Performance Work Statement-Integrated Risk Information System Draft.pdf

Air Force Safety Center (AFSEC)

Safety-Integrated Risk Information System

(S-IRIS)

Performance Work Statement

Dated: 17 Apr 2025

P a g e | 2

Revision Date Revision/Change Description and Location

1.0 17Apr25 DRAFT Initial PWS / OPSEC approved

P a g e | 3

TABLE OF CONTENTS

Section 1 – Introduction

Paragraph Description Page

1.0 Introduction 5

1.1 Mission 5

1.2 Objective 5

1.3 Guidance 5

1.4 Scope 5

Section 2 – General Requirements

2.0 General Requirements 6

2.1 Analysis Application 6

2.2 Web-based Capability 6

2.3 Software 6

2.4 Personnel 6

Section 3 – Contract Management Requirements

3.0 Contract Management 8

3.1 Communication 9

3.2 Meeting Minutes 9

3.3 Quarterly Program Management Review 9

3.4 Quarterly Phase Plan / Configuration Control Board 9

3.5 Monthly Status Report 9

3.6 Travel 9

3.7 Work Location 10

3.8 Air Force Training 10

3.9 Non-Personal Services 11

Section 4 – Analysis and Support Requirements

4.0 Analysis and Support Requirements 11

4.1 IRIS Analysis Tasks 11

4.2 IRIS Support Tasks 15

Section 5 – Additional Information and Requirements

5.0 Additional Information and Requirements 18

5.1 Intellectual Property: Data Rights and Software 18

5.2 Government Facilities and Common Access Cards 18

5.3 Security and Protection of Sensitive Information 18

5.4 Contract Phase-In and Phase-out Periods 19

5.5 Quality Control Plan 20

5.6 Packaging 21

5.7 Licenses 21

5.8 Records/Data/Hardware/Software and Documentation 21

5.9 Software 21

5.10 Testing 21

P a g e | 4

5.11 Section 508 Accessibility Standards for IRIS Software 21

5.12 Information Assurance Contractor Training and Certification 22

Section 6 – Deliverables

6.0 Table 1: Deliverables 22

Section 7 – Services summary

7.0 Table 2: Services Summary 26

Section 8 – Contractor Full-Time Equivalent Reporting

8.0 Reserved 29

Appendices

Appendix Description Page 1 Acronyms 30 2 Definitions 32 3 Integrated Risk Management System Description 33 4 Potential MDS Fleets 39 5 Historical Analysis Delivery Schedule 40

P a g e | 5

1.0 INTRODUCTION

1.1 Mission. The Air Force Safety Center (AFSEC) develops United States AF (USAF) safety policy, and implements, executes, and evaluates Air Force (AF) aviation, ground, weapons, space, and nuclear surety mishap prevention programs. This includes mishap investigation, mishap prevention, risk management, and oversight of the AF Safety Management Systems. AFSEC provides safety and risk management education and media programs for all safety disciplines, oversees major command (MAJCOM) safety and mishap prevention programs, and maintains the AF database for mishaps and hazards.

1.2 Objective. The AFSEC uses the Integrated Risk Information System (IRIS) to conduct analysis of flight-related data generated onboard the aircraft in support of the Military Flight Operations Quality Assurance (MFOQA) program to develop and integrate mishap precursor detection that would otherwise be unknown, and mitigation tools into AF and Department of Defense (DoD) aviation operations. MFOQA uses the data files from the routine collection and download of flight data recorders, processing the data files through specialized computer software to uncover hazards, errors, and mishap precursors, (e.g., trends and deviations from standard procedures and parameters). Analysis of recorded data identifies and quantifies both normal and hazardous flight environments, informs the development of mitigation measures, and where applicable, enables monitoring of control measure effectiveness. MFOQA analysis results may be collated with safety event investigations and hazard reports to further refine analysis algorithms or to explore additional areas of concern. The analysis products provide long-range safety benefits and support the risk management efforts of the operations, training, maintenance, safety, research and development, and design functions of aircraft acquisition and sustainment.

1.3 Guidance. DoD policy and AF safety program guidance necessitate the sustainment of current MFOQA analysis capabilities and the deployment of MFOQA analysis capability in additional aircraft fleets (Appendix 4) to prevent mishaps and preserve combat readiness. Each additional aircraft fleet requires software and operational subject matter expert tailoring of the analysis capability to meet individual aircraft configuration and missions. The AF MFOQA program implements DoD Instruction (DoDI) 6055.19 and is described in AF Instruction (DAFI) 91-225, Aviation Safety Programs. Aircraft data collection requirements are found in AF Pamphlet 63-129, Air System Development and Sustainment Engineering Processes and Procedures.

1.4 Scope: The primary objective of this contract is to support development, implementation, operational deployment, assessment, sustainment, and evolution of AF and Joint Service proactive aviation safety through the use of MFOQA.

Over the life of the contract, the contractor will sustain current fleets that

P a g e | 6 participate in MFOQA, expand MFOQA capabilities to include additional USAF fleets, and will provide MFOQA analysis support to Sister Services, other United States (US) Government Agencies, and Foreign Military Sales (FMS) partners.

