S02 - QASP - Security Architecture Services.docx

QUALITY ASSURANCE SURVEILLANCE PLAN

Department of Veterans Affairs (VA) Veterans Health Administration (VHA) Office of Health Informatics (OHI) Office of Health Information Governance (HIG) Health Care Security Requirements (HCSR) Office

Security Architecture Services

QUALITY ASSURANCE SURVEILLA NCE PLAN

For: Security Architecture Services Contract Number: PO no. TBD Contract Description: This requirement involves the gathering of data and transfer of knowledge to the Veterans Health Administration (VHA), Office of Health Informatics (OHI), Office of the Health Information Governance (HIG) Officer, Health Care Security Requirements (HCSR) Office, and the VHA Security Architect managed emerging health technology (EHT) architecture. The contractor (hereafter known as the “Analyst Team”) is tasked with identifying, researching and assessing EHT as potential candidates for improving the quality and efficiency of VHA healthcare. The Analyst Team facilitates entrepreneurial investment for incubation and/or development; builds relationships internally and with industry and other private groups and Government entities for audiences ranging from business and technical to executive. The major focus of the Analyst Team is to conduct core analysis of emerging security and other technology and policy areas, supporting VHA’s Healthcare line of business by providing :

· Technology and Policy Trending,

· Security and Privacy Architectural Artifacts,

· Security and Privacy Requirements and,

· Practical solutions supporting VHA Healthcare business stakeholders, Projects and Programs.

Above figure represents the high-level view of products provided under this contract exclusive of Innovation layer which is externally provided.

Contractor’s Name: TBD

1. Purpose

This Quality Assurance Surveillance Plan (QASP) provides a systematic method to evaluate performance for the stated contract. This QASP explains the following:

· What will be monitored.

· How monitoring will take place.

· Who will conduct the monitoring.

· How monitoring efforts and results will be documented.

This QASP does not detail how the contractor accomplishes the work. Rather, the QASP is created with the premise that the contractor is responsible for management and quality control actions to meet the terms of the contract. It is the Government’s responsibility to be objective, fair, and consistent in evaluating performance.

This QASP is a “living document” and the Government may review and revise it on a regular basis. However, the Government shall coordinate changes with the contractor. Copies of the original QASP and revisions shall be provided to the contractor and Government officials implementing surveillance activities.

2. Government Roles and Responsibilities

The following personnel shall oversee and coordinate surveillance activities.

a. Contracting Officer (CO) - The CO shall ensure performance of all necessary actions for effective contracting, ensure compliance with the contract terms, and shall safeguard the interests of the United States in the contractual relationship. The CO shall also assure that the contractor receives impartial, fair, and equitable treatment under this contract. The CO is ultimately responsible for the final determination of the adequacy of the contractor’s performance.

Assigned CO: Katherine Gibney Assigned CS: Benjamin Niznik Organization or Agency: Department of Veterans Affairs, Program Contracting Activity Central (PCAC).

b. Contracting Officer’s Representative (COR) - The COR is responsible for technical administration of the contract and shall assure proper Government surveillance of the contractor’s performance. The COR shall keep a quality assurance file. The COR is not empowered to make any contractual commitments or to authorize any contractual changes on the Government’s behalf.

Assigned COR: Brian K. Jarrell.

Assigned Alternate COR: Denise Zibura.

c. Other Key Government Personnel: John “Mike” M. Davis, Security Architect/Program Officer; Christopher Shawn, Program Analyst, OHI.

3. Contractor Representatives

The following employees of the contractor serve as the contractor’s program manager for this contract.

a. Program Manager: TBD.

b. Other Contractor Personnel: TBD.

4. Performance Management Approach

The Performance Work Statement (PWS) sets forth “what” service or quality level is required, as opposed to “how” the Contractor should perform the work (i.e., results, not compliance). This QASP will define the performance management approach taken by the Office of Informatics and Analytics (OIA), within the Veterans Health Administration (VHA) of the Department of Veterans Affairs (VA) to monitor the Contractor’s performance to ensure the expected outcomes or performance objectives communicated in the PWS, are achieved. Performance management rests on developing a capability to review and analyze information generated through performance assessment. The ability to make decisions based on the analysis of performance data is the cornerstone of performance management; this analysis yields information that indicates to what extent the expected outcomes for the project are being achieved by the Contractor.

Performance management represents a significant shift from the more traditional quality assurance (QA) concepts in several ways. Performance management focuses on assessing whether outcomes are being achieved and to what extent. This approach migrates away from scrutiny of compliance with the processes and practices used to achieve the outcome. A performance-based approach enables the Contractor to play a large role in how the work is performed, as long as the proposed processes are within the stated constraints. Required processes are those required by law (federal, state, and local) and compelling business situations, such as safety and health. A “results” focus by the Government provides the Contractor flexibility to continuously improve and innovate over the course of the contract as long as the critical outcomes expected are being achieved and/or the desired performance levels are being met.

