Insert System Characterization (including Tier Level) and list of
available documentation for each system for which you are contracting
document development. This will determine the level of effort required
to complete each document. **THIS IS CRITICAL**.

All documents (hard copy or electronic) produced for this project, as
well as the referenced risk assessments, security plans, contingency
plans, and disaster recovery plans, shall be considered business
sensitive and must be appropriately protected. Access and use of the
Agency LAN and related systems also shall be considered business
sensitive and appropriately protected. The contractor shall release no
information related to this project without written permission from the
CO or designated official. Contractor personnel will be required to sign
a non-disclosure statement.

# Contractor Personnel Requirements

Contractor personnel will be required to have a security classification
that corresponds with the sensitivity level of the tasks to be
performed. Work performed for Mission Critical systems require a level
6\\6C security clearance; Mission Important and Supportive systems
require a level 5\\5C security clearance. Certain elements of the
contracted work which require review of other Mission Critical systems
(such as review of the Agency LAN documentation) require personnel with
a level 6\\6C security clearance. Contractor personnel will be required
to sign a non-disclosure statement. Clearance and non-disclosure
documentation should be submitted to the Computer Security Officer
within 10 business days following award.

# Travel

The Contractor shall not be required to travel to sites beyond the
Washington, D.C. metropolitan area.

**Government-Furnished Equipment (GFE) / Government Furnished Materials
(GFM)**

The Government will not provide GFE. The \[insert Office name\] will
provide or make available the documentation relevant to the specified
tasks.