The contractor shall provide contract management, support and travel to: sustain and maintain MFOQA analysis software; conduct MFOQA analyses; share operational findings, benefits, and advances; integrate MFOQA analyses with other hazard identification programs and processes, such as Air Force Combined Risk Management System, Aviation Safety Action Program (ASAP) hazard reports, and safety event investigations; collaborate with members of Sister Services, Governmental agencies, and foreign partners on goals and capabilities for collaborative MFOQA efforts; technology assessments; and dissemination of lessons learned.

2.0 GENERAL REQUIREMENTS

2.1 Analysis Application: The contractor shall maintain and sustain a data processing and analysis capability (known as IRIS) to accept, aggregate, analyze, and visualize flight-related data generated onboard an aircraft to meet current and emerging USAF proactive aviation safety requirements, including but not limited to: flight data analysis and animation programs; repository for aircraft flight data and analysis results; file naming and definition standards; integration of data from various USAF Mission Design Series (MDS) aircraft and systems;

transformation of data collected using military data collection devices, data buses (e.g., Military Standard 1553), and non-standard proprietary formats into engineering units; methods required to support military-specific flight phases, maneuvers, and measurements; mathematical models and language constructs to characterize numerical, spatial, and temporal data to facilitate aggregation and correlation of data gathered through various USAF and DoD MDS and systems programs; techniques to support spatial analysis, data mining, multivariate statistical analysis, and advanced visualization; and methods for supporting maintenance and engineering requirements.

2.2 Web-based Capability. IRIS is a web-based service and shall remain a web-based service.

2.2.1. IRIS is part of an AFSEC Enclave hosting multiple AF safety information technology (IT) systems under one over-arching Authority to Operate (ATO).

The Enclave is hosted in a DoD- approved cloud environment.

2.2.2. The over-arching ATO is managed by AFSEC IT personnel; the contractor is required to provide support and documentation as described in paragraph 4.2. to sustain the overarching AFSEC ATO, as specifically related to an IRIS Virtual Private Cloud within the AFSEC Information Level (IL) 4 Enclave.

P a g e | 7

2.3 Software. IRIS is enabled by a Government Off-the-Shelf (GOTS) open-source software called “Integrated Risk Management System” (IRMS) (paragraph 5.1.2 and Appendix 3). The contractor will maintain and sustain the IRMS software, providing spiral enhancement of current analysis algorithms, and the deployment of MFOQA analysis on additional USAF fleets.

2.4 Personnel. The contractor shall accomplish the assigned work by employing and utilizing qualified personnel with appropriate combinations of education, training, and experience. All personnel whose tasks require administrative privileges to the IRIS system must meet requirements of DAF Manual (DAFMAN) 17-1305, DAF Cyberspace Workforce Management Program, commensurate with the level associated with their duties. The following are required general skill sets and contractor personnel qualifications.

2.4.1 Software Developers: Software development personnel shall have both education and 5 years industry experience in programming languages and processes related to the development

P a g e | 8 and maintenance of software for operational flight data analysis. Team members shall be able to apply creative thinking and advanced problem-solving methodologies to web development, analysis algorithms for flight-related data generated onboard an aircraft, and database management, while complying with DoD and AF cybersecurity requirements. Developers shall be knowledgeable of and experienced in database and software management to include data storage, data security, data migration, and government database certification and accreditation processes. Developers shall have current cybersecurity certification as required by DoDD

8140.01 Cyberspace Workforce Management, DoDM 8140.03 Cyberspace Workforce Qualification and management Program, and DAFMAN 17-1305, DAF Cyberspace Workforce Management Program.

Routine tasks may include designing, programming, configuring, installing, testing, evaluating, customizing, integrating, and maintaining systems, to include customizing database and software features such as graphic user interfaces specific to different aircraft fleet requirements. Analysis algorithms should be designed to identify maneuvers common to all aircraft fleets (such as takeoff and landing points) and specific to individual fleets (such as aerial refueling and acrobatic maneuvers). Developers will identify and recommend specific necessary technical support and product upgrades to support the MFOQA software, to include the testing, acquisition, and debugging of software upgrades and new releases. Similarly, the software development team shall be capable of performing feasibility and cost-benefit analysis of possible software and database changes, including the survey of application architectures and frameworks, leading to the estimation of budget and schedule implications for such new capabilities. Developers shall also write documentation stemming from the design and development of web-based analysis software for both qualitative and quantitative flight data analysis, including requirements and specification documents.

2.4.2 Information and Cyber Security: The information and cyber security personnel shall understand and possess a minimum of 5 years’ experience with DoD and AF cybersecurity policy, including successful experience implementing the Risk Management Framework (RMF) processes outlined in DoDI 8510.01. Personnel shall be familiar with DoD cybersecurity requirements and annual assessment procedures and processes. Information and cybersecurity personnel shall have current cybersecurity certification as required by DoDM 8140.03 and

DAFMAN 17-1305.

