Attachment 2 QASP dated 2.23.2026.docx
DOCX document 63 KB Posted
- Attached to
- Cloud Based Internet Isolation Service Federal contract opportunity
- Solicitation number
- HC108426R0005
- Issued by
- Defense Information Systems Agency
About this file
This is a Quality Assurance Surveillance Plan (QASP) for the Cloud Based Internet Isolation (CBII) Service contract. The document establishes systematic methods for evaluating contractor performance across multiple service areas, with oversight conducted by the Contracting Officer's Representative (COR), Program Manager, and Contracting Officer (KO). The QASP employs periodic inspection and random sampling methodologies to monitor compliance with Acceptable Quality Levels (AQLs) ranging from 90% to 100% depending on the specific performance objective.
The surveillance matrix addresses thirteen major performance categories including contract management support (90% AQL), Microsoft Project scheduling and Work Breakdown Structure maintenance (100%), weekly activity reporting (90%), engineering and deployment of the cloud service offering with FedRAMP+ Level 2 compliance (95%), HEAT Shield cybersecurity protections with AI/ML capabilities (95%), 24x7x365 operational support through Tier I-III service desk (100% incident documentation, 90% reporting accuracy), Risk Management Framework and Accreditation & Authorization compliance (100%), patch management and eMASS data entry (100%), user migration and sustainment for up to 3.4 million Department of War subscribers (100%), training delivery and materials development (100%), and engineering support including test lab operations and mobile device integration (95%). Performance is assessed through qualitative deliverable evaluations measuring accuracy, completeness, and timeliness, with results documented in Performance Assessment Reports (PARs) for acceptable performance or Corrective Action Reports (CARs) for deficiencies. The plan includes five performance rating categories—Exceptional, Very Good, Satisfactory, Marginal, and Unsatisfactory—with documented remediation procedures and payment withholding authority for unacceptable performance. Appendices provide templates for PARs, customer complaint records, and CARs.
View the file
Other files for this federal contract opportunity
Show all 30
On GovTribe
Work with this file on GovTribe
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
CUI
QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)
1. Contract Title: Cloud Based Internet Isolation (CBII) Service
2. Purpose: This QASP provides a systematic method to evaluate performance for the stated contract. This QASP explains the following:
· What will be monitored?
· How monitoring will take place.
· Who will conduct the monitoring?
· How monitoring efforts and results will be documented.
This QASP does not detail how the contractor accomplishes the work. Rather, the QASP is created with the premise that the contractor is responsible for management and quality control actions to meet the terms of the contract. It is the Government’s responsibility to be objective, fair, and consistent in evaluating performance In addition, the QASP should recognize that unforeseen and uncontrollable situations may occur.
This QASP is a “living document” and the Government may review and revise it on a regular basis. Updates shall ensure that the QASP remains a valid, useful, and enforceable document. Copies of the original QASP and revisions shall be provided to the contractor and Government officials implementing surveillance activities.
3. Roles and Responsibilities: The following personnel shall oversee and coordinate surveillance activities.
Program/Project Manager (PM) – The PM provides program oversight and supports the COR’s performance assessment activities.
Contracting Officer (KO) – The KO shall ensure performance of all necessary actions for effective contracting, ensure compliance with the contract terms, and shall safeguard the interests of the United States in the contractual relationship. The KO shall also ensure that the contractor receives impartial, fair, and equitable treatment under this contract. Determine the final assessment of the contractor’s performance.
Contracting Officer’s Representative (COR) – The COR is responsible for providing continuous technical oversight of the contractor’s performance. The COR uses the QASP to conduct the oversight/surveillance process. The COR shall keep a Quality Assurance file that accurately documents the contractor’s actual performance. The purpose is to ensure that the contractor meets the performance standards contained in the contract. The COR is responsible for reporting early identification of performance problems to the KO. The COR is required to provide an annual performance assessment for the KO which will be used in documenting past performance. The QASP is the primary tool for documenting contractor performance. The COR is not empowered to make any contractual commitments or to authorize any contractual change on the Government’s behalf.
4. Primary Method of Surveillance: Primary method of surveillance includes a combination of Random Sampling and Periodic Inspection.
· Random Sampling: This is usually the most appropriate method for recurring tasks. With random sampling, services are sampled to determine if the level of performance is acceptable. Random sampling works best when the number of instances of the services being performed is very large and a statistically valid sample can be obtained. Computer programs may be available to assist in establishing sampling procedures.
· Periodic Inspection: These services are monitored weekly, monthly, quarterly, semiannually, annually, etc. Periodic types of activities are perfect for periodic inspection because not only are they infrequent, but there is normally a predetermined, specified time frame within which the tasks must be accomplished. Therefore, you know exactly when to conduct the evaluations. Periodic inspections automatically become 100 percent evaluations or "100 percent checks." Inspections should be divided and scheduled by frequency: annual, semiannual, quarterly, monthly, weekly and as required. Sometimes services are required for which the time or frequency cannot be predicted, such as accident investigations, one-time special tasking by higher headquarters, etc. These would be labeled "as required inspections." Others are known and predictable such as the quarterly status report or the monthly travel report currently included in some DISA service contracts.
