DRD #39 | Application Status Review materials Three months from F This DRD was not
contract start, monthly delivered.
thereafter
DRD #49 | Portfolio Management Views of Six months from. M However, this
Application Services and Inventories contract start date, deliverable will need to
continuously thereafter be reviewed by NASA
and the contractor to
' determine updates
needed for FY14.
DRD #41 | As built detailed functional and physical | Two months from M
description of development contract start date,
environment, its interfaces and provided within 2 days
processes of changes to structural
or ITS environment
including patches
DRD Application Delivery Implementation Initial draft five months | M DRDs 424A, 42B, 42C,
H#42A Plan (Formerly Version Description from contract start; 43A, and 43B were
Document but renamed to Release final six months from delivered based on 7
. Tel
Implementation Plan Template) contract start date rcp DM Ps
collaborative efforts.
i
DRD Website Delivery Implementation Plan | Initial draft cight M DRDs 42A, 42B, 42C,
#42B (Formerly Version Description months from contract 43A, and 43B were
Document but a secondary plan created | start; final nine months delivered based on
specifically for Website from contract start date refined requirements per
Implementations IFCD and DMI

collaborative efforts.

14


Performance
Level
99,99% - 100%
average
availability per
10 100.00 | month.

Availabl Incentive
Pool Earned Adjective _ pool for 6 months Fee Earned Fee

Metic#

|_ Maximum Fee

i
H
i
|
L
i
t

95% - 98% meet
i. 95.00 | the criteria Target Fee

100% submitted

98%-100%meet |

if

12 | 100.00 | ontime | Maximum Fee
i
i

13 | 100.00 | the criteria i

j_Maximum Fee

Meet the criteria |
96% - 100% of the |
14 100.00 | time | Maximum Fee

Compliance to the DRD requirements and delivery schedules were reviewed as part of the technical

surveillance. During this period, 65 DRDs were eligible for review. Of the 65 DRDs, 9 DRDs failed to

meet requirements and/or the delivery schedule. (For specific comments, reference the DRD rating
provided in Addendum A of the Incentive Fee Letter.)

The DRDs that failed to meet requirements and/or delivery schedules outlined in the Performance Work
Statement are as follows:

DRD #5 Integrated Master Schedule with ability to drill down to supporting data, including
resource loading

DRD #8 HQ Enterprise Architecture Plan Updates

DRD #30 Application Service Framework

DRD #31 Application Service Roadmap and Implementation Plan

DRD #33 | Legacy application portfolio report

DRD #34A Framework for Development Program

DRD #34B Framework for Web Site Development Program

DRD #36 Software Management Guide

DRD #39 ‘Application Status Review materials



DRD'Name/Desct

DRD #79 | Quarterly Metric Report summarizing Due 90 days trom M
the transaction history, incidents, and contract start date, and
inventories/inspections for that report every 3 months

thereafter

DRD #89 | HQITS Contingency & Continuity annually by fiscal M

Plan, Training and Test Report annual year’s end

update

18


DRD Name/Description

Requirements & Delivery

Sche

Card

DRD Diagrams of Server dependencies Dratt three months atter M
#17 (sinks/sources), physical placement and contract start; final six
relationship months and update
continuously
DRD Healih & Safety Plan Submit with proposal WA NA
#18
DRD Occupational Injuries and Illnesses Report One month from contract | M All reports were delivered
#19 start and monthly per schedule.
thereafter
DRD Customer Service Metrics Proposal Deliver final three NIA N/A
#20 months after contract start
DRD Customer Satisfaction Survey Report Deliver at contract start M
#21 with the customer
satisfaction survey,
monthly summary
analytics and trending
DRD Training Program & Outreach Plan, detailing | Initial Draft 45 days from | M
#22A materials, methods and approach and to contract start; Final two
include communications, and facilitating months from contract
relationship building activity. Two plans start. Subsequent draft
submitted each year with each plan covering | plan due each August 1
the period of performance April | thru with final due Oct 1; and
September 30 and October | thru March 31. Feb 1 with final due April
1.
DRD ITCD Communications Plan Draft 45 days from M
#22B contract start; final six
months from contract
start. Updates as required
by ITCD.
DRD Customer Advisory and Service Review, As required within 2 M This DRD has been met
#23 meeting notes, action items, results, and business days of meetings. | consistently by HITSS.
schedule. |
DRD ‘On-Boarding and Off- Boarding Statistics Deliver weekly beginning | M All reports delivered and
#23A Report 3 months from contract received as required.
start.
DRD Customer Requirements Adherence Metrics Deliver within 75 days of | M Proposal received and
#24 Proposal contract start; final due 3 approved as required,

