Attachment_14_QASP.pdf

Performance Requirements Summary (PRS) Quality Assurance Surveillance

Plan (QASP)

NACCR

2 September 2016

PWS

Para.

Desired

Outcome

Requirement/

Service

Performance

Standard

Acceptable Quality

Level (AQL)

3.1, 3.1.1 and

3.1.2

Program

Management, Post

Award Conference

(PAC) Agendas, Briefing slides, Weekly Meetings and minutes

The Contractor shall conduct and participate in scheduled virtual and on-site meetings, conference calls, present briefings, provide progress overviews, and host a multi-day Post

Award Conference PAC, in the National Capital

Region. The contractor shall provide a PAC agenda, and presentation brief. The contractor shall conduct weekly meetings to provide and discuss status updates, findings, milestones, significant actions, issues or concerns, overall project status, and the discrepancy list.

Meetings and conference calls coordinated, briefings approved by government prior to the start of the meeting, meeting minutes are complete and on time.

For PAC:

- Technically edited documents completed in accordance to templates and standards available for review.

- Complete preliminary

CWBS and technical solution available for review.

-Preliminary system-level engineering document package available for review.

- Solution performance specifications, interface requirements, and preliminary allocation of

HW/SW are identified for review.

Acceptable performance has been met when the quality of the overall technical management strategy provides the ability to identify and preclude problems, or resolve issues; and their use of resources meets customer expectations and schedules supports program goals.

Draft Program Management documents will be delivered no less than 90% complete and on time in accordance with the agreed upon schedule. Final draft documents will be delivered

100% complete within one week of receipt of the document’s due date.

3.1.3 Project Plan

The contractor shall provide a Project Plan for the implementation of the

NACCR Project that includes project phases for each installation location/site work tasks, timelines, milestones, actions that will be taken to mitigate risk to cost, schedule, performance and resources, and contractors approach to configuration management.

Project plan and

Contractor Work

Breakdown Structures are developed, implemented, maintained, updated and current. Risk tracking and the identification of risks are accurate and up to date.

Milestone elements properly identified and tracked. Actuals vs.

planned and completion dates correctly tracked.

Percent completed early/on-time/late, quality and completeness.

Acceptable performance has been met when project plan is developed and maintained at 85% accuracy and that properly represents the project management plans; managing project resources; establishing and implementing management plans, tasks, work products including performance measurement systems; and approving and implementing changes to project baseline schedule and plans and configuration management has been documented and maintained.

Desired

Outcome

Requirement/

Service

Performance

Standard

Acceptable Quality

Level (AQL)

3.2, 3.2.1, 3.2.2, and

3.2.3

Design, Technical

Reviews, Test

Readiness Reviews for SQT Briefing

Presentation, Site

Specific TRR

Briefing

Presentation System

Verification

Reviews, EEVE

Peer Review, NIR

Design Briefing

Presentation, Engineering

Acquisition Support and System

Documentation

Location Specific

Engineering

Document Package

The Contractor shall conduct technical and test readiness , System verification, EEVE Peer, NIR reviews and develop a

System-level and Site-level

Engineering documentation packages, that define the system and systems

Architecture and design, required network services, sub-systems, interfaces, configurations, data flows, power and space requirements, operating systems, HW/SW requirements, IPs, cabling, systems engineer plans;

program environmental, safety and health evaluation; safety documentation; test and evaluation strategy;

requirement traceability matrix; system specification; Cybersecurity

Assurance Strategy;

Information Support Plan, and Architecture Views.

The Contractor shall review and comment on

Engineering Change

Proposals requests for configuration and technical data management support.

The Contractor shall participate in Integrated

Product Team meetings and develop strategy documentation to support the NACCR implementation.

The contractor will coordinate cross functional meetings to draft and complete NACCR documentation in accordance with SETR handbook and other system engineering guidance all documentation (Statutory and Regulatory) as applicable to the project and its ACAT designation.

The Contractor will assist in the entrance and exist of

Technical Reviews, Tests, and Design and Document

Reviews. The contractor will Engineer, Furnish, Install, Secure, and Test

(EFIST) and make operational any ancillary equipment required to support this effort (such as cables, firmware, interfaces, wiring blocks, applications, and racking) to provide a complete solution. Additional standards are identified in each Task Order.

Engineer Documents will be delivered no less than 90% and on time in accordance with the agreed upon schedule. All information provided is current and in the approved template/format.

Technical reviews and meetings are set up in advance to the start time of the meeting. Corrections to documents are done on time and are complete.

Desired

Outcome

Requirement/

Service

Performance

Standard

Acceptable Quality

Level (AQL)

3.2.4 Implementation Plan

Dev 410s

The contractor shall develop Implementation

Plans that details their processes for the implementation of NACCR into the EEVE lab and the

NCR to include the management infrastructure.

Plans shall include contractor details on methods and procedures for the deployment, installation and transition of NACCR at each site.

