Atch 8 - GSM-O Task Order-3.pdf

HC1028-10-R-2000

Attachment 08 i

GIG Services Management (GSM) – Operations (GSM-O) Task Order #GSM-O-03

GSM-O Net Assurance Support

Based on GSM-O PWS

Contract Number: (completed by the KO at time of TO award)

Task Order Number: (completed by the KO at time of TO award)

GSM-O Tracking Number: TO #GSM-O-03

Contents of this Task Order:

1 Task Monitors ………………………………………………………..……… 1 2 Task Order Title ………………………………………………..…………… 1 3 Background ………………………………………………………….……… 1 4 Objectives ……………………………………………………….………….. 2 5 Scope …………………………….……………………………….…..…….. 2 6 Performance Requirements ……………………………….……………… 2 7 Performance Standards ……………………………………….………….. 3 8 Incentives …………………………………………………………………… 3 9 Place of Performance ……………………………………………………… 4 10 Period of Performance …………………………………………..………… 4 11 Delivery Schedule ………………………………………………..………… 4 12 Security ……………………………………………………………………… 5 13 Government-Furnished Equipment (GFE)/Government-Furnished

Information (GFI) …………………………………………………………… 5 14 Other Pertinent Information or Special Considerations ……………….. 5 15 Section 508 Accessibility Standards ……………………………………… 5

Appendix A – Definitions …………………………………………………………… A-1 Appendix B – Net Assurance Location Data ………………… …………….… B-1 Appendix C – Government Furnished Equipment/Capabilities ……………...… C-1 Appendix D – Government Furnished Information (GFI) …………….………… D-1 Appendix E – Functional Requirements …………………………………….…… E-1 Appendix F – [Not Used this Task Order] ……………………………………….. F-1 Appendix G – Contract Data Requirements List (CDRLs) Items ………..…..… G-1 Appendix H – List of Data Capture Reports and Data Extracts ….……….....… H-1 Appendix I – Draft QASP for this TO ……………….……………………….....… I-1 Appendix J – DD Form 1423 (CDRL) Set for this TO …………………….....… J-1

1. Task Monitors (TMs).

a. Primary TM.

Name: TBD

Organization: TBD

Department of Defense Activity Address Code (DODAAC):

TBD

Address:

Phone Number: TBD

Fax Number: TBD

E-Mail Address: TBD

b. Alternate TM.

Name: TBD Organization: TBD

DODAAC: TBD

Address: TBD Phone Number: TBD Fax Number: TBD E-Mail Address: TBD

2. Task Order Title.

GSM-O Net Assurance Support

3. Background.

a. DISA provides networking support to its national security customers via GIG/DISN capabilities which are deployed and operated worldwide. GIG/DISN capabilities are functionally a system-of-systems entity that is in a continuing sustainment phase of its life cycle.

b. The Government (DISA) acts in the role of ―the provider of DISN services‖ to its DISN customers; support from existing contract(s) contributes to this overall mission by outsourcing much of the labor effort needed to plan, evolve, operate and sustain the DISN capabilities. The GSM-O contract, and other GSM capabilities, will replace services from the existing DGS contract upon its expiration.

c. The GSM Program supports the GIG/DISN infrastructure (see definition in Appendix A of this Task Order (TO)) through the combined efforts of contractors from the following sources:

Contractor support from the GSM-O contract (the basis for this TO), providing operation, sustainment and assurance of the DISN infrastructure

Contractor support from the GSM-ETI multiple-award sources (the basis for the ETI TOs) which provide engineering and implementation services in support of the DISN infrastructure

Contractor support from the GSM-P&S multiple-award sources which provide projects and support services in support of the DISN infrastructure

d. Contractor capabilities from GSM-O, -ETI and –P&S TOs are needed to succeed those from existing TOs from previous contracts (primarily the DGS contracts) as those contracts reach the expiration of their respective periods of performance.

e. Net Assurance capabilities are provided and applied on a per-site basis when ordered by DISA. The specific list of sites to be supported by this task order is described in the Scope paragraph below.

4. Objectives:

The Contractor shall provide Net Assurance services, as described in paragraph 6, to satisfy the performance standards stated in paragraph 7 of this TO. The services are necessary on a continuing basis to enable the Government to provide DISN services to DISN customers.

5. Scope.

a. As detailed in paragraph 6 below, the Contractor shall provide Net Assurance services by performing the functional activities that are described in the following GSM-O PWS sub-paragraphs:

7 Net Assurance Operations

7.1 Computer Network Defense – Protect Activities

7.2 Computer Network Defense – Detect Activities

7.3 Computer Network Defense – Response Activities

7.4 Computer Network Defense Sustainment Activities

b. Note: Requirements of PWS paragraph 3 are not cited in the list above because those requirements, which apply to the performance of this TO, are all addressed by portions of this Task Order template.

c. The functional activities of this TO shall be executed in support of the named DISN site locations, and the GIG infrastructure capabilities located therein, as described in TO Appendix B, plus new or modified capabilities as ordered by the Government during the period of this TO.

6. Performance Requirements.

The performance requirements of this TO are derived from the corresponding requirements of the GSM-O PWS. The requirements described below are subject to the following conditions:

The definitions stated in Appendix A of this TO shall be applicable to all task work.

The functional activities described in this paragraph are to be applied at the worldwide locations as listed in Appendix B of this TO.

