Attachment 13- TO1 PWS_amendment 4.pdf

Performance Work Statement (PWS) Indefinite Delivery Indefinite Quantity (IDIQ)

Task Order #1 Cybersecurity, Compliance, and Quality Assurance Services

As of 01/10/2023

I. GENERAL REQUIREMENTS:

1. Introduction: As a critical component of United States Department of Agriculture (USDA), the Rural Development (RD) Mission Area is driven by a mission to stimulate, grow, and protect the American rural economy by providing loans, grants, and loan guarantees to individuals and commercial entities engaged in the betterment of rural life.

The USDA RD Technology Office (RDTO) requires a qualified contractor to provide knowledge, skills, abilities, staff support, and other related resources necessary to support the following Professional Services in On-Prem and Salesforce environment for Cybersecurity, Compliance, and Quality Assurance Services.

2. Type of Contract Firm Fixed Price, Task Order #1, for professional services defined in the Task Order #1 PWS Scope and identified by Contract Line Item Numbers (CLINs).

The Contractor shall comply with all terms and conditions of their awarded IDIQ #TBD.

The terms and conditions in the USDA IDIQ #TBD apply to all task orders placed pursuant to it. In the event of an inconsistency between the terms of the IDIQ and a Task Order, the terms of the Task Order will take precedence.

3. Place(s) of Performance The Contractor shall perform the requirements of this PWS at the authorized contractor approved locations (remote) unless otherwise specifically stated in this PWS. Support for this work will be primarily at the contractor location, however, the government may request meetings and/or limited contractor support at the authorized government locations with advanced notice. Currently all tasks are being supported remotely/virtually in support of efforts to combat COVID-19. Virtual meetings shall be conducted using USDA/RD standard-issue teleconference software.

Approved work locations are:

a. USDA Rural Development

1400 Independence Ave SW Washington DC, 20250

b. One Metropolitan Square 211 N. Broadway Saint Louis, MO 63102-2711

c. Contractor/Vendor location as approved by COR and CO.

4. Days and Hours of Performance The Contractor is required to be available on non-government holidays from 9:00 am EST until 5:00 pm EST, Monday through Friday to correspond with USDA RD’s point of contacts, such as the Contracting Office, Contracting Officer’s Representative, and the Program/Technical Office. The Contractor is required to provide emergency phone numbers, along with regular contact phone numbers and email addresses.

Federal Holiday Schedule

New Year’s Day

Martin Luther King, Jr. Birthday

Washington’s Birthday

Memorial Day

Juneteenth National Independence Day

Independence Day

Labor Day

Columbus Day

Veterans Day

Thanksgiving Day

Christmas Day

5. Period of Performance

6. Kickoff Meeting At the Government’s request, the Contractor shall participate in the kickoff meeting when the contract is established. The Contractor is to provide meeting minutes to the COR and CO within 24 hours after the meeting completion. This meeting will be virtual to allow all stakeholders to attend.

The contractor shall provide and collaborate with the COR on an agenda for this meeting. Discussion topics shall include, but not be limited to: introduction of government and contractor and staff, government expectations, discussion of contract requirements, contract management expectations, schedule of deliverables and addressing contractor questions.

The Kick-Off meeting will take place within five (5) days from award and will be scheduled by the

COR.

7. Travel:

Travel will not be authorized under this Task Order #1 acquisition.

PERFORMANCE PERIODS

Based Period Starting the date of the Task Order Award Period of Performance (PoP) for a duration of one year (12 months).

8. Onboarding Process

At the Task Order level, the Contractor shall manage the onboarding of its staff for all Contractor personnel who have not yet been onboarded at USDA. Onboarding includes steps to obtain a USDA network and email account, complete training, initiate background investigations, and gain physical and logical access, which may include elevated privileges to the necessary development and test environments for the various systems to be enhanced.

A single Contractor Onboarding point of contact (POC) shall be designated by the Contractor that tracks the onboarding status of all Contractor personnel. The Contractor Onboarding POC shall be responsible for accurate and timely submission of all required USDA onboarding paperwork to the COR. The Contractor shall be responsible for tracking the status of all its staff’s onboarding activities and report the status at the staff level during onboarding status meetings. The Contractor shall provide, to the COR, an Onboarding Status Report for any staff with outstanding onboarding requests.

