Attachment_4_-_Application_Management_Sample_Task_Order_20120619_2005.docx

SOURCE SELECTION INFORMATION - SEE FAR 2.101 & 3.104

DISA CIO - DISA IT Enterprise Support Services

HC1028-13-R-XXXX TASK ORDER 0001

31 January 2012

APPENDIX B –QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

APPENDIX C –QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

Defense Information Systems Agency

Chief Information Officer DISA Information Technology Enterprise Support Services (DESS)

HC1047-12-D-XXXX

Task Order (TO) 0004 Application and Service Management (Version 1.0) 19 June 2012

TABLE OF CONTENTS

Task Order Contracting Representative (TO COR) Primary TO COR

Department of Defense Activity Address Code (DODAAC):

HC1047

Fort George G. Meade, MD 20755-0549

Alternate TO COR

Department of Defense Activity Address Code (DODAAC):

HC1047

Fort George G. Meade, MD 20755-0549

Task Order Title:

Defense Information Systems Agency’s (DISA’s) Information Technology (IT) Operations Application and Services Support.

Background The Defense Information Systems Agency is a Combat Support Agency responsible for connecting U.S. Forces and their coalition partners to the DoD’s Global Information Technology (IT) Enterprise. DISA provides IT networks, computing infrastructure, and enterprise services in direct support of U.S. Warfighters to facilitate the seamless exchange of information on a global scale.

The mission of DISA’s Chief Information Officer (CIO) is to, “Lead and govern the delivery and operation of secure world-wide Enterprise IT services enabling the efficient and effective execution of DISA’s global combat support missions.” In order to accomplish this mission, the DISA CIO must:

· Provide an efficient and effective IT infrastructure and service to support the Agency’s warfighting mission.

· Achieve a Mission Assurance posture that ensures the security and continuity of the Agency’s internal IT Enterprise’s infrastructure and services against an ever-evolving spectrum of threats.

· Maintain compliance with all DoD information governance policies and legislation.

· Govern a common architecture and service delivery framework to drive efficiencies in business system investments and portfolio and knowledge management capabilities.

The Defense Information Systems Agency’s (DISA’s) Office of the Chief Information Officer (CIO) has a continuing requirement to provide management information systems and services in support of the DISA IT Enterprise. The CIO’s Office of Application Management is responsible for the design, development, integration, implementation, and operations and maintenance (O&M) of Enterprise level Information Systems supporting customers across the Agency.

The operation and maintenance DISA’s Applications requires system design, development, configuration management, system administration, database administration, security engineering, and system integration support services in order to support the Agency’s mission. Contractor support and technical competencies are required to perform the function required to deliver DISA’s Intranet Applications. These skill include operation and maintenance tasks, as well as the delivery of new capabilities through product enhancements, adoption of other Department of Defense (DoD) technologies, or the integration of new software code (Government-Off-The-Shelf (GOTS) and/or Commercial-Off-The-Shelf (COTS).

Several sets of technical skill have proven essential to the mission of the DISA Applications Management Team. The team relies heavily on a deep technical understanding of the Oracle Identity Manager product. Additionally, expert knowledge of the VRD product, to include customization of the VRD interface, administration of the VRD database, and directory integration with enterprise LDAP directories are essential. A through technical knowledge of WebLogic’s application server and all associated security permissions is also a critical skill. In addition, experience with HTML, XML (exports), and JavaScript (manipulation of attributes) will be required.

Additionally, the operational tempo of the DISA’s combat support mission mandates that application maintenance and administration be conducted after normal working hours (0800-1600 EST, Monday through Friday).

The primary focus is to provide life cycle support for a suite of applications and services known as DISA Intranet Services. DISA Intranet Services is comprised of the following:

· Defense Enterprise Portal Service (SharePoint)

· DISA Workspaces;

· Alternate Workspaces;

· DISA Records Repository (DRR);

· Situational Awareness Table (SAT); Table

· Identity Management (IdM);

· Single-Sign-On (SSO) Service;

· Intranet Central Authentication Directory (CAD) enterprise-level Lightweight Directory Access Protocol (LDAP);

· Federated Search;

· DISA.MIL;

· Action Information Management System (AIMS);

· Enterprise Authorized Software List (EASL);

· PKI Registration

· Restricted Web Content Hosting;

· Knowledge Tree (KT);

· DISA Financial Management System (DFMS);