6.1 Computer Network Defense – Protect Activities

The Contractor shall satisfy the requirements of Appendix E paragraph 7.1, including all subparagraphs thereto, of this TO.

6.2 Computer Network Defense – Detect Activities

The Contractor shall satisfy the requirements of Appendix E paragraph 7.2, including all subparagraphs thereto, of this TO.

6.3 Computer Network Defense – Response Activities

The Contractor shall satisfy the requirements of Appendix E paragraph 7.3, including all subparagraphs thereto, of this TO.

6.4 Computer Network Defense Sustainment Activities

The Contractor shall satisfy the requirements of Appendix E paragraph 7.4, including all subparagraphs thereto, of this TO.

7. Performance Standards.

The performance standards applicable to the requirements of paragraph 6 of this TO are initially identified in the Appendix E activities to be controlled. The table of standards is provided at the end of the draft QASP at Appendix I of this TO.

8. Incentives

a. Incentive payments, as described in the QASP for this TO, are applicable to the following tasks of this TO:

TO

Paragraph

Incentive? Type Description

6.1 with all subparas thereto

Yes QASP Perf Incentive

CND – Protect Activities

6.2 with all subparas thereto

Yes QASP Perf Incentive

CND – Detect Activities

6.3 with all subparas thereto

Yes QASP Perf Incentive

CND – Response Activities

6.4 with all subparas thereto

Yes QASP Perf Incentive

CND Sustainment Activities

b. Specific required standards, metrics, measures, surveillance, and associated details including the composition of the incentive pool and how specific awards are to be made, are as described in the QASP.

9. Place of Performance.

a. Place of Performance: The duties of the GSM contractors shall be performed at Government Facilities (GF), including but not limited to the following locations: DISA facility Chambersburg, PA, and other locations as listed in Appendix B of this TO. The use of Contractor Facilities (CF) requires Government approval.

b. Alternate Place of Performance –Unforeseen Conditions: Contractor employees may be required to work at home, at another approved activity within the local travel area, or at the Contractor’s facility with Government approval, in cases of unforeseen conditions or situations (e.g., pandemic conditions, exercises, etc.). Any Government equipment such as laptops or phones provided to Contractor personnel shall be returned at a time mutually agreeable to both parties. Contracting Officer Representative (COR)/Task Monitor (TM) approval is required. The Contractor shall prepare all deliverables and other contract documentation utilizing Contractor resources. To the extent possible, the Contractor shall use best efforts to provide the same level of support as stated in the PWS. In the event the services are impacted, reduced, compromised, etc., the Contracting Officer or the Contractor may request an equitable adjustment.

10. Period of Performance.

This TO period of performance is for a period of 365 calendar days after TO award. The Government, at its option, may extend the original period of performance.

11. Delivery Schedule.

a. The schedule for performance of service capabilities as described in Task Order paragraph 6 is continuous. The CND support provided at site locations shall be executed on a continuing 24x7 shift basis.

b. Each task (sub-paragraph) of paragraph 6 above identifies (in TO Appendix E) the required services outcomes. Deliverables to be provided as evidence of required performance are also identified in each task and are listed in the table at Appendix G to this TO. Each CDRL is referenced to the task activity of this TO that requires it.

c. In addition (see PWS 3.7) the Government requires that the Contractor provide data inputs (called Data Capture Records) to established tool repositories, and provide data records (called Data Extracts) of accomplished tasks in a manner that can be directly viewed by the Government. These data inputs and extracts are actions that shall be performed by the Contractor during required tasks using Government-directed tools (most of which will be part of the GSM-OSS). Where such required data inputs and records are applicable, the TO Appendix E paragraph identifies these immediately following the identification of CDRLs. These required data inputs are listed in this task order at Appendix H.

12. Security.

a. Security shall be in accordance with the GSM-O DD254. Performance required by this TO will be up to the TOP SECRET level.

b. Security access requirements for each Government site to be supported will be provided as TO Appendix D GFI.

c. The contractor shall implement and adhere to security policies and classifications of the networks in accordance with the DISA and DoD classification guides.

d. Storage and reporting of information shall be in accordance with the classification guides. The contractor shall minimize security incidents.

13. Government-Furnished Equipment (GFE)/Government-Furnished Information

(GFI).

a. The Government will provide GFE to the Contractor for the Contractor’s use in the performance of this TO, as described in TO Appendix C.

b. GFI provided to enable the Contractor to perform under this TO is described in TO Appendix D.

14. Other Pertinent Information or Special Considerations.

a. The Contractor shall comply with all locally directed training, reporting, security, and personnel requirements. These include but are not limited to Personnel Access Management (PAM) reporting, security training, and safety training.

b. The contractor shall cease all actions on network support upon Government direction of a network ―freeze‖ condition (see Appendix A for definition).

c. The directives and instructions listed in PWS Appendix B apply, as applicable, to the requirements of this TO.

d. In compliance with U.S. Office of Management and Budget (OMB) guidance dated 28 September 2010, federal agencies are required to ensure that procurements of networked information technology comply with Federal Acquisition Regulation requirements for using the U.S. government version 6 (USGv6) profile and testing program for the completeness and quality of Internet Protocol version 6 (IPv6) capabilities. The DISA IPv6 POC will provide necessary implementing guidance applicable to the Contractor's service as GFI.

