Att_(1)_DRAFT_THXX_PWS.pdf

Contract N6134019-R-0007 Attachment 1DRAFT

DRAFT Page 1

*DRAFT*

Performance Work Statement for

TH-XX Aircraft Procurement

[Contract #]

[Revision XXX]

DD MMM YYYY

Prepared by:

Program Executive Officer - Tactical Aircraft Programs (PEO(T))

Naval Undergraduate Flight Training Systems (PMA-273)

48187 Standley Road, Building 4010, Room 228

Patuxent River, MD 20670

Approved by:___________________

DISTRIBUTION A. Approved for public release: distribution unlimited.

DRAFT Page 2

LIST OF ACRONYMS

AHTS Advanced Helicopter Training System

CAI Computer-Assisted Instruction CAC Common Access Card CDRL Contract Data Requirements List CFR Code of Federal Regulations CLIN Contract Line Item Number CLS Contractor Logistics Support CNATRA Chief of Naval Air Training

DCMA Defense Contract Management Agency

EI Engineering Investigation ESOH Environmental, Safety, and Occupational Health

FAA Federal Aviation Administration FL Florida FMS Flight Management System FPB Final Product Baseline FST Fleet Support Team FTD Flight Training Device

GAT Government Acceptance Testing GBTS Ground Based Training System

HUMS Health and Usage Monitoring System

IAW in accordance with ICA Instructions for Continued Airworthiness ICW Interactive Courseware IFR Instrument Flight Rules IP Instructor Pilot IPR Integrated Program Review ISC Industry Steering Committee

MD Maryland

NAS Naval Air Station NATOPS Naval Aviation Training and Operating Procedures Standardization

OGR On-Site Government Representative

PBS Performance Based Specification PEO(T) Program Executive Office – Tactical Aircraft Programs PKI Public Key Infrastructure PMA Program Manager, Air PWS Performance Work Statement

SCORM Shareable Content Object Reference Model SMP Sustainment Management Plan STC Supplemental Type Certificate

TC Type Certification TCH Type Certificate Holder

USB Universal Serial Bus

DRAFT Page 3

Table of Contents

1.0 Scope

1.1 Objective

1.2 Background

2.0 References

3.0 Requirements

3.1 TH-XX

3.1.1 Contractor Responsibilities

3.1.2 FAA Airworthiness Certification

3.1.3 FAA IFR Certification

3.1.4 User Interface Configuration

3.1.5 Final Product Baseline

3.1.6 Government Furnished Equipment/Materiel

3.1.7 Military Aircraft Identification Information

3.1.8 TH-XX Flyaway Kit

a. Window Covers

b. Wheels for Skids

3.1.9 External Hoist

3.1.10 Software Subscriptions and Licenses

3.1.11 Software End Items

3.1.12 Aircraft Logs and Records

3.1.13 Acceptance Test Procedures

3.1.13.1 Contractor Acceptance Test Procedures

3.1.13.2 Government Acceptance Testing

3.2 Peculiar Support Equipment

3.3 Mission Planning System

3.4 Instructor Pilot Training

3.4.1 TH-XX IP Training Requirements

3.4.2 TH-XX IP Training Curriculum

3.4.3 Flight Hours for Currency

3.5 NATOPS Flight Manual

3.6 Maintenance Personnel Training

3.6.1 TH-XX Maintenance Training Requirements

3.6.2 TH-XX Maintenance Training Curriculum

3.7 Third Party Maintenance Training

3.8 Maintenance Technical Publications

3.8.1 Integrated Electronic Technical Manual

3.8.2 Ground Transportation Instructions

3.9 Contractor-Government Data Submission

3.9.1 Data Management

3.9.2 Data Deliverables

3.9.3 Data Access

a. Access Control

b. Interface

3.10 Instructions for Continued Airworthiness

3.11 Non-FAA ICA Data

3.12 Program Management Reviews

3.12.1 Post-Award Conference

3.12.2 Integrated Program Review

3.13 Program Progress/Status Reporting

3.14 Spectrum Management

3.15 Sustainment Engineering

3.15.1 Engineering/Logistics Reach Back

3.15.2 Field Service Representative

3.15.3 Non-Standard Repairs and Investigation Process

3.15.4 Sustainment Management Plan

3.15.5 Industry Steering Committee

DRAFT Page 4

3.16 Initial Sparing Analysis

3.17 Airframe Analysis

3.18 Structural Monitoring

3.19 Prognostics and Health Management Analysis

3.20 Obsolescence / Diminishing Manufacturing Sources & Material Shortages

3.21 Environmental, Safety, and Occupational Health

3.22 Energetics List

3.23 Configuration Management

3.23.1 Configuration Data

3.23.2 Configuration Management Plan

3.23.3 Configuration Status Accounting

3.23.4 Request for Variance

3.23.5 Engineering Change Proposals

3.24 Cybersecurity

3.25 Operational Security

3.25.1 Contractor Identification Badges

3.25.2 Government Base Access

3.26 Training Curriculum Development

APPENDIX A - TH-XX Cybersecurity Plan

DRAFT Page 5

1.0 Scope

1.1 Objective. This Performance Work Statement (PWS) describes the production, delivery, engineering, and training curriculum support requirements for the Advanced Helicopter Training System (AHTS) TH-XX aircraft procurement.

1.2 Background

a. The mission of Chief of Naval Air Training (CNATRA) is to produce aviators and flight officers in sufficient quantity to meet Fleet requirements. Since 1981, CNATRA has utilized a fleet of more than 100 TH- 57B and TH-57C aircraft, corresponding Ground Based Training System (GBTS), and classroom and Computer-Assisted Instruction (CAI) and Interactive Courseware (ICW) to conduct undergraduate advanced helicopter training.

