S14 Attachment 2 QASP - Digital Collateral eVAULT Re-Compete.doc

Quality Assurance Surveillance Plan (QASP)

Digital Collateral (DCOL) eVault

31 Vision

1 Introduction

1.1 Purpose

1.2 Performance Management Approach

1.3 Performance Management Strategy

2 Roles and Responsibilities

2.1 The Contracting Officer

2.2 The Contracting Officer's Representative

3 Identification of Required Performance Standards / Quality Levels 4 Methodologies to Monitor Performance

4.1 Surveillance Techniques

4.2 Customer Feedback

4.3 Acceptable Quality Levels

5 Quality Assurance Documentation

5.1 The Performance Management Feedback Loop

5.2 Monitoring Forms

6 Analysis of Quality Assurance Assessment

6.1 Determining Performance

6.2 Reporting

6.3 Reviews and Resolution

6.4 Surveillance Matrix

Appendix 1 - Surveillance Matrix Appendix 2 - Corrective Action Report (CAR) Appendix 3 - Customer Complaint Record Appendix 4 - Performance Assessment Report (PAR)

Quality Assurance Surveillance Plan (QASP) Digital Collateral (DCOL) eVault

1 Vision

To obtain a robust electronic vault (“eVault”) solution that is fully integrated with the MERS (Mortgage Electronic Registration System) eRegistry to use as secure storage for eNotes and other Trailing eDocs that serve as collateral for Mortgage Backed Securities (MBS) carrying the Ginnie Mae Guarantee.

1 Introduction

This Quality Assurance Surveillance Plan (QASP) is pursuant to the requirements listed in the Performance Work Statement (PWS) entitled Digital Collateral (DCOL) eVault. This plan sets forth the procedures and guidelines Ginnie Mae will use in ensuring the required performance standards or service levels are achieved by the Contractor.

1.1 Purpose

1.1.1 The purpose of the QASP is to describe the systematic methods used to monitor performance and to identify the required documentation and the resources to be employed. The QASP provides a means for evaluating whether the Contractor is meeting the performance standards/quality levels identified in the PWS and the Contractor's Quality Control Plan (QCP), and to ensure that the Government pays only for the level of services received.

1.1.2 This QASP defines the roles and responsibilities of all members of the Integrated Project Team (IPT), identifies the performance objectives, defines the methodologies used to monitor and evaluate the Contractor's performance, describes quality assurance documentation requirements, and describes the analysis of quality assurance monitoring results.

1.2 Performance Management Approach

1.2.1 The PWS structures the acquisition around "what service or quality level is required", as opposed to "how the Contractor should perform the work" (i.e., results, not compliance). This QASP will define the performance management approach taken by Ginnie Mae to monitor and manage the Contractor's performance to ensure the expected outcomes or performance objectives communicated in the PWS are achieved. Performance management rests on developing a capability to review and analyze information generated through performance assessment. The ability to make decisions based on the analysis of performance data is the cornerstone of performance management; this analysis yields information that indicates whether expected outcomes for the project are being achieved by the Contractor.

1.2.2 Performance management represents a significant shift from the more traditional Quality Assurance (QA) concepts in several ways. Performance management focuses on assessing whether outcomes are being achieved and to what extent. This approach migrates away from scrutiny of compliance with the processes and practices used to achieve the outcome. A performance-based approach enables the Contractor to play a large role in how the work is performed, as long as the proposed processes are within the stated constraints. The only exceptions to process reviews are those required by law (federal, state, and local) and compelling business situations, such as safety and health. A "results focus" provides the Contractor flexibility to continuously improve and innovate over the course of the contract as long as the critical outcomes expected are being achieved and/or the desired performance levels are being met.

1.3 Performance Management Strategy

1.3.1 The Contractor is responsible for the quality of all work performed. The Contractor measures that quality through the Contractor's own Quality Control (QC) program. QC is work output, not workers, and therefore includes all work performed under this contract regardless of whether the work is performed by Contractor employees or by subcontractors. The Contractor's QCP will set forth the staffing and procedures for self-inspecting the quality, timeliness, responsiveness, customer satisfaction, and other performance requirements in the PWS. The Contractor will develop and implement a performance management system with processes to assess and report its performance to the designated government representative. This QASP enables the Government to take advantage of the Contractor's QC program.

