J-3 QASP for Processor revised 9 May 11.docx

Acquisition Sensitive Attachment J-3

HC1028-11-R-0104

QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

as of 21 Apr 2011

1. 0 Contract or Task Order Title: DISA, Computing Services Processor Capacity Services.

2. 0 Work Requirements:

· Task 1 - Operating Chipset Architecture/Operating environments.

· Task 2 - Performance/Availability

· Task 3 - Capacity

· Task 4 - Integration/Interfaces

· Task 5 - Installation/Configuration

· Task 6 – Release Management

· Task 7 – Security

· Task 8 - Facilities

· Task 9 - CSD “Green” Initiatives

· Task 10 - Technology Refresh Program

· Task 11 - Transition and Exit Strategy

· Task 12 - Removal of Equipment

· Task 13 - Quality Program

· Task 14 - Reporting Requirements

· Task 15 - Meeting Requirements

· Task 16 – Technical Assistance

· Task 17 - Ordering/Payment Process

3. 0 Primary Method of Surveillance:

100 Percent Inspection. This is usually only the most appropriate method for infrequent tasks or tasks with stringent performance requirements, e.g., where safety or health is a concern. With this method, performance is inspected/evaluated at each occurrence. One hundred percent inspection is too expensive to be used in most cases.

Random Sampling. This is usually the most appropriate method for recurring tasks. With random sampling, services are sampled to determine if the level of performance is acceptable. Random sampling works best when the number of instances of the services being performed is very large and a statistically valid sample can be obtained. Computer programs may be available to assist in establishing sampling procedures.

Periodic Inspection: These services are monitored weekly, monthly, quarterly, semiannually, annually, etc. Periodic types of activities are perfect for periodic inspection because not only are they infrequent, but there is normally a predetermined, specified time frame within which the tasks must be accomplished. Therefore, you know exactly when to conduct the evaluations. Periodic inspections automatically become 100 percent evaluations or "100 percent checks." Inspections should be divided and scheduled by frequency: annual, semiannual, quarterly, monthly, weekly and as required. Sometimes services are required for which the time or frequency cannot be predicted, such as accident investigations, one-time special tasking by higher headquarters, etc. These would be labeled "as required inspections." Others are known and predictable such as the quarterly status report or the monthly travel report currently included in some DISA service contracts.

Customer Input. Although usually not a primary method, this is a valuable supplement to more systematic methods. For example, in a case where random sampling indicates unsatisfactory service, customer complaints can be used as substantiating evidence. In certain situations where customers can be relied upon to complain consistently when the quality of performance is poor, e.g., dining facilities, building services, customer surveys and customer complaints may be a primary surveillance method, and customer satisfaction an appropriate performance standard. In all cases, complaints should be documented, preferably on a standard form.

Task 1 – Operating Chipset Architecture/Operating Environments, Subtask 1.1. The primary surveillance method shall be Periodic Inspection. The Government will review the Contractor solution/Bill of Materials for processor services requested to ensure the CSD functional requirements are met. The secondary surveillance method shall be Customer Input. The CSD Engineers will determine the usability and validate that all functional requirements are fully and satisfactorily met.

Subtask 1.2, 1.3, 1.4, 1.5 1.6, and 1.8 - The primary surveillance method shall be Periodic Inspection. The Government will review the Government Maintenance Call Records (TMS) to determine if downtime was attributed to support requirements for N-2 versions, access to OEM technical support, OS clustering, OS image, hardware components, VMWare, IBM System z (IBM z/OS, IBM z/VM, Red Hat Enterprise Linux, SUSE Linux Enterprise Server); X-86 (Windows Server, Red Hat Enterprise Linux, SUSE Linux Enterprise Server, Solaris, VMware); Itanium (HP-UX, HP VSE); SPARC (Solaris, Solaris 10 zones and Ldoms) ; and IBM System p (AIX, AIX LPARs) hardware management was available for use where required. The secondary surveillance method shall be Customer Input. The CSD processor users will respond to OS requirements inquiries to ensure support is provided and adequately identified and downtime was not attributed.

Subtask 7 – The primary surveillance method shall be Periodic Inspection. The Government will review the software entitlement and maintenance level documentation to determine if entitlements and maintenance levels are adequate. The secondary surveillance method shall be based upon audit requests from Software contractor s. The Processor Capacity Service contractor will respond to audit requests from Software contractor s and initiate any action to complete audit requirements.