· Defense Knowledge Online (DKO) Objectives The objective of this Task Order is to enable the DISA CIO to deliver operational excellence in the day-to-day operation of the Agency’s Intranet Applications. The ability to deliver the service provided by the Agency’s Intranet Applications, from stable and efficient operational platforms, are a critical enabler of DISA’s warfighting mission. Specifically, the objectives of the DISA’s Intranet Applications are to:

Deliver operational excellence in mission supporting Applications Deliver efficient and stable Applications platforms Provide effective governance and management of DISA’s Intranet Applications Support Agency’s goal of achieving an ISO 20000 Certification

Scope The scope of this Task Order includes DESS Task Area 1 - Project Management and Task Area 7 - DISA IT Enterprise Solution Engineering and Deployment. This Task Order encompasses the full range of Application Management support services and capabilities required by the DISA CIO to support the Agency’s IT Enterprise. The functional scope of the tasks associated with this effort is detailed below.

DISA Intranet Application Management and Services performed under this Task Order include:

· Systems Analysis

· System Testing

· System Implementation and Integration

· Application / Web Service Development

· Application / Web Service Retirement

· Change Management

· System Operations and Maintenance

· Data/System Backup and Recovery

· System Security

· Project Management and Support

· Technical Architecture Assessment

· Technical Documentation

· Certification and Accreditation Documentation

· Training Documentation

· ITIL Process Improvement Documentation

Task Order Management The Contractor shall provide Task Order management for the services provided under the Application and Service Management support.

IT Enterprise Application and Services The Contractor shall provide lifecycle support for Enterprise Intranet Applications and Services.

Intranet Services Operations and Maintenance The Contractor shall provide lifecycle support for Intranet Services Operations and Maintenance.

Specific Tasks Task 1 – Task Order Management Provide a Monthly Status Report monitoring the quality assurance, progress/status reporting, and program reviews applied to the TO.

Provide support for the maintenance of the Integrated Master Schedule (IMS) for all activities under their purview.

Perform initial Technical Exchange Meeting (TIM) within 15 days after contract award for the purpose of reviewing and clarifying the requirements of this PWS.

Develop and implement technical management control and quality assurance processes to ensure all contract related products, deliverables and services provided to the Government.

Task 2 - IT Enterprise Application and Services Develop, document, structure, plan, implement and maintain standardized business processes, based on industry best practices, to standardize and govern the delivery of IT applications and services.

As directed by the Government, conduct technical analysis to ensure all IT Enterprise applications and services are provided efficiently and economically. (Form 1) Perform the application and services maintenance activities required to repair errors and defects of new or existing GOTS/COTS applications and associated database

· Corrective and emergency maintenance to applications in production

· Preventive maintenance to mitigate future events that could disable or degrade service

· Adaptive maintenance to ensure application performance is not affected by changes to interfacing or new applications

· Perfective maintenance to ensure that applications operate at peak efficiency As directed by the Government, perform the application development activities required to develop application enhancements and related modifications, on new, existing or under development GOTS/COTS applications and databases.

· project management

· requirements and design

· programming and development

· integration and testing

· code migration

· software configuration management

· technical change management As directed by the Government, Perform technical analysis to determine the ability of new or newly modified applications to successfully interoperate with existing inventory of DISA IT Enterprise Components and DoD provided Joint Enterprise Services. (Form 1)

Task 3 - Intranet Services Operations and Maintenance (O&M) Intranet Services O&M Tasks:

Operate and maintain all production environment applications in accordance with the Service Level Agreements (SLA’s) located in Appendix B.

Perform all system maintenance activities (e.g., operating system patch application, version upgrade, web server configuration changes, maintenance on production servers, etc.) after 1900 EST.

Perform maintenance activities on all production environment applications as required to maintain the SLA’s identified in Appendix B.

Subtask 1 – DISA Workspaces Operate and maintain OpenText Collab servers and customized applications built using the Collab application interfaces (APIs) in the DISA environment.

Subtask 2 - Single Sign On (SSO) Maintain the Intranet Services SSO service and its integration with the applications and services.

Operate and maintain the existing CIO infrastructure.

Develop and maintain user synchronization between DKO and DISA directories (group synch) to ensure all DISA users (and authorized guests) have the access.

