NAVAL NETWORK WARFARE COMMAND (NETWARCOM)

Enterprise Cloud – Network Operations – Service Management

QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

1.0 PURPOSE

This Quality Assurance Surveillance Plan (QASP) is a Government developed and applied document used to make sure that systematic quality assurance methods are used in the administration of the

Performance Based Service Contract (PBSC) standards included in this contract. The intent is to ensure that the Contractor performs in accordance with performance metrics set forth in the contract documents, that the Government receives the quality of services called for in the contract and that the Government only pays for the acceptable level of services received.

2.0 AUTHORITY

Authority for issuance of this QASP is provided under FAR 52-212-4(a), Inspection/Acceptance, which provides for inspections and acceptance of the articles, services, and documentation called for in the contract to be accomplished by the Contracting Officer or their duly authorized representative.

3.0 SCOPE

The Contractor, and not the Government, is responsible for management and quality control actions necessary to meet quality standards set forth by the contract. The QASP is put in place to provide

Government surveillance oversight of the Contractor’s quality control efforts to assure that they are timely, effective and are delivering the results specified in the contract. The QASP is not a part of the contract nor is it intended to duplicate the Contractor’s Management Plan. The Government may provide the Contractor an information copy of the QASP as an Attachment to the solicitation to support the

Contractor’s efforts in developing its plan for maintaining the levels of quality anticipated to be delivered under the terms of the contract.

4.0 RESPONSIBILITIES

The Government resources shall have responsibilities for the implementation of this QASP as follows:

• Contracting Officer – The Contracting Officer ensures performance of all necessary actions for effective contracting, ensures compliance with the terms of the contract and safeguards the interests of the United States in the contractual relationship. It is the Contracting Officer that assures the Contractor receives impartial, fair and equitable treatment under the contract. The

Contracting Officer is ultimately responsible for the final determination of the adequacy of the

Contractor’s performance.

• Contracting Officer’s Representative (COR) – An individual designated in writing by the

Contracting Officer to act as his authorized representative to assist in administering a contract.

The source and authority for the COR is the Contracting Officer. COR limitations are contained in the written letter of appointment.

• Procuring Contract Officer (PCO) – The PCO ensures performance of all necessary actions for effective contracting compliance with the terms of the contract and safeguards the interests of the

United States in the contractual relationship. It is the PCO that assures the contractor receives impartial, fair and equitable treatment under the contract. The PCO is ultimately responsible for the final determination of the adequacy of the contractor’s performance.

• Technical Lead (TL) – The TL serves as the front line technical assistant to the COR. The TL provides detailed oversight of the contractors’ performance and reports monthly his or her findings to the COR in a timely complete and impartial fashion. The TL may serve as a direct conduit between the contractor and the COR. The TL cannot require additional work outside the scope of the contract or task order, constitute a change that cause an increase or decrease in the estimated cost of the contract or task order, alter the period of performance of the contract or task order, or change any of the other terms or conditions of the contract or task order.

5.0 METHODS OF QA SURVEILLANCE

The below listed methods of surveillance shall be used in the administration of this QASP. The QASP

Matrix (Attachment 1) describes the methods of surveillance that shall be used to monitor the services and deliverables to be provided under the contract.

• Progress Reports – Contractor shall provide progress reports on deliverables per the

Performance Work Statement (PWS) to the COR and Technical Lead.

• Customer Feedback – Customer feedback may be obtained either from the results of formal customer satisfaction surveys or from random customer complaints. Customer complaints, to be considered valid, must set forth clearly and in writing the detailed nature of the complaint, must be signed and must be forwarded to the Contractor. The Contractor shall maintain a summary log of all formally received customer complaints as well as a copy of each complaint in a documentation file.

• Random Checks/Inspections – Random checks will be conducted to ensure compliance with the

Standard Operating Procedures (SOP). The COR or Technical Point of Contact (TPOC) will conduct the random monitoring.

6.0 DOCUMENTATION

The COR will maintain a complete Quality Assurance Surveillance file. The file shall contain such documents as copies of all receiving reports, evaluations, recommendations, and any other actions related to the Government’s performance of the quality assurance function. All such records will be retained for the life of this contract. At a minimum, the Quality Assurance Surveillance file shall contain:

• Copies of letters of appointment for the COR.

• A copy of the contract and all modifications.

• A copy of the QASP and all subsequent revisions.

• The names and titles of individuals on the contract administration team.