Deliverable:

A. Onboarding Status Report – due weekly.

This report is to include all relevant details of the onboarding process, including but not limited to:

1. All outstanding onboarding requests that need to be reviewed by the COR.

2. Contractor personnel who began the onboarding process in the last 7 days.

3. Report of Contractor personnel who completed the onboarding process in the last 7 days.

II. SCOPE OF WORK

1. General Scope

Rural Development requires a qualified contractor to provide knowledge, skills, abilities, staff support, and other related resources necessary to support the following Professional Services in On- Prem and Salesforce environment for Cybersecurity, Compliance, and Quality Assurance Support Services Rural Development IDIQ #TBD, Task Order #1.

The Tasks for Focus Area 2 and 3 are in an On-Prem and Salesforce environment and shall include the following:

2. Focus Area 2 Task(s): Compliance and Assessment Services o Task 1: Cybersecurity Compliance Support The contractor shall:

o Complete an assessment of 20 RD systems annually as defined by (but not limited

to) NIST 800-37 Rev 2 Step 3.5, USDA RMF Step 4 SOP, and RD policies. This includes 1/3 annual control testing plus all new NIST 800-53 Rev 5 controls.

o Interpret and assess NIST 800-53 Revision 5 security and privacy controls.

o Develop an effective Security Assessment Plan (SAP).

o Conduct an impartial assessment of system-specific, common and hybrid controls, as applicable.

o Provide Technical Expertise with hardware, software, and firmware components as they relate to an accreditation boundary.

o Complete Security Assessment Report and Remediation actions.

o Coordinate all activities (assessment plan, control assessments, assessment reporting, remediation actions, plan of action and milestones) with stakeholders (including but not limited to Information System Security Officer (ISSO), Information System Security Program Manager (ISSPM), Assistant Chief Information Security Officer (ACISO), RD Technical staff and other subject matter experts.

o Facilitate with the USDA RD Compliance Branch in strategically managing the workload levels to ensure successful re-authorization of information systems on or before the expiration dates.

o Manage and maintain consistent flow of assessment activity and report the status on an agreed upon frequency.

o Assess Security Controls.

o Develop and deliver Security Authorization training as needed to stakeholders, IT staff, and customers.

o Task 2: Cybersecurity Assessment Support o Provide the full range of assessment activities to include Management, operational, technical and privacy control requirements. Create the Security Assessment Plan (SAP) to document the assessment schedule, tools, and personnel. Approval of the assessment approach and scope should be obtained. A Rules of Engagement (ROE) document should be developed where vulnerability scanning, or penetration testing procedures are included in the assessment. A final report of the assessment findings should be documented in the Security Assessment Report (SAR).

This task consists of the following subtasks:

Subtask 1 – Hold stakeholder kickoff meeting at the start of each assessment.

Subtask 2 - Review and update the Privacy Impact Assessment and Privacy Threshold

Analysis documentation. Update and provide expert guidance for the development and completion of System of Record Notices and Computer Matching Agreements.

Subtask 3 - Assessment Preparation. Develop, review, and obtain Government approval of a plan to assess the security controls, and develop a ROE document. Deliverables for Assessment Preparation include an SAP and ROE.

Subtask 4 - Security and Privacy Control Assessment. Assess the controls in accordance with the assessment procedures defined in the SAP. Deliverables for Security Control Assessment include, but are not limited to, a Security Categorization Review, a System Security Plan generation and analysis, Risk-Threat Pairing report, Risk Residual Report and a Risk Assessment Results Report in accordance with USDA RMF Step 4 SOP.

Subtask 5 - Security Assessment Report (SAR). Prepare the SAR documenting the issues, findings, and recommendations from the security control assessment. Maintain accurate and current documentation in the security artifact repository using agency defined tools. Deliverables for SAR include, but are not limited to, an SAR that includes a Vulnerability Assessment and a Briefing (slides and meeting support).

Subtask 6 –Debrief Remediation of Findings. Conduct debriefs with appropriate points of contact to detail findings and remediation actions based on the findings and recommendations of the SAR. Deliverables for Remediation Actions include, but are not limited to, a Residual Risk Report, Risk-Threat Pairing Report, and a Risk Assessment Results.

Subtask 7 - The contractor shall follow the issue resolution process for any identified vulnerability or issue identified throughout the RMF. Issue resolution is used to communicate issues to key stakeholders and document risk-based decisions to include risk acceptance, correcting vulnerabilities, and retesting, or creating a Plan of Action and Milestones (POA&M). Issue resolution provides an audit trail, accelerates the RMF, and documents management accountability.

