Memorandum of Agreement

For Industry Access to

Aircraft Situation Display and National Airspace System Status
Information Data

March 17, 2004

# Parties

This Memorandum of Agreement (MOA) is entered into by and between the
Federal Aviation Administration (FAA) and
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_,
hereafter referred to as a Direct Subscriber (defined in Section 5.4
below). The parties do hereby agree and obligate themselves to abide by
the rights, responsibilities, and other conditions defined in this
agreement.

# Background

In accordance with principles embodied in the Technology Transfer Act,
the Federal Aviation Administration (FAA) is making air Traffic Flow
Management (TFM) data, such as filtered Aircraft Situation Display (ASD)
and National Airspace System (NAS) Status Information (NASSI) data, as
well as subsets of that data, available to the aviation and other
industries based on defined classes of users.

The ASD data includes the near real time position and other relevant
flight data for every civil instrument flight rules (IFR) aircraft
receiving radar services within the NAS. The filtered data, meaning that
military and sensitive operations are not included, is referred to as
ASD to Industry (ASDI) data. The NASSI data includes a wide range of
information regarding the status of NAS components, such as airport
runway visual range and special use airspace data.

In 1992, the FAA joined with the Air Transport Association of America
through a Cooperative Research and Development Agreement to research the
operational and economic value of providing ASDI data to the aviation
industry. The research with a prototype capability clearly showed that
industry access to ASDI data can provide immediate and significant
economic benefits to airlines by providing an increased dispatching
flexibility to more efficiently manage their own operational (e.g.,
aircraft, aircrews, etc.) resources. The research also demonstrated that
ASDI data could present an opportunity for other commercial and academic
institutions to build upon the data to achieve advances in commercial
services to the aviation community and aviation-related research. As a
result of these findings, on December 5, 1997, the FAA established the
ASDI data feed.

Given the economic and aviation service benefits that have evolved from
the release of ASDI data, it has become clear that the additional
operational flow management data generated through the Collaborative
Decision Making (CDM) program could stimulate even more benefits to the
aviation community and the public. Therefore, in September 1998, the FAA
authorized the augmentation of ASDI data through the release of selected
NASSI data elements. This MOA is the agreement for authorized access to
filtered ASDI and/or selected NASSI data.

As a result of the aviation-related attacks of September 11, 2001 in the
United States, the FAA reviewed security risks related to the ASDI/NASSI
feed and determined that only Subscribers that are Class One Users (See
Section 5.2) are authorized to receive the full near real time ASDI and
NASSI data set (this includes Direct Subscribers with Class One Indirect
Subscribers). Subscribers that are Class Two Users (See Section 5.3) are
not authorized to receive near real time flight tracking and position
messages. Class Two Users are only authorized to receive the full ASDI
and NASSI data set that has been time-delayed at least 5 minutes. The
scope and content of ASDI/NASSI data that will be available to
government users and research and development organizations will be
determined by the FAA on a case-by-case basis. Sections 7.1 and 7.2 of
this MOA describe the responsibilities of the FAA and Direct
Subscribers, including limits on redistribution of the ASDI and NASSI
data.

# Purpose

This MOA identifies the rights, responsibilities, and other conditions
for the FAA and the Direct Subscribers (both Class One and Class Two
Users) of ASDI and NASSI data. This MOA supersedes the ASDI/NASSI MOA
dated May 4, 2000.

# Authority

The FAA's authority to enter into this MOA is governed by 49 United
States Code (U.S.C.) 106 (l)(6).

# Definitions

## ASDI Data:

The subset of ASD data as defined by current technical specifications
that are provided to commercial air carriers and other aviation-related
industries.

## Class One User:

A Class One User is a professional aviation organization with an
established flight dispatch or planning function that requires near real
time positional flight-tracking capabilities. This organization must
have direct responsibility for dispatching or tracking aircraft it owns
or be contracted by the owner of the aircraft to do so. Examples are
airlines, regional air carriers, air taxis, any organization providing
dispatch or tracking functions for aircraft owners, flight operation
centers, government users (as described in Section 5.5), and
professional flight planning service providers.

