RFP_Attachment_1_V2_8_6_2_IRIS__PWS_20161130_(002).doc

Page | 25

TABLE OF CONTENTS

Section 1 – Introduction

Section 2 – General Requirements

Section 3 – Contract Management Requirements

Section 4 – Analysis and Support Requirements

Section 5 – Additional Information and Requirements

Section 6 – Deliverables

Section 7 – Services summary

Section 8 – Contractor Full-Time Equivalent Reporting

Appendices

1.0

INTRODUCTION

1.1 Mission. The Air Force Safety Center (AFSEC) develops policy for, implements, executes, and evaluates Air Force (AF) aviation, ground, weapons, space, and nuclear surety mishap prevention programs. This includes mishap investigation, mishap prevention, risk management, and oversight of the AF Safety Management Systems. AFSEC provides safety and risk management education and media programs for all safety disciplines, oversees major command (MAJCOM) safety and mishap prevention programs, and maintains the AF database for mishaps and hazards.

1.2 Objective. The Proactive Aviation Safety team at AFSEC uses the Integrated Risk Information System (IRIS) to conduct analysis of flight data in support of the Military Flight Operations Quality Assurance (MFOQA) and the Airman Safety Action Program (ASAP) programs, in an effort to develop and integrate mishap precursor detection and mitigation tools into AF and Department of Defense (DoD) aviation operations. MFOQA uses the data files from the routine collection and download of flight data recorders, processing the data files through specialized computer software to uncover hazards, errors, and mishap precursors, (e.g., trends and deviations from standard procedures and parameters). Analysis of recorded data identifies and quantifies both normal and hazardous flight environments, informs the development of mitigation measures, and where applicable enables monitoring of control measure effectiveness. MFOQA analysis results may be collated with mishap reports, incident reports, and ASAP submissions to further refine analysis algorithms or to explore additional areas of concern. ASAP report submission capability is currently enabled in IRIS, and though AFSEC may integrate the report submission process into the Air Force Safety Automated System (AFSAS), the requirement to conduct ASAP analysis remains. The analysis products provide long-range safety benefits and support the risk management efforts of the operations, training, maintenance, safety, Research & Development, and design functions.

1.3 Guidance. DoD policy memo and AF safety program guidance necessitate the sustainment of current MFOQA and ASAP analysis capabilities, and the deployment of MFOQA analysis capability in additional aircraft fleets (Attachment 5). Each additional aircraft fleet may require tailoring of the analysis capability in order to meet individual aircraft configuration and missions.

1.4 Scope: Support development, implementation, operational deployment, assessment, sustainment, and evolution of AF and Joint Service proactive aviation safety through the use of MFOQA and ASAP analysis processes. Over the life of the contract expand MFOQA capabilities to include additional fleets. Provide MFOQA analysis services to Sister Services and Foreign Military Sales (FMS) partners when requested through a contracting action. Provide contract management, support and travel. Contract activities include: sustain and maintain MFOQA analysis software; conduct MFOQA and ASAP analyses; share operational findings, benefits, and advances; integrate MFOQA and ASAP analyses with other hazard identification programs and processes, such as Air Force Combined Risk Management System (AFCMRS) and mishap investigations; collaborate with members of sister services, Governmental agencies, and foreign partners on goals and capabilities for joint MFOQA efforts; technology assessments; and publish and disseminate educational materials, training materials, and lessons learned.

2.0 GENERAL Requirements

2.1 Analysis Application: Maintain and sustain a data processing and analysis capability (known as IRIS) for the acquisition, aggregation, analysis, and, visualization of data to meet current and emerging USAF proactive aviation safety requirements, including but not limited to: flight data analysis and animation programs; analysis results data repository; file naming and definition standards; integration of data from various USAF Mission Design Series (MDS) aircraft and systems; transformation of data collected using military data collection devices, data buses (e.g.MIL-STD-1553), and non-standard proprietary formats into engineering units; methods required to support military-specific flight phases, maneuvers, and measurements; mathematical models and language constructs to characterize textual, numerical, spatial, and temporal data to facilitate aggregation and correlation of data gathered through various USAF and DoD MDS and systems programs; techniques to support spatial analysis, data mining, text mining, multivariate statistical analysis, and advanced visualization; and methods for supporting maintenance and engineering requirements.

2.2 Web-based Capability. IRIS is a web-based service and shall remain a web-based service.

2.2.1. IRIS is currently hosted on Amazon Web Services (AWS) East-West; its initial Authority to Operate (ATO) expired in Apr 2015. Recertification documentation has been submitted to the appropriate Government review process. If necessary, during the transition period following contract award the contractor will coordinate with the incumbent and AWS to transfer the existing web hosting agreement from the incumbent to the contractor.

2.2.2. In parallel, IRIS is in the process of transitioning to AWS GovCloud as part of an AFSEC effort that will host multiple AF safety information technology (IT) systems under one over-arching ATO. The Government estimates the documentation needed to complete the transition will be in place by contract award; however, the contractor is required to complete any outstanding tasks that exist at contract award in support of the transition to GovCloud.