2.1 Compliance and Assessment Deliverables

It is the responsibility of contractor to complete (perform, administer, track, report on) all Cybersecurity Tasks listed in this PWS. The contractor shall deliver all documentation related to the associated tasks. These documents may vary in size based on complexity of the systems. RD systems are considered low and moderate with no High’s in the portfolio.

Current production systems have existing documentation that will be reviewed and updated annually or as needed based on planned system enhancements. New systems will need completed documents.Work products associated with this task may include supporting the following key areas:

1. Privacy Impact Assessment and Privacy Threshold Analysis documents

2. System of Record Notices and Computer Matching Agreements documents

3. Security Assessment Plan document

4. Rules of Engagement document

5. System Security Plan document

6. Risk-Threat Pairing Report, Residual Risk Report and Risk Assessment Results Report

7. Security Assess Report

8. Plan of Action and Milestone creation in agency defined tools

9. Artifact documentation uploaded into agency defined tools

10. Kickoff meeting at the beginning of each assessment and include agenda, presentation, timelines, and points of contacts

11. Vulnerability assessment briefings at the end of each assessment

12. Conduct debrief meetings with the stakeholders at the end of each assessment (system-specific)

13. Conduct a CY debrief for all systems (overall view) for system executives

14. Develop and deliver Security Authorization training

The contractor shall adhere to the following for all deliverables:

Timeframe – Assessments to begin within one week of assessment kickoff meeting.

Assessments to be conducted on RD Low and Moderate systems based on applicable controls.

Format - accepted formats include Microsoft and Atlassian products or another Government approved format.

Quality - must be logical, analytical, and free of errors.

Analysis – thorough analysis of risk impact to RD as a result of discoveries in the key areas above.

3. Focus Area 3 Task(s): Quality Assurance and Testing Services o Task 1: Project Team(s) Membership o Support the Project Teams by:

o Attend any meetings deemed necessary for Quality Assurance support of the Projects.

o Work with Federal and other Contracted Vendors to provide Quality Assurance support for Project efforts.

o Support and provide cybersecurity recommendations on the Technical Review Board as necessary.

o Attend any meetings deemed necessary for Quality Assurance support of Operations and Maintenance.

o Provide Quality Assurance Support and Testing for Monthly MuleSoft Releases o Provide Quality Assurance Support and Testing for Salesforce Releases.

o Task 2: Requirements Management o Support the requirements management process (amount of support determined on a case-by-case basis) by:

o Review the initial set of Requirements.

o Support and provide cybersecurity recommendations on the Configuration Control

Board.

o Attend Requirements Gathering Sessions and provide cybersecurity recommendations o Determine and communicate which Requirements are testable.

o Ensure the quality of the Requirements Traceability Matrix to ensure complete test coverage.

o Task 3: Test Planning o Develop a complete test plan for each product tested.

o Develop the test cases required to ensure complete test coverage for all product requirements.

o Develop the test cases based on Acceptance Criteria o Task 4: Participation in Design Reviews o The Contractor will assist in reviewing software design documentation provided in application design review periods.

o The design software documentation will include: Software design descriptions;

Software requirements specifications; Network diagrams and Mock framework designs.

o Attend Sprint Planning Meetings and provide cybersecurity recommendations o Task 5: Unit Testing o Review Unit testing in the system. The purpose of reviewing unit testing is to allow QA to confirm the functionality provided by the developer.

o Integrate automated testing into the application development pipeline.

o Develop automated unit testing to include:

Static testing – Conducting “walkthroughs” and reviews of the design and coded components.

Secure Code review: If secure code review is not accomplished in the development phase, it has to be absolutely completed in the beginning of the testing phase.

Basic path testing – Executing path testing based on normal flow.

Condition/multi-condition testing – Executing path testing based on decision points.

Data flow testing – Examining the assignment and use of variables in a program.

Loop testing – Checking the validity of loop constructs.

Error testing – Executing unexpected error conditions.

o Task 6: Functional Testing o Provide functional testing, which verifies a program by checking it against design documents and/or specifications. It is normally preceded by the development of a test plan and test cases.

o Integrate automated testing into the application development pipeline.

o Develop automated functional testing which performs:

The identification of functions that the software is expected to perform.

The creation of input data based on the function's specifications.

The determination of output based on the function's specifications.

The execution of the test case.

