## 1.

[Audit Requirement]{.underline}: An audit is required for all Direct
Subscribers that receive ASDI/NASSI Class One data from the Class One
FAA data interface. The audit requirement also applies to Indirect
Subscribers that redistribute data received from Direct Subscribers.
Direct Subscribers receiving only the Class Two (time-delayed) FAA data
interface are not subject to the audit requirements.

## 2.

[Audit Type]{.underline}: Agreed-Upon Procedures Audit in accordance
with appropriate Statements on Audit Services (SAS) criteria.

## 3.

[Purpose]{.underline}: The overall objectives of the audit are to:

3.1. Verify that the Direct Subscriber has internal controls in place to
ensure that only Class One Users receive the FAA Class One (real time)
Data Feed.

3.2. Ensure that the Direct Subscriber's software and hardware
architecture is sufficient to provide the FAA's Class One ASDI data feed
to Class One Users only. (This applies only to Direct Subscribers that
internally generate the Class One data feed at their level as well as
provide Class Two (time-delayed) data to Class Two Users).

**4.**

[Frequency]{.underline}: Annually, commencing First Quarter, CY 2003.
The first audit will be complete by March 31, 2003. Subsequent audits
will be completed by March 31st of each calendar year.

## 4.1. Direct Subscribers may initiate these annual audits at any time after program implementation (o/a Dec 1, 2002). 

**5.**

[Specific Criteria:]{.underline} For all Direct Subscribers receiving
the FAA Class One (real time) data feed, the Auditor will:

5.1. Develop a full understanding of the Revised ASDI/NASSI Memorandum
of Agreement (MOA), dated August 9, 2002. FAA point of contact for
inquiries will be the ASDI/NASSI POC per Section 15 of the MOA. Direct
Subscribers are strongly encouraged to familiarize their Auditors with
their products, processes, and technical architecture through
orientation sessions prior to the formal audit. Direct Subscribers and
their Auditors are encouraged to collaborate on the necessary
development of certification instruments prior the formal audit so that
the audit itself can be conducted most efficiently and effectively.

5.2. Have full access to the Direct Subscriber's customer Class One User
list and all supporting databases regarding the specific classification
of all the Direct Subscriber's Class One customers/clients. Such access
to the company's Class One databases will be before, during, and
following the formal audit.

5.2.1. The Auditor must take action to obtain the data bases in advance
of the audit, and familiarize themselves with the databases.

5.3. Verify that the Direct Subscriber has internal controls in place to
ensure that only Class One Users (as defined in Paragraph 5.2 of the
ASDI MOA) are receiving the Class One Data Feed from the Direct
Subscriber.

5.4. Identify any Indirect Subscribers receiving the Class One Data Feed
that do not qualify IAW Paragraph 5.2 of the MOA. The Direct Subscriber
company shall have a current Letter of Certification for each Class One
User on hand and available to the Auditors. The Auditors shall compare
these letters to the technical data base(s) of Indirect Subscribers
receiving the Class One Data Feed.

5.4.1. The Auditor must compare the certification letters to the
database listing of Indirect Subscribers who are receiving the Class One
Data Feed.

## 6.

[Additional Criteria]{.underline}: For Direct Subscribers providing FAA
ASDI data to both Class One and Class Two Users, the Auditor will:

6.1. Review the Direct Subscriber's system architecture for providing
service using the FAA Class One Data Feed to understand how the FAA's
Class One ASDI Data Feed is provided to Class One Users only by the
Direct Subscriber company being audited.

6.2. Test the Direct Subscriber's architecture by applying for both
Class One and Class Two service in sufficient sample size to validate
that the Direct Subscriber's architecture denies the Class One Data Feed
to Class Two Users. This will require the Direct Subscriber to set up
two side-by-side graphical displays for Auditors to validate
Class-specific processing (filtering) at the company level.

6.3. The Auditors shall have access to commercial phone lines and/or the
Internet to carry out application procedures identical to those used by
any prospective Indirect Subscriber applying to use the Direct
Subscriber's company's software and/or services.

## 7.

[Access]{.underline}: The Auditor shall have reasonable access to the
Direct Subscriber's facilities and personnel to conduct a thorough and
expeditious audit.

**8.**

[Audit Preparation]{.underline}: The Direct Subscriber and the Auditor
shall take the following actions in preparation for the audit itself.

8.1. The Direct Subscriber shall:

-Identify and provide to the Auditor a single point of contact within
the company/organization for the audit.

-Conduct Auditor orientation.

-Collaborate with the Auditor to develop the agreed-upon procedures for
the audit.

-Collaborate with the Auditor to develop the process and content for
letters of certification from Indirect Subscribers.

-Make available data bases to the Auditor.

-Prepare documents for the Audit

-Provide any other support to the Auditor as necessary to accomplish a
thorough and expeditious audit.

-Brief and make available company personnel to expedite the audit.

8.2. The Auditor will:

> -Provide a single point of contact for the audit to the Direct
> Subscriber.
>
> -Make available its personnel for a thorough orientation well in
> advance of the audit to ensure sufficient knowledge to finalize
> agreed-upon procedures with the Direct Subscriber and to accomplish
> all aspects of the audit.
>
> -Collaborate with the Direct Subscriber to develop the agreed-upon
> procedures for the audit.
>
> -Collaborate with the Direct Subscriber to develop the process and
> content for letters of certification from Indirect Subscribers.
>
> -Develop and prepare a checklist for the audit. Obtain FAA POC
> concurrence on the checklist prior to the audit.
>
> -Develop a questionnaire for the Direct Subscriber to complete prior
> to the audit in order to expedite the audit itself. Obtain FAA POC
> concurrence on the questionnaire prior to the audit.
>
> -Review all necessary databases and documents in advance of the audit.

## 9. 

[Conduct of the Audit]{.underline}:

9.1. The entire annual audit will be conducted at the site designated by
the Direct Subscriber company. Only company architecture variances will
result in a multi-site audit.

9.2. Audits shall be conducted in two distinct parts: Architecture
assessment and Class One User validation ---and in that order.

9.3. Whenever possible, audits should be scheduled, prepared for, and
accomplished in one business day trip after the Checklist/Questionnaire
has been reviewed by the Audit team. This does not include the
completion of the audit report.

9.4. The Auditor shall debrief the Direct Subscriber
company/organization on the initial observations of the audit at the end
of the on-site audit before leaving the premises. The Direct Subscriber
company shall make its key staff available for the audit debrief.

**10.**

[Deliverables:]{.underline} The Auditor must provide a written report
NLT 10 calendar days from the closeout date for the annual audit to FAA
David J. Hurley Air Traffic Control Systems Command Center, Manager,
System Requirements, ATT-220, 13600 EDS Drive, Suite 100, Herndon, VA
20171. ATTN: ASDI/NASSI POC.

10.1. The audit report will itemize and thoroughly explain any
corrective action that the Audit Recommends be taken by the Direct
Subscriber company. A copy of the annual audit report will be provided
to the Direct Subscriber company at the time the Auditor submits it to
the FAA.

## 

**11.**

[Corrective Action:]{.underline} Audit recommendations or corrective
actions required to bring the Direct Subscriber into compliance with the
MOA shall be implemented in a timely manner (as specified by the FAA in
the response to the audit report) or the FAA may take action IAW Section
12 of the MOA.