Surveillance Matrix
The Surveillance Matrix (Appendix 1) is the list of performance objectives and standards that must be performed by the contractor. This matrix details the method of surveillance the COR will use to validate and inspect these performance elements. Inspection of each element will be documented in the COR file.
Performance objectives define the desired outcomes. Performance Standards define the level of service required under the contract to successfully meet the performance objective. The inspection methodology defines how, when, and what will be assessed in measuring performance. Government performance surveillance, using this QASP, to determine the quality of the contractor’s performance as it relates to the performance element standards. The Acceptable Quality Level (AQL) performance Standard Table should be used to form the foundation of the COR’s inspection checklist.
5. Performance Standards:
Performance Standards
| AQLs |
| Methods of |
Calculation
| 6.1.1 The Contractor shall provide contract managed services support to interface with the CORs regarding task delegation, daily tasks, deliverables, and contract management/scope of work, budget and all other daily requirements. |
| 90% Contract Management Plan contain required information, comprehensive (Covers Initiation, Planning, Execution, Monitoring and Controlling, Closure Phases). |
Any required revisions are:
resolved within 1 week, accepted by KO/COR Calculation:
Qualitative deliverable assessment. Deliverables are assessed for accuracy, completeness, and timeliness against AQLs.
| 6.1.2 The Contractor shall provide key milestone and activity information via the provision of a Microsoft Project Schedule to support the Integrated Master Schedule and maintain a detailed Work Breakdown Structure (WBS) for each task on the contract. |
| 100% maintenance and updating of the MS project schedule accurately detailing activities and analyzing deviations from the schedule baseline. |
100% maintenance and updating of the WBS for required task on the contract.
Calculation:
Qualitative deliverable assessment. Deliverables are assessed for accuracy, completeness, and timeliness against AQLs.
| 6.1.3 The contractor shall provide a Weekly Activity Report (WAR) detailing program activities performed by the contractor that describes progress/status for the week reported in support of this contract. |
| 90% WAR input is a detailed, high level paragraph summary of the project’s weekly events and issues in support of this contract. |
| Calculation: |
Qualitative deliverable assessment. Deliverables are assessed for accuracy, completeness, and timeliness against AQLs.
| 6.1.5 The contractor shall manage, maintain, and update present and future program/briefing documentation. The contractor shall prepare and finalize all presentations/briefings to ensure compliance with Government standard template requirements. |
| 90% of the development and maintenance of the Documentation Management Plan accurately details documentation, repositories, and ownership. |
90% of PMO required documentation is timely uploaded, maintained, and updated on the Government required repository Calculation:
Qualitative deliverable assessment. Deliverables are assessed for accuracy, completeness, and timeliness against AQLs.
| 6.1.6 The contractor shall provide all managed services necessary to manage and oversee all aspects of the contract. |
| 90% of Key performance parameters to monitor work performance, measure results, and ensure delivery of contracted product deliverables shall be IAW PWS, Service Management Plan (SMP), and ID5 requirements. |
90% of agreement status reporting documentation shall be timely and accurate IAW PWS, SMP, ID5, and PAE Cyber requirements.
Calculation:
Qualitative deliverable assessment. Deliverables are assessed for accuracy, completeness, and timeliness against AQLs.
| 6.2 – 6.2.1 The Contractor shall develop a plan that supports the engineering, development, deployment, and sustainment of an unclassified Cloud Service Offering (CSO) that enables the DoW to isolate Internet traffic, mitigate threats, and free up the bandwidth capacity, by redirecting Internet browsing from the end user’s desktop into a remote cloud-based server. The CSO shall meet all the FedRAMP+ Level 2 (Non-Controlled Unclassified Information) distinguishing requirements and characteristics. |
| 95% engineering, development, deployment, implementation, integration, sustainment, testing, and cyber security protection plans shall be accurate, timely, and effective IAW applicable ID5 and DISA review and provided engineering standards. |
95% Operation Support reports shall be timely, and accurate IAW PWS, SMP, ID5, and PAE Cyber requirements.
Calculation:
Qualitative deliverable assessment. Deliverables are assessed for accuracy, completeness, and timeliness against AQLs.
| 6.2.2 The Contractor shall enable HEAT Shield protections in the CBII environment to provide cyber defensive auto-mitigations that respond to cyber threats, attempted breaches, or other malicious threat vectors by utilizing CBII platform-enabled machine learning (ML) and artificial intelligence (AI) capabilities that identifies, neutralizes, and eliminates these cyber threats. |
| 95% HEAT Shield engineering, development, deployment, implementation, integration, sustainment, testing, and cyber security protection plans shall be accurate, timely, and effective IAW applicable ID5 and DISA review and provided engineering standards. |
95% Operation Support reports shall be timely, and accurate IAW PWS, SMP, ID5, and PAE Cyber requirements.