<table style="width:100%;">
<colgroup>
<col style="width: 12%" />
<col style="width: 0%" />
<col style="width: 0%" />
<col style="width: 18%" />
<col style="width: 28%" />
<col style="width: 0%" />
<col style="width: 13%" />
<col style="width: 5%" />
<col style="width: 7%" />
<col style="width: 11%" />
</colgroup>
<thead>
<tr class="header">
<th colspan="2"><h1 id="desired-outcomes">Desired Outcomes</h1></th>
<th colspan="2"><h1 id="section"></h1>
<h1 id="required-services">Required Services</h1></th>
<th colspan="3"><h1
id="performance-standard-completeness-cost-reliability-accuracy-timeliness-quality">Performance
Standard (Completeness, Cost, Reliability, Accuracy, Timeliness,
Quality)</h1></th>
<th colspan="2"><strong>Acceptable Quality Level (AQL) (Deviation from
Performance Standard)</strong></th>
<th><h1 id="section-1"></h1>
<h1 id="monitoring-method">Monitoring Method</h1></th>
</tr>
</thead>
<tbody>
<tr class="odd">
<td colspan="10"><h1
id="general-conditions-and-standards-for-all-task-areas">General
Conditions and Standards for all Task Areas</h1></td>
</tr>
<tr class="even">
<td colspan="2"><h1
id="high-quality-work-products-that-adequately-complete-the-certification-and-accreditation-requirements-specific-to-the-systems-referenced-in-this-contract.">High
quality work products that adequately complete the certification and
accreditation requirements specific to the systems referenced in this
contract.</h1></td>
<td colspan="2"><ul>
<li><p>All deliverables will be launched with a <strong>Kick-off
Meeting</strong> specific for that document and system.</p></li>
<li><p>Prepare <strong>Work Breakdown Plans (WBP)</strong>.</p></li>
<li><p>The Contractor shall prepare and submit a bi-weekly progress
report.</p></li>
</ul></td>
<td colspan="3"><p>100% of scheduled meetings are attended. The kick-off
meeting will be attended by the contract, Project Manager, security
personnel specific to that system and the functional system manager.</p>
<p>A detailed WBP is delivered to the COR/PM within 10 workdays of the
kick-off meeting. The work plan shall include the following:</p>
<ul>
<li><p>A project plan prepared in a Microsoft Office 2000 product that
provides</p></li>
</ul>
<ul>
<li><p>Key milestones, schedule and staff assignment for the
task.</p></li>
<li><p>Estimated hours by labor category.</p></li>
<li><p>Proposed standards for acceptance of key deliverables.</p></li>
<li><p>Statement of the Contractor's approach to the project, including
a description of specific procedures, methodology, and techniques
employed in developing the specific document</p></li>
<li><p>Requirements that were requested by the COR/PM at the kick-off
meeting.</p></li>
</ul>
<p>The PM and COR will review and approve the plan or return it once for
revision. Subsequent work on any document shall not begin before the
respective work plan is approved by the COR.</p>
<p>Once the WBP is approved by the COR, the Contractor shall provide
three (3) additional copies for the functional system manager, Computer
Security Officer, and System Security Officer.</p>
<p>At a minimum, the bi-weekly report shall include the following
information</p>
<ul>
<li><p><strong>Work performed during the reporting period just
ended</strong></p></li>
<li><p><strong>Work to be performed during the next reporting
period</strong></p></li>
<li><p><strong>Problems encountered with corrective
action</strong></p></li>
<li><p><strong>Any Government action required</strong></p></li>
<li><p><strong>Estimate of the percent complete for each
task</strong></p></li>
</ul>
<ul>
<li><p><strong>Labor hours and funds expended to-date.</strong></p></li>
</ul></td>
<td colspan="2"><p>No deviation unless approved in advance by Project
Manager (PM).</p>
<h1 id="section-2"></h1>
<p>No deviation unless approved in advance by Project Manager (PM).</p>
<p>No deviation unless approved in advance by the PM.</p></td>
<td><h1 id="project-manager-pm-andor-cor-review.">Project Manager (PM)
and/or COR review.</h1>
<p>PM/COR review.</p>
<p>PM/COR review</p></td>
</tr>
<tr class="odd">
<td colspan="2"><h1 id="section-3"></h1></td>
<td colspan="2"><h1 id="prepare-documents.">Prepare documents.</h1></td>
<td colspan="3"><h1
id="work-products-for-a-specific-system-are-well-researched-and-reflect-knowledge-of-any-existing-documentation-for-that-system.-all-documents-should-comply-with-hypothetical-government-agency-guides-nist-and-other-applicable-standards-and-reflect-a-working-knowledge-of-best-practices-in-information-assurance.-all-documents-for-a-specific-system-will-also-address-any-weaknesses-appropriate-to-its-scope-that-have-been-cited-in-a-systems-risk-assessment-baseline-security-requirements-checklist.">Work
products for a specific system are well researched and reflect knowledge
of any existing documentation for that system. All documents should
comply with Hypothetical Government Agency Guides, NIST and other
applicable standards, and reflect a working knowledge of best practices
in information assurance. All documents for a specific system will also
address any weaknesses appropriate to its scope that have been cited in
a system’s Risk Assessment Baseline Security Requirement’s
checklist.</h1>
<h1
id="level-of-effort-for-each-document-will-meet-minimum-standards-for-each-specific-system-according-to-its-tier-level-1-4-as-defined-in-the-hypothetical-government-agency-information-technology-security-certification-and-accreditation-guide.">Level
of Effort for each document will meet minimum standards for each
specific system according to its Tier Level (1-4) as defined in the
<em>Hypothetical Government Agency Information Technology Security
Certification and Accreditation Guide.</em></h1>
<h1 id="section-4"></h1>
<h1
id="all-draft-documents-are-cleared-with-pm-and-a-matrix-in-a-format-provide-by-the-pm-that-details-how-each-comment-was-addressed-is-submitted-with-the-final-version.">All
draft documents are cleared with PM and a matrix (in a format provide by
the PM) that details how each comment was addressed is submitted with
the final version. </h1>
<p>All final documents are delivered in electronic form, completed in a
Microsoft Office 2000 product. Four printed copies of each final
document are also delivered: 1 for the Computer Security Officer, 1 for
the System Security Officer, 1 for the functional system manager and 1
for submission to OFFICE OF THE CHIEF INFORMATION OFFICER Information
Assurance.</p></td>
<td colspan="2"><p>No deviation unless approved in advance by the
PM.</p>
<p>No deviation unless approved in advance by the PM.</p>
<p>No deviation unless approved in advance by the PM.</p></td>
<td><h1 id="pmcor-review.">PM/COR review.</h1>
<p>PM/COR review.</p>
<p>PM/COR review.</p></td>
</tr>
<tr class="even">
<td colspan="10"><h1 id="soo-1-written-system-security-plan-ssp">SOO 1:
Written System Security Plan (SSP)</h1></td>
</tr>
<tr class="odd">