15. Section 508 Accessibility Standards.

Section 508 standards are not applicable to this TO.

Page A - 1

GSM-O TASK ORDER #3

APPENDIX A – Definitions Applicable to this TO

The following definitions shall be applicable to this task order.

DISN Infrastructure: The total set of installed networking/service capabilities as listed in the GSM asset inventory data provided as part of a draft Task Order. This includes transport fiber/circuits/services, equipment, software (both software imbedded within devices as well as functional software applications), functional services, government-designated facilities including network control centers, and associated tools used in the performance of networking O&M functions.

“Freeze” Condition: Restriction of any configuration changes, scheduled maintenance actions, and any access to the network for a period before and during scheduled mission events or real world contingency operations. This includes close coordination with commercial and government service providers, canceling/rescheduling maintenance, and the physical security of facilities, power, and network equipment.

ITIL®-Derived Definitions: This TO uses terms that are defined within documentation of the current version (currently v3) of the ITIL® Framework for Services Management. Note that ITIL® materials are trademarked; some materials are available only through subscription or comparable for-payment processes. The web link to the ITIL® governing body site is pasted here:

http://www.best-management-practice.com/officialsite.asp?DI=575004&FO=1230366

Net Assurance: The DoD activities, conducted consistent with applicable directives, focused on the protection and security of designated capabilities. The term Computer Network Defense (CND) is included within the context and definition of Net Assurance.

NetOps: The DoD-wide operational, organizational, and technical capabilities for operating and defending the GIG. NetOps includes, but is not limited to, enterprise management, net assurance, and content management.

http://www.best-management-practice.com/officialsite.asp?DI=575004&FO=1230366

Page B - 1

APPENDIX B – Net Assurance Location Data

Net Assurance capabilities, as describe in paragraph 6 of this TO, are required to be provided at the following site locations where GIG and/or DISA-supported Government networking capabilities are located:

Table B-1. CND Location Data

TO-3 CND Workload Locations and Scope Scope of Required Support

Location Para 6.1

CND

Protect

Para 6.2

CND

Detect

Para 6.3

CND

Response

Para 6.4

CND

Sustain

Chambersburg, PA Yes Yes Yes Yes

DISA NetOps Center (DNC) CONUS Yes Yes Yes Yes

DNC Europe Yes Yes Yes Yes

DNC Pacific Yes Yes Yes Yes

NORTHCOM Yes Yes Yes Yes

CENTCOM Yes Yes Yes Yes

Page C - 1

APPENDIX C – Government Furnished Equipment/Capabilities (GFE)

The specific list of GFE for this TO is attached hereto and includes but is not limited to the following.

(1) Site-specific support tools and test tools to be used in the operation and management of DISN infrastructure

(2) Other capabilities TBD as specified in the attachment to this herein

Page D - 1

APPENDIX D – Government Furnished Information (GFI)

GFI provided (initially as part of the RFP) to enable the Contractor to perform under this TO includes the following:

(1) The directives listed in Appendix B of the PWS, all of which are applicable to this

TO.

(2) GSM-O reference materials originally provided as part of the GFI associated with the GSM-O RFP.

(3) DISN Infrastructure data as provided in Appendix B of this TO

(4) Site security access requirements for each site to be supported

(5) DISN performance data from representative periods to support analysis of the effort required for performance-based task work

Page E - 1

APPENDIX E – Functional Requirements

a. This Appendix describes functional task requirements applicable to this Task Order.

To facilitate use of references in the PWS, the same paragraph numbers from the PWS are used in this Appendix. Note that details of outcomes, deliverables, and performance standards are provided in the description of requirements where they are applicable.

b. The term ―Appendix‖ refers to an Appendix of this TO unless noted otherwise. The term ―paragraph‖ refers to a paragraph of this Appendix E unless noted otherwise.

1. [This header not used in this TO.]

2. [This header not used in this TO.]

3. [This header not used in this TO.]

4. [This header not used in this TO.]

5. [This header not used in this TO.]

6. [This header not used in this TO.]

7. NET ASSURANCE OPERATIONS

a. In addition to the localized security support requirements described in PWS 6.2.6, the

Contractor shall also provide enterprise-level net assurance services as described in this section.

b. Table 1 allocation rules are not applicable to this PWS requirement (i.e. all actions are categorized as Other-Than-Standard by definition).

c. The Contractor shall provide threat analysis and incident reports, procedures and requirements as required by CJCSI 6510.01, to meet the outcomes prescribed in the paragraphs to follow.

d. The Contractor shall provide network defense of the DISN backbone and GIG High

Value Targets (HVTs). HVTs are as described in the GFI data to be provided for the applicable task order.

e. Specific details pertaining to sites where support is to be provided, network systems to be supported, and operating hours and other details will be as stated in the applicable task order.

f. To facilitate the development of performance based task orders for future services, the Contractor shall collect performance data pertaining to tasks performed, associated constraints, standards used (or that could have been used), and deliverables provided

Page E - 2

(or that could have been provided). The Contractor shall provide this data in the form of a cumulative analysis, with original source data, to the Government each quarter.