Task 2 – Performance/Availability, Subtask 2.1, 2.2 and 2.5 - The primary surveillance method shall be Periodic Inspection. The Government will review the Government Maintenance Call Records (TMS) to determine the processor performance/availability measure, problem escalation requirements, and contractor response time. The secondary surveillance method shall be Customer Input. The CSD processor users will respond to downtime inquiries to ensure processor capacity is adequately identified in the Government record of Government Maintenance Call Records (TMS) and the Contractor reports.

Subtask 2.3 and 2.4 – The primary surveillance method shall be Periodic Inspection. The Government will review contractor reporting/solution for validating and viewing hardware features and components installed on each processor; central management capability and reporting to include hardware utilization, error diagnostics of installed hardware components, and environmental telemetry information to measure power consumption and HVAC impact to CSD facilities and infrastructure. The secondary surveillance method shall be Customer Input. The CSD processor users will respond to inadequate validation/viewing of hardware features and components installed on each processor; inadequate central management capability and reporting and reporting to include hardware utilization, error diagnostics of installed hardware components, and environmental telemetry information to measure power consumption and HVAC impact to CSD facilities and infrastructure

Subtask 2.6.1-2.6.4 - The primary surveillance method shall be Periodic Inspection. The Government will review the Government record of acceptance for services to ensure delivery occurred within 30 days of the order acceptance, equipment report was received, and minimal disruption occurred. The secondary surveillance method shall be Customer Input. The CSD Facilities Group (CD522) will respond to delivery/acceptance inquiries to ensure delivery/acceptance occurred on the date identified in the acceptance record and in the Contractor reports.

Task 3 – Capacity, Subtask 3.1. 3.3 and 3.8. The primary surveillance method shall be 100% Inspection. The Government will review invoices to ensure the date of acceptance is the date billing begins and that the date of deactivation is the date billing ends. The secondary surveillance method shall be Customer Input. The CSD Facilities Group (CD522) will respond to acceptance/deactivation inquiries to ensure acceptance/deactivation occurred on the date identified in the acceptance/deactivation record, invoicing, and in the Contractor reports.

Subtask 3.2, 3.5 and 3.6. The primary surveillance method shall be Periodic Inspection. The Government will review the Government Maintenance Call Records (TMS) to determine if downtime was attributed to provisioning, Classified workloads, or disruption to production environment based on capacity changes.. The secondary surveillance method shall be Customer Input. The CSD processor users will respond to downtime inquiries to ensure timely provisioning and minimal disruption occurs due to capacity changes.

Subtask 3.4. The primary surveillance method shall be Periodic Inspection. The Government will review the testing requirements (CBU activation) to determine if testing was delayed due to contractor delay. The secondary surveillance method shall be Customer Input. The CSD processor users will respond to inquiries to ensure timely testing occurred.

Task 4 – Integration/Interfaces, Subtask 4.1. The primary surveillance method shall be Periodic Inspection. The Government will review training materials and participate in training sessions to ensure training occurs prior to infrastructure changes. The secondary surveillance method shall be Customer Input. The CSD System Administrators will respond to training inquiries to comment on whether materials were adequate to cover infrastructure changes and training occurred prior to infrastructure changes.

Subtask 4.2, 4.3, 4.5, 4.6, and 4.7 - The primary surveillance method shall be Periodic Inspection. The Government will review the Government Maintenance Call Records, Trouble Management System (TMS) to determine software interoperability; remote management/identified maintenance requirements; storage infrastructure issues; coordination for asset deployment; and (6) IPv6 interoperability issues. The secondary surveillance method shall be Customer Input. The CSD processor users will respond to downtime inquiries to comment on whether there are software interoperability issues; maintenance requirements are remotely identified ; there are storage infrastructure interoperability issues; and there are IPv6 interoperability issues.

Subtask 4.4 - The primary surveillance method shall be Periodic Inspection. The Government will complete inspection of backup network to ensure backups occur. The secondary surveillance method shall be Customer Input. The CSD processor users will respond to inquiries concerning backup issues to ensure backups are occurring without problems.

Task 5 – Release Management, Subtask 5.1 and 5.2. The primary surveillance method shall be Periodic Inspection. The Government will review the Government Maintenance Call Records TMS to determine if downtime was attributed to lack of ability to download/execute OS releases. The secondary surveillance method shall be Customer Input. The CSD processor users and the CSD Release Management team will respond to OS requirements inquiries to ensure support is provided for and adequately identified and downtime was not attributed.

Task 6 – Installation/Configuration. The primary surveillance method shall be Periodic Inspection. The Government will review the Government record of acceptance for services to ensure delivery occurred within 30 days of the order acceptance. The secondary surveillance method shall be Customer Input. The CSD Facilities Group (CD522) will respond to delivery/acceptance inquiries to ensure delivery/acceptance occurred on the date identified in the acceptance record and in the Contractor reports and that the configurations were correct for immediate installation.