<td>A roadmap for establishing appropriate and adequate security for the
referenced IT system.</td>
<td colspan="3"><p>Written System Security Plan (SSP) for the following
systems:</p>
<ul>
<li></li>
<li></li>
<li></li>
</ul></td>
<td><p>Each SSP must be compliant with NIST Special Publication 800-18,
<em>Guide for Developing Security Plans for Information Technology
Systems</em> and conform to the appropriate Template included in the
NIST guide – whether the SSP is for a General Support System (GSS) or a
Major Application (MA).</p>
<p>All reports are completed within agreed-upon timeframes and contain
the content and conform to standards specifically cited in the
WBP.</p></td>
<td colspan="3"><p>No deviation unless approved in advance by the
PM.</p>
<p>No deviation unless approved in advance by the PM.</p></td>
<td colspan="2"><p>Project Manager (PM) and/or COR review.</p>
<p>Review of contractor reports and assignment logs.</p></td>
</tr>
<tr class="even">
<td colspan="10"><h2 id="soo-2-contingency-plan">SOO 2: Contingency
Plan</h2></td>
</tr>
<tr class="odd">
<td>Improved ability to respond to unplanned events while maintaining
business functionality and security.</td>
<td colspan="3"><p>Written Contingency Plan for the following
systems:</p>
<ul>
<li></li>
<li></li>
</ul></td>
<td><p>Documents and updates are completed IAW the approved WBP</p>
<p>The written contingency planning must be compliant with NIST Special
Publication 800-34, <em>Contingency Planning Guide for Information
Technology Systems</em> and the <em>Hypothetical Government Agency
Contingency Planning Guide</em> (publication expected by
8/31/02)<em>.</em></p>
<p>The Contingency Plan may be incorporated into the system’s SSP or
written as a separate document.</p></td>
<td colspan="3"><p>No deviation unless approved in advance by the
PM.</p>
<p>No deviation unless approved in advance by the PM.</p></td>
<td colspan="2"><p>PM/COR review.</p>
<p>PM/COR review.</p></td>
</tr>
<tr class="even">
<td colspan="10"><strong>SOO 3: Configuration Management
Plan</strong></td>
</tr>
<tr class="odd">
<td>The ability to make changes to the referenced IT system to meet
business needs without sacrificing security or introducing new
weaknesses.</td>
<td colspan="3"><p>Written Configuration Management (CM) Plan for the
following systems:</p>
<ul>
<li></li>
<li></li>
</ul></td>
<td colspan="2"><p>Documents and updates are completed IAW the approved
WBP</p>
<p>CM Plan compliant with the <em>Hypothetical Government Agency
Configuration Management Guide</em> (expected to be published by
8/30/02)<em>.</em> The CM plan may either be incorporated into the
relevant SSP or may be a separate document.</p></td>
<td colspan="2"><p>No deviation unless approved in advance by the
PM.</p>
<p>No deviation unless approved in advance by the PM.</p></td>
<td colspan="2"><p>PM/COR review.</p>
<p>PM/COR review.</p></td>
</tr>
<tr class="even">
<td colspan="10"><h2 id="soo-4-disaster-recovery-plan">SOO 4: Disaster
Recovery Plan</h2></td>
</tr>
<tr class="odd">
<td>Improved ability to respond to catastrophic unplanned events while
maintaining business functionality and security</td>
<td colspan="3"><p>Written Disaster Recovery Plan (DRP) for the
following Tier 3 or 4 systems:</p>
<ul>
<li></li>
<li></li>
</ul></td>
<td><p>Documents and updates are completed IAW the approved WBP</p>
<p>The DRP must be compliant with NIST Special Publication 800-34,
<em>Contingency Planning Guide for Information Technology Systems</em>
and the <em>Hypothetical Government Agency Contingency Planning
Guide</em> (publication expected by 8/31/02)<em>.</em></p>
<p>Support is provided IAW with the approved WBP.</p></td>
<td colspan="3"><p>No deviation unless approved in advance by the
PM.</p>
<p>No deviation unless approved in advance by the PM.</p></td>
<td colspan="2"><p>PM/COR review.</p>
<p>PM/COR review.</p></td>
</tr>
<tr class="even">
<td colspan="10"><h2
id="security-testing-and-evaluation-ste-plan">Security Testing and
Evaluation (ST&amp;E) Plan</h2></td>
</tr>
<tr class="odd">
<td colspan="3">A thorough testing plan that validates the
implementation of documented security controls.</td>
<td><p>Written Security Testing and Evaluation (ST&amp;E) plan for the
following systems:</p>
<ul>
<li></li>
<li></li>
</ul></td>
<td><p>Changes and/or developments to the Plan in are accomplished IAW
the WBP.</p>
<p>The ST&amp;E will comply with Draft <em>NIST Special Publication on
Certification and Accreditation</em> (expected to be posted Summer of
2002), and the <em>Hypothetical Government Agency Information Technology
Security Certification and Accreditation Guide</em>, and the
<em>Hypothetical Government Agency IT System Security Testing and
Evaluation Guide</em> (expected to be published by 9/30/02).</p></td>
<td colspan="3"></td>
<td colspan="2"><p>PM/COR review.</p>
<p>PM/COR review.</p></td>
</tr>
<tr class="even">
<td colspan="10"><h2
id="system-security-authorization-agreement-saa">System Security
Authorization Agreement (SAA)</h2></td>
</tr>
<tr class="odd">
<td>A cohesive overview of the security posture of the referenced
system.</td>
<td colspan="3"><p>Written System Security Authorization Agreement
(SSAA) for the following systems:</p>
<ul>
<li></li>
<li></li>
</ul></td>
<td><p>Documents are developed IAW the approved WBP.</p>
<p>The SSAA will comply with Draft <em>NIST Special Publication on
Certification and Accreditation</em> (expected to be posted Summer of
2002), and the <em>Hypothetical Government Agency Information Technology
Security Certification and Accreditation Guide</em>. <strong>Please note
that if the NIST Draft Special Publication on Certification and
Accreditation (expected Summer of 2002) does away with the SSAA and
instead, incorporates its functionality into the SSP, then the SSP
developed under this Task Order should likewise accommodate this
functionality.</strong></p></td>
<td colspan="3"><p>No deviation unless approved in advance by the
PM.</p>
<p>No deviation unless approved in advance by the PM.</p>
<p>.</p></td>
<td colspan="2"><p>PM/COR review.</p>
<p>PM/COR review.</p></td>
</tr>
<tr class="even">
<td colspan="10"><h3
id="incentivesdisincentives-for-not-meeting-aqls">INCENTIVES/DISINCENTIVES
FOR NOT MEETING AQLs</h3></td>
</tr>
<tr class="odd">
<td colspan="10"><p>The contractor’s performance in meeting the
standards in the above PWS will be assessed and documented in Past
Performance records that will be reviewed by Hypothetical Government
Agency and other federal agencies as part of their source selection
decisions.</p>
<p>Although this is a time and materials contract, no additional costs
will be paid to the contractor to correct deficiencies in any final work
product that in the contracting officer’s judgment, does not meet the
acceptable quality level. If such a situation should occur, the contract
shall immediately provide an invoice covering hours previously
worked.</p></td>
</tr>
</tbody>
</table>

