J.1 (a) Attachment 1 SOW_.pdf

80ARC023R0002 - Attachment J.1(a)(1)

AVIATION SAFETY REPORTING SYSTEM (ASRS) AND RELATED SYSTEMS

Table of Contents

1.0 INTRODUCTION

2.0 SCOPE OF WORK

2.1 OVERALL CONTRACT REQUIREMENTS

2.1.1. Contract Management Requirements

2.1.2. Personnel Requirements

2.1.3 Facility Requirements

2.1.4 Information Technology (IT) Requirements

2.1.5 Records Management Requirements

2.1.6 Continuity of Operations and Preservation of Data

2.1.7 Core Requirements Technical Instruction

2.1.8 IDIQ Task Order Management and Administration

2.1.9 Overall Program Deliverables

2.2 AVIATION SAFETY REPORTING SYSTEM (ASRS)

2.2.1 ASRS Report Processing Flow

2.2.2 ASRS Information Systems and Processes

2.2.3 ASRS Safety Products and Analyses

2.2.4 ASRS Status Briefings and Reports

2.3 CONFIDENTIAL CLOSE CALL REPORTING SYSTEM (C3RS)

2.3.1 C3RS Report Processing Flow

2.3.2 C3RS Information Systems and Processes

2.3.3 C3RS Safety Products and Analyses

2.3.4 C3RS Status Briefings and Reports

3.0 PHASE-IN AND PHASE-OUT

3.1 PHASE-IN

3.1.1 Personnel

3.1.2 Information Technology (IT)

3.1.3 Facility

3.1.4 Transfer of Property, Equipment, Licenses and Agreements

3.1.5 Transition of Technical Work Requirements

3.2 PHASE-OUT

3.2.1 Phase-Out Plan and Execution of Phase Out Activities/Requirements

3.2.2 Phase-Out Data Deliverables

3.2.3 Transfer of Equipment Property, Supplies, and Materials

4.0 Indefinite Delivery Indefinite Quantity (IDIQ) Task Orders

5.0 APPENDICES

5.1 MINIMUM FACILITY / SYSTEM SECURITY AND DATA CONFIDENTIALITY PROTECTION

CONSIDERATIONS

5.2 LABOR CATEGORIES and DESCRIPTIONS

6.0 LIST OF ACRONYMS

AVIATION SAFETY REPORTING SYSTEM (ASRS)

AND RELATED SYSTEMS

1.0 INTRODUCTION

The National Aeronautics and Space Administration (NASA) Ames Research Center (ARC) operates and manages the Aviation Safety Reporting System (ASRS) and related voluntary safety reporting systems.

NASA Ames has operated the ASRS, a voluntary, independent, non-punitive, confidential safety incident reporting program, since 1976. The ASRS operates in accordance with an InterAgency Agreement (IAA) with the Department of Transportation's Federal Aviation Administration (FAA). The ASRS program is nationally and internationally recognized as an effective and trusted model for confidential safety reporting. ASRS receives reports from any person involved in the aviation system including pilots, air traffic controllers, dispatchers, ground operations, maintenance, flight attendants, and those involved in Unmanned Aerial Vehicle (UAV) operations. The mission of the ASRS is to analyze these safety reports and broadly disseminate the de-identified safety information concerning current and potential deficiencies in the operational performance of the National Airspace System. The identity of the individual submitting a safety report remains confidential for protection of the reporter and his/her organization. Protecting reporter confidentiality is always the highest priority. The FAA offers immunity against disciplinary action for those who submit incident reports to the ASRS as this is evidence of a constructive attitude towards aviation safety.

The Confidential Close Call Reporting System (C3RS) is a related voluntary safety reporting system, modelled after the ASRS. It was established in 2010 through an IAA between NASA and the Department of Transportation's Federal Railroad Administration (FRA). C3RS is designed to improve railroad safety by collecting and studying reports detailing unsafe conditions or near miss events in the railroad industry.

Railroad personnel can submit reports to C3RS when they are involved in or observe an incident or condition where railroad safety may have been compromised. Like ASRS, all reports sent to C3RS are voluntary and are held in the strictest confidence. In addition to confidentiality, the FRA and participating railroad carriers offer further incentives to those who submit reports to C3RS. Through agreements with the labor organizations, those who report are provided protection from discipline for qualifying events. The FRA and railroad carriers’ willingness to provide immunity is an important indication of the value they place on the constructive safety information gathered through incident reporting to C3RS.

This Statement of Work (SOW) is currently applicable for two systems: the ASRS, and the closely related C3RS. The requirements to be performed are described in the following sections. It is possible that additional related reporting systems, or other related tasks, may be added in the future, though none are anticipated at this time. Such additional systems and reporting requirements are not included in the current SOW, but if warranted, an Indefinite Delivery/Indefinite Quantity (IDIQ) task order may be executed at a future date (See Sections 2.1.8 and 4.0).