Military instructors utilize the aircraft, and civilian instructors utilize Flight Training Devices (FTDs) and academic testing, to evaluate Student Naval Aviators (SNAs) in the skills required to qualify for designation as helicopter pilots and assignment to Fleet Replacement Squadrons with a standard instrument rating.

b. Since 2005, Training Wing FIVE has utilized the TH-57B/C and associated GBTS to conduct intermediate tilt-rotor training. Helicopter and tilt-rotor pilots now make up more than 50% of all Naval Aviators. Current and expected Pilot Training Requirements forecast an annual requirement of more than 600 rotary wing and tilt-rotor pilots, which is estimated to continue to increase through at least 2040.

c. AHTS is a system of systems approach to mitigate capability and capacity gaps in the current helicopter training components. The AHTS concept will meet advanced rotary wing and intermediate tilt-rotor training requirements for the Navy, Marine Corps, and Coast Guard through the year 2050.

d. AHTS consists of:

1. The helicopter, identified in this document as the TH-XX aircraft

2. GBTS, including Flight Training Devices (FTD), CAI, ICW, and classroom instruction.

3. Contractor Logistics Support (CLS), maintenance, and logistics

DRAFT Page 6

2.0 References

FAA 8110.54 Instructions for Continued Airworthiness Responsibilities, Requirements, and Contents FAA Advisory Circular 121-22C, Maintenance Review Boards, Maintenance Type Boards, and OEM/TCH Recommended Procedures FAA Standard Airworthiness Certificate (FAA form 8100-2) GEIAHB859 Implementation Guide for Data Management ASD-S1000D, Aerospace and Defence Industries of Europe (ASD) International Specification for the Procurement and Production of Technical Publications Title 14 Code of Federal Regulations Rotorcraft, Normal (CFR Part 27), Appendix B DD Form 1494, Application for Frequency Authorization

CNATRAINST 5239.3 CHIEF OF NAVAL AIR TRAINING COMMAND CYBERSECURITY PROGRAM

DODD 8500.01E Information Assurance (IA) DODI 8520.02 Public Key Infrastructure (PKI) and Public Key (PK) Enabling

OPNAVINST 5239.1C NAVY INFORMATION ASSURANCE (IA) PROGRAM

SECNAVINST 5239.3B DEPARTMENT OF THE NAVY INFORMATION ASSURANCE POLICY

DOD 5220.22M National Industrial Security Program Operating Manual AS9100 Quality Management Systems Standard for Aerospace

3.0 Requirements

3.1 TH-XX

3.1.1 Contractor Responsibilities. (CLINs 0X01) The Contractor shall provide all technical, planning, management and manufacturing efforts, as well as all materials, personnel, equipment, facilities, hardware, and software required to execute this contract.

3.1.2 FAA Airworthiness Certification. (CLINs 0X01) The

Contractor, as the Federal Aviation Administration (FAA) Type Certification Holder (TCH), shall deliver to the Government the FAA Airworthiness Certificate (FAA Form 8100-2) for each aircraft. (CDRL A001)

3.1.3 FAA IFR Certification. (CLINs 0X01) The Contractor shall maintain the currency of and deliver to the Government the FAA Certificate (FAA Form 8110-9), Amended Type Certificate, and/or Supplemental Type Certificates (STC) for Title 14 Code of Federal Regulations (CFR) Rotorcraft, Normal (CFR Part 27) Appendix B through the year 2050. (CDRL A001)

3.1.4 User Interface Configuration. (CLINs 0X01) All aircraft delivered under this contract shall have identical user interface, to include cockpit and cabin layout, functions, operations, procedures, and associated publications.

3.1.5 Final Product Baseline. (CLINs 0X01) The Contractor Final Product Baseline (FPB)(also known as Baseline Configuration) shall be based on the manufacturing baseline as established by the first aircraft of each of the full rate delivery lots. The Contractor shall deliver the documented FPB by lot to the Government. (CDRL A002)

3.1.6 (CLINs 0X01) Government Furnished Equipment/Material. The Contractor shall provide all materials, personnel, equipment, facilities, and hardware/software required to produce aircraft for this contract. There will be no Government furnished equipment or materiel utilized in support of this contract.

DRAFT Page 7

3.1.7 (CLINs 0X01) Military Aircraft Identification Information.

The Government will provide military identification information such as type/model number, aircraft side numbers, unit designator, and radio call sign numbers, to the Contractor no later than 90 days prior to aircraft delivery to the Government to facilitate painting. The Contractor shall deliver to the Government the final paint schematic for the TH-XX aircraft.

(CDRL A027)

3.1.8 TH-XX Flyaway Kit. (CLINs 0X01) The Contractor shall provide a flyaway kit with each aircraft delivered. The flyaway kit shall contain the equipment normally required for aircraft handling and daily storage such as protective covers (inlet, antennas, displays, windshield), rotor blade tie-downs, equipment pins, etc. The flyaway kit shall include, but is not limited to:

3.1.8.1 Window Covers. With each aircraft delivery, the

Contractor shall provide removable window cover devices capable of reducing ultraviolet radiation and heat damage for the protection of interior equipment when the aircraft is parked and not in use.

3.1.8.2 Wheels for Skids. If the TH-XX aircraft is capable

of having the skids removed and replaced with wheeled landing gear, or if the landing skids are capable of having wheels attached to the skids, then the Contractor shall provide these alternate wheel attachments with each aircraft delivery.