1.3.2 The Government representative(s) will monitor performance and review performance reports furnished by the Contractor to determine how the Contractor is performing against communicated performance objectives. The Contractor will be responsible for making required changes in processes and practices to ensure performance is managed effectively.

2 Roles and Responsibilities

The following personnel shall oversee and coordinate surveillance activities.

2.1 The Contracting Officer

The Contracting Officer (CO) is responsible for monitoring contract compliance, contract administration, and cost control and for resolving any differences between the observations documented by the Contracting Officers Representative (COR ) and the Contractor. The CO will designate one full-time COR as the government authority for performance management. The number of additional representatives serving as technical inspectors depends on the complexity of the services measured, as well as the Contractor's performance, and must be identified and designated by the CO.

2.2 The Contracting Officer's Representative

The COR is designated in writing by the CO to act as his or her authorized representative to assist in administering a contract. COR limitations are contained in the written appointment letter. The COR is responsible for technical administration of the project and ensures proper government surveillance of the Contractor's performance. The COR is not empowered to make any contractual commitments or to authorize any contractual changes on the Government's behalf. Any changes that the Contractor deems may affect contract price, terms, or conditions, shall be referred to the CO for action. The COR will have the responsibility for completing QA monitoring forms used to document the inspection and evaluation of the Contractor's work performance. Government surveillance may occur under the inspection of services clause for any service relating to the contract.

3 Identification of Required Performance Standards / Quality Levels

The required performance standards and/or quality levels are included in the PWS and in Appendix 1, "Surveillance Matrix". If the Contractor meets the required service or performance level, it will be paid the monthly amount agreed on in the contract.

4 Methodologies to Monitor Performance

4.1 Surveillance Techniques

In an effort to minimize the performance management burden, simplified surveillance methods shall be used by the Government to evaluate Contractor performance when appropriate. The primary method of surveillance is Periodic Inspection - The COR typically performs the periodic inspection monthly.

4.2 Customer Feedback

The Contractor is expected to establish and maintain professional communication between its employees and customers. The primary objective of this communication is customer satisfaction. Customer satisfaction is the most significant external indicator of the success and effectiveness of all services provided and can be measured through customer complaints.

Performance management drives the Contractor to be customer focused through initially and internally addressing customer complaints and investigating the issues and/or problems. The customer always has the option to communicate complaints to the CO and/or COR as opposed to the Contractor.

Customer complaints, to be considered valid, must set forth clearly and in writing the detailed nature of the complaint, must be signed, and must be forwarded to the COR.

Customer feedback may also be obtained either from the results of formal customer satisfaction surveys or from random customer complaints.

4.3 Acceptable Quality Levels

The Acceptable Quality Levels (AQLs) included in Appendix 1, "Surveillance Matrix", for Contractor performance are structured to allow the Contractor to manage how the work is performed. .

5 Quality Assurance Documentation

5.1 The Performance Management Feedback Loop

The performance management feedback loop begins with the communication of expected outcomes. Performance standards are expressed in the PWS and are assessed using the performance monitoring techniques shown in Appendix 1.

5.2 Monitoring Forms

The Government's QA surveillance, accomplished by the COR, may be reported using the following monitoring forms: Appendix 2 - "Corrective Action Report (CAR)", Appendix 3 - "Customer Complaint Record", and Appendix 4 - "Performance Assessment Report" (PAR). The forms, when completed, will document the Government's assessment of the Contractor's performance under the contract to ensure that the required results are being achieved. The COR will retain a copy of all completed QA surveillance forms.

6 Analysis of Quality Assurance Assessment

6.1 Determining Performance

The Government will use the monitoring methods cited to determine whether the performance standards/service levels/AQLs have been met. If the Contractor has not met the minimum requirements, it may be asked to develop a corrective action plan to show how and by what date it intends to bring performance up to the required levels.