months after contract start

(CRAMP proposal received
5/31/2013.)

10


As result of mitigations implemented for the Core task order (10.01) by your company mid-July through
September, the projected cost overrun a) sa ot This amount was
covered with a portion of the additional funding} provided by NASA.

Task order 10.14 cost overruns were also a concern. NASA contributed approximately of

additional funding required on task order 10.14 due to errors in resource and resource hour estimations
in the cost proposal.

Based on the cost performance above, NASA considers cost performance as a high risk on this contract.

SUMMARY

In summary, NASA was concerned with your company’s performance on cost during this period. As the
contract starts option year 1, better communication and management of labor cost is expected. The
mitigation plan your company implemented to address the cost overruns is appreciated. However, there
are some actions in the mitigation plan that have not been fully executed or implemented. NASA looks
forward to starting the first option year of the contract where these mitigations can be realized.

Overall, NASA is satisfied with the technical performance during this period. However, there is
continued concern regarding progress made on some of the DRDs that failed compliance with
requirements and/or delivery schedules. NASA must see progress on these DRDs as some of these DRDs
are vital to NASA's, specifically ITCD’s, strategic plan and goals. NASA understands that there is a change
in the Program Manager for this contract and understands that the new Program Manager and Deputy
Program Manager are assessing the DRDs, cost, and specific areas of technical performance. Thoughtful
management of cost and technical performance is imperative to ensure that the IT services and support
required by ITCD and HQ organizations are sustained and enriched. NASA expects that the areas of
concern for cost and technical performance will be managed closely and that completion of critical
deliverables and the deficient DRDs, listed above, will be achieved.

Sincerely,

Bererieg x fhe
Terence L. Haynes . yp

Contracting Officer

Ce: HQ/ITCD/Victor Thompson
HQ/ITCD/Liteshia Dennis


COST PERFORMANCE

Cost performance was a key concern during period 2. A cost overrun in labor (on the Core task order
10.01) ‘otalin fom period 1 resulted in an EAC in April/May of approximateh
NASA requested that your company identify mitigations to address the cost overrun. The following
were factors contributing to the cost overrun:
¢ Distributed Direct Labor was incorrectly allocated during period 1, as well as April, May, and
June for period 2. More Distributed Direct Labor was allocated to the Core task order (10.01)
than should have been for 9 months of the contract base period. The error resulted in
approximately NASA provided additional funding to relieve the financial burden that
would be imposed on the other task orders if a retroactive Distributed Direct Labor Calculation
to correct the error was applied.
« Resources not planned on the Core task order (10.01) were performing work on the Core task
order instead of performing work on the other task orders to which these resources were

originally proposed and planned.
° reponse personnel supporting Rational.

o Approximate) for personnel charging to the Core task order instead of
charging to other HITSS task orders as outlined and approved in the cost proposals for
the other HITSS task orders.

¢ NASA provided an additional funding of Eo cover residual overrun not addressed by
mitigations implemented by your company. Consequently, funding for other projects and
services was reduced to supply the additional funding required.
The table below outlines the planned versus actual labor cost for contract base period.