Fixed Base Operators (FBOs), corporate flight departments, and part 135
operators must have direct responsibility for dispatching or tracking
aircraft to qualify as a Class One User. The FAA shall be the final
arbiter for any disputes regarding the interpretation of this Section
(see Section 13).

## Class Two User:

A Class Two User is any user not meeting the criteria of a Class One
User (e.g., most general aviation; non-aviation-related entities and
individuals; any other entity without a specific requirement for near
real time positional flight-tracking). Class Two Users can obtain Class
Two (time-delayed data) either directly from the FAA Enhanced Traffic
Management System Hubsite Class Two ASDI/NASSI interface or from Direct
Subscribers that provide time-delayed Class Two data.

## Direct Subscriber:

A Direct Subscriber is any entity that receives the ASDI/NASSI data
(Class One or Class Two) directly from the FAA Enhanced Traffic
Management System Hubsite. A Direct Subscriber will be eligible to
receive Class One data only if they have Class One Subscribers as
defined in section 5.2. Entities (e.g., AT&T, MCI, Sprint) solely
providing communications support under contract to Direct Subscribers
are not considered to be Direct Subscribers.

## Government User:

A Government User is a national, federal, state, or local government
organization, airport authority, or authorized organizations acting on
behalf of a Government organization.

## Indirect Subscriber:

An Indirect Subscriber is an entity that receives the ASDI/NASSI data
but not directly from the FAA Enhanced Traffic Management System
Hubsite. Indirect Subscribers that redistribute data received from
Direct Subscribers are subject to the same requirements and restrictions
as the Direct Subscriber, as detailed in section 7.2. . If an Indirect
Subscribers receives Class One data and redistributes Class One or Class
Two data, that Indirect Subscriber will be subject to the audit in
accordance with section 7.2.15. However, Indirect Subscribers that
receive and redistribute only Class Two data are not subject to the
audit in section 7.2.15.

## NASSI Data:

The subset of NAS status information that is provided to Direct
Subscribers. The NASSI data includes a wide range of specific
TFM-related airport, airspace, and system information that reflects the
condition and operational status of the NAS. As is the case with the
ASDI feed, the elements of the NASSI data revealing aircraft position
are only available in near real time to Class One Users and with at
least a 5 minute time-delay to Class Two Users.

## Data Access:

Class One Users are authorized to receive the full near real time ASDI
and/or NASSI data feed (Class One data). Class Two Users are only
authorized to receive the full ASDI and/or NASSI data feed that has been
time-delayed at least 5 minutes (Class Two data). Government
organizations and aviation system research and development industries
will be categorized by the FAA on a case-by-case basis. Access and use
restrictions for non-United States domestic ASDI/NASSI data are provided
in an Addendum to this MOA. Direct Subscribers may access ASDI data only
(or a subset thereof), NASSI data only (or a subset thereof), or both
ASDI and NASSI data (or subsets thereof).

# Scope

This MOA and its addenda apply to the transmission, receipt, utilization
and redistribution of ASDI and/or NASSI data by Direct Subscribers and
the FAA.

# Rights and Responsibilities

## Federal Aviation Administration (FAA)

The FAA shall:

### 

Provide the Direct Subscriber with the technical specifications,
communications protocols, equipment requirements, ASDI and/or NASSI data
message formats, and other relevant technical information necessary to
receive and interpret the ASDI and/or NASSI data stream. The FAA shall
also provide a point of contact for twenty-four hour technical support
to the communications entity providing the ASDI and/or NASSI physical
interface.

### 

Be responsible for providing the Direct Subscriber with physical access
to ASDI and/or NASSI data. The Class One User data interface will
provide the full near real time ASDI and NASSI message set as defined by
current technical specifications. The Class Two User data interface will
provide ASDI and/or NASSI data time-delayed at least 5 minutes.

### 

Provide class-appropriate ASDI and/or NASSI data consistent with the
timeliness, accuracy, reliability, maintainability, and availability of
the operational TFM system data.