The implementation plan

(Dev 410s) will at a minimum include: -

NACCR solution overview and system description, tasks involved in the implementation, planning and coordination assumptions, site resources (facilities, materials, and personnel) to install, configure, test, operate, train, sustain and support NACCR, Facility

Assessment timing and assumptions, Details on preparing site facilities to include switch configuration changes, Measures to ensure that all prerequisites have been fulfilled, Criteria for successful completion of the task, Site-specific implementation requirements. Additional standards are identified in each Task Order.

Implementation plan(s) (Dev

401) will be delivered no less than 90% complete and on time in accordance with the agreed upon schedule. All information provided is current and in the approved template/format. Site coordination and planning is complete and documented in the implementation plan. .

Corrections to documents are done on time and complete.

Successful site coordination and capability delivery completed as agreed upon. .

Complete installation of equipment within the agreed time.

Desired

Outcome

Requirement/

Service

Performance

Standard

Acceptable Quality

Level (AQL)

3.2.5, 3.3

3.4 and

3.4.1

Network Access

Control System

Requirements, Installation Services

& Support & Site

Implementation

The contractor shall install

NAC systems at specified locations. The contractor shall EFIST and make operational a fully functional, turn-key, NAC system and an administration terminal.

This implementation shall include programming, installation, applications, data transfer/migration and entry, hardware, software, ancillary equipment, parts, training, and material for all identified services and requirements. The system shall be capable of performing those functions and operating standards identified in Section 4.2 of

CWBS.

NAC system availability, as pertains to the contractor’s area of responsibility, shall be assessed on all contractor installed equipment and cabling. The NAC systems shall meet the capabilities in the NACCR

SSS to be fully operational. The contractor shall integrate the NAC appliance with network timing source for time synchronization and integrate on-site interfaces for receipt and delivery of compliance and remediation activities/tasks. Personnel performing site

Implementation DODI

IASAE Level-II are required to maintain certifications

Acceptable performance has been met when the government accepts the

NACCR capability at each site. The system shall not interfere with NGEN's ability to meet the sustainment

(availability) KPP when the authorized end user device is compliant.

Desired

Outcome

Requirement/

Service

Performance

Standard

Acceptable Quality

Level (AQL)

3.2.6

Facility

Assessment(s)

The contractor shall conduct a Facility

Assessment for each specific installation site.

Facility Assessment

Report will accurately describes the existing site conditions, identifies potential installation problem areas to include the Government’s readiness to proceed, and practicality of existing system reuse. The Facility

Assessment Report shall include a section that identifies facilities improvements required for implementation of the

NAC solution. Existing drawings, diagrams, and other Government

Furnished Information

(GFI) will be available for review through the site point of contact during the

Facility Assessment.

The Facility Assessment

Report shall be submitted no later than (NLT) seven working days after Facility

Assessment has been concluded.

Desired

Outcome

Requirement/

Service

Performance

Standard

Acceptable Quality

Level (AQL)

3.3, 3.3.1, 3.3.2, 3.3.3 and

3.3.4

Testing

Cybersecurity

Support

Product Acceptance

Test

System Qualification

Test

Site Acceptance Test

The contractor shall perform testing and

Cybersecurity of the delivered system to validate that the Government specifications have been met. Coordinate and schedule Test activities.

The contractor shall conduct a Product

Acceptance Test (PAT) in the EEVE lab.

The contractor shall participate in the

Government evaluation of the solution in the NCR.

The contractor shall create site specific test plans, procedures and reports for each Site Acceptance Test and present preliminary test results as part of each site-specific TRR prior to the beginning of the test event.

Marine Corps Order (MCO)

5239.2B establishes an information systems lifecycle management approach to protect critical

Marine Corps information.

The contractor shall execute to the requirements within this order and in accordance with the latest releases or revisions of the cybersecurity policies located in Section 4.3. of the PWS.

Attain and maintain the

NACCR IATT and ATO.

Harden and configure

NACCR in accordance with Defense Information

Systems Agency (DISA)

Security and Technical

Implementation Guides

(STIG) to include automated and manual settings.

Conduct ACAS scans using the DISA Field

Security Operations (FSO) scan policy (GFI) and latest ACAS plugin definitions available on the

DoD Patch Repository

(GFI). Plan, facilitate, and participate in all annual cybersecurity requirements. Analyze, test and apply all

Information Assurance

Vulnerability Alerts

(IAVAs), Information

Assurance Vulnerability

Bulletins (IAVBs), security updates and patches to software and operating systems.

Conduct cybersecurity risk analysis and the contractor shall assist the ISSM in the development and maintenance of accreditation packages required across the entire portfolio of systems as applicable.

Contractor delivers test plan, procedures/scenarios, reports and Cybersecurity products no less than 90% complete and on time in accordance with the agreed upon schedule. Test events coordinated and conducted on time IAW agreed upon schedule. Test activities are properly coordinated, start, and finish on time as scheduled. Draft Test documentation is delivered to no less than 80% complete in accordance with USMC

Integrated T&E standards.

