II.H.2 Performance Standards and Performance Requirement Summary Table (PRST).pdf

JANUARY 2022

PR NO.

Performance Standards

Writing Standards: All written work products to include but not limited to project documentation, business cases, architecture diagrams, standard operating procedures, after action reviews, weekly and monthly metrics, and system documentation shall adhere to Federal and DoD plain language standards. The Federal and DoD plain language standards can be found on the following websites:

http://www.plainlanguage.gov/index.cfm http://www.dtic.mil/whs/directives/plainlanguage.html

Performance shall be evaluated using the Quality Assurance Surveillance Plan (QASP) and metrics defined in this SOW. Reports shall contain all the information required by and be in the required government form and shall be complete and accurate before being sent to the Certifying Authority.

Performance Standard Acceptable Quality Level (AQL) Methods of Calculation Meet established delivery milestones in the accepted configuration change requests.

Acceptable deviation is meeting established project milestones at minimum 90% of the time.

However, this deviation shall not occur more than twice per quarter for each task order.

number of on time delivered CR’s divided by the total number of CR’s delivered

Maintain all project documentation to SUBMEPP standards.

Acceptable deviation is maintaining project documentation standards 95% of the time. However, this deviation shall not occur more than twice per quarter for each task order.

number of documents delivered with acceptable first time quality divided by the total number delivered

Mitigate/remediate all system vulnerabilities rated as Critical findings as determined by the DoD standard vulnerability scanner within 5 calendar days of being discovered.

Acceptable deviation is Mitigate/remediate all system vulnerabilities rated as Critical findings 95% of the time within 5 days.

number of on time mitigate/remediate of system vulnerabilities divided by the total number Critical vulnerabilities released

Mitigate/remediate all system vulnerabilities rated as High findings as determined by the DoD standard vulnerability scanner within 7 calendar days of being discovered.

Acceptable deviation is Mitigate/remediate all system vulnerabilities rated as Critical findings 95% of the time within 7 days number of on time mitigate/remediate of system High vulnerabilities divided by the total number High vulnerabilities released http://www.plainlanguage.gov/index.cfm http://www.dtic.mil/whs/directives/plainlanguage.html

JANUARY 2022

PR NO.

Mitigate/remediate all system vulnerabilities rated as Medium/Low as determined by the DoD standard vulnerability scanner within 14 days of being identified.

Acceptable deviation is to remediate 95% of all system vulnerabilities rated Medium/Low within 14 days.Identify to government the vulnerabilities that cannot be remediated and get ISSM Approval for all mitigations and remediation number of on time mitigate/remediate of system vulnerabilities divided by the total number vulnerabilities released.

Ensure all developed or configured solutions are in compliance with

DISA STIGS.

No deviation. COR/QA’s shall check ACAS or current Navy Reporting and Scan tools.

Incentives. Both positive and negative performance shall be documented in past performance reports/database, Contractor Performance Assessment Reporting System, as appropriate and shall be taken into consideration for follow-on work.