3.1.9 External Hoist. (CLIN 0005) The Contractor shall provide an external hoist capability on all TH-XX aircraft as described in the Performance Based Specification (PBS), Attachment 2. If the hoist capability requires an “A Kit” or fixed provision, it shall be installed on each aircraft prior to delivery. The contractor shall deliver 25 external hoist devices: hoist motor device, additional attaching hardware, and associated storage containers for the hoist when removed from the helicopter.

3.1.10 Commercial Software Subscriptions and Licenses. (CLINs 0X01) The Contractor shall deliver with each aircraft an active commercial subscription or software license for any required support to the TH-XX aircraft, such as commercial navigational databases (Garmin or Jeppesen) for both civil and military airfields. The active subscription shall be provided to the Government with the paid subscription along with any account or website login information associated with the subscription. The Contractor shall deliver active subscriptions or licenses for all software embedded in the aircraft, aircraft subsystems, support equipment, and any mission planning systems. (CDRL A003)

3.1.11 Software End Items. (CLINs 0X01) In addition to software installed on required support equipment (referenced in paragraph 3.2), the Contractor shall deliver to the Government an additional copy of all software required to support the TH-XX aircraft system, including, but not limited to, software required to conduct a system reboot; reinstall any operating systems, programs, or applications; perform system diagnostics; or perform system updates. The Contractor shall deliver one copy of all such software on the media utilized by the aircraft. The contractor shall deliver any peripheral hardware required to connect this media to a computer via Universal Serial Bus (USB) or USB-compatible device as support equipment per paragraph 3.2. (CDRL A004)

3.1.12 Aircraft Logs and Records. (CLINs 0X01 and 0X02) The

Contractor shall deliver with each aircraft delivery an up-to-date Aircraft

DRAFT Page 8

Maintenance Log Book, and all other information documenting current airworthiness including but not limited to inspections and current weight and balance determination. (CDRL A005)

3.1.13 Acceptance Test Procedures (CLINs 0X02)

3.1.13.1 Contractor Acceptance Test Results. The

Contractor shall deliver a copy of the Contractor’s in-house acceptance testing results, 10 days prior to the Government Acceptance Test (GAT) of each aircraft. (CDRL A006)

3.1.13.2 Government Acceptance Testing. Final inspection

and acceptance will be conducted at the Contractor’s CONUS facility. If the Contractor’s manufacturing facility is located OCONUS, preliminary inspection may be conducted at the Contractor’s manufacturing facility. The Government will utilize the Government approved acceptance test approach proposed by the Contractor and incorporated into the contract by attachment. Defense Contract Management Agency (DCMA) representatives (pilots and non-flying personnel) will conduct GAT that will include a limited verification of delivered aircraft equipment against the PBS and Configuration List as part of the DD250 acceptance of each aircraft. The Contractor shall deliver each aircraft with all embedded software, operating systems, programs, and/or applications installed and operational. Any required subscriptions, such as for commercial navigational databases, shall be activated by the contractor.

The DCMA Government Flight Representative will be the approval authority for all DD250 aircraft flights. The Contractor shall provide all resources, manpower and supplies required to perform and support the GAT, including, but not limited to: spares, repair parts, consumables including petroleum, oil, and lubrication, and maintenance support (field and sustainment/depot level).

(CDRL A007)

3.2 Peculiar Support Equipment. (CLINs 0X04) The Contractor shall provide appropriate tools, fixtures, support equipment, support and ground handling equipment, and maintenance stands. Tools and support equipment shall contain the equipment normally required for aircraft support, based upon the size of the fleet and predicted usage. Support equipment shall include, but is not limited to, blade fold kits, fuel and power cart adapters, any equipment required for Health and Usage Monitoring System (HUMS) analysis, software loading peripheral hardware and cables.

3.3 Mission Planning System. (CLIN 0006) The Contractor shall deliver to the Government 25 mission planning systems, including any required hardware, software, and peripheral devices, that are compatible with the Flight Management System (FMS) on the TH-XX. The mission planning system and associated components shall be delivered to the designated Government representative at Naval Air Station Whiting Field upon delivery of the TH-XX.

Refer to Appendix A TH-XX Cybersecurity Plan for additional requirements.

3.4 Instructor Pilot Training. (CLIN 0007) The Government requires an initial cadre of instructor pilots (IP) to be trained on TH-XX aircraft prior to delivery of the first aircraft to the Government and flight hours for currency.

3.4.1 TH-XX IP Training Requirements. The Contractor shall

provide ground and flight training on the TH-XX aircraft for 25 Government IP at a Contractor-designated training facility. The Contractor shall schedule TH-XX IP training with the concurrence of the Government. TH-XX IP training should commence 45 days after contract award and complete all 25 Government IP no later than five months after contract award, with as many Government IP

DRAFT Page 9 being trained simultaneously as possible. The Government will provide lodging and per diem to Government attendees. The Contractor shall provide one copy of the course materials to each IP (student) at the commencement of the IP training. Contractor IP training shall be based on an aircraft that meets at least the TH-XX aircraft type and model configuration, and should meet the TH-XX aircraft series configuration, if available. Contractor flight training shall include the following topics:

a. Aircraft systems

b. TH-XX aerodynamics

c. Normal procedures (day and night)

d. Emergency procedures

e. Aircraft familiarization (day, night-unaided, energy management)

f. FMS operation and instrument navigation

g. Formation flying

h. Night vision device systems and flight training

i. Aircraft-specific instructional procedures

j. Logistics familiarization (hoist, cargo hook, confined area and pinnacle operations)

k. Any differences between the training aircraft and the final configuration of the TH-XX aircraft purchased by the Government

3.4.2 TH-XX IP Training Curriculum and Student Materials. The Contractor shall deliver to the Government the TH-XX IP training curriculum that will include the aircraft flight manuals and training publications supporting the TH-XX IP training. The Contractor shall provide one copy of any training curriculum materials and student course materials associated with the Contractor IP training course to the Government and one copy of course materials to each Government IP at the commencement of the training.