2.2.3. The over-arching ATO will be managed by AFSEC IT personnel; the contractor is required to provide support and documentation as described in paragraph 4.2. as required to complete acquisition of and the sustainment of the overarching AFSEC ATO, as specifically related to an IRIS Virtual Private Cloud (VPC) within the AFSEC Information Level 4 Enclave.

2.3 Software. IRIS is currently enabled by a Government Off-the-Shelf (GOTS) open-source software called “Integrated Risk Management System” (IRMS) (paragraph 5.1.2 and Attachment 4). At contract start the contractor shall provide analysis and reporting capabilities using the IRMS software available in IRIS. Over the course of the contract, the contractor shall propose utilizing the existing IRMS software, other GOTS, other Commercial-Off-the-Shelf (COTS), other software, or a combination of software tools in order to meet the terms of the contract. The contractor will support and sustain the IRMS analysis capability for the time the contractor needs to complete a transition to the offered analysis capability.

2.4 Software Transition. If the contractor chooses to transition from IRMS to another software product, the contractor must develop a transition plan demonstrating how the contractor will sustain IRMS while establishing a new web-based service, prepare necessary documents to modify the IRIS ATO to include the new capability; and establish processes to transfer aircraft flight data files to the new analysis capability. Prior to implementation, the transition plan requires Government review and approval through the contracting officer and Contracting Officer’s Representative (COR).

2.5 Personnel. The contractor shall accomplish the assigned work by employing and utilizing qualified personnel with appropriate combinations of education, training, and experience. All personnel whose duties require administrative privileges to the IRIS system must meet AFMAN 33‑285, Attachment 2, AF Cybersecurity Position Certification Determination Guide, certification commensurate with the level associated with their duties. The following are general skill sets the Government anticipates will be required.

2.5.1 Software Developers: The software development team shall be comprised of personnel with both academic and industry experience in programming languages and processes related to the development and maintenance of software for operational flight data analysis. Team members shall be able to apply creative thinking and advanced problem solving methodologies to web development, analysis algorithms, and database management, keeping in mind DoD and AF cybersecurity requirements. Routine tasks may include designing, programming, configuring, installing, testing, evaluating, customizing, integrating, and maintaining systems, to include customizing database and software features such as graphic user interfaces specific to different aircraft fleet requirements. Developers shall be knowledgeable of and experienced in database management to include data storage, data security, data migration, and Government database certification and accreditation processes. Developers will identify and recommend specific necessary technical support and product upgrades to support the MFOQA software, to include the testing, acquisition, and debugging of software upgrades and new releases. Similarly, the software development team shall be capable of performing feasibility and cost-benefit analysis of possible software and database changes, including the survey of application architectures and frameworks, leading to the estimation of budget and schedule implications for such new capabilities. Developers shall also write documentation stemming from the design and development of web based analysis software for both qualitative and quantitative flight data analysis, including requirements and specification documents. Developers shall have current cybersecurity certification as required by DoD 8570.01M and AFMAN 33-285. Cybersecurity functions are embedded in the software developer duties.

2.5.2 Information and Cyber Security Director: The information and cyber security director shall have an understanding of and experience with DoD and AF cybersecurity policy, and successful experience leading and implementing the Risk Management Framework (RMF) processes outlined in DoDI 8510.01. The director will be required to utilize the assessment and authorization compliance reporting IT systems of record [currently Enterprise Information Technology Database Repository (EITDR) and Enterprise Mission Assurance Support Service (eMASS)], used for maintaining IRIS DoD ATO. The director shall be familiar with DoD cybersecurity requirements and annual assessment procedures and processes. The information and cyber security director coordinates with the program manager, software development team, the COR, and AFSEC cybersecurity manager on overall policies, goals, and procedures for the cybersecurity function of IRIS. Tasks include: develop and implement a robust cybersecurity program; ensure all activities required to sustain and renew the IRIS ATO are completed; generate assessment and authorization supporting documentation; facilitate the IRIS Configuration Control Board; monitor systems for security gaps, run risk assessments as part of on-going continuous monitoring and implement an effective policy and process for continuity of operations and incident response; develop and provide reports to the program manager for communication to all senior stakeholders; and promote cybersecurity awareness within the IRIS team. Information and cybersecurity personnel shall have current cybersecurity certification as required by DoD 8570.01M and AFMAN 33-285. Cybersecurity functions are the primary duty of this position.