Subtask 3 – Identity Management (IdM) Operate and Maintain the DISA IdM service Develop and implement IdM workflows Develop and implement SPML development and custom data/directory synchronization scripts outside of the IdM product Develop and implement account provision, account deprovisioning processes Design and implement Active Directory (AD) and LDAP integration Design and implement Microsoft Structured Query Language (MS SQL) and Oracle integration.

Maintain IdM service integration with other DISA systems.

Provide CAC/PKI self-registration, directory synchronization, and account provisioning / de-provisioning services for all DISA IdM service users (estimated to be 15,000 DISA military, civilian, and Contractor personnel).

Perform DISA IdM service integration with the DISA Enterprise Services Directorate (ESD) delivery of the DISA Enterprise Email Solution.

Provide DISA IdM service Account Approval Process module (to provide account approval process workflow, account request review forms for Intranet Support and Approver/Sponsor, and rules for account creation request validation and checking account request status).

Develop and implement a DISA IdM service provisioning/de-provisioning module designed to provide creating, updating, and disabling the accounts that presents the user in the LDAP directory and/or DKO directory service.

Develop and implement a DISA IdM Service Administration Module (designed to provide the ability to delegate individual system activities to administrators by providing limited control over specific organizations and objects within those organizations, filter administrator views of user creation and edition pages, and give administrators specific job duties in the form of capabilities).

Develop and implement a DISA IdM service to perform installation and configuration of additional database and directory connectors to DISA systems to further synchronize DISA identity information across all DISA systems.

Develop and implement a DISA IdM service to facilitate the sharing of DISA identity information with the DoD Joint Enterprise Directory Service (JEDS).

Develop and implement a DISA IdM web services to provide the means for DISA systems to consume and utilize the DISA identity information that is brokered by the DISA IdM service.

Administer the WebLogic application server and develop new, or update existing, software code for the User Tool.

Subtask 4 – DISA Records Repository (DRR) As directed by the Government, conduct technical analysis to evaluate DISA’s Records Management requirements and make recommendations the Pros/Cons of remaining with the current OpenText application or moving to a new product. (Form 1) Maintain the OpenText Records and Documents (VRD)-based Electronic Records Management (ERM) code and custom configurations, known within DISA as the DISA Records Repository (DRR).

Administer or update existing software code for the custom java web application used to manage users/groups.

Subtask 5 – Intranet System Architecture As directed by the Government, develop technical documentation & views and Systems Architect (e.g., OV’s, TV’s, SV’s, etc.)

Perform technical desktop integration for DISA applications.

Subtask 6 – Systems and Database Administration Provide systems and database administration for all CIO application environments (at a minimum, this includes development, test, and production instances includes, but is not limited to, building servers, upgrading operating system versions (e.g., migrate servers from Solaris 8 to 10) Ensure Security Technical Implementation Guides (STIGs) are applied to DISA applications.

Ensure all system and database backup and restoration procedures are available for system and database restoration activities.

Execute Backup schedules in accordance with the schedule identified by the Government.

As directed by the Government, identify roles and responsibilities related to providing data and system backups and provide deficiencies identified to the Government TO/COR in writing.

As directed by the Government, develop, implement and document system and database backup and restoration procedures.

As directed by the Government, conduct technical analysis (via Government available tools) to generate metrics that provide insight into content and system usage.

Subtask 7 – Configuration Management (CM) Develop and implement an overarching configuration management plan providing general procedures, tools, system platforms, personnel, roles, and responsibilities for CIO applications. (CM Plan) Perform configuration management on all production applications, software products, and DISA-specific source code.

Develop and implement a CM plan document for each individual system/application/service which includes: specific CM procedures unique to individual applications.

As requested by the Government, provide training on software configuration management tools, policies, and procedures.

Document the metrics associated with each change to the production system baseline (e.g., version release). Each Version Release Metrics Report shall include:

1. Problem Change Request (PCR) Metrics

a. Number of PCRs originally assigned to release

b. Number of PCRs removed from the release

c. Number of PCRs added to the release

d. Number of Final PCRs assigned to the release

e. Number of PCRs meeting code freeze

f. Number of PCRs deployed to Test

g. Number of PCRs deployed to Test post-Test Window

h. Number of PCRs passed in test environment

i. Number of PCRs deployed to Prod post-Outage Window

j. Number of PCRs that passed initial production verification

k. Number of PCRs that passed final production verification

l. Number of new PCRs generated

2. Resource Expenditure Metrics

a. Total Man-hours spent on development

b. Total Man-hours spent on production deployment

c. Total Man-hours spent on production verification testing

d. Total Man-hours spent on developer fixes (PCR rework)

3. Percentage of Completion

a. Percentage of PCRs making it to test

b. Percentage of PCRs passing initial production verification

c. Percentage of PCRs passing final production verification

4. Named Resources

a. Deployers

b. System/Database Administrators

c. Testers Provide the CM metrics report as an appendix or supporting document to the Software Version Description (SVD) to include the software code, configurations, and PCRs in the system baseline release.

