Draft_WFL_TO_QASP.pdf

DRAFT

QUALITY ASSURANCE SURVEILLANCE PLAN

FOR

WESTERN FEDERAL LANDS HIGHWAY

DIVISION

INFORMATION TECHNOLOGY SUPPORT

SERVICES

Date

QUALITY ASSURANCE SURVEILLANCE PLAN

FOR

INFORMATION TECHNOLOGY (IT) SUPPORT SERVICES

INTRODUCTION

This Quality Assurance Surveillance Plan (QASP) has been developed to evaluate contractor actions while implementing the IT Support Services contract at Western Federal Lands Highway Division (WFLHD). It is designed to provide an effective surveillance method of monitoring contractor performance for each listed objective on the Service Delivery Summary (SDS) in the contract.

The QASP provides a systematic method to evaluate the services the contractor is required to furnish.

This QASP is based on the premise the government desires to maintain a quality standard in the operation of the Information Technology Service Desk, maintaining Information Technology services to the office, and repairing IT equipment, and that a service contract to provide the service is the best means of achieving that objective.

The contractor, and not the government, is responsible for management and quality control actions to meet the terms of the contract. The role of the government is quality assurance to ensure contract standards are achieved.

In this contract the quality control program is the driver for product quality. The contractor is required to develop a comprehensive program of inspections and monitoring actions. The first major step to ensuring a “self-correcting” contract is to ensure that the quality control program approved at the beginning of the contract provides the measures needed to lead the contractor to success.

Once the quality control program is approved, careful application of the process and standards presented in the remainder of this document will ensure a robust quality assurance program.

QUALITY ASSURANCE SURVEILLANCE PLAN

FOR

INFORMATION TECHNOLOGY SUPPORT SERVICES

Performance Objective PWS Para Performance Threshold WAN/LAN Services.

LAN/WAN is operating 99% of normal work schedule hours. All computer stations are connected to the WAN/LAN. Users can access the WAN/LAN from remote locations. All users have access to their applicable network drives. All data is sufficiently protected from system failure or disaster.

2.2. No more than __5_ customer

complaints monthly.

WFL Internet/Intranet Development Services.

The web pages are maintained and updated as specified. Requests for routine changes and updates to web pages shall be completed within 2 business days. The web pages adequately support customer communications. Web pages will be maintained with 100% accuracy. All users have access to the Internet/Intranet. [DEH1] The system is adequately protected against infiltration or unauthorized access.

2.7 No more than __5__ customer

complaints monthly.

Software Applications.

All computers have the latest approved version of software installed. Software configuration follows standard procedures and configuration requirements are strictly adhered to. Software installations and updates will have no or minimal disruption to business operations.

2.3 2.4 2.5

No more than __5__ customer complaints monthly.

User Support.

All users have adequate access to the Service Desk in order to effectively report problems, request information, and receive assistance in using computer equipment, and related systems.

2.3 2.4 2.5

No more than __5_ customer complaints monthly.

Inventory Management.

All computer systems, accessories, and peripherals are accounted for. Computer equipment is not relocated, removed, or replaced without appropriate authorizations.

2.4

No more than __3_ customer complaints monthly.

PC Troubleshooting and Repair.

All desktop and notebook computers function properly using approved software and standard configurations.

2.3 2.4 2.5

No more than __3_ customer complaints monthly.

Document Production Printers, plotters, copiers, scanners and facsimile machines work properly, consumables are replenished in a timely manner, and maintenance is performed to minimize device failure. Repairs are initiated as needed to insure efficient operation.

2.3 2.4 2.5

No more than __5_ customer complaints monthly.

Telecommunications Telephone handsets, call features, and voicemail function correctly. The phone system is adequately protected against infiltration or unauthorized access. PBX data is sufficiently protected from system failure or disaster.

2.6 No more than _3__ customer

complaints monthly.

CAD Support CADD systems (hardware and software) operate efficiently, with minimal errors.

Customized applications, uniform configurations, and automated tools and routines are used to improve the WFLHD CAD environment.

2.3 No more than _3__ customer

complaints monthly.

Application Development Application change requests are documented in writing.

2.8 2.10

No more than _3_ customer complaints monthly.

SURVEILLANCE: The government Quality Assurance Personnel (QAP) will receive complaints from WFLHD personnel and pass them to the contractor's representative for correction.

STANDARD: Customer complaints shall not exceed the thresholds cited above for each performance objective. The COTR shall initiate a Contract Discrepancy Report and notify the contracting officer for appropriate action in accordance with FAR 52.212.4, Contract Terms and Conditions-Commercial Items or the appropriate Inspection of Services clause, if any of the above performance objectives exceed the customer complaint thresholds.