The comparison of actual and expected outputs.

o Task 7: Defect Testing o While performing testing when defects are identified log defects.

o Integrate automated testing into the application development pipeline.

o Develop and perform automated defect testing to ensure the fix provided corrects the problem identified in the defect. Defect and test results are documented in the project specified tracking tool.

o Additional tests may be created to validate specific defects. These tests would be incorporated into the functional and regression test sets.

o All defects will be logged and tracked in a Defect Management Tool agreed to by

RD.

o Attend Defect Grooming meetings and provide cybersecurity feedback o Provide complete details on the defect, such as steps to replicate, videos of the defect, specify the failed test case, location of the defect, and demo the defect to developers, as needed.

o Task 8: Regression Testing o Develop and perform automated software regression testing. This is a quality control measure to ensure that the modified solution/system still abides with its specified applicable requirements and non- modified system has not been impacted by the maintenance activity. This includes software code that has been added or modified, database changes, or any changes to the system/solution as a whole.

o Integrate automated testing into the application development pipeline.

o The purpose of regression testing best practices is to discover unexpected faults of a program. Every time code is modified or used in a new environment, regression tests are executed to check the code’s integrity. The best way to perform regression testing is to develop an automated script to ensure that errors are detected and fixed as soon as possible.

o Task 9: Smoke Testing o Perform automated smoke testing to determine if a new software version is installed, configured correctly and stable enough to accept it for a major testing effort. If the application is unable to pass the smoke test, then the system is not stable enough for further testing and the build or application is returned for correction.

o Integrate automated testing into the application development pipeline.

o Task 10: Acceptance Testing The purpose of agency acceptance testing is for the agency to validate the specified business requirements have been implemented in the software that is acceptable by the end users for production use. Agency acceptance testing is conducted in an environment similar to production.

o Submit test scenarios and test cases for government acceptance.

o All test cases and scenarios will trace to the requirements.

o Task 11: Accessibility Testing

The purpose of Accessibility Testing is to ensure any created code, updated code, and documentation is accessible to those with disabilities. This testing includes checking all Code for Section 508 compliance as well as checking any created documentation to ensure it passes an accessibility checker.

The contractor shall develop and perform manual and automated testing:

o Submit test scenarios and test cases for accessibility.

o Develop and perform automated testing o Integrate automated testing into the application development pipeline.

o Check new/updated/modified code for Section 508 compliance.

o Check created documentation for accessibility.

o Support any 508 needs RD has based upon requests from the RD 508 Coordinator o Task 12: Release Management

The purpose of Release Management is to ensure any created automated test scripts, test regions, code merging, and test environments are tracked, controlled, and managed.

The contractor shall:

o Track all project work within the RD code repository.

o Collaborate with Project Teams, Developers, Production Support Operations, and

QA Staff to coordinate Quality Assurance Test Regions.

o Perform Release Management Activities for deploying Developed code to the QA

Test Regions, and work with Production Support Operations for code release to the Production Regions.

o Provide Saleforce sandbox administration for QA Test Regions.

o Support Automation Staff with tracking and storing Automated Tests within the

RD Code Repository.

o Understand that operational availability is essential when conducting any tests, assessments, reviews, or analysis.

In addition to items listed in this section of the PWS, the following services shall also be provided by the Contractor QA Team. The Contractor QA Team shall determine the appropriate tests from the list below based on business and systems requirements and not all tests listed would need to be performed on all projects. A key feature of the Contractor QA Team is to be involved early and throughout the entire development process.

Government acceptance of all testing is based upon independent verification and validation

(IV&V).

Key strategies that shall be incorporated include:

Consolidating and optimizing the testing practices & processes for managing QA.

Improve the QA Team efficiencies, minimizing critical issues in the applications.

Integrating QA early into the software development process.

Establishing a Core Team that assures quality and maturity of testing capabilities that lead to efficient business operations, translating to successful business applications.

Develop mature testing practices that deliver exceptional quality effectively and reliably.

Providing vital QA services that help assure quality and maturity of testing capabilities;

as well as define processes, metrics, and the implementation roadmap.

3.1 Quality Assurance and Testing Related Deliverables

It is the responsibility of contractor to complete (perform, administer, track, report on) all testing listed in the testing section of this PWS. The contractor shall deliver all test plans, scripts, test data sets and associated reports according to the approved Project Plan Schedule.

