PWS for Aviation Safety - Integrated Risk Information System.pdf

Air Force Safety Center (AFSEC)

Safety-Integrated Risk Information System

(S-IRIS)

Performance Work Statement

Dated: 12 Sep 2025

P a g e | 2

Revision Date Revision/Change Description and Location

1.0 17Apr25 DRAFT Initial PWS / OPSEC approved

2.0 12Sep25 Incorporated wording and language feedback from base contracting and

AFSEC CIO/CDO. Added 5.5. Added option to use DAFeL for training (3.8).

2.1 21Oct26 Updated AI to SI. Updated wording to have CMMC certification reflect current (and changing) DoW policy

2.2 10Nov26 Updated Appendix 4 list of current and future aircraft

P a g e | 3

TABLE OF CONTENTS

Section 1 – Introduction

Paragraph Description Page

1.0 Introduction 5

1.1 Mission 5

1.2 Objective 5

1.3 Guidance 6

1.4 Scope 6

Section 2 – General Requirements

2.0 General Requirements 6

2.1 Analysis Application 6

2.2 Web-based Capability 7

2.3 Software 7

2.4 Personnel 7

Section 3 – Contract Management Requirements

3.0 Contract Management 10

3.1 Communication 10

3.2 Meeting Minutes 10

3.3 Quarterly Program Management Review 10

3.4 Quarterly Phase Plan / Configuration Control Board 10

3.5 Monthly Status Report 10

3.6 Travel 10

3.7 Work Location 11

3.8 Air Force Training 11

3.9 Non-Personal Services 12

Section 4 – MDS Fleet Risk Assessments and Support Requirements

4.0 MDS Fleet Risk Assessments and Support Requirements 12

4.1 IRIS Risk Assessment Tasks 12

4.2 IRIS Support Tasks 16

Section 5 – Additional Information and Requirements

5.0 Additional Information and Requirements 19

5.1 Intellectual Property: Data Rights and Software 19

5.2 Government Facilities and Common Access Cards 19

5.3 Security and Protection of Sensitive Information 20

5.4 Contract Phase-In and Phase-out Periods 20

5.5 Non-Displacement of Qualified Workers for Follow-On Contract 21

5.6 Quality Control Plan 22

5.7 Packaging 23

5.8 Licenses 23

5.9 Records/Data/Hardware/Software and Documentation 23

5.10 Software 23

5.11 Testing 23

5.12 Section 508 Accessibility Standards for IRIS Software 24

5.13 Information Assurance Contractor Training and Certification 24

P a g e | 4

Section 6 – Deliverables

6.0 Table 1: Deliverables 24

Section 7 – Services summary

7.0 Table 2: Services Summary 28

Section 8 – Contractor Full-Time Equivalent Reporting

8.0 Reserved 31

Appendices

Appendix Description Page 1 Acronyms 32 2 Definitions 34 3 Integrated Risk Management System Description 35 4 Potential MDS Fleets 40 5 Historical Analysis Delivery Schedule 41

P a g e | 5

1.0 INTRODUCTION

1.1 Mission. The Air Force Safety Center (AFSEC) develops United States AF (USAF) safety policy, and implements, executes, and evaluates Air Force (AF) aviation, ground, weapons, space, and nuclear surety mishap prevention programs. This includes mishap investigation, mishap prevention, risk management, and oversight of the AF Safety Management Systems. AFSEC provides safety and risk management education and media programs for all safety disciplines, oversees major command (MAJCOM) safety and mishap prevention programs, and maintains the AF database for mishaps and hazards.

1.2 Objective. The AFSEC uses the Safety - Integrated Risk Information System (S-IRIS) to detect and trend operational risks of flight-related data routinely generated onboard aircraft in support of the Military Flight Operations Quality Assurance (MFOQA) program to develop and integrate mishap precursor detection that would otherwise be unknown and drive mitigation tools into AF and Department of Defense (DoD) aviation operations. MFOQA uses the data files from the routine collection and download of flight data recorders, processing the data files through customized IT solutions within S-IRIS and specialized computer software to uncover risks to readiness, hazards, errors, and mishap precursors (e.g., trends and deviations from standard procedures and parameters).

Using operational and technical subject matter experts to assess risks inherent in recorded flight data and unique to military aviation operations, identifies and quantifies both normal and hazardous flight environments, drives the development of mitigation measures, and where applicable, enables monitoring of control measure effectiveness in support of the Chief of Staff of the Air Force (CSAF’s) Integrated Risk to Readiness campaign. This effort encompasses comprehensive analysis of current and future major Air Force weapon systems, including next-generation fighters, Remotely Piloted Aircraft (RPA), tankers, airlift, training and special operations aircraft as well as operational risks associated with Global Positioning Systems, satellite launch and recovery procedures and numerous tactics, techniques and procedures employed by USAF aircraft on a daily basis. MFOQA analysis results may be collated with safety event investigations and hazard reports to further refine customized algorithms or to explore additional areas of concern that could impact mission success. The resulting operational MFOQA products support USAF combat efforts in the Great Power Competition arena, provide long-range safety benefits and support the risk management efforts of the operations, training, maintenance, safety, research and development, and design functions of aircraft acquisition and sustainment. The contractor's support services directly enable AFSEC's mission-critical functions by providing specialized technical expertise, advanced research and AI tools, cybersecurity and governance, and programmatic assistance necessary to advance the center's safety oversight responsibilities and maintain the highest standards of operational safety across aircraft fleets enabling mission success.