CDRL A039 CND Performance Data Analysis

g. The Contractor shall support the Government’s Computer Network Defense (CND)

Service Provider (CNDSP) in the areas of Protect; Monitor, Analyze and Detect;

Respond; and Sustain (as depicted in DoD Instruction 0-8530.1). These CND services define actions employed to prevent or mitigate computer network attacks that may cause disruption, denial, degradation, destruction, exploitation, unauthorized access, or information theft to computer networks, information systems, or their contents. These

CNDSP-led activities include the following as described in paragraphs 7.1 through 7.4.

7.1 Computer Network Defense – Protect Activities

a. The Contractor shall support the CNDSP by performing CND Protect activities for supported networks and services including the following:

(1) Support Red Team Functions – Provide support to serviced components and appropriate Government oversight entities by implementing DoD-wide Red

Team: notifications, reports, assessments, coordination, information collection, performance measurement, requirements identification, and feedback.

(2) Support Information Condition (INFOCON) – Monitor and report status; maintain, assess, implement and comply with INFOCON actions; and assist in the continuous improvement of INFOCON definitions.

(3) Support Information Assurance Vulnerability Alerts (IAVAs) – Monitor the implementation of IAVAs; provide technical assistance to Government oversight entities; de-conflict component and information specific IAVA guidance; provide technical support for development, dissemination and management of

Component vulnerability guidance; and identify network/system vulnerabilities or threats for improvement of the IAVA system and processes.

(4) Support Vulnerability Analysis and Assessment (VAA) – Provide support for VAA, including identifying and cataloging VAAs, assessing potential impact, supporting appropriate entities in implementing Defense-wide VAA notification, reporting and coordination activities, and supporting CND and related requirements.

(5) Support Security Education, Training and Awareness (ETA) – Assist appropriate entities to identify their ETA requirements, support management and tracking systems, coordinate inclusion of ETA requirements into appropriate curricula and courseware, and provide technical support in course development.

Page E - 3

b. Specific performance data needed to shape and quantify this support effort is not currently available. See Appendix B Table B-1 for data pertaining to current workload and staffing.

c. Applicable standards from the Acceptable Levels of Performance (ALP) table in

Appendix C is/are row number 29. Deliverables (CDRLs) resulting from this work are as follows:

A033 Red Team Support Data A034 INFOCON Status

7.2 Computer Network Defense – Detect Activities

a. The Contractor shall support the CNDSP by monitoring and detecting incidents and events in supported networks and services including the following:

(1) Monitor Sensors – Perform monitoring, detection and analysis on a 24X7 basis.

Monitor subscriber networks, protect Intrusion Detection System data, and provide failover capabilities for operations in the event of outages.

(2) Provide Attack, Sensing and Warning (AS&W) Support – Support the CND

Architect and Systems Integrator roles by: identifying requirements; developing, deploying and maintaining information systems; and identifying and analyzing emerging technologies. Participate in the MCEP IAP CND Systems Working

Group. Conduct or support AS&W; ensure CND AS&W information is timely and accurate; and support Component-unique requirements and their development, deployment and maintenance. Provide: notice of suspicious/malicious network traffic or similar activities, general warnings of potential cyber attacks, and impact assessments; and provide information for customer situational awareness.

(3) Provide Indications and Warnings (I&W) – Support CND activities: by distributing information and improving communications between Government entities: by providing intelligence-based information regarding cyber threats and expected imminent actions: and by disseminating information regarding theater activities.

(4) Perform Statistical Analyses – Perform statistical analyses by gathering and analyzing metrics of incidents/events, and disseminating the resulting information to the Government.

Page E - 4

Appendix C is/are row numbers 30 and 31. Deliverables (CDRLs) resulting from this work are as follows:

A035 Security Incident and Event Statistics

7.3 Computer Network Defense – Response Activities

a. The Contractor shall support the CNDSP by providing recommended response actions to security incidents in supported networks and services with course of action to mitigate and contain risk, and minimize impact to customers, including but not limited to the following:

(1) Provide Incident Reporting – Provide monitoring and reports regarding sensor-detected events or potential events to customers and to Government oversight entities, ensuring that these incidents are populated in the DoD-mandated

Incident Reporting Structure and in accordance with the Incident Reporting

Guidelines; then file and safeguard all incident reports.

(2) Provide Incident Analysis – Provide limited analysis of incidents for the customers by: determining the incidents’ nature and formulating responses, identifying and providing the ability to surge during emergencies, correlating event and incident data, determining actions to be taken, and determining possible effects on the DISN and on networks of customers and other organizations.

(3) Provide Incident Response – Recommend actions in response to incidents, coordinate responses, provide technical assistance during repair until restoration of full capability.

(4) Perform Statistical Analyses – Perform statistical analyses on incidents/events and provide results to the Government.

and staffing.

c. Applicable standards from the Acceptable Levels of Performance (ALP) table in Appendix C is/are row number 32. Deliverables (CDRLs) resulting from this work are as follows:

A036 Security Incident Analysis

Page E - 5

7.4 Computer Network Defense Sustainment Activities

a. The Contractor shall support the CNDSP by performing Security Administration and CNDSP Information Systems sustainment activities in support of net defense operations, to include server administration and maintenance, configuration monitoring and logistics support to servers, networks and applications. This task includes but is not limited to the following:

(1) CND Server Administration and Maintenance – Provide CND server administration and maintenance of the Element Management Systems workstations, servers, intrusion detection systems, and other associated equipment. Assess server security posture, ensure security plan compliance and ensure configuration changes do not adversely impact the server security posture. Perform Net Assurance-related audits and logging; implement

Vulnerability Management System (VMS) and IAVA compliance; monitor servers;

support related hardware and software upgrades; and provide user administration and logistics support.