• A record of all accepted receiving reports, required documentation with the submission of each receiving report and reviews.

• Memoranda for the record or minutes of any pre-performance meetings or conferences.

• Memoranda for the record or minutes of any meetings or discussions with the contractor, or others, pertaining to the contract or contract performance or changes to the PWS.

7.0 ANALYSIS OF CONTRACTOR PERFORMANCE

The analysis of contractor performance shall be conducted at the end of each month and serves to provide a summary of the Contractor’s performance to the Contracting Officer and the Contractor. Overall performance is important in determining whether to increase, decrease or maintain the current level of surveillance and/or whether to initiate corrective action to bring the Contractor’s work up to the standards of the specification.

QASP MATRIX

Performance

Element Performance Requirement

Surveillance

Method Frequency

Acceptable Quality

Level (AQL)

Procedures to be taken when performance standards are not met

Program, Security, Financial, Technical, and Documentation Management

Progress Reports

Reports must include the status of support provided in completion of assigned missions (deployments and sustainment) in support of operations and associated tasks prescribed in the

PWS and/or Task Orders.

Review by the

Technical Lead and COR Monthly

95% of reports submitted on time and without rework due to errors.

FAR Clause 52.212-

4(a)

Inspection/Acceptance

Overall Contract

Performance

Overall contract performance of a sufficient quality to earn a

Satisfactory (or higher) rating in the

COR’s annual report on Contractor

Performance.

Assessment by

Technical Lead.

The COR to review and submit in CPAR

Annually

All performance elements rated

Satisfactory (or higher).

FAR Clause 52.212-

4(a)

Inspection/Acceptance

FAR Clause 42.1503

Procedures

Trip Report

Contractor shall provide trip reports and shall include results of trip as related to specific PWS tasks. Trip reports due within 5 working days upon return from trip.

Review by the

Technical Lead and COR

As needed

95% of reports submitted on time and without rework due to errors.

FAR Clause 31.205-

46(a)(7)

Travel costs

Invoicing Monthly invoices per contract procedures are timely and accurate.

Review and acceptance of invoice by the

COR

Monthly

99% of reports submitted on time and without rework due to errors.

FAR Clause 52.212-

4(g)

Inspection/Acceptance

Combatting

Trafficking in

Persons (CTIP)

Contractor shall ensure compliance with FAR 52.222-50 – Combatting

Trafficking in Persons

Inspection by the

COR

Continuous

100% Compliance Non-compliance will be immediately reported to the

Contracting Officer.

Remedies in accordance with FAR

52.222-50 (e).

Contractor

Quality

Assurance Plan

Contractor Quality Assurance Plan are submitted as prescribed in the

PWS. Overall contract performance of sufficient quality to earn a satisfactory or higher rating.

Review by the

Technical Lead and COR

Due within 30 days of POP start and updated annually

98% of reports submitted on time and without rework due to errors.

FAR Clause 52.212-

4(a)

Inspection/Acceptance

Element Performance Requirement

Surveillance

Method Frequency

Acceptable Quality

Level (AQL)

Procedures to be taken when performance standards are not met

Cloud Tenant Service Desk Operations Time to Resolution

(TTR)

Contractor shall acknowledge, diagnose, and resolve incoming service desk tickets within the timeframes specified by the ticket's priority level.

Priority 1: < 4 hours, Priority 2: < 8 hours, Priority 3: < 3 business days.

100% automated review of service desk ticketing system data

Monthly 95% of tickets resolved within the specified TTR each month.

Positive/Negative

CPARS entry. May be used as a factor in future Task Order award decisions.

First Contact

Resolution

(FCR)

Contractor's T2 support staff shall resolve incoming tickets using available knowledge and resources to prevent unnecessary escalation to T3, demonstrating technical proficiency at the appropriate tier.

Automated review of ticketing system data, tracking escalation paths

Monthly (calculated over a 3-month rolling average)

FCR rate is >= 20% over a 3-month rolling average.

Higher FCR rates can be highlighted in

CPARS as a sign of efficiency and may influence future TO awards.

Customer

Satisfaction

(CSAT)

Contractor shall provide professional, effective, and timely customer service, resulting in a high degree of end-user satisfaction, as measured by post-ticket surveys.

Random sampling of post-ticket surveys and direct user feedback captured in BMC

Helix

Quarterly Average CSAT score is >= 4.5/5 for 90% of survey responses per quarter.

Failure to meet it requires a formal

Corrective Action

Report.

Service Operations/Management & Collaborative Integration

Seamless Ticket

Handoff

Tickets requiring transfer between contractors are complete, accurate, and accepted without rework.

Weekly ticket sampling

(random + high-priority incidents).

Automated workflow tracking (handoff timestamps, rejection rates).

Monthly ≥ 95% of tickets accepted on first transfer (no bounce-back).

≤ 2% of tickets missing required fields/artifacts.

100% compliance with Associate

Contractor Agreement

(ACA) data-sharing requirements.

1st occurrence:

Contractor submits

Root Cause +

Corrective Action Plan

(CAP) within 5 business days.

2nd occurrence (within

30 days): Mandatory process retraining + increased sampling

(e.g., 20%).

Chronic failure (3+ months):

Formal Performance

Improvement Plan

(PIP)

Consider withholds tied to SLA degradation.

ACA violation:

Immediate escalation to

Contracting Officer

(CO) and legal review.

Element Performance Requirement

Surveillance

Method Frequency

Acceptable Quality

Level (AQL)

Procedures to be taken when performance standards are not met

Service Operations/Management & Collaborative Integration (continued)

Joint Root Cause

Analysis (RCA)

Participation

For all Priority 1 (P1) incidents, all designated Associate Contractors must actively participate in joint troubleshooting, attend all RCA meetings, and contribute required analysis to the final after-action report.

Attendance review of RCA meeting minutes, AAR reviews

Monthly ≥ 95% attendance for required RCA events.

≥ 90% of RCA deliverables submitted on time.

Qualitative:

Contributions deemed actionable in ≥ 85% of reviews.

Repeated Gaps:

Assign named SME participation requirement

Government-directed corrective actions for

RCA methodology.

Systemic issue:

Require formal RCA training or tool standardization.

Contribution to

Shared

Knowledge

Bases

Contractors shall create and/or update knowledge base articles with troubleshooting steps, "how-to" guides, and resolutions for issues and known errors related to their services to enable faster resolution and higher

FCR rates across the enterprise.

Report via

KMDB or KEDB

(BMC Helix or

FS Hub)

Monthly knowledge base audits, usage analytics, peer and gov review

≥ 4–6 articles/month

(adjust based on contract size).

≥ 90% of articles meet quality standards (no major rework required).

≥ 85% positive usability feedback (if rating system exists).

Initial deficiency:

Require backlog submission within 10 days.

Continued shortfall:

Assign minimum quotas per team

Require KB integration into ticket closure criteria.

Chronic failure: Tie deliverables to award fee or performance rating.

Incident

Response Time

& Success Rate

Contractor shall meet initial response time for service level agreements

(SLA) for all incidents and demonstrate successful resolution. Response

Time: Acknowledge Priority 1 incidents in < 15 mins, P2 in < 30 mins. Success Rate: Measured by resolution within TTR and no incident recurrence within 72 hours.

ITSM Reporting

Dashboard

Monthly ≥ 95% compliance with response time

SLAs.

≥ 90% resolution within SLA.

≤ 3% reopen rate.

≥ 90% first-contact resolution (for applicable tiers).

Repeated SLA breaches:

Shift coverage adjustments.

Critical incident failure: Immediate escalation + after-action RCA within 48 hours.

Chronic underperformance:

CPARS inputs.

Element

Performance Requirement Surveillance

Method

Frequency Acceptable Quality

Level (AQL)

Procedures to be taken when performance standards are not met

Service Operations/Management & Collaborative Integration (continued)

Change

Management &

Deployment

Success

Changes are implemented with minimal disruption and proper authorization.

Change records review, CAB meeting minutes

Monthly Success Rate: 98% of implemented changes do not cause a subsequent P1 or P2 incident.

Authorization: 100% of non-emergency changes possess an approved RFC and

CAB authorization prior to deployment.

Planning Maturity:

10% of all monthly changes are submitted as Emergency

Changes.

Failed change:

Mandatory post-implementation review within 3 days.

Trend in failures:

Require change maturity assessment

Government approval required for higher-risk changes.

Unauthorized change:

Immediate escalation to

CO and potential contract remedy.

Configuration

Management

Database

(CMDB)

Accuracy

Contractor is responsible for maintaining the operational accuracy of all Configuration Items (CIs) under their control within the CMDB. This includes virtual servers, virtual devices, applications, and their inter-relationships to enable rapid incident resolution and safe and accurate change execution..