P a g e | 6

1.3 Guidance. Department of War (DoW) policy and AF aviation safety program guidance necessitates the sustainment of current MFOQA support to operations capabilities and the deployment of MFOQA capability in additional aircraft fleets (Appendix 4) to prevent mishaps and preserve combat readiness. A robust MFOQA capability is a critical requirement described in the National Commission on Military Aviation Safety for air power. Each additional aircraft fleet requires unique customized software and operational subject matter expert tailoring of the targeted risk assessment capability to meet individual aircraft configuration and essential missions. The AF MFOQA program implements DoD Instruction (DoDI) 6055.19 and is described in AF Instruction (DAFI) 91- 225, Aviation Safety Programs. Aircraft data collection requirements are found in AF Pamphlet 63-129, Air System Development and Sustainment Engineering Processes and Procedures.

1.4 Scope: DAF Safety, AFSEC, and the MAJCOMs that AFSEC support requires non-decision-making technical support directly affecting the readiness of day-to-day USAF aircraft operations and mission employment. The primary objective of this contract is to provide direct support to defense weapon system programs through customized IT support and development, implement capability and deploy across all Major Weapon System aircraft fleets, provide continual risk assessment packages and recommendations by subject matter experts, sustainment, and evolution of AF and Joint Service proactive aviation safety using MFOQA to prevent mishaps and enhance readiness. Over the life of the contract, the contractor will sustain current fleets that participate in MFOQA, expand MFOQA capabilities to include additional USAF fleets, develop advanced predictive and prescriptive analytical tools, dashboards, and SI/ML capabilities delivering domain-specific safety analysis and subject matter expert support. The contractor may provide MFOQA risk identification and reduction support to Sister Services, other United States (US) Government Agencies, and Foreign Military Sales (FMS) partners. The contractor shall provide contract management, support and travel to: sustain and maintain MFOQA technical software; conduct MFOQA risk identification and reduction strategies; share operational findings, benefits, and advances; integrate MFOQA capabilities with other hazard identification programs and processes, such as mishap investigations within AFSEC’s Air Force Safety Automated System, Air Force Combined Risk Management System, Aviation Safety Action Program (ASAP) hazard reports;

collaborate with members of Sister Services, Governmental agencies, and foreign partners on goals and capabilities for collaborative MFOQA efforts; technology assessments; and dissemination of lessons learned.

2.0 GENERAL REQUIREMENTS

2.1 Application: The contractor shall maintain and sustain a data processing, storage and analysis capability (known as S-IRIS) to accept, aggregate, analyze, P a g e | 7 and visualize flight-related data generated onboard an aircraft to meet current and emerging USAF proactive aviation safety requirements, including but not limited to: flight data analysis and animation programs; repository for aircraft flight data and analysis results; file naming and definition standards; integration of data from various USAF Mission Design Series (MDS) aircraft and Major Weapon Systems (MWS); transformation of data collected using military data collection devices, data buses (e.g., Military Standard 1553), and non-standard proprietary formats into engineering units; methods required to support military-specific flight phases, maneuvers, and measurements; mathematical models and language constructs to characterize numerical, spatial, and temporal data to facilitate aggregation and correlation of data gathered through various USAF and DoW MDS and systems programs; techniques to support spatial analysis, data mining, multivariate statistical analysis, and advanced visualization; and methods for supporting maintenance and engineering requirements.

2.2 Web-based Capability. IRIS is a web-based service and shall remain a web-based service.

2.2.1. S-IRIS is part of an AFSEC Enclave hosting multiple AF safety information technology (IT) systems under one over-arching Authority to Operate (ATO) and Cybersecurity Strategy (CSS). The Enclave is hosted in a DoD-approved cloud environment.

2.2.2. The over-arching ATO is managed by AFSEC IT personnel; the contractor is required to provide support as requested and documentation as described in paragraph 4.2. to sustain the overarching AFSEC ATO, as specifically related to an S-IRIS Virtual Private Cloud within the AFSEC Information Level (IL) 4 Enclave.

2.3 Software. S-IRIS is enabled by a Government Off-the-Shelf (GOTS) open-source software called “Integrated Risk Management System” (IRMS) (paragraph 5.1.2 and Appendix 3). The contractor will maintain and sustain the IRMS software, providing spiral enhancement of current analysis algorithms, and the deployment of tailored MFOQA capability on additional USAF aircraft fleets.

2.4 Personnel. The contractor shall accomplish the assigned work by employing and utilizing qualified personnel with appropriate combinations of education, training, and experience. All personnel whose tasks require administrative privileges to the S-IRIS system must meet requirements of DAF Manual (DAFMAN) 17-1305, DAF Cyberspace Workforce Management Program, commensurate with the level associated with their duties. The following are required general skill sets and contractor personnel qualifications.

