70RCSJ26RFI000001 CTS_QASP.pdf

This is a Quality Assurance Surveillance Plan (QASP) for a Cyber Technology Services (CTS) contract focused on CISA/CSD Threat Hunting. The contract is essential to sustain mission-critical cyber defense and federally mandated asset response activities, including threat analysis, victim notifications, malware reverse engineering, detection capabilities, and tailored guidance to organizations impacted by cyber incidents. The CTS contract encompasses core IT operations, threat detection, malware analysis, forensic investigation, proactive threat hunting, and stakeholder support to strengthen critical infrastructure resilience and enable timely responses to emerging cyber threats.

The QASP establishes systematic performance evaluation methods through identified surveillance approaches including direct observation, management information systems monitoring, periodic inspection, validated user/customer complaints, 85% inspection, random/periodic sampling, progress/status meetings, and contractor progress report analysis. Government roles are assigned to Contracting Officer Hannah Moussa (CISA) and Contracting Officer's Representative Sophia Y. Hunt for day-to-day surveillance. Fourteen key performance areas are defined with specific Acceptable Quality Levels (AQLs) and corresponding positive and negative incentives, including monthly status reports (95% on-time delivery), staffing plan maintenance (90% inspection), work breakdown structure/program management (85% inspection), DevSecOps/CI-CD pipeline (85% unit test coverage, 99% successful builds), system availability (99% for critical systems), SOC operations (95% coverage), security documentation (85% artifact delivery), data management/analytics (95% pipeline success), malware lab operations (99% availability), IT Service Desk (90% ticket response), asset management (98% inventory accuracy), ODC/travel management (85% compliance), and transition-out planning (80% inspection). Measurement occurs weekly for task status and operational metrics, monthly for program reviews and staffing/risk status, quarterly for trend analysis and artifact sampling, and annually for comprehensive reviews. Performance ratings apply a qualitative scale of Exceptional, Satisfactory, or Unsatisfactory, with documentation through COR reports, meeting minutes, and performance dashboards to support award fee determinations, CPARS evaluations, and option exercise decisions.