Attachment J.2 IT Staffing QASP.pdf

Quality Assurance Surveillance Plan (QASP) Version – 1.0 Federal Occupational Health (FOH) Information Technology Staffing Contract

Contract Number:

Contractor’s Name:

1. Vision Federal Occupational Health (FOH) defined Occupational Health Services (OHS) as well as consultation to Federal customer agencies exclusively through interagency agreements (IAAs).

FOH is the largest provider of occupational health services in the Federal Government. FOH enters into IAAs negotiated with federal departments and federal agencies’ national headquarters, and/or with their regional/local components for standard services, including clinical services delivery, expert medical consultation tailored to a particular federal agency’s OHS needs, wellness and health promotion services, behavioral health services, and environmental health and safety services. FOH maintains sole responsibility for consulting with its Federal agency customers. The Contractor’s primary role is to facilitate delivery of FOH occupational health services by providing reliable information technology (IT) infrastructure and staffing expertise that supports mandated requirements and efficiently allows FOH staff to be as competitive as possible in the performance of their work. The intent is that these will aid in management of the revenue stream for the entire organization. FOH provides OHS services in four areas: Clinical Services, Behavioral Health Services, Environmental Health and Safety Services, as well as Wellness and Health Promotions.

2. Mission The mission of Federal Occupational Health (FOH), a component of the Program Support Center (PSC) is to improve the health, safety, and productivity of the Federal workforce.

We provide support for HHS and many other agencies across the federal government.

3. Purpose This Quality Assurance Surveillance Plan is a government-developed document used to determine if the contractor’s performance meets the performance standards contained in the contract. The QASP establishes procedures on how this assessment/inspection process will be conducted. It provides the detailed process for a continuous oversight process:

• What will be monitored

• How monitoring will take place

• Who will conduct the monitoring

• How monitoring efforts and results will be documented

The contractor is responsible for implementing and delivering performance that meets contract standards using its Quality Control Plan. The QASP provides the structure for the government’s surveillance of the contractor’s performance and their Quality Assurance/Quality Control (QA/QC) actions to assure they meet contract standards. It is the government’s responsibility to be objective, fair and consistent in evaluating contractor performance.

The QASP is not part of the contract, nor is it intended to duplicate the contractor’s quality control plan. This QASP is a living document. Flexibility in the QASP is required to allow for an increase or decrease in the level of surveillance necessary based on contractor performance.

The government may provide a copy of the QASP to the contractor to facilitate open communication. In addition, the QASP should recognize that unforeseen or uncontrollable circumstances might occur that are outside the control of the contractor. The QASP should ensure early identification and resolution of performance issues to minimize impact on mission performance.

4. Authority Authority for issuance of this QASP is provided under Part 46 of the Federal Acquisition Regulation, Inspection of Services clauses, which provides for inspection, acceptance and documentation of the service called for in the contract or order. This acceptance is to be executed by the contracting officer or a duly authorized representative.

5. Roles and Responsibilities The following personnel shall oversee and coordinate surveillance activities.

Program/Project Manager (PM) or Functional Services Manager (FSM) – The PM/FSM provides primary program oversight, nominates the contracting officer representative ( COR), ensures the COR is trained before performing any COR duties and supports the COR’s performance assessment activities. While the PM/FSM may serve as a direct conduit to provide Government guidance and feedback to the Contractor on technical matters, they are not empowered to make any contractual commitments or any contract changes on the government’s behalf.

Assigned PM/FSM: To be determined at award Organization or Agency:

Telephone:

Email:

Contracting Officer (CO) – The CO shall ensure performance of all necessary actions for effective contracting, ensure compliance with the contract terms, and shall safeguard the interests of the United States in the contractual relationship. The CO shall also ensure that the contractor receives impartial, fair, and equitable treatment under this contract and determine the final assessment of the contractor’s performance.

Assigned CO: Saundra Little Kpadeh Organization or Agency: Office of Acquisition Management Services Telephone: (301)492-5297 Email: Saundra.Kpadeh@hhs.gov

Contracting Officer’s Representative (COR) The COR is responsible for providing continuous technical oversight of the contractor’s performance. The COR uses the QASP to conduct the oversight/surveillance process. The COR shall keep a Quality Assurance file that accurately documents the contractor’s actual performance. The purpose is to ensure that the contractor meets the performance standards contained in the contract. The COR is responsible for reporting early identification of performance problems to the CO.