**Hypothetical Government Agency**

**Quality Assurance Surveillance Plan**

List the contract number and task order number here

**Purpose**

This Quality Assurance Surveillance Plan (QASP) is a
Government-developed and applied document used to ensure that systematic
quality assurance methods are used in the administration of the
Performance Based Service Contract (PBSC) standards included in this
order. The intent is to ensure that the Contractor performs in
accordance with the performance standards/acceptable quality levels
contained in the Performance Work Summary (Appendix A), that the
Government receives the quality of services called for in the contract
and that the Government only pays for the acceptable level of services
received.

**Scope**

It is important to understand the responsibilities of the parties and
distinguish between the quality control plan and the QASP. The
contractor is responsible for management and developing a quality
control plan to meet the quality standards established in the
Performance Work Statement (PWS). The QASP is put in place to provide
**Government** surveillance and oversight of the contractor's efforts in
meeting the performance standards required by the contract. The QASP is
not part of the contract nor is it intended to duplicate the
Contractor's quality control plan. The Government may provide the
Contractor with an information copy of the QASP to support the
Contractor's efforts in developing a quality control plan that will
interrelate with the QASP.

**Government Resources**

The following personnel will implement all surveillance activities:

**Contracting Officer**-The Contracting Officer ensures performance of
all necessary actions for effective contracting, ensures compliance with
the terms of the contract and safeguards the interests of the United
States in the contractual relationship. It is the Contracting Officer
that assures the Contractor receives impartial, fair and equitable
treatment under the contract. The Contracting Officer is ultimately
responsible for the final determination of the adequacy of the
Contractor's performance.

**Contracting Officer's Representative (COR)**-The COR is responsible
for technical administration of the contract and assures proper
Government surveillance of the Contractor's performance. The COR is not
empowered to make any contractual commitments or to authorize any
contractual changes on the Government's behalf. Any changes that the
Contractor deems may affect contract price, terms, or conditions shall
be referred to the Contracting Officer for action.