2.4.1 Software Developers: Software development personnel shall have both education and 5 years industry experience in programming languages and processes related to the development

P a g e | 8 and maintenance of software for operational flight data analysis. Team members shall be able to apply creative thinking and advanced problem-solving methodologies to web development, analysis algorithms for flight-related data generated onboard an aircraft, and database management, while complying with DoD and AF cybersecurity requirements. Developers shall be knowledgeable of and experienced in database and software management to include data storage, data security, data migration, and government database certification and accreditation processes. Developers shall have current cybersecurity certification as required by DoDD

8140.01 Cyberspace Workforce Management, DoDM 8140.03 Cyberspace Workforce Qualification and management Program, and DAFMAN 17-1305, DAF Cyberspace Workforce Management Program.

Routine tasks may include designing, programming, configuring, installing, testing, evaluating, tailoring, integrating, and maintaining systems, to include customizing database and software features such as graphic user interfaces specific to different aircraft fleet requirements.

Algorithms should be designed to identify maneuvers common to all aircraft fleets (such as takeoff and landing points) and specific to mission employment tasks of individual fleets (such as aerial refueling, combat maneuvering and aerobatic maneuvers). Developers will identify and recommend specific necessary technical support and product upgrades to support the MFOQA software, to include the testing, acquisition, and debugging of software upgrades and new releases. Similarly, the software development team shall be capable of performing feasibility and cost-benefit analysis of possible software and database changes, including the survey of application architectures and frameworks, leading to the estimation of budget and schedule implications for such new capabilities. Developers shall also write documentation stemming from the design and development of web-based analysis software for both qualitative and quantitative flight data analysis, including requirements and specification documents.

2.4.2 Information Technology and Cybersecurity: The information and cybersecurity personnel shall understand and possess a minimum of 5 years’ experience with DoD and AF cybersecurity policy, including successful experience implementing the Risk Management Framework (RMF) processes outlined in DoDI 8510.01. Personnel shall be familiar with DoD cybersecurity requirements and annual assessment procedures and processes. Information and cybersecurity personnel shall have current cybersecurity certification as required by DoDM 8140.03 and DAFMAN 17-1305. Per current and evolving DoW policy, the contractor will possess and maintain Cybersecurity Maturity Model Certification (CMMC) per 32 CFR part 170 as required. A current CompTIA Security+ or equivalent baseline certification per the DoD

8140.03 is required for all personnel who build, secure, operate, defend, and protect DoD and U.S. cyberspace resources.

The information and cybersecurity personnel shall coordinate with the program manager, software development team, the contracting officer representative (COR), and the AFSEC cybersecurity management team on overall policies, goals, and procedures for the cybersecurity function of S-IRIS. Contractor tasks include: create and implement a robust cybersecurity program and S-IRIS specific cybersecurity strategy (CSS); ensure all activities required to sustain and renew the S-IRIS portion of the AFSEC Enclave ATO are completed; generate assessment and authorization supporting documentation; facilitate the S-IRIS Configuration Control Board (CCB); generate and maintain Information Control Documents to include Information Exchange Agreements, Data Sharing Agreements, Memorandums of Agreement, and topologies for interfaces between S-IRIS and other IT systems; monitor systems for security gaps; run risk assessments as part of on-going continuous monitoring; implement an effective policy and process for continuity of operations and incident response; develop and provide reports to the program manager for communication to all senior stakeholders; and promote

P a g e | 9 cybersecurity awareness within the S-IRIS team.

2.4.3 Flight Data Analysts (FDA): FDA is the world-wide industry term for highly experienced operations personnel that use customized IT tools to identify, assess, and drive recommendations to reduce risks in aviation tactics, techniques, and procedures. MFOQA flight data analysts should have a minimum of 5 years’ experience as military aviation instructors in the mission type, and preferably in the specific aircraft, to which they are assigned (Appendix 4).

The FDAs shall manage processing and trending of flight data from aircraft participating in the Air Force MFOQA program. Contractor tasks include: the use and customization of software to identify and assess risk to readiness within flight data in relation to triggered events and routine operating measures; act as gatekeeper in aircrew contacts to expose underlying factors to an event, mishap or hazard; the completion of special studies resulting from analyst detection of hazardous conditions and acts; and respond to ad hoc requests from the MAJCOM or operational units. FDAs will assist in the development of, and be responsible for, the verification and validation of aircraft specific event definitions. Other tasks include the preparation of flight operations risk trending, charts, reports, and statistical data required to keep the AF aviation community informed of the status and programs related to proactive aviation safety information to drive operational recommendations to enhance readiness and project lethality through improvement of aircraft fleet tactics, techniques, and procedures. FDAs shall integrate flight hazard and risk information from multiple sources, including S-IRIS, Air Force Safety Automated System (AFSAS) events, operational trends, and Government and industry aviation hazard and safety reports.

2.4.4 MAJCOM Program Management: MAJCOM program managers (PM) shall have a minimum of 5 years’ experience in military aviation operations and shall understand AF aviation safety programs and objectives as well as Safety Management Systems (SMS). MAJCOM PMs shall be physically embedded at MAJCOM locations but are responsible for coordinating MFOQA efforts and activities with AFSEC.

