SOW TAWS 18 Mar 2025.pdf

STATEMENT OF WORK

17 December 2024

Terrain Awareness Warning System Tactical & Commercial Database

1.0 SCOPE AND BACKGROUND

1.1 This Statement of Work (SOW) establishes the requirements for an annual subscription for the latest version of the C-130J Terrain Awareness and Warning System (TAWS) Tactical & Commercial Databases (DBs).

1.2 The latest version of the C-130J TAWS Tactical DB will merge the Honeywell commercial terrain database with the National Geospatial-Intelligence Agency's (NGA) Digital Vertical Obstruction File (DVOF), and include the following features:

1. Improves alerting algorithms

2. Expands database of terrain, obstacles, and airports

3. Adds man-made obstacles

2.0 APPLICABLE DOCUMENTS

2.1 All software shall be labeled and described thoroughly on AF Form 1243 and DVD+R DL in accordance with T.O. 00-5-16, dated 1 Nov 2024, Computer Program Identification Number (CPIN) Management.

(CDRL A003 DI-MISC-81454D).

3.0 REQUIREMENTS

3.1 C-130J TAWS Tactical & Commercial DB Subscription

3.1.1 The Contractor shall deliver the latest version of the flight-ready C-130J TAWS Tactical DB 120 days after award of this contract. The Contractor shall use NGA-provided DVOF data to update and deliver the updated C-130J TAWS Tactical DB semi-annual after the initial delivery. Two copies of the Tactical Database shall be delivered to AFLMC/WLNE, Attention: C-130J TAWS Engineer and Equipment Specialists, 420 Richard Ray Blvd, Ste 1W1, Robins AFB, GA 31098 on Dual Layered DVDs (DL-DVDs) once every semi-annual. Each revision shall also include:

a. File Listing

b. Certificate of Conformance

c. Database Change Impact Analysis (i.e. DBA69003267-641_-)

d. ReadMe file

3.1.2 The Contractor shall deliver annual update of the C-130 J TAWS Commercial MKV/VII EGPWS Terrain DB. The Commercial DB shall be downloadable and include the following:

a. ATP Configuration Matrix

b. All applicable Terrain DB Service Information Letters

3.1.3 The period of performance will be four years, comprised of one 12-month base period and three annual option periods.

3.1.4 The Contractor shall provide assistance in troubleshooting TAWS Tactical or Commercial DB related problems.

3.1.5 The Contractor shall, upon discovery or in any way obtaining knowledge of any error, defect, omission, inaccuracy, or other problem which might adversely affect the delivered TAWS Tactical or Commercial DB, notify the United States Government (USG) as soon as possible.

3.1.6 Monthly telecoms will not be required for execution of this contract.

3.2 Government Furnished Information

3.2.1 The USG shall coordinate with the NGA to obtain the rights to use DVOF data. The USG will provide DVOF data to Honeywell upon request to USAF C-130 System Program Office (SPO) avionics engineering representatives.

3.3 Program Management

3.3.1 The Contractor shall work closely with the USG and shall be responsible for ensuring timely completion of the tasks specified in the contractual requirements.

3.3.2 The Contractor shall work with the USG in an Integrated Product Team (IPT) approach.

3.3.3 The delivery schedule is included in the resulting contract Line Items.

3.4 Systems Engineering

3.4.1 Configuration Management (CM): The Contractor shall establish a process to assure that CM is maintained on the system and in the functional, allocated, and product baseline configuration identification documentation. The TAWS Tactical DB will use the same numbering scheme as the TAWS Commercial DB.

3.5 Logistics

3.5.1 Packaging, Handling, Storage, and Transportation (PHS&T): N/A

4.0 Contract Deliverables

4.1.1 C-130J TAWS Tactical Database (DB) Subscription

4.1.1.1 The Contractor shall deliver the latest version of the flight-ready C-130J TAWS Tactical & Commercial DB, a Computer Software Product End Item, 120 days after award of this contract. The Contractor shall use NGA-provided DVOF data to update and deliver the updated C-130J TAWS Tactical DB every six months or semi-annually after the initial delivery on dual-layer digital versatile disc (DVD+R DL). DVD+R DL shall include a checksum hash for data integrity, preferably generated with SHA128 or higher as a minimum. (CDRL

A001 DI-AVCS-80700A/T)

4.1.1.2 The Contractor shall deliver the latest annual version of the flight-ready C-130J TAWS Commercial MKV/VII EGPWS Terrain DB. The Commercial DB shall be downloadable for the USAF C-130 SPO only, not for DoD field units to download.

