6.2.7 of the FAA Test and Evaluation Handbook, v5.0.

C - 18

Prior to exiting DT, the Contractor must satisfy all criteria identified in Section 6.2.8 of the FAA Test and Evaluation Handbook, v5.0.

CDRL CSS-FD-TE03 ACCEPTANCE TEST PROCEDURES (ATP)

CDRL CSS-FD-TE04 TEST REPORTS

C.4.2.6.5.1.1 Component Test The Contractor must conduct Component Test to verify all Computer System Configuration Items (CSCIs), computer software components, and functional design components.

The Contractor must perform unit testing (or its equivalent) to ensure individual functions or parts of the code are working as expected in accordance with the Contractor’s chosen test methodology.

C.4.2.6.5.1.2 Integration Test The Contractor must conduct Integration Testing in the Government-provided test environment, to verify the installation, integration, and configuration of the software satisfies the requirements in Attachment J-1, Functional and Performance Specification. Integration Testing must be conducted prior to entering System Test.

C.4.2.6.5.1.3 System Test The Contractor must conduct System (end-to-end) Testing in the Government-provided test environment to verify the integrated software components under conditions that emulate the projected operational conditions, and that CSS-FD services or capabilities satisfies the requirements in Attachment J-1, Functional and Performance Specification.

The Contractor must deliver to the FAA all test documentation, test scripts, and test data used for each iteration of System Testing.

C.4.2.6.5.2 Key Site Acceptance Test The Contractor must conduct Key Site Acceptance Test to demonstrate that CSS-FD capabilities can successfully function in the Government’s operational environment. One or more Key Site(s) may be necessary to verify system performance.

The Contractor must prepare and submit, for Government approval, Acceptance Test Procedures (ATP) that address the full scope of Key Site Acceptance.

The Contractor must prepare and submit Test Reports to document the outcome of all Key Site Acceptance Test.

C.4.2.6.6 Operational Test Support The Contractor must provide support for Government conducted Operational Testing. The Contractor’s test personnel must have the requisite knowledge and experience to support the Government conducted testing.

C.4.2.7 System Safety The Contractor must establish a system safety program to comply with requirements identified in FAA Order 8040.4B, FAA Safety Risk Management Policy. The Contractor must comply with

C - 19

RTCA DO-278A, Software Integrity Assurance Considerations for Communication, Navigation, Surveillance and Air Traffic Management (CNS/ATM) Systems, per Assurance Level 2 (AL 2) Hazardous.

As requested, the Contractor must participate in and provide information to support the Government’s system safety and hazard analyses activities. The Contractor must use the output of the systems safety activities to assist in preparing software documentation, as appropriate.

As…