Attachment_4_-_Quality_Assurance_Surveillance_Plan_(QASP).pdf

QUALITY ASSURANCE SURVEILLANCE PLAN

For: Naval Special Warfare Command Contract Number: H92240-19-P-XXXX Contract Description: Web Hosting and Social Media Security Services Contractor’s name: TBD

1.0 PURPOSE.

1.1. This Quality Assurance Surveillance Plan (QASP) provides a systematic method to evaluate performance for the stated contract. This plan provides a basis for the Government to evaluate the quality of contractor performance. The oversight provided for in the contract and in this plan will ensure service levels reach and maintain the required levels throughout the contract term.

This plan will provide the Government with a proactive way to avoid unacceptable or deficient performance, and provide verifiable input for required annual past performance evaluations.

This QASP explains the following:

1.1.1. What will be monitored.

1.1.2. How monitoring will take place.

1.1.3. Who will conduct the monitoring.

1.1.4. How monitoring efforts and results will be documented.

1.2 This QASP does not detail how the contractor accomplishes the work. Rather, the QASP is created with the premise that the contractor is responsible for management and quality control actions to meet the terms of the contract. It is the Government’s responsibility to be objective, fair, and consistent in evaluating performance. In addition, the QASP should recognize that unforeseen and uncontrollable situations may occur.

1.3 This QASP is a “living document” and the Government may review and revise it on a regular basis. However, the Government will coordinate changes with the contractor. Updates will ensure that the QASP remains a valid, useful, and enforceable document. Copies of the original QASP and revisions will be retained the contract file.

2.0 GOVERNMENT ROLES AND RESPONSIBILITIES.

2.1 The following personnel will oversee and coordinate surveillance activities.

2.1.1 Contracting Officer (KO) - The KO will ensure performance of all necessary actions for effective contracting, ensure compliance with the contract terms, and will safeguard the interests of the United States in the contractual relationship. The KO will also assure that the contractor receives impartial, fair, and equitable treatment under this contract. The KO is ultimately responsible for the final determination of the adequacy of the contractor’s performance.

Assigned KO: WARCOM-Contracts

2.1.2 Contracting Officer Representative (COR) –The COR is responsible for the technical oversight of the contract, assuring proper Government surveillance of the contractor’s performance and keeping a quality assurance file. At the conclusion of the contract or when requested by the KO, the COR will provide documentation to the KO. The COR is not empowered to make any contractual commitments or to authorize any contractual changes on the Government’s behalf. The contractor shall refer any changes they deem may affect contract price, terms, or conditions to the KO for action.

Assigned COR: TBD

3.0 CONTRACTOR REPRESENTATIVES:

3.1 Contractor shall appoint an employee to serve as the primary point of contact responsible for coordinating issues relating to quality assurance and surveillance issues.

Program Manager – XXXXXXXX (Enter PM Name if applicable)

Other Contractor Personnel – XXXXXXXX (Enter Other Key Personnel Name if applicable)

4.0 PERFORMANCE REQUIREMENTS SUMMARY (PRS).

4.1 Performance standards define desired services. The Government performs surveillance to determine if the contractor exceeds, meets, or does not meet these standards.

4.2 The Performance Requirements Summary Matrix includes performance standards outlined in the Performance Work Statement. The Government shall use these standards to determine contractor performance and shall compare contractor performance to the Acceptable Quality Level (AQL):

Performance Objective

ID PWS

Reference

Performance Standard (and AQL)

Method of Performance Assessment

Incentive (Positive and/or Negative) (Impact on Contractor Payments)

24/7/365 database support & programming updates

4.1 Immediate phone

or E-mail response with Client within 24 hours

Direct Observation

Failure to respond to Client or complete updates within 24 hours shall result in a negative rating and possible withholding or reduction in payment

Website/Forum Intrusion Prevention/PII protection/General

4.4.2 8.1

Industry standard protection:

Quarantine and elimination of

Periodic Inspection

Intrusions, PII breaches, site defacement or other malicious acts successfully executed shall be evaluated

Security Intrusions; Zero breaches of PII, detailed reports as either preventable or unpreventable. Preventable acts due to Contractor negligence in maintaining updated security protocols or software shall result in a negative rating and possible withholding or reduction in payment