Task 7 – Security. The primary surveillance method shall be Periodic Inspection. The Government will review contractor personnel security requirements to ensure appropriate security clearances are obtained/maintained and that all security regulations/procedures are followed. The secondary surveillance method shall be Customer Input. The CSD Processor users and CSD Facilities Group (CD522) will respond to security inquiries to ensure all security regulations/procedures are followed.

Subtask 7.1 – The primary surveillance method shall be 100% Inspection. The Government will review the contractor IA certification report to ensure contractor employees are in compliance with certification requirements. The secondary surveillance method shall be Customer Input. The CSD Processor users and CSD Facilities Group (CD522) will respond to certification inquiries to ensure contractor employees portray knowledge as required in the certification requirements.

Subtask 7.2 - The primary surveillance method shall be 100% Inspection. The CSD Installations Team will test each system prior to installation to ensure all STIGs are in compliance.

Task 8 – Facilities.

Subtask 8.1 and 8. 2 – The primary surveillance method shall be 100% Inspection. The CSD Facilities Group (CD522) will test each rack prior to installation to ensure racks are in compliance with the requirements as set forth in ATTACHMENT FIVE.

Task 9 – CSD “Green” Initiatives, Subtasks 9.1 and 9.2. The primary surveillance method shall be Periodic Inspection. The Government will review the environmental telemetry data/reports and analysis to ensure delivery occurred within specified timeframe. The secondary surveillance method shall be Customer Input. The CSD Facilities Group (CD522) will respond to delivery/acceptance inquiries to ensure delivery/acceptance occurred on the date identified in the acceptance record and in the Contractor reports and that the configurations were correct for immediate installation.

Task 14 – Reporting Requirements, Subtasks 14.1-14.3. The primary surveillance method shall be Periodic Inspection. The Government will review the reports presented to ensure they identify/discuss the required elements as identified and are delivered on time. The secondary surveillance method shall be Customer Input. The CSD Processor community will respond to inquiries to ensure material presented in the reports are accurate.

Task 15– Meeting Requirements, Subtask 15.2-15.4. The primary surveillance method shall be Periodic Inspection. The Government will review the agenda and subsequent email report/s presented to ensure they identify/discuss the required elements as identified and are delivered on time. The secondary surveillance method shall be Customer Input. The CSD Processor community will respond to inquiries to ensure material presented in the meeting and subsequent reports are accurate.

Task 16 – Technical Assistance. The primary surveillance method shall be Periodic Inspection. Inspection requirements will be included in separate PWS as technical assistance is ordered. The secondary surveillance method shall be Customer Input. The CSD Processor community will respond to inquiries to ensure service provided met the Government needs.

Task 17 – Ordering/Payment Process, Subtasks 17.1 and 17.2. The primary surveillance method shall be Periodic Inspection. The Government will review the lapse of time between when Govt call order is dispatched to contractor and “Acceptance” occurs and periodic inspection of call order management system to include order validation, invoicing, billing, returns, financial tracking, and asset management. The secondary surveillance method shall be Customer Input. The CSD Processor community will respond to inquiries as to whether call order management system impedes ordering.

Subtask 17.3. The primary surveillance method shall be 100% Inspection. The CSD Installation Group (CD522) will test each processor using the acceptance testing to ensure each asset operates IAW the SOO.

4. 0 Scope of Performance:

The Contractor will design, deliver, install, and maintain processor capacity infrastructure in concert with the Government, at any of the current DISA CSD computing facilities or future DISA CSD computing facilities in the continental US (CONUS), the Government, DISA CSD outside CONUS (OCONUS) and other DISA or DISA approved locations worldwide where DISA CSD may acquire an operational responsibility.

The hardware/Chipset and the operating systems software, required to deliver processor capability for DISA are:

· IBM System Z (IBM z/OS, IBM z/VM, Red Hat Enterprise Linux, SUSE Linux Enterprise Server)*

· X-86 (Windows Server, Red Hat Enterprise Linux, SUSE Linux Enterprise Server, Solaris, VMware)*

· Itanium (HP-UX, HP VSE)*

· SPARC (Solaris, Solaris 10 zones and Ldoms)*

· IBM System P, (AIX, AIX LPARs)*

* Any other operating environment or chip sets that DISA may require in the future

This initiative will support controlled unclassified and classified including SCI level environments.

The objective is for the Contractor to provide processor services using a “utility contract concept”. This utility concept requires that the Contractor provide all assets needed for the processor service. These assets shall include, but are not limited to, hardware, software, design capabilities, logistical support, field maintenance, and systems engineering.