6.2 Reporting

At the end of each month, the COR will prepare a written report summarizing the overall results of the quality assurance surveillance of the Contractor's performance. This written report, which includes the Contractor's submitted monthly report and the completed quality assurance monitoring forms, will become part of the QA documentation. It will enable the Government to demonstrate whether the Contractor is meeting the stated objectives and/or performance standards, including cost/technical/scheduling objectives.

6.3 Reviews and Resolution

6.3.1 The COR may require the Contractor's project manager, or a designated alternate, to meet with the CO, PM, and/or other Government IPT personnel as deemed necessary to discuss performance evaluation. The COR will define a frequency of in-depth reviews with the Contractor, including appropriate self-assessments by the Contractor; however, if the need arises, the Contractor will meet with the COR as often as required or per the Contractor's request. The agenda of the reviews may include:

· Monthly performance assessment,

· Data and trend analysis,

· Issues and concerns of both parties,

· Projected outlook for upcoming months and progress against expected trends, including a corrective action plan analysis,

· Recommendations for improved efficiency and/or effectiveness,

6.3.2 The CO and COR must coordinate and communicate with the Contractor to resolve issues and concerns regarding marginal or unacceptable performance.

6.3.3 The COR and Contractor should jointly formulate tactical and long-term courses of action. Decisions regarding changes to metrics, thresholds, or service levels should be clearly documented. Changes to service levels, procedures, and metrics will be incorporated as a contract modification at the discretion of the CO.

6.4 Surveillance Matrix

The Surveillance Matrix (Appendix 1) is the list of performance objectives and standards that must be performed by the Contractor. This matrix details the method of surveillance the COR will use to validate and inspect these performance elements. Inspection of each element will be documented in the COR file.

Performance objectives define the desired outcomes. Performance standards define the level of service required under the contract to successfully meet the performance objective. The inspection methodology defines how, when, and what will be assessed in measuring performance. The Government performs surveillance, using this QASP, to determine the quality of the Contractor's performance as it relates to the performance element standards. The PRS should be used to form the foundation of the COR's inspection checklist.

In evaluating the quality of contractor’s performance, the following performance ratings may be used.

[If your organization requires that you use a different rating mechanism, insert it here.] Performance

Rating Criteria

Appendix 1 - Surveillance Matrix

5.1 Project Management

5.1.1 Project Work Plan

Deliverables:

A001 Initial Project Work Plan A002 Final Project Work Plan A003 Updated Project Work Plan

a) The contractor shall submit their Initial Project Work Plan at the Kickoff Meeting.

AQL: Zero Deviation

b) The contractor shall provide the Final Project Work Plan within 5 business days of receiving government approval AQL: Two business days

c) Project Work Plans are submitted within 5 business days after the end of the reporting month.

AQL: Two business days

What: The Deliverable

How: Review the Deliverable

Frequency: After receipt

Who: The COR

Incentive: 1% deduction from the associated LIN price for the monthly invoice for non-compliance

Standard(s): Inspection applies to all standards

5.1.2 Monthly Project Status Report

Deliverables:

A004 Monthly Project Status Report

a) The contractor shall provide a Monthly Project Status Report five business days after the end of the month.

AQL: Two business days

What: The Deliverable

Frequency: After receipt

Who: COR

5.1.3 Coordinate a Kick-Off Meeting

Deliverables:

A006 Kickoff Meeting Minutes

a) The contractor shall provide a kickoff meeting agenda at least 3 business days prior to the kickoff meeting.

AQL: Zero Deviation

b) The contractor shall provide a copy of the meeting minutes 5 business days from the end of the kickoff meeting.

AQL: Zero Deviation

What: The Deliverable

Frequency: After receipt

Who: The COR

5.2 eVault

5.2.1 eVault Production and Operations

a) The contractor shall provide an eVault system that can meet the performance specifications listed in this section of the PWS.

5.2.2 eNote Transaction Volume Requirements

a) The contractor shall execute transactions that update the rights holder filed in the MERS eRegistry for a minimum of 50,000 eNotes per year, including for example, transactions that execute transfers of control and/or location.

5.2.3 eNote Storage Volume Requirements

a) The contractor shall have the capacity over the life of the awarded contract to store a minimum of 150,000 copies of the Authoritative Copy of the eNotes for which Ginnie Mae is identified as a rights holder as well as other related eDocs for each such note, including but not limited to copies of title insurance policies or other digitized loan closing files or pool/loan package files.