2.0 SCOPE OF WORK

The Contractor shall operate and maintain ASRS and the related C3RS. The Contractor shall provide flexible, responsive, coordinated, and comprehensive support services for ASRS and C3RS. The Contractor shall manage and administer all work to be performed and assure the availability of qualified personnel and resources.

The following descriptions represent the Government’s requirements.

• accessing raw reports that have not yet been de-identified and any special study or other work materials with information that could identify a reporter or their organization.

• conducting confidential call backs to ASRS/C3RS reporters and study participants, and

• processing paper reports and ID strips that contain ASRS/C3RS reporter personal and/or organizational information.

If a future need arises, in which the government elects to permit telework or remote work for selected tasks, the Contractor will be notified in writing by the CO.

Additionally, some tasks require on-site work at either the Contractor’s secure facility and/or NASA Ames Research Center to fulfill a business function because of specialized equipment or government resources. These tasks include, but are not limited to receiving shipments and visitors, date-stamping paper reports, preparing ID strips for mailing, processing incoming mail, server and computer system administration, data backups, inventory management, and facility maintenance and security checks as well as Phase-In activities.

If the Contractor proposes a telework / remote work arrangement for eligible tasks, the Contractor shall develop and implement telework procedures which will identify eligibility, procedures to ensure data confidentiality and quality, training protocols for telework procedures, and robust IT security requirements for remote work locations. The Contractor shall develop and maintain a telework agreement with each employee and demonstrate an ability to effectively manage telework so that telework does not diminish performance and compromise confidentiality.

2.1.2. Personnel Requirements

The Contractor shall provide personnel to meet all technical requirements laid out in this SOW, including, but not limited to, expertise in the areas specified in SOW Section 5.2.

The Contractor shall provide one person to manage and oversee technical work, personnel, budget, schedule, and deliverables and interface with the CO and COR for ASRS, C3RS, and all related systems and sub-projects and IDIQ task orders (See SOW Section 5.2, Program Manager)

The Contractor shall provide personnel to manage each reporting system (ASRS and C3RS), see SOW Section 5.2 ASRS Project Manager and C3RS Project Manager. These personnel shall be responsible for overseeing all aspects of ASRS/C3RS operations and their respective report processing workflows and ensure the quality of all technical products including report-processing and safety products, special studies, publications, and presentations. Outreach efforts and communication about the ASRS/C3RS programs to government and industry are an important responsibility of these positions.

The Contractor shall provide one person to be responsible for the provision of services for all IT-related functions required for the completion of SOW requirements and be responsible for coordination of support services, coordination with NASA ARC Chief Information Officer (CIO) and ARC IT Security offices, and fulfill the role of ASRS Information System Security Officer (ISSO). See SOW Section 5.2, IT Manager.

The Contractor shall provide Expert Analysts and Assistant Analysts who are expected to apply operational knowledge, judgment and decision-making skills while carrying out all aspects of the report processing workflow including screening, coding, and de-identifying reports as well as calling back reporters and synopsis writing (and other tasks as described in SOW Section 5.2). These analysts are expected to have relevant domain experience and knowledge and shall have the minimum professional qualifications listed in SOW Appendix, Section 5.2 (see Expert Analysts and Assistant Analysts) and be able to perform the functions described in SOW Section 2.2, and 2.3.

The number of ASRS and C3RS reports received in a given time period is difficult to predict and often quite variable. Therefore, report processing needs are inherently uncertain which, in turn, results in variability in labor hours required for report processing, analyses, and generation of safety products. Also, ASRS and C3RS requirements for analyses, secondary studies, and special topic report processing vary based on government and industry interests and needs. The Contractor must demonstrate a capability to provide for flexibility in staffing to accommodate these variations both by quickly ramping up and down staffing hours and nimbly reallocating labor hours to accommodate government requirements.

Personnel with experience in other areas, including but not limited to, may include database search, quantitative and qualitative data analysis, computer systems administration, database management, cybersecurity, research methods, graphic design, technical writing, web-site administration, human factors, human interface design, business and financial management, and administrative support may also be required.

2.1.3 Facility Requirements

Location –The Contractor shall provide a facility large enough to accommodate both ASRS and C3RS operations within five (5) miles of NASA Ames Research Center (ARC), Moffett Field, California 94035.

This proximity to NASA ARC requirement is due to the number and frequency of significant interactions among the Contractor personnel, NASA personnel, NASA programs, and facilities at NASA ARC.

Examples of the required interactions include the daily pickup of mail from the official U.S. Postal Service P.O. Boxes for each reporting system at the Moffett Field Post Office; the requirement to mail ID strips (SOW Sections 2.2.1, ASRS Report Processing Flow and 2.3.1, C3RS Report Processing Flow) through only the NASA Ames onsite mailroom, location of IT assets, records retention management, equipment management, NASA printing services, and coordination with the CO, and the NASA ARC staff and management team.