2.5.3 Flight Data Analysts (FDA): MFOQA flight data analysts should have experience as military aviation instructors in the mission type, and preferably in the specific aircraft, to which they are assigned (Attachment 5). Analysts manage processing and trending of flight data from aircraft participating in the Air Force MFOQA and ASAP programs. Tasks include the use of software to analyze flight data in relation to triggered events and routine operating measures, the completion of special studies resulting from analyst detection of hazardous conditions and acts, as well as ad hoc requests from the MAJCOM or operational units. FDAs will assist in the development of, and be responsible for, the verification and validation of aircraft specific event definitions. Other duties include the preparation of flight operations trending analysis, and charts, reports, and statistical data required to keep the AF aviation community informed of the status and programs related to proactive aviation safety information. Analysts shall integrate flight hazard information from multiple sources, including IRIS, ASAP, AFSAS, mishap reports, operational trends, and Government and industry aviation hazard and safety reports. The quantity of data available for analysis for a specific fleet or group of aircraft may not require a full-time position.

2.5.3 MAJCOM Program Management: MAJCOM program managers (PM) shall have experience in aviation operations, preferably in military aviation operations, and shall have an understanding of aviation safety programs and objectives as well as Safety Management Systems (SMS). MAJCOM program managers are responsible for overseeing the execution of MFOQA and ASAP activities at Air Mobility Command (AMC), Air Education and Training Command (AETC), Air Combat Command (ACC) headquarters, Air Force Special Operations Command (AFSOC), and Air Force Global Strike Command (AFGSC). Current activities accomplished by these personnel shall be sustained. Specific managerial responsibilities include the daily administration, security, and operation of IRIS; assisting the MAJCOM in the identification, employment, and sustainment of data collection and retrieval processes that support MFOQA analysis; facilitating processing, analysis and trending of ASAP reports; the security and protection of aircraft data and resulting MFOQA analyses; and supporting the development of corrective actions. PMs shall strive to maximize the efficient use of proactive aviation safety data and shall participate in meetings and supporting events for MFOQA, ASAP, and other proactive safety efforts. Managers collaborate with operations and safety personnel to support MAJCOM integration of proactive safety capabilities in the SMS process. The PM will ensure that all analysis reports generated under the MFOQA program meet MAJCOM needs regarding the measurement and management of operational and safety hazards and trends, and are factually correct and statistically sound. The PM shall support trending of hazards identified through ASAP reports as coordinated with the MAJCOM. PMs will represent the Air Force MFOQA and ASAP initiatives in the industry and at DoD events. While physically embedded at MAJCOM locations, IRIS PMs are responsible for coordinating MFOQA efforts and activities with AFSEC.

3.0

CONTRACT MANAGEMENT REQUIREMENTS

3.1 Communication. The contractor shall establish clear organizational lines of authority and responsibility to ensure effective management of the resources assigned to the requirement. Regular communication between the contractor and the proactive safety team at AFSEC is required for optimal program development. The contractor shall provide, and update when necessary, a roster of personnel (CDRL A001).

3.2 Meeting Minutes. The contractor shall deliver meeting minutes after each Quarterly Program Management Review, and for other official meetings when requested by the COR. (CDRL A002)

3.3 Quarterly Program Management Review. The contractor shall conduct quarterly Program Management Reviews (PMR). A review of the completed quarter’s activity, analysis capabilities for future platforms, analysis software user enhancements, analysis algorithm improvements, IRIS Assessment and Authorization (A&A) activities, and proposed activity for the next quarter shall be briefed to the Government for review and approval during the PMR.

3.4 Quarterly Phase Plan / Configuration Control Board. Within 15 workdays following each PMR, the contractor shall brief to the Government a Quarterly Phase Plan describing major IRIS activity for the next quarter, including the impact of software modifications on the Assessment and Authorization requirements of IRIS and its subcomponents, and document the briefing in the Quarterly Phase Plan report. This report meets A&A requirements for IT configuration management control and change approval. (CDRL A003)

3.5 Monthly Status Report. The contractor shall provide monthly contract status reports, including: 1) work accomplished during the reporting period; 2) a description of how ongoing activity supports task requirements and overall contract objectives; 3) risks and concerns associated with current and future contract activities, and 4) status of the overall task. Describe schedule deviations, including the impact to deliverables and overall program objectives. The status report shall also identify funds and hours expended and remaining both numerically and graphically throughout the life of the contract. The status reports may be associated with the contractor’s invoice cycle. (CDRL A004)

3.6 Subcontract Management. The contractor shall be responsible for any subcontract management necessary to integrate work performed on this requirement and shall be responsible and accountable for subcontractor performance. The prime contractor will manage work distribution to ensure there are no Organizational Conflict of Interest (OCI) considerations. Contractors may add subcontractors to their team after notifying the Contracting Officer or Contracting Officer Representative (COR) and completing any necessary contractual modifications. Cross teaming is permitted.

3.7 Travel. Contractor personnel shall be prepared to travel in support of MFOQA program development and implementation. Travel requirements include: PMRs; aircraft program office technical meetings (such as Aircraft Information Working Groups or Technical Interface Meetings); to support MAJCOM proactive safety briefings and activities; and industry and DoD advocacy and education meetings and conferences. All travel must be approved by the COR or alternate COR prior to being undertaken.

