ASISP BAA 2016 final.pdf

Broad Agency Announcement (BAA)

DTFACT-16-R-00037

for

Aircraft Systems Information Security/Protection

(ASISP)

1. Background/Purpose

Aircraft network systems security is an increasing concern on both current and future aircraft. Recently, some of these concerns were documented by the Government Accountability Office (GAO) in report GAO-15-370, published 14 Apr 2015 entitled “FAA Needs a More Comprehensive Approach to Address Cybersecurity.”

Future generations of aircraft will be increasingly network centric to expand aircraft connectivity for improved safety, operations and maintenance. The aircraft manufacturers and modifiers are installing avionics systems to allow this increased connectivity within an aircraft as well as to networks external to the aircraft to take full advantage of new computer technologies for more efficient aircraft operations and safety enhancements.

The increased connectivity, particularly to external networks and systems without sufficient security controls could introduce information security vulnerabilities, which if exploited, might impact the safety of aircraft operations and continued airworthiness. Examples of such external networks and services include airline operation centers, airport gate links, flight information databases, and aircraft software uploads and maintenance.

Research is needed to address Aircraft Systems Information Security / Protection (ASISP) concerns which encompass aircraft certification and continued operational safety. The focus is on the aircraft itself and does not encompass the entire national airspace system (NAS), but does include aircraft connectivity to external links (also called access points or apertures). The research will explore where ASISP-related threats and risks can compromise fail-safe mechanisms in the architecture, design, and operation of aircraft systems, including ASISP-related particular risks that might lead to common cause failures.

In summary, this ASISP research effort will develop a timely process to explore security vulnerability/threat identification and risk identification/mitigation to provide the necessary information to support the FAA’s eventual development of aviation policies, regulation, and training requirements to ensure the resilience of aircraft network systems from cyber-attacks. More specifically, this Broad Agency Announcement (BAA) provides direct support to the FAA NextGen Aviation Research Division (ANG-E2) to research, develop and apply methodologies for ASISP Safety Risk Assessment (SRA) associated with avionics systems onboard aircraft operated in the US National Airspace System (NAS). This research, including the resulting methodologies and SRAs, is intended to assist decision-making by the FAA’s Aviation Safety (AVS) organization to establish appropriate safety policies and regulations.

Shown below in Figure 1, the FAA has developed an SRA framework that includes vulnerability assessment, threat analysis, asset valuation, risk identification and overall risk assessment (with probability of occurrence and severity of impact). A primary outcome of the research is a determination of the feasibility of the framework for the stated objective, demonstrated through a tested methodology that will be applied to one or more ASISP subjects. Resulting assessments, coupled with an understanding of potential mitigations for each, eventually lead to risk-management decisions that will influence FAA ASISP policies and regulations specific to the impacts of aircraft system risks to flight safety.

ASISP BAA March 2016

Figure 1: FAA ASISP Safety Risk Assessment (SRA) Framework

2. General Guidance

A starting point for assessing the vulnerabilities of a particular SRA subject (system, aggregation of operational functions, or other) should be to consider the potential access paths, also known as “apertures” for compromising the SRA subject. One of the challenges associated with ASISP vulnerability assessment is the wide scope of avionics systems found on certain aircraft operating in the NAS (the problem space). For phase 1a (discussed later) of this research, the problem space is limited to Code of Federal Regulations, Title 14, Chapter I, Subchapter C, Parts 23 & 25 (commuter and transport category airplanes). Since the FAA does not have access to data on every individual component in every aircraft, it is important that the methodology consider vulnerabilities at the system level (“black box” approach).

A full evaluation of an ASISP threat requires knowledge of a threat actor’s capabilities, and a determination of the threat actor’s motivations which determine relevant threat sources. The threat agent evaluation typically relies on intelligence gathering and is therefore uncertain and prone to rapid fluctuations. A portion of the research may explore threat actor motivation or other areas (such as threat actor capability) as considered appropriate by the researcher. This research area is a minor focus of the initial (phase 1a) effort (phases discussed in BAA Section 3, R&D Phased Efforts).

In the SRA framework, a threat is present when a motivated and capable threat actor (threat agent) has knowledge of, and the potential to exploit, a system vulnerability. A vulnerability assessment and threat assessment methodology is needed to identify, categorize and quantify threats as part of a repeatable process which includes specific methodologies and tools to conduct a System Risk assessment (SRA). The categorization and quantification should facilitate prioritization when unrelated threats are considered across multiple aircraft systems and/or apertures.