Calculation:
Qualitative deliverable assessment. Deliverables are assessed for accuracy, completeness, and timeliness against AQLs.
| 6.3 – 6.3.4 The Contractor, as a managed service, will provide operational support in accordance with the Defense Enterprise Service Management Framework (DESMF). DoW uses the DESMF to improve Information Technology (IT) Service Management (ITSM) capabilities across the Department via the provision of Tier I, II, III 24x7x365 service desk operational support |
| 100% time to incident documentation, response, escalation, and resolution status shall be IAW the SMP, PWS, ID5, and PAE Cyber requirements. |
90% Operational Service Support Reports shall be accurate and timely as required PWS, SMP, ID5, and PAE Cyber requirements.
Calculation:
Qualitative deliverable assessment. Deliverables are assessed for accuracy, completeness, and timeliness against AQLs.
| 6.4 The contractor shall provide expertise, knowledge, understanding, support and implementation of all phases of the Risk Management Framework (RMF) and Accreditation & Authorization (A&A) lifecycle in support of CBII. |
| 100% Compliance with RMF Standards |
100% Maintenance of all operational RMF standards to include but not limited to Interim Authority to Test (IATT), Interim Authority to Operate (IATO), Authority to Operate Conditional (ATO-C), and Authority to Operate (ATO) for the CBII program.
100% Compliance with security engineering to the Government and executing A&A activities for development, test, and production systems to maintain compliance with DoD 8500 series publication.
Calculation:
Qualitative deliverable assessment. Deliverables are assessed for accuracy, completeness, and timeliness against AQLs.
| 6.4 The Contractor shall maintain current SOPs in support of obtaining, testing, and coordinating the deployment and implementation of all patches to mitigate and/or remediate all assets in the development, test and production environments affected by open findings to include vulnerability and Enterprise Mission Assurance Support Services (eMASS) data entry. |
| 100% Compliance with eMASS requirements |
100% Compliance with A&A requirements (with exceptions authorized by Government)
100% Compliance with POA&M creation and remediation Calculation:
Qualitative deliverable assessment. Deliverables are assessed for accuracy, completeness, and timeliness against AQLs.
| 6.5 The Contractor shall develop a user migration and sustainment approach that minimizes the business impact to day-to-day operations such as downtime, data integrity issues, and costs. The Contractor shall provide the manpower, tools, and hardware needed to migrate and sustain existing services, operations, and customer data necessary to deliver the CSO up to 3.4 million DoW subscribers. |
| 100% Compliance with supporting dual operations, ensuring that users migrated to the CSO can collaborate with those that have not been migrated |
100% Compliance during sustainment providing white glove technical support to organizations undergoing CBII upgrades, enhancements or other technical changes or issues with the CBII environment that require assistance
Calculation:
Qualitative deliverable assessment. Deliverables are assessed for accuracy, completeness, and timeliness against AQLs.
| 6.6 – 6.6.3 The Contractor shall provide in-person, or online classroom/instructor led training to subscribers, privileged users, and trainers. The Contractor shall develop training materials to prepare CBII subscribers, administrators, and instructors on the CSO features and functions in preparation for migration, deployments and day-to-day operations. The Contractor shall develop various training artifacts that will be utilized to train users and administrators on the service. |
| 100% of training delivery shall be timely, accurate, and effective IAW ID5 and DISA review and provided engineering operational standards. |
100% of training and procedural documentation shall be timely, accurate, and effective IAW ID5 and DISA review and provided engineering operational standards.
Any required revisions are minimal.
Revisions within five Business Days, Accepted by COR Calculation:
Qualitative deliverable assessment. Deliverables are assessed for accuracy, completeness, and timeliness against AQLs.
| 6.7 – 6.7.7 The Contractor shall provide the full range of engineering support necessary to incorporate new/future technologies into the CBII service/baseline after initial deployment and must have expertise in both traditional IT infrastructure and cloud computing. The Contractor shall provide comprehensive technical/engineering support services to include design, implementation, modification, and sustainment of CBII projects and work activities |
| 95% of the engineering / architecture / network documents and diagrams are accurate and in compliance with ID5 and DISA provided engineering standards. |
Any required revisions are minimal.
Revisions within five Business Days, Accepted by COR Calculation:
Qualitative deliverable assessment. Deliverables are assessed for accuracy, completeness, and timeliness against AQLs.
| 6.7.5 The Contractor shall establish and maintain an integrated test lab that will support a full range of integration test activities for both the currently fielded system, and future maintenance/modernization releases. |
| 95% of the test plans and test report are accurate and in compliance with ID5 and DISA provided engineering testing standards. |
Any required revisions are minimal.