### 

Have the sole right to relocate, upgrade, and/or update the ASDI and/or
NASSI data stream in order to take advantage of advances in technology
and for other reasons. The FAA shall provide notice of such changes to
the Direct Subscriber not less than sixty (60) calendar days prior to
their implementation.

###  

Have the sole right to modify the content (including data elements) of
the ASDI and/or NASSI data stream. The FAA shall provide notice of such
changes to the Direct Subscriber not less than sixty (60) calendar days
prior to their implementation.

###  

Have the sole right and responsibility to approve, prior to public
availability, any and all applications of ASDI and/or NASSI data that
can or are intended to be directly and freely accessed by the general
public via an unrestricted, public access, mass media communications
technology (e.g., Internet, television).

### 

Have the sole right to identify Direct and Indirect Subscribers not in
compliance with this agreement and to interrupt, or direct the
interruption and/or termination (see Section 12.0) of the ASDI and/or
NASSI data stream to those recipients.

###  

Have the sole right, with timely written notification, to modify this
MOA and its addenda if it is in the best interests of the United States
Government, the aviation industry, or the general public.

### 

Have the sole right to establish the criteria for the annual Direct
Subscriber audits (see Addendum).

### 

Take appropriate measures to protect proprietary, privileged, or
otherwise confidential information that may come into its possession as
a result of this MOA.

### 

It is important to note that service interruptions with the ASDI/NASSI
data may occur due to operational necessity, safety and security
concerns, and/or hardware failure. Final authority to deny access to
data in accordance with the terms of this agreement shall reside with
the ASDI/NASSI POC (identified in Section 15.0 below). The FAA shall not
be held responsible or retain any legal obligation as to the accuracy,
validity, or continued availability of the data.

## Direct Subscriber

The Direct Subscriber shall comply with the provisions identified in
this Section. A violation of any of these provisions shall be considered
an information security violation and the FAA's rights under section
7.1.11 and/or 12.0 shall apply. The Direct Subscriber shall:

###  

Provide and maintain the hardware, software, communications facilities,
and any other resources needed to receive and interpret the ASDI and/or
NASSI data. The Direct Subscriber receiving Class One data shall create
and maintain a system architecture that guarantees that near real time
Flow Control Track and/or Flight Data Block Information (TZ and/or TO
messages) are only provided to Class One Users. The Direct Subscriber
receiving Class One data shall ensure that any Class Two data that they
delay internally is time-delayed at least 5 minutes. The Direct
Subscriber shall submit to the FAA ASDI/NASSI POC for approval a plan
identifying their system architecture. For Direct Subscribers to Class
One data, this plan shall include a description of the Direct
Subscriber\'s information security capability (firewalls, security
software, encryption, etc.) that provides for separate logical data
feeds from the FAA Enhanced Traffic Management System Hubsite to
Indirect Subscribers for Class One and Two Users. The Direct Subscriber
shall be required to comply with the procedures for non-United States
domestic ASDI/NASSI data and the Audit Requirements for Direct
Subscriber Receiving Class One Data as provided for in the Addenda to
this MOA. In the event the ASDI and/or NASSI data stream is relocated,
upgraded, updated, and/or modified, the Direct Subscriber shall be
responsible, at its own expense, for providing and maintaining the
hardware, software, communications facilities and all other resources
needed to continue to receive and interpret the ASDI and/or NASSI data.

### 

Interact with the ASDI/NASSI data hub in accordance with information
security requirements defined by the FAA in the ASDI Functional
Description and Interface Control Document.

### 

Agree to provide and demonstrate to the satisfaction of the FAA
ASDI/NASSI POC (identified in Section 15.0 below) the capability to
selectively block the display of any data related to any identified
aircraft registration number.