Generally, aircraft systems that are critical to the safe operation of an aircraft, such as aircraft control systems, have a higher safety impact than those assets associated with convenience or the entertainment of passengers. Avionics suites/aircraft systems should be valued according to their criticality to flight safety. A repeatable measurement type (quantitative, qualitative/adjectival) based on general criteria should be identified to assign value to assets for use in risk factor identification.

The SRA framework recognizes that not all ASISP threats are safety risks. Safety risks result from a credible threat to an asset with sufficient relevance to safe aircraft operation. Risk factor identification results from examining the assessed threats in the context of the assessed value of a particular type of asset. The research should focus on a repeatable methodology with criteria to quantify asset value and associate with the threat assessment to identify risks and the critical descriptive information associated with each risk.

The overall SRA should focus on characterizing the impact of the various risk factors identified for a system to flight safety. Risk is commonly expressed in terms of the probability of occurrence and severity of impact for each identified risk factor. The starting point for assessing and categorizing severity of impact should be based upon failure conditions identified in RTCA document DO-178C. Probability may be difficult to quantify due to its dependence on the motivation of threat agents, therefore the research also should consider alternative/supplemental approaches to the traditional risk aspect of probability, such as ease of exploitation.

The risk assessment approach should be repeatable across assessment subjects.

3. R&D Phased Efforts

The BAA research & development (R&D) will be executed in 3 phases: 1a, 1b and 2. These phases coincide with the first two phases of planned program funding. Any contracts awarded will be funded for phase 1a only, with an option for the FAA to fund follow-on phases 1b and 2. The FAA solely will determine whether to fund individual optional phases beyond 1a, based on research progress and availability of funds. The FAA is not obligated to fund any follow-on phases beyond 1a. If requested by the FAA, a technical summary will be submitted at the end of a phase, describing how the objectives of the next phase will be executed, including proposed schedule, price and overall approach. R&D conducted by the offeror is not entirely independent and requires collaboration with, and guidance from, the FAA. Follow-on phases may require incorporation of other concepts not developed under the contract and may require direct collaboration with other organizations to incorporate other concepts in ongoing research and application, as directed by the FAA. In summary, the objectives of each phase are:

Phase 1a: This phase is not to exceed 9 months from time of award. Mature the FAA SRA framework (shown earlier in Figure 1) for implementation, through development of a repeatable SRA methodology and subsequent application of that methodology to at least one SRA subject, the Aircraft Communications Addressing and Reporting System (ACARS). Other subjects, selected by the FAA, may be assessed based upon available time and resources as reflected in the offeror’s proposal.

Phase 1a products will include briefings and reports for both the methodology and ACARS SRA. The methodology should provide approaches, guidelines and quantification for performing the individual analysis tasks shown in Figure 1, including vulnerability and threat agent assessment, safety risk factor identification, and risk assessment and prioritization. The approach should consider a nominal SRA being completed within 3 months, by a small team of appropriately skilled personnel.

Collaboration and periodic reviews with the FAA are necessary.

Phase 1b: This phase is expected not to exceed 18 months. Continue refining and applying the SRA methodology, with appropriately skilled personnel, to additional SRA subjects to be determined by the FAA. Research and develop a general repeatable methodology to identify and evaluate potential risk mitigations. Phase 1b products will include briefings and SRAs (reports) for each SRA subject, and individual briefings and reports for the mitigation methodology and revised SRA methodology.

Collaboration and periodic reviews with the FAA are necessary.

Phase 2: This phase is expected not to exceed 36 months. Apply mitigation methodology to individual SRAs to identify and analytically evaluate specific mitigations. Refine mitigation methodology through multiple applications to SRAs. Recommend laboratory capability/architecture suitable to explore identified risks and potential mitigations. Conduct or support physical laboratory evaluations of both SRAs and associated mitigations as directed by FAA. Develop recommendations, based upon risk and mitigation assessments, which may be used to impact regulations and standards similar to those in Figure 2. Phase 2 products will include briefings and reports for each set of SRA mitigations, separate reports with regulatory recommendations, and a separate report of laboratory recommendations as directed. Collaboration and periodic reviews with the FAA are necessary.

Figure 2: Aircraft Rules, Processes & Standards

All R&D conducted under contract and the resulting products (which includes processes/methodologies, assessments and recommendations) are the property of the FAA for use as desired by the FAA. This property may not be used by the offeror for any purpose outside of any contract vehicle resulting from this announcement without prior approval of the FAA.

4. Technical Summary Proposal (TSP)

A. TSP Submission Deadlines

Technical Summary Proposals (TSPs) prepared in accordance with this synopsis will be accepted through June 2016 or until funding available for this effort is committed, whichever occurs first. Based upon the FAA schedule and available funding, TSPs received within 21 calendar days of BAA posting will receive priority consideration for review and funding.