5. Performance Management Strategy The Contractor is responsible for the quality of all work performed. The Contractor measures that quality through the Contractor’s own quality control (QC) program. QC is work output, not workers, and therefore includes all work performed under this contract, regardless of whether the work is performed by Contractor employees or by Subcontractors. The Contractor’s QC Program (QCP) will set forth the procedures for self-inspecting the quality, timeliness, responsiveness, customer satisfaction, and other performance requirements in the PWS. The Contractor will implement a performance management system with processes to assess and report its performance to the designated Government representative.

The Government representative(s) will monitor performance by the Contractor to determine how the Contractor is performing against performance objectives. The Contractor will be responsible for making required changes in processes and practices to ensure performance is managed effectively. The Contractor will be monitored and assessed throughout the period of performance of the contract as to either meeting or not meeting the performance thresholds stated in the Performance Metrics Section of the PWS. The Contracting Officer’s Representative (COR) will perform annual assessments or at the end of the period of performance if less than a year. The Performance Based Service Assessment Survey, or other method, may be used to document this assessment. A sample Performance Based Service Assessment Survey is provided at the end of this document. When a Contractor performance issue occurs, the Program Manager will notify the COR and Contracting Officer (CO). The COR/CO will engage the Contractor PM to resolve the discrepancy.

6. Performance Feedback At the end of each assessment period, the assessment will be reviewed by the Program Manager and CO. The COR/CO will administer the assessment and provide feedback in accordance with the Federal Acquisition Regulation (FAR) Part 42.

7. Performance Standards Performance Standards define acceptable performance for specific tasks. The Government performs surveillance to determine if the Contractor exceeds, meets, or does not meet these standards.

The Performance Metrics for Deliverables and Performance Standards are outlined in the Performance Work Statement (PWS). The schedule of deliverables is outlined in Section B of the contract. The Government may utilize the Performance Based Service Assessment Survey, provided at the end of this document, or other method to compare Contractor performance to the Acceptable Quality Level (AQL).

Quality of submission should also be considered. Error rates or resubmits for content flaws would be the measures associated with these standards.

Accuracy Work Products shall be accurate in presentation, technical content, and adhere to accepted elements of style.

Clarity Work Products shall be clear and concise. Any/All diagrams shall be easy to understand and relevant to the supporting narrative.

Consistency to Requirements All work products must satisfy the requirements of this PWS.

File Editing All text and diagrammatic files shall be editable by the VA in Windows-based or Adobe environments/platforms.

Format - Follow specified VA Directives or Manuals and/or best business practices.

Presentations - Presentations shall be clear, concise, executive-focused, and written in plain, clear English with minimal jargon and understandable by lay persons. The quality of deliverables directly contributes to the Office of Informatics and Analytics (OIA) communications.

Project Plan - Project Plan shall be comprehensive; recognize and address authority, perceptions, and concerns of stakeholders; incorporate scope of requisite requirements across the OIA.

Reports - There shall be no omissions in the reports, documents, or functional requirements.

Publications and other documents - Deliverables shall be in formats appropriate to target audiences; user friendly, clear, thorough, and comprehensive.

Meeting support - Pre-meeting preparations and logistics; smooth meeting operations; comprehensive post-meeting summaries to include but not limited to: Minutes, Action Items, Attendees, Program Objectives and Milestones and major decision points.

Analyses and Assessments - Analyses and assessments are performed with accuracy, completeness and adherence to industry best practices.

Stakeholder Input - Deliverables shall consist of the timely implementation of input mechanisms, and shall consist of an accurate and comprehensive synthesis of results and recommendations. Integration of relevant stakeholder input documented for deliverable.

8. Methods of QA Surveillance Various methods exist to monitor performance. The COR shall use any or several of the surveillance methods listed below in the administration of this QASP.

100% INSPECTION (of all outcomes).

1. Each year, the COR shall review all of the Contractor’s performance/generated documentation and document results accordingly. This assessment shall be placed in the COR’s QA file.

100% INSPECTION (of a Specific type of Deliverable) in a Specific Area

1. Each year, the COR shall review the Contractor’s performance/generated documentation and document your results accordingly. This assessment shall be placed in the COR’s QA file.

Random Sample

1. Each year, the COR shall review a random sampling of the Contractor’s performance/generated documentation and document the results accordingly. This assessment shall be placed in the COR’s QA file.

Validated Customer Complaint or Validated Below Average Acceptable Level of Performance in a Specific Area

1. Each quarter, the COR shall review the Contractor’s performance/generated documentation corresponding to a validated customer complaint or validated below average acceptable performance level in a specific area and document the results accordingly. This assessment shall be placed in the COR’s QA file.

On-Site Surveillance

1. Each year, the COR shall review and document findings from an on-site surveillance and document results accordingly. This assessment shall be placed in the COR’s QA file.

9. Acceptable Performance Levels Metrics and methods are designed to determine if performance exceeds, meets, or does not meet a given standard and acceptable performance level.

The acceptable performance levels (APLs) are included in the Performance Metrics Section of the PWS for Contractor performance and are structured to allow the Contractor to manage how the work is performed, while providing negative incentives for performance shortfalls.