3.7.1 The Government must approve all travel in advance of the activity. The Government will notify the contractor of the travel requirement at least three (3) days in advance of the travel date. Travel and per diem shall be in accordance with Chapter 4 of the Joint Travel Regulation for the locations visited (http://www.defensetravel.dod.mil/Docs/perdiem/JTR.pdf). U.S. Per Diem rates for the continental U. S. are located at the following website: http://www.defensetravel.dod.mil/site/perdiemCalc.cfm. Travel will be performed as necessary on a cost-reimbursable (no fee) basis. Costs for travel, subsistence, and lodging shall be reimbursed to the contractor only to the extent that it is necessary and authorized for performance of the services under this contract.

3.7.2 In the performance of necessary travel, the contractor shall use the lowest cost mode commensurate with the requirements of the mission. When it is necessary to use air or rail travel, the contractor shall use coach, tourist class, economy class, or similar accommodations to the extent consistent with the successful and economical accomplishment of the mission for which the travel is being performed. Travel will be reimbursed on a cost reimbursable basis and is not subject to profit or fee.

3.7.3 Travel within any contractor’s local area between the contractor’s residence, contractor facilities, and Government facilities will not be reimbursed.

3.7.4 Within 5 workdays following the travel, provide a travel report describing the purpose of the trip; attendees; agenda; briefings and discussion topics; action items; and recommendations and conclusions. (CDRL A005)

3.8 Work Location. Work may be performed at both contractor-identified and Government facilities. For those tasks performed at a Government facility, the Government will provide work space and equipment to perform the tasks associated with this contract. Telework is permitted for this contract with prior coordination between the COR and contractor management. Contractor personnel who telework shall follow their corporate guidance with regard to telework capabilities and frequency.

3.8.1 Contractors providing support in a Government facility will follow the work days and hours established by the host organization, typically 0700-1600 Monday through Friday. The Government reserves the right to increase the weekly hours worked for limited periods to support surge operations.

3.8.2 Contractor personnel shall not have access to Government facilities unless Government personnel are present. Government agencies/facilities may not be available during scheduled holidays, inclement weather, weekends, after duty hours, or AF down days. Contractor personnel hosted by a Government facility may telework on Government holidays not recognized by the contractor, or when the hosting organization is closed (i.e. base closure due to weather, down day, etc.). U.S. Government scheduled holidays are: New Year’s Day; Dr. Martin Luther King, Jr. Birthday; President’s Day; Memorial Day; Independence Day; Labor Day; Columbus Day; Veterans Day; Thanksgiving Day; and Christmas Day.

3.8.3 All contractor/subcontractor personnel working at a Government facility shall wear company picture identification badges so as to distinguish themselves from Government employees. When conversing with Government personnel during business meetings, over the telephone or via electronic mail, contractor/subcontractor personnel shall identify themselves as such to avoid situations arising where sensitive topics might be better discussed solely between Government employees. Contractors/subcontractors shall identify themselves on any attendance sheet or any coordination documents they may review. Electronic mail signature blocks shall identify their company affiliation. Contractor/subcontractor personnel who occupy shared space with their Government program customer shall, where practicable, identify their work space area with their name and company affiliation.

3.9 Air Force Training. Contractor employees whose duties require accessing the IRIS web capability shall complete, at a minimum, the courses listed below, either through the Advanced Distributed Learning Service (ADLS) computer based training (for those working in a Government facility) or via briefing materials provided by the COR. Contractors/subcontractors working in Government facilities shall complete additional training requirements specific to the MAJCOM or work environment (e.g. fire extinguisher training). The contractor will track training completion and maintain an electronic file of course completion certificates; course completion documentation will be provided to the COR upon request. Failure to complete training may result in the contractor being denied base and computer access. Contract employees with cybersecurity responsibilities shall have baseline certification commiserate with their assigned duties, in accordance with DoD 8570.01-M.

· DOD IAA CyberAwareness Challenge (ZZ133098) - Due Annually

· Safety Privilege (AFSEC training) – Due Annually

4.0

ANALYSIS AND SUPPORT REQUIREMENTS

4.1 IRIS Analysis Tasks. The overall focus of this requirements area involves analyses of flight operations, including processing flight data files through the web-based analysis server, analysis, integration of hazard and error information from other sources, results distribution, and risk assessment and mitigation.