The information and cyber security personnel shall coordinate with the program manager, software development team, the contracting officer representative (COR), and the AFSEC cybersecurity management team on overall policies, goals, and procedures for the cybersecurity function of IRIS. Contractor tasks include: develop and implement a robust cybersecurity program; ensure all activities required to sustain and renew the IRIS portion of the AFSEC Enclave ATO are completed; generate assessment and authorization supporting documentation;

facilitate the IRIS Configuration Control Board (CCB); generate and maintain Information Control Documents for interfaces between IRIS and other IT systems; monitor systems for security gaps; run risk assessments as part of on-going continuous monitoring; implement an effective policy and process for continuity of operations and incident response; develop and provide reports to the program manager for communication to all senior stakeholders; and promote cybersecurity awareness within the IRIS team.

P a g e | 9

2.4.3 Flight Data Analysts (FDA): MFOQA flight data analysts should have a minimum of 5 years’ experience as military aviation instructors in the mission type, and preferably in the specific aircraft, to which they are assigned (Appendix 4).

The analysts shall manage processing and trending of flight data from aircraft participating in the Air Force MFOQA program. Contractor tasks include: the use of software to analyze flight data in relation to triggered events and routine operating measures; act as gatekeeper in aircrew contacts to understand underlying factors to an event or hazard; the completion of special studies resulting from analyst detection of hazardous conditions and acts; and respond to ad hoc requests from the MAJCOM or operational units. FDAs will assist in the development of, and be responsible for, the verification and validation of aircraft specific event definitions. Other tasks include the preparation of flight operations trending analysis, and charts, reports, and statistical data required to keep the AF aviation community informed of the status and programs related to proactive aviation safety information. Analysts shall integrate flight hazard information from multiple sources, including IRIS, Air Force Safety Automated System (AFSAS) events, operational trends, and Government and industry aviation hazard and safety reports.

2.4.4 MAJCOM Program Management: MAJCOM program managers (PM) shall have a minimum of 5 years’ experience in military aviation operations and shall understand AF aviation safety programs and objectives as well as Safety Management Systems (SMS). MAJCOM PMs shall be physically embedded at MAJCOM locations but are responsible for coordinating MFOQA efforts and activities with AFSEC.

MAJCOM program managers are responsible for overseeing the execution of MFOQA activities at Air Mobility Command (AMC), Air Education and Training Command (AETC), Air Combat Command (ACC) headquarters, Air Force Special Operations Command (AFSOC), and Air Force Global Strike Command (AFGSC). Current activities accomplished by these personnel shall be sustained. Specific managerial responsibilities include the daily administration, security, and operation of IRIS; educating MAJCOM staff on military and industry proactive aviation safety initiatives; assisting the MAJCOM in the identification, employment, and sustainment of data collection and retrieval processes that support MFOQA analysis; the security and protection of aircraft data and resulting MFOQA analyses; acting as gatekeeper in aircrew contacts to understand underlying factors to an event or hazard; and supporting the development of corrective actions. PMs shall maximize the efficient use of proactive aviation safety data and shall participate in meetings and supporting events for proactive safety programs. Managers collaborate with operations and safety personnel to support MAJCOM integration of proactive safety capabilities in the SMS process. The PM shall oversee the generation of flight data analysis reports and ensure that all analysis reports generated under the MFOQA program meet MAJCOM needs regarding the measurement and management of operational and safety hazards and trends and are factually correct and statistically sound. The PM shall support the MAJCOM’s trending of hazards identified through MFOQA analysis, and mishap and hazard reports, and may be asked to represent these initiatives at government and industry events.

3.0 CONTRACT MANAGEMENT REQUIREMENTS

P a g e | 10

3.1 Communication. The contractor shall establish clear organizational lines of authority and responsibility to ensure effective management of the resources assigned to the requirement.

Regular communication between the contractor and the COR is required for optimal program development. The contractor shall provide, and update, when necessary, a roster of personnel.

(CDRL A001).

3.2 Meeting Minutes. The contractor shall deliver meeting minutes after each Quarterly Program Management Review (PMR), and for other official meetings when requested by the

COR. (CDRL A002)

3.3 Quarterly Program Management Review (PMR). The contractor shall conduct quarterly PMRs. The PMRs shall include a review of the completed quarter’s activity, analysis capabilities for future platforms, analysis software user enhancements, analysis algorithm improvements, IRIS Assessment and Authorization (A&A) activities, and proposed activity for the next quarter. The PMR shall be briefed to the Government for review and approval.

3.4 Quarterly Phase Plan / Configuration Control Board (CCB). The contractor shall, within 15 workdays following each PMR, brief the Government on its Quarterly Phase Plan.

Each Quarterly Phase Plan briefing shall describe major IRIS activity for the next quarter, including the impact of software modifications on the A&A requirements of IRIS and its subcomponents, and document the briefing in the Quarterly Phase Plan report. Each Quarterly Phase Plan report shall meet A&A requirements for IT configuration management control and change approval. (CDRL A003)

3.5 Monthly Status Report. The contractor shall provide monthly contract status reports. The monthly status reports shall include: 1) work accomplished during the reporting period; 2) a description of how the Quarterly Phase Plan activity supports overall contract objectives; and 3) risks and concerns associated with current and future contract activities. Describe schedule deviations, including the impact to deliverables and overall program objectives. The status reports may be associated with the contractor’s invoice submission. (CDRL A004)

3.6 Travel. The contractor personnel shall be prepared to travel in support of MFOQA program development and implementation. Travel requirements include: PMRs; aircraft program office technical meetings (such as Aircraft Information Working Groups, System Safety Groups, or Technical Interface Meetings); to support AF and MAJCOM operations and safety briefings and activities (such as Trend Review Action Committee, Air Reserve Component Chief of Safety course, and MDS proactive safety training), ; and industry and DoD advocacy and education meetings and conferences. See paragraph 4.1.7 for additional information.

