Enclosure AA - Quality Assurance Surveillance Plan (QASP).pdf

FOR INFORMATION PURPOSES ONLY (10/2017)

FOREWARD

Under performance-based acquisitions such as this, the Contractor assumes more responsibility and greater risk in exchange for more flexibility and less direct Government involvement in contract activities. However, the Government still has a responsibility to conduct surveillance.

Surveillance spans a spectrum of Government involvement. Surveillance may be as simple as inspecting a delivered support or service at acceptance or as complex as continually monitoring contractor performance. To meet this responsibility, the Government needs to understand the risks involved in the Contractor's activity and how the Contractor is managing those risks.

This Government Quality Assurance Surveillance Plan has been prepared to describe the Government’s surveillance of this contract. It is a “living” document that will be tailored to the contractor selected. The Government welcomes suggestions for improving this Plan. Of particular interest are ideas on what information the Government should monitor (i.e., metrics) and how the Government can most cost-effectively obtain the relevant performance data it needs.

CYBERSECURITY AND PRIVACY ENTERPRISE SOLUTIONS AND SERVICES

(CYPRESS)

GOVERNMENT QUALITY ASSURANCE SURVEILLANCE PLAN

1.0 INTRODUCTION

1.1 Purpose

The purpose of this Government Quality Assurance Surveillance Plan (QASP) is to define the overall approach that NASA intends to use to monitor and survey Contractor onsite performance under the Cybersecurity and Privacy Enterprise Solutions and Services (CyPrESS) Contract No.

TBD. This QASP defines the process the Government expects to follow to obtain data, evaluate the Contractor, and determine if contract performance conforms to contract requirements. The goal is to balance the level of Government surveillance with perceived impacts and risks associated with performance hereunder. The QASP can be changed unilaterally by the Government at any time during the contract.

NASA plans to utilize a surveillance team to evaluate Contractor performance and direct surveillance activities. The team will establish and rely on objective and subjective performance metrics based on the contract Statement of Work (SOW) and task orders issued thereunder to evaluate Contractor performance against requirements.

The QASP is a Government-developed surveillance tool prepared in accordance with FAR 46.4 and NFS 1846.4. It shall not be included in the contract, per NFS 1846.401(a)(iii), but provided to the Contractor for informational purposes only.

1.2 Scope

This QASP identifies the program requirements, strategies, resources, review and control processes, surveillance activities, and metrics for continuous measurement of Contractor performance. This plan provides effective and systematic surveillance methods for evaluating the Contractor services, processes, and products provided under this contract. The Government may evaluate work at any time during the Contractor’s work performance.

The intent of the QASP is to ensure that the Contractor performs in accordance with acceptable quality levels and the Government receives the quality of services and products called for in the contract. This QASP does not detail how the Contractor accomplishes the work. Rather, the QASP is based on the premise that the contractor, not the Government, is responsible for managing its quality controls and ensuring that performance meets the terms of the contract. The role of the Government is quality assurance to ensure contract standards are achieved.

The QASP is intended to be a “living” document from which resources and activities will evolve from one phase to another during the life of the contract, and will be updated as required and defined in this document.

This plan is applicable to all services performed or products provided by the CyPrESS Contractor(s). Throughout this QASP, the term “Contractor” is used. In terms of this plan, it should be known that unless explicitly stated, the term “Contractor” is applicable to both the CyPrESS Contractor and any and all of its subcontractors.

The surveillance program shall be a collaborative and integrated effort that includes all areas of contract management, including the following:

a. Engineering & Technology

b. Quality Assurance

c. Procurement/Subcontracting/Purchasing

d. Finance

e. Property

f. Environmental

g. Export Control

h. Safety and Health

i. Security

1.3 Program Definition and Contract Description

1.3.1 Program Background and Definition

The principal purpose of the NASA Office of Chief Information Officer (OCIO) is to enable the secure use of data to accomplish NASA’s mission. The NASA OCIO Cybersecurity & Privacy Division (CSPD) established the Cybersecurity & Privacy Program (CSPP). The CSPP manages the Agency-wide information and cybersecurity program to correct known vulnerabilities, reduce barriers to cross-Center collaboration, and provide cost-effective cybersecurity services in support of NASA’s information systems and e-Gov initiatives. The CSPP ensures that cybersecurity across NASA meets confidentiality, integrity, and availability objectives for data and information systems, to include disaster recovery and continuity of operations for systems, in order to support the business continuity requirements of critical Agency programs and processes.

