Attachment J-2 - Performance Requirements Summary dated 10-20-2023.docx

47QMCB23R0011 - ETSNext Generation Attachment J-2: Performance Requirements Summary dated October 20, 2023 Attachment J-2: Performance Requirements Summary The Government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP), which will be based on the elements incorporated in this Performance Requirements Summary table. A Government Point of Contact (POC) will monitor the compliance with the PWS by conducting reviews in accordance with the quality control measures and meeting the required delivery dates below.

The QASP is a Government owned and provided plan that is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards outlined in this Performance Requirements Summary.

· 100% of requirements are deployed in each phase .

· No Critical or High defects are open.

First time yield (unassisted rate): >2% improvement over initial agency baseline within 12 months of FOC completion of reservations that are booked in the OBT and ticketed automatically with no TMC counselor intervention Assisted rate: >2% reduction over initial agency baseline within 12 months of FOC completion reservations that are booked in the OBT and then modified or assisted by a TMC counselor

Submit findings to Governance within 30 days of testing

Testing includes at least 5 participants from each relevant user type

All major features in development, as prioritized by the Government product owner, are tested prior to rollout with at least 5 users from the relevant user type at least 90 percent of the time

System availability (Production environment)

System availability (Testing, Training environments)

Planned maintenance occurs during non-business hours >99.5%

>99%

100%

Backup reporting At least quarterly

At least monthly

and Data Cleansing and Normalization Plan are fully executed.

100%

95% service desk support availability during specified hours

95% service desk support availability during specified hours

a. Critical - resolution <8 hrs; response <1 hr

b. High - resolution <48 hrs; response <4 hrs

c. Medium - resolution <5 days; response <24 hrs

d. Low - resolution <4 weeks; response <48hrs

Issues are responded to and resolved within the time outlined in the accepted standard’s priority levels.

(Per Customer Support #31, issues can be reported by users, TMCs, and agency T&E management and policy personnel.)

98% response within time outlined in PWS based on severity level

90% resolution within time outlined in PWS based on severity level

Defect Rate (%) will be measured each release. Defect Rate is the measurement of the units of production that are defective or unusable. Defect Rate = Defects / Output Tested x 100.

100%

Defect Rate % less than 20% for User Acceptance Testing

Automated Testing success rate is at least 90%

Defect Rate % less than 10% for Integration and Regression Testing

No Critical or High Defects included in a release

No critical or high defects

90% of releases have been tested for 508 compliance with any issues remediated

(1) Binding Operational Directive (BOD) Timelines

(a) Within 14 days for vulnerabilities added to CISA’s KEV Catalog with a CVE date post FY21.

(b) Per the CISA KEV catalog date or GSA Standard timelines below, whichever is earlier, for vulnerabilities in the CISA KEV catalog with a CVE date in FY21 or earlier.

(c) Within 15 days for Critical (Very High) vulnerabilities for Internet-accessible systems or services.

(2) GSA Standard Timelines

(a) Within 30 days for Critical (Very High) and High vulnerabilities.

(b) Within 90 days for Moderate vulnerabilities.

(c) Within 120 days for Low vulnerabilities for Internet-accessible systems/services

No Critical, High, or outstanding KEV findings at the time of FedRAMP package submission.

Refer to Appendix F of CIO-IT Security-06-30 for Showstopper Capabilities and Associated Controls.

1. Multi-Factor Authentication (MFA) for Privileged & User-level access

2. Critical and High vulnerabilities or weaknesses (from scans or assessments)

3. Remote Code Execution (RCE) Vulnerabilities

4. End of Life Software

5. System Architecture has been reviewed and approved by GSA OCISO Information Security Engineering

6. Encryption of Sensitive Data (i.e., PII, PCI, Authenticators)

7. Compliance with CISA ED/BOD (https://www.cisa.gov/news-events/directives)