3.6.1 The Government must approve all travel in advance of the activity. The Government will notify the contractor of the travel requirement at least three (3) days in advance of the travel date.

The contractor shall coordinate specific travel arrangements with the COR prior to traveling.

The contractor’s written request for travel shall contain the dates and locations of travel.

3.6.2 Allowable travel costs are described in the Federal Acquisition Regulation 31.205-46, Federal Travel Regulations, and Joint Travel Regulations. The contractor shall be responsible

P a g e | 10 for obtaining all passenger transportation, lodging, and subsistence, both domestic and overseas.

In the performance of necessary travel, the contractor shall use the lowest cost mode commensurate with the requirements of the mission. When it is necessary to use air or rail travel, the contractor shall use coach, tourist class, economy class, or similar accommodations to the extent consistent with the successful and economical accomplishment of the mission for which the travel is being performed.

3.6.3 The contractor will provide, within five (5) workdays following any travel, a travel report describing the purpose of the trip; attendees; agenda; briefings and discussion topics; action items; and recommendations and conclusions suitable for dissemination to DAF leadership.

(CDRL A005)

3.7 Work Location. Work may be performed at contractor-identified and government facilities.

For those tasks performed at a government facility, the Government will provide workspace and equipment to perform the tasks associated with this contract. Telework is permitted for this contract with prior coordination between the COR and contractor management. Contractor personnel who telework shall follow their corporate guidance regarding telework capabilities and frequency.

3.7.1 Contractors providing support in a government facility will follow the workdays and hours established by the host organization, typically 0700-1600 Monday through Friday.

3.7.2 Contractor personnel shall not have access to government facilities unless government personnel are present. Government agencies/facilities may not be available during scheduled holidays, inclement weather, weekends, after duty hours, or AF down days. Contractor personnel hosted by a government facility may telework on government holidays not recognized by the contractor, or when the hosting organization is closed (i.e. base closure due to weather, down day, etc.). U.S. Government scheduled holidays are: New Year’s Day; Dr.

Martin Luther King, Jr. Birthday; President’s Day; Memorial Day; Juneteenth; Independence Day; Labor Day; Columbus Day; Veterans Day; Thanksgiving Day; and Christmas Day.

3.7.3 All contractor personnel working at a government facility shall wear company picture identification badges to distinguish themselves from government employees. When conversing with government personnel during business meetings, over the telephone or via electronic mail, contractor/subcontractor personnel shall identify themselves as such to avoid situations arising where sensitive topics might be better discussed solely between government employees. Contractors shall identify themselves on any attendance sheet or any coordination documents they may review. Electronic mail signature blocks shall identify their company affiliation. Contractor personnel who occupy shared space with their government program customer shall, where practicable, identify their workspace area with their name and company affiliation.

3.8 Air Force Training. Contractor employees whose tasks require accessing the IRIS web capability shall complete, at a minimum, the courses listed below, through the Center for Development of Security Excellence (CDSE), MyLearning computer-based training (for those working in a government facility), or via briefing materials provided by the government.

Contractors/subcontractors working in government facilities shall complete additional training

P a g e | 11 requirements specific to the MAJCOM or work environment (e.g. Force Protection). The contractor will track training completion and maintain an electronic file of course completion certificates; course completion documentation will be provided to the COR upon request.

Failure to complete training may result in the contractor being denied base and computer access.

Contract employees with cybersecurity responsibilities shall have baseline certification commensurate with their assigned tasks, in accordance with DoDM 8140.01, DoDM 8140.03 and DAFMAN 17- 1305.

• DOD IAA CyberAwareness Challenge (ZZ133098) - Due Annually

• Safety Privilege (AFSEC training) – Due Annually

• Security (AFSEC training) – Due initially and as required by the AFSEC Security

Manager

• Operational Security (OPSEC) Training – Due initially (in-processing), annually

(DAF-Operations Security Awareness Training on myLearning), and as required by the OPSEC Program managers (PM)

• Department of Defense Controlled Unclassified Information (CUI) mandatory training – Due initially and as required by the COR or the CDSE guidance

• Security Education and Training – Prior to performing tasks covered by the IRIS contract DD Form 254, complete host installation training as identified in the DD Form 254 for each specific task.

3.9 Non-Personal Services. The government will neither supervise contractor employees nor control the method by which the contractor performs the required tasks. Under no circumstances shall the government assign tasks to, or prepare work schedules for, individual contractor employees. It shall be the responsibility of the contractor to manage its employees and to guard against any actions of personal services or give the perception of personal services. If the contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the contractor's responsibility to notify the Contracting Officer immediately. These personnel shall not perform work of a policy/decision making or management nature, i.e., inherently governmental functions. All decisions relative to programs supported by the contractor shall be the sole responsibility of the government.