The COR is required to provide an annual performance assessment to the CO which will be used in documenting past performance. The QASP is the primary tool for surveillance of the contractor’s quality program and help the COR to document contractor mailto:Saundra.Kpadeh@hhs.gov performance. The COR is not empowered to make any contractual commitments or to authorize any contractual change on the Government’s behalf.

Assigned COR: To be determined at award Organization or Agency:

Telephone:

Email:

Contractor Representatives The following employees of the contractor serve as the contractor’s Program Manager and Task Manager for this contract. (Complete this section after the contract award)

Contractor Program Manager – Contractor Task Manager –

6. Performance Requirements and Method of Surveillance

6.1. Contract Surveillance

The goal of the QASP is to ensure that contractor performance is effectively monitored and documented. The COR’s contribution is their professional, non-adversarial relationships with the CO, PM and the contractor, which enables positive, open and timely communications.

The foundation of this relationship is built upon objective, fair, and consistent COR evaluations of contractor performance against contract requirements. The COR uses the methods contained in this QASP to ensure the contractor is in compliance with contract requirements. The COR function is responsible for a wide range of surveillance requirements that effectively measure and evaluate the contractor’s performance. Additionally, this QASP is based on the premise that the contractor, not the government, is responsible for management and QC/QA actions to successfully meet the terms of the contract.

6.2. Surveillance Matrix

The Surveillance Matrix is the list of performance objectives and standards that must be performed by the contractor. This matrix details the method of surveillance and frequency the COR will use to validate and inspect these performance elements. Inspection of each element will be documented in the COR file.

Performance objectives define the desired outcomes. Performance Standards define the level of service required under the contract to successfully meet the performance objective. The inspection methodology defines how, when, and what will be assessed in measuring performance. The Government performs surveillance, using this QASP, to determine the quality of the contractor’s performance as it relates to the performance element standards. The Performance Requirement Summary (PRS) should be used to form the foundation of the COR’s inspection checklist.

6.3. Performance Rating Definitions

The performance ratings below reflect definitions at FAR 42.1503 Table 42-1. The COR will use these rating to evaluate the quality of contractor’s performance.

Performance Rating

Definition

Exceptional Performance meets contractual requirements and exceeds many to the government’s benefit. The contractual performance of the element or sub-element being evaluated was accomplished with few minor problems for which corrective actions taken by the Contractor were highly effective.

Very Good Performance

Performance meets contractual requirements and exceeds some to the Government’s benefit. The contractual performance of the element or sub-element being evaluated was accomplished with some minor problems for which corrective actions taken by the Contractor were effective.

Satisfactory Performance meets contractual requirements. The contractual performance of the element or sub-element contains some minor problems for which corrective actions taken by the contractor appear or were satisfactory.

Marginal Performance does not meet some contractual requirements. The contractual performance of the element or sub-element being evaluated reflects a serious problem for which the contractor has not yet identified corrective actions. The contractor’s proposed actions appear only marginally effective or were not fully implemented.

Unsatisfactory Performance does not meet most contractual requirements and recovery is not likely in a timely manner. The contractual performance of the element or sub-element contains a serious problem(s) for which the contractor’s corrective actions appear or were ineffective.

Note 1: Plus or minus signs may be used to indicate an improving (+) or worsening (-) trend insufficient to change the evaluation status.

Note 2: N/A (not applicable) should be used if the ratings are not going to be applied to a particular area for evaluation.

6.4. Methods of Surveillance include but are not limited to:

* 100% Inspection - This is an inspection method whereby all outputs are monitored. This method provides the best indication of contractor performance and the most documented basis for determining contract payment actions. However, it requires extensive COR resources, and therefore, is not practical for most service requirements. 100 percent inspection is preferred when the PWS requirement is so critical that nonperformance would pose a direct risk to the safety of personnel or property, or when the work occurs infrequently, and the output population is small.

* Random Sampling - When a service is performed relatively frequently, and a statistically valid sample can be selected for audit. The most appropriate method for frequently recurring tasks.