Revisions within five Business Days, Accepted by COR Calculation:
Qualitative deliverable assessment. Deliverables are assessed for accuracy, completeness, and timeliness against AQLs.
| 6.7.7 The Contractor shall support the integration of the CBII CSO and delivery of CBII services to DoW approved mobile devices |
| 95% of mobility engineering plans are accurate and in compliance with ID5 and DISA provided mobility engineering standards. |
Any required revisions are minimal.
Revisions within five Business Days, Accepted by COR Calculation:
Qualitative deliverable assessment. Deliverables are assessed for accuracy, completeness, and timeliness against AQLs.
6. Documenting Performance:
Acceptable Performance.
The Government shall document positive performance. A Performance Assessment Report (PAR) template is attached (Appendix 2). Any report may become part of the supporting documentation for fixed price payments, award/incentive fee payments, Contractor Performance Assessment Reporting System (CPARS) entries, or other actions. Government acceptance of services permits the contractor to invoice for the service fee.
Unacceptable performance.
Unacceptable contractor performance can be identified by customer complaints (Appendix 3) or upon schedule surveillance evaluations. When unacceptable performance occurs, the COR shall inform the contractor. This will normally be in writing unless circumstances necessitate verbal communication and may be through the PAR template (Appendix 2). The COR shall document the discussion and place it in the COR file and provide a copy to the KO.
When the COR determines formal written communication is required, the COR shall prepare a Corrective Action Report (CAR). The CAR is forwarded to the KO for dissemination to the contractor. A CAR template is attached to this QASP (Appendix 4).
The contractor shall acknowledge receipt of the CAR in writing. The CAR will specify if the contractor is required to prepare a corrective action plan to document how the contractor shall correct the unacceptable performance and avoid a recurrence. The CAR will also state how long after receipt the contractor must present this corrective action plan to the KO and COR. The Government may withhold payment for services until corrective action is taken. The Government shall review the contractor's corrective action plan to determine acceptability. Upon Government acceptance of the corrected services the contractor will be permitted to invoice for the service fee.
Any CAR may become a part of the supporting documentation for contract payment deductions, fixed fee deductions, award fee nonpayment, CPARS or other actions deemed necessary by the KO.
7. Mandatory or regulatory compliance items: The contractor will provide initial proof of compliance with regulatory and compliance items contained in the contract. The Contracting Officer's Representative (COR) and the Contracting Officer (KO) will evaluate the initial submission and will conduct ad hoc reviews of the contractor's compliance throughout the remainder of the contract. The contractor will monitor compliance as required by FAR 52.222-50, Combating Trafficking in Persons, and report any issues to the KO. The contractor shall inform its employees in writing of contractor employee whistleblower rights and protections as required by DFARS 252.203-7002, Requirement to Inform Employees of Whistleblower Rights. The contractor shall also ensure that the clause is included in all subcontracts. No later than 60 days prior to expiration of the period of performance, the contractor shall provide written affirmation to the COR that a written notification was provided to Contractor employees and the forum/means in which the written notification was provided (e.g., posted in hallways, cubicle spaces, common room spaces, email correspondence).
8. AQL: See Section 5 – Performance Standards. The AQLs are identified in performance standards matrix.
9. Evaluation Method: See Section 5 – Performance Standards. The evaluation method is identified in the calculation and surveillance methods of the performance standards matrix.
10. Performance Rating: In evaluating the quality of contractor’s performance, the following performance ratings may be used (same as CPAR ratings).