10. Incentives The Government shall consider the Contractor’s performance when making a determination to exercise any options.

11. Documenting Performance

1. Acceptable Performance The Government shall document acceptable performance accordingly. Any report may become a part of the supporting documentation for any contractual action.

1. Unacceptable Performance When unacceptable performance occurs, the COR shall inform the CO. This will always be in writing although, when circumstances necessitate immediate verbal communication, communication will be followed in writing. The COR shall document the discussion and place it in the COR file.

When the CO determines formal written communication is required, the COR shall prepare a Contract Discrepancy Report (CDR), and present it to the Contractor's program manager.

The Contractor shall acknowledge receipt of the CDR in writing to the CO. The CDR will state how long after receipt the Contractor has to take corrective action. The CDR will also specify if the Contractor is required to prepare a corrective action plan to document how the Contractor shall correct the unacceptable performance and avoid a recurrence. The CO shall review the Contractor's corrective action plan to determine acceptability.

Any CDRs may become a part of the supporting documentation for any contractual action deemed necessary by the CO.

Quality of submission should also be considered. See examples below. Error rates or resubmits for content flaws would be the measures associated with these standards.

· Accuracy - Work Products shall be accurate in presentation, technical content, and adhere to accepted elements of style.

· Clarity - Work Products shall be clear and concise. Any/All diagrams shall be easy to understand and be relevant to the supporting narrative.

· Consistency to Requirements - All work products must satisfy the requirements of this PWS.

· File Editing - All text and diagrammatic files shall be editable by the VA in Windows-based or Adobe environments/platforms.

· Format - Follow specified VA Directives or Manuals and/or best business practices.

· Presentations - Presentations shall be clear, concise, executive-focused, and written in plain, clear English with minimal jargon, understandable by lay persons. The quality of deliverables directly contributes to organizational communications.

· Project Plan - Project Plan shall be comprehensive; recognize and address authority, perceptions, and concerns of stakeholders; incorporate scope of requisite requirements across the organization and/or agency.

· Reports - There shall be no omissions in the reports, documents or functional requirements.

· Publications and other documents - Deliverables shall be in formats appropriate to target audiences; user friendly, clear, thorough and comprehensive.

· Meeting support - Pre-meeting preparations and logistics; smooth meeting operations; comprehensive post-meeting summaries to include but not limited to: Minutes, Action Items, Attendees, Program Objectives, Program Milestones and major decision points.

· Analyses and Assessments - Analyses and assessments are performed with accuracy, completeness and adherence to industry best practices.

· Obtain stakeholder input. Deliverables shall consist of the timely implementation of input mechanisms, and shall consist of an accurate and comprehensive synthesis of results and recommendations. Integration of relevant stakeholder input documented for deliverable.

The following rating definitions can be used as a guide when completing the Performance Based Service Assessment:

Performance Rating Criteria

12. Frequency Of Measurement

1. Frequency of Measurement During contract performance, the COR will periodically analyze whether the negotiated frequency of surveillance is appropriate for the work being performed, and at a minimum shall be twice a year.

1. Frequency of Performance Assessment Meetings The COR shall meet with the Contractor annually to assess performance and shall provide a written assessment to the CO.

PERFORMANCE BASED SERVICE ASSESSMENT

CONTRACT/ORDER NUMBER/ TITLE:

PERIOD COVERED:

Place an X in the appropriate response

Performance Objectives for Assessment

VERY

A. MEETING TECHNICAL NEEDS:

1. What level of understanding does the Contractor have of my technical needs and my mission requirements?

2. What level of efficiency and effectiveness does the Contractor demonstrate in meeting my requirements?

3. Overall, how well does the Contractor meet my technical needs and mission requirements?

4. Overall, the quality of the products/services provided are….

B. PROJECT MILESTONES AND SCHEDULE:

1. How well does the Contractor meet my established milestones and project dates?

2. How timely are products completed, reviewed, and delivered?

3. How would you assess the reasonableness of cost of the services being provided?

4. How well does the Contractor notify me in advance about potential milestones and scheduling problems so that I have enough time to correct them?

C. PROJECT STAFFING:

1. How current is the expertise of those Contractors performing requested tasks?

2. Do Contractor personnel possess the necessary knowledge, skills and ability to accomplish assigned tasks?

3. Are the staffing levels assigned by Contractor appropriate for accomplishing the mission?

D. VALUE OF THE CONTRACTOR:

1. How would you assess the value of the services provided by the Contractor?

2. How do you rate the quality of the products delivered by the Contractor?

3. What overall rating would you give to the Contractor's performance?

Ratings for a Performance Objective are calculated by adding the individual scores under a Performance Objective and dividing it by the number of sub-objectives under that Performance Objective.

****Poor and Below Satisfactory ratings must be explained in Section II (Narrative Clarification) below. Must be supportive and objective.

II NARRATIVE CLARIFICATION

(USE ADDITIONAL SPACE AS REQUIRED)

Typed Name And Title of Government Project Lead/ Date:

image1.jpeg image2.png