Random Sampling is a means of evaluation by observing or inspecting some part (a sample), but not all, of a population or lot of the contract requirements to assist the government with determining whether standards set forth in the contract have been met. This tool is not the Contracting Officer’s only option nor is the tool usage mandatory. When performing random sampling, use a current version of Military Standard 105E Tables/ANSI/ASQC Z1.4 to determine the sample size and the acceptance and rejection numbers.

* Periodic Sampling - This method, sometimes called "planned inspection," consists of the evaluation of tasks selected on other than a 100 percent or random basis. It may be appropriate for tasks that occur infrequently, and where 100 percent inspection is neither required nor practical. A predetermined plan for inspecting part of the work is established using subjective judgment and analysis of agency resources to decide what work to inspect and how frequently to inspect it.

* Customer Feedback – Not necessarily a valid method of surveillance, but a good indicator for areas surveillance should be conducted or intensified. The COR may design a customer survey questionnaire to be used as an essential part of a well-publicized customer complaint program.

In time of resource constraints, the use of customer surveys provides an effective and efficient means of monitoring contractor performance. Customer surveys should only supplement other surveillance efforts and be analyzed by surveillance personnel trained in validating customer complaints. Customers should be made aware of minimal contractor performance requirements to be sure that customer responses to surveys are valid indicators of actual contractor performance. The COR must investigate each customer complaint and validate the accuracy before any action is taken.

7. Performance Reporting

7.1. Corrective Action Report (CAR)

All discrepancies are reported and unresolved will be result in the COR issuing a COR (see sample CAR below).

7.2. Customer Complaint Form

All escalated complaints for FOH staff or customers will result in the COR documentation of the incident on the Customer complaint form. (See sample customer complaint form below).

7.3. Contractor Performance Assessment Report (CPAR)

(See sample customer CPAR below)

Appendix 1 - Surveillance Matrix

Statements Standards/AQLs Inspections Ratings

C.3.2 Vacant Positions – Key Personnel

The Contractor shall maintain a stable workforce. The Contractor shall have thirty (30) business days to hire and obtain FOH Security Clearance package acceptance as complete for each new key personnel staff from date of contract award and / or receipt date of a staff resignation letter/email or termination. It is unacceptable to FOH to have a greater than 30% turnover rate of key personnel annually.

a) Hire key personnel and obtain FOH security package acceptance within 30 business days of contract award.

b) Maintain key personnel for 12 months or more of continuous service on contract.

What: Staffing Vacancy Fulfillment Report (included in Monthly Progress, Status and Management Report) How: 100% review of documents Continuous observation Who: COR

Disincentive: A daily disincentive equal to 20% of the daily billable rate for each vacancy will be assessed

Standard(s): Inspection applies to all standards

C.3.3 Vacant Positions - Non-Key Personnel

The Contractor shall have thirty (30) business days to hire and obtain FOH Security Clearance package acceptance as complete for each new staff from contract award and receipt date of a staff resignation letter/email or termination. If the Contractor fails to obtain FOH Security Clearance package acceptance as complete within their

a) Hire non- key personnel and obtain FOH security package acceptance within 30 business days of contract award.

b) Maintain key personnel for 12 months or more of continuous service on contract.

What: Staffing Vacancy Fulfillment Report (included in Monthly Progress, Status and Management Report) How: 100% review of documents Continuous observation Who: COR

Disincentive: A daily disincentive equal to 10% of the daily billable rate for each vacancy will be assessed

(30) business days, then a daily disincentive equal to 10% of the daily billable rate for each vacancy will be assessed will be assessed to the Contractor, as described in the QASP, until the FOH Security Clearance package is accepted as complete.

C.5.1 FOH IT System Operations Requirements

The Contractor shall develop, document, and implement processes to coordinate and carry out the activities and processes required to deliver and manage services at agreed levels of service as directed by the Government.

The Contractor shall implement processes to ensure ongoing management and control of the day-to-day activities and technology that is used to deliver and support services (e.g., infrastructure monitoring and reporting tools, utilities). The Contractor shall also develop processes for the systematic monitoring of service delivery performance, assessing metrics, and gathering and analyzing data collected during service operations and reporting results to the Government, including the integrated project plan.

