SOW_DO-200B_20250318.docx

UNCLASSIFIED APPENDIX A

NATIONAL GEOSPATIAL INTELLIGENCE AGENCY

AERONAUTICAL NAVIGATION OFFICE

DO-200B/AC-20-153B Assessment/Compliance Audit

Statement of Work 18 March 2025

UNCLASSIFIED

Attachment 1

8 | Page

1.0 INTRODUCTION

1.1 The National Geospatial-Intelligence Agency (NGA) delivers Geospatial Intelligence (GEOINT) and Aeronautical Safety of Navigation information that provides a decisive advantage to policymakers, warfighters, intelligence professionals, humanitarian efforts, and first responders. NGA supports the National System for Geospatial Intelligence (NSG), which supports the U.S. Department of Defense (DoD), Department of Homeland Security, and the Intelligence Community (IC). NGA is a unique combination of intelligence agency and combat support agency and leads the world in providing timely, relevant, accurate and actionable GEOINT.

1.2 Communication, Navigation, Surveillance/Air Traffic Management (CNS/ATM) requirements drive toward an accepted standard used by the aeronautical community throughout the aeronautical data chain process. Demonstrating compliance to these requirements as well as continually improving those aeronautical data processes is a continued effort by the NGA.

2.0 SCOPE

2.1 The intent of this Statement of Work (SoW) is specifically related to observing the Aeronautical Navigation Office’s (SFA) system of organization for processing worldwide aeronautical data elements or creating aeronautical products provided to its customer group –the Department of Defense, IC, and the aeronautical international community. This Statement of Work is focused on the SFA’s aeronautical data chain processes from receipt of source to dissemination to the end user.

CNS/ATM requirements incudes guidance published by RTCA in Document (DO)-200B, “Standards for Processing Aeronautical Data,” the Federal Aviation Administration (FAA) Advisory Circular (AC) 20-153B, “Acceptance of Aeronautical Data Processes and Associated Data,” and DO-330 “Software Tool Qualification Considerations.” These requirements provide the baseline for which CNS/ATM requirements are applicable to processing aeronautical data. These standards provide recommended minimum requirements for the processing of aeronautical data. The emphasis for this SoW is for a 3rd party organization to observe and document findings of compliance or deviations of compliance according to the guidance found in DO-200B, AC-20-153B, and other related industry standards. Additionally, several key activities listed in Section 4.0 of this SoW describe NGA’s expectations and deliverables from the contractor.

2.2 DO-200B, para 3.2 lays out objectives for compliance audits (abbreviated from DO-200B):

2.2.1 Authorized versions of plans and procedures are available.

2.2.2 Controls exist to ensure that plans and procedures are followed.

2.2.3 The Quality Management System (QMS) meets all requirements and compliance deviations are being managed appropriately.

2.2.4 Procedures exist for the management of changes to the data processing procedures to meet QMS requirements.

3.0 AUDITING REQUIREMENTS

3.1 Although the NGA Aeronautical Navigation Office operates at two sites in the St Louis metropolitan area, the primary site for processing aeronautical data is the South Second Street location. The scope of this audit is to provide feedback for compliance to DO-200B, AC 20-153B, and DO-330. The audit activities required to assess this compliance will likely be accomplished at the site located on South Second Street. There may be times the audit activities will include a site visit to the secondary location in Arnold, MO.

National Geospatial-Intelligence Agency Aeronautical Navigation Office (SFA) 3200 South Second Street St. Louis, MO 63118

National Geospatial-Intelligence Agency Aeronautical Navigation Office (SFA) 3838 Vogel Road Arnold, MO 63010

The St. Louis, MO and Arnold, MO locations for the Aeronautical Navigation Office operate with one shift.

3.2 The Aeronautical Navigation Office has a current multi-site Certificate of Registration that is in conformance with the International Quality System Standard: ISO 9001:2015.

3.3 Should a new version of the DO-200B, AC 20-153B, and DO-330 standard be released, NGA will take the required steps to realign to the requirements of the new version. This may include scheduling additional audit activities in order to retain compliance.

3.3.1 The Contractor shall realign its processes to support any new versions of DO-200B, AC 20-153B, and DO-330 requirements within the scope of this SOW.