Subtask 8 – Help Desk Support Perform the mission of the DISA CIO Intranet Support Help Desk (unclassified and classified) for CIO managed applications and DISA’s use of DKO.

Monitor the Intranet Support Outlook mailbox (NIPRNet and SIPRNet) and provide technical assistance to resolve the end user’s problems.

Develop and implement policies and procedures for help desk problem troubleshooting and the forwarding of errors to the development team.

Create and manage user accounts to include performing account resets and assisting users with login information, assist users with application functionality.

Perform full lifecycle ticket management.

Revise current Help Desk procedures, to include Remedy (ticket management), Outlook, and Serena Team Track tools.

Subtask 9 – DISA Financial Management System (DFMS) Application

Operate and maintain the DFMS applications, servers, and databases.

As directed by the Government, perform SQL queries, triggers, views, etc. to provide end-users and system managers with the data they need.

Subtask 10 – Knowledge Tree (KT) Application and Database Maintenance

Operate and maintain the KT applications, servers, and databases.

Maintain the KT software.

As directed by the Government, perform a number of workflow development and configuration tasks, user account management activities, and report design and development efforts.

Subtask 11 – SharePoint Application Provide technical direction for all application development projects and initiatives within DISA’s Microsoft SharePoint framework to ensure project completion dates and performance criteria are met.

Design, implement/integrate, and consolidate SharePoint instances with the Agency.

Execute system architecture changes and upgrade plans upon approval by the Government.

Coordinate with Microsoft technical support on all SharePoint related software issues (e.g., deployed customizations and configurations, application administration, system troubleshooting, software patch installation, etc.).

Place of Performance Primary Place of Performance The primary place of performance for this Task Order is the DISA Headquarters buildings located on Fort Meade, MD. The work will primarily be performed in Government provided office space located in the DISA Headquarters buildings. Occasional travel may be required.

Alternate Place of Performance Contractor employees may be required to work at home, another approved DISA activity within the local travel area, or at the Contractor's facility in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, etc.). Any equipment such as laptops or phones provided to Contractor personnel shall be returned at the termination of the engagement or at another time mutually agreeable to both parties. Contracting Officer Representative (COR)/Task Order COR (TO COR) approval is required. Contractor shall prepare all deliverables and other contract documentation utilizing Contractor resources. The Contractor shall continue to provide the same level of support as stated in the PWS. In the event the services are impacted, reduced, compromised, etc., the Contracting Officer may request an equitable adjustment.

Travel and Other Direct Costs Contractor travel is anticipated to support the requirements named in this Task Order. Travel shall be conducted IAW Section H.8 and H.9 of the DESS basic ID/IQ contract. Travel will be established as a Cost Reimbursable CLIN in the Task Order with an estimated amount of $5,000.00 per year. Travel for the 6-month extension of services in accordance with FAR 52.217-8 is estimated to be $2,500.00. The total travel estimated under this Task Order, inclusive of all options and extensions, is $27,500.00.

Period of Performance The period of performance for this Task Order is one-year with four (4) one-year option periods. The Task Order also includes the 6-month Extension of Services in accordance with FAR 52.217-8. The total period of period, inclusive of all options and extensions, is 66 months.

Delivery Schedule All deliverables associated with this Task Order are specified in the Deliverables Appendix (Appendix A).

Task Order Service Level Agreements and Performance Metrics All Service Level Agreements (SLAs) associated with this Task Order are specified in Appendix (Appendix B).

Security Requirements All tasks and subtasks to be performed under this contract are up to and including the SECRET level and positions are IT-II for systems access. All personnel performing services under this Task Order shall be designated ADP Sensitivity Level II (ADP-II), and shall have a favorably completed National Agency Check (NAC), or an Interim SECRET clearance prior to performance.