4.0 ANALYSIS AND SUPPORT REQUIREMENTS

4.1 IRIS Analysis Tasks. The overall focus of this requirements area involves analyses of flight operations, including processing aircraft-generated flight data files through the web-based analysis server, flight data analysis, integration of hazard and error information from other sources, results distribution, and risk assessment and mitigation.

4.1.1 Analytical Services: The contractor shall conduct analyses and document findings specifically targeted to aviation inflight hazards. The contractor shall communicate regularly with AFSEC, the MAJCOM safety, operations, and maintenance staffs, and FMS partners to keep abreast of current areas of interest; and modify the analysis focus and capabilities as necessary to address these areas of interest. The contractor shall ensure analysis products direct user attention to important areas in the analysis report with intuitively understandable, recallable, and actionable hazard mitigation information, such as: annotating the purpose and context associated with a specific chart; identifying the specific hazard(s) associated with an analysis graphic; providing specific guidance to various users, such as commanders, trainers, and safety personnel; including operating limits as a reference when appropriate; using a scheme that

P a g e | 12 indicates hazard severity; and/or using illustrations that trigger a memory that elicits a specific reaction to the hazard. (CDRL A006)

4.1.1.1. The contractor shall use the MFOQA flight data analysis software to identify operational hazard indicators, conduct analysis, and trend results to detect and quantify risks to aviation safety. This is accomplished using flight data analysis software to identify: routine operational measurements (ROMs) such as unstick point, or 1000’ on approach; triggered events (TE) such as start airdrop, or overbank on approach; flight safety alerts (FSA) trending specific TEs; standard operating procedures (SoPs) found in aircraft flight manuals; and other data points associated with each flight. The contractor will use both operational and maintenance MDS-specific technical orders and tactics guides to develop appropriate measures and validate current product applicability on a recurring basis. The contract shall then assemble these individual measurements for aggregate analyses. The contractor shall track, trend, and analyze the analysis results. An analysis product shall be provided for each MDS fleet on a schedule agreed upon with the government, at least once per quarter and no more than once per month. Squadrons or wings may submit ad hoc requests for a breakout of their unit’s flight activity. The government may request the contractor provide mission-unique analyses for small fleets of MDS variants (e.g., AC-130J). The mission-unique analyses shall be provided on a schedule coordinated with the government.

4.1.1.2 The contractor shall derive hazard and risk information by integrating MFOQA analysis results with current MAJCOM, DAF, DoD, FMS, and industry aviation hazard information sources, (i.e. safety event investigations, hazard reports, ASAP, Line Operations Safety Audit (LOSA) findings and recommendations, publications, MDS technical orders, information meetings, the MFOQA analysis tool sets, etc.), and communicate the results in a timely and effective method to functional leadership within the MAJCOM, DAF, DoD, government, and FMS partners. In coordination with MAJCOM safety or operations staff, perform gatekeeper duties to better understand contributing factors to an event or hazard, and integrate the information in communications to the MAJCOM, DAF, DoD, government, and foreign military representatives. Disseminate lessons learned throughout the analyst cadre, and make analysis results available through the IRIS web service, AF Safety Automated System (AFSAS) and MAJCOM-specific information websites.

4.1.1.3 The contractor shall sustain MFOQA analyses for the aircraft identified in Appendix 4.

MFOQA analysis processes shall include: the ability to receive aircraft-generated flight data files in various formats; determine data suitability for useful analysis output; process, validate, track, trend, animate and aggregate flight data files and analysis results; and adapt the analysis process as needed following flight data recording capability modifications. MFOQA software shall allow analysts to derive information using an analysis tool set, including a query process, and to communicate their findings to MAJCOM, AFSEC, Air Force Materiel Command (AFMC, aircraft program offices), AF, and FMS partner staffs and leadership. MFOQA analysts shall routinely analyze operational data to detect deviations from standard procedures and parameters, trend this information, disseminate analysis results, animate the flight data, review and evolve MFOQA system techniques and visualizations, and provide feedback to the AFSEC, the MAJCOMs, and FMS partners, on current areas of interest. MFOQA analysts may be directed to assign hazard severity, and to facilitate the identification of causal factors and generation of recommendations. The analysis results shall be provided in the form of graphs, spreadsheets, animations and/or written reports, as coordinated with AFSEC and the unit, Lead MAJCOM, or FMS partner (as applicable) for each MDS.

P a g e | 13

4.1.1.4 The contractor shall sustain MFOQA analysis capability for current MFOQA participating fleets as identified in Appendix 4 and develop MFOQA analysis capability for additional aircraft fleets, dependent upon AF acquisition processes (i.e. data collection hardware modifications) and the needs of the DAF. Current MFOQA-participating fleets, to include fleets added to the program during this contract, that undergo extensive modifications by the AF requiring an entirely new software effort by the contractor to support continued analysis, shall be considered an “additional aircraft fleet” with concurrence of the USG PM.

Appendix 4 identifies current and potential future aircraft MDS fleets as well as current fleets projected for major data-centric upgrades/revisions.

4.1.1.4.1. The aircraft may vary, based on future AF agreements to provide analysis for Sister Services, other government agencies (e.g. Coast Guard), or for foreign military partners.