4.1.1 Analytical Services: Conduct monthly analyses and document findings specifically targeted to aviation operational hazards. Communicate regularly with AFSEC, the MAJCOM safety, operations, and maintenance staffs, and FMS partners in order to keep abreast of current areas of interest; and modify the analysis focus and capabilities as necessary to address these areas of interest. Ensure analysis products direct user attention to important areas in the analysis report with intuitively understandable, recallable, and actionable hazard mitigation information, such as: annotating the purpose and context associated with a specific chart; identifying the specific hazard(s) associated with an analysis graphic; providing specific guidance to various users, such as commanders, trainers, and safety personnel; including operating limits as a reference when appropriate; using a scheme that indicates hazard severity; and/or using illustrations that trigger a memory that elicits a specific reaction to the hazard. (CDRL A006)

4.1.1.1. Use the MFOQA flight data analysis software to identify operational hazard indicators, conduct analysis, and trend results to detect and quantify risks to aviation safety, using routine operational measurements (ROMs), triggered events (TE), standard operating procedures (SoPs), and other data points associated with each flight, and assemble these individual measurements for aggregate analyses. Track, trend, and analyze the analysis results.

4.1.1.2 In conjunction with MAJCOM staffs, use the ASAP self-reporting capability to identify operational hazard indicators, conduct analysis, and trend results to detect and quantify risks to aviation safety.

4.1.1.3 Derive hazard and risk information by integrating MFOQA analysis results with current MAJCOM, AF, DoD, FMS, and industry aviation hazard information sources, (i.e. AFSAS, ASAP reporting, Line Operations Safety Audit (LOSA) findings and recommendations, publications, information meetings, the MFOQA analysis tool sets, etc.), and communicate the results in a timely and effective method to functional leadership within the MAJCOM, AF, DoD, and FMS partners. Disseminate lessons learned throughout the analyst cadre, and make analysis results available through the IRIS web service, AFSAS publication POCs, and MAJCOM-specific information websites.

4.1.1.4 Sustain MFOQA analyses for the aircraft and timelines identified in Attachment 5. MFOQA analysis processes include: the ability to receive flight data files in various formats; determine data suitability for useful analysis output; process, validate, track, trend, animate and aggregate flight data files and analysis results; and adapt the analysis process as needed following flight data recording capability modifications. MFOQA software shall allow analysts to derive information using an analysis tool set, including a query process, and to communicate their findings to MAJCOM, AFSEC, AF, and FMS partner staffs and leadership. The software shall have the ability to assign hazard severity, facilitate the identification of causal factors and the generation of recommendations, and support the report resolution process. MFOQA analysts shall routinely analyze operational data to detect deviations from standard procedures and parameters, trend this information, disseminate analysis results, animate the flight data, review and evolve MFOQA system techniques and visualizations, and provide feedback to the AFSEC, the MAJCOMs, and FMS partners, on current areas of interest. The analysis results shall be provided in the form of graphs, spreadsheets, and/or written reports, as coordinated with AFSEC and the unit, Lead MAJCOM, or FMS customer (as applicable) for each MDS.

4.1.1.5 Develop and sustain MFOQA analysis capability for additional aircraft as identified in Attachment 5. The schedule of aircraft availability is dependent upon AF acquisition processes (i.e. data collection modifications), thus the estimated date of analysis initiation, number of aircraft, or identified aircraft may change based on the needs and acquisition schedule of the AF. The Attachment 5 table identifies current and potential future aircraft Mission Design Series (MDS) fleets and the estimated number of aircraft in each fleet that will be analyzed in the Jun 2017 through May 2022 timeframe. The potential exists for the total number of aircraft to vary, based on current and potential AF agreements to provide analysis for the US Navy, Marines, Army, and Coast Guard, or for foreign military partners. An increase in aircraft numbers or additional fleets will be accomplished through task orders.

4.1.1.6 Maintain and sustain ASAP reporting and trending processes in the IRMS software, until such time as the AF transitions the reporting capability to AFSAS. This includes the ability to collect textual reports, and to process, track, trend and aggregate the information contained therein. ASAP software shall allow analysts to derive information using an analysis tool set, and to communicate their findings to MAJCOM, AFSEC, and AF staffs and leadership. The software shall include a data query process, the generation of analysis results, and an ASAP report scoreboard. The software shall also assign hazard severity, facilitate the identification of causal factors and the generation of recommendations, and support the report resolution process by providing an ability to assign resolution activities. Ongoing ASAP sustainment and maintenance shall include the evolution and enhancement of reporting, presentation, and resolution capabilities.

4.1.2 MAJCOM and FMS Partner Support: The contractor shall provide the Lead MAJCOMs ACC, AMC, AETC, AFSOC, AFGSC, and FMS partner safety, operations, training, and maintenance customers flight data analytical support for risk assessment and management. Interface regularly with AFSEC, the MAJCOM staff and FMS partner representatives to: identify significant areas of interest; present emerging trends, hazards, and risks; and convey results of subsequent analyses. Integrate MAJCOM interest areas with industry standards, MFOQA trends, and ASAP identified hazards in identifying trends towards major hazards and threats. The contractor will solicit AFSEC, MAJCOM and FMS partner desires for analysis capability and process improvement for inclusion in IRIS maintenance and sustainment activities (see paragraph 4.2.10).

4.1.2.1 FMS Partners: The Government currently provides C-17 MFOQA analysis products to the United Kingdom, Australia, and the North Atlantic Treaty Organization Airlift Management Program.