Website/Forum & Web Application Firewall technical support

4.4.3 Immediate phone

or E-mail response with Client within 24 hours

Direct Observation

Intrusions, PII breaches, site defacement or other malicious acts successfully executed shall be evaluated as either preventable or unpreventable. Preventable acts due to Contractor negligence in maintaining updated security protocols or software shall result in a negative reduction in payment

Bandwidth service for website

4.2 Commensurate

with site visitor demand, at least 50 mbps

Periodic Sampling

Failure to meet this standard shall result in a negative rating

Website and web server threat assessment and vulnerability test

5.0 Industry standard

protection, quarterly

Periodic Inspection

Failure to meet this standard shall result in a negative rating

4.3 The Government reserves the right to use a reduction in payments as a negative incentive.

4.4 Various methods exist to monitor performance. The COR shall use the surveillance methods listed below in the administration of this QASP.

4.4.1. DIRECT OBSERVATION. (May be performed periodically or through 100% surveillance).

4.4.2. PERIODIC INSPECTION. (Evaluates outcomes on a periodic basis.) Inspections may be scheduled [Daily, Weekly, Monthly, Quarterly, or annually] or unscheduled, as required.

4.4.3. PERIODIC SAMPLING. (Variation of random sampling. However, sample is only taken when a problem/deficiency is suspected. Sample results are applicable only for the specific work inspected. Since sample is not entirely random, it cannot be applied to total activity performance.

5.0 CONTRACT DELIVERABLES.

5.1 The Contractor shall provide all of the following documents during the course of the contract at the frequency noted in the table below:

Deliverable Number

PWS

Para.

Item Description Due Date Government POC(s)

D001 4.4.1 Website and web server threat assessment and vulnerability Test Report

Submit quarterly written report within 1 week of assessment completion

COR

D002 4.4.2 Incident Response Submit written report within 12 hours of detected incident

COR

D003 8.2 Report of PII Breach Report by phone or E-mail immediately upon discovery

COR

6.0 DOCUMENTING PERFORMANCE.

6.1. Acceptable Performance. The Government will document positive performance. Any report may become a part of the supporting documentation for determining present or future contractual actions.

6.2 Unacceptable Performance. When unacceptable performance occurs, the COR will inform the contractor. This will normally be in writing unless circumstances necessitate verbal communication. In any case the COR will document the discussion and place it in the COR file.

6.2.1. When the COR determines formal written communication is required, the COR will prepare a Contract Discrepancy Report (CDR), and present it to the contractor's manager or on-site representative. A CDR template is attached to this QASP.

6.2.2. The contractor shall be required to acknowledge receipt of the CDR in writing. The CDR will specify if the contractor is required to prepare a corrective action plan to document how the contractor shall correct the unacceptable performance and avoid a recurrence. The CDR will also state how long after receipt the contractor has to present this corrective action plan to the COR. The Government will review the contractor's corrective action plan to determine acceptability.

6.2.3 Any CDR will become a part of the supporting documentation for contract payment deductions, fixed fee deductions, award fee nonpayment when applicable. The Government will use any completed CDR as part of an overall evaluation of Contractor performance when determining present or future contractual actions.

7.0 FREQUENCY OF MEASUREMENT.

7.1. During contract/order performance, the COR will take periodic measurements and analyze whether the negotiated frequency of measurement is appropriate for the work being performed.

7.2. The COR will interact with the contractor at least monthly and meet annually to assess performance and will provide a written assessment.

Signature – Contractor Program Manager

Signature – Contracting Officer Representative

Signature – Contracting Officer

CONTRACT DISCREPANCY REPORT (CDR)

1. Contract Number: H92240-19-P-XXXX

2. TO: (Contractor’s Manager or on-site representative) <insert name>

3. FROM: TBD

4. Date and time observed discrepancy:

5. DISCREPANCY OR PROBLEM:

<Describe in detail. Identify any attachments.>

5. Corrective action plan:

A written Corrective action plan < is / is not > required.

< If a written Corrective action plan is required include the following. > The written Corrective Action Plan will be provided to the undersigned not later than < # days after receipt of this

CDR. >

Prepared by: <Enter COR’s name>

Signature – Contracting Officer’s Representative Date

Received by:

Signature – Contractor’s Manager or on-site representative Date