PWS.pdf

Performance Work Statement (PWS)

A. PROJECT/TITLE

Airworthiness Security Certification Training for Federal Aviation Administration (FAA) Airworthiness (Maintenance / Avionics) Inspectors.

B. BACKGROUND

Training to address deficiencies cited in 2020 FAO report to Congress (GAO-21-86) titled Aviation Cybersecurity, FAA Should Fully Implement Key Practices to Strengthen Its Oversight of Avionics Risks.

Specifically, maintenance practices for connected aircraft commonly known as eEnabled.

Modern aircraft are being designed and delivered with advanced systems of interconnectivity that pose a safety risk if improper procedures are used when loading critical software and data bases. Due to the lack of certification standards and regulations these aircraft are considered new and novel requiring the issuance of electronic security Special Conditions (SC) at time of certification. These SCs require the manufacturer to provide aircraft operators with instructions specific to security to maintain the aircraft in an airworthy condition.

Historically, instructions mandated by the SC were very specific and prescriptive that operators and manufacturers found hard to comply with. The aviation industry has gained regulatory approval to use industry standards instead of prescriptive and difficult procedures.

The prominent industry standard for continued airworthiness is DO-355A, Information Security Guidance for Continued Airworthiness. DO-355A is the new standard for all operator Aircraft Network Security Programs (ANSP) and the basis for manufacture guidance, which incorporates Security Documents DO-326A, DO-355 and DO-356A.

The ANSP concept has been around since 2011 but was limited to a handful of aircraft and operators but fleet replacements have triggered a significant increase of modern, connected in the NAS.

Current FAA training does not cover ANSP related topics.

C. SCOPE

Work completed for this Performance Work Statement will deliver, safety critical Avionics Inspector training related to airworthiness security.

Curriculum Development Services:

The contractor must:

• Provide content topic outline and course objectives must provide a general understanding of internet technology (IT) interaction during aircraft maintenance activities as described in DO-355A. The objectives must also include a detailed understanding of design and maintenance activities that could have a negative impact on airworthiness related to electronic system security.

• Ensure all text, graphic, and multimedia components that comprise eLearning courseware are compliant with Section 508 standards.

D. DEFINITIONS

The following definitions are used to define the terminology contained herein:

1. Contracting Officer (CO): The person authorized to act on behalf of the Government to negotiate and award contracts and modifications thereto, and to administer contracts through completion or termination. Except for certain limited authority delegated by the Contracting Officer to a technical representative, the Contracting Officer is the only individual with the authority to direct the work of the Contractor.

2. Contracting Officer's Representative (COR): The authorized Government representative(s) acting within the limits of their delegated authority for management of specific projects or functional activities.

3. DOT: Department of Transportation

4. FAA: Federal Aviation Administration

E. TRAINING REQUIREMENTS

1. General Requirements:

The contractor must provide instruction, presented by a skilled and qualified instructor in a classroom environment (in-person) as the preferred method of training, unless there is a natural disaster or pandemic. If the training cannot be conducted in a brick and mortar environment, Computer-Based Instruction (CBI) or Virtual Training is allowed at the discretion of the Government and with the concurrence of the vendor.

Daily sessions begin when the student shows at the contractor facility for training each day and runs for eight (8) hours per day, not including breaks.

• Present and deliver a four day course all instruction virtual instructor-led training as follows:

o 1st day (Monday) o 4th day (Thursday) o Ensure meal break for training more than 6 hours daily and two 10-15 minute break o Ensure one 10-15 break for training at least 4 hours of training

• Provide a 15 minute time slot at the beginning and end of the course for AFS-300 SME comments relevant to regulatory responsibilities.

• At least two weeks prior to any course, provide each registered student with the training site address, map and/or directions to the training site, a local point of contact and telephone number, and commercially available lodging near the training site.

• Provide copy of syllabus, course materials, including user/participant guides, support materials, instructor guides, reference materials, handouts/technical exhibits, presentation slides, and lesson plans, and to include graphics and multimedia in the courseware on the first training day for brick and mortar training and 3 days before virtual training.