The CSPP develops and maintains a cybersecurity program that ensures consistent security policy, identifies and implements risk-based security controls, and tracks security metrics to gauge compliance and effectiveness.

1.3.2 Contract Goals and Objectives:

The NASA OCIO goal for this CyPrESS contract is to acquire cybersecurity and privacy enterprise solutions and services for the NASA OCIO to support the Core requirements of the CSPP, which includes but not limited to, cybersecurity and privacy oversight; operating the Security Operations Center (SOC); risk management framework services; cybersecurity hygiene, standards, and architecture; and supporting the Office of Cybersecurity Services (OCSS) and the services. The anticipated contract will support all NASA Centers and Facilities.

The purpose of this hybrid Cost-Plus-Award Fee core and Indefinite Delivery Indefinite Quantity (IDIQ) contract is to provide cybersecurity and privacy enterprise solutions and services and related services for the OCIO. These services are to be performed at all of NASA’s centers and facilities.

1.4 Guiding Directives

The guiding documents for this surveillance effort include the Contract SOW, performance standards, Performance Evaluation Plan, Task Order requirements as specified in issued Task Orders, and deliverable requirements. The contract identifies general requirements and the Task Orders identify specific objectives or results desired for each issued Task Order requirement.

1.5 References and Applicable Documents

All applicable references and documents are listed in the applicable and document section of the contract.

2.0 SURVEILLANCE STRATEGY AND APPROACH

2.1 General

There exists a wide-ranging spectrum associated with surveillance, ranging from oversight to insight. The strategy and approach to surveillance by NASA for the CyPrESS contract, as detailed in this plan, is one that concentrates primarily on insight as opposed to oversight.

However, some limited areas do exist where oversight is conducted either via NASA exercising approval authority on contract-deliverable documentation in critical areas of performance or participation in the Contractor's configuration management process. Regardless, the Government reserves the right to initiate additional surveillance activities (insight or oversight) on an ‘as-needed’ basis, based upon circumstances and data collected (adverse trends, negative data points, lack of corrective action, etc.) via the surveillance activities defined in this plan. As applicable, any and all oversight activities would be communicated and coordinated with the Contractor and subsequently documented within this QASP.

The level of risk and the impact of failure are major determinants in helping define the type of surveillance to be conducted. Clearly, if the impact of failure is minor and the level of risk is low, only a small amount of insight-driven surveillance would normally be needed. Conversely, if the impact of failure could be significant and the level of risk is high, more extensive surveillance (including possible oversight surveillance) is warranted.

This insight-based approach to surveillance will utilize and leverage the Contractor's Quality Management System (QMS). Definitions, requirements, and specifications contained in the contract, SOW, and referenced documents will establish a baseline for the surveillance activities.

This insight-based approach will seek objective evidence and data that the Contractor's program and processes are functioning as intended in accordance with the terms of the contract. The focus will be on trusting the Contractor's QMS, and verifying that the Contractor is performing according to the policies, procedures, plans, and processes defined by their QMS.

NASA will strive to use an insight-driven surveillance approach throughout the performance of this contract. The overall surveillance goal will be to obtain objective evidence and data that enable the Government to determine whether the Contractor's program and processes are functioning as intended in accordance with the terms of the contract. The focus will be on prevention rather than detection, i.e., emphasizing controlled processes and methods of operation, as opposed to relying solely upon inspection and test to identify problems.

This insight-based approach to surveillance as applied to the contract will result in lower levels of Government intervention, thus allowing the Contractor to assume full accountability and responsibility for integrity of processes. Although less obtrusive than oversight, this insight-based approach to surveillance continues to provide the Government with visibility into the Contractor's programmatic processes, technical processes, progress, and issues at all levels.

