Symantec Attachment J-3 QASP.doc

QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

1. Task Order Title: Symantec AV/AS Maintenance Contract

2. Work Requirements:

Task Area 1 – Project Control and Planning

Task Area 2 – Security Engineering Certification and Accreditation

Task Area 3 – Operations Support

Task Area 4 – Software

3. Primary Method of Surveillance The primary methods of surveillance are random checks, observations, inspections, complaints and review of records and files required to be maintained and delivered under this contract. The Government will use appointed representatives, as well as reports and input from DoD personnel as sources of comments on the Contractor’s performance.

The methods of surveillance listed below shall be used in the administration of this QASP. The specific surveillance method for each performance standard and acceptable quality level is listed below:

a. Customer Feedback - Customer feedback may be obtained either from the results of formal customer satisfaction surveys or from random customer complaints. Customer complaints, to be considered valid, must set forth clearly and in writing the detailed nature of the complaint, must be signed or emailed and forwarded to the COR who will assess the validity of the complaint and retain it in a documentation file. The COR shall also maintain the tabulated results of all customer satisfaction surveys on file.

b. 100% Inspection - This level of inspection shall be accomplished by the DoD site personnel verifying the completion of delivery of products and/or completion of service performance. Performance is inspected/evaluated at each occurrence.

c. Periodic Inspection - This level of inspection consists of the evaluation of selected tasks on other than a 100 percent basis. Periodic inspections can occur on a weekly, monthly, quarterly or yearly basis.

d. Direct Observation - Direct observation is designed to evaluate Symantec contract services through careful, direct examination of activities to determine whether services conform to contract requirements.

e. Contractor Self Reporting - Contractor proactively reports on performance and alerts the COR to potential performance issues. This method relies on the Contractor’s in-place infrastructure and systems for measurement of performance indicators and results.

4. Scope of Performance The scope of this requirement covers the entire DoD, which requires a scalable enterprise AV/AS solution that provides real-time zero-day protection capabilities for multiple operating systems against vendor and security community identified threats utilizing industry best practices.

This contract will provide the continuation of brand name, Symantec, enterprise software licenses for AV/AS capabilities. The Symantec AV/AS capabilities includes maintenance updates for existing perpetual licenses for the currently installed AV/AS solutions for all DoD Components. AV/AS Tier III Help Desk Support will be required in addition to training and optional SMEs. SME’s will be used on an as needed basis only. The solution shall continue to accurately protect the DoD enterprise networks and connected systems against malware and implement DoD standards (e.g. Federal Desktop Core Configuration (FDCC), Security Technical Implementation Guides (STIGs), and all known vulnerabilities.

5. Performance Standards:

Performance Objective

Task Areas 02

Subtask C&A

Inspection

Task Area 01

Subtask – Progress Reviews

Inspection

Task Area 04

Subtask – Zero-Day Emergency Response

Inspection

Task Areas 02

Subtask – Help Desk

Inspection

6. Acceptable Quality Level (AQL):

The AQL for this project is 100% due to the critical maintenance and support provided for DoD activities.

7. Evaluation Method:

The COR will perform method of surveillance identified above and notify the Contractor of performance deficiencies. The Contractor will provide a response to the COR detailing methods of performance improvement when required by the government. The COR will verify successful upgrades, patches, and/or updates followed by successful normal operation of Symantec software, and servicecs.

8. Incentives (Positive and/or Negative):

No specific incentives are anticipated for this procurement, other than those inherent in firm fixed price performance-based contracts. However, both positive and negative performance will be documented in past performance reports/database (CPARS), as appropriate and will be taken into consideration or follow-on work

PAGE