| Rating |
| Definition |
| Note |
| Exceptional |
| Performance meets contractual requirements and exceeds many to the Government’s benefit. The contractual performance of the element or sub-element being evaluated was accomplished with few minor problems for which corrective actions taken by the contractor were highly effective. |
| To justify an Exceptional rating, identify multiple significant events and state how they were of benefit to the Government. A singular benefit, however, could be of such magnitude that it alone constitutes an Exceptional rating. Also, there should have been NO significant weaknesses identified. |
| Very Good |
| Performance meets contractual requirements and exceeds some to the Government’s benefit. The contractual performance of the element or sub-element being evaluated was accomplished with some minor problems for which corrective actions taken by the contractor were effective. |
| To justify a Very Good rating, identify a significant event and state how it was a benefit to the Government. There should have been no significant weaknesses identified. |
| Satisfactory |
| Performance meets contractual requirements. The contractual performance of the element or sub-element contains some minor problems for which corrective actions taken by the contractor appear or were satisfactory. |
| To justify a Satisfactory rating, there should have been only minor problems, or major problems the contractor recovered from without impact to the contract/order. There should have been NO significant weaknesses identified. A fundamental principle of assigning ratings is that contractors will not be evaluated with a rating lower than Satisfactory solely for not performing beyond the requirements of the contract/order. |
| Marginal |
| Performance does not meet some contractual requirements. The contractual performance of the element or sub-element being evaluated reflects a serious problem for which the contractor has not yet identified corrective actions. The contractor’s proposed actions appear only marginally effective or were not fully implemented. |
| To justify Marginal performance, identify a significant event in each category that the contractor had trouble overcoming and state how it impacted the Government. A Marginal rating should be supported by referencing the management tool that notified the contractor of the contractual deficiency (e.g., management, quality, safety, environmental deficiency report or letter). |
| Unsatisfactory |
| Performance does not meet most contractual requirements, and recovery is not likely in a timely manner. The contractual performance of the element or sub-element contains a serious problem(s) for which the contractor’s corrective actions appear or were ineffective. |
| To justify an Unsatisfactory rating, identify multiple significant events in each category that the contractor had trouble overcoming and state how it impacted the Government. A singular problem, however, could be of such serious magnitude that it alone constitutes an unsatisfactory rating. An Unsatisfactory rating should be supported by referencing the management tools used to notify the contractor of the contractual deficiencies (e.g., management, quality, safety, or environmental deficiency reports, or letters). |
Appendix 1 – Surveillance Matrix
Performance Standards Acceptable Quality Levels Methods of Calculation
| Surveillance |
| Results/Ratings |
| 6.1.1 The Contractor shall provide contract managed services support to interface with the CORs regarding task delegation, daily tasks, deliverables, and contract management/scope of work, budget and all other daily requirements. |
| 90% Contract Management Plan (CMP) contains required information, comprehensive (Covers Initiation, Planning, Execution, Monitoring and Controlling, Closure Phases). |
Any required revisions are:
Resolved within 1 week, Accepted by KO/COR Calculation:
Qualitative deliverable assessment. Deliverables are assessed for accuracy, completeness, and timeliness against AQLs.
Method of Surveillance Periodic Inspection. Performance monitoring and assessment shall be accomplished by the COR via the weekly review of WAR and Project Schedules, and monthly review of the Monthly Status Report. Applicable deliverables shall be evaluated for timeliness, content and format, as provided to Government.
A cumulative assessment of the periodic inspections of contract deliverables to develop an overall acceptability determination IAW acceptability level.
6.1.2 The Contractor shall provide key milestone and activity information via the provision of a Microsoft Project Schedule to support the Integrated Master Schedule and maintain a detailed WBS for each task on the contract.
100% maintenance and updating of the MS project schedule accurately detailing activities and analyzing deviations from the schedule baseline.
100% maintenance and updating of the WBS for required task on the contract.
Calculation:
Qualitative deliverable assessment. Deliverables are assessed for accuracy, completeness, and timeliness against AQLs.
Method of Surveillance Periodic Inspection. Performance monitoring and assessment shall be accomplished by the COR via the weekly review of WAR and Project Schedules, and monthly review of the Monthly Status Report. Applicable deliverables shall be evaluated for timeliness, content, and format, as provided to Government.
A cumulative assessment of the periodic inspections of contract deliverables to develop an overall acceptability determination IAW acceptability level.
6.1.3 The contractor shall provide a WAR detailing program activities performed by the contractor that describes progress/status for the week reported in support of this contract.
| 90% WAR input is a detailed, high level paragraph summary of the project’s weekly events and issues in support of this contract. |
| Calculation: |
Qualitative deliverable assessment. Deliverables are assessed for accuracy, completeness, and timeliness against AQLs.
Method of Surveillance Periodic Inspection. Performance monitoring and assessment shall be accomplished by the COR via the weekly review of WAR and Project Schedules, and monthly review of the Monthly Status Report. Applicable deliverables shall be evaluated for timeliness, content, and format, as provided to Government.
A cumulative assessment of the periodic inspections of contract deliverables to develop an overall acceptability determination IAW acceptability level.
| 6.1.5 The contractor shall manage, maintain, and update present and future program/briefing documentation. The contractor shall prepare and finalize all presentations/briefings to ensure compliance with Government standard template requirements. |
| 90% of the development and maintenance of the Documentation Management Plan accurately details documentation, repositories, and ownership. |
90% of PMO required documentation is timely uploaded, maintained, and updated on the Government required repository Calculation:
Qualitative deliverable assessment. Deliverables are assessed for accuracy, completeness, and timeliness against AQLs.
Method of Surveillance Periodic Inspection. Performance monitoring and assessment shall be accomplished by the COR via the weekly review of WAR and Project Schedules, and monthly review of the Monthly Status Report. Applicable deliverables shall be evaluated for timeliness, content, and format, as provided to Government.
A cumulative assessment of the periodic inspections of contract deliverables to develop an overall acceptability determination IAW acceptability level.
6.1.6 The contractor shall provide all managed services necessary to manage and oversee all aspects of the contract.
90% of Key performance parameters to monitor work performance, measure results, and ensure delivery of contracted product deliverables shall be IAW PWS, SMP, and ID5 requirements.