The Contractor will forward a Visit Authorization Letter (VAL) to the Task Order Contracting Officer Representative (TO/COR) listed at beginning of this Task Order all employees 5 working days prior to the beginning of the Task Order period of performance and as new Contractor employees are assigned to the Task Order.

The VAR/VAL should be sent via one of two methods.

Method One Per direction of DISA Security and the Chief of Security for Computing Services Operations, Visit Authorization Letters (VALs) or Visit Requests (VARs) for Contractor personnel that shall be working for Computing Services on- or off-site shall be forwarded via Joint Personnel Adjudication System (JPAS) to the VAR Center using the following SMO Code: DKABAA10.

For those companies submitting the VALs via JPAS, they shall also provide a copy of the VALs to the TO CORs of the contract for creation of records in the Contractor Verification System (CVS) so that Common Access Cards can be obtained for the Contractors that require them.

Method Two For those companies that do not have the capability to send VALs via JPAS, they can send the VALs via e-mail to the TO CORs. Due to Privacy Act concerns, the VALs shall be e-mailed as a password protected “WinZip” attachment, followed up by a second e-mail containing the password for the first e-mail.

The VAR/VAL shall be on company letterhead or pre-fabricated form and contain the following information:

· Task Order number with start and end dates

· Company point of contact (POC) and telephone number

· Government TO COR name and telephone number

· Complete legal name of employee(s)

· Social Security Number

· Security Clearance level, date granted, and

· Adjudication facility name, i.e. DISCO

· Type of personnel security investigation (PSI) pending or completed

· Date PSI completed

DISA Security Personnel can be contacted for security related questions as follows:

For Industrial Security related issues:

Primary: Ms. Jane A. Doe, phone: (301) 225-XXX Alternate: Mr. John A. Doe, phone: (301) 225-XXXX Defense Information Systems Agency ATTN: MPS61, Industrial Security DISA HQ Complex (Command Bldg) 6910 Cooper Ave Fort Meade, MD, 20755

For Personnel Security related issues to include interim IT access requests:

Primary: Ms Jane A. Doe, phone: (301) 225-XXXX Alternate: Mr. John A. Doe, phone: (301) 225-XXXX Defense Information Systems Agency ATTN: MPS62, Personnel Security DISA HQ Complex (Command Bldg) 6910 Cooper Ave Fort Meade, MD, 20755 Contractor personnel must comply with local security requirements for entry and exit control for personnel and property at the Government facility.

Contractor employees shall be required to comply with all Government security regulations and requirements. Initial and periodic security training and briefings shall be provided by Government security personnel. Personnel who fail to complete the required training by the stated deadlines for completion may have their access to the DISA IT Enterprise revoked and/or be removed from performance on the Task Order.

The Contractor shall not divulge any information about DoD files, data processing activities or functions, user identifications, passwords, or any other knowledge that may be gained, to anyone who is not authorized to have access to such information. The Contractor shall observe and comply with the security provisions in effect at the DoD facility. Identification shall be worn and displayed as required.

DISA retains the right to request removal of Contractor personnel regardless of prior clearance or adjudication status, whose actions, while assigned to this Task Order, clearly conflict with the interest of the Government. The reason for removal shall be fully documented in writing by the Contracting Officer (CO). When and if such removal occurs, the Contractor shall, within 15 working days, fill the vacancy with equally or more qualified personnel than the individual dismissed.

The Privacy Act of 1974 applies. The Contractor may be required to have access to highly sensitive and proprietary information for the performance of this Task Order. The Contractor shall not divulge any information about data processing activities or functions, or any other knowledge that may be gained, to anyone who is not authorized to have access to such information. The Contractor shall observe and comply with the security provisions in effect at computer centers. Any required identification badges shall be worn and displayed at all times. A Department of Defense Contract Security Classification Specification, Form DD 254, must be completed. A DISA Non-Discloser Agreement (NDA) must be completed by each employee prior to commencement of work.

Government-Furnished Equipment (GFE)/Government-Furnished Information (GFI) GFE/Access DISA shall provide the Contractor access to the applicable Local Area Network(s), Personal Computer(s) necessary to accomplish the work tasked under this Task Order. The Contractor, in coordination with the COR/TO COR, shall be responsible for obtaining appropriate approvals for access. Non-DISA site access requirements shall be the sole responsibility of the Contractor.