Facility Requirements - The Contractor shall provide a secure office space ensuring that all sensitive information and equipment is protected (see SOW Section 5.1.3). The office use shall be dedicated for only ASRS/C3RS staff. The facility shall have a functioning site security system in accordance with the ASRS and Related Systems Facility Security Plan (see DRD 22). In addition, the facility shall include a private and secure location for Analysts to conduct telephone calls to ASRS/C3RS reporters as required during report processing or while conducting special studies to ensure reporter confidentiality. All callbacks shall be conducted from this private and secure facility, unless otherwise permitted by the CO.

Any identifying phone records shall be kept confidential, with limited access granted in accordance with the Facility Security Plan and managed in accordance with ASRS Systems and Processes (Section 2.2.2.1, ASRS Processing Logs and Records Management and Section 2.3.2.1, C3RS Processing Logs and Records Management).

The Contractor facility shall adhere to all NASA IT Security requirements. The Contractor shall provide a secure room that can be used to conduct confidential meetings which may include staff trainings, all-hands meetings, and host external meetings which may include international visitors. The facility shall accommodate government furnished office equipment.

The Contractor shall be prepared for periodic unannounced visits from members of NASA ARC Contracting Office, IT security, and Management team as well as from federal government partners from the FAA and FRA The Contractor shall provide supervised access to the facility and demonstrate that the minimum security considerations provided in Section 5.1.3 are met. The Contractor shall protect the confidentiality of all reporters to ASRS, C3RS or any other reporting system in operation and shall not provide access to confidential reports.

Visitors - The Contractor shall provide controlled access for all visitors including members from the aviation and rail communities, NASA, FAA, and FRA and those seeking assistance with the ASRS/C3RS program, if approved by NASA ASRS/C3RS Director. The Contractor shall maintain on-site visitor records and escort visitors when within ASRS/C3RS work areas.

Liaison Offices - The Contractor shall provide a private and secure office space for up to two NASA personnel directly related to ASRS, C3RS, and any other related programs (e.g., NASA ASRS/C3RS Director or other NASA personnel). This office space shall permit unrestricted access to these NASA software and website certificates. The Contractor shall ensure that all software used to conduct ASRS and C3RS requirements, including virtual collaboration environment tools, are approved by NASA and are patched and maintained in compliance with NASA requirements. The Contractor shall request authorization from NASA’s Office of the Chief Information Officer (OCIO) before purchase or use of any software not already authorized for use. All software shall be purchased in the name of the Government.

The Contractor shall deliver all electronic databases, websites, software tools/algorithms/documentation and other software developments/improvements in source and object code format. Websites and other public-facing systems shall adhere to government requirements including, but not limited to, Section 508 Compliance and IT security-related requirements. It is the Contractor’s responsibility to understand these requirements and ensure compliance. Government shall retain rights to all report processing and analysis software developed under the contract. This does not include software for the Contractor’s own internal business processes.

Database Management – The Contractor shall provide the IT system and related services necessary to store and maintain reliable and secure access to large amounts of electronic data. Technical areas of focus include systems engineering, deployment, and operations; storage for near-term, long-term, and archival requirements; shared access and security features; data integrity; backup systems; disaster plans; user interface and access systems; identification of potential sources for required products and services; and assessment of relevant emerging technologies and technical approaches. Data storage retrieval and archives must preserve all security metadata, audit logs, and security-related fields associated with the data.

The Contractor shall design, implement, and administer Oracle and PostgreSQL database servers (MS Windows and Linux) and analyze and resolve database system production problems according to industry standards and best practices. The Contractor shall provide general IT service delivery, including customer support, IT strategic planning, and database security. The Contractor shall, as necessary, extract and convert data to and from different database systems, and data source types that include JavaScript Object Notation (JSON) or Comma-Separated Variable (CSV) to meet data requirements from NASA and federal government partners. The Contractor shall develop database back-up and recovery contingency plans to ensure no data loss and implement them when needed.

Cyber Security - The Contractor shall be responsible for all IT systems, which include firewalls, all the supporting hardware, software, firmware, data, versioning, IT security support systems, vulnerability and patch management, incident response and forensics, log aggregation, and correlation. The Contractor shall comply with all Federal, NASA, Center level, and applicable policies, procedures, standards, and guidelines pertaining to IT security as applied to Federal systems.

The Contractor is responsible for understanding and meeting or exceeding the Agency cybersecurity requirements and ensuring that all cybersecurity findings are tracked, reported, and mitigated. The Contractor shall maintain an expert knowledge of National Institute of Standards and Technology (NIST) and NASA IT requirements such as, but not limited to, NASA Policy Directives (NPD), NASA Policy Regulations (NPRs) available in the NASA Online Directives Information System (NODIS), and similar.

and understand their security implications for the ASRS and C3RS Systems. The goal is to protect NASA system and network resources from internal and external cyber-security related threats.