4.2 Software Version Description Document (SVDD)

4.2.1 The Contractor shall provide a Software Version Description Document that identifies and describes each software version, a Computer Software Configuration Item (CSCI). Each SVDD shall be delivered on the same

DVD+R DL with each semi-annual TAWS Tactical Database update. (CDRL A002 DI-IPSC-81442A/T)

4.3 Computer Program Identification Number (CPIN) Catalog Information

4.3.1 The Contractor shall provide Computer Program Identification Number (CPIN) Catalog Information for each TAWS Tactical Database update. All software shall be labeled and described thoroughly on AF Form 1243 and DVD+R DL in accordance with T.O. 00-5-16, dated 1 Nov 2024, Computer Program Identification Number (CPIN) Management. (CDRL A003 DI-MISC-81454D).

5.0 Cyber Security

5.1 Contractor shall provide System Security Plan (SSP) or equivalent that adequately describes network/system framework, system boundaries, system environments of operation, relationships with or connections to other systems, software patches & updates practices, security requirements in place to protect system(s) from compromise and how they are implemented, incident mitigation & reporting, a sound audit process, and communication plan in accordance with DFARS 252-204-7008, 252.204-7012, 252.239-7018 and/or FAR Clause

52.204-21, and security requirements from NIST SP 800-171 and NIST 800-53. The SSP shall:

a. Clearly demonstrate utilization of best practices in their network/system framework, operations, security/protections measures, systems isolation (connections to shared networks, systems), Incident mitigation, and reporting, auditing tools, and customer communications plans in accordance with DoD guidelines and regulations;

b. Safeguard Critical Defense Information (CDI) and report to the DoD the possible exfiltration, manipulation, or other loss or compromise of unclassified CDI: or other activities that allow unauthorized access to the contractor’s unclassified information system on which unclassified CDI is resident or transiting within 24 hours of identification

c. Identify sufficient processes in place for company to provide adequate security for covered defense information that is processed, stored, or transmitted on the contractor's internal information system or network per DFARS Clause 252.204-7012;

d. Identify systems/networks that are accessed by alternate sites, subsidiaries and partners and describes the need for access. Describes whether systems are unclassified/classified. Describe whether Domestic or Foreign owned;

e. Demonstrate that the contractor’s information system, system component, or information system service prior to selection, acceptance, or updates comply with DoD guidelines and regulations.

5.2 Contractor shall implement and conduct SCRM, to include Cyber-SCRM in compliance with DoDI 5000.90.

These cybersecurity requirements are to be considered throughout all aspects of planning, maintaining, development, production, and distribution. Contractor shall conduct early and continuous monitoring to prevent or reduce impacts of cyber vulnerabilities where adversaries are able to exploit, steal, alter, manipulate, interrupt, or destroy system functionality, information, or technology. Cyber-SCRM shall include, at a minimum, internal monitoring as well as screening potential vendors and suppliers to determine if they:

a. Provide products and components, or subcomponents, sourced through original equipment manufacturers or government authorized resellers;

b. Have previously incurred any findings of malicious network intrusions, data breaches, loss of client data or intellectual property;

c. Have obtained a CMMC certification level or similar indicating that they practice, at least basic cyber hygiene (e.g., access management, timely patch management, identity management, and password management).

d. Maintains continuous situational awareness of risks and vulnerabilities with considerations to new emerging threats and technologies;

e. Manage supply chain risks including those associated with foreign ownership, control, or influence concerns. This includes companies that currently do, or potentially will, supply (hardware, software, or firmware) components to the programs. Companies that possess technology relationships with other suppliers or vendors that are known to already be under the influence or control of threat actors.

6.0 Foreign Influence

6.1 Contractor shall ensure security measures are in place to prevent any instance of which foreign interest has the power, direct or indirect, whether or not exercised, and whether or not exercisable through the ownership of the U.S. company's securities, by contractual arrangements or other means, to direct or decide matters affecting the management or operations of that company in a manner which may result in unauthorized access to classified information or may adversely affect the performance of classified contracts.in accordance with DOD

5220.22-M. The Contractors foreign influence plan shall:

a. Identify policies, practices, processes, training and other key elements in place to ensure that foreign firms cannot undermine U.S. security and export controls.

b. Prevent unauthorized access to critical technology, classified information, and special classes of classified information supporting national security.

c. Describe the source, nature and extent of Foreign Ownership Control or Influence (FOCI), including whether foreign interests hold a majority or substantial minority position in the company, taking into consideration the immediate, intermediate, and ultimate parent companies.

d. Provide information for any/all existing, pending, or upcoming negotiations of mergers, consolidations, reorganizations, partnerships, acquisitions or takeovers by a foreign interest.

e. Describe all bilateral and multilateral security and information exchange agreements