QASP_for_Command_IA_Support_Services.pdf

Simplified Acquisition Procedure

Quality Assurance Surveillance Plan

(QASP)

Naval Surface Warfare Center, Corona Division

COMMAND OPERATIONS IA C&A AND TIER 2 SECURITY

ENGINEERING SUPPORT

7 July 2015

Introduction

This Quality Assurance Surveillance Plan (QASP) documents the philosophy and process to be used to monitor and evaluate contractor performance in connection with Command Operations IA C&A and Tier 2 Security Engineering Support Requirement.

The QASP establishes the methodology for measuring performance in the performance work areas and establishing the standard quality level for each task. Tasks are defined as:

• Review/recommend changes to the Code104 IT systems.

• Provide C&A documentation.

• Provide C&A validation.

• Provide Tier 2 Security Engineering Support.

Each of these tasks are reviewed independently and documented as they are completed.

The government retains the prerogative to unilaterally modify the QASP during the life of the Command Operations IA C&A and Tier 2 Security Engineering Support Contract. The paramount objective of this plan, however, remains constant: To ensure that the method for evaluating contractor performance is, to the maximum extent possible, consistently objective, quantitative, and comprehensive.

Quality Assurance

As a performance based service acquisition, the Command Operations IA C&A and Tier 2 Security Engineering Support Contract specifies work tasks in terms of desired outcome. The overriding outcome expected is that the two new systems in Code 104 achieve and ATO status and maintain IA compliance. The contractor will be evaluated in the context of the task requirements in the performance work statement. Performance relative to these task requirements will be evaluated.

Successful completion of these tasks requires proper management of contract work and the generation of high quality outcomes delivered in a timely manner that meet program requirements.

The QASP measures the contractor’s demonstrated performance with respect to the following factors:

Compliance with Contract Requirements, Quality of Deliverables, Efficient Use of Resources, and Job Knowledge.

Surveying Quality of Contract Requirements

The Contractor’s performance will be evaluated on an ongoing basis by Code 104 Department personnel responsible for the overall Command Operations IA C&A and Tier 2 Security Engineering Support. The effort will include both periodic review of the deliverables and an on-going evaluation of the work as it is performed in the Code 104 Department.

Evaluation Categories and Factors

The Contractor’s performance during the contract period shall be judged in the following categories: (1) Technical Performance, and (2) Schedule Performance. Unsatisfactory performance in either of these areas will be addressed to the contractor and they will be requested to correct the deficiencies.

Technical Performance Assessment The Contractor’s technical performance will be evaluated in terms of their ability to deliver high quality products to program sponsors in a timely manner that meets program/contract requirements. Evaluation of the Contractors technical performance will include the following:

- Ability to develop a C&A package which is capable of receiving an ATO.

- Ability to develop the written documentation to support the validation of each system.

- Ability to communicate/collaborate within each step of the C&A process to obtain and maintain an ATO.

- Ability to provide Tier 2 Engineering support to maintain IA compliance.

Performance Ratings

The Government will evaluate the contractor’s performance of the Performance Work Statement and the Contracting Officer will assign one of the following ratings:

(1) Excellent

(2) Satisfactory

(3) Unsatisfactory

The standards associated with these ratings are given in the following Table 1.

Table 1: Overall Performance Ratings

Overall Performance Rating Standard

Excellent “Excellent” ratings for all performance evaluation criteria.

Satisfactory A minimum of “Satisfactory” ratings for all performance evaluation criteria.

Unsatisfactory A rating of “Unsatisfactory” for one or more performance evaluation criteria.

(b) Objectives.

The Contracting Officer will make a performance determination for the TO at the end of each evaluation period.

The determination will be based upon the Subject Matter Expert (SME) or Contracting Officer’s Representative (COR) recommendations, the contractor’s comments including any Self-Evaluation Reports and any other information deemed relevant by the Contracting Officer. The Contracting Officer shall resolve disagreements between the SME’s/COR’s recommendations and the contractor’s comments/reports regarding the evaluation.

The Contracting Officer’s performance evaluation is unilateral and final. The Contracting Officer will document the determination and provide a copy to the contractor within 30 calendar days of receipt of the contractor’s self assessment.

The Government may not exercise an option year term unless the contractor meets the acceptable performance definition during all previous rating periods.

(c) Performance Evaluation Criteria.