**Project Manager (PM)**-The PM provides detailed technical oversight of
the Contractor's performance and reports his or hers findings to the COR
in a timely, complete and impartial fashion to support the COR's
administration activities. While the PM may serve as a direct conduit to
provide Government guidance and feedback to the Contractor on technical
matters, he or she is not empowered to make any contractual commitments
or authorize and contractual changes on the Government's behalf.

**Methods of QA Surveillance**

The below listed methods of surveillance shall be used in the
administration of this QASP. The specific surveillance method for each
performance standard and acceptable quality level is listed in the
"Monitoring Method" column of the PWS.

**PM/COR Review**-Indicates that either the Project Manager, Contracting
Officer's Representative, or both will be responsible for monitoring the
Contractor's performance in meeting a specific performance
standard/acceptable quality level. Due to the nature of the work under
this order, this will be the predominant method of surveillance. In the
case of the numerous written deliverables, PM/COR Review will consist of
100% inspection of the specific deliverable and supporting
documentation. In the case of day-to-day support activities, PM/COR
Review will consist of periodic inspection or random monitoring.

**Customer Feedback**-Customer feedback may be obtained either from the
results of formal customer satisfaction surveys or from random customer
complaints. Customer complaints, to be considered valid, must set forth
clearly and in writing the detailed nature of the complaint, must be
signed and forwarded to the PM, who shall assess the validity of the
complaint and retain it in a documentation file. The PM shall also keep
the tabulated results of all customer satisfaction surveys on file.

**Documentation**

The PM will, in addition to providing documentation to the Contracting
Officer, maintain a complete quality assurance file. The file will
contain copies of all reports, evaluations, recommendations,
surveillance checklists, and any actions related to the Government's
performance of the quality assurance surveillance function. All such
records will be retained for the life of the contract and forwarded to
the Contracting Officer upon completion.

**[Evaluation Criteria]{.underline}**

**[Instructions to offerors]{.underline}**

**Summary**

This competition is being run under the \[list contract number here\].

The source selection process will consist of three parts: first, a
technical evaluation; second, a past performance review; third, a cost
evaluation. HYPOTHETICAL GOVERNMENT AGENCY intends to make a best value
award. For this requirement the technical proposal will be weighted as
60% of the quality factors while the past performance report will
comprise 40% of the quality score. When taken together, the results of
the technical evaluation and past performance review will outweigh the
results of the cost evaluation.

For the technical evaluation, offerors are asked to submit a written
technical proposal. For the past performance report, the offeror must
submit three client references for work performed that is similar in
size and scope to requirements in the sow for this solicitation,
including references for any engagements the offeror cites in its
technical proposal.

**Technical Proposal**

The contractor shall submit a written technical proposal describing how
it will successfully carry out the work of the Task Order. The proposal
should address all activities the contractor will potentially perform
under this Task Order. The proposal should address the evaluation
criteria as it relates to the contractor's abilities to meet the
requirements/objectives detailed in the Statement of Work.

The contractor should also include resumes for each individual proposed
for this Task Order. Be sure to highlight any relevant experience and
qualifications. Note: Specific individuals proposed must be made
available immediately upon award. The contractor may not replace
personnel unless they discontinue employment with the contractor or
unless written permission to replace an individual is obtained by
contractor from the COR via the Contracting Officer.

Evaluation Criteria for the technical proposal will be based on the
following:

**1. Qualifications of personnel**

-   Proposed staff has the technical/professional, leadership, and/or
    managerial experience and/or education necessary to fulfill their
    role and responsibilities on the Task Order -- 20 points

2.  **Corporate Capability**

-   Ability to provide these services to for all the systems described
    in the Statement of Work at the same time (i.e., work for one system
    does not have to be completed before work on another system begins)
    -- 15 points

```{=html}
<!-- -->
```
-   Ability to complete development of security plans, configuration
    management plans and contingency plans by \[place date here\] and
    remaining documentation by \[place date here\] for the systems
    described in the Statement of Work -- 20 points

-   Knowledge of relevant NIST guidance and other Information Assurance
    Standards -- 30 points

-   Knowledge of the Hypothetical Government Agency's IT environment --
    10 points

-   Knowledge of the Hypothetical Government Agency's business processes
    -- 5 points

**Past Performance Report**

The contractor must submit three past performance references for work of
similar size and scope. For each reference please include a description
of the work, level of effort, and dollar value of the task. Also, please
include a contact person for the past performance reference.