(2) CND LAN Support – Install, configure and monitor CND security-relevant network components, ensure that C&A requirements are satisfied, and manage requirements for classified and unclassified networks. Perform infrastructure monitoring and performance assessment and new requirements analysis and support. For new equipment: order, inspect and inventory the equipment;

determine outside support installation requirements; and update equipment security information. Maintain the Integrated Configuration and Tracking System

(ICATS) and other configuration databases, ensure security posture integrity during system outages, coordinate configuration changes with the Designated

Approving Authority (DAA) for changes in security posture or status, and maintain security documentation for hardware and software baselines and maintenance logs. Perform related installation and logistics support.

(3) CND Application Security Support – Maintain data pertaining to security-relevant applications, perform audits and log reviews, flag suspect non-conforming applications, ensure security requirements conformance and evaluate permission levels while maintaining logs for access to applications. Perform related audits, logging, and IAVA compliance activities; monitor/manage applications; support software upgrades and user administration applications; and provide related logistics support.

(4) Net Assurance Support Desk – Establish a centralized support desk for security related incidents, support or lead trouble shooting efforts, escalate Trouble

Reports as necessary to Government oversight entities, and initiate OSS trouble tickets as necessary.

Page E - 6

Appendix C is/are row numbers 33 - 35.

d. Data Capture Records (see PWS 3.7) resulting from this work are as follows:

B013 Net Assurance Auditing and Logging

e. Data Extracts (see PWS 3.7) resulting from this work are as follows:

C012 Net Assurance Trouble Reports

Page F - 1

APPENDIX F

[Not Used this Task Order]

Note: the Table of Acceptable Levels of Performance (ALPs) formerly contained in Appendix F has been deleted. Use the ALPs table (exact same content) in the QASP at Appendix I of this TO.

Page G - 1

APPENDIX G – List of Contract Data Requirements List (CDRL) Items Applicable to this TO

Deliverables –CDRLS

Item # Title Subtitle Frequency Classification Requiring

Office TO App E Reference

A001 Thru A0032

Not Used this

TO

A033 Technical

Report Red Team Support Data Per Task

Order Secret

DISA

NS/GO 7.1

A034 Technical

Report INFOCON Status Per Task

Order FOUO

DISA

NS/GO 7.1

A035 Technical

Report Security Incident and Event Statistics Per Task

Order FOUO

DISA

NS/GO 7.2

A036 Technical

Report Security Incident Analysis Per Task

Order FOUO

DISA

NS/GO 7.3

A037 Thru A0038

Not Used this

TO

A039 Technical

Report CND Performance Data Analysis Per Task

Order FOUO

DISA

NS/GO 7

Page H - 1

APPENDIX H – List of Data Capture Reports and Data Extracts

Appendix H – List of Data Capture Reports and Data Extracts

Item # Title Subtitle Frequency Classification Requiring

Office

PWS

Reference

B001 Thru B012

Not Used this

TO

B013 Data Capture

Record Net Assurance Auditing and Logging Per Task

Order FOUO

DISA

NS/GO 7.4

C001 Thru C011

Not Used this

TO

C012 Data Extract Net Assurance Trouble Reports Per Task

Order FOUO

DISA

NS/GO 7.4

Page I- 1

APPENDIX I – Draft Quality Assurance Surveillance Plan (QASP) for this TO

The draft QASP associated with the GSM-O PWS is attached hereto as the draft QASP for this TO. Upon contract award, the GSM-O QASP will be finalized. That final document will then serve as the basis for tailoring to fit the requirements of this TO.

Logically the QASP for this TO has the same roles, responsibilities and procedures, but with the scope of performance to be assessed limited to the scope of this TO.

Page I- 2

Global Information Grid Services Management - Operations (GSM-O)

Quality Assurance Surveillance Plan (QASP)

For GSM-O Task Order #3

Page I- 3

1 INTRODUCTION

The Global Information Grid (GIG) Services Management (GSM) – Operations (GSM-O) Quality Assurance Surveillance Plan (QASP) will evaluate the performance of the GSM- O contractor in meeting the program’s requirements as described in the GSM-O Performance Work Statement (PWS). The contractor, and not the Government, is responsible for management and quality control actions to meet the terms of the contract. The Government will perform quality assurance and surveillance to verify contract performance standards are achieved.

2 PURPOSE

a. This QASP provides a quality surveillance strategy for the GSM-O contract. The primary intent of the plan is to provide a basis for the Government to evaluate performance quality. Oversight of contractor performance will assure quality performance. The plan will also allow the Contracting Officer and Contracting Officer’s Representative a mechanism to preclude major deficiencies in performance, provide input for annual contractor past performance evaluations, and assist in the decisions pertaining to the exercise of contract options.

b. The GSM QASP is intended to accomplish the following:

Discuss the process of performance measurement;

Describe the incentive award plan;

Establish a governance structure for monitoring performance, comparing actual performance against the performance standards, and authorizing the invoicing (payments) for earned incentives (or the credits to the Government); and, Identify the key performance standards and acceptable performance levels that will be used as both a measure of success and as a basis for incentive awards.