90% of agreement status reporting documentation shall be timely and accurate IAW PWS, SMP, ID5, and PAE Cyber requirements.
Calculation:
Qualitative deliverable assessment. Deliverables are assessed for accuracy, completeness, and timeliness against AQLs.
Method of Surveillance Periodic Inspection. Performance monitoring and assessment shall be accomplished by the COR via the weekly review of WAR and Project Schedules, and monthly review of the Monthly Status Report. Applicable deliverables shall be evaluated for timeliness, content, and format, as provided to Government.
A cumulative assessment of the periodic inspections of contract deliverables to develop an overall acceptability determination IAW acceptability level.
| 6.2 – 6.2.1 The Contractor shall develop a plan that supports the engineering, development, deployment, and sustainment of an unclassified CSO that enables the DoW to isolate Internet traffic, mitigate threats, and free up the bandwidth capacity, by redirecting Internet browsing from the end user’s desktop into a remote cloud-based server. The CSO shall meet all the FedRAMP+ Level 2 (Non-Controlled Unclassified Information) distinguishing requirements and characteristics. |
| 95% engineering, development, deployment, implementation, integration, sustainment, testing, and cyber security protection plans shall be accurate, timely, and effective IAW applicable ID5 and DISA review and provided engineering standards. |
95% Operation Support reports shall be timely, and accurate IAW PWS, SMP, ID5, and PAE Cyber requirements.
Calculation:
Qualitative deliverable assessment. Deliverables are assessed for accuracy, completeness, and timeliness against AQLs.
Method of Surveillance Periodic Inspection. Performance monitoring and assessment shall be accomplished by the COR via the weekly review of WAR and Project Schedules, and monthly review of the Monthly Status Report. Applicable deliverables shall be evaluated for timeliness, content, and format, as provided to Government.
A cumulative assessment of the periodic inspections of contract deliverables to develop an overall acceptability determination IAW acceptability level.
| 6.2.2 The Contractor shall enable HEAT Shield protections in the CBII environment to provide cyber defensive auto-mitigations that respond to cyber threats, attempted breaches, or other malicious threat vectors by utilizing CBII platform-enabled ML and AI capabilities that identify, neutralizes, and eliminates these cyber threats. |
| 95% HEAT Shield engineering, development, deployment, implementation, integration, sustainment, testing, and cyber security protection plans shall be accurate, timely, and effective IAW applicable ID5 and DISA review and provided engineering standards. |
95% Operation Support reports shall be timely, and accurate IAW PWS, SMP, ID5, and PAE Cyber requirements.
Calculation:
Qualitative deliverable assessment. Deliverables are assessed for accuracy, completeness, and timeliness against AQLs.
Method of Surveillance Periodic Inspection. Performance monitoring and assessment shall be accomplished by the COR via the weekly review of WAR and Project Schedules, and monthly review of the Monthly Status Report. Applicable deliverables shall be evaluated for timeliness, content, and format, as provided to Government.
A cumulative assessment of the periodic inspections of contract deliverables to develop an overall acceptability determination IAW acceptability level.
| 6.3 – 6.3.4 The Contractor, as a managed service, will provide operational support in accordance with the DESMF. DoW uses the DESMF to improve ITSM capabilities across the Department via the provision of Tier I, II, III 24x7x365 service desk operational support |
| 100% time to incident documentation, response, escalation, and resolution status shall be IAW the SMP, PWS, ID5, and PAE Cyber requirements. |
90% Operational Service Support Reports shall be accurate and timely as required PWS, SMP, ID5, and PAE Cyber requirements.
Calculation:
Qualitative deliverable assessment. Deliverables are assessed for accuracy, completeness, and timeliness against AQLs.
Method of Surveillance Periodic Inspection. Performance monitoring and assessment shall be accomplished by the COR via the weekly review of WAR and Project Schedules, and monthly review of the Monthly Status Report. Applicable deliverables shall be evaluated for timeliness, content, and format, as provided to Government.
A cumulative assessment of the periodic inspections of contract deliverables to develop an overall acceptability determination IAW acceptability level.
| 6.4 The contractor shall provide expertise, knowledge, understanding, support and implementation of all phases of the RMF and A&A lifecycle in support of CBII. |
| 100% Compliance with RMF Standards |
100% Maintenance of all operational RMF standards to include but not limited to IATT, IATO, ATO-C, and ATO for the CBII program.
100% Compliance with security engineering to the Government and executing A&A activities for development, test, and production systems to maintain compliance with DoD 8500 series publication.
Calculation:
Qualitative deliverable assessment. Deliverables are assessed for accuracy, completeness, and timeliness against AQLs.
Method of Surveillance Periodic Inspection. Performance monitoring and assessment shall be accomplished by the COR via the weekly review of WAR and Project Schedules, and monthly review of the Monthly Status Report. Applicable deliverables shall be evaluated for timeliness, content, and format, as provided to Government.