The Government also intends use the training materials to inform or supplement Government curriculum development. (CDRL A008)

3.4.3 Flight Hours for IP Currency and Curriculum Development. The Contractor shall provide four hours of flight time per month to each of the 25 Government IPs in an OEM owned TH-XX representative aircraft in order to maintain IP currency and support curriculum development, which will conclude at completion of first lot deliveries.

3.5 NATOPS Flight Manual. (CLIN 0009) The Contractor shall establish a bi-weekly working group to produce a Naval Aviation Training and Operating Procedures Standardization (NATOPS) Flight Manual for the TH-XX aircraft.

This working group will be supported by Contractor technical writers, pilots, and engineers as well as Government participation consisting of, but not limited to: pilots, NAVAIR engineers, and Government third party support, as required. The schedule for NATOPS Flight Manual development and working group meetings shall be incorporated into the contractor’s schedule. The Contractor shall format the OEM flight manuals and additional information required by the MIL-DTL 85025B into NATOPS format such that FAA Airworthiness

DRAFT Page 10 certification can be maintained. The Contractor shall deliver a baseline TH- XX Flight Manual that adheres to the NATOPS format. (CDRLs A013 and A028)

3.6 Maintenance Personnel Training. (CLIN 0008) The Government requires an initial cadre of Government maintenance personnel to be trained on TH-XX aircraft prior to the first aircraft delivery to the Government.

3.6.1 TH-XX Maintenance Training Requirements. The Contractor shall provide TH-XX maintenance training to 10 Government maintenance personnel at a Contractor-designated training facility. All maintenance training shall be completed no later than 30 days prior to delivery of first aircraft. The Government will provide lodging and per diem to Government attendees. This Contractor maintenance training shall be based on an aircraft that meets at least the TH-XX aircraft type and model configuration, and should meet the TH-XX aircraft series configuration, if available.

3.6.2 TH-XX Maintenance Training Curriculum. The Contractor shall provide one copy of any training curriculum materials and student course materials associated with the Contractor maintenance training course to the Government and one copy of course materials to each Government maintenance person at the commencement of the training. (CDRL A009)

3.7 Third Party Maintenance Training. The Contractor shall coordinate with the Government and the Government’s third-party CLS provider to establish a mutually agreed upon plan for training CLS maintenance personnel on the TH-XX aircraft. (Note: The Third Party Maintenance Training is not priced as part of this contract.)

3.8 Maintenance Technical Publications (CLINs 0X02)

3.8.1 Integrated Electronic Technical Manual (IETM). The

Contractor shall provide to the Government an IETM, as defined in ASD-S1000D, or commercially available equivalent system. (CDRL A010)

3.8.2 Ground Transportation Instructions. Contractor shall

provide instructions for ground transportation of a TH-XX aircraft. These instructions shall include, at a minimum: system size and weight limits, power requirements, safety procedures, trailer roll on/roll off procedures, and identify any peculiar support equipment required. (CDRL A011)

3.9 Data Submissions (CLINs 0X02)

3.9.1 Data Management. The Contractor shall maintain a data

management program IAW the requirements of this PWS and GEIAHB859 Implementation Guide for Data Management. The Contractor shall maintain an Integrated Data Environment to automate the management and exchange of data products with Government.

3.9.2 Data Deliverables. The Contractor shall deliver all data items electronically via a public key infrastructure (PKI)-encrypted system.

This data item delivery method shall be operational within 30 days after contract award. The NAVAIR External Sharepoint Site (Team Connect) shall be utilized. The Government will provide and approve access as required. The Contractor shall ensure that the proper PKI credentials for all individuals responsible for submissions or receipt.

3.9.3 Integrated Digital Environment(IDE)

a. IDE Control.

DRAFT Page 11

The Contractor shall provide to the Government and third party contractors supporting the AHTS system access to IDE. IDE access shall be through a portal that employs access control to enforce data rights. The contractor shall maintain access authority and provide the Government and third party support contractor accounts that can be transferred when personnel changes.

b. Interface. The primary interface shall support user access via Internet Explorer, Google Chrome, or Mozilla Firefox. The utilization of any “Cloud” storage for Government data in support of this contract is unauthorized unless specifically authorized by the Government Program Information System Security Manager in writing (see Cybersecurity Appendix A). No classified data shall be exchanged on this deliverable submission system. The Contractor shall provide any unique software applications required to access/utilize the data.

3.10 Instructions for Continued Airworthiness. (CLIN 0X02) The Contractor shall deliver all Instructions for Continued Airworthiness (ICA) IAW FAA 8110.54 (Series) through the year 2050. (CDRL A012)

3.11 Non-FAA ICA Data. (CLIN 0010) Through the year 2050, the Contractor shall provide access and use of the following in accordance with Section J, Attachment 3, Specially Negotiated License/Access Agreement:

3.11.1 TH-XX engineering design data and analysis to the

Government for development of repairs outside the scope of FAA 8110.54 (Series) ICA. TH-XX repair procedures developed by the Government will be provided to the Contractor for disposition under the Contractor’s TCH authority and formal issuance IAW FAA 8110.54 (Series) ICA procedures.