This initial draft of the QASP will contain a set of performance standards that will be reconciled with the contractor’s proposed performance standards and subject to mutual agreement between the parties. The consolidated, negotiated standards and measures will be included in the final QASP.

3 GSM-O EXECUTION CONTEXT

a. See Government Furnished Information (GFI) provided as supplemental information with the GSM-O RFP for general background information

b. The Contractor’s work performance shall be monitored and evaluated in accordance with the contract (including the PWS) and task order (TO) requirements. In case of conflict between the contract/PWS and a task order the contract/PWS shall govern. The controls applicable to each active Task Order will be contained in the QASP included within that task order.

c. The GSM-O contract has an ID/IQ structure with a PWS that describes primary requirement areas. Each GSM-O TO specifies the scope and requirements of the PWS that are to be provided, including the specific performance measures and a separate tailored QASP

Page I- 4

d. For the GSM-O contract, QASP procedures will be applicable at the task order level.

For each task order issued by the Government during each execution year of the contract, the task order will contain its own draft QASP to be used by the Contractor in proposing a responding Quality Control Plan (QCP).

e. PWS Appendix C provides a table of Acceptable Levels of Performance (ALPs) that measure the performance of specific PWS activities. Each ALP establishes the following color-coded performance levels:

Blue = Performance is Above-Satisfactory to a degree that merits Incentive

Green = Performance is Satisfactory (no incentive is applicable)

Yellow = Performance is not yet Satisfactory, but no credit to the Government is applicable

Red = Performance is sufficiently below the Satisfactory level to justify a credit to the Government

f. Each ALP contains the following structural elements:

Reference to PWS requirement being evaluated by the ALP

Performance objective (e.g. ―adhere to security policies and procedures to minimize classified ―spillage‖ incidents‖)

Performance Standard for measurement (e.g. ―zero spillage incidents per period‖)

Acceptable Level of Performance (e.g. ―There shall be zero classified ―spillage‖ incidents. If confirmed incidents occur, a credit to the Government of $2500 per incident shall be applied‖)

Performance Ranges (e.g. ―Blue = not applicable; Green = zero incidents; Yellow = one incident; Red = two or more incidents‖)

Surveillance Method (e.g. ―Frequency: monthly; Surveillance Type: 100% monitoring; surveillance method: data analysis‖)

g. The PWS table of ALPs is included in this QASP in paragraph 8 without change as the primary basis for QASP performance evaluation. Each TO may include additional appropriate measures/metrics/incentives and methods of surveillance within its respective QASP

4 WORK REQUIRING SURVEILLANCE

In the QASP for each specific TO, this section will provide applicable information about the tasks of that TO that are subject to incentives management under that QASP.

5 PRIMARY METHODS OF SURVEILLANCE

a. As outlined in FAR Part 46.4, Government Contract Quality Assurance, the QASP specifies the method and location of surveillance to ensure that the services conform to contract requirements. The place of performance will be as designated in the applicable Task Order.

Page I- 5

b. The primary methods of quality surveillance are addressed below. This list may be revised based on the contractor’s recommendations in a final negotiated QASP.

(1) 100 Percent Data Capture. If the performance of a PWS requirement (such as logging of help desk calls or resolving confirmed troubles) is documented via automated systems that capture descriptive and status data, that data can be used for QASP assessment purposes.

(2) Random or Periodic Sampling or Data Capture. The Government PMO can direct that data associated with the performance of a specific requirement be collected for purposes of QASP assessment, on either a random or periodic basis.

(3) Government Operator/Customer input. The Government can request input pertaining to perceived contractor performance from Government operations staff and from DISN end-users if/when there is direct interaction with the contractor such as in Help Desk calls or in contractor-provided assistance to resolve troubles at an end-user location. (Most GSM-O services are provided to the Government DISN PMO not to DISN end-users per se.)

6 GOVERNANCE

6.1 Roles and Responsibilities

The following roles and responsibilities will be incorporated in the QASP process as documented in the final QASP after award.

6.1.1 Contractor

The contractor will perform the work as described in each GSM-O Task Order and as requested by the Government, provide source data pertaining to task activities needed for evaluation by Government QARs for QASP related procedures.

6.1.2 Government Contracting Officer (KO)

The Government contracting officer will ensure that QASP-related processes, to include the payment of incentive payments as approved by the Incentives Determining Official (IDO) are executed in conformance with the FAR, the terms of the contract, and the final approved GSM-O QASP.

6.1.3 Government Contracting Officer’s Representative (COR)

The COR will act under Contracting Officer direction to assist in the administration of the contract at the contract level, and will coordinate with Task Monitors for each task order as applicable. The COR receives a completed incentive fee recommendation from each operative task order TM, checks that the TM’s recommendation is complete, and ensures that the recommendation is processed appropriately through the KO and IDO.