Table 3 — Cost Performance: Labor

Jan 13 Pele Mardy ApelS | May-tN Jua-13 Angh) | Sel

Total
Cakcaated

Table 4 — Cost Performance: ODC

Va Meet Apel Mayld duet duh Aug} Tara
Cakewlated



DRD#

DRD Name'Description

& Delivery

Requirements

Schedule

DRD #6 | Project Schedule Adherence Report Monthly — no later than M The report was delivered per
second week of the month schedule and requirements.
DRD #7 | Logistics Management Plan Three months after NA NA
contract start date.
DRD #8 | HQ Enterprise Architecture Plan Updates 8 months after contract F This DRD was not delivered
start date per the DRD delivery
schedule. The DRD was
delivered September 2013.
This DRD is under NASA
review and will need to be
updated per NASA feedback.
DRD #9 | Operational Level Agreements Initial set due 4 months M Requirement and deliverabie
after contract start; was addressed in the IDAs
subsequent due in and ICDs updated for
accordance with individual applications.
Government schedules
DRD Report on response times, ticket aging, and I month after start date M
#10 customer satisfaction, delivered and monthly after that.
DRD Root Cause Analysis and Corrective Action as requested by ITCD M NASA has requested that the
il Plan root cause analysis and
corrective action plan be
included in the Assessment
SR process for defects and
issue reporting,
DRD Configuration Management Plan Update as required by M
#12 ITcD |
DRD CCB Meeting Minutes Weekly — 2 days after M
#13 meeting
DRD Spare Parts Inventory Report 3 months after contract M
#14 start, quarterly thereafler
DRD Summary of updates to ROSA showing what | One time deliverabledue | M
#ISA was created with Data Migration Plan
for RAM
DRD ‘Summary of updates to RAM showing what | Available quarterly after_| N/A NA This report will be due
#15B was created and modified over previous 3 RAM Implementation in October 2013 (the start of
months period 3 reporting).
DRD Diagrams of Application logic, connectivity, | 90 days after contract start | M
#16 interdependence and data flow and update continuously



National Aeronautics and
Space Administration =

Goddard Space Flight Center
Greenbelt, MD 20771

Reply to Attn of =210.H December 12, 2013

Ms, Tyler Brooks-Craft

Senior Vice President, Contracts, Subcontracts & Compliance
Digital Management Inc.

6550 Rock Spring Dr, 7" Floor

Bethesda, MD 20817

Subject: Contract NNH12CF39C, HITSS Incentive Fee Period 2
Dear Ms. Brooks-Craft,

NASA has completed the evaluation of your company’s technical performance for the second reporting
period, April 1, 2013 through September 30, 2013, under NASA Headquarters Contract Number
NNH12CF39C, Headquarters Information Technology Support Services (HITSS) Contract.
The result of NASA’s evaluation was that your company earned a total incentive fee of t

The Contracting Officer will prepare and forward the contract modification under separate cover for
payment of the carned incentive fee.

This letter conveys a summary of your company’s performance for the second 6-month period. The
scoring scheme used for evaluating performance is detailed in Attachment K of the contract, Incentive
Fee Plan and Incentive Fee Quality Assurance Plan.


DRD #32 | Legacy application disposition plan Six months from The DRD was delivered
contract start date, and accepted as an initial
modifications reflecting submission. This DRD
status and approved needs to be updated to
changes every 60 days. reflect the approved
(Initial plan due last application migration
business day of plan approach, analysis,
Incentive Fee Period recommendations, and
(3/29/2013); 60 day requirements identified
status due the first for application
business day of July, development for the data
September, November, center consolidation
January and March) project.

DRD #33 | Legacy application portfolio report Six months from The DRD was delivered
contract start date, late and the initial draft
modifications reflecting did not NASA.
status and approved } expectations or
changes every 60 days. requirements. The DRD
initial plan due last was revised and was
business day of delivered to NASA late
Incentive Fee Period September 2013 for
(3/29/2013); 60 day review, The DRD is
status due the first under NASA review.

business day of July,
September, November,

January and March)
DRD Framework for Development Program Due at contract start, The DRD was delivered
#B4A modifications reflecting Jate and the initial draft
approved changes as did not meet NASA
required expectations or

requirements. The DRD
is under revision by the
contractor and will be
submitted to NASA for
review.