MAJCOM program managers are responsible for overseeing the execution of MFOQA activities at Air Mobility Command (AMC), Air Education and Training Command (AETC), Air Combat Command (ACC) headquarters, Air Force Special Operations Command (AFSOC), and Air Force Global Strike Command (AFGSC). Current activities accomplished by these personnel shall be sustained. Specific managerial responsibilities include the daily administration, security, and operation of S-IRIS; educating MAJCOM staff on military and industry proactive aviation safety initiatives; leading the MAJCOM in the identification, employment, and sustainment of data collection and retrieval processes that support MFOQA capabilities; the security and protection of aircraft data and resulting MFOQA products; acting as gatekeeper in aircrew contacts to understand underlying factors to an event or hazard; and supporting the development of risk reduction measures to enhance aircraft fleet tactics, techniques, and procedures. PMs shall maximize the efficient use of proactive aviation safety data and shall participate in meetings and supporting events for proactive safety mishap prevention programs. Managers collaborate with operations and safety personnel to support MAJCOM integration of proactive safety capabilities in the SMS process. The PM shall oversee the generation of flight data MFOQA products and ensure that all reports generated under the MFOQA program meet MAJCOM needs regarding the measurement and management of operational and safety hazards and trends and are factually correct and statistically sound in support of warfighter needs. The PM shall support the MAJCOM’s trending of risk reduction strategies identified through MFOQA and mishap and hazard reports, and may be asked to represent these risk to readiness initiatives at government and industry events.

P a g e | 10

3.0 CONTRACT MANAGEMENT REQUIREMENTS

3.1 Communication. The contractor shall establish clear organizational lines of authority and responsibility to ensure effective management of the resources assigned to the requirement.

Regular communication between the contractor and the COR is required for optimal program development. The contractor shall provide, and update, when necessary, a roster of personnel.

(CDRL A001).

3.2 Meeting Minutes. The contractor shall deliver meeting minutes after each Quarterly Program Management Review (PMR), and for other official meetings when requested by the

COR. (CDRL A002)

3.3 Quarterly Program Management Review (PMR). The contractor shall conduct quarterly PMRs. The PMRs shall include a review of the completed quarter’s activity, MFOQA capabilities for future platforms, software user enhancements, algorithm improvements to enhance fleet effectiveness, S-IRIS Assessment and Authorization (A&A) activities, and proposed activity for the next quarter. The PMR shall be briefed to the Government for review and approval.

3.4 Quarterly Phase Plan / Configuration Control Board (CCB). The contractor shall, within 15 workdays following each PMR, brief the Government on its Quarterly Phase Plan.

Each Quarterly Phase Plan briefing shall describe major IRIS activity for the next quarter, including the impact of software modifications on the A&A requirements of S-IRIS and its subcomponents, and document the briefing in the Quarterly Phase Plan report. Each Quarterly Phase Plan report shall meet A&A requirements for IT configuration management control and change approval. (CDRL A003)

3.5 Monthly Status Report. The contractor shall provide monthly contract status reports. The monthly status reports shall include: 1) work accomplished during the reporting period; 2) a description of how the Quarterly Phase Plan activity supports overall contract objectives; and 3) risks and concerns associated with current and future contract activities. Describe schedule deviations, including the impact to deliverables and overall program objectives. The status reports may be associated with the contractor’s invoice submission. (CDRL A004)

3.6 Travel. The contractor personnel shall be prepared to travel in support of MFOQA program development and implementation. Travel requirements include: PMRs; aircraft program office technical meetings (such as Aircraft Information Working Groups, System Safety Groups, or Technical Interface Meetings); to support AF and MAJCOM operations and safety briefings and activities (such as Trend Review Action Committee, Air Reserve Component Chief of Safety course, and MDS proactive safety training), and industry and DoD advocacy and education meetings and conferences. See paragraph 4.1.7 for additional information.

3.6.1 The Government must approve all travel in advance of the activity. The Government will notify the contractor of the travel requirement at least three (3) days in advance of the travel date.

The contractor shall coordinate specific travel arrangements with the COR prior to traveling.

The contractor’s written request for travel shall contain the member’s names, dates and locations of travel.

3.6.2 Allowable travel costs are described in the Federal Acquisition Regulation 31.205-46, Federal Travel Regulations, and Joint Travel Regulations. The contractor shall be responsible

P a g e | 11 for obtaining all passenger transportation, lodging, and subsistence, both domestic and overseas.

In the performance of necessary travel, the contractor shall use the lowest cost mode commensurate with the requirements of the mission. When it is necessary to use air or rail travel, the contractor shall use coach, tourist class, economy class, or similar accommodations to the extent consistent with the successful and economical accomplishment of the mission for which the travel is being performed.

3.6.3 The contractor will provide, within five (5) workdays following any travel, a travel report describing the purpose of the trip; attendees; agenda; briefings and discussion topics; action items; and recommendations and conclusions suitable for dissemination to DAF leadership.

(CDRL A005)

3.7 Work Location. Work may be performed at contractor-identified and government facilities.

For those tasks performed at a government facility, the Government will provide workspace and equipment to perform the tasks associated with this contract. Telework is permitted for this contract with prior coordination between the COR and contractor management. Contractor personnel who telework shall follow their corporate guidance regarding telework capabilities and frequency.

3.7.1 Contractors providing support in a government facility will follow the workdays and hours established by the host organization, typically 0700-1600 Monday through Friday.