A cumulative assessment of the periodic inspections of contract deliverables to develop an overall acceptability determination IAW acceptability level.
| 6.4 The Contractor shall maintain current SOPs in support of obtaining, testing, and coordinating the deployment and implementation of all patches to mitigate and/or remediate all assets in the development, test and production environments affected by open findings to include vulnerability and eMASS data entry. |
| 100% Compliance with eMASS requirements |
100% Compliance with A&A requirements (with exceptions authorized by Government)
100% Compliance with POA&M creation and remediation Calculation:
Qualitative deliverable assessment. Deliverables are assessed for accuracy, completeness, and timeliness against AQLs.
Method of Surveillance Periodic Inspection. Performance monitoring and assessment shall be accomplished by the COR via the weekly review of WAR and Project Schedules, and monthly review of the Monthly Status Report. Applicable deliverables shall be evaluated for timeliness, content, and format, as provided to Government.
A cumulative assessment of the periodic inspections of contract deliverables to develop an overall acceptability determination IAW acceptability level.
| 6.5 The Contractor shall develop a user migration and sustainment approach that minimizes the business impact to day-to-day operations such as downtime, data integrity issues, and costs. The Contractor shall provide the manpower, tools, and hardware needed to migrate and sustain existing services, operations, and customer data necessary to deliver the CSO up to 3.4 million DoW subscribers. |
| 100% Compliance with supporting dual operations, ensuring that users migrated to the CSO are able to collaborate with those that have not been migrated |
100% Compliance during sustainment providing white glove technical support to organizations undergoing CBII upgrades, enhancements or other technical changes or issues with the CBII environment that require assistance
Calculation:
Qualitative deliverable assessment. Deliverables are assessed for accuracy, completeness, and timeliness against AQLs.
Method of Surveillance Periodic Inspection. Performance monitoring and assessment shall be accomplished by the COR via the weekly review of WAR and Project Schedules, and monthly review of the Monthly Status Report. Applicable deliverables shall be evaluated for timeliness, content, and format, as provided to Government.
A cumulative assessment of the periodic inspections of contract deliverables to develop an overall acceptability determination IAW acceptability level.
6.6 – 6.6.3 The Contractor shall provide in-person, or online classroom/instructor led training to subscribers, privileged users, and trainers. The Contractor shall develop training materials to prepare CBII subscribers, administrators, and instructors on the CSO features and functions in preparation for migration, deployments and day-to-day operations. The Contractor shall develop various training artifacts that will be utilized to train users and administrators on the service.
100% of training delivery shall be timely, accurate, and effective IAW ID5 and DISA review and provided engineering operational standards.
100% of training and procedural documentation shall be timely, accurate, and effective IAW ID5 and DISA review and provided engineering operational standards.
Any required revisions are minimal.
Revisions within five Business Days, Accepted by COR Calculation:
Qualitative deliverable assessment. Deliverables are assessed for accuracy, completeness, and timeliness against AQLs.
Method of Surveillance Periodic Inspection. Performance monitoring and assessment shall be accomplished by the COR via the weekly review of WAR and Project Schedules, and monthly review of the Monthly Status Report. Applicable deliverables shall be evaluated for timeliness, content, and format, as provided to Government.
A cumulative assessment of the periodic inspections of contract deliverables to develop an overall acceptability determination IAW acceptability level.
| 6.7 – 6.7.7 The Contractor shall provide the full range of engineering support necessary to incorporate new/future technologies into the CBII service/baseline after initial deployment and must have expertise in both traditional IT infrastructure and cloud computing. The Contractor shall provide comprehensive technical/engineering support services to include design, implementation, modification, and sustainment of CBII projects and work activities |
| 95% of the engineering / architecture / network documents and diagrams are accurate and in compliance with ID5 and DISA provided engineering standards. |
Any required revisions are minimal.
Revisions within five Business Days, Accepted by COR Calculation:
Qualitative deliverable assessment. Deliverables are assessed for accuracy, completeness, and timeliness against AQLs.
Method of Surveillance Periodic Inspection. Performance monitoring and assessment shall be accomplished by the COR via the weekly review of WAR and Project Schedules, and monthly review of the Monthly Status Report. Applicable deliverables shall be evaluated for timeliness, content, and format, as provided to Government.
A cumulative assessment of the periodic inspections of contract deliverables to develop an overall acceptability determination IAW acceptability level.
| 6.7.5 The Contractor shall establish and maintain an integrated test lab that will support a full range of integration test activities for both the currently fielded system, and future maintenance/modernization releases. |
| 95% of the test plans and test report are accurate and in compliance with ID5 and DISA provided engineering testing standards. |
Any required revisions are minimal.
Revisions within five Business Days, Accepted by COR Calculation:
Qualitative deliverable assessment. Deliverables are assessed for accuracy, completeness, and timeliness against AQLs.