As required by FAR 42.1502 and GPR 5100.2, Supplier Performance Evaluations, the Contracting Officer (CO), in collaboration with the Contracting Officer’s Representative (COR), will annually complete a Contractor Performance Assessment Reporting System (CPARS) evaluation, which will also be reviewed by the Contractor, and become a part of the Past Performance Information Retrieval System (PPIRS).

2.2 Surveillance Activity Limitations and Guidance

2.2.1 General

Surveillance of the CyPrESS contract, will be conducted on a non-interference basis and in a manner that will not unduly delay work being performed by the Contractor.

2.2.2 Insight

Insight is an assurance process that uses performance requirements and, if definable, performance metrics to ensure process capability, product quality and end-item effectiveness.

Insight relies on gathering a minimum set of product or process data that provides adequate visibility into the integrity of the product or process. The data may be acquired from Contractor records, usually in a non-intrusive parallel method.

Insight as applied to this contract will result in lower levels of Government surveillance and allow the Contractor to assume increased responsibility and accountability for the integrity of processes. Insight will rely heavily on evaluating planned contract deliverables, performance standards, and existing Contractor procedures and working documents, if available.

2.2.3 Oversight

Oversight as applied to this contract will result in higher levels of Government surveillance. The Government will gather information pertaining to the Contractor’s process through on-site involvement and/or inspection in the process and will monitor the process itself. The Government’s involvement in the Contractor’s performance, through oversight, will be determined necessary by the COR.

2.3 Surveillance Organization and Resources

2.3.1 General

The activities detailed in this plan will be supported and performed by a group of individuals, many with differing levels of responsibilities, but all maintaining a level of consistency in terms of the surveillance strategy, approach, and activities in general. Specific entities supporting the CyPrESS contract surveillance activities include the identified NASA personnel; Contractor QA Department personnel (including their subcontractors); and contractor support services and delegated agency personnel, if applicable. Each of these entities and their associated responsibilities/input to the surveillance activities on the CyPrESS contract are described in the following paragraphs.

2.3.2 Surveillance Team

2.3.2.1 General Organization and Responsibilities

General organization and responsibilities of the Surveillance Team are as follows:

a. The surveillance team will be composed of key Government personnel. All surveillance activities will be implemented using NASA and NASA support-contractor personnel, a delegated agency (e.g., Defense Contract Management Agency (DCMA)), and/or a surveillance support contractor(s). The surveillance team may be composed of:

1. NASA Information Technology Procurement Office Personnel (i.e., CO, Contract

Specialist)

2. NASA CSPP Personnel (i.e., COR, Task Monitor(s) and Technical Monitor(s), and

Resource/Financial Analyst(s));

3. NASA Safety, Health and Security Personnel (both physical and Information

Technology (IT) Security);

4. NASA Property Administrator Personnel;

5. CyPrESS Performance Evaluation Board

b. The team’s primary purpose will be to provide direction for contract surveillance activities and to serve as the Government’s focal point in reviewing and evaluating overall Contractor performance under the CyPrESS contract. The team will obtain information from various sources, including deliverable Contractor documents, communications with the Contractor, and reports by other personnel or representatives (e.g., Task Monitor(s) and Technical Monitor(s); Safety, Health, or Security personnel;

DCMA) who interact with the Contractor.

c. The NASA OCIO has the responsibility for independently assuring that the Contractor's operations meet NASA's contract performance requirements and enable success. As such, surveillance team members will have open access to all areas in which this contract is being performed and will interface directly with their Contractor counterparts.

Government expertise with regards to the CyPrESS contract may be applied in the form of technical consultants and/or providing assistance at working group meetings, design/development and specification reviews, review board meetings, surveys, audits, program reviews, and as in-plant representatives. The team will document problems, concerns and issues, and take note of Contractor accomplishments. They will collect performance metric data, where applicable, and will participate in Contractor review meetings, such as those described herein. Information will flow from individual team members through the COR to surveillance team representatives, who will present issues and achievements at surveillance team meetings. Information gained from these formal and informal exchanges of ideas and collection of data will be compiled and evaluated as a continuous measure of contract performance.

d. All available information will be evaluated, and any action by NASA will be determined based upon the scope and magnitude of any particular issue or problem. The surveillance team chairperson, the COR, will formally notify the CO of situations where it is perceived that the Contractor has failed to take prudent corrective or preventive action, of situations that increase risk, or of findings of continued contractual non-compliance.