PROCEDURES: Any WFLHD employee that observes unacceptable services, either incomplete or not performed, for any of the above performance objectives should immediately contact QAP who will complete appropriate documentation to record the complaint. The QAP will consider the customer complaint valid upon receipt from the customer. The QAP should inform the customer of the approximate time the unacceptable performance will be corrected and advise the customer to contact the QAP if not corrected. The QAP will consider customer complaints as resolved unless notified otherwise by the customer. The QAP shall verbally notify the Contractor’s Quality Control Representative (QCR) to pick up the written customer complaint. The QCR will be given two hours after verbal notification to correct the unacceptable performance. If the QCR disagrees with the complaint after investigation and challenges the validity of the complaint, the QCR will notify the QAP. The QAP will conduct an investigation to determine the validity of the complaint. If the QAP determines the complaint as invalid, he/she will document the written complaint of the findings and notify the customer. The QAP will retain the annotated copy of the written complaint for his/her files. If after investigation the QAP determines the complaint as valid, the QAP will inform the QCR and the QCR will be given an additional hour to correct the customer complaint. A customer complaint will not be recorded if proper and timely correction of the unacceptable condition(s) is accomplished. The QCR shall return the written customer complaint document, properly completed with actions taken, to the QAP, who will file the complaint for monitoring future recurring performance. Recurring customer complaints are not permitted for any of the above service items. If a repeat customer complaint is received indicating the same deficiency during the service period (month, quarter, etc.), the QAP should contact the Contracting Officer’s Technical Representative (COTR) for appropriate action.

PERFORMANCE REQUIREMENTS SUMMARY

The following performance requirements will be used to measure the performance of the contractor. These measures are applicable to the four functional areas of the Performance Work Statement (PWS) that include: IT Operations Support, and Cyber Security. These measurements will also apply to all contractual provisions identified in the resulting Contract. WFLHD Quality Assurance Personnel (QAP) and the WFLHD Contracting Officer’s Technical Representative (COTR) will monitor contractor performance as stipulated in the Contract under the performance based task assignments. The contractor shall be required to comply with all terms and provisions of the Contract, including the PWS and any Technical Exhibits (TEs). All detailed metrics, standards, and surveillance methods are task order specific and will be included in each issued task order.

IT OPERATIONS SUPPORT

The following tables outline specific contractor responsibilities for performance metrics, performance standards, and surveillance methods pertaining to IT Operations Support for WFLHD including sensitive, classified, and unclassified information systems. Furthermore, this portion of the PRS describes the standards by which the contractor shall meet the task assignments. Tasks include, but are not limited to: IT facilities management and IT physical security; telecommunications/network engineering services; network administration; network configuration, installation, maintenance, repair, and upgrades; firewall management and maintenance; server platform administration; server installation, maintenance, repair, and upgrades; system back-ups and restores; applications system administration; emergency preparedness; inventory control; maintenance, support, and service agreement management;

audio, video, and web conferencing; user support/help desk; workstation management; wireless services; and voice and data services.

Tier 1 - Service Desk, General Operation

PWS

Section Performance Metric Performance Standard Surveillance Method

2.5 Staffed Support (Availability)1 2 deep coverage, 11 hours a day, 5 days a week.

2.5 First Contact Resolution Rate2 No less than 30% of monthly service requests

2.2 2.3 2.4 2.5 2.6

Incident reporting

100% of incidents entered in service logs

2.4 2.5 2.6

Incident Management3 A minimum of 70% of total monthly service requests are resolved in 20 minutes or less.

No more than 20% of total monthly service requests resolved in 20 minutes to 60 minutes

No more than 8% of total monthly service requests resolved in 60 minutes to 240 minutes

No more than 2% total monthly service requests exceeding 240 minutes to resolve.

No more than 1% of total monthly service requests resolved in 0 minutes.

Monthly Review of Reports and

Random Observation

2.4 2.5 2.6

Response Times See Tier 2 Table

Note 1: Applies to service desk as a whole, i.e., Tier 1 and Tier 2 combined, may also be accomplished by incorporating Tier 3 support.

Note 2: First Contact resolution rate applies to all issues that can be resolved via phone/remote tools/e-mail/web.

Note3: Completion of service requests within established periods. Resolution time is based on expended effort, (i.e., actual time expended on resolving service request).