Cloud Environment

(e.g., Azure, AWS):

Automated State

Verification: The

Government will utilize automated scripts or tools (e.g., via APIs or cloud-native tools) to pull the current operational state of deployed cloud resources.

Reconciliation

Focus: This data is programmatically compared against the enterprise

CMDB to verify that operational attributes (e.g., Hostname, IP

Address, current

OS/Image version, operational status

[running/stopped], and assigned

Support Group) match. It also checks for "rogue" operational instances (systems running in the cloud

Monthly review of automated discrepancy reports generated by ITSM tool suites.

Operational Attribute

Accuracy: 95%

Accuracy. (95% of the

CIs discovered on the network/cloud have matching operational attributes in the

CMDB, such as IP address, active

OS/firmware, and correct Support Group routing assignment).

O&M Relationship

Mapping: 90%

Accuracy. (90% of critical infrastructure

CIs correctly show their upstream/downstream operational dependencies to enable accurate

Incident Impact

Analysis).

Change-Driven CI

Updates: 100%

Compliance. (When the contractor executes an approved

Change Request [e.g., a software patch or

VM resize], the corresponding CI

Failures directly impact the metrics established earlier (FCR and TTR), because an inaccurate

CMDB causes help desk routing errors and delayed troubleshooting.

Tier 1 (First Issue /

Minor Miss - e.g., 90-

94% accuracy):

Action: Documented finding in the monthly performance review.

Requirement:

Contractor must update the inaccurate operational records within 5 business days at no additional cost.

Tier 2 (Repeat

Occurence / Process

Failure):

Action: Issuance of a formal Corrective

Action Request (CAR).

Requirement:

Contractor must deliver a formal Plan of Action that have no operational CI record).

Network

Environment (On-

Premises, Transport, HCI):

Network Discovery

Polling: The

Government will rely on outputs from enterprise network scanning and discovery tools

(e.g., ACAS, SolarWinds, Forescout, or native

CMDB probes).

Reconciliation

Focus: The active scan data is compared against the CMDB to verify the logical presence and operational configuration of the devices on the network. This verifies that if a device is pingable and routing traffic, its corresponding CI in the CMDB accurately reflects its current IP, firmware level, and operational state.

must be updated to reflect the new state prior to closing the

Change ticket).

and Milestones

(POA&M) detailing why their O&M processes (specifically

Change Management) are failing to update the

CMDB, and implement a process fix within 10 business days.

Tier 3 (Systemic

Failure impacting

Operations):

Action: Negative past performance evaluation

(CPARS) entry specifically citing

"Failure to maintain operational baselines, resulting in degraded

Incident Management capabilities."

Impact: Documented failure to maintain the operational CMDB will be used as a negative evaluation factor for future Task Order awards within the IDIQ pool.

CUIT

Requirements

PWS Section

5.2-1

New contract Instructors who are hired prior to mobilization shall complete all requirements for certification in the lesson topic(s) assigned by the ECS

Training Officer within the

Mobilization period utilizing the CUIT process for the ECS COI.

New replacement contract Instructors brought on post mobilization will be required to complete all requirements for certification in the lesson topic(s) assigned by the ECS Training Officer within 90 days of reporting to the

Detachment and full qualification attained in their assigned phase within

9 Months.

TA Reports/COR

Assessment

As needed 100% Inspection

Request immediate corrective action from contractor in accordance with

Quality Assurance Plan and/or request notification of extenuating circumstances, and/or

COR reporting to

Contractor

Performance

Assessment Reporting

System (CPARS), and/or

Reject contractor invoice and request new invoice that reflects decreased level of services delivered

If performance is within acceptable levels, it will be considered to be satisfactory. If not, overall performance may be considered unsatisfactory.

INCENTIVES/DISINCENTIVES:

The COR makes an annual report on Contractor Performance (CPARS or other annual report). The Contractor’s failure to achieve satisfactory performance under the contract, reflected in the COR’s annual report, may result in termination of the contract and may also result in the loss of future Government contracts. Additionally, the

Contractor’s failure to achieve satisfactory performance under the contract may also result in the non-exercise of available options.

For each item that does not meet acceptable levels, the Government may issue a Contract Discrepancy Report (CDR).

CDRs will be forwarded to the Contracting Officer with a copy sent to the Contractor. The Contractor must reply in writing within 5 days of receipt identifying how future occurrences of the problem will be prevented. Based upon the

Contractor’s past performance and plan to solve the problem, the Contracting Officer will determine if any further action will be taken.