2.3.2.2 CyPrESS Contracting Officer

CyPrESS CO responsibilities are as follows:

a. The CO is responsible for ensuring performance of all necessary actions for effective contracting, ensuring compliance with the terms of the contract, issuing task orders, and safeguarding the interests of the United States in its contractual relationships. Within the surveillance area the CO takes inputs from the Program/Project managers, COR, Safety, Health, Office of Safety and Mission Assurance, CyPrESS Performance Evaluation Board, and others to establish the detailed surveillance requirements to be performed by NASA personnel, delegated to another Federal agency via a NASA Letter of Delegation, or to be performed under contract by a surveillance support Contractor. The CO will also assure that the Contractor receives impartial, fair, and equitable treatment under this contract. The CO is ultimately responsible for the final determination of the adequacy of the contractor’s performance.

b. The CO will complete an annual Contractor performance assessment report using the

CPARS that will also be reviewed by the Contractor and become a part of the PPIRS.

2.3.2.3 CyPrESS Contracting Officer’s Representative

CyPrESS COR responsibilities are as follows:

a. The COR is designated in writing by the CO to act as his or her authorized technical representative to assist in administering the contract. The COR monitors the technical work performed under the contract, evaluates Contractor performance, serves as the primary interface for the Contractor and the CO for all technical matters, reports on contract status to Program/Project Management, and recommends corrective action when necessary. The COR is not empowered to make any contractual commitments, authorize any contractual changes on the Government’s behalf, or in any way direct the Contractor to operate in conflict with the contract terms and conditions. Any changes that the Contractor deems may affect the contract or task order value, terms, or conditions shall be referred to the CO for action. The COR’s limitations of authority are contained in the NASA Form 1634, COR Delegation.

b. The COR assumes full responsibility for directing the surveillance activities identified in this plan. The COR also trains Task Monitor(s) and Technical Monitor(s) on evaluation procedures for evaluating contractor performance.

c. The COR will assist the CO in the completion of the contract’s annual performance assessment report using CPARS.

2.3.2.4 Task Monitors

Task Monitors are individuals appointed by the COR for developing Task Orders, reviewing the Contractor’s Task Plans and Task Order reports, and monitoring Task Order performance. Task Orders will include quantitative metrics, as appropriate. Task Monitors provide detailed technical oversight of the Contractor’s performance and report findings to the COR in a timely, complete and impartial fashion. While the Task Monitors may serve as a direct conduit to provide Government guidance and feedback to the Contractor on technical matters, the Task Monitors are not empowered to make any contractual commitments or to authorize any contractual changes on the Government’s behalf.

2.3.2.5 Technical Monitors

Technical Monitors are individuals appointed by the COR for the oversight of specific technical work on the contract. Technical Monitors provide detailed technical oversight of the Contractor’s performance and report findings to the COR in a timely, complete and impartial fashion. While the Technical Monitors may serve as a direct conduit to provide Government guidance and feedback to the Contractor on technical matters, the Technical Monitors are not empowered to make any contractual commitments or to authorize any contractual changes on the Government’s behalf.

2.3.2.6 CyPrESS Contractor Quality Assurance

It is expected that the Contractor will maintain a QA lead as part of its QMS. It is expected that the QA lead will perform QA-related activities for the CyPrESS contract efforts. The Contractor's QA lead will serve a vital role in the success of the surveillance efforts detailed in this plan. In particular, it is expected that the Contractor will task its QA lead to serve as a focal point for the Government in several areas including but not limited to provision of and access to all requested insight data/lifecycle-related assets and artifacts as they pertain to the insight areas described in this plan, and all QA-related activities conducted by this group.

The Government expects that as necessary and applicable, the QA lead may direct the Government to other groups/individuals supporting the CyPrESS contract effort in order to obtain requested insight data. These groups/individuals may include the Contractor's Program/Business Management office and/or representatives, discipline engineers, Configuration Management representatives, etc.