GFI

A listing of GFI to be provided to the Contractor after Task Order award will be provided and maintained by the Task Monitor COR. As new GFI is made available to the Contractor, or current GFI is updated, the information will be added to the Task Order COR’s list. Other Pertinent Information or Special Considerations Identification of Potential Conflicts of Interest (COI).

The Contractor(s) providing support on this Task Order may be assisting in helping the DISA CIO to establish requirements for new DISA system and/or IT capabilities. Contractor(s) must identify any actual or potential organizational Conflict of Interest (COI) and its plan to avoiding, neutralizing or mitigating such conflicts IAW Sections H.4 and H.5 of the DESS basic ID/IQ contract and DARS 52.209-9000.

Identification of Non-Disclosure Requirements.

The Contractor may have access to sensitive or proprietary information during Task Order (TO) execution. All Contractor employees are required to sign non-disclosure agreements prior to the commencement of performance.

Inspection and Acceptance Criteria.

Task Order deliverable inspection and Acceptance Criteria procedures shall be detailed in the Quality Assurance Surveillance Plan (QASP).

Section 508 Accessibility Standards The following Section 508 Accessibility Standard(s) (Technical Standards and Functional Performance Criteria) are applicable (if box is checked) to this acquisition.

Technical Standards |_| 1194.21 - Software Applications and Operating Systems |_| 1194.22 - Web Based Intranet and Internet Information and Applications |_| 1194.23 - Telecommunications Products |_| 1194.24 - Video and Multimedia Products |_| 1194.25 - Self-Contained, Closed Products |_| 1194.26 - Desktop and Portable Computers |_| 1194.41 - Information, Documentation and Support The Technical Standards above facilitate the assurance that the maximum technical standards are provided to the Offerors. Functional Performance Criteria is the minimally acceptable standards to ensure Section 508 compliance. This block is checked to ensure that the minimally acceptable electronic and information technology (E&IT) products are proposed.

Functional Performance Criteria |_| 1194.31 - Functional Performance Criteria

DESS APPLICATION AND SERVICE MANAGEMENT SUPPORT TASK ORDER DELIVERABLES

APPENDIX A – LIST OF DELIVERABLES/DELIVERABLES TABLE

Page A-4

(System Name)

• Receive a successful internal quality review prior to delivery in accordance with the documents and records control SOP

• Meet Government standards for grammar and spelling, and

• Be useful, clear and complete

>=95%

• In compliance with any DOD or Government standard

>=90%

•Meet functional and business requirements

• Overall Satisfied Customer •% of requirements are met on schedule •=>Satisfactory Survey

>=90

• Response to system outage

•=>Satisfactory Survey; % System/Service Availability

>=98

· % of resources replaced within 30 days

· % accessibility of skilled resource

· •% of resources maintain required certifications

100%

1. Percent of PCRs making it to test – 90%

2. Percent of PCRs passing initial production verification – 90%

3. Percent of PPCRs passing final production verification – 95%

APPENDIX B – SERVICE LEVEL AGREEMENTS (SLA)

Page B-3

DISA IT ENTERPRISE SUPPORT SERVICES (DESS)

QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

1. Contract Title: DISA IT ENTERPRISE SUPPORT SERVICES

2. Task Order: Task Order 0004 - Applications Management

3. Purpose:

a. This plan is designed to provide an effective surveillance method to promote effective Contractor performance. The QASP provides a method for the Contracting Officer and/or Contracting Officer's Representative (COR) and Task Order COR to monitor Contractor performance, advise the Contractor of unsatisfactory performance, and notify the Contracting Officer of continued unsatisfactory performance. The Contractor, not the Government, is responsible for management and quality control to meet the terms of the contract. The role of the Government is to conduct quality assurance to ensure that contract standards are achieved.

b. The QASP shall evaluate the performance of the Contractor in meeting the requirements as described in the DESS Applications Management Support Task Order. The QASP is grounded in the performance standards and, if applicable, incentives of the PWS and all other supporting documentation. The QASP includes: (1) the specific requirements from the Task Order, (2) the applicable performance metrics, (3) the applicable acceptable level of performance, (4) the surveillance methodology used to evaluate performance, (5) incentives/penalties/remedies, and (6) personnel and mechanisms responsible for performance surveillance.