Test related deliverables include:

1. Functional/Regression Test Plans and Reports

2. Defect Test Plans and Reports

3. Unit Test Plans and Reports

4. Smoke Test Script Execution Plans and Reports

5. Load and Performance Test Plans and Reports

6. Testing Summary Document

7. Functionality/Load Test Scripts

8. Test Scenarios (User Stories) and Test Cases

9. Automated Test Scripts

10. Test Data Sets

11. Accessibility Test Plans, Test Scripts, and Test Cases

The contractor shall adhere to the following for all deliverables:

Timeframe -the test scenarios and test cases are due upon code delivery for testing.

Format- the entire suite of test scenarios and test cases used during testing will be delivered in

Microsoft Excel or another Government accepted format at the completion of testing.

Test Plans- a test plan is a document detailing a systematic approach to testing a system. A test plan documents the strategy that will be used to verify and ensure that a product or system meets its design specifications and other requirements. RD currently follows IEEE 829-2008, also known as the 829 Standard for Software Test Documentation, for the test plan structure.

The contractor shall deliver a Test Plan.

Test Reports- test reports are documents which provide the results of test execution.

Test Status Report-a status report provides an up to date look at where testing is at a given time.

Testing Summary Report – a test summary report includes basic information about what was tested and what happened within each test type executed. It also includes summary information regarding incidents/defects and their current status.

o The contractor will provide a summary report of test findings.

o Individual Testing Reports - the contractor will submit a test results report, for each deliverable, which will provide the contractor’s findings for all testing outlined in the testing section of this PWS. The report will include details on every known defect (open or closed).

A test report shall include the following information:

Test Summary - Include basic information about what was tested and what happened within each test type used (unit, functional, system, etc.).

Test Assessment - Enter a comprehensive assessment of how adequate the test was in light of how thorough the test plan said it should be. What wasn't tested well enough?

Test Results - Summarize the test results for each type of testing conducted. Include a detailed description of any deviations from the original test plan, design, test case, or expected results. Include any issues or bugs discovered during the test.

Variances - Describe any variances between the testing that was planned and the testing that occurred. Also, provide an assessment of the manner in which the test environment may be different from the operational environment and the effect of this difference on the test results.

Test Incidents - Provide a brief description of the unexpected results, problems, or defects that occurred during the testing.

Recommendations - Describe what actions are suggested upon completion of this test. Provide any recommended improvements in the design, operation, or future testing of the business product that resulted from the testing being reported. A discussion of each recommendation and its impact on the business product may be provided. If there are no recommendations to report, then simply state as such.

Approval - The test report must be approved by appropriate management before delivery to government.

4. Onboarding, Transition In and Transition Out

4.1 Onboarding

The contractor shall begin the process for onboarding new employees. The contractor should expect it to take four weeks 60 calendar days from the accepted submission of all required documents to the point when an individual receives a GFE computer and all access rights.

The contractor shall not receive compensation for this waiting period. The contractor must wait for written authorization from the Contracting Officer before beginning work on Task Order 1.

4.2 Transition In

A Transition In period will begin when written authorization from the Contracting Officer is received. concurrent at the beginning of Base period along with other above tasks. During the transition from the Government and/or a previous contractor, the new contractor shall perform all necessary transition-in activities, including, but not limited to, participation, at discretion of COR, in the following:

o Conduct up to five, one-hour meetings with the Government and/or previous contractor to affect a smooth transition and receive knowledge transfer of all previous deliverables.

o Receive a detailed inventory of all files and materials that were submitted by the previous vendor, along with detailed instructions to seamlessly set up and deploy the websites, applications, databases, systems, and platform. All files, materials, boxes, etc. will have been clearly labeled, packaged, and indexed according to the inventory.

o Attend and collaborate in training by the previous vendor or Government employees/contracted personnel in all system operation and maintenance functions during transition period.

5. Deliverables/Schedule Chart

All written deliverables require at least two iterations – a draft and a final. The final document must be approved and accepted by the Government prior to payment submission. The contractor shall submit draft and final documents, using Microsoft Office document types, to the Government electronically. The Government requires 5 business days for review and submission of written comments to the contractor on draft and final documents. The contractor shall make revisions to the deliverables and incorporate the Government’s comments into draft and final deliverables before submission. Upon receipt of the Government’s comments, the contractor shall have 3 business days to incorporate the Government's comments and/or change requests and to resubmit the deliverable in its final form.