2.3.2.7 CyPrESS Performance Evaluation Board

The CyPrESS Performance Evaluation Board (PEB) is made up of voting members appointed by the Fee Determination Official (FDO) to evaluate the Contractor's performance according to the standards and criteria stated in the CyPrESS Performance Evaluation Plan. The PEB will submit an award fee letter to the FDO for signature, which addresses the PEB's findings and recommendations for each award-fee evaluation period.

2.4 Forms of Surveillance

2.4.1 General

Surveillance on the CyPrESS contract will be performed using any of the primary surveillance forms applied to the insight areas described in Section 3 of this document, during applicable stages of the contract. These primary forms of surveillance are described below.

2.4.2 Communications

Communications is a general surveillance activity. Communications is a two-way process and includes both written and oral communication. Examples of written communications activities that may be used in conducting surveillance include:

a. Exchanges from the Contractor to the Government of plans, procedures, quality records, reports, etc., and/or provision of read-only access to repositories which retain these items.

b. Exchanges from the Government to Contractor of letters, reports, review results, etc.

c. Ad hoc information submitted by the COR and/or Task Monitor(s) and Technical

Monitor(s) to the CO related to the Contractor’s electronic mail.

Examples of oral communications activities that may be used in conducting include:

a. Informal telephone calls, teleconferences.

b. Informal verbal inquiries, discussions, engineering consultations.

c. Working group meetings, IPT participation, technical/status briefings, progress reviews, technical information meetings, and formal and informal reviews.

d. Informal discussions.

2.4.3 Management Reviews and Reporting

Examples of management review and reporting activities that may be used in conducting surveillance include:

a. Formal, process, and progress reviews

b. Review of contract deliverables

c. Documentation of problems, issues and concerns

d. Data collection reporting

e. Review of task order deliverables, products, and documentation

2.4.4 Participation in Contractor Configuration Management Processes

NASA's CSPP Configuration Control Boards’ (CCB)s’, which includes OCSS and the local NASA Centers, approvals are required for changes that affect CyPrESS contract capabilities and external interfaces. The Contractor is required to facilitate the applicable CCBs’ insight into the contractor configuration management process. This process will be accomplished through the Enterprise CSPP’s participation in the Contractor configuration management process and insight into Contractor configuration controlled documentation. CSPP’s personnel monitor network performance and activities with metrics. These metrics are used to assess network and contractor performance, as well as, to ensure mission customer requirements are met.

3. SURVEILLANCE ACTIVITIES

3.1 General

There exist specific insight areas that the Government and the Contractor shall concentrate on during applicable stages of contract performance. Each of these insight areas and the Government’s expectations for these areas are described in Table 1.

Table 1. Surveillance Insight Areas

Area of Risk Identified Impact to Government Surveillance Team Activity System Maintenance and Availability

System downtime or loss of functionality could result in loss of service to the user community

Review Contractor-developed maintenance plan for improvements. Review data and trouble data. Review corrective action performance.

Information Technology (IT) Security

Computer Security: Potential corruption and loss of data;

disruption of schedule

Annual review of IT security plans and contingency test results and controls.

Review compliance with policies, firewalls, protection software, vulnerability scans and external systems.

Configuration Management (CM) Documentation

Uncontrolled models, hardware, software, or documents could lead to erroneous results, incompatible interfaces, wasted resources, and/or mission failure

Periodically sample current documentation, and active management documents to verify compliance with the Contractor’s CM System and CM Plan.

Property Management, Control, and Maintenance

Loss of or damage to equipment;

potential schedule impact

Review Contractor property management techniques, compliance with policies, and record-keeping.

Safety Loss of work-time or equipment, with schedule or cost impact

Evaluate compliance with the Contractor's Safety and Health Plan and safety requirements.

Technical Documentation and Control

Loss of knowledge of processes and results

Periodically sample documents (review for accuracy) and ensure they are under CM control.

Process Controls Degradation of work products;

increase in safety risk; potential schedule impact

Periodically monitor the Contractor’s adherence to key processes and their internal audit schedules/results.

Continuous Risk Management Technical, cost, schedule, safety, and program success

Periodically ensure that the Contractor is performing a Continuous Risk Management program that identifies, analyzes, tracks, mitigates, controls and reports on related risks.