4.1.2 MAJCOM, government agency, and FMS Support: The contractor shall provide flight data analytical support for risk assessment and management to the Lead MAJCOMs, (ACC, AMC, AETC, AFSOC, AFGSC), government agencies, and FMS safety, operations, training, and maintenance staffs. The contractor shall integrate organizational areas of interest with those of MAJCOMs, DAF, DoD, government agencies, and FMS representatives. The contractor shall, as needed, educate MAJCOM staff on the goals and processes associated with flight data analysis and its integration in the command’s SMS. The contractor shall interface regularly with AFSEC, the MAJCOM and DAF staff, government agencies, and FMS representatives to identify significant areas of interest; support activities to make new aircraft fleets MFOQA capable, present emerging trends, hazards, and risks; perform analysis; and convey results of subsequent analyses.

4.1.2.1. The contractor shall provide MFOQA analysis of mishap sorties and / or trend analysis to aircraft event investigations when coordinated with the COR or alternate COR.

4.1.2.2. The contractor shall provide approximately 10 squadron or wing-level ad hoc MFOQA analyses per month, as requested by the units and coordinated with the COR or alternate COR.

4.1.2.3. The contractor shall provide analysis of sorties flown under MAJCOM demonstration guidelines.

4.1.2.4. The contractor shall support lifecycle sustainment activities, including but not limited to notification of aircraft performance exceedances; analysis extracts for engine, structural, or systems monitoring; and ad hoc analysis in support of safety-related program office investigations.

4.1.2.5. Government Agency Partners: If requested, the contractor shall provide Sister Service and Coast Guard safety personnel, or other government agencies (e.g. Customs and Border Patrol) with access to aircraft flight data analysis capabilities within IRIS, or with organizational analysis results, as coordinated with the government.

4.1.2.6. Foreign Military Support: The contractor shall provide foreign militaries with flight data analytical support when coordinated with the government. MFOQA analysis support agreements currently exist with three C-17 FMS militaries (United Kingdom (UK), Australia, and the North Atlantic Treaty Organization Airlift Management Program), and the UK RC-135 Rivet Joint program. The contractor shall provide analysis products to the foreign military on a schedule agreed upon between the government and the foreign military representative, at least once per quarter and no more than once per month. Additional MFOQA analysis may be required as additional support agreements are established with other foreign militaries.

P a g e | 14

4.1.2.7. The contractor shall coordinate with the Government to solicit AFSEC, MAJCOM, government agency, and foreign military desires for analysis capability and process improvement for inclusion in IRIS maintenance and sustainment activities (see paragraph 4.2.10.)

4.1.3 Flight Data File Distribution: The contractor shall understand the Recorded Aircraft Information requirements in DAFI 63-101/20-101, Integrated Life Cycle Management, and AFPAM 63-129 Air System Development and Sustainment Engineering Processes and Procedures to educate the MAJCOM operations, requirements, and safety staff on how these requirements are essential to providing aircraft-generated flight data to the MFOQA process.

The contractor shall work with the MAJCOMs, AFSEC, and other defense contractors to determine the best method of conveying flight data files from the aircraft to the analysis web service. The contractor shall participate (electronically or in person) in recorded aircraft information working groups and provide MFOQA related inputs to each fleets’ Aircraft Information Management Plan.

4.1.4 Data Dissemination: The contractor shall work with AFSEC, the MAJCOMs, government agencies, and FMS representatives to establish a schedule for providing analysis products. The contractor shall provide MAJCOMs, government agencies, and FMS militaries fleet-level proactive aviation safety analysis reports covering recent data analysis results and recommendations (at least one report per quarter, but no more than one report per month, for each MDS). The contractor shall provide analysis reports in presentation-ready format and appropriate for immediate messaging to field users and senior leaders. The reports shall provide information on current areas of interest as expressed by AFSEC, the MAJCOMs, government agencies, and FMS militaries to include emergent safety, operations, training, and maintenance trends. The contractor shall provide aircraft data (i.e. HAF A4 CBM+, Rapid Sustainment Office, engine propulsion, etc.) and lifecycle sustainment analyses if coordinated and approved by

AFSEC.

4.1.5 Presentations: The contractor shall present proactive aviation safety analysis results and programmatic activity. Primarily, these presentations shall cover flight data analysis products, in-depth analysis of high-interest events and trends, and proposals for mitigating negative trends.