The QASP is intended to accomplish the following:

· Discuss the process of performance measurement;

· Describe the incentive award plan, (if applicable);

· Establish a governance structure for monitoring performance, comparing actual performance against the performance standards, and authorizing reimbursement for earned incentives (if applicable) and,

· Identify the key performance standards and acceptable performance levels that shall be used as both a measure of success and as a basis for incentive awards.

4. Work Requirements:

The Contractor’s performance shall be monitored and evaluated in accordance with the Task Order requirements.

5. Governance

a. Roles and Responsibilities

(1) Contractor

The Contractor shall perform the requirements of the Contract and each TO and provide the necessary evidence of completion metrics and measures to the Government as required.

(2) Government Contracting Officer (KO)

The KO shall ensure that QASP-related processes, to include the payment of incentives and receipt of remedies as approved by the Task Order COR, are executed in conformance with the FAR, the terms of the contract, and the final approved QASP.

A person duly appointed with the authority to enter into, administer, or terminate contracts and make related determinations and findings on behalf of the Government. The KO is located at DISA, Ft. Meade, MD. The KO ensures performance of all necessary actions for effective contracting, ensures compliance with the terms of the contract, and safeguards the interest of the United States in the contractual relationship. The KO is responsible for (1) appointing the DISA Contracting Officer’s Representatives (COR’s), and/or Task Order COR (TO/COR) (2) reviewing the COR’s assessment of the Contractor’s performance and (3) resolving any differences that may exist between the COR’s version and the Contractor’s version. The KO shall determine the appropriate course of action when performance problems occur. The KO is ultimately responsible for the final determination of the adequacy of the Contractor’s performance.

(3) Government Contracting Officer’s Representative (COR)

The COR shall act under KO direction to assist in the administration of the contract at the contract level, and shall coordinate with TO/COR’s for each Task Order, as applicable.

COR – An individual designated, in writing by the KO to act as his/her authorized representative to assist in the technical administration of the contract and Task Orders. The source and authority for a COR is the KO. The COR reports directly to the KO concerning administration matters. Matters pertaining to the Contractor’s failure to perform shall be reported directly to the KO. The duties and limitations of the COR are contained in a written letter of designation. The COR is located at DISA, Ft. Meade, MD. The COR is responsible for the overall technical administration of the contract/Task Orders and assures proper Government surveillance of the Contractor’s performance in accordance with the QASP. While the COR may serve as a direct conduit to provide Government guidance and feedback to the Contractor on technical matters outlined in the contract/Task Orders, he or she is not empowered to make any contractual commitments or to authorize any contractual changes on the Government’s behalf. Changes that the Contractor deems may affect the contract, price, terms or conditions shall be referred to the KO for action. The COR shall have primary responsibility for reviewing the surveillance schedule(s), Surveillance Activity Checklist(s) and surveillance reports submitted by the Technical Monitors (TM’s). The COR may also be responsible for making customers aware of contract requirements, investigating and validating customer complaints and ensuring the Contractor takes appropriate corrective action. The COR shall also have the overall responsibility to maintain accurate and complete documentation of all surveillance activities including minutes of any meetings and all correspondence between the Government and the Contractor. The COR must approve the Contractor’s Quality Control (QC) plan and may request changes to the plan to accommodate, processes, procedures, local SOPs and/or mission requirements. The monthly written feedback shall be provided to the Contractor’s Program Manager by completing the “Performance Objectives Evaluation” (this activity may be designated to the TM).

(4) Task Order Contracting Officer Representative (TO/COR)

There may be numerous TO/COR’s. Each TM is responsible for coordinating, as may be needed, with other TO/COR’s in the same region/Field Command to ensure that the Government goal of integrated operations is supported.