3.11.2 New and revised product baseline drawings including wiring harnesses and diagrams, models, product baseline specifications, and associated lists implementing approved Class I ECPs.

3.11.3 Source data (beyond that provided to commercial customers as part of Contractor’s standard commercial practice) pertaining to sustainment and improvement of products including maintenance plans, technical publications, training material, reliability and maintainability data, and spares modeling predictions.

3.12 Program Management Reviews

3.12.1 Postaward Conference. The Contractor shall host a

postaward conference at the Contractor TH-XX production facility no later than 30 days after contract award. The Contractor shall coordinate, via email, the conference date and an agenda with the Government Program Manager’s office 10 days prior to the conference.

3.12.2 Integrated Program Review. The Contractor shall

participate in two Integrated Program Reviews (IPR) each year of the contract. Each IPR will be tailored to include the current program status and current issues. The Contractor shall be prepared to host one IPR each year at the Contractor facility. The other bi-annual IPR will be conducted at NAS Patuxent River, MD, or NAS Whiting Field, FL, at the Government’s discretion. The Contractor shall coordinate review dates and the with the Government Program Manager’s office prior to all IPRs.

3.13 Program Progress/Status Reporting. The Contractor shall deliver to the Government a program status report. (CDRL A013)

DRAFT Page 12

3.14 Spectrum Management. The Contractor shall prepare and deliver to the Government Standard Form DD Form 1494, Application for Frequency Authorization. (CDRL A014)

3.15 Sustainment Engineering (CLINs 0X01)

3.15.1 Engineering/Logistics Reach Back. The Contractor shall provide XXXX engineering and logistics support reach back hours, per lot, to support PMA-273 Class Desk, APML, NAVAIR Engineering and Logistics, and the Fleet Support Team (FST). The Contractor shall provide access to source data IAW 3.9.3 Data Access pertaining to sustainment and improvement products including Maintenance Plans, Technical Publications, Training Material, Reliability and Maintainability Data, and Spares Modeling predictions consistent with what the Contractor’s standard commercial practice. The Logistics Manager shall provide quarterly recommendations to the Government team regarding the Contractor Product Support Analysis outputs.

a. Engineering Investigations. The Contractor shall establish procedures to respond to more in-depth analyses associated with basic design engineering/logistics analysis, using the same procedures for support of currently fielded commercial fleet customers. These procedures shall provide a level of support for immediate and standard inquires through this life of this contract.

b. Support Categories and Response Times. The Contractor shall establish conditions and procedures for immediate support (24-hour response), standard support (24 to 80-hour response), and Basic Design engineering analysis (analysis beyond 80 hours required). The Contractor shall ensure these procedures encompass approval and review of non-standard repairs for TH-XX aircraft. (CDRL A015)

3.15.2 Field Service Representative. The Contractor shall

provide an on-site Field Service Representative (FSR) to perform engineering and logistics support, aligned with the continued FAA Airworthiness Certification of the TH-XX. The Field Service Representative (FSR) shall have reach back capabilities to the Contractor Designated Engineering Representative or Other Designated Authority, to ensure continued support to the FST and maintenance activity at NAS Whiting Field, FL. The FSR shall be on-site no later than 30 days prior to first aircraft delivery.

3.15.3 Non-Standard Repairs and Investigation Process. In the event of a non-standard TH-XX repair requirement, procedures developed by the Government will be provided to the Contractor for disposition under the Contractor’s TCH authority and formal issuance IAW FAA 8110.54 (Series) ICA procedures. The Contractor shall establish procedures that allow the Government FST and NAVAIR engineering to coordinate with the Contractor for repair and maintenance support, Engineering Investigations (EIs), and mishap investigations. These procedures shall maintain the Contractor as the engineering authority and TCH for execution of all FAA requirements related to implementing the analysis in support of continued airworthiness resulting from these cooperative engineering efforts.

3.15.4 Sustainment Management Plan. The Contractor shall provide and implement a Sustainment Management Plan (SMP) that establishes roles, responsibilities, and processes for cooperative engineering support of the TH-XX Helicopter and its supporting systems. The Contractor shall provide a SMP that incorporates Government representation in the process established by

DRAFT Page 13

FAA Order 8110.54 (Series), Instructions for Continued Airworthiness (ICA), as applied to the TH-XX. The Government will operate a fleet of 130 helicopters in a controlled environment generating data to assist the Contractor investigating ICA deficiencies such as airworthiness concerns, assessments of potential unsafe conditions, major repairs, or special certification reviews. The SMP shall describe how the Contractor will notify the Government of service bulletins, grounding events, etc. (CDRL A016)

3.15.5 Industry Steering Committee. The Contractor shall allow the Government and the Government third party CLS provider to be part of the Industry Steering Committee (ISC), within the guidelines of FAA Advisory Circular 121-22C.

3.16 Initial Sparing Analysis. (CLIN 0002) The Contractor shall deliver to the Government an initial, predictive analysis of the spares required to be on hand to establish inventory minimum and maximum levels for operation in accordance with the lot delivery inventory ramp up to 130 TH-XX aircraft and 89,918 flight hours per year. (CDRL A017)

3.17 Airframe Analysis. (CLIN 0002) The Contractor shall update the airframe static, dynamic, and fatigue analysis based on the TH-XX Mission Profiles and Usage Spectrum provided in Appendices B and C of the PBS, respectively. The Contractor shall deliver to the Government the results of this analysis. The Contractor shall update and deliver to the Government TH- XX maintenance documentation, periodic inspection content and frequency, operating envelope limits, changes to structural design margins, and any additional recommendations. (CDRL A018)

3.18 Structural Monitoring. (CLINs 0X01 and 0X02) The Contractor shall implement a structural monitoring program for TH-XX aircraft based upon the airframe analysis of PWS Para 3.17 for any airframe components not monitored under normal TCH responsibilities for continued airworthiness. The Contractor shall deliver to the Government the data and results of structural monitoring analysis, and recommendations to prevent structural fatigue.