12


DRD Name Deseriptior

Requirements & Del

Schedile

thereafter, modifications
reflecting approved
changes as required. (Due
last business day of cach
Incentive Fee Period)

DRD Requirements Adherence Report | Deliver 3 months after M ‘This DRD was not
#25 contract start date, consistently delivered per the
monthly thereafter schedule.
DRD Summary and Trend Ticket Reporting One month from contract : M The delivery of this DRD
#26 including number of tickets opened, start date and monthly H was missed in August and
compicted and pending (¢.g. under a week, thereafter i September 2013
under two or over three) number escalated, H
rating, closed, times to first respond, customer !
satisfaction. Summary and reporting of phone
‘support, email support, and drop-in support.
|
DRD Service Request Processing Plan describing Within two weeks of N/A T N/A
#27 overall management and execution of the SR__ | contract start date |
system and customer satisfaction report {
|
DRD 1 NIA N/A (This DRD was
#28 | remoyed from the DRD
{ requirement list.)
|
DRD Catalog Orders Report/Checkbook includes | Two weeks from contract. | M
#29 number of orders by category, requisition start date, monthly
number and funding source (if known), thereafter
number complete, funds used versus
available, funds in process, summary total of
H monthly catalog invoice and break out of
! ITCD funded monthly total.
DRD Application Service Framework Two months from contract | F The initial version of the
#30 start date, modifications DRD was delivered late and
reflecting approved was deemed unacceptable by
changes as required | NASA as it did not meet
NASA requirements. A
revised
DRD was delivered on
September 30.
DRD Application Service Roadmap and ‘Six months after contract | F The initial version of the
431 Implementation Plan start and every six months DRD was deemed

unacceptable by NASA as it
did not meet NASA.
requirements and was not
executable. The contractor
has met with ITCD to review
the mitigation actions. A
revised DRD ‘s in progress.
Final version of the DRD
will be dependent upon
acceptance of DRDs 30 and
36.

11


Addendum A — Data Requirements Delivery Schedule Compliance and Surveillance Results

Score Card Key: N/A — The delivery of the DRD is not applicable for this contract reporiing period. The DRD was
ptovided per the schedule outlined and ail requirements were completed in period 1
M-— The DRD requirements and delivery schedule were met satisfactorily
F-— The DRD requirements and/or delivery scheduled were noi met.

DRD Name'Deseription

DRD #1 | Documentation environment of metrics, Updated and available N/A N/A — DRD is related to the
analytics and deliverables implementation weekly during the first contract transition.
plan and migration schedule two months of contract

start; enhancements and
additional content added
monthly thereafter until

established baseline
schedule is met
DRD #2 | Transition plan and integrated schedule Available at contract start | N/A N/A— DRD is related to the
with significant weekly contract transition.
updates for the transition
period up to Operational |
Readiness Review and
acceptance.
DRD #3 | Contract Status Meeting Monthly — no later than M Contract Status Meetings
last week of the month were held monthly as
required, Exceptions were
initiated by NASA and
executed by the contractor
satisfactorily. i
DRD #4 | Daily TagUp Review Daily M
DRD #5 | Integrated Master Schedule with ability to Updated every 2 weeks F The contractor did not
drill down to supporting data, including from month 2 of contract consistently meet the
resource loading start date. delivery schedule, IMS

content does not adequately
support the contractor's or
NASA’s reporting and
surveillance
needs/requirements. The
contractor and NASA have
met to review the
contractor’s mitigation pian.
The mitigations proposed
were accepted by NASA and
resolution of known issues is
expected during the next two
reporting periods (periods 3
& 4).



PWS PWS Area Metric % of NASA Surveillance Performance

Section a Metric Manager Comments Level for
Met Incentive Fee Incentiv
# Fee %
Headquarters Maximum 8%
| 6 | Datacenter 10 _| Data Center Availability 99% Fee
| Headquarters Compliance with Patch |
\ 6 | Datacenter 11__| Management Plan 95%. Target Fee T%
Metric relief is granted
Systems for this reporting period
Engineering and Delivery of Annual Tactical | since the tactical plan Maximum
7_| integration 12__| Planand Updateson Demand _| 100% | was reprioritized. Fee 2%
T Maximum
8 | iSecurity 13 _| Vulnerability Mitigation 100% | Fee 10%
i Maximum
8 | MSecurity 14__| incident Response 100% | Fee 5%