STD: Standard industry practice for systems operations and maintenance, consistent with the Project Management Body of Knowledge (PMBOK

What: System Operations Documentation How: 100% review of documents Continuous observation Customer feedback trouble reports Who: COR, FOH IT Team, HHS Information Systems Security Officer (ISSO)

Deliverable System Performance Report

C.5.2 Asset Management and Tracking

The Contractor shall perform the following asset management tracking and support services for IT hardware, software and software licenses, network, and telecommunication resources:

• Assist in the development, maintenance and improvement of inventory management protocols and procedures.

• Provide asset inventory record tracking and logistics support

• Manage and monitor all IT assets

• Support activities to audit physical inventories of IT resources

• Support excessing of IT assets

• Support contract administration efforts to continually improve the efficiency and effectiveness of IT resource management.

• Support management of all FOH software licenses used throughout the enterprise

• Support the management of the inventory of telecommunications, and network circuit

• Implement a management system to ensure that all FOH’s IT asset

a) Implement Asset Management System and document Standard Operating Procedure.

b) Ensure all FOH assets data is captured, recorded and updated monthly

AQL: Assets are recorded with 30 business days of delivery/procurement.

What: Asset Inventory Asset Disposal Record How: Records and Visual Inspection On-site periodic inspections Frequency: Quarterly, After completion of each inventory Who: COR, Property Accountability Officer /Designee, FOH IT Team data is captured, accurately recorded, and updated monthly throughout the entire asset lifecycle of all existing, and newly acquired IT and their attributes

(e.g., location, costs, depreciation, contracts, vendor, serial numbers).

• Develop and deliver asset inventory report as directed by the

COR

Asset Inventory

C.5.3 Software License Inventory

The Contractor shall establish, monitor, and manage a centralized data repository for FOH enterprise-wide use for recording and tracking information regarding software licensing and support agreements (e.g., vendor name, software name and version, number of authorized users and/or devices covered, licensing fees, commencement, and expiration date).

Deliverable Software License Inventory

a) Establish and record Software License Inventory

b) Establish and document Standard operating procedures for Software Licenses.

What: Software License Inventory How: Records and Visual Inspection On-site periodic inspections Frequency: Quarterly, after completion of each inventory Who: COR, Property Accountability Officer /Designee, FOH IT Team

C.5.5 Service Desk Support: The Contractor shall provide service desk support, record, track, and coordinate the resolution of

a) Provide initial responses for within two (2) hours of receipt for inquiries placed during operating hours.

What: Service Desk Ticket Report How: Records and Visual Inspection On-site periodic inspections issues submitted to the FOH Service Desk.

Service Desk Ticket Report

AQL:

b) 85% of all inquiries resolved within one (1) business day of the initial contact.

Frequency: Weekly/Monthly, via the Weekly Status Report and Monthly Progress, Status and Management Report Who: COR, FOH IT Team Standard(s): Inspection applies to all standards

C.5.6.1 Configuration Management:

The Contractor shall establish, implement, manage, monitor, and update a Configuration Management Database (CMDB). The Contractor shall implement, track and document Configuration Management services as approved, by the Government

Deliverables Configuration Management Database Configuration Management Plan Configuration Management Change Log

Submit a Configuration Management Plan within 30 business days of contract award.

What: Configuration Management Database, Configuration Management Plan, Configuration Management Change Log

How: Records and Visual Inspection On-site periodic inspections Frequency: Annually Who: COR, FOH IT Team

C.5.6.2 Change Management: The Contractor shall implement, track and document Change Management services as approved, by the Government.

Control Board

Change Management Plan

Submit a Change Management Plan the following within 30 business days of contract award ,

a) Change Management Plan

b) Configuration / Change Control Board (CCB) Charter

The Contractor shall establish standardized methods and procedures for the managing and

What: Change Management Plan How: Records and Visual Inspection Frequency: Annually Who: COR, FOH IT Team Standard(s): Inspection applies to all standards Frequency: Weekly/Monthly, via the Weekly Status Report and Monthly Progress, Status and Management Report documenting all IT change.

b) Establish change management plan and process to minimize the impact of change

C.5.6.3 Change / Configuration Control Board Contractor shall implement and manage a Configuration /Change

Control Board. The Contractor shall manage day-to-day activities related to

Configuration / Change Management

Deliverables

Change Control Charter Change Control Requests Log

What: Change Control Board (CCB) Charter Change Control Requests Log

How: Records and Visual Inspection On-site periodic inspections Frequency: Monthly

C.5.7 Database Services The contractor shall provide database services activities focused on the development of physical data models, database design, design of extraction, transformation and load design, data preparation design, and data interface design.