3.7.2 Contractor personnel shall not have access to government facilities unless government personnel are present. Government agencies/facilities may not be available during scheduled holidays, inclement weather, weekends, after duty hours, or AF down days. Contractor personnel hosted by a government facility may telework on government holidays not recognized by the contractor, or when the hosting organization is closed (i.e. base closure due to weather, down day, etc.). U.S. Government scheduled holidays are: New Year’s Day; Dr.

Martin Luther King, Jr. Birthday; President’s Day; Memorial Day; Juneteenth; Independence Day; Labor Day; Columbus Day; Veterans Day; Thanksgiving Day; and Christmas Day.

3.7.3 All contractor personnel working at a government facility shall wear company picture identification badges to distinguish themselves from government employees. When conversing with government personnel during business meetings, over the telephone or via electronic mail, contractor/subcontractor personnel shall identify themselves as such to avoid situations arising where sensitive topics might be better discussed solely between government employees. Contractors shall identify themselves on any attendance sheet or any coordination documents they may review. Electronic mail signature blocks shall identify their company affiliation. Contractor personnel who occupy shared space with their government program customer shall, where practicable, identify their workspace area with their name and company affiliation.

3.8 Air Force Training. Contractor employees whose tasks require accessing the S-IRIS web capability shall complete, at a minimum, the courses listed below, through the Center for Development of Security Excellence (CDSE), MyLearning computer-based training (for those working in a government facility), DAF E-Learning (DAFeL) computer-based training or via briefing materials provided by the government. Contractors/subcontractors working in government facilities shall complete additional training

P a g e | 12 requirements specific to the MAJCOM or work environment (e.g. Force Protection). The contractor will track training completion and maintain an electronic file of course completion certificates; course completion documentation will be provided to the COR upon request.

Failure to complete training may result in the contractor being denied base and computer access.

Contract employees with cybersecurity responsibilities shall have baseline certification commensurate with their assigned tasks, in accordance with DoDM 8140.01, DoDM 8140.03 and DAFMAN 17- 1305.

• DOD IAA Cyber Awareness Challenge (ZZ133098) - Due Annually

• Safety Privilege (AFSEC training) – Due Annually

• Security (AFSEC training) – Due initially and as required by the AFSEC Security

Manager

• Operational Security (OPSEC) Training – Due initially (in-processing), annually

(DAF-Operations Security Awareness Training on myLearning)

• Department of Defense Controlled Unclassified Information (CUI) mandatory training – Due initially and then annually

• Security Education and Training – Prior to performing tasks covered by the S-

IRIS contract DD Form 254, complete host installation training as identified in the DD Form 254 for each specific task.

3.9 Non-Personal Services. The government will neither supervise contractor employees nor control the method by which the contractor performs the required tasks. Under no circumstances shall the government assign tasks to, or prepare work schedules for, individual contractor employees. It shall be the responsibility of the contractor to manage its employees and to guard against any actions of personal services or give the perception of personal services. If the contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the contractor's responsibility to notify the Contracting Officer immediately. These personnel shall not perform work of a policy/decision making or management nature, i.e., inherently governmental functions. All decisions relative to programs supported by the contractor shall be the sole responsibility of the government.

4.0 MDS FLEET RISK ASSESSMENTS AND SUPPORT REQUIREMENTS

4.1 IRIS Risk Assessment Tasks. The overall focus of this requirements area involves risk identification, assessment and support to flight operations, including processing aircraft-generated flight data files through the web-based analysis server, flight data analysis, integration of hazard and error information from other sources, results distribution, and risk assessment and mitigation.

4.1.1 Analytical Services: The contractor shall conduct detailed risk-assessments by fleet and document findings specifically targeted to aviation inflight hazards focused on tactics, techniques, and procedures. The contractor shall communicate regularly with AFSEC, the MAJCOM safety, system program offices, operations, and maintenance staffs, and FMS partners to keep abreast of current areas of interest; and modify the focus and capabilities as necessary to address these areas of interest. The contractor shall ensure products direct user attention to important areas in the MFOQA report with intuitively understandable, recallable, and actionable hazard mitigation information, such as: annotating the purpose and context associated with a specific chart; identifying the specific hazard(s) associated with an analysis graphic; providing specific guidance to various users, such as commanders, trainers, and safety personnel; including

P a g e | 13 operating limits as a reference when appropriate; using a scheme that indicates hazard severity;

and/or using illustrations that trigger a memory that elicits a specific reaction to the hazard.

(CDRL A006)

4.1.1.1. The contractor shall use the MFOQA flight data software to identify operational hazard indicators, conduct analysis, and trend results to detect and quantify risks to aviation safety.

This is accomplished using flight data analysis software to identify: routine operational measurements (ROMs) such as unstick point, or 1000’ on approach; triggered events (TE) such as start airdrop, or overbank on approach; flight safety alerts (FSA) trending specific TEs;

standard operating procedures (SoPs) found in aircraft flight manuals; and other data points associated with each flight. The contractor will use both operational and maintenance MDS-specific technical orders and tactics guides to develop appropriate measures and validate current product applicability on a recurring basis. The contract shall then assemble these individual measurements for aggregate reports. The contractor shall track, trend, and drive operational recommendations based on these results. An MFOQA product shall be provided for each MDS fleet on a schedule agreed upon with the government, at least once per quarter and no more than once per month. Squadrons or wings may submit ad hoc requests for a breakout of their unit’s flight activity. The government may request the contractor provide mission-unique analyses for small fleets of MDS variants (e.g., AC-130J). The mission-unique products shall be provided on a schedule coordinated with the government.