6.1.4 Government Quality Assurance Reviewer (QAR)

a. For QASP-related processes, the Government will appoint functionally qualified field staff to perform "quality assurance reviewer‖ (QAR) duties for each task order where QASP incentives are applicable. If a task order is divided for execution on a geographic region basis, the regional Field Commander will appoint functionally qualified field staff to perform QAR duties for QASP incentive actions in that region. Further references in

Page I- 6 this QASP to a ―QAR‖ shall be interpreted to mean, a functionally qualified field staff appointed to perform QAR duties.

b. QARs will have responsibility for monitoring Contractor performance supporting the applicable regional Field Command, or globally if applicable, collecting applicable ALP source data from the Contractor and other sources,and interpreting that data to compute the performance color level at the end of the evaluation period for each ALP. The QAR also provides additional information related to contractor performance to the TM for consideration in the incentive fee decision process. The QARs are aligned with the TO structure to ensure that contractor performance is monitored and rewarded by Government staff who are best positioned to make the recommended incentive decisions.)

6.1.5 Government Task Monitor (TM)

a. Government policy requires that each task order must have a Task Monitor (TM) who verifies that the requirements of a given specific GSM-O Task Order are being satisfied.

b. In the GSM-O context where multiple TOs are operative, each TM is responsible for coordinating, as may be needed, with other TMs in the same region/Field Command to ensure that QASP procedures are applied properly. However, each TO has its own QASP; incentive fee awards are earned and approved on a by-TO basis and are not rolled up at the contract level.

c. For QASP management purposes, the TM receives QASP inputs from the QARs and applies the decision criteria of the Incentives Table of RFP Section H to recommend incentive fee awards, if earned, or credit to the Government, as applicable, for decision by the IDO. (Incentive related data is recorded continuously, extracted monthly, evaluated for payment monthly, for invoicing on a quarterly basis.) See RFP Section H Tables 1 and 2 for details of application of the QASP metrics.

6.1.6 QASP Incentive Determining Official (IDO)

For GSM-O task orders, the DISA Network Services Division (NSD) Director will be the Incentive Determining Official (IDO) and in that role is the final approving authority for incentive fee payments earned, and credit to the Government to be applied, as applicable. The IDO receives recommendations from the COR and provides decision notifications to the KO and COR.

6.2 Finalizing the QASP

a. This draft QASP provides standards and assessment metrics consistent with the GSM-O PWS. After award, the draft QASP and the contractor’s QCP will be reconciled through negotiation to result in a revised QASP that provides the Government the means to assess performance and award incentives and credits to the Government, and allows the contractor to monitor the quality of its performance.

b. The Government can change QASP standards unilaterally at its discretion reflecting changes in priorities, Government requirements, and other considerations. PWS-level QASP performance standards may be reviewed and updated by mutual agreement.

Negotiated updates to the QASP will be added to the contract in a bi-lateral contract modification. Reviewing trends and discussing corrective actions and performance successes regularly will allow the QASP to remain relevant and ensure the focus is always to measure and reward the performance that leads to service quality above satisfactory levels.

Page I- 7

6.3 Using the QASP to Monitor Task Order Performance

Within the overall GSM-O framework provided by the PWS and the final approved QASP, specific GSM-O Task Orders will use subsets of the PWS standards according to the scope of requirements of each TO. Applying the QASP to the performance of each awarded task order will follow a 5 step process as described below.

1) The process begins with the contractor performing the required work and delivering the required results. This includes, as applicable, performing data inputs into Government OSS tools during the course of task activities, including data related to status of request fulfillment, configuration management, trouble management, security, and performance management activities. As explained in the PWS (paragraph 3.7) these data inputs are not deliverables in the formal sense but are artifacts of ongoing task activity that are used by the Government as part of the management overhead and capabilities of the DISN network. For QASP execution purposes, the Contractor will propose, in its Quality Control Plan (QCP) responding to the QASP, its procedures for collecting and providing activity data to enable evaluation of its performance under the ALPs of the TO.

The Government QARs will also use Government data from the OSS and other sources to confirm and supplement the source data provided by the Contractor.

2) This performance is evaluated by the Government QAR who applies the specific metrics of each applicable ALP from the TO. The QAR also receives and interprets, as applicable, other information pertaining to contractor performance from Government officials including the applicable TM or field command personnel

3) The QAR will then apply the criteria of an ALP (i.e. the Performance Ranges column in each ALP structure) to determine the performance level of that ALP.

(For example, in ALP 8 pertaining to request fulfillment order processing within a specific geographic region, if there were 120 customer requests processed during the evaluation month, and 117 of them were processed within the time frames provided in the ALP, the performance level would be computed as 117/120 = 97.5%, which falls into the Satisfactory (Green) performance range for that ALP. The QAR documents this conclusion for each of the ALPs of the TO in his/her responsibility, and forwards that information to the TM for further processing. Note that, as described in detail in RFP Section H, some incentive fees are earned only after a set of evaluated ALPs have been considered. The QAR also forwards to the TM any non-ALP findings or materials that are recommended for consideration during the specific evaluation cycle.

4) The TM will receive QASP evaluation inputs from all the applicable QARs, and using the applicable table from the Incentive Plan in RFP Section H, will determine whether or not an incentive fee has been earned in each of the task areas of the TO for that period, and if so what the incentive amount is according to the criteria of the table from the Incentive Plan in RFP Section H. The TM also considers any non-ALP performance information submitted by the QARs in making each incentive determination. The TM then forwards his/her recommendation, with the supporting data, to the COR who determines Incentive payments earned/recommended and the forwards to the Incentive Determination Official (IDO) for decision. The TM’s recommendation also includes any credits to the Government that are recommended to be imposed, based on the table for that purpose from the Incentive Plan in RFP Section H.