### 

### Not release ASDI and/or NASSI data for use by law enforcement agencies or for use in any civil litigation, except pursuant to court order. The Direct Subscriber shall notify the FAA that such release has been made. {#not-release-asdi-andor-nassi-data-for-use-by-law-enforcement-agencies-or-for-use-in-any-civil-litigation-except-pursuant-to-court-order.-the-direct-subscriber-shall-notify-the-faa-that-such-release-has-been-made. .unnumbered}

### 

Provide the FAA ASDI/NASSI POC with the conceptual, operational, and
technical details for any and all planned applications of ASDI data, or
enhancements to existing applications, that can or are intended to be
directly and freely accessed by the general public via an unrestricted,
public access, mass media communications technology (e.g. Internet,
television) for FAA approval.

### 

Obtain written approval from the FAA for the release and/or display of
ASDI and/or NASSI data that can or is intended to be accessed by the
general public via an unrestricted, public access, mass media
communications technology (e.g., Internet, television).

### 

RESERVED

### 

Not contact the: (a) FAA ASDI/NASSI POC; (b) any FAA air traffic control
facility; or (c) the Air Traffic Control System Command Center (ATCSCC)
regarding operational traffic flow management issues. The only
exceptions are authorized personnel representing aircraft operators and
others explicitly authorized in writing by the FAA ASDI/NASSI POC to do
so.

###  

Provide associated Indirect Subscribers with the technical
specifications, communications protocols, equipment requirements,
message formats, and other relevant technical information necessary to
receive and interpret the ASDI and/or NASSI data stream.

### 

Provide associated Indirect Subscribers with any and all documentation
received from the FAA regarding the timeliness, accuracy,
interpretation, and other properties of specific ASDI and/or NASSI data
elements.

###  

Maintain a current and historical listing of all associated Indirect
Subscribers and forward that listing to the FAA ASDI/NASSI POC by 1
March of each year, as well as at any time the FAA ASDI/NASSI POC
requests such a listing.

###  

Ensure that all agreements/contracts with Indirect Subscribers: (a)
extend in writing to all Indirect Subscribers the rights,
responsibilities, data use restrictions, exclusion of warranties,
limitation of remedies, and liability conditions defined in this
document including the classification of users, and the provisions
stated in sections 7.2.1, 7.2.5, 7.2.6, and 7.2.11; (b) state that
commercial product(s) based on the ASDI and/or NASSI data are not
guaranteed, sponsored, recommended, warranted, or endorsed by the FAA;
(c) include the wording in Paragraph 8.0 regarding the issue of personal
privacy, (d) prohibit all Indirect Subscribers from contacting the FAA
ASDI/NASSI POC or the ASDI/NASSI hub site in the event of technical or
system problems, but to direct such communications to their data
provider, and (e) prohibit all Indirect Subscribers, (except for
authorized personnel representing aircraft operators and others
explicitly authorized in writing by the FAA ASDI/NASSI POC to do so)
from contacting the FAA ASDI/NASSI POC, any FAA air traffic control
facility, or the Air Traffic Control System Command Center (ATCSCC)
regarding operational traffic flow issues*.*

### 

At the written direction of the FAA, interrupt or direct the
interruption of the ASDI and/or NASSI data stream to Indirect
Subscribers identified by the FAA as being in non-compliance with any of
the provisions listed in Section 7.2.12 (incorporated into the Direct
Subscriber/Indirect Subscriber agreement/contract).

### 

Be responsible for compliance with any export control restrictions
(e.g., Department of Commerce Bureau of Export Administration) in
connection with the use or dissemination of any interface and/or
transmission of software or documentation.

### 

Be subject to the audit requirements for Direct Subscribers (including
Indirect Subscribers to Class One data that redistribute data received
from Direct Subscribers) as detailed below and in the Addendum to this
MOA on Audit Requirements for Direct Subscriber Receiving Class One
Data.

All Direct Subscribers receiving the Class One (real time) ASDI data
feed will be subject to an annual audit. However, Direct Subscribers
receiving only the Class Two (time-delayed) ASDI data feed are not
subject to this audit.

The audit shall be an Agreed-To (Upon) Procedures Audit.

Direct Subscribers requiring annual audit will select their own audit
firm. The audit firm will meet the standards of the American Institute
of Certified Public Accountants (AICPA). The attestation type audits
will be conducted in accordance with the Statements on Audit Services
(SAS) criteria for Agreed-To (Upon) Procedures Audits.