Method of Surveillance Periodic Inspection. Performance monitoring and assessment shall be accomplished by the COR via the weekly review of WAR and Project Schedules, and monthly review of the Monthly Status Report. Applicable deliverables shall be evaluated for timeliness, content, and format, as provided to Government.
A cumulative assessment of the periodic inspections of contract deliverables to develop an overall acceptability determination IAW acceptability level.
| 6.7.7 The Contractor shall support the integration of the CBII CSO and delivery of CBII services to DoW approved mobile devices |
| 95% of mobility engineering plans are accurate and in compliance with ID5 and DISA provided mobility engineering standards. |
Any required revisions are minimal.
Revisions within five Business Days, Accepted by COR Calculation:
Qualitative deliverable assessment. Deliverables are assessed for accuracy, completeness, and timeliness against AQLs.
Method of Surveillance
Periodic Inspection. Performance monitoring and assessment shall be accomplished by the COR via the weekly review of WAR and Project Schedules, and monthly review of the Monthly Status Report. Applicable deliverables shall be evaluated for timeliness, content, and format, as provided to Government.
A cumulative assessment of the periodic inspections of contract deliverables to develop an overall acceptability determination IAW acceptability level.
Appendix 2 – Performance Assessment Report
PERFORMANCE ASSESSMENT REPORT (PAR)
(If more space is needed, use reverse and identify by number)
| 1. CONTRACT/TASK ORDER NUMBER |
| 2. CONTRACTOR |
| 3. TYPE OF SERVICES |
4. QUALITY ASSURANCE PERSONNEL (COR) SIGNATURE AND DATE
| 5. COR PHONE |
| 6. SUSPENSE DATE |
I. PERFORMANCE
7. |_| DEFICIENCY (CHECK ALL BOXES THAT APPLY)
|_| NEW
|_| REPEAT
|_| NO DEFICIENCY NOTED
8. SERVICES SUMMARY or PWS PARAGRAPH ITEM REVIEWED
| 9. BRIEF DESCRIPTION OF DEFICIENCY (IF DEFICIENCY BOX WAS CHECKED) |
| 10. DETAILED PERFORMANCE ASSESSMENT |
II. CONTRACTOR VALIDATION
11. CONTRACTOR REPRESENTATIVE |_| CONCUR |_| NON-CONCUR
12. CORRECTIVE ACTION ESTIMATED COMPLETION DATE
13. CONTRACTOR REPRESENTATIVE CORRECTIVE ACTION AND PREVENTION OF RECURRENCE OR REASON FOR NON-CONCURRENCE OF COR CITED DEFICIENCY
III. ACTION CORRECTED
14. |_| CONCUR |_| NON-CONCUR COR SIGNATURE AND DATE
15. COR REMARKS (REQUIRED)
6. CONTRACTOR REPRESENTATIVE REMARKS
Appendix 3 – Customer Complaint Record
CUSTOMER COMPLAINT RECORD
DATE/TIME OF COMPLAINT
SOURCE OF COMPLAINT
ORGANIZATION
BUILDING NUMBER
INDIVIDUAL
PHONE NUMBER
NATURE OF COMPLAINT
CONTRACT REFERENCE
VALIDATION
DATE/TIME CONTRACTOR INFORMED OF COMPLAINT
ACTION TAKEN BY CONTRACTOR
RECEIVED/VALIDATED BY
Appendix 4 – Corrective Action Report
CORRECTIVE ACTION REPORT (CAR)
(If more space is needed, use reverse and identify by number)
1. CONTRACTOR
2. CONTRACT NUMBER
3. TYPE OF SERVICES
4. FUNCTIONAL AREA
5. SUSPENSE DATE
6. CONTROL NUMBER
7. DEFICIENCY |_| MAJOR |_| MINOR
FINDING:
FINDING IMPACT:
Please respond with a written corrective action plan that details the corrective action of the cited deficiency, the cause of the deficiency, and actions taken to prevent recurrence by Suspense Date in Block 5. If date was not entered in Block 5, the contractor is not required to provide a response.
8. QUALITY ASSURANCE PERSONNEL (COR)
TYPED NAME AND GRADE
SIGNATURE AND DATE
9. ISSUING AUTHORITY
TYPED NAME AND GRADE
SIGNATURE AND DATE
10. COR RESPONSE TO CONTRACTOR CORRECTIVE ACTION AND ACTION TAKEN TO PREVENT RECURRENCE
11. COR DETERMINATION
|_| ACCEPTED |_| REJECTED
12. CLOSE DATE
Controlled By: DISA Controlled By: ID5 CUI Category: PROCURE Distribution/Dissemination Control: FEDCON POC: Gordon, Elmer A CIV DISA PEO CYBER (USA) <elmer.a.gordon.civ@mail.mil>
File details come from the government source that posted it. Updated .