(CDRL A019)

3.19 Prognostics and Health Management Analysis. (CLINs 0X01) The Contractor shall implement a prognostics and health management analysis program for all TH-XX aircraft delivered under this contract. The Prognostics and Health Management Analysis Program shall collect, download, analyze, and archive HUMS data. The Contractor shall deliver to the Government the prognostics and health management analysis data and results, and any recommendations to improve sustainment and logistics supportability products. (CDRL A020)

3.20 Obsolescence / Diminishing Manufacturing Sources & Material Shortages. (CLINs 0X02) As part of the Program Status Report, the Contractor shall notify the Government upon identification of obsolescence or Diminishing Manufacturing Sources & Material Shortages issues that will impact production. (CDRL A013)

3.21 Environmental, Safety, and Occupational Health. (CLINs 0X01 and 0X02) The Contractor shall support the Government with Environmental, Safety, and Occupational Health (ESOH) assessments and data requirements that ensure Program compliance with applicable ESOH laws, regulations, and Executive Orders. The Contractor shall deliver to the Government TH-XX Noise/Sound Characteristics and Engine Emission Data. (CDRL A021)

DRAFT Page 14

3.22 Energetics List. (CLINs 0X02) The Contractor shall provide a list of energetics material used to maintain the TH-XX platform and peculiar support equipment. (CDRL A022)

3.23 Configuration Management (CLINs 0X01)

3.23.1 Configuration Data. IAW para 3.9.3, IDE Access, the

Contractor shall prepare a report identifying the As-Built Configuration List (ABCL) in accordance with standards for a commercial sale for each as-delivered TH-XX aircraft by Serial and Tail number IAW DI-CMAN-81516.

However, at a minimum the ABCL shall contain the Bill of Materials with part numbers, quantities, and descriptions. In addition, the ABCL shall indicate all Alert Service Bulletins and Service Bulletins that have been applied to the aircraft. (CDRL A023)

3.23.2 Configuration Management Plan. The Contractor shall

perform Configuration Management IAW an AS9100 compliant manner. The Contractor shall deliver a Configuration Management Plan (CMP) to the Government. The Contractor shall ensure that all configuration changes comply with the requirements below and are documented to ensure continuous (without interruption) adherence to the PBS, Attachment J-2. The Contractor shall provide any aircraft configuration updates filed with the FAA for the helicopters being produced under this contract. The Contractor shall ensure that CM issues affecting the TH-XX are addressed in the Progress / Status Report. (Progress / Status Report CDRL, A013) (Configuration Management Plan, CDRL A024)

3.23.3 Configuration Status Accounting. The Contractor shall

maintain an audit trail of the configuration control activity for Configuration Items to ensure establishment of a product baseline and future Government audits. The DD250 for each delivery shall document any variances from the approved baseline in the “as delivered” product. The Contractor CSA system shall identify the current approved configuration identification associated with the TH-XX by part number and serial number, as applicable.

3.23.4 Request for Variance (RFV). The Contractor shall not

manufacture for acceptance by the Government items that incorporate a variance from requirements of approved documentation unless a Request for Variance (RFV) has been approved by the Procuring Contracting Officer. The Contractor shall prepare and deliver RFVs in accordance with FAR 52.243-4.

3.23.5 Engineering Change Proposals (ECP). In the event an RFV incorporates a change to the configuration of the aircraft, the Contractor shall prepare and deliver Class I or II ECPs, as applicable. The Contractor shall provide a written request for a change and obtain Procuring Contracting Officer (PCO) written approval via a contract modification prior to incorporating any Class I change. The request shall include a summary description of each anticipated change, the impacts and shall also describe effects and mitigation efforts on contract performance requirements. Changes shall only be incorporated after the required notification has occurred.

Changes not directed by the Government shall not be the basis for any equitable adjustment (CDRL A025)

3.24 Cybersecurity. (CLINs 0X01) The Contractor shall execute TH-XX Cyber Security Plan provided in Appendix A (CDRL A026).

3.25 Operational Security (CLINs 0X01)

DRAFT Page 15

3.25.1 Contractor Identification Badges. Contractor

identification badges will be issued by the Government and shall be worn visibly at all times IAW CNATRAINST 5239.3, DODD 8500.01E, DODI 8520.02, OPNAVINST 5239.1C, SECNAVINST 5239.3B, DOD 5220.22M, and while Contractor personnel are at the Government sites. The Contractor shall furnish all requested information required to facilitate issuance of identification badges to the On-Site Government Representative (OGR). The Contractor shall ensure that all identification badges issued to their employees are returned to the Security Department at the Government site, following completion of the contract, relocation or termination of an employee, or upon request from the OGR.

3.25.2 Government Base Access. Contractor Employees in

possession of a valid Common Access Card (CAC) may utilize their CAC for base access. For employees that do not require or possess a CAC, the Contractor shall be responsible for the cost of enrolling its company and registering its employees through the RAPIDGate Program. A daily one-day pass will be required for employees who are not enrolled in the RAPIDGate Program or do not have a CAC.