If the Direct Subscriber provides the Class One ASDI data feed to Class
One Users only, the audit will verify that each Indirect Subscriber
receiving the Class One data feed (or data derived from the Class One
Data Feed) meets the requirements in paragraph 5.2 above (Class One
User).

If the Direct Subscriber provides the Class One ASDI data feed to Class
One Users and also provides (direct or internally-generated) Class Two
(time-delayed) ASDI Data to Class Two Users, the audit will: (a) verify
the technical architecture and internal controls are in place at the
Direct Subscriber site(s) necessary to ensure only qualified Class One
Users can receive the Class One ASDI Data Feed (or data derived from the
Class One Data Feed); and (b) each Indirect Subscriber receiving the
Class One (real time) ASDI data feed meets the requirements in paragraph
5.2 above (Class One User).

The Direct Subscriber being audited shall bear the full cost of the
annual audit.

### 

Direct Subscribers and their associated Indirect Subscribers are
prohibited from displaying IFR track data on aircraft not correlated by
ASDI flight plan and/or aircraft identification.

# Personal Privacy Issues

The ASDI and NASSI data includes the near real time position and other
flight data associated with civil instrument flight rules (IFR)
aircraft. While commercial operators conduct business according to a
published listing of service and schedule, general aviation operators do
not. It is possible that public knowledge of the flight information of
general aviation operators could compromise the privacy and/or security
of individuals. Because the protection of such information is not
covered under the Privacy Act (5 U.S.C. 552a), and because the cost of
developing and operating the technical mechanisms required to manage
that information exceed available FAA resources, all Direct Subscribers
(as a condition of signing this MOA) and Indirect Subscribers (as a
condition of signing agreements with Direct Subscribers) are asked to
consider and respect this personal privacy issue when developing and/or
marketing ASDI and/or NASSI-based products. If the FAA determines that
any Direct and/or Indirect Subscribers develop and/or market products
that violate this provision, the FAA's rights under Section 12.0 shall
apply.

# Exclusion of Warranties

All warranties, expressed or implied, are excluded from this agreement
and shall not apply to the data or services (including software
compatibility) that the Direct and Indirect Subscribers receive under
this agreement. Specifically, all implied warranties of merchantability
and "fitness for a particular purpose" for the data or services
(including software compatibility) that the Direct Subscriber receives
from the FAA are also excluded under this MOA and its Addenda.

# Limitation of Remedies

The FAA shall not be liable to the Direct Subscriber, Indirect
Subscriber, or any other entity for any loss, damage, claim, liability,
expense, or penalty, or for any indirect, special, secondary,
incidental, or consequential damages deriving from the use of the ASDI
and/or NASSI data.

# Indemnification

The Direct and Indirect Subscribers agree to indemnify and hold harmless
the Government and its respective officers, employees, and agents, from
and against all claims, demands, damages, liabilities, losses, suits,
and judgments (including all costs and expenses incident thereto), which
may accrue against, otherwise be chargeable to the Government by reason
of, or as a direct and proximate result of, the Direct or Indirect
Subscriber's use of the ASDI and/or NASSI data or software received
under this agreement.

# Termination of this Agreement

Any party may voluntarily terminate this MOA by written notice to the
other party, provided no termination may be effective in less than
ninety (90) calendar days from the date of such written notice. In the
event a Direct Subscriber ceases its business operations, they must
notify the FAA within five (5) business days.

If the Direct Subscriber, or any of its Indirect Subscribers, fails to
abide by the requirements of this MOA and its Addenda, the Direct
Subscriber's access to data covered under this MOA and its Addenda may
be terminated immediately by written notice of termination issued by the
FAA. The FAA reserves the right, at its sole discretion, to reinstate a
User's access to the ASDI and/or NASSI data feed if the User can
satisfactorily demonstrate to the ASDI/NASSI POC that they are in
compliance with the terms of the MOA and its Addenda. However, in all
cases, the FAA reserves the right for termination to be final and
permanent, with no opportunity for reinstatement.