B. TSP Submission Requirements

This BAA is an expression of interest only and does not commit the Government to make an award. The FAA will not pay for any information received or for costs incurred in preparing the response to this BAA Announcement. Any costs associated with the BAA Announcement submittal are solely at the interested offeror’s expense. All foreign-owned companies are subject to forging disclosure review procedures. Only a Contracting Officer (CO) can legally authorize any expenditure or commitment by the US Government. No work is to begin without written authorization from the CO.

Offerors will submit Technical Summary Proposals (TSPs) of no more than 5 pages prior to potential FAA request for submission of a more-detailed formal proposal. The TSP must meet the document requirements described below. An electronic version of the summary proposal will be emailed to technical POC john.peace@faa.gov, and to contracting officer karen.mercer@faa.gov. The electronic version must be provided in either Microsoft Word (.docx) or portable document (pdf) format.

The FAA anticipates responding, to TSPs received within 21 calendar days of BAA posting, within thirty calendar days after receipt of the TSP, in one of the following ways:

1) With a request for the submission of a formal technical proposal;

2) With a recommendation to submit a formal technical proposal if certain changes are made or conditions met;

3) With a request for clarification; or,

4) With a letter acknowledging receipt and that no further information is desired.

Before responding, the FAA may request that the offeror brief the TSP during open discussions. In that instance, the offeror would be provided with a choice of time slots from a limited range of dates. In-person discussions are welcome; however, phone conference is acceptable. Any travel would be at offeror expense.

Non-acceptance of a request for briefing and discussion may impact the FAA response.

C. TSP Document Requirements

There is no specific format for the TSP. The summary may be preceded by a cover letter, but the cover letter will not be considered in the evaluation and will not be counted in the page count. Resumes also may be included for up to 3 key personnel, no more than 3 pages per resume. Any pages additional to the requirements will not be considered for evaluation. Offerors are advised in BAA Section 6, Method of Evaluation, that the primary focus of the proposal evaluation will be on phase 1a, although the basic approach to the optional phases are of general interest. Although there is no specific format, at a minimum the TSP must contain the following items:

A description of the ability and approach to addressing all BAA objectives for phase 1a, including number of SRAs proposed to conduct in phase 1a (see 5b below)

A description of offeror core expertise and related experience to conduct the effort

A description of any existing and planned tools/techniques proposed to conduct the effort

Cost sharing by the offeror including use of existing laboratory facilities, related work or other resources leveraged by the offeror at no expenses to the FAA

Relationships with other organizations that would facilitate or enhance proposed efforts

The estimated schedule and total time to execute the proposed phase 1a effort

The total funds required to execute the proposed phase 1a effort and estimated funds required for phases 1b and 2 mailto:john.peace@faa.gov mailto:karen.mercer@faa.gov

5. Formal Proposal Requirements

If requested by the FAA and the offeror elects to submit a formal technical proposal, it must contain a more-detailed discussion of the information presented in the TSR, and meet all requirements as described below.

The technical proposal will be limited to 25 pages, not including key personnel resumes and the separate price proposal. Pricing information must not be included in the technical proposal. Two paper sets of the complete formal technical proposal will be mailed to the Contracting Officer (CO) at the address below, along with an electronic copy in portable document format sent to: karen.mercer@faa.gov.

William J. Hughes Technical Center (WJHTC) Atlantic City International Airport Atlantic City, NJ 08405 Attn: Karen Mercer; AAQ-610

a. The proposal must contain a detailed discussion of the technical approach and how a methodology will be developed to satisfy the overall BAA objectives for repeatable use in conducting safety risk assessments (SRAs) on aircraft systems/SRA subjects.

b. In addition to the ACARS SRA, the proposal must identify how many SRAs (if any) can be conducted in phase 1a, based upon the constraints in the BAA phase 1a description and on the offeror’s proposed phase 1a price.

c. The proposal must contain the education level; experience, both general and project related; and the availability of sufficient key project professional and technical personnel, as evidenced by resumes provided.

d. The proposal must contain any applicable cost sharing or special partnerships with operators, manufacturers or other government agencies that would provide value to the proposal.

e. The proposal must provide a realistic and organized plan for accomplishing the effort of the proposal within the BAA constraints for phase 1a, as evidenced by project separation into a viable schedule including discretionary project tasks and milestones. Potential impact of implementation risks on scheduled tasks and milestones must be identified, along with risk mitigation plans. Proposals that do not identify risk areas will be considered non-developmental in nature and therefore outside the scope of this research program.

f. The proposal must indicate the location and availability of, or the ability to obtain, the necessary equipment and facilities to perform this effort. This includes collaborative meeting space and laboratory space & equipment as may be needed to physically conduct assessments.

g. The offeror must provide a separate detailed price proposal. Applicable in-house funding, cost matching, and services-in-kind, will be identified in the price proposal.

