QASP - GovInfo-System-Administration-QASP (1).docx

GovInfo System Administration and Support Quality Assurance Surveillance Plan (QASP)

Introduction The purpose of this Quality Assurance Surveillance Plan (QASP) is to evaluate contractor actions while implementing the Statement of Work (SOW). It is designed to provide an effective surveillance method of monitoring contractor performance for each task and deliverable outlined in the SOW. It also provides a systematic method to evaluate the services the contractor is required to furnish.

Standard The contractor is responsible for management and quality control actions to meet the terms of the contract. The contractor shall perform all work required in a satisfactory manner in accordance with the requirements of the SOW. The Contracting Officer’s Representative (COR) shall notify the Contracting Officer (CO) for appropriate action if it is unlikely that the contractor will be able to complete deliverables in accordance with the contract and quality levels identified below.

Contracting Officer The Contracting Officer (CO) is responsible for monitoring contract compliance, contract administration, and cost control and for resolving any differences between the observations documented by the Contracting Officer's Representative (COR) and the contractor. The CO will designate one full-time COR as the government authority for performance management. The number of additional representatives serving as technical inspectors depends on the complexity of the services measured, as well as the contractor’s performance, and must be identified and designated by the CO.

Contracting Officer’s Representative The Contracting Officer’s Representative (COR) is designated in writing by the CO to act as his or her authorized representative to assist in administering a contract. COR limitations are contained in the written appointment letter. The COR is responsible for technical administration of the program and ensures proper Government surveillance of the contractor’s performance. The COR is not empowered to make any contractual commitments or to authorize any contractual changes on the government’s behalf. Any changes that the contractor deems may affect contract price, terms, or conditions shall be referred to the CO for action. The COR will have the responsibility for completing any necessary QA monitoring forms used to document the inspection and evaluation of the contractor’s work performance. Government surveillance may occur under the inspection of supplies clause for any items in scope of the contract.

Performance Requirements Summary The COR will evaluate the performance objectives through surveillance as reflected below by reviews and acceptance of work products and services.

Code, configurations, and dependencies delivered under the contract must have a clean code base, be consistently styled, be functional, be free of medium, high, and critical level security vulnerabilities and must successfully run and deployed to the appropriate integration, QA, stage, production, COOP, or successor environments.

Configurations includes updates to support code and environment changes and patches in all applicable environments.

Clean automation runs (i.e. Ansible) across environments , configurations, and/or services, including monitoring for configuration drift (i.e. dry run or other testing or monitoring methods).

Successful build and/or patching, successful deployment, free of medium, and high, and critical level security vulnerabilities including documentation explaining any false positives or mitigations as appropriate and determined by GPO.

Combination of manual review and configuration output review by Government personnel including clean test results from Program / GPO IT Security / IG monitoring and assessment tools (e.g., Nexpose, Nexus Repository checks, OWASP Dependency checks, sonar, system configuration tests, dry runs), along with documentation explaining any drift from expected baselines or false positives or mitigations.

Update issues within the GovInfo Program’s issue management tools (e.g., Trello, GitLab, Azure DevOps). Provide and update documentation regarding standard operating procedures for system administration, storage management, security management, and build services.

As agreed to with the Program Manager, Product Owner, and COR after contract award.

Issues created and properly updated.

Combination of manual review and the results from automated testing, if available, by Government personnel.

Infrastructure as Code

Create, update, and document processes using infrastructure as code (i.e. Ansible or other approved IaC solutions) as a best practice for tasks, include system administration, storage management, identity management, security administration, or build processes where applicable.

As agreed to with the Program Manager, Product Owner, and COR after contract award.

Issues created and properly updated.

Combination of manual review and the results from automated configuration outputs, if available, by Government personnel.

Updated Quarterly. Technology timeline is in English, and it does not contain spelling or grammatical errors.

Provided in Excel format or another format as proposed by the contractor and agreed to by the COR.

GPO will review updated Technology Timeline for accuracy and completeness, including adjustments from prior baseline.

Functionality in the software / source code is documented.

Documentation is checked in to GPO’s source code management tools (e.g., GitLab, Azure DevOps) and provided to GPO’s IT Configuration Management Branch.

Individual methods, functions, jobs, and tasks in source code are documented using comments.

All products delivered, deployed, and operational in the appropriate environment as appropriate for each sprint or release.

Design documentation and artifacts are updated and checked into source code management tools (e.g., GitLab, Azure DevOps) by the end of each quarterly release for new and updated source code and functionality.

Design documentation deliverables are in English, and they do not contain spelling or grammatical errors.

Combination of manual review and the results from automated testing, if available, by Government personnel.

GPO will evaluate and approve design documentation for accuracy and completeness as part of criteria for deploying a release to production.

Procedures, documentation, and automated scripts updated as appropriate in each sprint or release.

Procedures and documentation are in English, and they do not contain spelling or grammatical errors.

GPO will evaluate and approve support and operations deliverables for accuracy and completeness as part of criteria for deploying a release to production.

Within 5 business days of the beginning of each month.

Logs and the list of completed deliverables are in English, and they do not contain spelling or grammatical errors.

GPO will evaluate and approve logs and the list of completed deliverables for accuracy and completeness.