Whenever written notice of termination is issued by or received by the
Direct Subscriber, the Direct Subscriber shall immediately return all
Government equipment (if any), software and associated documentation
that the Government issued to the Direct Subscriber pursuant to this MOA
and its Addenda.

# Disputes

Where possible, disputes will be resolved by informal discussion between
the parties. In the event the parties are unable to resolve any
disagreement through good faith negotiations, the FAA Manager, Tactical
Operations Division, Air Traffic Control System Command Center (ATCSCC),
will resolve the dispute. This decision is final and binding.

# Notices

Written/electronic notices to the Direct Subscriber shall be sent to the
following address:

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Electronic address:
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

# FAA Point of Contact (POC)

Written notices to the FAA shall be sent to the address shown below.

Federal Aviation Administration

David J Hurley Air Traffic Control System Command Center

ATTN: ASDI/NASSI POC

13600 EDS Drive, Suite 100

Herndon, Virginia 20171-3233

# Effective Date

# This agreement shall be effective on the date that the FAA signatory below executes it and shall remain in effect for five (5) years or until otherwise terminated.  {#this-agreement-shall-be-effective-on-the-date-that-the-faa-signatory-below-executes-it-and-shall-remain-in-effect-for-five-5-years-or-until-otherwise-terminated. .unnumbered}

# 17 Signatures

  -------------- ------------------------------ -- ---------------------------------- -- --
  **Direct                                         **Federal Aviation                    
  Subscriber**                                     Administration**                      

                 Class One                                                               

                 Class Two                                                               

                                                                                         

  Signature                                        Signature                             

                                                   Michael J. Sammartino                 

  Name (Printed)                                                                         

                                                   Director of System Operations,        
                                                   ATO-R                                 

  Title                                            Title                                 

                                                                                         

  Date                                             Date                                  
  -------------- ------------------------------ -- ---------------------------------- -- --

**ADDENDUM**

**ON**

**NON-UNITED STATES DOMESTIC ASDI/NASSI DATA**

**TO**

Memorandum of Agreement

**For Industry Access to**

**Aircraft Situation Display and National Airspace System Status
Information Data**

# 1 Non-United States Domestic ASDI/NASSI Data {#non-united-states-domestic-asdinassi-data .unnumbered}

## 1.1 {#section-27 .unnumbered}

A Class One User may receive access to British flight data (London
data).

## 1.2 {#section-28 .unnumbered}

A Class One User is authorized to receive the London data if it is
designated an *approved recipient* by satisfying one or both of the
following conditions:

-   The Class One User is an air carrier and/or cargo carrier.

-   The Class One User owns and operates aircraft in Europe, and
    therefore, pays landing fees and air traffic control fees in Europe.

If the Class One User does not fulfill at least one of these conditions,
then that User is not authorized to receive any London data.

## 1.3 {#section-29 .unnumbered}

A Direct Subscriber shall ensure the London data access, use, and
distribution restrictions defined in this Addendum are enforced. If the
Direct Subscriber violates this provision, the FAA's rights under
Paragraph 12.0 shall apply.

## 1.4 {#section-30 .unnumbered}

A Direct Subscriber shall receive written approval from the FAA in order
to receive the London data. Without this approval, the Direct Subscriber
is only authorized to receive ASDI/NASSI data that does not contain
London data.

## 1.5 {#section-31 .unnumbered}

A Direct Subscriber shall comply with the steps and conditions outlined
in the current version of the Aircraft Situation Display To Industry:
Functional Description and Interface Control Document to be authorized
to receive the London data.

ADDENDUM

ON

Audit Requirements for Direct Subscribers Receiving Class One Data

TO

Memorandum of Agreement

For Industry Access to

Aircraft Situation Display and National Airspace System Status
Information Data

# 1 Audit Requirements {#audit-requirements .unnumbered}

## 1.1 {#section-32 .unnumbered}

An audit is required for all Direct Subscribers that receive ASDI/NASSI
Class One data from the Class One FAA data interface. The audit
requirement also applies to Indirect Subscribers to Class One data that
redistribute data received from Direct Subscribers. Direct Subscribers
receiving only the Class Two (time-delayed) FAA data interface are not
subject to the audit requirements.