4.1.3 Flight Data File Distribution: Understand the Recorded Aircraft Information requirements in paragraph 5.4.1.1. in AFI 63-101, Integrated Life Cycle Management, and educate the MAJCOM operations, requirements, and safety staff on how these requirements are essential to providing flight data to the MFOQA process. Work with the MAJCOMs, AFSEC, and other USAF contractors to determine the best method of conveying flight data files from the aircraft to the analysis web service. Participate (electronically or in person) in aircraft information working groups.

4.1.4 Data Dissemination: Work with AFSEC, the MAJCOMs, and FMS partners to establish a schedule for providing fleet-level proactive aviation safety analysis reports covering recent data analysis results and recommendations (at least one report per quarter, but no more than one report per month, for each MDS). Analysis reports should be in presentation-ready format and appropriate for immediate messaging to field users and senior leaders. The reports shall provide information on current areas of interest as expressed by AFSEC, the MAJCOMs, and FMS partners to include emergent safety, operations, training, and maintenance trends. Respond to requests for unit level analyses as resources permit.

4.1.5 Presentations: Present proactive aviation safety analysis results and programmatic activity to MAJCOMs, AF, DoD, and industry. Primarily, these presentations shall cover software analysis products, in-depth analysis of high-interest events and trends, and proposals for mitigating negative trends; when requested, activity associated with IRIS program growth and implementation shall be presented. The contractor shall also be prepared to discuss methods to track any recommended training or operations changes. (CDRL A007)

4.1.6 Each calendar year write at least four MFOQA-derived case studies, detailing a hazard identified through MFOQA and / or ASAP, the associated flight data analysis, and the MAJCOM hazard analysis, mitigation decision, and validation of the solution. Write eight papers or articles per year (approximately 3000-6000 words), for MAJCOM and / or AFSEC safety publications. Topics include, but are not limited to: 1) description of MFOQA and / or ASAP analysis successes for a single MDS or group of MDSs; 2) the integration of MFOQA and / or ASAP analysis in an organization’s SMS process; and 3) the use of MFOQA analysis to quantify a hazard identified through ASAP reporting or vice versa. (CDRL A008)

4.1.7 Attend and participate in approximately 15 meetings per year. Meetings may include, but are not limited to: IRIS contract quarterly program management reviews (4 per year, key personnel); FAA InfoShare (1 per year); Aircraft Information Working Group or Technical Interchange Meetings (4 per year, as called by MDS Program Manager); Government or industry led meetings or conferences in support of IRIS cybersecurity support and certification (2 per year, A&A personnel); unit or organizational meetings in support of AF, DoD, or industry data-driven proactive safety efforts (3 per year, analyst or MAJCOM program manager). Provide minutes or a trip report as appropriate (CDRL A002 or A005)

4.2 IRIS Support Tasks: Existing open source legacy IRMS software, GOTS or COTS products, and/or a combination thereof shall be considered in fulfilling the following requirements.

4.2.1 Integrated Risk Information System (IRIS): Provide a web based integrated information system, utilizing Government-provided IRMS software (paragraph 4.2), other GOTS or COTS software, or a combination. If the proposed solution is to utilize an analysis capability other than IRMS, the Government requires the contractor to support and sustain the IRMS analysis capability for the time the contractor needs to complete a transition to the proposed analysis capability. The minimum IRIS functionality shall include MFOQA components with the ability to integrate added interfaces or components. Current data transfer interface capability, such as with the Aircraft Structural Integrity Management Information System (ASIMIS), G081/Mobility Air Force Logistics Command & Control (G081/MAF Log C2), and AMC’s Data and Web Services (DAWS) shall be maintained. The proposed software solution must meet AF and DoD cybersecurity requirements as needed to acquire and sustain an ATO prior to fielding.

4.2.2 Legacy System Integration and Migration: Analyze the configuration, functionality, technical architecture, operating system, infrastructure, files, and databases associated with existing legacy systems, and develop plans to incorporate legacy systems to the delivered IRIS. Added interfaces or components may include but are not limited to the AFSAS, Mishap Analysis & Animation Facility (MAAF) at the AF Safety Center, AFCMRS, and Organizational Safety Assessments (OSA).

4.2.3 IRIS MFOQA Employment: Maintain existing MFOQA analysis capabilities, and deploy MFOQA analysis capabilities on additional MDS as described in Attachment 5. The MFOQA software shall have the ability to process flight data files from multiple recorder types, as identified in Attachment 5, enable identification of unique standard operations and procedures for each MDS, deviations from standard procedures and parameter exceedances, enable statistical analysis of various flight regimes, trend this information, and animate the flight data. This capability shall be adaptable for application against individual flight data files, aggregate MDS data files, and meta-analysis across multiple MDSs. The contractor shall have the technical knowledge necessary to monitor and provide technical assistance for the proposed software programs and database(s).