5.2.4 Batch/Bulk Processing Requirements

a) The contractor shall provide an eVault system can meet the batch/bulk processing requirements of this section in the PWS.

5.2.5 eVault Licensing and User Credentials

Deliverables:

A007 eVault Licensing and User Credentials

a) The contractor shall provide licensing and user credentials within 5 business days from contract award

What: The Deliverable

Frequency: After receipt

Who: The COR

5.2.6 Production Monitoring

Deliverables:

A008 On-Call Technical Support Email A009 Failed Process Notification Email A010 Solution Recommendation Report A011 Periodic Problem Update Email

a) The Contractor shall provide via email within five (5) business days of contract award the contact information for the "on call technical support personnel.

AQL: Zero Deviation

b) The Contractor shall inform the COR via email of any changes to "on call" technical support contact information two (2) business days prior to change.

AQL: Zero Deviation

c) 100% of notification emails are submitted within one hour of problem detection.

AQL: 5% deviation from standard.

What: Deliverables

Frequency: After receipt

Who: The COR

5.2.7 eVault Maintenance

a) The contractor shall conduct continuous maintenance of the eVault system to ensure the system is functioning properly.

5.2.8 Post-Implementation Help-Desk Technical Support

Deliverables:

A012 Monthly Help Desk Ticket Report

a) The contractor shall be reachable within 2 hours from Ginnie Maes initial contact.

AQL: Zero Deviation

a) The contractor shall be reachable within 2 hours from Ginnie Maes initial contact.

What: The Deliverable

Frequency: After receipt

Who: The COR

5.2.9 The Contractor shall correct application software errors.

a) 95% of application software corrections require no further software releases.

AQL: 5% deviation from standard.

5.2.10 API Integrations

a) The contractors eVault Application Programming Interface shall posse integration requirements outlined in section 5.4 of the PWS.

5.2.11 System Integration

a) The Contractor shall provide System Integration Services to ensure eVault system properly interfaces with other applications.

5.2.12 Disaster Recovery Requirements

Deliverables:

A013 DR Plan A014 DR Test

a) The contractor shall conduct a DR Test on an annual basis and provide the results to Ginnie Mae.

AQL: Zero Deviation

b) The contractor shall provide their DR Plan 5 business days after contract award.

What: The Deliverable

Frequency: After receipt

Who: The COR

5.2.13 Support Compliance with eCommerce Laws

a) The contractor shall ensure the storage of eNotes and Trailing eDocs in a manner that is consistent with the provisions of UETA and ESIGN

5.2.14 eVault Environment for Testing Upcoming Code Releases and Patches

Deliverables:

A015 eVault Testing Environment

a) The Contractor shall provide a test environment, other than the UAT environment identified in Section 5.9, that supports test execution with hardware, software and network within 5 business days of contract award.

What: The Deliverable

Frequency: After receipt

Who: The COR

5.2.15 eVault Environment for User Acceptance Testing

a) The contractor shall provide the UAT Testing environment within 5 business days of contract award.

5.2.16 Reporting

a) The contractors eVault system shall be able to generate the reporting requirements of Sections 5.2.16, 5,2.16.1 and 5.2.16.2 of the PWS.

Standard(s): Inspection applies to all standards

5.2.16.1 Standard Audit/Reporting

5.2.16.2 Post-Implementation Custom Reporting

5.2.17 Data Security and System Availability Standards

a) The contractor shall maintain security and availability standards in accordance with requirements in 5.3 of the PWS.