Upon request from the government, the contractor shall include in its presentation activity associated with IRIS program growth and implementation. The contractor shall also be prepared to discuss methods to track any recommended training or operations changes. (CDRL A007)

4.1.6 Each calendar year the contractor shall write at least two MFOQA-derived case studies, detailing a hazard, the associated flight data analysis, and the MAJCOM hazard analysis, mitigation decision, and validation of the solution. The contractor shall write up to six papers or articles per year (approximately 500-1000 words), for MAJCOM and / or AFSEC safety publications. The minimum number of case studies and articles combined is four per year of performance or one per quarter. The topics include but are not limited to 1) description of MFOQA and / or ASAP-driven MFOQA analysis successes for a single MDS or group of MDSs;

2) the integration of MFOQA analysis in an organization’s SMS process; and 3) the use of MFOQA analysis to quantify a hazard identified through a LOSA or ASAP reporting or vice versa. (CDRL A008)

P a g e | 15

4.1.7 The contractor shall attend and participate in approximately 40 meetings per year. The meetings may include, but are not limited to: IRIS contract quarterly program management reviews (4 per year); IRIS contract quarterly requirements planning sessions (4 per year);

Federal Aviation Administration (FAA) InfoShare (2 per year); Aircraft Information Working Group or Technical Interchange Meetings (~10 per year, as called by MDS Program Manager);

government or industry led meetings or conferences in support of IRIS cybersecurity support (2 per year, A&A personnel); unit or organizational meetings in support of DAF, DoD, or industry data-driven proactive safety efforts (5 per year, analyst or MAJCOM program manager);

proactive safety instruction at MDS-specific school houses (10 per year, analyst or MAJCOM program manager ). Provide minutes and a trip report as appropriate (CDRL A002 or A005)

4.2 IRIS Support Tasks: The overall focus of this requirements area involves utilizing the open-source legacy Integrated Risk Management System (IRMS) software to maintain, sustain, and enhance the AF MFOQA analysis software.

4.2.1 Integrated Risk Information System (IRIS): The contractor shall sustain the web based integrated information system, utilizing Government-provided IRMS software. The minimum IRIS functionality shall include MFOQA components with the ability to integrate added interfaces or components. Current data transfer interface capability, such as with the Aircraft Structural Integrity Management Information System (ASIMIS), G081/Mobility Air Force Logistics Command & Control (G081/MAF Log C2), Aging Fleet Integrity Resource (AFIRM-M/AFIRM-O), Advana-Blade, Panda, and Boeing’s Exostar shall be maintained.

4.2.2 System Interface: The contractor shall analyze the configuration, functionality, technical architecture, operating system, infrastructure, files, and databases associated with legacy or future information systems, and develop plans to interface between these systems and the delivered IRIS, as needed for system growth and sustainment. Added interfaces may include but are not limited to the Reliability and Maintainability Information System, and Aging Fleet Integrity and Reliability Maintenance.

4.2.3 IRIS MFOQA Employment: The contractor shall maintain existing MFOQA analysis capabilities and deploy MFOQA analysis capabilities on additional MDS as described in Appendix 4. The MFOQA software shall have the ability to process aircraft-generated flight data files from multiple recorder types and data formats, enable identification of unique standard flight maneuvers and procedures for each MDS, deviations from standard flight maneuvers and procedures and parameter exceedances, enable statistical analysis of various flight regimes, trend this information, and animate the flight data. This capability shall be adaptable for application against individual flight data files, aggregate MDS data files, and meta-analysis across multiple MDS. The contractor shall have the technical knowledge necessary to monitor and provide technical assistance for the IRMS software programs and database(s).

4.2.4. The contractor shall conduct initial and ongoing assessments of aircraft recording capabilities, data formats, documentation, and data distribution to understand changes to recording capabilities and processes for aircraft employing MFOQA, and to determine aircraft fleet potential for MFOQA implementation.

4.2.4.1. This task includes activity needed to create a timeline for deployment of a new fleet, such as review of technical documentation for data transcription and use in IRIS, an estimation of the bandwidth and data storage required to implement; any significant/unexpected costs involved, evaluation of differences between fleet variants and

P a g e | 16 impact on algorithm development and deployment and mapping of data files into analysis algorithms.

4.2.4.2. The activity in this task should sustain a level of assessment and development that provides fielding of at least one aircraft fleet per year, but is not limited to one aircraft fleet per year based on: AFMC/AFLCMC compliance with aircraft-generated flight data collection requirements for the delivered aircraft fleet or modification; the complexity or simplicity of a fleet’s recording and distribution process; extent of modification of an aircraft’s recording and distribution process; the extent of modification required to existing algorithmic functions based on changes to the fleet’s recording and distribution processes for a fleet currently employing MFOQA analysis capabilities; the modification of a fleet’s mission requiring modification of existing algorithmic functions or development of new algorithmic functions; and Lead Command prioritization, and planned or unplanned funding opportunities. Current MFOQA fleets (Appendix 4) that undergo modifications by the AF requiring an extensive new effort by the contractor to sustain MFOQA support will count as an additional aircraft fleet when identified by the contractor and approved by the COR. In such cases, the contractor may need to increase software engineering support personnel in lieu of an additional MDS flight data analysts after consulting with and gaining COR approval.

4.2.5 Software Assessment and Authorization: The contractor shall conduct assessment and authorization activities supporting the cybersecurity requirements of the RMF, in accordance with DAF and DoD requirements (current and future revisions), as needed to support a single ATO for all AFSEC IL4 systems. Tasks and activities shall be coordinated through the COR and the AFSEC Information System Security Manager and include but are not limited to generation of assessment and authorization supporting documentation; the identification and documentation of IRIS cybersecurity responsibilities; AFSEC change management procedures, and activities required to sustain and renew the IRIS Authority to Operate.