## 1.2 {#section-33 .unnumbered}

[Audit Type]{.underline}: Agreed-To (Upon) Procedures (attestation type)
Audit in accordance with appropriate Statements on Audit Services (SAS)
criteria.

## 1.3 {#section-34 .unnumbered}

[Purpose]{.underline}: The overall objectives of the audit are to:

(1) Verify that the Direct Subscriber has internal controls in place to
    ensure that only Class One Users receive the FAA Class One (real
    time) Data Feed.

(2) Ensure that the Direct Subscriber's software and hardware
    architecture is sufficient to provide the FAA's Class One ASDI data
    feed to Class One Users only. (This applies *only* to Direct
    Subscribers that internally generate the Class One data feed at
    their level as well as provide Class Two (time-delayed) data to
    Class Two Users).

## 1.4 {#section-35 .unnumbered}

[Frequency]{.underline}: Annually, commencing First Quarter, CY 2003.
The first audit will be complete by March 31, 2003. Subsequent audits
will be completed by March 31st of each calendar year.

## 1.5 {#section-36 .unnumbered}

[Specific Criteria:]{.underline} For *all* Direct Subscribers receiving
the FAA Class One (real time) data feed, the Auditor will:

1\. Develop a full understanding of the Revised ASDI/NASSI Memorandum of
Agreement (MOA), dated August 9, 2002. FAA point of contact for
inquiries will be the ASDI/NASSI POC per Section 15 of the MOA.

2.Have full access to the Direct Subscriber's customer Class One User
list and all supporting databases regarding the specific classification
of all the Direct Subscriber's Class One customers/clients.

3.Verify that the Direct Subscriber has internal controls in place to
ensure that only Class One Users (as defined in Paragraph 5.2 of the
MOA) are receiving the Class One Data Feed (as defined in Paragraph 5.8
of the MOA) from the Direct Subscriber.

4\. Identify any Indirect Subscribers receiving the Class One Data Feed
(as defined in Paragraph 5.8 of the MOA) that do not qualify IAW
Paragraph 5.2 of the MOA.

## 1.6 {#section-37 .unnumbered}

[Additional Criteria]{.underline}: For Direct Subscribers providing FAA
ASDI data to *both* Class One and Class Two Users, the Auditor will:

1.Review the Direct Subscriber's system architecture for providing
service using the FAA Class One Data Feed to understand how the FAA's
Class One ASDI Data Feed is provided to Class One Users only.

2\. Test the Direct Subscriber's architecture by applying for both Class
One and Class Two service in sufficient sample size to validate that the
Direct Subscriber's architecture denies the Class One Data Feed to Class
Two Users. This will require the Direct Subscriber to set up two
side-by-side graphical displays for auditors to validate Class-specific
processing (filtering) at the company level.

## 1.7 {#section-38 .unnumbered}

[Access]{.underline}: The Auditor shall have reasonable access to the
Direct Subscriber's facilities and personnel to conduct a thorough and
expeditious audit. The Direct Subscriber shall prepare documents,
demonstrations, and make available company personnel to expedite the
audit.

## 1.8 {#section-39 .unnumbered}

[Deliverables:]{.underline} The Auditor must provide a written report
NLT 10 calendar days from the closeout date for the annual audit to FAA
David J Hurley Air Traffic Control Systems Command Center, Manager,
Systems Requirements, ATT-220, 13600 EDS Drive, Suite 100, Herndon, VA
20171. ATTN: ASDI/NASSI POC.

## 1.9 {#section-40 .unnumbered}

[Corrective Action:]{.underline} Audit recommendations or corrective
actions required to bring the Direct Subscriber into compliance with the
MOA shall be implemented in a timely manner (as specified by the FAA in
the response to the audit report) or the FAA may take action IAW Section
12 of the MOA.