4.2.4 IRIS ASAP Employment: Maintain existing ASAP reporting capabilities as employed in the IRMS software, until such time as the AF transitions the reporting capability to AFSAS. The capability shall be flexible and expandable as ASAP participation increases across airframes and mission types. The report forms and taxonomies shall be tailorable to enable collection of information unique to the mission area. The ASAP software shall provide flexibility in the presentation of analysis products, enable statistical analysis of events and hazards, and trend this information.

4.2.5 Software Assessment and Authorization: Conduct assessment and authorization activities supporting the cybersecurity requirements of the Risk Management Framework (RMF), in accordance with USAF and DoD requirements (current and future revisions), as needed to support a single ATO for all AFSEC IL4 systems. Tasks and activities will be coordinated through the COR and the AFSEC ATO team, and include but are not limited to: generation of assessment and authorization supporting documentation; the identification and documentation of IRIS cybersecurity responsibilities; activities required to sustain and renew the IRIS Authority to Operate; and the upload of artifacts to the AF/DoD RMF data repository in use at the time (currently the Enterprise Mission Assurance Support Services (eMASS) site).

4.2.6 Graphical User Interface (GUI): The MFOQA analysis products shall provide a GUI interface to the IRIS analysis tools and products that is user-friendly, uses common FOQA terminology, and with an interface, menu design, formatting, and tools similar to Microsoft Office products.

4.2.7 Flight Data and Analysis Results Database: Maintain a database containing the flight data files and MFOQA analysis results for each MDS. The data query tools and results shall be accessible by the contract analysts, IRIS development staff, and the COR and alternate COR. The IRIS web service shall provide an AFSEC-approved analysis summary dashboard for squadron, wing and MAJCOM staff top-level assessment of analysis results, trends, and emerging hazards.

4.2.8 Technical Documentation: Generate and sustain software requirements, security, and specification documents for IRIS. These documents shall comply with appropriate industry software development documentation standards and be provided in the format required by DoD and AF cybersecurity requirements when created for inclusion with assessment and authorization documentation. Supplemental specifications shall be generated to document MDS specific implementation, containing descriptions of each event, standard operating procedures, and other data points associated with each flight sufficient to recreate the analysis capability. These supplements shall also describe the analysis constants and constraints as determined by the flight recorder capability. All technical documentation shall be available for viewing and download from the IRIS web service. (CDRL A009, A010, A011)

4.2.9 Deployment of the IRIS Capability: Deploy the IRIS analysis capabilities to the field. Deployment is defined as all of the activities that make the integrated IRIS software system operational and available for use.

4.2.10 IRIS System Maintenance and Sustainment Task:

4.2.10.1 Provide IRIS system maintenance and sustainment to augment that provided by system vendors for configuring, installing, evaluating, customizing, and maintaining systems, including, but not limited to: application file/data base management, storage, security, and communications; generating and tracking vendor discrepancies; identifying and recommending necessary technical support and product upgrades; coordinating Government approval of and acquiring licenses, upgrades and new releases; installing, testing, and debugging new software releases; performing configuration management; and performing on and off-site system backups and/or restores.

4.2.10.2 Sustain and maintain all IRIS products, including IRMS software delivered and deployed under this contract while in use. Sustainment is defined as the processes, procedures, people, materiel, and information required to support, maintain, and operate the software aspects of the IRIS system over the web. Maintenance is defined as the process of modifying the software system or component after delivery to correct faults, improve performance or other attributes, or adapt to a changed environment. Sustain and maintain all systems delivered under this contract to include: all hardware and software trouble-shooting; all software debugging and recoding; all testing of fixes; development and deployment of upgrades to fix software discrepancies and improve analysis capabilities; sustainment of security controls in all software components; maintaining configuration control of all software releases; answering help requests; meeting RMF and ATO criteria; and updating all documentation as changes occur. All enhancements and fixes shall be mapped back to the applicable Software Requirements documentation for the module being worked on in the IRIS system.

4.2.11 Technology Evaluation: Integral to ongoing IRIS maintenance and sustainment, investigate and evaluate various options for IRIS technology improvements. Recommend the best solution to the USAF, taking into consideration the system capabilities and functionality, security, integration with USAF networks, user configurability, hardware requirements, technical support, training, user aids and costs for purchase, licensing, and sustainment.

5.0

ADDITIONAL INFORMATION AND REQUIREMENTS

5.1 Government-Furnished Property (GFP)/Government-Furnished Information (GFI). See Appendix 7 for Government-Furnished Property and Information.

5.1.1 The contractor may assume responsibility for and utilize none, part or all of the identified GFE. Any equipment acquired and sustained by the contractor and used outside a Government facility is wholly the responsibility of the contractor. If the contractor assumes responsibility for GFE, the contractor will submit DD Form 1662, Annual Report on DoD Property in the Custody of Contractors, at the start of each fiscal year, in accordance with FAR 52.245-1.