4.2.6 Graphical User Interface (GUI): The MFOQA analysis products shall provide a GUI interface to the IRIS analysis tools and products that is user-friendly, uses common FOQA industry terminology, and with an interface, menu design, formatting, and tools similar to Microsoft Office products.

4.2.7 Flight Data and Analysis Results Database: The contractor shall maintain a database containing the aircraft-generated flight data files and MFOQA analysis results for each MDS.

The data query tools and results shall be accessible by the contract analysts, IRIS development staff, and the COR and alternate COR. Data files shall be accessible by MAJCOMs and other AF authorized users. The IRIS web service shall provide an AFSEC-approved analysis summary dashboard for squadron, wing and MAJCOM staff top-level assessment of analysis results, trends, and emerging hazards.

4.2.8 Technical Documentation: The contractor shall generate and sustain software requirements, security, and specification documents for IRIS. These documents shall comply with appropriate industry software development documentation standards and be provided in the format required by DoD and DAF cybersecurity requirements when created for inclusion with assessment and authorization documentation. The contractor shall generate supplemental specifications to document MDS specific implementation, containing descriptions of each event, standard operating procedures, and other data points associated with each flight sufficient to recreate the analysis capability. These supplements shall also describe the analysis constants and constraints as determined by the flight recorder capability. Generate or sustain a Process Guide

P a g e | 17 for each fleet, including aircraft data flow, MFOQA programmatics and specifics for the fleet, description of ROMs and TEs, and a list of frequently asked questions. The contractor shall make all technical documentation available for viewing and download from the IRIS web service or other government approved location. (CDRL A009, A010, A011, A012)

4.2.9 Deployment of the IRIS Capability: The contractor shall deploy the IRIS analysis capabilities to the field. Deployment is defined as all the activities that make the integrated IRIS software system operational and available for use.

4.2.10 IRIS System Maintenance and Sustainment Task:

4.2.10.1 The contractor shall provide IRIS system maintenance and sustainment to augment that provided by system vendors for configuring, installing, evaluating, customizing, and maintaining systems, including, but not limited to: application file/data base management, storage, security, and communications; generating and tracking vendor discrepancies; identifying and recommending necessary technical support and product upgrades; coordinating Government approval of and acquiring licenses, upgrades and new releases; installing, testing, and debugging new software releases; performing configuration management; and performing on and off-site system backups and/or restores.

4.2.10.2 The contractor shall sustain and maintain all IRIS products, including IRMS software delivered and deployed under this contract while in use. Sustainment is defined as the processes, procedures, people, materiel, and information required to support, maintain, and operate the software aspects of the IRIS system over the web. Maintenance is defined as the process of modifying the software system or component after delivery to correct faults, improve performance or other attributes, or adapt to a changed environment. The contractor shall sustain and maintain all systems delivered under this contract to include: all hardware and software trouble-shooting; all software debugging and recoding; all testing of fixes; development and deployment of upgrades to fix software discrepancies and improve analysis capabilities;

sustainment of security controls in all software components; maintaining configuration control of all software releases; answering help requests; meeting RMF and ATO criteria; and updating all documentation as changes occur. The contractor shall ensure all enhancements and fixes are mapped back to the applicable software requirements documentation for the module being worked on in the IRIS system.

4.2.11 Technological Development, Support, and Evaluation: Integral to ongoing IRIS maintenance and sustainment, the contractor shall investigate and evaluate various options for IRIS technology improvements.

4.2.11.1. The contractor shall evaluate technological advances, software, and capabilities that may increase efficiency or effectiveness if integrated in IRIS. The contractor shall recommend options to the DAF, taking into consideration the following: system capabilities and functionality; security; integration with DAF networks; user configurability; hardware requirements; technical support; training and user aids; costs for purchase; licensing; resources required for implementation; and sustainment.

P a g e | 18

4.2.11.2. The contractor shall make aircraft-generated flight data files (raw files and .ofd, para 4.2.7.) available to other DAF or authorized governmental organizations upon approval and coordination with the COR. Include: processes to store .ofd files; validate requester status; an independent user query tool for selecting data files; and data file extraction and delivery capabilities.

5.0 ADDITIONAL INFORMATION AND REQUIREMENTS

5.1 Intellectual Property: Data Rights and Software

5.1.1 The software titled “Integrated Risk Management System (IRMS)” (See Appendix 3) currently in use by the AF is an open source, secure, web-based information system, supporting military-specific MFOQA processing needs. IRMS supports an open architecture, including naming standards, non-proprietary components, and use of relevant industry standards [e.g.

Structured Query Language (SQL), Hypertext Markup Language (HTML), Extensible Markup Language (XML), etc.] wherever possible.

5.1.2 IRMS software, tools, and applications (e.g. operating system, programming language, statistical tools, database management systems, querying tools, reporting tools, visualizations tools, and web servers, etc.) are Open-Source Software (OSS), as defined at https://opensource.org/about, using the MIT form of license (https://opensource.org/licenses/MIT).

5.1.3 As a web-based application, IRMS does not require users to install or maintain any software, other than approved third-party tools. Commonly available web browsers (e.g. Internet Explorer) provide access to all system functions.

5.1.4 The Air Force Safety Center holds licenses for Insight/Analysis and Insight/Animation Version 2.6 and General…