IT System Patch Management and Deployment - The Contractor shall apply, maintain and monitor patches to address system vulnerabilities via the Agency’s approved patch management tool and other means as necessary. The Contractor shall ensure that knowledgeable staff is involved with monitoring of the Patch Management tools to ensure that the latest vulnerabilities are being mitigated by the vendor and those patches are being properly tested and deployed. The Contractor shall address any gaps with additional mitigating tools, as needed. The Contractor shall ensure all IT vulnerabilities identified by NASA (such as, but not limited to, NASA-issued Mitigation Action Requirement (MAR) vulnerabilities) and the Department of Homeland Security (DHS)) are mitigated by the mitigation due date. If unable, the Contractor shall notify NASA (COR) and the NASA designated official (e.g., SOC) before the deadline

• improvements to report processing capabilities and tools to increase quality and efficiency of report processing

• Improved usability of electronic report submission mechanisms, including mobile-friendly mechanisms, and partner report-sharing mechanisms (e.g. ASAP and PRT portals)

• Improved efficiency of ID strip return process, including digital proof of submission

• Improved data retrievability of reports, text search, and data query tools

• Enhanced data analysis methods and tools

• Expanded information sharing products and broad dissemination of safety information.

• Data visualization of safety reporting metrics

• Reporting forms for new ASRS and C3RS domains and/or prototypes for new reporting systems

• Website updates and augmentations

• System augmentations to meet IT security requirements such as updating end-of-life operating systems or software platforms

NASA values the role of human subject-matter expertise for most aspects of report processing and safety issue identification. and any system augmentations must maintain this important system feature. The Contractor shall obtain approval from the NASA ASRS/ C3RS Director prior to developing and/or implementing any enhancements or augmentations. All software developed or introduced during the contract shall be made available without cost to NASA or a future Contractor at the end of the contract,

2.1.5 Records Management Requirements

The Contractor shall be solely responsible for the security of all materials entrusted to it and the Contractor shall not release or disseminate any information regarding ASRS or C3RS without the written approval of the NASA ASRS/C3RS Director.

The Contractor shall maintain the archival and current working ASRS and C3RS Databases, internal ASRS and C3RS incident report screening dataset, and other appropriate data collections for the length of the contract. Other data collections shall include at a minimum an archive of all program deliverables created throughout the duration of the contract (e.g., monthly, quarterly, annual reports; safety products such as Alert Bulleting/FYI notices, newsletters; program reviews and industry presentations). The Contractors shall also maintain the archive of historic materials and records related to ASRS, C3RS, and related legacy systems including the former Patient Safety Reporting System (PSRS) and Security Incident Reporting System (SIRS) that are in files and documents provided by the Government.

The Contractor shall address, as part of the IT Security Management Plan (DRD 17), a description of data and information security requirements, which shall ensure the integrity of the databases, protection of Personally Identifiable Information (PII), and other information. The database elements of the IT Security Management Plan shall follow the format and address the elements as described in the Office of Management and Budget (OMB) Circular No. A-130 and identify how they shall meet the requirements set forth in the NASA IT Security Handbooks.

The Contractor shall adhere to all applicable federal government requirements as specified under the Federal Record Retention Act (https://nodis3.gsfc.nasa.gov/NPR attachments/NRRS 1441.1A.pdf ) and for handling Controlled Unclassified Information (CUI; see https://www.nasa.gov/content/controlled-unclassified-information) when managing confidential data and reports. All staff handling these materials shall complete training with regards to NASA Record Retention Schedule and Controlled Unclassified Information.

At the completion of the contract, these data and other information derived from the data shall be provided to the Government in a form compatible with the operability specified in this document, and with the approval of the NASA ASRS/C3RS Director.

2.2 AVIATION SAFETY REPORTING SYSTEM (ASRS)

The ASRS is a system wherein pilots, air traffic controllers, dispatchers, cabin crew, mechanics, ground operations personnel, Unmanned Aerial Systems (UAS) / drone operators and any other individual associated with the aviation system may voluntarily and confidentially report aviation incidents or potential safety hazards. Operation of this confidential safety reporting system includes the receipt and batching of reports, specific de-identification protocols to protect the identity of the person reporting and any third-party references (e.g., airline company, names of individuals involved, or information that could be used to determine the identity of those involved, see 2.2.1.10), coding of reports to support retrievability, identification and dissemination of safety alerts and other safety products operation and maintenance of large databases, and qualitative and quantitative analyses of data to identify and characterize emerging and recurring safety issues based on the accumulated safety data and information.

Reports are submitted to ASRS from airline Aviation Safety Action Programs (ASAP) and the Air Traffic Safety Action Program (ATSAP) via electronic data transmission protocols developed by NASA. Reports are also submitted directly to ASRS via the ASRS electronic reporting system (http://asrs.arc.nasa.gov/report/electronic.html) as well as via paper reports through the official ASRS P.O. Box. The Contractor shall provide for secure and efficient report transmission through the above listed mechanisms and shall coordinate with airline ASAP, ATSAP, and other partner programs to establish and maintain compatible system interfaces. Efficient processing, de-identification and report management is a major requirement of this work.

