B08_SOL_Attachment_4_-_Quality_Assurance_Surveillance_Plan.pdf

Quality Assurance Surveillance Plan (QASP)

Managed Optical Network Backbone Service

1. Purpose

This Quality Assurance Surveillance Plan (QASP) describes the Government's approach for monitoring Contractor performance of the Managed Optical Network Backbone Service.

The purpose of surveillance is to assess whether the Contractor is meeting the performance requirements and service outcomes established in the Performance Work Statement (PWS). Government surveillance will focus on critical aspects of performance affecting network operations, availability, resilience, and security.

The QASP does not relieve the Contractor of responsibility for managing, controlling, and ensuring the quality of its own performance.

2. Roles and Responsibilities

The Contracting Officer (CO) retains authority for administration of the contract and contractual remedies.

The Contracting Officer's Representative (COR), will monitor Contractor performance within the scope of delegated authority, document performance concerns, review performance information, and coordinate identified issues with the CO.

NCI technical and security personnel may provide technical input to the COR and CO regarding network operations, security, testing, incidents, and other areas within their assigned responsibilities.

The Contractor remains responsible for performing and managing the services required by the PWS and for identifying and correcting deficiencies in its performance.

3. Surveillance Approach

Government surveillance will focus on the Contractor's achievement of required service outcomes rather than day-to-day direction of Contractor personnel or methods of performance.

Surveillance may include review of operational information, incident records, network performance information, security information, test results, Contractor reports, and other information generated during contract performance.

The Government may increase surveillance when recurring deficiencies, significant incidents, security concerns, or other performance risks warrant additional monitoring.

4. Performance Surveillance

Performance Area Performance Standard Surveillance Method Frequency

Network Operations & Incident Response

Provide continuous 24×7×365 network monitoring and operations. Respond to Priority 1 incidents within 15 minutes and restore service or implement an approved workaround.

Review incident/ticket records, response timestamps, root cause analysis (RCA reports), and applicable operations reporting.

Monthly and following significant incidents

Network Capacity, Resilience & Connectivity

Maintain required 10/40/100 Gbps backbone connectivity, capacity, path diversity, cloud interconnect redundancy, and capacity necessary to support NCI mission operations.

Review network performance/capacity information and results of applicable network changes, validation testing, and failover exercises.

Monthly;

additional review following significant changes or testing

Security & Compliance

Operate and optimize Amazon Web Services (AWS) Direct Connect via two diverse Northern Virginia sites;

deploy/manage GCP Interconnect links from Rockville/Shady Grove and Frederick/ATRF to Northern Virginia.

All interconnect traffic and backbone links shall enforce end-to-end encryption with FIPS-validated ciphers; RMF artifacts and continuous monitoring will be maintained per NIH/NIST policies

Review applicable security information and coordinate technical assessment with the ISSO or other designated security personnel.

Ongoing, with periodic review based on applicable security requirements

Domestic Service Delivery & Data Protection

Required service delivery, personnel, remote-access endpoints, and Government data handling remain within the United States unless otherwise authorized in writing by the

CO.

Review relevant Contractor-provided staffing/location information, access information, and other records when necessary to verify compliance.

At contract start, when material changes occur, and when otherwise warranted

5. Performance Documentation

The COR will maintain appropriate records of surveillance activities and significant Contractor performance issues in accordance with applicable contract administration procedures.

When a potential performance deficiency is identified, the Government will evaluate the circumstances and determine whether additional information, corrective action, or referral to the CO is appropriate.

Surveillance records may include Contractor reports, Government observations, incident reports, technical findings, correspondence, meeting records, and other information relevant to Contractor performance.

Evaluation Methods

The COR will conduct performance evaluations based upon the required performance levels set forth in the QASP and PWS.

Process of Quality Assurance Assessment

NCI will provide performance feedback. As soon as a discrepancy is identified with a deliverable associated with this contract, the COR and/or CO will notify the Contractor. A determination of the Contractor's performance will be executed every six months.

Performance Meetings

The Contractor Project Manager, NCI Program Manager, COR and CO will meet to discuss contract performance, resolve issues, discuss customer complaints, and provide positive interaction and feedback to all parties. The COR will provide a list of any unresolved deficiencies to the contractor's quality assurance representative to afford him/her the opportunity to show where the problem is already in the process of being worked. If evidence is shown where the contractor's quality program has already documented the deficiency and timely corrective action is working the problem, the COR will follow up with the contractor's quality control representative to ensure the deficiencies are remedied in a timely manner, in accordance with the PWS. All deficiencies associated with performance requirements listed in the Performance Requirements Summary, whether remedied by the contractor or not, will be included in the QASP Report regardless of who identified the deficiency. The contractor's Project Manager will provide a copy of the meeting minutes to all attendees within 5 workdays of the meeting.

6. Performance Deficiencies

When surveillance identifies performance that does not meet contractual requirements, the COR will document the observed condition and coordinate with the CO as appropriate.

The Contractor may be requested to identify the cause of the deficiency, describe corrective actions, and take appropriate action to prevent recurrence, consistent with the requirements and terms of the contract.

Only the Contracting Officer may exercise contractual authority or determine the applicability of contractual remedies.

7. QASP Maintenance

This QASP may be updated during the period of performance when changes to the PWS, performance risks, surveillance needs, or other contract administration considerations warrant revision.

Changes to the QASP will not alter the Contractor's contractual requirements or impose requirements that are not established by the contract.

8.0 Attachments

1 – Six-Month Assurance Monitoring Report

Attachment 1 - Six-Month Quality Assurance Monitoring Report

Survey Period: ______________________________________

COR: ____________________________________

Contractor: ____________________________________

CLIN/contract: ____________________________________

Performance Requirement: _________________________________________

The contractor has met all the requirements of the contract. These are summarized in this report and are supported by the COR periodic surveillance checklists and/or reports and customer feedback attached to this form.

Summary of discrepancies:

Actions taken to remedy discrepancies:

Other comments: