Attachment 3 - QASP.pdf

SOLICITATION N00173-23-R-GF07

ATTACHMENT 3

Quality Assurance Surveillance Plan (QASP)

Radar Division Information Technology Support - 2022

12/09/2022

Version 1.0

1 Scope

2 Purpose

3 Authority

4 Roles and Responsibilities

4.1 Contracting Officer (KO)

4.2 Contracting Officer's Representative (COR)

4.3 Contracting Specialist (CS)

4.4 Contractor Representatives

5 Performance Requirements and Method of Surveillance

5.1 Contract Surveillance

5.2 Surveillance Matrix

5.3 Corrective Action Report (CAR)

Appendix 1 - Surveillance Matrix

Appendix 2 - Corrective Action Report (CAR) Form

Quality Assurance Surveillance Plan (QASP)

NRL Management Information Systems Services

1 Scope

The purpose of this contract is to provide personnel to perform technical services for the Management Information Systems (MIS) Office in the following three areas:

1. Infrastructure

2. Help Desk

3. Application Sustainment

The quality and timeliness of the provider's contribution to the work will be evaluated in terms of its impact on the success of the overall project.

The Contractor will provide system administration and software maintenance necessitated by requirements changes, technological advances, information assurance regulations and the integration of Naval Research Laboratory (NRL) business processes with external Navy and Department of Defense (DoD) systems. The contractor will provide software, test plans and procedures, configuration management, documentation, and hardware/network support necessary to support the needs of multiple offices within NRL. The contractor will additionally provide functional expertise supporting one or more of the various business processes, as required by NRL.

2 Purpose

This Quality Assurance Surveillance Plan (QASP) is a government-developed document used to determine if the contractor's performance meets the performance standards contained in the contract. The QASP establishes procedures on how this assessment/inspection process will be conducted. It provides the detailed process for a continuous oversight process:

What will be monitored

How monitoring will take place

Who will conduct the monitoring

How monitoring efforts and results will be documented

The contractor is responsible for implementing and delivering performance that meets contract standards using its Quality Control Plan. The QASP provides the structure for the government's surveillance of the contractor's performance to assure that it meets contract standards. It is the government's responsibility to be objective, fair and consistent in evaluating contractor performance.

The QASP is not part of the contract nor is it intended to duplicate the contractor's Quality Control Plan. This QASP is a living document. Flexibility in the QASP is required to allow for an increase or decrease in the level of surveillance necessary based on contractor performance.

The government may provide a copy of the QASP to the contractor to facilitate open communication. In addition, the QASP should recognize that unforeseen or uncontrollable circumstances might occur that are outside the control of the contractor.

Bottom line, the QASP should ensure early identification and resolution of performance issues to minimize impact on mission performance.

3 Authority

Authority for issuance of this QASP is provided under Part 46 of the Federal Acquisition Regulation, Inspection of Services clauses, which provides for inspection, acceptance and documentation of the service called for in the contract or order. This acceptance is to be executed by the contracting officer or a duly authorized representative.

4 Roles and Responsibilities

The following personnel shall oversee and coordinate surveillance activities.

4.1 Contracting Officer (KO)

The KO provides primary program oversight, nominates the COR, and ensures the COR is trained before performing any COR duties. The KO ensures performance of all necessary actions for effective contracting, compliance with the contract terms, and is responsible for safeguard the interests of the United States in the contractual relationship. The KO also ensures that the Contractor receives impartial, fair, and equitable treatment under this contract. The KO is responsible for documenting the final assessment of the Contractor's performance in the Government's past performance tracking system.

Assigned KO: Brenda Green Organization or Agency: Naval Research Laboratory Code 3240 Telephone: 202-404-1342 Email: Brenda.Green@nrl.navy.mil

4.2 Contracting Officer's Representative (COR)

The QASP is the primary tool for documenting contractor performance. The COR uses the QASP to conduct the oversight/surveillance process. The COR keeps a Quality Assurance file that accurately documents the contractor's actual performance. The purpose is to ensure that the contractor meets the performance standards contained in the contract. The COR is required to perform an annual performance assessment and record it in the Contractor Performance Assessment Reporting System (CPARS), or replacement system or process.

The COR is responsible for providing continuous technical oversight of the contractor's performance and supports the COR's performance assessment activities. They are not empowered to make any contractual commitments or any contract changes on the government's behalf. The COR is responsible for reporting early identification of performance problems to the KO. While the COR may serve as a direct conduit to provide Government guidance and feedback to the Contractor on technical matters, they are not empowered to make any contractual commitments or any contract changes on the government's behalf.

Assigned COR: Pamela Lowery Organization or Agency: Naval Research Laboratory Code 3030 Telephone: 202-404-3659 Email: Pam.Lowery@nrl.navy.mil

4.3 Contracting Specialist (CS)

The CS will be the KO's primary assistant in the execution of the contract, and will be the contractor's primary point of contract for contractual matters. The COR is not empowered to make any contractual commitments or to authorize any contractual change on the Government's behalf.

Assigned CS: Constance Reedus Organization or Agency: Naval Research Laboratory Code 3240 Telephone: 202-767-3003 Email: Constance.Reedus@nrl.navy.mil

4.4 Contractor Representatives

The following employees of the contractor serve as the contractor's Task Manager for this contract. (Complete this section after the contract award)

Program Manager - <upon award, enter name> Telephone: <upon award, enter number> Email: <upon award, enter address>

5 Performance Requirements and Method of Surveillance

This section describes the special requirements for this effort. The following sub-sections provide details of various considerations on this effort.

5.1 Contract Surveillance

The goal of the QASP is to ensure that contractor performance is effectively monitored and documented. The COR's contribution is their professional, non-adversarial relationships with the KO, CS and the contractor, which enables positive, open and timely communications. The foundation of this relationship is built upon objective, fair, and consistent COR evaluations of contractor performance against contract requirements. The COR uses the methods contained in this QASP to ensure the contractor is in compliance with contract requirements. The COR function is responsible for a wide range of surveillance requirements that effectively measure and evaluate the contractor's performance. Additionally, this QASP is based on the premise that the contractor, not the government, is responsible for management and quality control actions to successfully meet the terms of the contract.

5.1.1 Surveillance Techniques

In an effort to minimize the performance management burden, simplified surveillance methods shall be used by the government to evaluate contractor performance when appropriate. The primary methods of surveillance are:

1. Random monitoring, which shall be performed by the COR.

2. 100% Inspection – Each month, the COR, shall review the generated documentation and enter summary results into the Surveillance Activity Checklist.

3. Periodic Inspection – COR typically performs the periodic inspection on a monthly basis

5.1.2 Customer Feedback

The contractor is expected to establish and maintain professional communication between its employees and customers. The primary objective of this communication is customer satisfaction. Customer satisfaction is the most significant external indicator of the success and effectiveness of all services provided and can be measured through customer complaints.

Performance management drives the contractor to be customer focused through initially and internally addressing customer complaints and investigating the issues and/or problems but the customer always has the option to communicate complaints to the COR, as opposed to the contractor.

Customer complaints, to be considered valid, must set forth clearly and in writing the detailed nature of the complaint, must be signed, and must be forwarded to the COR.

The COR will accept those customer complaints and investigate using the Quality Assurance Monitoring Form identified in Appendix 1.

Customer feedback may also be obtained either from the results of formal customer satisfaction surveys or from random customer complaints.

5.2 Surveillance Matrix

The Surveillance Matrix (Appendix 1) is the list of performance elements and standards that must be performed by the contractor. This matrix details the method of surveillance the COR will use to validate and inspect these performance elements. Inspection of each element will be documented in the COR file.

Performance objectives define the desired outcomes. Performance Standards define the level of service required under the contract to successfully meet the performance objective. The inspection methodology defines how, when, and what will be assessed in measuring performance. The Government performs surveillance using this QASP to determine the quality of the contractor's performance as it relates to the performance element standards. The standards listed below provide the foundation of the COR's performance evaluation.

5.3 Corrective Action Report (CAR)

If Contractor performance in any area covered by the QASP is determined to be unsatisfactory, the COR will issue a Corrective Action Report (CAR) in the format provided in Appendix 2, for contractor action and remediation

In evaluating the quality of contractor’s performance, the following performance ratings will be used.

Performance Rating

Criteria

Exceptional Performance meets contractual requirements and exceeds many to the government’s benefits. The contractual performance of the element or sub-element being assessed was accomplished with no problems and contractor actions were highly effective.

Very Good Performance meets contractual requirements and exceeds some to the government benefits. The contractual performance was accomplished with few minor problems for which corrective actions taken by the contractor were effective.

Satisfactory Performance meets contractual requirements. The contractual performance contains some minor problems for which corrective actions taken by the contractor were satisfactory.

Marginal Performance does not meet some contractual requirements. The contractual performance reflects a serious problem for which the contractor has not yet identified corrective actions. The contractor’s proposed actions appear marginally effective or were not fully implemented.

Unsatisfactory Performance does not meet most contractual requirements and recovery is not likely in a timely manner. The contractual performance contains serious problem(s) for which the contractor’s corrective actions appear or were ineffective.

N/A Will be used to denote a particular element was not performed during the rating period (due to no fault of contractor).

Appendix 1 - Surveillance Matrix

Elements (SOW Section Numbers) Standards/Acceptable Quality Levels

Inspections Ratings

3.5 Infrastructure Inspections will be performed by COR

with one of the three surveillance techniques mentioned.

3.5.1.

Design, Development, and

Administration of Radar Division

Unclassified and Classified Computer

Systems

Inspections will be performed by COR

3.5.1.1

The Contractor Shall provide technical support for Windows Active Directory environments and all component systems.

Inspections will be performed by COR

3.5.1.2

The Contractor shall ensure all hardware and software configurations will comply with DoD Standard Technical

Implementation Guides (STIGs) and any applicable DoD/Navy standards.

Inspections will be performed by COR

3.5.1.3

The Contractor shall provide

Collaboration with tier 1/2 support personnel providing resolution of issues affecting user access that may require action at the server or individual user computer level.

Inspections will be performed by COR

3.5.1.4 The Contractor shall documented

and tracked in an inventory control system used for configuration control and verification of compliance with relevant

NRL/Navy/DoD security requirements.

3.5.1.5 The Contractor shall maintain an

online trouble ticketing system to keep track of requests for assistance, to document resolution of issues, and to communicate issue status with users requesting assistance.

The contractor should response to all request within a 24 hour period.

Issues should begin being resolved within a 72 hour period

Inspections will be performed by COR

3.5.1.6

The Contractor shall provide user support to all users of Radar Division IT equipment to address hardware, software, configuration, and compatibility issues.

The contractor should response to all request within a 24 hour period.

Issues should begin being resolved within a 72 hour period

Inspections will be performed by COR

3.5.1.7

The Contractor shall configure all systems and services to meet Information

Assurance Vulnerability Alert Bulletin

(IAVA/B) compliance requirements as well as all applicable Standard Technical

Implementation Guide (STIG) requirements

Inspections will be performed by COR

3.5.1.7 The Contractor shall support

obtaining and installing DoD certificates to secure required systems and services.

Inspections will be performed by COR

3.5.1.7 The Contractor shall scan systems

for vulnerabilities and findings remediated in a timely fashion.

Vulnerability issues should be addressed immediately upon findings.

Inspections will be performed by COR

3.5.1.8 The Contractor shall maintain

documentation on the design, performance and configuration of all servers, networks, services, and database products in support of Navy Certification

Inspections will be performed by COR and Accreditation requirements.

3.5.1.10

The Contractor shall maintain the login and networking configuration of the current Multifunction Printers and monitor their maintenance and supply status.

3.5.1.11

The Contractor shall maintain the login and networking configuration of the two current Cisco SX80 CODECs that are part of the unclassified and Secure VTC facility maintained by the Radar

Division.