Deliverable Data Models

Data models are detailed and fully attributed (all data elements are defined); adhere to business rules or shall be defined by business rules and adhere to HHS/FOH data administration standards and align with HHS/FOH EA data models

What: Data Models

How: Records and Visual Inspection On-site periodic inspections Frequency: As requested by COR

C.5.8 Security Control Assessment (SCA) Support Services Services: The contractor shall provide SCA support

What: SCA Support Activities documented in SCA Activity Log

Services.

Deliverables SCA Activity Log

Frequency: Per HHS Policy and as requested by COR ; Weekly/Monthly, via the Weekly Status Report and Monthly Progress, Status and Management Report

C.5.9 Maintenance Services: The Contractor shall provide Maintenance Services, including activities required to maintain the system code in the production environment and covers fixes, development of limited scope enhancements, changes required by users, and modifications required because of changes in the production environment.

Change Requests Maintenance Plan

Establish maintenance processes and procedures consistent with software development best practices, industry standards, and the System Development Management Plan on file with HHS.

b) System documentation shall be updated to reflect changes due to the maintenance modification

What: Change Requests Maintenance Plan How: Records and Visual Inspection Who: COR, FOH IT Team, Information System Security Officer (ISSO)

C.5.10 Data Request Services: The contractor shall provide Data Request Services

Fulfill data request within timelines requested, as approved by the Government data request.

Create and deliver data extract with 1 business day of the

What: Data Request Tracking Log How: Records and Visual Inspection Frequency: Weekly/Monthly, via the Weekly Report and Monthly Progress, Status and Management Report

Data Request Tracking Log target completion date.

AQL

Create and deliver within 3 business days of the target completion date.

Standard(s): Inspection applies to all standards

C.5.13 Information Security Services Services: The contractor shall provide information security services including threat assessments, analysis, and remediation; Patch software, report security incidents, provide information needed for security data call and mitigate weaknesses and document remaining deficiencies ins a system

POA&M.

The contractor shall develop and implement processes to document and track cybersecurity services.

See SOW for full requirement.

Deliverables Cybersecurity Services Tracking Log

Mitigate identified weaknesses from the date of identification, within the following thresholds:

• Critical risk weakness– 15 calendar days

• High risk weakness – 30 calendar days

• Medium weakness – 90 calendar days

• Low weakness – 360 calendar days

What: Data Request Tracking Log How: Records and Visual Inspection Frequency: Weekly/Monthly, via the Weekly Report and Monthly Progress, Status Report What: Information Security Services Tracking Log How: Records and Visual Inspection Frequency: Weekly/Monthly, via the Weekly Report and Monthly Progress, Status and Management Report Who: COR, FOH IT Team, Information System Security Officer (ISSO)

C.6.2 Work Breakdown Structure (WBS) and Project Schedules The Contractor shall provide a draft WBS and of all of the project work and required project management. The Contractor shall update the WBS and

a) Provide Draft WBS within 14 business days

b) Update on ongoing basis

What: Work Breakdown Structure (WBS) included in Weekly Report and Monthly Progress, Status and Management Report Frequency: Bi-weekly or as requested by COR project schedules on an on-going basis and deliver updates to the Government

Deliverables Work Breakdown Structure

Standard(s): Inspection applies to all standards

C.6.3 Integrated Project Management Plan Contractor shall develop and deliver an integrated project management plan within 30 business days of contract award, that is based on the Contractor’s proposal solution that breaks out management items to the task order requirement. See SOW for required components.

Deliverable Integrated Project Management Plan

a) Provide Integrated Project Management Plan within 30 business days

b) Update on ongoing basis

What: Integrated Project Management Plan Frequency:

How: Records and Visual Inspection Who: COR, FOH IT Team, Standard(s): Inspection applies to all standards

C.6.5.1 Weekly Status Reports The Contractor shall provide a weekly status report that shall include major activities completed, planned activities for the following week, issues, risks, and other pertinent information. See SOW for full required components.