Table 2— Incentive Fee: Technical Performance

Performance Available Fee Eamed Fee Earned Fee
Level Pool Earned Adjective _ pool for 6 months (Calculated) (Rounded)
Less than 83% of
the required
elements are
1| 75.00 | included. Minimum Fee
Less than 83% of
! the required

elements are

2 75.00 _| included. Minimum Fee

Metric #

Less than 949%
3 90.00 | meet the criteria. | Minimum Fee

97%-100% meet
4 | 100.00 | the criteria Maximum Fee
Meet metrics
96%-100% of the
5 | 100.00 | time Maximum Fee
Meet response
and mitigation
metrics 96% -
6 | 100.00 | 100% of the time._| Maximum Fee
Meet response
and mitigation
metrics 96% -
7 | 100.00 | 100% of the time, _| Maximum Fee

98%-100% meet

8 | 100.00 | the criteria Maximum Fee
75% - 92% are

9 90.00 | error free. Target Fee



DRD Name!Deseription

renients & Delivery

ule

DRD Release Notes Document Template Initial draft five months | M.
#42C from contract start;
final six months from
contract start date
DRD 43A | Release Implementation Plan (foreach {| Scheduled in M
Application and Website) accordance with CCB
DRD Release Notes Document (for each Scheduled in M
#43B Application and website) accordance with CCB
DRD Biennial Review of Forms Final Report | First report due N/A N/A
| 844A 10/1/2014 and ; ; ;
\ biennially per NPD Will be delivered during
1420.1 period 3 reporting.
DRD Quarterly Data to Produce Forms Quarterly (Dec, March, | M
#44B Bulletin (one for Agency and 1 for HQ) | June & Sept)
DRD #45 | Data Exchange Agreement Audit and Six months from NA NA
Gap Analysis contract start date
DRD #46 | Service Level Agreement Audit One month from M
contract start date and
monthly thereafter
DRD #47 | Availability of hosted and housed One month from M
services contract start date and
monthly thereafter
DRD #48 | Performance of hosted and housed One month from M
services contract start date and
monthly thereafter
DRD #49 | Diagram of server location Three months from M
contract start date and |
every three months
; thereafter
DRD #50 | Diagram of servers logical connection Three months from M
to network contract start date and
on-demand thercafter
DRD #51 | Capacity and Performance Report Two months from M
| contract start date, on-
demand thereafter

15


ne/Descriptior

Daily Risk Vulnerability Report Daily M
DRD #65
DRD #66 | Monthly Vulnerability Scan Report One month after M
(encrypted) contract start date,
monthly thereafter
DRD #67 | Intrusion Detection Summary One month after M
contract start date,
quarterly thereafter
DRD #68 | Monthly Wireless 802.11 Scanning Two months after M
Report (encrypted) contract start date,
monthly thereafter
DRD #69 | Annual Penetration Test Plan and Rules | On demand M
of Engagement and Schedule
DRD #70 | Annual HQ Penetration Testing Report | On demand M
DRD #71 | IT C&A Security Plan Assessment On demand M
using the NASA standard template
DRD #72 | Risk Assessment On demand M
DRD #73 | Sccurity Controls Assessment Report On demand M
Assessment using the NASA standard
template
DRD #74 | Plan of Actions and Milestones On demand M
Assessment using the NASA standard.
template
DRD #75 | System Certification Report On demand M
DRD #76 | Monthly POA&M Status Report One month after M
contract start date,
monthly thereafter
DRD #77 | Monthly ISSA Status Report Two months after M
contract start date,
monthly thereafter
DRD #78 | Incident Response Training and Test annually by fiscal M
Report year’s end