4.1.1.2 The contractor shall derive hazard and risk information by integrating MFOQA analysis results with current MAJCOM, DAF, DoD, FMS, and industry aviation hazard information sources, (i.e. safety event investigations, hazard reports, ASAP, Line Operations Safety Audit (LOSA) findings and recommendations, publications, MDS technical orders, information meetings, the MFOQA analysis tool sets, etc.), and communicate the results in a timely and effective method to functional leadership within the MAJCOM, DAF, DoD, government, and FMS partners. In coordination with MAJCOM safety or operations staff, perform gatekeeper duties to better understand contributing factors to an event or hazard, and integrate the information in communications to the MAJCOM, DAF, DoD, government, and foreign military representatives. Disseminate lessons learned throughout the MFOQA program team cadre and make results available through the S-IRIS web service, AF Safety Automated System (AFSAS) and MAJCOM-specific information websites.

4.1.1.3 The contractor shall sustain MFOQA protection and support for the aircraft fleets identified in Appendix 4. MFOQA processes shall include: the ability to receive aircraft-generated flight data files in various formats; determine data suitability for useful analysis output; process, validate, track, trend, animate and aggregate flight data files and trending results; and adapt the MFOQA process as needed following flight data recording capability modifications. MFOQA software shall allow FDAs to derive information using an analysis tool set, including a query process, and to communicate their findings to MAJCOM, AFSEC, Air Force Materiel Command (AFMC, aircraft program offices), AF, and FMS partner staffs and leadership. MFOQA FDAs shall routinely analyze operational data to detect deviations from standard procedures and parameters, trend this information, disseminate results, animate the flight data, review and evolve MFOQA system techniques and visualizations, and provide feedback to the AFSEC, the MAJCOMs, System Program Office (SPOs) and FMS partners, on current areas of interest. MFOQA FDAs may be directed to assign hazard severity, and to facilitate the identification of causal factors and generation of recommendations. The FDA results shall be provided in the form of graphs, spreadsheets, animations and/or written reports, as coordinated with AFSEC and the unit, Lead MAJCOM, or FMS partner (as applicable) for each MDS.

P a g e | 14

4.1.1.4 The contractor shall sustain MFOQA support capability for current MFOQA participating fleets as identified in Appendix 4 and develop MFOQA analysis capability for additional aircraft fleets, dependent upon AF acquisition processes (i.e. data collection hardware modifications) and the needs of the DAF. Current MFOQA-participating fleets, to include fleets added to the program during this contract, that undergo extensive modifications by the AF requiring an entirely new software effort by the contractor to continue support, shall be considered an “additional aircraft fleet” with concurrence of the USG PM. Appendix 4 identifies current and potential future aircraft MDS fleets as well as current fleets projected for major data-centric upgrades/revisions.

4.1.1.4.1. The aircraft may vary, based on future AF agreements to provide risk reduction information for Sister Services, other government agencies (e.g. Coast Guard), or for foreign military partners.

4.1.2 MAJCOM, government agency, and FMS Support: The contractor shall provide flight data analytical support for risk assessment and management to the Lead MAJCOMs, (ACC, AMC, AETC, AFSOC, AFGSC), government agencies, and FMS safety, operations, training, and maintenance staffs. The contractor shall integrate organizational areas of interest with those of MAJCOMs, DAF, DoD, government agencies, and FMS representatives. The contractor shall, as needed, educate MAJCOM staff on the goals and processes associated with flight data analysis and its integration in the command’s SMS. The contractor shall interface regularly with AFSEC, the MAJCOM and DAF staff, government agencies, and FMS representatives to identify significant areas of interest; support activities to make new aircraft fleets MFOQA capable, present emerging trends, hazards, and risks; perform analysis; and convey results of subsequent analyses.

4.1.2.1. The contractor shall provide MFOQA analysis of mishap sorties and / or trend analysis to aircraft event investigations when coordinated with the COR or alternate COR.

4.1.2.2. The contractor shall provide approximately 10 squadron or wing-level ad hoc MFOQA analyses per month, as requested by the units and coordinated with the COR or alternate COR.

4.1.2.3. The contractor shall provide analysis of sorties flown under MAJCOM demonstration guidelines.

4.1.2.4. The contractor shall support lifecycle sustainment activities, including but not limited to notification of aircraft performance exceedances; analysis extracts for engine, structural, or systems monitoring; and ad hoc analysis in support of safety-related program office investigations.

4.1.2.5. Government Agency Partners: If requested, the contractor shall provide Sister Service and Coast Guard safety personnel, or other government agencies (e.g. Customs and Border Patrol) with access to aircraft flight data analysis capabilities within S-IRIS, or with organizational analysis results, as coordinated with the government.