3.4 Audit Activities

3.4.1 The Contractor must be an independent, primary audit firm. The subcontracting of auditing services is not authorized.

3.5 Auditor Qualifications

3.5.1 The Certification Body (Audit Firm) must have credentials recognized by the Federal Aviation Administration (FAA) for the purpose of performing a DO-200B/AC 20-153B Assessment/Compliance audit.

3.5.2 The Certification Body must have a process to determine competence of its auditors. The Aeronautical Navigation Office has a unique mission of providing worldwide aeronautical data to a wide range of users (DoD). The auditors are required to possess appropriate aeronautical data management knowledge.

3.5.3 The contractor will assign a certified lead auditor to lead all audit activities accompanied by certified audit team members (as needed). The lead auditor shall have a minimum of three years of experience and be identified by name in the proposal.

3.5.4 Each audit team member assigned to this contract shall have a minimum of one year of experience as a certified auditor. Any proposed change of key personnel and the reasons for the change must be coordinated with the Contracting Officer prior to execution of the audit. Changes to the audit team must be coordinated with the COR at least 21 calendar days prior to the scheduled audit.

3.6 Arbitration Process

3.6.1 The auditor shall have a process for handling appeals by the Government arising from the audits. Appeals are to be filed with the auditor within 30 days of receipt of audit report. A review is to be accomplished by a disinterested individual not involved in the audit activity.

3.7 Period of Performance

3.7.1 This delivery order will have a Period of Performance (POP) of a 1 July 2025 - 30 June 2026, plus an additional four (4)- twelve (12) month option periods.

4.0 AERONAUTICAL NAVIGATION OFFICE PERFORMANCE SUMMARY

a) Audit schedule

b) Audit plan

c) Audit

d) Audit report

a) Observation Report

a) Agenda in the form of a Microsoft Word or PDF via Email

b) Minutes in the form of a Microsoft Word or PDF, Provided via Email

a) Training Schedule

b) Training Plan

c) Training Material

d) Training Report

4.6 Conduct a yearly CNS/ATM Assessment/Compliance audit within the Period of Performance that will not exceed more than 12 months from the previous CNS/ATM Assessment/Compliance audit. This deliverable will be a record of compliance in support of AC 20-153B, Section 10.2.4.

4.6.1 Audit scheduling will be coordinated between the Contractor and NGA through the Contracting Officer Representative (COR).

4.6.2 Activities that will be performed as part of the audit performed by the Contractor:

4.6.2.1 Review of previous audit findings delivered by the Contractor.

4.6.2.2 Audit against the applicable objectives of DO-200B Appendices D and F.

4.6.2.3 Audit against the applicable objectives of AC 20-153B Appendix 3.

4.6.2.4 Creation of an objectives-based compliance matrix to record results, which uses either the audit classifications defined in RTCA DO-200B, section 3.4 or the audit classifications defined in FAA Order 8110.55B

4.6.2.5 Final report, which provides explanatory text for compliance matrix results.

4.6.2.6 Upon completion of any audit activity, the auditor will provide a closing meeting detailing the audit activities and findings.

4.6.2.7 Due to any restriction that prevents on-site visitors, the audit will be conducted via remote methods.

4.6.2.8 Determining the remote platform will be a coordinated agreement between NGA and the Contractor.

4.6.3 Audit activities may include necessary Contractor and NGA follow-up events with the FAA Issuer of the NGA Type I LOA to address audit activities and audit findings. Refer to the activity listed in Section 4.7.

4.6.4 Proof of the deliverables will be given to the COR to demonstrate completed tasks prior to payment.

4.7 Participate in the yearly CNS/ATM: Type I LOA Issuer 3rd Party Audit by the regulatory authorities for issuance of the NGA Type I Letter of Acceptance (LOA) with in the Period of Performance.

4.7.1 Upon coordination with NGA, the Contractor shall attend, support as needed and provide written observations as applicable.

4.7.1.1 The Contractor will attend the full duration of the audit.

4.7.1.2 The audit will not extend more than 5 days in duration and more than 10-hour days.

4.7.1.3 The Contractor’s participation may include reviewing and answering questions from the Issuer of the Type I LOA concerning previous audit activities and findings.