Task Order Contracting Officer Representative (TO/COR). An individual designated, in writing, by the KO to assist the COR to act as his/her authorized representative for the technical administration of individual Task Orders (Task Order Level). The source and authority for a TO/COR is the KO. The TO/COR reports directly to the COR concerning administration matters. Matters pertaining to the Contractor’s failure to perform shall be reported directly to the COR and/or KO. The duties and limitations of the TO/COR are contained in a written letter of designation. TO/COR’s may be appointed for each Task Order. The TO/COR provides detailed technical oversight of the Contractor’s performance in accordance with the QASP and reports his or her findings to the COR in a timely, complete and impartial fashion to support the COR’s technical administration activities of the overall contract. While the TO/COR may serve as a direct conduit to provide Government guidance and feedback to the Contractor on technical matters outlined in the contract/Task Orders, he or she is not empowered to make any contractual commitments or to authorize any contractual changes on the Government’s behalf. Any changes that the Contractor deems may affect contract, price, terms or conditions shall be referred to the COR and KO for action. The TO/COR may provide the Contractor written feedback of the performance on the Task Orders. The TO/COR may use his/her first-hand observations of the Contractor, as well as, the observations of Government personnel and customers in this evaluation. For TO/COR’s with a period of performance that exceeds one month, the TO/COR shall provide written feedback to the COR at the conclusion of the Task Order’s Period of Performance. The monthly written feedback shall be provided to the Contractor’s Program Manager by completing the “Performance Objectives Evaluation,” (this activity is a COR responsibility but may be designated to the TO/COR). For TO/COR where performance is not limited solely to the DISA, Ft Meade, MD location, the Government may assign a lead TO/COR (at DISA HQ) and appoint other (local, alternate or subordinate) TO/COR’s who report to the lead. The lead TO/COR shall receive input from other assigned TO/COR’s to formally approve recommended incentives to the QAEs, as applicable.

(5) Government Quality Assurance Evaluator (QAE)

a. The Government shall appoint subject matter experts (functionally, regionally, globally, etc.) to perform the "quality assurance reviewer” (QAR) duties for each Task Order where incentives are applicable. b. QARs shall have responsibility for monitoring Contractor performance supporting his/her applicable, assigned subset and applying the QASP standards and incentives to that performance. With the concurrence of the TO/COR, the QAR shall recommend the amount of each QASP Incentive to be awarded. (QASP Incentive payments are determined and paid on a by-task paragraph basis within each Task Order. The QARs are aligned with the Task Order structure to ensure that Contractor performance is monitored and rewarded by Government staff that are best positioned to make the recommended incentive decisions.)

6. Methods of Surveillance:

· 100% Inspection. This is usually only the most appropriate method for infrequent tasks or tasks with stringent performance requirements, e.g., where safety or health is a concern. With this method, performance is inspected/evaluated at each occurrence. One hundred percent inspection is too expensive to be used in most cases.

· Random Sampling/Random Monitoring. This is usually the most appropriate method for recurring tasks. With random sampling/monitoring, services are sampled to determine if the level of performance is acceptable. Random sampling/monitoring works best when the number of instances of the services being performed is very large and a statistically valid sample can be obtained. Computer programs may be available to assist in establishing sampling/monitoring procedures.

· Periodic Inspection. This method, sometimes called “planned sampling,” consists of the evaluation of tasks selected on other than a 100 percent or random basis. It may be appropriate for tasks that occur infrequently, and where 100 percent inspection is neither required nor practicable. A predetermined plan for inspecting part of the work is established using subjective judgment and analysis of Agency resources to decide what work to inspect and how frequently to inspect it.

· Customer Input. Although usually not a primary method, this is a valuable supplement to more systematic methods. For example, in a case where random sampling indicates unsatisfactory service, customer complaints can be used as substantiating evidence. In certain situations where customers can be relied upon to complain consistently when the quality of performance is poor, e.g., dining facilities, building services, customer surveys and customer complaints may be a primary surveillance method, and customer satisfaction an appropriate performance standard. In all cases, complaints should be documented, preferably on a standard form.

7. Scope of Performance:

The scope of performance is specified in the Task Order PWS.

8. Performance Standards:

The performance standards are specified in Appendix B, Task Order 0004 – Service Level Agreement Table.

9. Acceptable Quality Level (AQL):

The AQLs are specified in Appendix B, Task Order 0004 – Service Level Agreement Table.

10. Oversight/Surveillance:

The Contracting Officer’s Representative (COR), Task Order Contracting Officer’s Representative (TO/COR) /Other Designee reserves the right to perform oversight and surveillance of Contractor performance at any time, but not as a disruption or impedance to Contractor performance. The Contractor shall be notified immediately (verbally if possible, but always in writing) of any discoveries requiring urgent attention/remedy/resolution. The TO/COR shall monitor outstanding issues until resolution. The TO/COR shall document all notifications, discussions, transmissions on contract matters.

11. Incentives/Remedies:

The performance incentives/remedies will be specified in Appendix B, Task Order 0004 - Service Level Agreement…