Confidentiality of the reporter and their organization is the most critical factor in the success of these voluntary reporting systems. The Contractor shall be responsible for reporter and third-party confidentiality. During the performance of this contract, the Contractor shall at all times protect and preserve the confidentiality of the reporter and any third-party references (e.g., airline company, names of individuals involved, or information that could be used to determine the identity of those involved). This requires maintaining current knowledge of aviation operations and flight deck/air traffic control procedures, as well as airline schedules, terminology and equipage. FAA program requirements are described in the original Federal Register Notices, FAA Advisory Circular 00-46F (or as amended) and 14 CFR 91.25. The current FAA Advisory Circular 00-46F (or as amended) is available on the ASRS website https://asrs.arc.nasa.gov/overview/immunity.html under Program Information / Immunity Policy. Any conflict or question concerning confidentiality shall be provided to the NASA ASRS/C3RS Director for resolution within 2 hours of discovery.

Historical ASRS report intake rates can be viewed in the ASRS Program Briefing (https://asrs.arc.nasa.gov/docs/ASRS_ProgramBriefing.pdf). Approximately 1% of the reports received are paper reports, received by US Mail, and 99% are submitted electronically.

The Contractor shall perform the following ASRS requirements.

2.2.1 ASRS Report Processing Flow

ASRS and C3RS share similar report processing steps though each utilizes its own unique custom software. This software, referred to as the ASRS Analyst Workbench and the C3RS Workbench, will be provided to the Contactor by the Government and is expected to be used by the Contractor for report processing and maintained to meet NASA IT security requirements. The two systems are independent and must remain separated by appropriate procedures, access controls and IT configurations and controls such as firewalls. The SOW will address each reporting system separately and, in the instances where a process may differ between the reporting systems, these will be noted in the separate sections addressing ASRS and C3RS.

The simplified production flow chart of the current ASRS report processing method is presented below (also see the ASRS program briefing located at https://asrs.arc.nasa.gov/docs/ASRS_ProgramBriefing.pdf ). The ASRS processing steps identified in the flowchart shall be monitored and tracked using the ASRS Analyst Workbench report processing software

• Watch List and Special Processing Topics – These are items representing emerging trends in the aviation community and are processed as Full Form reports as directed by the NASA ASRS/C3RS Director. The list of Watch List issues is a dynamic list based on safety concerns that may arise from requests from FAA and industry, as well as NASA or Contractor identified reports that require follow-up or additional reports to understand a safety concern. This set also includes special topics of safety concerns identified by NASA in consultation with FAA, National Transportation Safety Board (NTSB), and industry groups and reports labeled for selected studies (e.g., Structured Callback, Quick Responses, and Topical Research). The watchlist topics will be provided by the Government. All these reports shall undergo Full Form processing. Additionally, currently there are two on-going special studies (Wake Turbulence and HAZMAT; see SOW Section 2.2.3.7; ASRS Safety Products and Analyses; ASRS Topical Research, Analyses, and Special Studies) and these reports shall receive Full Form processing. Additional special study topics may be added in the future.

• Discretionary - These are reports of educational and illustrative value chosen by ASRS Expert Analysts for Full Form processing. The Contractor should maximize the number of discretionary reports that are processed after ensuring that mandatory/bold list, alerts, and special study reports are processed. The NASA ASRS/C3RS Director will communicate report processing goals based on report intake and resource availability. The Contractor shall propose augmentations to report processing capabilities to continually maximize the number of discretionary reports to be processed.

• Abbreviated – Some categories of reports, as defined by the NASA ASRS/C3RS Director, will be de-identified in their entirety for public consumption and processed with a reduced level of coding and without synopses. These reports shall be publicly available in the ASRS database online.

Categories of reports designated for abbreviated processing may change as a function of report intake and will be designated by the ASRS/C3RS Director.

• Sensitive Security Information (SSI) - Reports describing sensitive security concerns, outside the scope of ASRS aviation safety concerns, shall be directed to the NASA ASRS/C3RS Director for disposition.

• Criminal - Reports describing events that would be codified under Title 18 of the United States Code of Federal Regulations as criminal shall be directed to the NASA ASRS/C3RS Director and are solely excluded from inclusion in the ASRS as described in FAA Advisory Circular 00-46F (or as amended).

• Accident - An incoming report presumed to describe an “accident” shall be verified by comparison to the NTSB on-line accident files (http://www.ntsb.gov). If the event is in the current NTSB online list as a preliminary or final investigation, or the ASRS analysts believes that the report describes an accident, the report should not be processed into the database. No efforts shall be made to gather additional information from sources other than the incident reporter that may identify any aspect of the report that could compromise the reporter’s identity or that of his/her organization.

• Screen Only - The Contractor shall classify all reports that are not identified for Full Form or abbreviated processing as Screen Only and maintain a screening dataset of a limited set of pre-determined data fields for all reports. After returning the ID strip to the reporter, the Contractor shall handle these reports in accordance with the NASA ASRS record retention schedule. The disposition of all original reports will be described in SOW Section 2.2.2.1.

2.2.1.7 ASRS Alert Messages – There are two potential categories of Alert Messages: Alert Bulletin (AB) or For Your Information (FYI) Notices. The Contractor shall identify an ASRS Expert Analyst who will serve as the ASRS Alert Message Coordinator. The Alert Coordinator determines from the screened reports tagged as potential alerts whether a report is an AB or FYI based on the potential risk and the systemic safety-wide value of the report and with consideration of any potential de-identification risks.