4.7.2 This will include observing the entire audit from the opening meeting to the closing meeting.

4.7.3 If the audit is on-site, the contractor shall be on-site unless travel restrictions limit this capability the contractor participant will dial-in remotely.

4.7.3.1 NGA shall ensure remote dial-in is coordinated with the contractor.

4.7.4 Any observations the contractor may have as a result of the audit will be provided to NGA within 30 days.

4.7.5 Proof of the deliverables will be given to the COR to demonstrate completed tasks prior to payment.

4.8 Participate in Technical Exchange Meetings (TEM)

4.8.1 NGA and the Contractor shall meet once a month to discuss internal and external CNS/ATM relatable discussion points, such as previous audit findings, upcoming audit or training events, or topics for discussion. These TEMS shall include support with reviewing processes and updating relevant documents, such as the CNS/ATM Compliance Plan.

4.8.1.1 The schedule and agenda will be a coordinated effort between NGA and the Contractor.

4.8.1.2 An agenda will be provided by the Contractor no later than 7 days prior to the scheduled TEM.

4.8.2 Technical Exchange Meetings will be conducted via remote methods between NGA and the Contractor.

4.8.3 This type of meeting will be coordinated in advance with all participants and will not last more than 3 hours.

4.8.4 Minutes will be captured by the Contractor after each TEM and forwarded within 3 working days of the conclusion of the meeting.

4.9 If requested by NGA, the contractor will conduct a yearly training event

4.9.1 The NGA and the Contractor shall coordinate and determine the best method(s) to conduct the training.

4.9.2 The event will not last more than 3 days and 8-hour days.

4.1.1.1 If travel restrictions limit on-site visits, the training event will occur remotely via a coordinated platform that NGA and the Contractor have agreed upon.

4.9.3 The scope of the training event will be determined by NGA with recommendations by the Contractor.

4.9.4 The Contractor will provide appropriate forms of media that supports the training event.

4.9.5 The event will include opening and closing meetings.

4.9.6 A training report describing the events will be provided to NGA within 30 days of the end of the training event.

4.9.7 Proof of the deliverables will be given to the COR to demonstrate completed tasks prior to payment.

5.0 REPORTING

Communication between NGA and the Contractor is essential to achieving success in meeting the mission, conducting business, and advancing our abilities. To achieve this success, the following requirements are included in this SOW:

5.6 In support of 4.2:

5.6.1 the Contractor shall submit an audit plan to the designated Contracting Officer’s Representative (COR) 14 days prior to audit activities.

5.6.2 The Contractor shall provide a draft copy of the audit report prior to exiting the audit location.

5.6.3 A finalized audit report is to be delivered within 30 days after completion of the audit, sent to the COR.

5.6.4 NGA has 30 days to respond to the final report. Upon acceptance, NGA shall return a copy of the audit report with an original signature from the Contractor Management Representative and the Aeronautical Navigation Office. The signed audit report will constitute acceptance by NGA, at which time the Contractor shall invoice for services provided.

5.7 The vendor shall invoice NGA at a minimum every quarter from the start of the Period of Performance.

6.0 SECURITY

6.6 Contractors must abide by all applicable security policies and regulations.

6.7 Work associated with this contract is limited to UNCLASSIFIED, UNCLASSIFIED/FOUO, or UNCLASSIFIED/LIMDIS. The contractor shall not release to anyone outside the Contractor’s organization any unclassified information, regardless of medium (e.g., film, tape, document), pertaining to any part of this contract or any program related to this contract, unless the Contracting Officer has given prior written approval or in performance of a project that has been scoped and negotiated by NGA with the contractor. Release and disclosure guidance provided to subcontractors shall be ‘all release and disclosure requests shall be submitted through the prime contractor to NGA.’

6.8 The contractor resources provided for maintenance and data delivery are not required to hold security clearances given that the nature of the data will be UNCLASSIFIED/FOUO and UNCLASSIFIED/LIMDIS. A classified environment is not required at the contractor facility and an Automated Information System (AIS) is not required for this effort.