Tier 2 Service Desk Response Times

Performance Standard PWS

Section Performance Metric1 Response Time2 Elapsed Resolution

Time3 Surveillance Method

2.4 2.5 2.6

Critical -Complete loss of service -Multiple customer service failure -Virus contamination -Media contamination

<5 minutes from incident ≤2 hours

2.4 2.5 2.6

High -Service loss for multiple/single customer (deadlines in jeopardy)

≤10 minutes ≤4 hours

2.4 2.5 2.6

Medium -Single user unable to accomplish a task with no “work around”

≤30 minutes ≤4 hours

2.4 2.5 2.6

Low -Single user unable to use their

IT

services without a “work around” -User request for information or asks a how-to question without immediacy -Software or hardware training/inquiry

Respond to or schedule appointment ≤1 hour

≤4 days

Customer Feedback and Random Observations

Note 1: Performance Metric means the generic descriptions within the critical, high, medium, and low lists are examples only and should not be considered all-inclusive. The contractor shall make the first assessment of criticality based on the criteria provided by the

COTR.

Note 2: Response Time means customer has consultation with support staff. In some cases, the resolution may require further research and/or additional resources/coordination with other providers. The contractor shall make at least two attempts within the allotted response time leaving a voice message each time they are unsuccessful. If there is no response from the customer in the allotted time frame, the priority will be lowered one level.

Note 3: Elapsed Resolution Time, (the length of time a service request is “open”) is dependent upon the nature and severity of the ticket. The standard will be achieved for 90% of incidents. All tickets will be handled by a consultation from Tier 1 support to determine the appropriate steps to resolve the ticket. In some cases, the resolution may require further research and/or additional resources, coordination and/or support of external vendors or support groups. All measured times are business minutes, hours, days and weeks per a 6:00 am – 5:00 pm workday or as otherwise required by the COTR. These metrics exclude organizationally unique or unsupported legacy applications (e.g., customer developed applications).

Tier 3 - Network Services & CAD Support

PWS

Section Performance Metric(ibid) Performance Standard Surveillance Method

2.2 Network Availability1 99% 5x11

2.2 Internet Access Availability1 99% 5x11

2.2 Email Service Availability1 99% 5x11

2.2 All Media Backed Up

per Disaster Recovery Plan 95% of backups are completed successfully

2.2 Significant/Non-maintenance

O/S and Software Patches Tested and Applied

Within 5 days of notification from COTR unless otherwise agreed upon by the COTR

2.2 Disk Storage Capacity Maintain 15% available free space of total storage capacity daily

2.2 Restoration time for All

Server Related Outages ≤4 hours to restore service

Periodic Review of Reports and Customer

Feedback

2.2 Account Administration

-Email, network, account privileges, and COTS/GOTS applications -Password Reset/Account Unlock

≤4 hours from receipt of request for administrative change

Periodic Review of Reports and Customer

Feedback

2.3 CAD Plotting Availability

99% 5x11

Periodic Review of Reports and Customer

Feedback

2.3 CAD Data Availability

99% 5x11 Periodic Review of

Reports and Customer Feedback

2.2 2.3

Infrastructure Change Management

100 % of infrastructure changes are approved in advance with appropriate risk analysis.

Periodic Review of Reports and Customer

Feedback

Note 1: Excluding scheduled maintenance.

Other IT Support Operations

PWS

Section Performance Metric(ibid) Performance Standard Surveillance Method

???? Emergency Preparedness -Continuity of Operations -Disaster Recovery Planning

Final COOP and Disaster Recovery Plans are100% Executable, Timely, and Comprehensive which will be weighted on a percentage basis as directed by the COTR

2.6 Voice Services

-Service Availability ≥99% 24x7

2.2 2.6

Audio, Video, & Web Conferencing -Service Availability

≥95% during business hours or as scheduled

???? Inventory/Asset Management;

Maintenance and Deletion of Records for:

-contractor Supported Systems -Government Furnished Equipment -Licenses & Agreements

99.8% Accuracy

2.4 2.5

Installations -New systems, applications & technology refresh

≤5 business days to complete after notification by the COTR unless otherwise agreed upon by the COTR 2.4 2.5 2.6

Moves/Adds/Changes -Disconnects, reconnects, moves, new software, telephone, and manual software changes

≤3 days to complete after notification by the COTR

Periodic Review of Reports and Customer

Feedback

Cyber Security

The following table outlines specific contractor responsibilities for performance metrics, performance standards, and surveillance methods pertaining to Cyber Security. Furthermore, this portion of the PRS describes the standards by which the contractor shall meet the task assignments. Tasks include, but are not limited to, cyber resource protection, cyber security planning, and cyber risk management.