4.1 Current Environment – DISA CSD currently provides processor services at 15 computing facilities in the CONUS, located at:

· Chambersburg, PA,

· Columbus, OH,

· Dayton, OH,

· Denver, CO

· Fort Meade, MD

· Huntsville, AL,

· Jacksonville, FL

· Pensacola, FL

· Mechanicsburg, PA,

· Montgomery, AL,

· Ogden, UT,

· Oklahoma City, OK,

· San Antonio, TX,

· St Louis, MO,

· Warner Robins, GA

4.2Three (3) OCONUS locations are:

· Patch Barracks, Vaihingen, Germany

· Pearl Harbor, Hawaii

· Manama, Bahrain

5.5.2 Future locations. Contractor shall have the ability to support DISA or DISA approved locations worldwide where DISA CSD may acquire an operational responsibility.

5. 0 Performance Standards.

Processor capacity for High Availability Systems will meet or exceed 99.99% based on the calculation: Total available hours for 30 days – Measurement Exceptions – Time server is unavailable) / (Total available hours for 30 days –Measurement Exceptions)*100=“Service Level Attained”. Total available hours = 24x7x365 for each five nine orderable system for each 30 day period averaged over all five nine’s designated systems.

Periodic inspection of downtime reports.

Periodic inspection of downtime reports and number of hours to resolve issues.

Periodic inspection of delivery timelines.

Periodic inspection of delivery timelines.

Periodic inspection of backup network to ensure backups occur.

6. 0 Acceptable Quality Level (AQL):

The ACL for this project is 100% due to the critical support provided by the processor infrastructure operations.\

7. 0 Evaluation Method:

Example: The Task Monitor (TM) will document the time of verbal notification to the contractor. The TM will document the official time and date of notification on the Maintenance Call Record. The TM will review self-diagnostic systems logs, conduct a comparison with actual maintenance performance and otherwise verify and validate contractor performance. The contractor shall enter in the record the official time the system is restored to full operational status. The TM will confirm the date and time of problem resolution in the record.

Task 1 – Operating Chipset Architecture/Operating environments, Subtask 1.1– The Contracting Officer Representative (COR) will document CSD Engineer comments concerning Contractor solution/Bill of Materials to verify and validate that the performance standard has been met.

Subtask 1.2, 1.3, 1.4 and 1.6, 1.8 and 1.9 - The COR will document review of the Government Maintenance Call Records, Trouble Management System (TMS) directed at support requirements N-2 versions, access to OEM technical support, OS image, OS clustering, hardware peripherals, VMWare, RedHat Enterprise Linux and SUSE Linux Enterprise Server, and IBM System z hardware management to verify and validate that the performance standard has been met.

Subtask 7 – The COR will document review of the software entitlement and maintenance level documentation to verify and validate that the performance standard has been met.

Task 2 – Performance/Availability, Subtask 2.1,2. 2 and 2.5- The COR will document review of the Government Maintenance Call Records. Calculations based on definition of Performance/Availability will be completed, review of required escalation, and calculation of contractor response time will be completed to verify and validate that the performance standard has been met.

Subtask 2.3 and 2.4 – The COR will document review of the contractor reporting/solution to validate and view hardware features and components installed on each processor; central management capability and reporting to include hardware utilization, error diagnostics of installed hardware components, and environmental telemetry information to measure power consumption to verify and validate that the performance standard has been met.

Subtask 2.6.1-2.6.4 - The COR will document review of the Government record of acceptance for services to ensure delivery occurred within 30 days of the order acceptance, equipment report was received, and minimal disruption occurred to verify and validate that the performance standard has been met.

Task 3 – Capacity, Subtask 3.1 - The COR will document the date of acceptance on the invoices to ensure the invoice amounts marry to the actual acceptance and deactivation dates to verify and validate that the performance standard has been met.

Subtask 3.2 and 3.5 - The COR will document review of the Government Maintenance Call Records (TMS) directed at provisioning or disruption to product environment based on capacity changes to verify and validate that the performance standard has been met.

Subtask 3.4. The COR will document review of the test requirements to verify and validate that the performance standard has been met.

Task 4 – Integration/Interfaces, Subtask 4.1- The COR will document CSD System Administrator comments concerning training materials and training sessions to verify and validate the performance standard has been met.

Subtask 4.2, 4.3, 4.5, and 4.6 - The COR will document review of the Government Maintenance Call Records. The COR will document review of self-diagnostic systems logs, conduct a comparison with actual maintenance performance and otherwise verify and validate that software interoperability issues; maintenance requirements are remotely identified ; there are no storage infrastructure interoperability issues; and there are no IPv6 interoperability issues to verify and validate the performance standard has been met.