5.1.2 The software titled “Integrated Risk Management System (IRMS)” currently in use by the AF is an open source, secure, web-based information system, supporting military-specific MFOQA and ASAP reporting and processing needs. IRMS supports an open architecture, including naming standards, non-proprietary components, and use of relevant industry standards [e.g. Structured Query Language (SQL), HTML, Extensible Markup Language (XML), etc.] wherever possible. See Appendix 4 for a description of the Integrated Risk Management System software.

5.1.3 IRMS software, tools, and applications (e.g. operating system, programming language, statistical tools, database management systems, querying tools, reporting tools, visualizations tools, and web servers, etc) are Open Source Software (OSS), as defined at https://opensource.org/about, using the MIT form of license (https://opensource.org/licenses/MIT).

5.1.4 As a web-based application, IRMS does not require users to install or maintain any software, other than approved third-party tools. Commonly available web browsers (e.g. Internet Explorer or Mozilla) provide access to all system functions.

5.1.5 The Air Force Safety Center holds licenses for Flightscape Insight animation tools for use in MFOQA animation and analysis processes.

5.2 Government Facilities and Common Access Cards (CAC)

5.2.1 The Government will provide contract personnel who work in Government facilities office space, supplies, computers, telephone communications, internet access, printers, and access to appropriate Government files, databases, and CACs for use in the performance of this requirement. Use is limited to official Government business related to the performance of the requirements in this contract.

5.2.2 Contractor employees who work in Government facilities are prohibited from attaching any computer hardware to the Air Force network, or running any computer software unless it has been certified and accredited according to current USAF Instructions. Any such requests for reconfiguration or addition of computer software must be approved by the USAF Designated Approval Authority Representative via the contractor’s submission of a written request to the COR. Contractor employee use of computer modems, thumb drives, and external hard drives on any machine attached to the Air Force network is prohibited.

5.2.3 Contractor personnel who do not work on a Government facility but who access the IRIS system are required to obtain a CAC. The COR will provide instructions for procuring a CAC during the contract phase-in period.

5.3 Security and Protection of Sensitive Information

5.3.1 All contractors shall be required to have an approved National Agency Check with Inquires (NACI) prior to beginning work on any task described in this document. Contractors shall fund acquisition of and ensure that NACIs are initiated in a timely manner to ensure timely completion.

5.3.2 Access to classified information and material and U.S. Facilities Clearance are not a consideration at this time, but may become a requirement in the future. At that time one or more contract personnel may be required to have or obtain, at own or contractor’s expense, a “Secret” security clearance. The Government will complete and submit DD Form 254 when necessary.

5.3.3 During the performance of this contract, the contractor may be exposed to sensitive planning data/information in the form of technology strategies, product selection criteria, or risk management programs, at the program, AFSEC, MAJCOM, and/or DoD level. This information, if shared with industry, could lead to the compromise of Government plans and potentially legal action against the USAF. If, as a result of the performance of this contract, exposure to sensitive information cannot be avoided, the contractor shall take appropriate measures to protect this information from further distribution. Therefore, it is expected that all information associated with the performance of PWS be treated on a need-to-know basis, even if Unclassified.

5.3.4 Privacy & Privilege: Contractor employees may be exposed to data that is subject to the Privacy Act of 1974, Arms Export Control Act or the Export Administration Act of 1979, and Safety Privileged data. All contractor employees assigned to this task shall be required to take appropriate action to prevent disclosure of this information. Contractor employees shall abide by the guidance in DoDI 6055.07, Mishap Notification, Investigation, Reporting, and Record Keeping, Enclosure 5; AFI 91-202, The US Air Force Mishap Prevention Program, Chapter 5; AFI 91-204, Safety Investigations and Reports, Chapter 3; and AFMAN 91-223, Aviation Safety Investigations and Reports. Completion of non-disclosure statements will be required to ensure information that is considered sensitive, proprietary, or privileged is not compromised.

5.4 Contract Phase-In and Phase-Out Periods:

5.4.1 Contract Phase-In Period: A 30-day transition period shall ensure a smooth transition between the incumbent contractor and the successor contractor.

5.4.1.1 The successor contractor and the Government shall attend a Program Review at a location TBD during the transition period. A contract kick-off meeting will occur at the same time.

5.4.1.2 The contractor shall deliver a phase-in plan within 5 business days of award. The plan shall address how the on-going workload will continue to meet MAJCOM expectations for flight data analysis requirements, interaction with MAJCOM and AFSEC personnel, and AF and DoD IRIS cybersecurity processes and requirements. If any of the GFE (PWS Appendix 7) is required, the contractor shall include the list of requested GFE, and POC and location for shipment. (CDRL A012)

5.4.1.3 The successor contractor may observe day-to-day activities at the MAJCOMS.

5.4.1.4 The successor contractor shall complete hiring of personnel and acquire National Agency Check with Inquires (NAC-I) (see…