Any issues that cannot be resolved by the contractor in a timely manner shall be identified and referred to the COR.

Non-conforming products or services will be rejected. Deficiencies will be corrected by the contractor within 3 business days of the rejection notice. If the deficiencies cannot be corrected within 3 business days, the contractor shall immediately notify the COR of the reason for the delay and provide a proposed corrective action plan within 2 business days.

Deliverable/ Item Title

Description Frequency Submit To Due By

Onboarding Status Report

This report is to include all relevant details of the onboarding process, including but not limited to:

1. All outstanding onboarding requests that need to be reviewed by the

COR.

2. Contractor personnel who began the onboarding process in the last 7 days.

3. Report of Contractor personnel who completed the onboarding process in the last 7 days.

Weekly Via email to

COR

Coordinate with COR to determine the most appropriate day of the week

Monthly Status Report Monthly report documenting: actual and target work progress, completed and planned activities, and deviations from the scheduled milestones.

Once per month Via email to

COR

The 5th day of each month after POP begins

Weekly Status Reports Weekly Report Weekly Microsoft Monday of the documenting actual and target work progress completed, planned activities, deviations from schedule, Risks, and Issues

Doc/PowerPoint delivered Via email to Government Lead week following.

Monthly deliverable listing

Listing of all documents delivered and accepted as final deliverable.

Monthly Excel The 10th day of each month

Monthly meeting notes Develop agendas for monthly POA&M meetings and provide action items and meetings notes

Each meeting Meeting invite for agenda and word doc for action items and notes

Agenda to be posted at least 3 workdays prior to meeting. Action items and notes to be sent within 1 day after meeting.

Focus Area 2 Compliance and Assessment work products listed in 3.1

All documents and artifacts as described for all Tasks of Compliance and Assessment Requirement

At completion of each task

As outlined in each individual task.

At completion of each task

Focus Area 3 Quality Assurance and Testing work products listed in 4.1

All documents and artifacts as described for all Tasks of the Quality Assurance and Testing Requirement.

At completion of each task

As outlined in each individual task.

At completion of each task

Transition In Plan All documents and artifacts as described in Transition In Section

At the beginning of contract PoP

As outlined in

PWS

10 days after award

Transition Out Plan All documents and artifacts as described in Transition Out Section

60 days prior to contract completion

As outlined in

PWS

60 days prior to contract completion

Quarterly contract status briefings

Provide quarterly briefing to RD TO leadership on status of contract.

Deliverables, issues, projections for next quarter, etc.

Once a quarter Teams meeting with documentation to present

Once a quarter

Quality Assurance Surveillance Plan

(QASP)

This QASP is pursuant to the requirements listed in the PWS. This plan sets forth the procedures and guidelines that the USDA, will use in ensuring the required performance standards or services levels are achieved by the contractor.

One time (or updated as needed)

Via email to

COR

Finalize as within 14 days after contract POP begins.

Quality Control Plan

(QCP)

The contractor shall establish and maintain a complete Quality Control Plan (QCP) as identified in the IDIQ and subsequent Task Orders as a required deliverable. Quality Management shall be utilized to ensure the services are performed in accordance with the IDIQ and commonly accepted commercial practices.

One time (or updated as needed)

Via email to

COR

Finalize as within 14 days after contract POP begins. The QCP shall include a Performance Requirements Summary (PRS) such as the sample PRS shown in the following table.

The PRS shall reflect the quality approach (using the headings shown in the table below) of the contractor as it applies to the key areas of the Task Order.

Performance Requirements Summary

(PRS)

The contractor shall establish and maintain a PRS reflecting the quality approach (using the headings shown in the table below) of the contractor as it applies to the key areas of the contract.

One time (or updated as needed)

Via email to

COR

Finalize as within 14 days after contract POP begins.

5.1 Non-Conforming Deliverables

Non-conforming products or services will be rejected. Deficiencies will be corrected by the contractor within 5 business days of the rejection notice. If the deficiencies cannot be corrected within 5 business days, the contractor shall immediately notify the COR of the reason for the delay and provide a proposed corrective action plan within 3 business days.