Subtask 4.4 - The COR will document review of the Government Maintenance Call Records and inspection of the backup network to verify and validate that the performance standard has been met.

Task 5 – Installation/Configuration – The COR will document the official acceptance date on the Official Call Order to verify and validate whether the performance standard has been met.

Task 6 – Release Management, Subtask 6.1 and 6.2 - The COR will document Government Maintenance Call Records (TMS) to determine if downtime was attributed to lack of ability to download/execute OS releases to ensure enterprise compatibility to verify and validate that the performance standard has been met.

Task 7 – Security. The COR will document review of personnel security requests to verify and validate that performance standard has been met. The COR will document review of contractor security regulations/procedures to verify and validate whether the performance standard has been met.

Subtask 7.1 – The COR will document review of the IA certification report to verify and validate whether the performance standard has been met..

Subtask 7.2 - The COR will document testing of each system installed to verify and validate whether the performance standard has been met.

Task 8 – Facilities.

Subtask 8.1 and 8.2 – The COR will document testing of each system installed to verify and validate whether the performance standard has been met.

Task 9 – CSD “Green” Initiatives, Subtask 9.1 and 9.2. The COR will document review of the reports to verify and validate that the performance standard has been met.

Task 14 – Reporting Requirements, Subtasks 14.11-14.3 – The COR, in conjunction with the PM, will document review of the reports to verify and validate that the performance standard has been met.

Task 15– Meeting Requirements, Subtask 15.2-15.4 - The COR, in conjunction with the PM, will document review of the reports to verify and validate that the performance standard has been met.

Task 16 – Technical Assistance – The COR will document requirements based upon PWS requirements upon call order for service.

8. 0 Incentives (Positive and/or Negative):

8.1 The positive incentive is prescribed below:

8.1.1 If the Government requests expedited delivery earlier than the performance threshold for Task 2, Subtask 2.6.1 (delivery to occur between days 1-28) for an ordered system, the first monthly invoice amount for the ordered sytem/service will be increased by 5% of the invoice amount:

The calculation for positive remedy for Task 2, Subtask 2.6.1 is: (Monthly ordered system/service invoice amount * 5 %). For instance, if the actual number of days for delivery is 15 (15 calendar days earlier than requested) and the monthly ordered system/service amount is $5,000, the first monthly ordered system/invoice amount will be increased by $250 ($5,000*5%=$250).

If the Government modifies the original call order, the 30 calendar day delivery period remains in effect. In addition, the positive incentive remains in effect. For instance, the original call order for the ordered system/service was placed on 1 March, the original contract delivery date is 30 March. A modification is made to the original call order on 15 March. The contract delivery date remains at 30 March. The delivery is made on 20 March with the modified call order requirement, the positive incentive will increase the invoice amount by 5%.

8.2 The following negative incentives apply:

8.2.1 Any minimum standard not met will be officially documented as a negative record in the Contractor Performance Assessment Reporting System (CPARS).

8.2.2 The PWS and QASP will be modified to identify Performance Objectives and standards for other services as required.

8.2.3 If all performance thresholds are met, there will be no adjustment to the invoice amount.

8.2.4 If the performance thresholds for Task 2, Subtask 2.1 are not met, the contract value for each ordered systemthat does not meet the performance threshold for the month (when the invoice is accepted ) will be reduced by the system percentage of availability not met by the Contractor . The calculation for negative remedy for Task 2, Subtask 2.1 is: (Total available hours for each ordered system for 30 days (30X24) – Measurement Exceptions – Time ordered system is unavailable) / (Total available hours for ordered system for 30 days (30X24)–Measurement Exceptions)*100=“Service Level Attained”- 99.95% = % invoice for the ordered system for the month will be reduced. For instance, if an ordered system average for the month is availability is 99.92%, the monthly invoice will be reduced by .03%. (99.95% - 99.92% = .03%)

8.2.5 If the performance threshold for Task 2, Subtask 2.6.1 are not met, the contractor will reduce the first month invoice for the ordered system/service equal to the amount of days the contractor delivery was late. The calculation for negative remedy for Task 2, Subtask 2.6.1 is: (actual number of days for delivery – 30)*invoice amount)-monthly invoice amount. For instance, if the actual number of days for delivery was 35 (delivery was 5 days late), the first monthly invoice will be reduced by 5 days of the monthly invoice amount.

Enclosure 6, QASP Page 1 of 4 Pages 01Sep09/Version 1.1

QASP

Page 5 of 12 Pages