6.9 For access to NGA facilities during audit, contractor personnel must be escorted.

6.10 The contractor shall follow all applicable NGA, IC, and DoD information security and operational security policies and guidance when accessing and transmitting data over networks during performance of contractual requirements.

6.11 Only United States personnel (foreign nationals are prohibited from working on this contract) are authorized to perform work on this contract.

6.12 Auditors may have access to information of a sensitive nature. Therefore, it will be a requirement that auditors shall sign an NGA Form 5210-18, Nondisclosure Agreement prior to audit activities (See Appendix A). To gain access to privileged information requires that information be protected and not be disclosed to outside entities.

6.13 All Contractor visits to Government facilities for onsite audits must be coordinated in advance with the COR. Work hours will be planned in advance and notification to NGA will be accomplished by a Visit Request according to NGA guidelines. Work areas, including walking paths, will be sanitized from classified material prior to the auditor’s arrival. Expect that auditors will have to be escorted at all times.

6.14 The Contractor shall inform the Government when their employees no longer support the contract.

6.15 All government furnished information released to the contractor or created in the performance of this contract (UNCLASSIFIED/FOUO or UNCLASSIFIED/LIMDIS) will be destroyed by the contractor or returned to the NGA upon termination of the contract or when no longer required in the performance of the contract.

6.16 Contractor personnel are forbidden from bringing in prohibited, unauthorized, and/or Portable Electronic Devices (PEDs) into any NGA installation or any office/working location covered under this contract. A list of PEDs includes, but is not limited to, cell phones, cameras, two-way pagers, laptops, recorders (digital, tape, etc.), flash drives, or any other kind of removable media. See NGA instructions/regulations/policy for a full list of prohibited and unauthorized items. Security violations will be determined on the severity of the violation.

6.17 If the Contractor chooses to initiate security protocols to access the Sensitive But Unclassified (SBU) network while on-site at the NGA facilities all required steps, time, and financial obligations to complete this process is the Contactor’s responsibility.

6.18 Contractor employees shall comply with all applicable rules and regulations while on NGA premises and handling NGA information/material, which includes providing proper identification for entrance and vehicle passes, obeying posted signs, displaying the issued badge, and observing smoking restrictions.

6.19 The Contractor shall not possess weapons, firearms, or ammunition on themselves or within their Contractor-owned vehicle or privately-owned vehicle while on any NGA installation or any office/working location covered under this contract. Possession of weapons, firearms, or ammunition while on an installation is considered a major security violation.

Note: While Contractor employees will be provided viewing access to controlled workstations for document and Quality Management System component viewing, it is the responsibility of the Aeronautical Safety of Navigation Office personnel to ensure that only the appropriate documents are displayed (no document that is classified higher than UNCLASSIFIED/FOUO OR UNCLASSIFIED/LIMDIS). Documents may be printed for auditor reference, but review of any document will include the assurance that no classified portion is made available without the proper clearance and need to know.

7.0 TRAVEL

Travel may be required by the contractor in support of NGA requirements. All travel will be priced on a cost reimbursable (NTE) basis (no profit/fee). All travel shall be pre-approved by the NGA CO and COR. The travel must occur during the base period of performance.

7.6 Conduct a yearly CNS/ATM audit per Section 4.6

7.6.1 The agency will authorize one round trip to the locations listed above for no more than the length of 5 days for one auditor.

7.6.2 If the yearly CNS/ATM audit is conducted remotely/virtually, travel will not be authorized.

7.7 Participate in the CNS/ATM: Type I LOA Issuer 3rd Party Audit per Section 4.7

7.7.1 The agency will authorize one round trip to the locations listed above for no more than the length of 5 days for one auditor.

7.7.2 If the CNS/ATM: Type I LOA Issuer 3rd Party Audit is conducted remotely/virtually, travel will not be authorized.

7.8 Conduct a Training Event per Section 4.8

7.8.1 The agency will authorize one round trip to the locations listed above for the length of 3 days for one auditor.

7.8.2 Dependent on the scope of the training event, if NGA determines that the event can be completed through remote capabilities, travel will not be authorized.

image1.jpeg