Additionally, ABs or FYIs may be selected for presentation at the monthly NASA ASRS/FAA Safety Telecon. This process requires expert operational and human factors judgment and decision-making skills. The AB category is reserved for those events determined to be potentially significant safety hazards. The FYI category is for those events determined to be of a lesser severity, but important as safety information to be distributed to those parties involved in a potential solution. The AB and FYI categories are mutually exclusive, but they can overlap with the monthly NASA ASRS/FAA Safety Telecon items. One report or a collection of reports describing a safety issue of concern can trigger an Alert Message.

After initial selection by the screening process, the ASRS Alert Message Coordinator performs a preliminary evaluation to determine if the report warrants an alert and if additional information is needed to evaluate the incident report. If it is determined that the report shall be developed as an AB or FYI, the ASRS Alert Message Coordinator shall refer the report immediately to the appropriate ASRS Expert Analyst for analysis and possible callback to the reporter for confirmation and supplemental information needed to understand the safety issue. Any time-critical reports, as determined by the ASRS Expert Analysts (i.e., recommended processing in less than 30 calendar days due to safety content), shall be directed to the NASA ASRS/C3RS Director within 24 hours of identification.

Any report, if not initially identified as an alert in the screening process, can be brought into the Alert Message process at any stage of analysis. This report is tracked as a “Walk-In” Alert Message. The reasons that any potential report may be determined to be inappropriate as an Alert Message shall be documented in a status log for future reference.

The Contractor shall track reports that require further information or follow-up at any time in the screening and alert notification process, including after the alert has been issued. The follow-up by the analysts may include callbacks to the reporters, searching the current database for similar reports, and monitoring future incoming reports that may contribute to the understanding of the potential safety issue.

2.2.1.8 ASRS Multiple Report Matching (MRM) - The Contractor shall match all incoming reports on the same incident and combine them into a joint incident record for further analysis and processing.

Approximately 25% of ASRS reports received can be matched (e.g., a Captain report matched with a First Officer report on the same event). In some cases, several reports will be received on the same incident from the flight crew, cabin crew, mechanic, and air traffic control. The Government will provide the Multiple Report Matching software program currently used to accomplish this requirement. It is included in the current ASRS Analyst Workbench. The Contractor shall capture the relevant information required by the software necessary to complete the matching process. Once these separate reports are matched, they become a record. Records are the completed files entered into the ASRS Database. Retention of these limited data fields of the MRM data is captured for 100% of all reports and is included in the Internal ASRS Screening Dataset that can be used to describe features of the total report intake.

2.2.1.9 ASRS Report Coding and Full Form Processing - For reports selected for Full Form processing, the ASRS Analysts shall analyze the report or record, capture the data provided, summarize information gathered in their analysis, and provide the analyst’s evaluation and recommendations for report disposition. Full Form processing yields a full evaluation that captures the safety information provided in the report using an established taxonomy which contains over 1,200 coding fields. The analyzed report shall be coded using the existing ASRS Database coding fields and taxonomy (See https://asrs.arc.nasa.gov/docs/dbol/ASRS_CodingTaxonomy.pdf). From time to time the coding taxonomy may require updates to reflect current aviation operations, all changes must be approved by the NASA ASRS/C3RS Director before implementation. The coding process requires expert operational and human factors judgment and decision-making skills. Processing ASRS safety reports is accomplished through the consistent application of report screening, coding, de-identification and alerting criteria, which have been established to maintain data integrity and consistency. Expert Analysts are required to have over 10 years of expertise in their domain (e.g., pilots, air traffic control, Unmanned Aerial Systems (UASs), dispatch, and maintenance, etc.). Even with the required domain expertise, it is estimated that training a new Expert Analyst on the ASRS specific report processing procedures and taxonomy requires a minimum of six months on-the-job training with the Contractor providing careful monitoring and feedback to attain full competency.

During the process of analysis, the analysts shall consult all relevant references (e.g., Navigation Charts, aircraft manuals, schedules). The analyst reference material is largely available online however, some reference material requires a monthly or annual fee that is the responsibility of the Contractor.

2.2.2 ASRS Information Systems and Processes

The Contractor shall adopt and maintain the following established ASRS systems and processes.

2.2.2.1 ASRS Records Management and Processing Logs - The Contractor shall retain and maintain within the approved secure Contractor facility all original reports, attachments, phone records, and any other identifying logs for a time period specified by NASA to be compliant with government record retention schedules for ASRS and Related Systems. At the end of the appropriate retention periods, the Contractor shall box these draft report materials, seal the boxes and mark according to NASA Controlled Unclassified Information (CUI) policies, and contact NASA Ames Research Center Document Control for secure pick-up and destruction. The government record retention schedule applies to electronic records as well. At the end of the appropriate retention periods, the Contractor shall completely remove electronic digital files from servers and other computers to assure compliance with record retention policies.