Quality Management Technical, cost, schedule, safety, and program success

Monitor the Contractor’s internal and external audits for compliance with the Contractor’s established Quality Management Systems, including CMMI® or ANSI/ISO/ASQ Q9001:2000 or AS 9100.

Area of Risk Identified Impact to Government Surveillance Team Activity Quality of Work Force a. Inability to fill positions and meet commitments on scheduled deliverables or science results,

a. Monitor time required to fill positions, and evaluate Contractor efforts and approaches used to fill vacancies.

including NASA Performance Metrics

b. Additional cost resulting from decreased productivity of other staff reliant on unfilled positions

c. Lack of expertise or inadequate experience in key areas

d. Delayed data delivery and/or poor data quality

b. Assess Contractor efforts to train staff in areas of required expertise.

c. Evaluate Contractor technical performance

d. Monitor progress and timeliness and evaluate the quality of data received.

Quality of Workmanship (End-Items)

a. Inability to meet commitments of scheduled deliverables

b. Additional cost and time resulting from rework, nonconforming, latent defects

a. Monitor and track schedules and delivery due dates.

b. Conduct/witness testing and inspections, when necessary. Ensure end-item deliverables conform prior to acceptance.

Schedule Services or products not provided in a timely manner can impact project schedule and cost

Monitor progress via management reviews and reporting.

Cost and Funding

Cost Overrun:

a. Inability to implement contract requirements within negotiated costs may lead to erosion of technical performance, delay, or deletion of work

b. Reduction of work due to funding limitations/fluctuations

Monitor and track costs incurred through the NASA Form 533, NASA Contractor Financial Management Report submitted on a monthly and quarterly basis

Organizational Conflicts of Interest (OCI) Avoidance

Potential restrictions, ineligible to perform, and/or unfair competitive advantage on future work

Monitor submittal, enforcement and compliance with the Contractor’s OCI Avoidance Plan.

Environmental Environmental damage to local and remote sites

Conduct periodic inspections to ensure compliance with environmental requirements.

Export Control Violation of International Traffic in Arms Regulations (ITAR)

Ensure the Contractor has Technical Assistance Agreements as required by the NASA Export Control Program.

TBD (as designated on individual Task Orders)

TBD (as designated on individual Task Orders)

TBD (as designated on individual Task Orders)

3.2 Surveillance Team Activities

The surveillance team members will participate in review meetings, if applicable. They will provide support, as necessary, with the development and approval of technical requirements;

flow-down of requirements; and with design, development, production and test activities. They will also maintain insight into the Contractor’s compliance with relevant deliverables submitted under the contract and services performed. When the Government has concerns regarding Contractor performance, surveillance team members may conduct independent audits of the Contractor’s activities, processes, products, documentation and data, in order to provide assurance that the program is being implemented according to all requirements and specifications. These audits will normally be conducted with advance notification and coordinated with the Contractor. However, the Government reserves the right to conduct unscheduled audits when evidence indicates that Contractor performance is deficient.

The following selected surveillance team activities will be performed by various surveillance team members during applicable stages of contract performance:

3.2.1 Work Area/Floor Checks

The surveillance team members will make a physical inspection of the Contractor's onsite work area semi-annually. In addition, the COR may make informal inspections, as required. These inspections are made to assure compliance with NASA and NASA Centers’ and Facilities’ regulations and procedures regarding:

a. All onsite Contractor employees have a NASA Personal Identify Verification (PIV) card (badge).

b. The total number of Contractor employees provided onsite office space.

c. The Contractor’s office space is physically separated from the Government’s workspace and is properly identified by a sign with the contractor employee & company’s name clearly displayed.

d. The names and locations (buildings/room numbers) of the Contractor employees match their monthly onsite Personal Identity Verification (PIV) Report.

e. The Contractor knows who the building's Facilities Operation Manager (FOM) is, and what his/her functions are.

f. The Contractor is familiar with the building emergency evacuation procedures.

g. The Contractor employees are aware that work area checks may be conducted at any time.

h. The Contractor is familiar with NASA and NASA Centers’ and Facilties’ Policy Directives and Procedural Requirements as it pertains to ANSI/ISO/ASQ Q9001:2000 or

