Attachment_8_-_QASP_-_Task_Order_2_Final_Draft.docx

QUALITY ASSURANCE SURVEILLANCE PLAN

FOR

DTRA Agency-Wide Information Technology Support Services Task Order 2; Cybersecurity Support Services

RFP HDTRA1-18-R-0002

1. Purpose of Contract: The contractor shall provide agency-wide cybersecurity support services to ensure DTRA and its partners have secure and efficient IT capabilities and services necessary to perform the critical DTRA mission, and compliant with DoD mandates and INFOCON requirements. In the performance of this Task Order (TO), the contractor shall provide support services necessary to meet the DTRA Information Integration and Technology Services Directorate (I2TS)/Chief Information Officer’s (CIO) strategic goals consistent with DoD policies and industry best practices. The effective date of the contract is from (insert date) for a base period of five years and one (1) five-year renewable option, thus possibly extending the period of performance to (insert date).

2. Review Responsibilities: TBD will be designated as the Contracting Officer's Representative (COR) for this contract. As COR, TBD is responsible for interfacing with the contractor in the performance of duties such as those set forth below.

3. Methods and Frequency:

3.1 Surveillance will be accomplished in several methods: random basis; weekly, monthly, quarterly and bi-annual reviews. The method used for evaluation will be based upon document reviews, reports, observation, and received customer feedback.

3.2 Timely feedback to the contractor on unacceptable performance will be provided in writing by the COR.

3.3 A summary of any performances that did not meet the terms and conditions of the contract shall be prepared by the COR and forwarded to the Contracting Officer (KO).

3.4 The surveillance report and a summary of the surveillance logs will be prepared by the COR and submitted to the KO annually. The COR may submit out-of-cycle reports to the KO to support claims of unacceptable performance or when there is a significant change in performance that alters the assessment in one or more evaluation areas.

4. Performance Areas:

The following performance areas will be evaluated as described. However, they are not all inclusive, and any service on this contract may be evaluated at any time; all services provided on this contract are subject to inspection and evaluation at any time. Specific performance areas, standards, metrics, acceptable quality levels, and frequency of assessments are shown in the attached QASP Table.

4.1 The contractor will be evaluated on the effectiveness of their task order management. Specifically, the government will evaluate the timeliness of staff on-boarding, timeliness of deliverables, and consistently meeting performance measures in other performance measures within this task order.

4.2 The contractor will be evaluated on their support of Information Assurance (IA) Policy and Planning as defined in the PWS. Specifically, the government will monitor and evaluate …TBD (contractor input on meaningful performance measures are welcome).

4.3 The contractor will be evaluated on their ability to effectively support the I2TS Authorization Official perform required assessments and authorizations. Specifically, the government will monitor and evaluate …TBD (contractor input on meaningful performance measures are welcome).

4.4 The contractor will be evaluated on the consistency and effectiveness of their support to security test and evaluation, and continuous monitoring. Specifically, the government will monitor and evaluate the contractor’s performance based on consistent application and adherence to applicable DoD Instructions and Regulations. (contractor input on meaningful performance measures are welcome)

4.5 The contractor will be evaluated on the effectiveness of support and planning in the area of Supply Chain Risk Management. Specifically, the government will monitor and evaluate …TBD (contractor input on meaningful performance measures are welcome).

4.6 The contractor will be evaluated on the effectiveness of planning and support to the Cybersecurity Service Provider (CSSP). Specifically, the government will monitor and evaluate consistent compliance to cybersecurity standards and passing all DoD CSSP Evaluators Securing Metrics (ESM) reviews. The next re-certification will occur 3rd Quarter FY19.

4.7 The contractor will be evaluated on their COMSEC support activities. Specifically, the government will monitor and evaluate the contractor’s performance based on consistent application and adherence to applicable DoD Instructions and Regulations. (contractor input on meaningful performance measures are welcome)

4.8 The contractor will be evaluated on their ability to effectively transition into full performance following task order award. Specifically, the government will monitor and evaluate the on-boarding of support staff per the transition-in plan included in the contractor proposal.

5. Evaluation Criteria:

· Exceptional: Performance meets contractual requirements and exceeds many to the Government’s benefit. The contractual performance of the element or sub-element being evaluated was accomplished with few minor problems for which corrective actions taken by the contractor were highly effective.

· Very Good: Performance meets contractual requirements and exceeds some to the Government’s benefits. The contractual performance of the element or sub-element being evaluated was accomplished with some minor problems for which corrective action taken by contractor was effective.

· Satisfactory: Performance meets contractual requirements. The contractual performance of the element or sub-element contains some minor problems for which corrective actions taking by the contractor appear or were satisfactory.