The contractor’s performance under this TO will be evaluated using the criteria and standards provided for each objective and identified in Tables 2 through 4 of this QASP.

(d) Organization.

The performance evaluation organization consists of the Contracting Officer, who will serve as the Determining Official, and the SME/COR.

(e) This performance evaluation does not replace any other requirement for evaluating contractor performance that may be required by this contract such as a Contractor Performance Assessment Reporting System (CPARS) report.

TABLE 2: TASK PERFORMANCE EVALUATION CRITERIA AND STANDARDS

CRITERION UNSATISFACTORY SATISFACTORY EXCELLENT

Task Performance

Work product fails to meet Acceptable Quality Levels (AQLs) defined in Performance Requirements Summary Table, Exhibit A.

Work product routinely meets Acceptable Quality Levels (AQLs) defined in Performance Requirements Summary Exhibit A.

Work product frequently exceeds Acceptable Quality Levels (AQLs) defined in Performance Requirements Summary Exhibit A.

Staffing

Contractor provides marginally qualified or unqualified personnel. Lapses in coverage occur regularly.

Contractor provides qualified personnel. Lapses in coverage may occasionally occur and are managed per TO policy.

Contractor provides highly qualified personnel. Contractor reassigns personnel to ensure proper coverage. Actual lapses in coverage occur very rarely, if ever, and are managed per TO policy. Contractor ensures staff training remains current.

Timeliness

Contractor frequently misses deadlines, schedules, or is slow to respond to Government requests or is non-responsive to Government requests.

Contractor routinely meets deadlines, schedules, and responds quickly to Government requests.

Contractor always meets deadlines, schedules, and responds immediately to Government requests.

Table 3: CONTRACT MANAGEMENT PERFORMANCE EVALUATION CRITERIA AND STANDARDS

CRITERION UNSATISFACTORY SATISFACTORY EXCELLENT

Problem Resolution

Problems are unresolved, repetitive, or take excessive Government effort to resolve.

Problems are resolved quickly with minimal Government involvement.

Problems are non-existent or the contractor takes corrective action without Government involvement.

Responsiveness Contractor’s management is unresponsive to Government requests and concerns.

Contractor’s management is responsive to Government requests and concerns.

Contractor’s management takes proactive approach in dealing with Government representatives and anticipates Government concerns.

Communications

Contractor often fails to communicate with Government in an effective and timely manner.

Contractor routinely communicates with Government in an effective and timely manner.

Contractor takes a proactive approach such that communications are almost always clear, effective and timely.

TABLE 4: COST EFFICIENCY PERFORMANCE EVALUATION CRITERIA AND STANDARDS

CRITERION UNSATISFACTORY SATISFACTORY EXCELLENT

Cost Management

Contractor routinely fails to complete the effort within the originally agreed-to estimate cost, i.e. cost overruns frequently occur.

Contractor routinely completes the effort within the originally agreed-to estimated cost.

Contractor provides measures for controlling all costs at estimated costs. Funds and resources are generally used in a cost-effective manner. No major resource management problems are apparent.

Reductions in direct costs to the Government below contract estimated costs are noteworthy.

Contractor provides detailed cost analysis and recommendations to Government for resolution of problems identified. Funds and resources are optimally used to provide the maximum benefit for the funds and resources available.

Documented savings are apparent.

Cost Reporting

Reports are generally late, inaccurate incomplete or unclear.

Reports are timely, accurate, complete and clearly written.

Problems and/or trends are addressed, and an analysis is

Reports are clear, accurate, and pro-active. Problems and/or trends are addressed thoroughly, and the contractor’s recommendations also submitted. and/or corrective plans are implemented and effective.

NOTIFICATION OF DEFICIENT PERFORMANCE

Any Performance deficiency identified during the rating period will be brought to the immediate attention of the COR, who will inform the Contracting Officer of this issue. When contractor performance in any area approaches or reaches a minimum acceptable quality level, or is not fully compliant with the requirements of the TO, the COR will notify the contractor Site Manager of the discrepancy in writing. The contractor will then have two weeks to implement corrective action and to explain the corrective action in writing to the COR. If the contractor’s response resolves the problem, no further action will be taken. If the problem continues after implementation of corrective action, the COR will submit a Contract Discrepancy Report (Exhibit A-CDR) to the contractor.

Unsatisfactory contractor performance that causes significant injury or damage to personnel or equipment, which puts personnel, or equipment unnecessarily at risk, or which results from gross negligence or inattention to standing procedures may result in an immediate CDR with no advance notification by the COR. When the COR submits a CDR, the contractor is required to prepare a formal reply delineating corrective action. If the reply satisfies the COR, no further action will be taken. If replies are unsatisfactory and resolution cannot be obtained, the COR will forward the contractor’s reply along with the recommended action to the Contracting Officer to initiate formal action against the contractor for unsatisfactory performance. When appropriate, Contracting Officer may investigate any event further to determine if all the facts and circumstances surrounding the event were considered in the COR’s recommendation.

Exhibit A

PERFORMANCE REQUIREMENTS SUMMARY (PRS)

Task Area Performance Standard

Acceptable Quality Level

(AQL)

Method of Surveillance

Ability to develop a C&A package which is capable of receiving an ATO.

3 Year Approved Authority to Operate (ATO) granted or maintained.

Annual Reviews completed and submitted.

ATO granted from completed C&A package and accepted by NSWC Corona CIO, ISSM and Ech II, CA, and NAO.

Packages completed and submitted at least 6 months prior to previous ATO expiration.

Government Observation, package checklists, Ech

II, SPAWAR

CA, and NAO feedback.

Annual reviews completed before 14 days of end of annual review cycle for each respective system.

Ability to develop the written documentation to support the validation of each system.

Accepted and Approved Validator artifacts by Navy SPAWAR CA and NAO.

Accepted and Approved Validator artifacts by Navy SPAWAR CA and NAO.

Government Observation, package checklists, Ech

II, SPAWAR

CA, and NAO feedback.

Ability to communicate/collaborate within each step of the C&A process to obtain and maintain an ATO.

Findings Addressed within time frame required by Government.

Findings Addressed within time frame required by Government.

Government Observation, package checklists, Ech

II, SPAWAR

CA, and NAO feedback.

Ability to provide Tier 2 Engineering support to maintain IA compliance.

Security Technical Implementation Guidelines

(STIGS),

checklists, and Inspection/Audit Results.

Tier 2 Engineering Support and Security updates completed within time frame required by the Government.

Findings from STIGs, SCANs, and checklists mitigated to minimum of CAT II (or medium severity) with appropriate countermeasures applied.

Passing Grades/Positive Evaluations from Inspections/Audits.

Government Observation, Compliance Tools, Compliance Scans, Security Technical Implementation Guidelines

(STIGS),

checklists, and Inspection/Audit Results.

EVALUATION OF CONTRACTOR PERFORMANCE

To: Contracting Officers Representative

Date:

Contact: Contractor: XYZ

Task: Survey Period: 1st Quarter FY XX

Method of Surveillance: Task Originator review.

Evaluation of Contractor Performance: Performance Assessment Rating

Timeliness and Quality of Work

Control Of Government Furnished Property

Deliverables

Funds Status Report

Narrative Discussion Of Contractor Performance During Survey Period:

Recommendations:

Prepared By:

Note(s):

1. Evaluation follows PAP Table 1. Performance Rating Criteria.

2. See PAP Section 4.0

APPENDIX A

CONTRACT DISCREPANCY REPORT

DATE AND TIME:

CONTRACT NUMBER:

CONTRACTOR:

SITE:

DESCRIPTION OF DISCREPANCY: (reference SOW/Directive)

DATE(S) OF VERBAL NOTIFICATION:

ORIGINATOR’S SIGNATURE:

ABOVE PORTION OF FORM IS TO BE FILLED OUT BY COR OR ACOR

CONTRACTOR’S RESPONSE AS TO CAUSE, CORRECTIVE ACTION, AND ACTION(S) TO

PREVENT RECURRENCE. CITE APPLICABLE QA PROGRAM PROCEDURES OR NEW QA

PROCEDURES:

SIGNATURE OF CONTRACTOR REPRESENTATIVE:

DATE:

ABOVE PORTION TO BE FILLED OUT BY CONTRACTOR

GOVERNMENT EVALUATION (ACCEPTANCE, PARTIAL ACCEPTANCE, REJECTION):

CLOSE OUT (TO BE FILLED OUT WHEN DISCREPANCY HAS BEEN SATISFACTORILY SOLVED):

FUNCTION

NAME/TITLE

SIGNATURE DATE

ORIGINATOR

CONTRACTOR