Page I- 8

5) The IDO will then act on the TM’s recommendation pertaining to incentive fee payments earned, and/or credit to the Government to be imposed, for the evaluation period. The IDO will notify the KO and the TM of this decision. The KO will either process a modification to the contract to add the fee, or (if fee is already obligated) then notifies the Contractor and the TM that the appropriate invoice should be submitted (via the Government Wide Area Workflow (WAWF) system to the WAWF Acceptor for payment.

7 PERFORMANCE-BASED INCENTIVE STRUCTURE

a. Performance-based incentive contracts are intended to provide motivation for the contractor to perform at levels above the required acceptable level, and to be appropriately rewarded when it does so. When a task order that is subject to performance incentives is awarded, an incentive CLIN will be included in the award and will be funded as described in the task order, either at a stated dollar amount or as a stated percentage of the value of the parent task order.

b. The primary basis for implementation of performance based principles in the GSM-O contract is the set of ALPs which are derived from industry best practices pertaining to a given specific task requirement in the PWS. The PWS released with the GSM-O has a table of 35 ALPs that map to PWS requirements in paragraphs 4, 5, 6, and 7. If the Government issues task orders for capabilities under PWS paragraphs 8, 9, or 10, the table of ALPs in each such task order(s) will be expanded to include additional ALPs beyond those in the PWS. (All QASP incentive processes are executed at the task order level in the GSM-O contract environment.)

c. Each ALP contains a set of structural elements as described in paragraph 3f above.

These structural elements are sufficient to enable both the Contractor and the Government to understand what the minimum satisfactory performance results are for that task activity, as measured by the ALP, and specifically how contractor performance in that ALP activity will be measured and evaluated.

d. As described in paragraph 3e above, most ALPs identify four performance regions by color (Blue, Green, Yellow, and Red) that are determined by interpretation of quantitative data collected over the period of evaluation for that ALP by the applicable QAR (see paragraph 6.3 above).

e. An ALP is evaluated either on a Global basis (i.e. the designated Quality Assurance Reviewer in one geographic region will collect and evaluate all of the data pertaining to this ALP), or on a By-Region basis (i.e. the given ALP will be evaluated separately by the QAR in each of the four GSM-O regions, with a separate color evaluation; this prevents a high-scoring region from masking lower performance in another region). By-region ALP evaluations are not rolled up but are each considered separately.

f. Paragraph 6 above describes what the QAR does as the first part of applying the incentive structure for QASP purposes. When the QAR has completed his/her process of collecting (from the Contractor, per its QCP, and from other sources), evaluating, and scoring the data for a specific ALP for the evaluation period, those results (including the QAR’s determination, by use of the criteria in the ALP, of the color performance level attained for the period) are forwarded to the TM. The TM then interprets the inputs from all responding QARs and applies the criteria of Table 1 of the RFP Section H Incentive Plan, to determine whether or not an incentive fee has been earned for each separate task area of Table 1 for that task order. As is shown in the Incentive Plan, in some task

Page I- 9 orders (including TO-1 and TO-2) the performance levels of multiple ALPs are considered (but not combined per se) to determine whether or not the incentive has been earned – which result is only visible at the TM level after receipt of all QAR inputs.

g. The Section H Incentive Plan Table of Incentives shows the mapping relationship between the set of ALPs applicable to a given task order, and the number of possible incentive fee awards that are possible. For example, for TO-1 for year-1, there are 19 individual ALPs that are evaluated for QASP purposes; those are grouped into seven (7) task areas for purposes of determining whether or not an incentive fee has been earned.

This approach, selected by the Government after consideration of industry practices, is midway between one extreme of requiring Blue level performance for all 19 ALPs before any incentive has been earned, and the other extreme of parceling out the total incentive fee pool into 19 small slices. Grouping them causes the Contractor to focus on the collective effects of the tasks being performed, and to work to raise the level of those areas whose performance could still be improved. Thus the incentive fee for a given task area, supported by multiple contributing ALPs, is an all-or-nothing determination for that particular task area.

h. In the DISN networking environment where the availability of a service is as aspect of the environment, how the Government addresses topics such as outages not attributable to the contractor affects how incentives are earned. In the GSM-O context, due to scale and complexity of Government-provided DISN services, there is no single overall measure or metric that deals with this complex issue. Therefore, specific ALPs have been developed, based on the requirements of the PWS, to deal with availability and responsibility issues. For a given type of task activity, the ALP that measures that activity specifies, within the ALP, how conditions beyond the GSM-O Contractor’s responsibility are handled in the collection and evaluation of QASP data. For activities that are timed, such as response to outages, this leads to specific conditional rules, within the ALP, that determine when ―the clock is stopped‖ for ALP measurement purposes. These conditions are typical and inherent in network availability situations, and the ALP deals with them so the GSM-O Contractor is evaluated on activities over which it has sufficient control and responsibility to be held accountable through ALP metrics and measures.

These conditional provisions are not generalized either in the Incentive Plan or in this QASP because they must be applied at the level of each ALP.

i. When the Government notifies the Contractor of the results of QASP evaluation for a given period, if there are any ALPs that were rated below the Satisfactory (Green) level, (i.e. were rated in the Yellow or Red ranges), the Government will instruct the contractor to identify corrective actions for any performance area with a Red or Yellow indicator.

T…