6. Task Order #1 Contract Line-Item Number (CLIN) Structure

BASE PERIOD/ 12

Months

DESCRIPTION

Cost

CLIN 0001 Focus Area 2: Compliance Support Services

CLIN 0002 Focus Area 3: Quality Assurance Support Services

CUMULATIVE TOTAL $

7. Team Structure and Skillsets

The contractor shall provide qualified personnel with relevant experience and domain knowledge in line with this task's performance work statement, in terms of necessary skills at the requisite level of knowledge and experience. Broadly, a team assigned to build the desired product is expected to have experience with:

Cybersecurity Administration Risk Assessment and Management Computer and Data Networking National Security Community, Threat and Vulnerability Assessments and Solution Design Security Incident Handling & Response Operational availability is essential when conducting any tests, assessments, reviews, or analysis Interpret and assess NIST 800-53 Revision 4-5 security and privacy controls

Security Assessment Plan (SAP) development Develop Assessments of system-specific, common and hybrid controls Technical Expertise with hardware, software, and firmware components as it relates to an accreditation boundary Create Security Assessment Report and Remediation actions Quality Assurance Data Analysis Writing and manage test cases/scripts/plans

8. Substitutions and Additions of Contractor Personnel

The following instructions address the procedures for substitution of personnel filling key functional roles defined above:

1. Resumes for substitutions and/or additions to the Contractor’s personnel filling key functional roles under this contract shall be submitted for the written approval of the Task Order COR. Any substitutions and/or additions shall be subject to the terms and conditions of this requirement.

2. No substitutions of personnel filling key functional roles shall be permitted unless such substitutions are due to illness, injury, death, disciplinary action, demotion, bona-fide promotion, termination of employment, or other exceptional circumstances when approved by the Task Order COR. If any of these events occur, the Contractor shall promptly notify the Task Order COR and provide the information required by paragraph 3 below.

3. For all requests for substitutions and additions, the Contractor shall provide a detailed explanation of the circumstances requiring the proposed substitution or addition. The Contractor shall include a complete resume for each proposed person and any other information requested by the Task Order COR. The Contractor shall certify that the proposed replacement is at least equal to the person to be replaced. The Task Order COR will evaluate such requests and promptly notify the Contractor of the approval or disapproval thereof.

III. PAYMENT AND INVOICING:

1. Evaluation Method for Periodic Payment

This acquisition will allow for monthly invoicing on work that has been completed and accepted.

The USDA Program office and COR will evaluate the Contractor’s performance on this requirement on the basis of:

Evaluation of deliverable listed o The Contractor shall ensure proper control and coordination of all deliverables to ensure they are on time. Unless otherwise stated, the Government will review deliverables and notify the Contractor of acceptance or non-acceptance within ten (10) business days. Representatives of the Contractor shall meet with the COR and other members of the Government as necessary to review status of deliverables.

2. Invoicing and Payment

The Contractor shall submit the original of the invoice to the COR as well as submit via the Invoice Processing Platform (IPP) at www.ipp.gov. To constitute a proper invoice, the invoice must include the following information and/or attached documentation:

• Name and Remittance address of Contractor

• Vendor Identification Number

• Invoice Date

• Contract or Task Order Number

• Amount to be paid by CLIN

• Travel/ODC’s billed, extension thereto, if relevant

• Total amount to be paid

• Cumulative amount billed to date

• The Contractor shall submit any other information or documentation required by other provisions of the Contract such as reports, copies of travel vouchers, hotel, and meal receipts, supporting paid invoices, receiving/acceptance reports, etc., or required to support the invoice request. The original receipts shall be maintained by the Contractor and made available to Government auditors upon request.

Payment by the Government will be made via electronic funds transfer typically before 30 days.

IV. ADDITIONAL INFORMATION

1. Quality Assurance Surveillance Plan (QASP)

The QASP is used in performance-based acquisitions and will be used for each Task Order. The QASP describes measurable performance standards and methods used by the government to provide surveillance and oversight of the contractor’s quality controls efforts to ensure timely, effective, and delivery results as specified in the PWS.

The contractor shall establish and maintain a complete Quality Control Plan (QCP) as identified in the contract as a required deliverable. Quality Management shall be utilized to ensure the services are performed in accordance with the contract and commonly accepted commercial practices. The contractor shall develop and implement procedures to identify, prevent and ensure non-recurrence of defective services. The government reserves the right to perform inspections on services provided to the extent deemed necessary to protect the government’s interests. The contractor must control the quality of the services and deliverables provided in support of this contract and maintain substantiating evidence that services conform to contract requirements and furnish such information to the government if requested.