6. Method of Evaluation

Multiple contracts are anticipated to be awarded; however, the FAA reserves the right to award contracts for all, any part, or none of the responses received from this BAA. The BAA is structured in 3 phases, with phases 1b and 2 being optional and only executed at the sole discretion of the FAA based on R&D results and available funding. For this reason, the primary focus of the proposal evaluation will be on phase 1a, although the basic approach to address the optional phases are of general interest.

Proposals, with emphasis on implementation of phase 1a, will be evaluated in the following areas listed in order of descending importance:

A. Technical Merit

The proposal discussion of technical approach will be evaluated for the offeror's knowledge and understanding of the SRA framework and BAA objectives, applicable parts of the CFR, aircraft systems, associated NAS communications architecture, information security & protection, aircraft safety and safety regulations. This includes the offeror’s knowledge of aircraft/system apertures and understanding of potential SRA “subjects”.

This element will be evaluated on the following points, listed in descending order of importance:

1. Offeror demonstrates a clear approach and ability to implement the objectives for phase 1a, including identification of ability to conduct one or more phase 1a SRAs.

2. Offeror demonstrates experience and understanding of aircraft systems and information security and protection, including the relationship between aircraft systems.

3. Offeror demonstrates an understanding of the FAA’s SRA framework and overall BAA objectives, as well as the concepts of apertures and SRA subjects.

4. Offeror demonstrates an understanding aircraft safety and the FAA safety regulatory process, both generally and also as specifically related to aircraft design, manufacturing and airworthiness.

B. Investigative Team Competency and Experience

The proposed investigative team and key personnel will be evaluated based on education level; experience, both general and project related; the availability of sufficient key project professional and technical personnel;

as evidenced by resumes provided; and overall proposed skill mix to address BAA objectives.

C. Effective & Realistic Project Management Plan

The project management plan will be evaluated based on the level of detail and clarity provided to accomplish both proposed tasks and all BAA objectives strictly for phase 1a. Supporting rationale will be considered for support of all key aspects of the plan, especially for planning or scheduling items that are not immediately intuitive, as evidenced by project separation into a viable schedule including discretionary project tasks and milestones. Risk identification and potential mitigations will be considered as support to the realism of the proposed schedule. No consideration will be given to scheduling of optional phases 1b and 2.

D. Availability and Quality of Equipment and Facilities

Ready availability and sufficiency of facilities, quality and capability of equipment and tools, and proposed use of these will be evaluated. Consideration will include how these will impact execution of tasks for all 3 BAA phases, including collaborative efforts with other organizations as well as the FAA.

E. Value to FAA and Cost Sharing

All cost sharing information, including use of existing facilities and equipment, leverage of prior related research, and use of labor and tools, will be considered for its overall value to the FAA in meeting the R&D objectives. Proposals that do not contain cost sharing or advantageous partnerships still will be considered on total value to FAA.

F. Price Realism

Price realism will be evaluated as acceptable or unacceptable only. Preference will be given to fixed price contracts. Acceptable proposals will have price commensurate with the work load proposed for phase 1a.

As with the TSP, the FAA may request open discussion with the offeror to receive a briefing of the formal proposal and to address FAA and offeror questions. If invited, the offeror would be provided with a choice of time slots from a limited range of dates. In-person discussions are welcome; however, phone conference is acceptable. Any travel would be at offeror expense.

7. Period of Performance

Efforts lasting up to 9 months will be considered for phase 1a. Continued efforts for phases 1b and 2 are optional, at the discretion of the FAA. Each phase will be evaluated by the FAA for measurable and adequate R&D results, prior to exercising an option for a subsequent phase. If the FAA elects to proceed to a subsequent phase, the offeror will be required first to submit a formal detailed proposal at no cost to the FAA, within 15 calendar days of request. The proposal will contain relevant information as described earlier in this BAA, including price and schedule. The period of performance for each optional phase will be determined upon review of the offeror proposal and prior research results, consistent with BAA Section 3 constraints. The total period of performance for all 3 phases will not exceed 5 years.

8. Funding

Phase 1a will be funded in full at contract award. Available funding for all contracts in phase 1a is less than $900K, with multiple awards anticipated. Optional phases 1b and 2 will be funded incrementally at the sole discretion of the FAA, subject to R&D results and availability of funds.