PWS Section Performance Metric(ibid) Performance Standard Surveillance Method

2.2 Network Security Systems 99.9% Logs of all intrusion

attempts (e.g. hacking) 100% Successful Intervention

2.2 2.5

Malicious Code Identification and Prevention (e.g., virus, Trojan horses)

>99% Servers >95% All Other Devices

???? Critical/Non-maintenance Security Related Patches Tested and Applied

Within 5 day of notification or as directed by the COTR

All??? Ability to Report Current Configuration and Vulnerabilities of contractor Supported Systems

≤8 hours

All??? Incident Responses1 -Response Time -Notify COTR of incident

≤1 hour2

2.2 Access Administration

-Detect, Disconnect and Terminate access rights for unauthorized users

99.9% of all contractor supported accounts within 24 hours

??? Compliance with Applicable Security Regulations (Per section 3.4 of PWS and contractor Security Plan)

100% Compliance

Periodic Review of Reports, Customer Feedback and

100% Inspections

Note 1: From log of incident.

Note 2: The one-hour standard represents a time limit to respond to the incident(s) and notify the COTR.

IT Property Management

The following table outlines specific contractor responsibilities for performance metrics, performance standards, and surveillance methods pertaining to IT Property Management.

Furthermore, this portion of the PRS describes the standards by which the contractor shall meet the task assignments. Tasks include, but are not limited to the issue, receipt and inspection of computer hardware, software, and other information technology devices.

PWS Section Performance Metric(ibid) Performance Standard Surveillance Method

2.4 Equipment moves between

employees located in Vancouver WA.

(a) Completed FHWA 1363 submitted & processed prior to relocation of equipment.

(b) Physical relocation accomplished within 3 business days of submission of FHW A1363.

2.4 Preparing equipment for

shipment to field offices

(a) Assures all shipments are addressed correctly

(b) Assures packaging appropriately protects equipment from damage.

2.4 Returning equipment to Depot (a) Useable returned

equipment is stored in the IT Equipment Cage for reissue or;

(b) Unusable equipment is stored for evaluation.

2.4 Evaluate returned equipment

for serviceability

Returned equipment will be accumulated until there is a lot of 10 units. At which time the “lot” will be evaluated and either repair will be made and equipment will be transferred to the IT Equipment Cage, or equipment will be reclassified and readied for disposal.

Evaluation time period allotted will be 5 days.

2.4 Maintenance of storage areas Maintains clean, hazard free, and organized work and storage areas.

Periodic Review of Reports, Customer Feedback and

100% Inspections

Contract Discrepancy Report

1. CONTRACT NUMBER DISCREPANCY REPORT NUMBER:

2. TO: (SERVICE PROVIDER & MANAGER'S NAME)

3. FROM: (NAME OF COTR)

4. DATES

4a. PREPARED:______________________________

4b. ORAL NOTIFICATION:________________________________

4c. RETURNED BY SERVICE PROVIDER:___________________________

4d. ACTION COMPLETE:__________________________________________

5. DISCREPANCY OR PROBLEM (DESCRIBE IN DETAIL. INCLUDE PWS REFERENCES.

ATTACH CONTINUATION SHEET IF NECESSARY):

6. SIGNATURE OF QAP:

7. TO: (CONTRACTING OFFICER) FROM (SERVICE PROVIDER)

8. SERVICE PROVIDER RESPONSE AS TO CAUSE, CORRECTIVE ACTION AND ACTIONS TO

PREVENT RECURRENCE (ATTACH CONTINUATION SHEET IF NECESSARY. CITE

APPLICABLE QC PROGRAM PROCEDURES OR NEW QC PROCEDURES):

9. SIGNATURE OF SERVICE PROVIDER REPRESENTATIVE: DATE:

10. GOVERNMENT EVALUATION (ACCEPTANCE, PARTIAL ACCEPTANCE, REJECTION.

ATTACH CONTINUATION SHEET IF NECESSARY):

11. GOVERNMENT ACTIONS (SERVICE PROVIDER DEFICIENCY REPORT, CURE NOTICE,

SHOW CAUSE, OTHER):

CLOSE OUT

NAME: DATE

Contracting Officer

SERVICE PROVIDER NOTIFIED:

Date CO Initials

QAP:

Date CO Initials

COTR:

Date CO Initials

Customer Feedback Record

Date/Time of Incident or Complaint:

Source of Incident or Complaint:

Organization:

Individual:

Nature of Incident or Complaint:

Contract Reference:

QAP:

Validation:

Date/Time contractor Informed Incident or Complaint:

Action Taken by contractor:

Received/Action Validated:

Determination: Complaint Valid Complaint Invalid