5.2.17.1 Federal Information Technology Security

5.2.17.2 Requirements for Safeguarding Information and Information Systems

5.2.17.3 Privacy Requirements

5.2.17.4 Assessment & Authorization (A&A)

5.2.17.5 Financial Systems

5.2.17.6 Continuous Monitoring

5.2.17.7 Encryption and Protection Standards

5.2.17.8 Multi Factor Authentication for Platform Access

5.2.17.9 Leveraging Cloud-based solutions (where applicable)

5.2.17.10 Personnel Screening

5.2.17.11 Incident handling and reporting (applicable for GSS/Major System acquisitions)

5.2.17.12 Data Jurisdiction

5.3 Transition In Service

Deliverables:

A016 Draft Transition In Plan A017 Final Transition In Plan A018 Transference of Services Emails A019 Transition In Completion Report

a) Submit a draft transition plan 5 business days after contract award AQL: Five (5) business day deviation from standard

b) Submit a final transition plan 15 business days after receiving

Government Comments

AQL: Five (5) business day deviation from standard

c) Send a Transference of Services email 5 business days after completion of the transference of service AQL: Five (5) business day deviation from standard

d) Submit a Transition-In Completion 10 business days after completion of transition-in activities AQL: Five (5) business day deviation from standard

What: The Deliverable

Frequency: After receipt

Who: The COR

5.4 Transition Out Services

Deliverables:

A020 Draft Transition Out Plan A021 Final Transition Out Plan

a) The contractor shall provide a final Transition-Out Plan 90 calendars before the expiration of the contract after receiving government approval.

What: The Deliverable

Frequency: After receipt

Who: The COR

Appendix 2 - Corrective Action Report (CAR)

CORRECTIVE ACTION REPORT (CAR)

(If more space is needed, use reverse and identify by number)

1. CONTRACTOR

2. CONTRACT NUMBER

3. TYPE OF SERVICES

4. FUNCTIONAL AREA

5. SUSPENSE DATE

6. CONTROL NUMBER

7. DEFICIENCY FORMCHECKBOX

MAJOR FORMCHECKBOX

MINOR

FINDING:

FINDING IMPACT:

Please respond with a written corrective action plan that details the corrective action of the cited deficiency, the cause of the deficiency, and actions taken to prevent recurrence by Suspense Date in Block 5. If date was not entered in Block 5, the contractor is not required to provide a response.

8. QUALITY ASSURANCE PERSONNEL (COR)

TYPED NAME AND GRADE

SIGNATURE AND DATE

9. ISSUING AUTHORITY

TYPED NAME AND GRADE

SIGNATURE AND DATE

10. COR RESPONSE TO CONTRACTOR CORRECTIVE ACTION AND ACTION TAKEN TO PREVENT RECURRENCE

11. COR DETERMINATION

FORMCHECKBOX

ACCEPTED FORMCHECKBOX

REJECTED

12. CLOSE DATE

Appendix 3 - Customer Complaint Record

SOURCE OF COMPLAINT

ORGANIZATION

BUILDING NUMBER

INDIVIDUAL

PHONE NUMBER

NATURE OF COMPLAINT

CONTRACT REFERENCE

VALIDATION

DATE/TIME CONTRACTOR INFORMED OF COMPLAINT

ACTION TAKEN BY CONTRACTOR

RECEIVED/VALIDATED BY

Appendix 4 - Performance Assessment Report (PAR)

PERFORMANCE ASSESSMENT REPORT (PAR)

(If more space is needed, use reverse and identify by number)

4. QUALITY ASSURANCE PERSONNEL (COR) SIGNATURE AND DATE

I. PERFORMANCE

7. FORMCHECKBOX

DEFICIENCY (CHECK ALL BOXES THAT APPLY)

FORMCHECKBOX

NEW

FORMCHECKBOX

REPEAT

FORMCHECKBOX

NO DEFICIENCY NOTED

8. SERVICES SUMMARY or PWS PARAGRAPH ITEM REVIEWED

II. CONTRACTOR VALIDATION

11. CONTRACTOR REPRESENTATIVE FORMCHECKBOX

CONCUR FORMCHECKBOX

NON-CONCUR

12. CORRECTIVE ACTION ESTIMATED COMPLETION DATE

13. CONTRACTOR REPRESENTATIVE CORRECTIVE ACTION AND PREVENTION OF RECURRENCE OR REASON FOR NON-CONCURRENCE OF COR CITED DEFICIENCY

III. ACTION CORRECTED

14. FORMCHECKBOX

CONCUR FORMCHECKBOX

NON-CONCUR COR SIGNATURE AND DATE

15. COR REMARKS (REQUIRED)

6. CONTRACTOR REPRESENTATIVE REMARKS