What: Weekly Status Reports How: Records and Visual Inspection

C.6.5.2 Monthly Progress, Status and Management Report: The Contractor shall provide a monthly progress, status, and management report. that shall include major activities completed, What: Monthly Progress, Status and Management Report How: Records and Visual Inspection planned activities for the following month, issues, risks, and other pertinent information. See SOW for required components.

C.6.6 Data and Documentation Management:

The Contractor shall develop program documentation in support of each contract task The Contractor shall establish, maintain, and administer an integrated data management capability for collection, control, publishing and delivery of all program documentation.

Deliverables Program documentation including:

Audit Reports Agendas Presentation Materials Standard Operating Procedures (SOPs)

a) Data Management standard and performance indicator/measures.

b) Provide Data Status Report, agendas, presentation materials

What: Program Documentation including: audit reports, agendas, presentation materials, standard operation procedures (SOPSs) How: Records and Visual Inspection On-site periodic inspections Who: COR, FOH IT Team, Information System Security Officer (ISSO)

C.6.8 Meeting Minutes:

The Contractor shall document and distribute meeting minutes Deliverable Meeting Minutes

a) Provide meeting minutes withing 48 hours of the meeting completion.

AQL

Provide meeting minutes within 5 business days of the meeting completion.

What: Meeting Minutes How: Records and Visual Inspection On-site periodic inspections Frequency: Monthly

CORRECTIVE ACTION REPORT (CAR)

(If more space is needed, use reverse and identify by number)

1. CONTRACTOR

2. CONTRACT NUMBER

3. TYPE OF SERVICES

4. FUNCTIONAL AREA

5. SUSPENSE DATE

6. CONTROL NUMBER

7. DEFICIENCY MAJOR MINOR

FINDING:

FINDING IMPACT:

Please respond with a written corrective action plan that details the corrective action of the cited deficiency, the cause of the deficiency, and actions taken to prevent recurrence by Suspense Date in Block 5. If date was not entered in Block 5, the contractor is not required to provide a response.

8. QUALITY ASSURANCE PERSONNEL (COR)

TYPED NAME AND GRADE

SIGNATURE AND DATE

9. ISSUING AUTHORITY

TYPED NAME AND GRADE

SIGNATURE AND DATE

10. COR RESPONSE TO CONTRACTOR CORRECTIVE ACTION AND ACTION TAKEN TO PREVENT RECURRENCE

11. COR DETERMINATION

ACCEPTED REJECTED

12. CLOSE DATE

CUSTOMER COMPLAINT RECORD

DATE/TIME OF COMPLAINT

SOURCE OF COMPLAINT

ORGANIZATION

BUILDING NUMBER

INDIVIDUAL

PHONE NUMBER

NATURE OF COMPLAINT

CONTRACT REFERENCE

VALIDATION

DATE/TIME CONTRACTOR INFORMED OF COMPLAINT

ACTION TAKEN BY CONTRACTOR

RECEIVED/VALIDATED BY

PERFORMANCE ASSESSMENT REPORT (PAR)

(If more space is needed, use reverse and identify by number)

1. CONTRACT/TASK ORDER NUMBER 2. CONTRACTOR 3. TYPE OF SERVICES

4. QUALITY ASSURANCE PERSONNEL (COR) SIGNATURE AND DATE

5. COR PHONE 6. SUSPENSE DATE

I. PERFORMANCE

7. DEFICIENCY (CHECK ALL BOXES THAT APPLY)

NEW

REPEAT

NO DEFICIENCY NOTED

8. SERVICES SUMMARY or PWS PARAGRAPH ITEM REVIEWED

9. BRIEF DESCRIPTION OF DEFICIENCY (IF DEFICIENCY BOX WAS

CHECKED)

10. DETAILED PERFORMANCE ASSESSMENT

II. CONTRACTOR VALIDATION

11. CONTRACTOR REPRESENTATIVE CONCUR NON-CONCUR

12. CORRECTIVE ACTION ESTIMATED COMPLETION DATE

13. CONTRACTOR REPRESENTATIVE CORRECTIVE ACTION AND PREVENTION OF RECURRENCE OR REASON FOR NON-

CONCURRENCE OF COR CITED DEFICIENCY

III. ACTION CORRECTED

14. CONCUR NON-CONCUR COR SIGNATURE AND DATE

15. COR REMARKS (REQUIRED)

6. CONTRACTOR REPRESENTATIVE REMARKS