· Marginal: Performance does not meet some contractual requirements. The contractor’s performance of the element or sub-element being evaluated reflects a serious problem for which the contractor has not yet identified corrective actions. The contractor’s proposed actions appear only marginally effective or were not fully implemented.

· Unsatisfactory: Performance does not meet most contractual requirements and recovery is not likely in a timely manner. The contractual performance of the element or sub-element contains a serious problem(s) for which the contractor’s corrective actions appear or were ineffective.

6. Surveillance Documents: Documentation used and referenced to perform surveillances will consist of Reports, the Performance Work Statement, the Quality Control Plan, Customer Feedback, and the Surveillance Delivery Summary/Performance Surveillance Checklist. Documentation shall include the date, time, and location of the surveillance; applicable remarks to the surveillance; and signature of the COR. Unsatisfactory ratings must be signed by the contractor.

7. Rating: All contractor tasks will be rated as Exceptional, Satisfactory, Marginal, or Unsatisfactory in the Surveillance Delivery Summary/Performance Surveillance Checklist. At the end of the contract or contract order, the KO will collect the Surveillance Delivery Summary/Performance Surveillance Checklist and any supporting documentation and provide an overall rating for each of the performance areas using the evaluation criteria in Paragraph 5 of this plan.

8. Recording Observations: The Surveillance Delivery Summary/Performance Surveillance Checklist will be used to document observations and problems and rate the individual contractor tasks. The Performance Assessment Report (PAR) Form will be used to record each observed performance issue noted, for performance areas identified in Paragraph 4 or any other tasks identified in the PWS. The Surveillance Checklists and PARs become the formal record for reference. The contractor is told each time a performance issue is found during the observations.

9. Potential Unacceptable Performance: The COR must identify the specific service that is unacceptable and the possible causes and ask a number of questions that will likely identify the source of the problem. The COR shall attempt to resolve the problem with the contractor.

9.1 The COR shall forward the original Surveillance Delivery Summary/Performance Surveillance Checklist and the PAR documenting the observation and attempted solution (along with an evaluation of the results) to the KO, when a specific service becomes unsatisfactory during a surveillance period. The surveillance reports will be used to provide an overall rating for the performance areas identified in Paragraph 4 of this plan.

9.2 The contractor shall complete a response to the unacceptable evaluation if requested by the KO or by its own choice.

10. Taking Action:

10.1 The COR shall evaluate the contractor's performance and document any non- compliance, but only the KO may take action against the contractor for an unacceptable rating.

10.2 When the contractor's performance is unacceptable and a formal action is indicated, the COR and KO will determine what action is appropriate for the specific circumstances. The KO will determine the final action.

11. Records: During the performance of the contract, the COR will retain a copy of all Surveillance Delivery Summary/Performance Surveillance Checklists and Performance Assessment Report (PAR) Forms, with performance issues noted. The Surveillance Delivery Summary/Performance Surveillance Checklist and PARs become the formal record for reference. At the end of the surveillance period, the COR will forward all inspection records to the KO for inclusion in the contract file.

QASP Table

After the initial transition period, the contract shall ensure staffing is available as required to meet performance requirements, and unplanned staff vacancies are held to a minimum.

Staff Transition Metric = # of planned staff positions fully on-boarded at DTRA / # of staff positions scheduled to be onboarded at end of performance period.

Average Staff Availability Metric (Key Personnel) = (Total hours accumulated within period for Key Personnel) / (# of key personnel positions X available workhours in period) Average Staff Availability Metric (Non-Key Personnel) = (Total hours accumulated within period for Non-Key Personnel) / (# of key personnel positions X available workhours in period) 1st Month AQL > 85% 2nd Month AQL > 95% 3rd Month AQL > 98%

Metric begins after transition period AQL for Key Personnel > 95%

AQL for Non-Key Personnel > 90% Data will be collected from Monthly Status Report and compared to Staffing Plan in the Proposal. Metrics will be as of the cut-off date of the MSR. Metric can be validated using DTRA security records.

Data will be collected from MRS and will be as of the cut-off date of the MSR for each period.

NOTE: on-time deliverable assumes the item is accepted as compliant by the government reviewer. A rejected deliverable will be withdrawn from the delivered count and the metric will be recalculated.

Staff Transition Metric = # of planned staff positions fully on-boarded at DTRA / # of staff positions scheduled to be onboarded at end of performance period.

1st Month AQL > 85% 2nd Month AQL > 95% 3rd Month AQL > 98%

The contractor shall collect data to support this metric from their QA program and include the calculated metric in the MSR