The Multiple Report Matching (MRM) files shall be retained only for the period of time required for matching reports, normally no longer than 60 calendar days. Following the MRM process in the ASRS Analyst Workbench and final de-identification, a limited set of data fields for every ASRS report shall be retained permanently for use in the internal ASRS Screening Dataset and the remainder of the report shall be handled as per NASA ASRS record retention policies above.

Report tracking logs which record which staff members had contact with the report shall be maintained throughout the length of the contract and undetermined future.

The ASRS Alert Message log shall be retained throughout the contract and in compliance with the government record retention schedule. The Contractor shall maintain these files in a secure area at the Contractor's facility or suitable secure, off-site location approved by NASA. The Contractor shall also maintain the files in a manner such that individual reports can be accessed and reviewed readily if necessary. The Contractor shall provide limited access to these maintained files so that only personnel authorized in accordance with the Contractor's ASRS and Related Systems Facility Security Plan are granted access.

2.2.2.2 ASRS Data Processing, Storage, and In-House Data Retrieval – The Contractor shall maintain the capability for secure report processing via the ASRS Analysts Workbench, data storage for all de-identified records stored in the ASRS database and the screening dataset, and a system for archiving selected data and data products such as Alerts/FYI notices and feedback responses, CALLBACK newsletters, telecons presentations, industry presentations, special studies, quick responses, and database search requests, The expected capability requirement is to provide for data input, data processing, data storage, and rapid retrieval of data by the ASRS staff, NASA ASRS/C3RS Director, and others as authorized by the NASA ASRS/C3RS Director including access to the fully de-identified data on the public-facing website. The Contractor shall maintain the ASRS Database, internal incident report screening dataset, and other appropriate data collections for the length of the contract. At the completion of the contract, these data and information derived from the data, shall be provided to the Government with the necessary software and hardware to ensure access.

The Contractor shall be solely responsible for the security of all materials entrusted to it (also see SOW Section 2.1.5 on this topic as applied here to ASRS). In addition to data security provisions mentioned above, the Contractor shall not release or disseminate any information regarding ASRS without the expressed written approval of the NASA ASRS/C3RS Director.

The Contractor shall back-up all data every 24 hours and have the capability to regenerate data archives remotely if needed. The Contractor shall provide a secure location for the back-up data media remote from the main Contractor facility to provide redundancy in the event of damage that may result from fire, earthquake, flood, or other disasters. This shall be addressed in the Contractor’s Contingency Plan (See

DRD 23).

ASRS Report Sets, and update them every six months, adhering to the current format. For each update, new records displace the oldest records. Records within each Report Set may be initially identified using automated searches but must then be screened by ASRS analysts to assure their relevance to the topic.

The current report sets can be found at: https://asrs.arc.nasa.gov/search/reportsets.html. The Contractor shall establish a system for updating the topical reports sets posted on the ASRS website to ensure content is refreshed every 6 months.

2.2.3.7 ASRS Topical Research, Analyses and Special Studies - The Government will make periodic requests to the Contractor for research on specific topics. These topics are determined by agreements between NASA ASRS and others, including FAA, NTSB, NASA, and aviation organizations. Examples of topical research include expanded Full Form processing of selected topics, secondary coding analysis, and Supplemental Question Sets (SQS).

Secondary coding analysis is the process of codifying existing report narratives using a coding rubric customized to answer a particular research question or operational query. ASRS Secondary coding may be conducted as a follow-up assessment for unique characteristics of the incident data that require deeper understanding by classification of the type of events, contributing factors, and the associated report data. For example, secondary coding analysis might entail using fixed-field codes (such as a combination of incident date, event type, and reporter function) to define a manageable dataset of 100 to 300 reports. Typically, a coding rubric is developed by the Contractor with input from NASA and other government collaborators to answer specific research questions. The report narratives are reviewed by ASRS analysts and coded using the coding rubric. Secondary coding of ASRS narratives typically requires subject area expertise of Expert Analysts (e.g., ATC, Airline Pilot, dispatcher etc.). De-identified data from the fixed fields and the results of the secondary coding effort are delivered in a presentation and/or written research report format.

For studies employing Supplemental Question Sets (SQS), the ASRS staff contact the submitters of qualifying ASRS reports to gather supplemental information. A SQS is typically a combination of rating scales and open-ended questions. The Contractor shall develop the SQS in collaboration with the NASA ASRS/C3RS Director and other Government partners and with adherence to survey and questionnaire design methodology. The ASRS analyst conducts a Callback to the ASRS reporter and invites their participation in the SQS. The SQS may be administered by phone, internet-based survey or similar method depending on project needs. The data collected during a SQS shall be fully de-identified and results shall be delivered in a presentation format and/or written research report.

Specific details of each study (including scope or work, expected milestones and deliverables, and deadlines) will be communicated by the government at the commencement of each study.