After contract award, the QCP shall include a the contractor is required to establish and maintain a PRS. This PRS will be incorporated into the QCP and QASP upon approval by the government. An example of a PRS is, such as the sample PRS shown in the following table. The PRS shall reflect the quality approach (using the headings shown in the table below) of the contractor as it applies to the key areas of the contract.

The following PRS is a sample format for the contractor only. The Contractor shall propose a PRS (using the headings shown in the sample) as part of the QCP in response to contract award to be finalized 14 days after the contract kick-off meeting reflecting the key areas of support identified in the contract and the QCP proposed by the contractor.

The mutually agreed upon PRS shall be incorporated into the QASP template to be finalized within 14 days of contract kick-off.

Performance is continuously monitored to demonstrate the activity/project/task/focus area is meeting the needs of RD, delivering expected value, and/or being modernized and replaced consistent with the USDA's Strategic Plan, Investment portfolio, enterprise architecture, risk management framework, acquisition strategy, and human capital plan. Measures used for monitoring performance should be as “outcome” based as possible rather than “output” based and should help benchmark performance and trigger considerations of how the activity/project/task/focus area's objectives could be better met, how cost/price could be reduced, and whether the organization should continue performing a particular function.

PRS Example Table:

Requirement

Performance Standard

Method of Measurement

Acceptable Quality Level

(AQL)

Method of Surveillance

Customer Satisfaction (Process Results)

How well the goods or services meet the customer processes they were designed to deliver.

Process execution (e.g., efficiency, correctness, completeness, timing);

Product or service delivery (e.g., quality, timeliness, coverage, availability, satisfaction);

Technology functionality or usability (e.g., end-user satisfaction)

85% Satisfactory 100% Inspection or Customer feedback

Strategic and Business Results

How well the goods or services contributes to the organization’s achievement of strategic goals, fulfillment of its mission, and/or meeting service level agreements with its customers.

Business process improvements or advances that support RD priority goals and measures; and

Actions, time, or burden reduction in activities for either Federal users or American taxpayers using the tools.

85% Satisfactory 100% Inspection or

Financial

Comparison of current performance with a pre-established cost/price baseline.

Cost/price control (e.g., costs/prices remaining within the specified constraints)

Cost/price reasonableness (e.g., with respect to the cost/price of similar benchmarks).

Cost/price efficiency (e.g., cost/price per unit – transaction, user, and query;

especially units of business interest).

85% Satisfactory 100% Inspection or

PRS Example Table:

Requirement

Performance Standard

Method of Measurement

Acceptable Quality Level

(AQL)

Method of Surveillance

Schedule Management

All work is completed on agreed upon time per task order requirements

Establish temporal milestones for key tasks and deliverables in the project plan and compare with actual performance

85% Satisfactory 100% Inspection or

Deliverable Quality Deliverables are provided without spelling or other errors

Review of Deliverables

85% Satisfactory 100% Inspection or

Task Progress Status Reporting Accuracy

Task Progress status reports provides current and valid information

Review of Task Progress Reports

85% Satisfactory 100% Inspection or

Satisfactory - Performance meets contractual requirements. The contractual performance of the element or sub-element contains some minor problems for which corrective actions taken by the contractor appear or were satisfactory.

V. SPECIAL CONSIDERATIONS/REQUIREMENT

1. Inspection and Acceptance

The contractor shall ensure proper control and coordination of all deliverables to ensure they are on time.

Unless otherwise stated, the Government will review deliverables and notify the contractor of acceptance or non-acceptance within ten (10) business days. Representatives of the contractor shall meet with the COR and other members of the Government as necessary to review status of deliverables.

The Contractor shall notify the COR, or other authorized representative designated in the contract as soon as it becomes apparent to the Contractor that a scheduled delivery will be late. The Contractor shall include in the notification the rationale for late delivery, the expected date for the delivery, and the project impact of the late delivery. Such notification in no way limits any Government contractual rights or remedies, including, but not limited to, termination.

Notwithstanding the foregoing, any deliverable requiring acceptance by the Government shall be deemed to be accepted by the Government if no written notice of non-conformity has been received by the Contractor within the acceptance period.

Government acceptance of all testing is based upon independent verification and validation

(IV&V).

2. Packaging and Marking of Deliverables:

All information and deliverables shall be delivered electronically to the COR, unless otherwise instructed, and shall be marked as follows:

1. Name and Address of Contractor;

2. Contract Number;

3. Description of item contained therein; and

4. Consignee’s name and address