3.26 Training Curriculum Development. (CLINs 0101 and 0102) The Contractor shall support the creation of an integrated training curriculum for the TH-XX that incorporates emerging technologies and best-in-practice training solutions. The Contractor shall participate in a working group to produce the integrated training curriculum. The Contractor shall provide technical writers, pilots, and engineers to the Working Group, with Government participation. The new training curriculum shall provide a modernized training capability that consists of Interactive Multimedia Instruction for Instructor Led Training/CAI, and self-paced ICW. The final products shall be owned, updated, and maintained by the Government. The schedule for training curriculum development and working group meetings shall be incorporated into the contract schedule and provided via CDRL A013.

(CDRLs A013 and A027)

DRAFT Page 16

APPENDIX A: TH-XX Cybersecurity Plan

The content of this Cyber Security Plan (CSP) is established for the protection of Government data. Per Department of Defense Instruction (DoDI) 8582.01, industry partners are subject to the following requirements in order to establish a consistent and unified strategy for Government data protection. These requirements must be flowed down to any subcontractors, suppliers, and organizations that process Government data.

This CSP is further been established for the protection of all information being exchanged within this contract. The CSP also establishes the protection requirements of Government data that is processed by any “System” or “software’ that will be delivered to Government.

Per DFARS SUBPART 204.73, Covered Defense Information (CDI) is considered unclassified information. Per Presidential Directive Order 13556, November 2010 Controlled Unclassified Information (CUI) replaces categories and terms of unclassified information such as For Official Use Only (FOUO), Sensitive But Unclassified (SBU) and Law Enforcement Sensitive (LES) with the intent of utilizing a single term to improve uniformity across all Federal agencies. As CDI is a term for unclassified information it falls under the definition of CUI. CDI then must be treated as CUI. CUI will be identified by the Primary Contracting Officer or Government Public Affairs Officer (PAO). CDI will not include information considered proprietary or copyrighted by the Contractor or sub-contractors, or information that is commercially available.

Finally, this Cyber Security Plan (CPS) identifies the data required by the Government to routinely assess the cybersecurity risk to the TH-XX aircraft and associated support equipment purchased under this contract.

The contractor shall execute the TH-XX Cyber Security (CS) Program pursuant to the requirements designated below. The requirements in this CSP shall apply to all sub-contractors, suppliers, and other organizations that process Government data under this contract.

The Government will provide all necessary reference documents or electronic links to those documents not generally available to the industry partner, as required. Throughout the life of the contract, if any instruction or document is replaced or superseded, the replacement or superseding instruction or document shall be applicable to the requirements defined in this CSP.

All CS authority within a program office rests with the civilian Program Information System Security Manager (PISSM). This authority has been designated via an appointment letter by the CS competency and the Program Manager. Questions regarding the requirements set forth in this CS Plan must be directed to the PISSM.

A. CYBER SECURITY

DRAFT Page 17

Cyber Security (CS) is the discipline that protects and defends information and information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation. These measures include providing for restoration of information systems by incorporating protection, detection, and reaction capabilities. The following paragraphs contain United States Public Law as well as Department of Defense (DoD) and Department of the Navy (DON) CS requirements. These CS requirements stem from various DoD, Secretary of the Navy (SECNAV), Office of the Chief of Naval Operations (OPNAV), and Naval Air Systems Command (NAVAIR) policies, directives, and instructions. United States Government herein described as "Government" officials have the authority to review and examine, in conjunction with contractor personnel, the CS controls on any contractor operated system containing government information for the purposes of ascertaining proper CS posture and implementation.

B. ARCHITECTURE

To provide the Government access to their data, the Contractor and subcontractors shall establish compatibility with the U.S. Government Navy/Marine Corps Internet (NMCI). The contractor’s network architecture shall maximize the use of the contractor’s existing infrastructure and that of its subcontractors, suppliers via the commercial Internet in order to maintain compatibility with the U.S. Government Wide Area Networks (WANs), such as NIPRNET, DREN, and NMCI. The contractor shall continue to utilize a network architecture which supports the mission needs of Navy/USMC Programs for the purposes of interoperability while maintaining the quality and timeliness of the technical information, data access, and delivery. The contractor shall utilize all observed network trends for the purposes of ascertaining the successful accomplishment of the preceding. The contractor shall make adjustments to its network infrastructure on an as needed basis for the purposes of meeting the mission requirements. Security measures should be put in place in accordance with OPNAVINST 5239.3 (series), DoDI 8510.01, NIST 800-53 and DoDI 8520.02.

C. CYBER SECURITY PRACTICES

The contractor should adhere to the Department of the Navy’s (DON)’s Cyber Security Program prescribed methodologies for the protection of information to support DON missions. The contractor shall utilize existing methods and processes in order to deliver secure, interoperable and integrated information management (IM) and information technology (IT) to the DON and its contract support. The contractor should ensure that all IT systems, software and interfaces that contain Government data meet government security certification standards and requirements appropriate to the particular classification level of operation as specified by the US Navy, Department of Defense, or other cognizant

DRAFT Page 18 government authority for the purposes of the above mentioned DON goals in accordance with SECNAV M-5239.1. DON CS Program policies are listed in the REFERENCES section.

D. PUBLIC KEY INFRASTRUCTURE (PKI):

1. Public Key Infrastructure (PKI) encryption is the chosen compliant DoD standard for protecting Controlled Unclassified Information (CUI) during transmission. CUI is defined as U.S. Government data that is NOT CLASSIFIED and that has NOT BEEN PUBLICALLY RELEASED. CUI includes but is not limited to data that is labeled or considered: For Official Use Only (FOUO), Privacy data, Contract Information, Unclassified Technical Data, Accountability information, DoD Sensitive But Unclassified (SBU).