3.5.1.12 Provide backup services for all

production services.

3.5.1.13

The Contractor shall support configuration and maintenance of storage systems such as Promise Technology and

Dell Scalable Storage System..

Inspections will be performed by COR

3.5.2

Design, Development and Administration of Division Level Unclassified and

Classified Linux-Based Computer

Systems and Services.

3.5.2.1

Provide technical and engineering support Linux-based systems and IT services for the Division.

The contractor shall configure and manage Linux servers is required.

3.5.2.2

The Contractor shall Provide management and integration of Linux

Systems into a Windows Domain on

Classified and Unclassified networks.

Inspections will be performed by COR

3.5.2.3

The Contractor shall provide support, configuration and troubleshooting for

Linux Systems

Inspections will be performed by COR

3.5.2.4 The Contractor shall Configure

all systems and services to meet

Information Assurance Vulnerability

Alert Bulletin (IAVA/B) compliance requirements as well as all applicable

Standard Technical Implementation

Guide (STIG)

3.5.2.4 The Contractor shall Obtain and

install DoD certificates.

3.5.2.4 The Contractor shall provide

system scans for vulnerabilities and findings remediated.

Vulnerability issues should be addressed immediately upon findings.

Inspections will be performed by COR

3.5.2.5 The Contractor shall Provide

support in researching and testing new hardware and software products to assure compatibility with current and future information systems environments

Inspections will be performed by COR

3.5.2.6 Provide documentation on the

design, performance and implementation of all servers, networks, services, and database products in support of Navy

Certification and Accreditation requirements.

3.5.2.7 Support configuration and

maintenance of storage systems such as

OSNexus Scalable Storage System.

3.5.3 Computer Cybersecurity (CS) and

Information Assurance (IA)

3.5.3.1 The Contractor shall provide

technical and engineering support toward the design, development, installation, test, and operation of Cybersecurity (CS) and Information Assurance (IA) systems and services.

Inspections will be performed by COR

3.5.3.2 The Contractor shall Participate

in the Navy Certification and

Accreditation process for Radar Division equipment, assisting with all facets of the accreditation review and documentation process.

The Contractor shall provide necessary reports and data to meet mandated accreditation requirements.

3.5.3.3The Contractor shall configure all systems and services to meet Information

Assurance Vulnerability Alert Bulletin

(IAVA/B) compliance requirements.

3.5.3.3 The Contractor shall configure all

systems and services to meet applicable

Standard Technical Implementation

Guide (STIG) requirements.

3.5.4 Infrastructure & Facility Support

3.5.4.1 The Contractor shall provide

technical expertise and engineering support towards the design, installation, implementation and operation of

Division-level storage and file server solutions.

3.5.4.2 The Contractor shall support

managing the computer room facilities at the infrastructure level

Inspections will be performed by COR

Appendix 2 - Corrective Action Report (CAR) Form

CORRECTIVE ACTION REPORT (CAR)

(If more space is needed, use reverse and identify by number)

1. CONTRACTOR

2. CONTRACT NUMBER

3. TYPE OF SERVICES

4. FUNCTIONAL AREA

5. SUSPENSE DATE

6. CONTROL NUMBER

7. DEFICIENCY MAJOR MINOR

FINDING:

FINDING IMPACT:

Please respond with a written corrective action plan that details the corrective action of the cited deficiency, the cause of the deficiency, and actions taken to prevent recurrence by Suspense Date in Block 5. If date was not entered in Block 5, the contractor is not required to provide a response.

8. QUALITY ASSURANCE PERSONNEL (COR)

TYPED NAME AND GRADE

SIGNATURE AND DATE

9. ISSUING AUTHORITY (KO)

TYPED NAME AND GRADE

SIGNATURE AND DATE

10. COR RESPONSE TO CONTRACTOR CORRECTIVE ACTION AND ACTION TAKEN TO PREVENT RECURRENCE

11. COR DETERMINATION

ACCEPTED REJECTED

12. CLOSE DATE