• Promptly notify the COR and FAA Project Manager in writing when any FAA personnel fails to report for training as scheduled.

• In the event the FAA inspector fails to report for training as scheduled, or should become ill, injured or incapacitated during the training period, the contractor shall promptly notify the COR and the inspector’s emergency contact, if known.

2. FAA personnel are expected to perform at a level compatible with the highest standards of the specialty. Accordingly, each course of instruction shall adhere to the adult learning principles, which include but are not limited to:

a. Focus the training on "Real World" situations and applications.

b. Emphasize how the training can be applied.

c. Relate the training to the instructional objectives.

d. If possible, relate the training materials to the FAA employees past experience.

e. Allow reasonable debate and challenge of ideas.

f. Encourage FAA employees to be resources to one another.

In addition:

a. The classes shall not contain content or methodology likely to produce high levels of emotional response;

b. The training content and methodology of the classes shall not be associated with religious, quasi-religious, or new age belief systems;

c. The classes shall not include materials which could be viewed as attempts to change the influence an individual’s personal values or lifestyle outside the workplace.

3. The Brick and Mortar Training Facility will be provided by the contractor and must provide the following:

a. Classrooms must be large enough to accommodate at least the entire class plus one observer, with either desks or tables large enough to allow the students to be able to take notes and still have space for them to keep their reference books open during lecture periods. Student chairs must be ergonomically appropriate for 8-hour occupancy.

b. Sufficient presentation boards for effective teaching shall be provided.

c. The classroom shall be well lighted. There shall be not less than 30 footcandles of illumination at the student's desk or table.

d. The classroom shall be cleaned not less than two times each week of instruction.

e. Sanitary restroom facilities shall be available within convenient distance of the classroom.

f. The classroom facilities shall be adequately ventilated; heated in winter and cooled in summer. Temperature range shall not exceed 68 to 74 degrees Fahrenheit.

g. Ambient noise shall be below the distraction point. At any position in the classroom, normal instructor voice levels should exceed the ambient noise level by 20 decibels.

h. Contractor shall comply with safety standards specified by the National Electrical Code, the

National Fire Code, and the United States of America Standards Institute in conducting contract training. Each class shall receive a briefing on safety and security procedures to ensure proper egress in the event of any foreseeable emergency.

i. Local environmental distraction adversely affecting student learning shall be eliminated.

j. Adequate free student parking shall be available near the training site.

k. Visual aids used in the classroom to describe specific aircraft system or aircraft components shall be legible, visible from each student station, and color enhanced as necessary to show each system operating mode.

l. Classrooms must have at least one computer with internet access and printer available for student use.

4. If CBI or Virtual Training is used to accomplish training then the following requirements must be met:

a. Prior to training, provide information to the COR on the computer based platform being utilized for approval to include number of hours and the number of training days.

b. Students shall receive a thorough briefing on the operation and use of the software prior to start of first date of course for accessing the virtual platform

c. Provide Time Zone training will be conducted.

d. At least one instructor shall be present or readily accessible by electronic means to resolve any problems or questions that the FAA may have regarding the material presented in the course.

e. All material presented by CBI shall be reviewed and reinforced by a qualified instructor in classroom discussion or one-on-one with the engineer.

5. Student Reports and Grading:

a. Upon completion of all training, the contractor shall issue a Certificate of Training (Appendix A), which includes an End of Course Evaluation. Each FAA inspector and instructor shall sign the Certificate of Training (Appendix A) certifying the type of training provided, specific dates, and the duration of such training. One copy must be submitted to the COR.

b. Each FAA Inspector shall also complete the End of Course Evaluation. One copy must be submitted to the COR.

c. Each student's performance shall be graded with a Pass or Fail rating. The contractor shall furnish a report to the COR reflecting the student's final grades, attendance records, and any additional comments deemed necessary concerning his/her attitude and ability. Each student shall receive a certificate of graduation, pending completion of required testing, with a minimum average of 70 percent. Testing may be conducted with open textbook for reference.