Attachment_6_-_QASP_-_Agency-Wide_ITSS_Base_Contract_Final_Draft.docx

QUALITY ASSURANCE SURVEILLANCE PLAN

FOR

DTRA Agency-Wide Information Technology Support Services Base Contract – DTRA Core IT Services

RFP HDTRA1-18-R-0002

1. Purpose of Contract: The contractor shall plan, develop, implement, operate, maintain and monitor a DTRA IT infrastructure operations and maintenance program to provide robust, reliable, efficient, and secure IT networks access and availability across all security levels. In the performance of this SOO, the contractor(s) shall provide support services necessary to meet the J6 strategic goals consistent with DoD policies and industry best practices. The effective date of the contract is from (insert date) for a base period of five years and one (1) five-year renewable option, thus possibly extending the period of performance to (insert date).

2. Review Responsibilities: Mr. John Sheffer will be designated as the Contracting Officer's Representative (COR) for this contract. As COR, Mr. Sheffer is responsible for interfacing with the contractor in the performance of duties such as those set forth below.

3. Methods and Frequency:

3.1 Surveillance will be accomplished in several methods: random basis; weekly, monthly, quarterly and bi-annual reviews. The method used for evaluation will be based upon document reviews, reports, observation, and received customer feedback.

3.2 Timely feedback to the contractor on unacceptable performance will be provided in writing by the COR.

3.3 A summary of any performances that did not meet the terms and conditions of the contract shall be prepared by the COR and forwarded to the Contracting Officer (KO).

3.4 The surveillance report and a summary of the surveillance logs will be prepared by the COR and submitted to the KO annually. The COR may submit out-of-cycle reports to the KO to support claims of unacceptable performance or when there is a significant change in performance that alters the assessment in one or more evaluation areas.

4. Performance Areas:

The following performance areas will be evaluated as described. However, they are not all inclusive, and any service on this contract may be evaluated at any time; all services provided on this contract are subject to inspection and evaluation at any time. Specific performance areas, standards, metrics, acceptable quality levels, and frequency of assessments are shown in the attached QASP Table.

4.1 The contractor will be evaluated on network and system availability, network security, security patch deployment and installations, and reliable system back-ups, as these are critical health indicators of IT Core Services.

4.2 The contractor will be evaluated on the service desk call response time, first contact resolution rates, and user service restoration times. In order to support the operational nature of the DTRA mission it is essential that IT services are reliable and uninterrupted. When connectivity or accessibility issues arise, the DTRA mission could be impacted.

4.3 The contractor will be evaluated on their ability to maintain IT security within and between the DTRA IT networks. Incidents must be recognized, reported and neutralized to ensure IT services are neither interrupted nor impacted. Specific performance measures will be based on Cyber Command Readiness Inspection (CCRI) scoring, and vulnerability solution and implementation.

4.4 The contractor will be evaluated on the consistency with which IT assets (software or hardware components of the network) are upgraded, patched, or replaced before they exceed their usefulness and serviceability and impact mission availability or effectiveness.

4.5 The contractor will be evaluated on the consistency with which network provides consistent, reliable, secure and effective delivery of the services available in the DTRA Services Catalog.

5. Evaluation Criteria:

· Exceptional: Indicates performance clearly exceeds contractual requirements. The area of evaluation contains minor problems for which corrective actions appear to be highly effective.

· Satisfactory: Indicates performance clearly meets the contractual requirements. The area of evaluation contains some minor problems for which the corrective actions appear satisfactory.

· Marginal: Indicates performance meets contractual requirements. The area of evaluation contains a serious problem for which corrective actions have not yet been identified, appear only marginally effective, or have not been fully implemented.

· Unsatisfactory: Indicates the contractor is in danger of not being able to satisfy contractual requirements, and recovery is not likely in a timely manner. The area of evaluation contains serious problems for which the corrective actions appear ineffective.

6. Surveillance Documents: Documentation used and referenced to perform surveillances will consist of Reports, the Performance Work Statement, the Quality Control Plan, Customer Feedback, and the Surveillance Delivery Summary/Performance Surveillance Checklist. Documentation shall include the date, time, and location of the surveillance; applicable remarks to the surveillance; and signature of the COR. Unsatisfactory ratings must be signed by the contractor.

7. Rating: All contractor tasks will be rated as Exceptional, Satisfactory, Marginal, or Unsatisfactory in the Surveillance Delivery Summary/Performance Surveillance Checklist. At the end of the contract or contract order, the KO will collect the Surveillance Delivery Summary/Performance Surveillance Checklist and any supporting documentation and provide an overall rating for each of the performance areas using the evaluation criteria in Paragraph 5 of this plan.

8. Recording Observations: The Surveillance Delivery Summary/Performance Surveillance Checklist will be used to document observations and problems and rate the individual contractor tasks. The Performance Assessment Report (PAR) Form will be used to record each observed performance issue noted, for performance areas identified in Paragraph 4 or any other tasks identified in the PWS. The Surveillance Checklists and PARs become the formal record for reference. The contractor is told each time a performance issue is found during the observations.

9. Potential Unacceptable Performance: The COR must identify the specific service that is unacceptable and the possible causes and ask a number of questions that will likely identify the source of the problem. The COR shall attempt to resolve the problem with the contractor.

9.1 The COR shall forward the original Surveillance Delivery Summary/Performance Surveillance Checklist and the PAR documenting the observation and attempted solution (along with an evaluation of the results) to the KO, when a specific service becomes unsatisfactory during a surveillance period. The surveillance reports will be used to provide an overall rating for the performance areas identified in Paragraph 4 of this plan.

9.2 The contractor shall complete a response to the unacceptable evaluation if requested by the KO or by its own choice.

10. Taking Action:

10.1 The COR shall evaluate the contractor's performance and document any non- compliance, but only the KO may take action against the contractor for an unacceptable rating.

10.2 When the contractor's performance is unacceptable and a formal action is indicated, the COR and KO will determine what action is appropriate for the specific circumstances. The KO will determine the final action.

11. Records: During the course of the contract, the COR retains a copy of all Surveillance Delivery Summary/Performance Surveillance Checklists and Performance Assessment Report (PAR) Forms, with performance issues noted. The Surveillance Delivery Summary/Performance Surveillance Checklist and PARs become the formal record for reference. At the end of the surveillance period, the COR will forward all inspection records to the KO for inclusion in the contract file.

QASP Table

For each network, the metric is calculated as follows: Possible Availability = (# of devices) * (seconds in month) Actual Availability = (Possible Availability) - (sum of all outages in seconds for servers as measured in Remedy by taking Asset Outage records and subtracting the Actual Start Time from the Actual End Time) Availability = Actual Availability/Possible Availability

Network Availability AQL > 99%

First Contract Resolution Rate = # of user service restoration incidents (received during performance period) resolved during the initial contact / Total # of user service restoration incidents within the performance period.

Monthly AQL for First Contract Resolution Rate shall be equal to or greater than 75%.

The performance standard for the Seamless New Service Integration Rate is 95%, and will be calculated for each new cloud service added to the Enterprise.