Desired

Outcome

Requirement/

Service

Performance

Standard

Acceptable Quality

Level (AQL)

3.4.2, 3.4.3, 3.4.4, 3.4.5, 3.4.6, and

3.4.7

Logistics Warranty

Support Agreement, Monthly

Maintenance Report

Unique Item

Identifier (UII)

Requirement, Packaging, Handling and Shipping, Disposal &

Counterfeit Parts

Program and

Diminishing

Manufacturing

Sources and Material

Shortages

Receive guidance and direction from the Team

Lead Logistician and provide support for

Logistics activities, to include but not limited to:

meeting support and setup, knowledge of logistics activities applicable to

Programs and their ACAT, conduct analysis, draft and make final logistics documentation, and maintaining accurate

Logistics records. Perform system configuration and comply with the government Configuration

Management processes.

Store, ship, and receive equipment at installation sites. Additional duties identified in each Task

Order to include proper disposal of NACCR items

Meetings set up, documents are drafted in accordance with approved templates, and analysis is current, knowledge of logistics (Statutory and

Regulatory) process in accordance to ACAT designation. Equipment is stored, shipped, and received appropriately.

Logistics support and sustainment documentation and plans are IAW MCSC Fielding and Acquisition Guides, policies, and instructions.

Draft documents are delivered no less than 90% complete and on time, in accordance with the agreed upon schedule. Naval Fielding messages are delivered no less than 99% complete.

Logistics support and Input from the Contractor is relevant and current information. Meetings are set up in advance to the start time of the meeting. Equipment is tracked, received, and shipped to meet established RDDs and disposed of properly IAW

CNSSI4004.1

3.5 Programs Training

Support

The contractor shall

Develop, maintain, and present sustainment and

NET Programs of

Instruction (PoI) and lesson plans for the NACCR solution. Travel is required for this effort. The contractor shall provide

Operator and Administrator

Training course materials and perform training which shall provide training on the

USMC NACCR solution.

POIs are developed as per the Task Order requirements with regard of NET and/or sustainment training. All training shall be conducted during the installation phase, and prior to system cutover for each location.

The contractor shall prepare and provide a draft Training

Plan to include course descriptions, syllabuses, and training schedules for all locations 45 calendar days from contract award date.

The contractor shall provide a final Training Plan NLT 30 calendar days prior to the planned commencement of training at each location. POIs are developed and delivered within the SAT standard. The contractor shall provide manufacturer certified courses tailored for operation and maintenance for the

USMC NACCR solution.

Desired

Outcome

Requirement/

Service

Performance

Standard

Acceptable Quality

Level (AQL)

3.5.1.

3.5.2, and

3.5.3

Operator Training, Systems

Administrator

Training

Documentation &

Technical Manuals

The contractor shall provide

NACCR Technical Manuals for all new systems delivered. The contractor shall provide all necessary

Operator and Administrator training, training materials, documentation, manuals, and training aids at the commencement of training.

Training material shall be provided to each training attendee in hard copy and electronic formats.

Provide step-by-step instruction for NACCR deployment, configuration, integration, monitoring, troubleshooting, operation, management and updating of systems and subsystems.

Include MCEN and

MITSC NACCR

workflow(s), sketches and interfaces.

Detail instructions for

NACCR installation at each MITSC.

Troubleshooting with technical instructions

Preventive and Corrective maintenance procedures.

Help Desk Support and procedures.

Detailed System

Architecture

Warranty Instructions.

Training, Training

Documentation and Technical

Manuals provide step by step detailed instructions for

MCEN and MITSC specific installations and are accurate and complete 90% and on time.

3.5.4

Manpower, Personnel and

Training (MPT)

The contractor shall provide

NACCR solution MPT impacts for all new systems provided under this PWS.

MPT Impact analysis shall include NACCR Manpower and Personnel impacts and changes in force mix across the Enterprise, NACCR Job

Task Analysis, and NACCR

Workload Analysis.

Provide the pertinent information needed to

Effectively identify and perform tasks on the job to operate NACCR solution by identifying the system mission tasks, how

NACCR Operators, Administrators, and maintainers will perform assigned system functions.

Time spent on particular components, processes and tasks. Analysis of the complexity of the

Tasks and required skillsets to perform required tasks.

Acceptable performance had been met when the government accepts

Manpower and Personnel

Impact Analysis, Job Task Analysis, and

Workload Analysis at 90% complete and accurate, delivered on time IAW PWS and CDRLs.

Desired

Outcome

Requirement/

Service

Performance

Standard

Acceptable Quality

Level (AQL)

3.6

Post Implementation

Life Cycle

Sustainment &

Support

The contractor shall provide sustainment and support services to maintain

NACCR solution on the

MCEN-N and MCEN-S.

Provide onsite support to sustain and maintain the installed NACCR solution.

Onsite support shall consist of SME support capable of troubleshooting, documentation, configuration management of policy updates, preventative and corrective maintenance, assisting in problem resolution.

Provide Logistics support.

Provide vulnerability scans, remediation and mitigation activities to maintain NACCR ATO.

Provide industry best practice recommendations, product knowledge improvement recommendations and continuous product support recommendations.

On-site support personnel are required to maintain

DODI 8140 IAT Level-II certification. .

Draft documents are delivered no less than 90% complete and on time, in accordance with the agreed upon schedule. On-site support is made available during normal working hours and during after hour outages 100% of the time. Post

Implementation support personnel are required to maintain required IA certifications 100% of the time.