Failure to encrypt CUI during electronic transmission is considered a security weakness and must be corrected upon discovery via the contractor personnel responsible for CS. Multiple violations by individuals must be reported to the PISSM by the contractor for resolution. The contractor shall require its personnel to adhere to the required PKI policies stated herein when transmitting CUI.

2. The contractor shall implement DoD PKI policy per DoDI 8520.02. The contractor shall obtain and utilize PKI certificates issued by an approved External Certificate Authority (ECA) for the purposes of protecting all CUI. Approved PKI will be utilized by the contractor, its subcontractors, and suppliers when transmitting CUI via electronic means.

Public Key Enablement (PKE) is the chosen DoD standard for authentication at the application level. The contractor shall utilize PKI when interacting with DoD PKI/PKE information systems and accessing DoD CUI or sensitive information.

E. ELECTRONIC MAIL (E-MAIL):

The contractor shall utilize digital signature and encryption via DoD PKI or ECA digital certificates on all electronic mail (e-mail) messages containing CUI or e-mail messages that discuss any matter that may serve as an Operations Security (OPSEC) indicator, per DoDI 8520.02. If contractor personnel support multiple email addresses for use under this contract, then a separate PKI certificate is required for each email address. Unapproved accounts, such as AOL, HOTMAIL or YAHOO, will not be used for official business under this contract unless specifically authorized to do so by the Government per CJCSI 6510.01F.

F. DATA AT REST: Not applicable to this contract.

G. ASSESSMENT AND AUTHORIZATION (A&A)

DRAFT Page 19

1. For Information Technology (IT) systems which receive process, store, display, or transmit DoD information to be delivered to the government, the contractor shall coordinate with the PISSM to determine the CS requirements for the delivered systems. All delivered IT systems must have the ability to obtain an Authority to Operate (ATO) as defined in DODI 8510.01 and OPNAVIST 5239.1 (series).

2. The AHTS boundary for cybersecurity purposes includes the TH-XX aircraft, associated support and maintenance equipment, and any other device governed by the Contractor’s type certificate authority purchased by the Government under this contract. “External data transmissions” are defined as data transmitted across the cybersecurity boundary. “Internal data” is defined as data transmitted within but does not cross the cybersecurity boundary. The Contractor shall assist and provide necessary documents for the purposes of completing the Risk Management Framework (RMF) process for all delivered IT/IS, where applicable. The Contractor shall provide Objective Quality Evidence (OQE) demonstrating CS defense-in-depth system architecture, including any cybersecurity data provided to the FAA. If the data is already provided in other CDRLs or FAA ICA data, the Contractor shall provide to the Government the location of that data. If the Government determines Contractor OQE is insufficient to support the Government RMF process, the Contractor shall provide additional evidentiary data in sufficient detail as specified by the Government. The cybersecurity data requested shall be provided to the Government for access only and will be utilized by the Government only for supporting the RMF process. (CDRL A026)

H. Cyber Security (CS) Point of Contact (POC)/Cyber Security Workforce (CSWF)

The contractor shall provide a counterpart point of contact to the Program Information System Security Manager (PISSM); herein identified as the CS Point of Contact (POC). The CS POC shall ensure all CS requirements are adhered to. The CS POC will ensure that the contractor team is aware of all CS requirements. The CS POC shall coordinate with the PISSM in all matters related to CS.

I. WEB SITES, ELECTRONIC ROOMS (E-ROOMS), COLLOBORATION TOOLS, & CLOUD

SERVICES

1. The contractor shall utilize DoD compliant PKI digital certificates to use as authenticators for accessing all DoD web sites and/or e-rooms and collaboration tools.

2. The Contractor shall utilize existing Government hosting tools and services, such as VTC websites, e-rooms, and SharePoint sites, as much as possible. In the event that existing Government hosting tools and services cannot be utilized, the contractor shall obtain government approval prior to implementing or utilizing non-Government hosting tools

DRAFT Page 20 or services. If such services are deemed necessary by the government then, these tools shall be web based applications that enhance data delivery and distribution to include electronic collaboration and management tools. These efforts shall supplement existing legacy systems, and the Navy’s goals of web enablement of new technology and applications. Any developed systems shall utilize DoD PKI and PKE digital certificates as an authenticating mechanism and utilize existing encryption methods (i.e. Secure Sockets Layer (SSL) or Transport Layer Security (TLS) for the protection of CUI data.

3. For secure large electronic file exchange requirements, the NAVAIR External Sharepoint Site (Team Connect) may be utilized. The Government will provide and approve access to this site on a required basis. The industry partner shall ensure that the proper PKI credentials are utilized by individuals per section “D” of this CSP.

J. COMMON ACCESS CARDS (CAC) & SAAR-N FORMS

1. The government may approve and issue common access cards (CAC) to personnel supporting this contract on a case by case basis. CAC request shall be initiated using the Trusted Associate Sponsorship System Consent to Monitor (TASS) (https://www.dmdc.osd.mil/TASS/). A Trusted Agent (TA) will be identified by the Government to the Contractor for CAC issuance.

2. CAC applicants shall submit an initial request for a CAC or government credential to the Trusted Agent (TA) and log in to TASS to complete and submit the online application for government credentials.

The sponsoring DoD Agency will provide the Applicant Request Form which is the necessary information and appropriate paperwork required for obtaining a government credential. The contractor shall then vet the Applicant using the DoD approved process. Once the Applicant, Contracting Agency, and Sponsoring Agency provide the necessary information, the Applicant shall submit the required information to the TA.

3. The TA will verify that the contractor has vetted the Applicant and establish the affiliation of the Applicant with…