4.1.2.6. Foreign Military Support: The contractor shall provide foreign militaries with flight data analytical support when coordinated with the government. MFOQA analysis support agreements currently exist with three C-17 FMS militaries (United Kingdom (UK), Australia, and the North Atlantic Treaty Organization Airlift Management Program), and the UK RC-135 Rivet Joint program. The contractor shall provide analysis products to the foreign military on a schedule agreed upon between the government and the foreign military representative, at least once per quarter and no more than once per month. Additional MFOQA analysis may be required as additional support agreements are established

P a g e | 15 with other foreign militaries.

4.1.2.7. The contractor shall coordinate with the Government to solicit AFSEC, MAJCOM, government agency, and foreign military desires for analysis capability and process improvement for inclusion in IRIS maintenance and sustainment activities (see paragraph 4.2.10.)

4.1.3 Flight Data File Distribution: The contractor shall understand the Recorded Aircraft Information requirements in DAFI 63-101/20-101, Integrated Life Cycle Management, and AFPAM 63-129 Air System Development and Sustainment Engineering Processes and Procedures to educate the MAJCOM operations, requirements, and safety staff on how these requirements are essential to providing aircraft-generated flight data to the MFOQA process.

The contractor shall work with the MAJCOMs, AFSEC, and other defense contractors to determine the best method of conveying flight data files from the aircraft to the analysis web service. The contractor shall participate (electronically or in person) in recorded aircraft information working groups and provide MFOQA related inputs to each fleets’ Aircraft Information Management Plan.

4.1.4 Data Dissemination: The contractor shall work with AFSEC, the MAJCOMs, government agencies, and FMS representatives to establish a schedule for providing MFOQA products. The contractor shall provide MAJCOMs, government agencies, and FMS militaries fleet-level proactive aviation safety analysis reports covering recent data analysis results and recommendations (at least one report per quarter, but no more than one report per month, for each MDS). The contractor shall provide analysis reports in presentation-ready format and appropriate for immediate messaging to field users and senior leaders. The reports shall provide information on current areas of interest as expressed by AFSEC, the MAJCOMs, government agencies, and FMS militaries to include emergent safety, operations, training, and maintenance trends. The contractor shall provide aircraft data (i.e. HAF A4 CBM+, Rapid Sustainment Office, engine propulsion, etc.) and lifecycle sustainment analyses if coordinated and approved by

AFSEC.

4.1.5 Presentations: The contractor shall present proactive aviation safety MFOQA results and programmatic activity. Primarily, these presentations shall cover flight data analysis products, in-depth analysis of high-interest events and trends, and proposals for mitigating negative trends.

Upon request from the government, the contractor shall include in its presentation activity associated with S-IRIS program growth and implementation. The contractor shall also be prepared to discuss methods to track any recommended training or operations changes. (CDRL A007)

4.1.6 Each calendar year the contractor shall write at least two MFOQA-derived case studies, detailing a hazard, the associated flight data analysis, and the MAJCOM hazard analysis, mitigation decision, and validation of the solution. The contractor shall write up to six papers or articles per year (approximately 500-1000 words), for MAJCOM and / or AFSEC safety publications. The minimum number of case studies and articles combined is four per year of performance or one per quarter. The topics include but are not limited to 1) description of MFOQA and / or ASAP-driven MFOQA analysis successes for a single MDS or group of MDSs;

2) the integration of MFOQA analysis in an organization’s SMS process; and 3) the use of MFOQA analysis to quantify a hazard identified through a LOSA or ASAP reporting or vice versa. (CDRL A008)

P a g e | 16

4.1.7 The contractor shall attend and participate in approximately 40 meetings per year. The meetings may include, but are not limited to: IRIS contract quarterly program management reviews (4 per year); IRIS contract quarterly requirements planning sessions (4 per year);

Federal Aviation Administration (FAA) InfoShare (2 per year); Aircraft Information Working Group or Technical Interchange Meetings (~10 per year, as called by MDS Program Manager);

government or industry led meetings or conferences in support of IRIS cybersecurity support (2 per year, A&A personnel); unit or organizational meetings in support of DAF, DoD, or industry data-driven proactive safety efforts (5 per year, analyst or MAJCOM program manager);

proactive safety instruction at MDS-specific school houses (10 per year, FDA or MAJCOM program manager ). Provide minutes and a trip report as appropriate (CDRL A002 or A005)

4.2 IRIS Support Tasks: The overall focus of this requirements area involves utilizing the open-source legacy Integrated Risk Management System (IRMS) software to maintain, sustain, and enhance the AF MFOQA software.

4.2.1 Safety - Integrated Risk Information System (S-IRIS): The contractor shall sustain the web based integrated information system, utilizing Government-provided IRMS software.

The minimum IRIS functionality shall include MFOQA components with the ability to integrate added interfaces for new fleets or components. Current data transfer interface capability, such as with the Aircraft Structural Integrity Management Information System (ASIMIS), Field Maintenance Command and Control (FMxC2/G081), Aging Fleet Integrity Resource (AFIRM), Advana-Blade, Panda, and Boeing’s Exostar shall be maintained.

4.2.2 System Interface: The contractor shall analyze the configuration, functionality, technical architecture, operating system, infrastructure, files, and databases associated with legacy or future information systems, and develop plans to interface between these systems and the delivered IRIS, as needed for system growth and sustainment. Added interfaces may include but are not limited to the Reliability and Maintainability Information System, and Aging Fleet Integrity and Reliability Maintenance.