Currently there is a long-running topical research project regarding Wake Vortex Encounters. This project is likely to proceed through the length of the contract and entails weekly summary reporting due by close of business on Thursday of each week, SQS, and quarterly data presentations. Additional information on this topical research project is available at the ASRS website (http://asrs.arc.nasa.gov), and examples of previous projects can be found at the same URL under ASRS Research Papers. There is also an on-going analysis requirement for HAZMAT-related reports that requires an annual secondary coding of all HAZMAT related reports using an established coding rubric, coupled with a quantitative data summary, semi-annual report metric summaries, and monthly report intake/processing metrics. Ongoing abbreviated processing of General Aviation Reports and monthly report processing metrics summaries is expected to continue through the period of performance of the contract.

It is expected that additional special studies will be added. These projects vary widely in scope from short, one-month projects to larger-scale, multi-year efforts and the reporting requirements typically include monthly or quarterly summary statistics of report intake and processing rates and report compilations.

2.3 CONFIDENTIAL CLOSE CALL REPORTING SYSTEM (C3RS)

The Confidential Close Call Reporting System (C3RS) is operated by NASA for the Federal Rail Administration (FRA). The current C3RS is based upon the NASA ASRS model and has been modified and customized for the rail transportation domain. C3RS task requirements follow the general descriptions described previously for ASRS however important differences are described in the following sections the requirements to be performed will be coordinated with the NASA ASRS/C3RS Director on a continuous basis.

The C3RS is a voluntary system wherein rail engineers, conductors, dispatchers, carmen, machinists, signal maintainers and any other individual associated with the operation of the railroad system may report events or incidents or safety hazards that have been experienced or witnessed. Operation of the C3RS includes the processing of reports, specific de-identification protocols to protect the identity of the person reporting and the rail carrier, identification of safety hazards, analysis of data (qualitative and quantitative), operation and maintenance of a large database, and presentation of findings based on the accumulated safety data and information.

As in the ASRS, confidentiality of the reporter is the most critical element to the success of this system.

The Contractor shall, at all times during the performance of this contract, protect and preserve the confidentiality of the reporter and any third-party references (e.g., rail company, names of individuals involved). The rail reporting system requirements are specified and described in the FRA’s Implementing Memorandum of Understanding (IMOU) approved by each rail carrier, labor organizations, and FRA.

Examples of past FRA IMOUs are available through a link from the FRA C3RS website:

https://railroads.dot.gov/human-performance/c3rs/confidential-close-call-reporting-system-c3rs.

C3RS receives reports from all railroad crafts (Transportation, Mechanical, Engineering). Therefore, reports are submitted to NASA C3RS from a wide range of rail personnel including conductors, engineers, carmen, dispatchers, and signal maintainers.

The simplified production flow chart of the current C3RS report processing methodology is presented below. It is similar to ASRS with some important exceptions. C3RS utilizes its own custom report-processing software, distinct and separate from ASRS. The processing steps identified in the flowchart shall be monitored and tracked using the C3RS Analyst Workbench which will be provided to the Contractor by the Government. All steps shown in the C3RS workflow that involve raw, identified, data shall be completed in the secure Contractor facility. Raw reports containing confidential information may not be accessed from remote locations. All reports shall be processed to the screening stage (see 2.3.1.6) at which point a report may be classified for further Full Form processing (with or without call back), or Abbreviated processing (see 2.3.1.6).

Approximately 1 to 2% of the reports received are paper reports, received by US Mail, and the remainder are submitted electronically via direct submission at the NASA C3RS website.

The Contractor shall perform the following C3RS requirements.

During the Screening and Classification stage, a report may also be classified as one of the following categories:

• Alert Messages: Alert Messages (also see 2.3.1.7) are determined by the C3RS Expert Analysts as significant rail hazards that may have system-wide accident prevention potential or may describe lesser severity incidents that may be appropriate as safety notices. All Alert messages are further classified as an Alert Bulletin, a For Your Information Notice, or a Carrier Heads-Up notification (see 2.3.1.7). All of these undergo Full Form processing with callback.

• Special Studies and Emerging Issues – These special studies or items representing emerging trends in the railroad community shall be identified during the performance of this contract. The NASA ASRS/C3RS Director will provide the details and requests for these studies when they are identified.

• Sensitive Security Information (SSI) - Reports describing sensitive security concerns, outside the scope of C3RS safety concerns, shall be directed to the NASA ASRS/C3RS Director for disposition.

• Criminal – Reports describing events that would be codified under Title 18 of the United States Code of Federal Regulations as criminal shall be immediately submitted to the NASA ASRS/C3RS Director and are solely excluded from inclusion in the C3RS as described in FRA and rail carriers IMOUs.

• Accident – An incoming report presumed to describe an “accident” shall be verified by whether the event reaches the “reporting limits” for mandatory reporting to FRA or is under the “reporting limits” as described in each rail carriers IMOU. If it is determined by the C3RS Expert Analysts that the report describes a reportable accident, the report shall be submitted to the NASA ASRS/C3RS Director within 5 working days of identification. Any other reports not determined to be reportable accidents shall be included in the incident report process.

• Screen Only – Rarely, reports with no safety content may be classified as screen-only, after approval by the…