AS 9100 governing onsite performance. These procedures can be accessed via the following NASA Online Directive Information System Website:

http://nodis3.gsfc.nasa.gov/.

i. The Contractor is aware of the appropriate protection procedures for handling Government planning data and other Contractor confidential or financial data.

j. The Contractor employees are aware that the use of Government telephones is for official business only.

k. The Contractor employees are following the proper Checkout Procedures when leaving NASA Centers and Facilities (e.g., returning PIV card (badges), Government property, library books). The PIV data forms will be checked against the monthly Onsite Reports to identify exiting employees.

l. The Contractor employees are aware of the NASA and NASA Centers’ and Facilities’ IT

Security compliance requirements.

m. The Contractor employees are aware of the Contractor’s OCI Avoidance Plan and the appropriate Non-Disclosures.

In addition to checking conformance with NASA and NASA Centers’ and Facilities’ regulations listed above, the COR may make periodic checks of the Contractor's workspace to assess adequacy of facilities, equipment, and materials.

3.2.2 Work Review and Performance Monitoring

The COR, with the assistance of the Task Monitor(s) and Technical Monitor(s), will perform the following functions to evaluate the Contractor's performance:

a. Reviews individual Task Orders with the Task Monitors to assure that each Task Order is technically within the scope of the contract and its personnel requirements and schedule are within the Contractor's capabilities. Reviews Contractor Task Plans to ensure that performance estimates are acceptable and that all milestones and deliverables have been identified.

b. Reviews specific SOW areas with the Technical Monitor(s) to assure that work being performed and deliverables are in accordance with the technical requirements of the SOW and timely.

c. Reviews the Contractor's monthly Progress Report for accuracy and completeness.

Consult with the Task Monitor(s) and Technical Monitor(s), as necessary, to assess the fidelity of reports.

d. Meets monthly, or more often if required, with the Contractor's Program Manager to discuss overall contract management and performance, review staffing and schedule issues, and review cost related issues.

e. Certifies the Contractor’s invoices for payment in accordance with NASA procedures.

f. Perform QA inspections and QA witnessing/monitoring of tests.

g. In the event of a discrepancy in the Contractor's performance, the COR promptly notifies both the CO and the Contractor's Program Manager and arranges a meeting to rectify the situation.

h. Assesses the Contractor’s overall contract performance against the factors and criteria established in the contract’s Performance Evaluation Plan.

3.2.3 Government Property Administration

The COR will carry out the following functions.

a. Review Contractor's request to purchase controlled property and facilities and make recommendations to the CO.

b. Validate that no property or facilities are being acquired without the CO's prior approval.

c. Review and approve Contractor's requests for acquisitions of supplies from NASA Centers’ and Facilities’ store stocks.

d. Validate that all Installation-Accountable Government Property (IAGP) is being properly utilized and maintained.

e. Conduct periodic inspection of equipment and its location, compared to the data on the property records.

f. Validate that all existing and new equipment is properly tagged.

g. Validate that Government property is made available in accordance with the terms of the contract.

h. Validate that the Contractor is maintaining records for all offsite Government-Furnished Property (GFP).

i. Review all requests to move IAGP to an offsite location for a period longer than 30 days ensure the required documentation has been properly completed and all required COR/CO signatures obtained on the GSFC 20-4, Transfer/Shipping Request.

3.2.4 Performance Monitoring

The COR will ensure that employer–employee relationships do not occur between Government and Contractor personnel. This is achieved if the following is adhered to:

a. Only the Contractor interviews prospective employees.

b. Only the Contractor’s Program Manager assigns work directly to the employees.

c. Only the Contractor approves timecards and absences.

d. Government personnel do not interfere with the Contractor regarding personnel and administrative prerogatives.

3.2.5 Safety

The responsibility for meeting all safety requirements rests with the Contractor. Surveillance team safety engineers and technical personnel will review Contractor-generated hazard analyses, safety compliance data packages or other safety-related documentation, as appropriate, to help ensure all safety requirements have been satisfied. Surveillance team personnel will also maintain insight into the Contractor’s safety activities through the review of the Contractor’s submitted Safety and Health Plan, and updates, as required by this contract.