4.2.3 IRIS MFOQA Employment: The contractor shall maintain existing MFOQA analysis capabilities and deploy MFOQA analysis capabilities on additional MDS as described in Appendix 4. The MFOQA software shall have the ability to process aircraft-generated flight data files from multiple recorder types and data formats, enable identification of unique standard flight maneuvers and procedures for each MDS, deviations from standard flight maneuvers and procedures and parameter exceedances, enable statistical analysis of various flight regimes, trend this information, and animate the flight data. This capability shall be adaptable for application against individual flight data files, aggregate MDS data files, and meta-analysis across multiple MDS. The contractor shall have the technical knowledge necessary to monitor and provide technical assistance for the IRMS software programs and database(s).

4.2.4. The contractor shall conduct initial and ongoing assessments of aircraft recording capabilities, data formats, documentation, and data distribution to understand changes to recording capabilities and processes for aircraft employing MFOQA, and to determine aircraft fleet potential for MFOQA implementation.

4.2.4.1. This task includes activity needed to create a timeline for deployment of a new fleet, such as review of technical documentation for data transcription and use in S-IRIS, an estimation of the bandwidth and data storage required to implement; any significant/unexpected costs involved, evaluation of differences between fleet variants and

P a g e | 17 impact on algorithm development and deployment and mapping of data files into analysis algorithms.

4.2.4.2. The activity in this task should sustain a level of assessment and development that provides fielding of at least one aircraft fleet per year, but is not limited to one aircraft fleet per year based on: AFMC/AFLCMC compliance with aircraft-generated flight data collection requirements for the delivered aircraft fleet or modification; the complexity or simplicity of a fleet’s recording and distribution process; extent of modification of an aircraft’s recording and distribution process; the extent of modification required to existing algorithmic functions based on changes to the fleet’s recording and distribution processes for a fleet currently employing MFOQA capabilities; the modification of a fleet’s mission requiring modification of existing algorithmic functions or development of new algorithmic functions; and Lead Command prioritization, and planned or unplanned funding opportunities. Current MFOQA fleets (Appendix 4) that undergo modifications by the AF requiring an extensive new effort by the contractor to sustain MFOQA support will count as an additional aircraft fleet when identified by the contractor and approved by the COR. In such cases, the contractor may need to increase software engineering support personnel in lieu of an additional MDS flight data analysts after consulting with and gaining COR approval.

4.2.5 Software Assessment and Authorization: The contractor shall conduct assessment and authorization activities supporting the cybersecurity requirements of the RMF, in accordance with DAF and DoD requirements (current and future revisions), as needed to support a single ATO for all AFSEC IL4 systems. Tasks and activities shall be coordinated through the COR and the AFSEC Information System Security Manager and include but are not limited to generation of assessment and authorization supporting documentation; the identification and documentation of S-IRIS cybersecurity responsibilities; AFSEC change management procedures, and activities required to sustain and renew the S-IRIS Authority to Operate.

4.2.6 Graphical User Interface (GUI): The MFOQA analysis products shall provide a GUI interface to the S-IRIS analysis tools and products that is user-friendly, uses common FOQA industry terminology, and with an interface, menu design, formatting, and tools similar to Microsoft Office products.

4.2.7 Flight Data and Analysis Results Database: The contractor shall maintain a database containing the aircraft-generated flight data files and MFOQA analysis results for each MDS.

The data query tools and results shall be accessible by the contract analysts, IRIS development staff, and the COR and alternate COR. Data files shall be accessible by MAJCOMs and other AF authorized users. The S-IRIS web service shall provide an AFSEC-approved risk summary dashboard for squadron, wing and MAJCOM staff top-level assessment of analysis results, trends, and emerging hazards.

4.2.8 Technical Documentation: The contractor shall generate and sustain software requirements, security, and specification documents for S-IRIS. These documents shall comply with appropriate industry software development documentation standards and be provided in the format required by DoD and DAF cybersecurity requirements when created for inclusion with assessment and authorization documentation. The contractor shall generate supplemental specifications to document MDS specific implementation, containing descriptions of each event, standard operating procedures, and other data points associated with each flight sufficient to recreate the analysis capability. These supplements shall also describe the analysis constants and constraints as determined by the flight recorder capability. Generate or sustain a Process Guide

P a g e | 18 for each fleet, including aircraft data flow, MFOQA programmatics and specifics for the fleet, description of ROMs and TEs, and a list of frequently asked questions. The contractor shall make all technical documentation available for viewing and download from the S-IRIS web service or other government approved location. (CDRL A009, A010, A011, A012)

4.2.9 Deployment of the S-IRIS Capability: The contractor shall deploy the IRIS analysis capabilities to the field. Deployment is defined as all the activities that make the integrated S- IRIS software system operational and available for use.

4.2.10 S-IRIS System Maintenance and Sustainment Task:

4.2.10.1 The contractor shall provide S-IRIS system maintenance and sustainment to augment that provided by system vendors for configuring, installing, evaluating, customizing, and maintaining systems, including, but not limited to: application file/data base management, storage,…