17


PWS Area NASA Surveillance Performance Perce
Manager Comments
Metric
Met
| Accomplishment of Plan
Program | Objectives- Training Program 100% of the objectives
Management j_and Outreach Plan 25% | were met.
‘Accomplishment of Plan
Program Objectives- Data Center 100% of the objectives
Management | Modernization Plan 25% | were met.
| Based on DRD 5 (IMS)
and DRD 6 (Project
Schedule Adherence
Report) evaluation
results, content of DRD 5
is not suitable for proper
tracking of SR schedules.
Several SRs/work efforts
are missing and the
contractor is addressing
this deficiency. Based on
| the weekiy SR List and
| status provided in the
| daily tag-ups and CCB,
t | there is a consistent
i | trend for SRs requiring
| | rebaselines, that are
i i delinquent for
Program Adherence to Service Request | completion, and that are
I Management Schedules 90% | not on schedule. Minimum Fee. 5%
I Metric relief granted per
Surveillance Monitor.
| The mechanism and
tools for tracking and
capturing related data
needs to be assessed.
However, based on data
gathered, there is
evidence that there is a
99.62% statistics on First !
Time to Response and a !
99.54% on Time to i
Resolution. Considering i
these statistics, the total H
percentage met |
Program ! calculated for this metric | Maximum
Management| Problem Ticket Response Time | 100% | is 99.58%. Fee 1 5%
Program Wide | Maximum
Services Prime Time Password Resets 100% Fee 4%
Restore Prime time Service
Program Wide Outages for Applications and Maximum
Services Servers 100% Fee 6%
Resolve Prime Time
Application and Server
Program Wide Hardware and Software Maximum
Services Problems 100% Fee 5%
Customer
Relationship Maximum
Management Customer Satisfaction Surveys | 98% Fee 15%
Application
Development and
Information Error-free Deployments (Post- 43 out of 48 releases
Management Release Bug Fixes) 90% | were error-free. Target Fee 13%



TECHNICAL PERFORMANCE

The tables below provide summary level data for each metric. Specific comments are provided for each

metric in Table 1. Table 2 provides a breakdown of the incentive fee calculation by metric.

Table 1 - Metrics: Technical Surveillance Results

% oF Pocformance

pws Matric Metric NASA Surveillance Level for
Section PWS Ares # Met Man

Comments incentive Fee

‘of the

Incentiv

efee

Program: Content of Selected Plan Minimum
2 | Management 1 Updates 75% | See Below Fee TH
(100% metric given) -The
Legacy Applications
Disposition Pian was
delivered and reviewed
| by the government. The
| plan is accepted by the
government but requires |
updates in November
2013 to reflect current
priorities, opp migration,
‘and application
roadmaps. (0% metric
given) - The Application
Service Roadmap and
implementation Plan has
not been accepted by the
government due to
unsatisfactory content in
the initiot draft
Content of Selected Plan delivered. Major rework
Updates - Application Service was required and the
Roadmap and implementation revisions are under
Program Plan, Legacy Applications review by the
2 | Management 1 Disposition Plan 25% | government.
100% of the updates for
Content of Selected Plan the Training Program
Program Updates - Training Program and Outreach Plan were
2 | Manogement 1 and Outreach Pion 25% | met.
100% of the updates for
Content of Selected Plan the Data Center
Program Updates = Data Center Modernization Plan were
2 | Management 1 Modernization Plan 25% | met.
Program ‘Accomplishment of Plan
2_| Management 2 Objectives 75% | See Below Fee 8%
| (100% metric given}-
The Legacy Applications
Disposition Plan
objectives identified for
Accomplishment of Plan | period 2 were met. (0%
Objectives - Application | metric given) - The
Service Roadmap and Application Service
Program: Implementation Plan, Legacy Roadmap and
2_| Management, 2 Applications Disposition Plan 25% | Implementation Plan. l



DRD Name/Destriprion

NASA Review Restilt

DRD Framework for Web Site Development | Due nine months after ] The DRD was delivered
#34B Program contract start late and the initial draft
did not meet NASA
expectations or
requirements. The DRD
is under revision by the
contractor and will be
submitted to NASA for
review.
DRD #35 | Interface Control Documents ; One month from
| contract start date and \
as needed thereafter |
i
DRD #36 | Software Management Guide Interim due three The DRD was delivered
months after contract | late and the initial draft
start date; updated i did not meet NASA
SDLC due six months expectations or
after contract start; } fequirements. The DRD
modifications reflecting is under revision by the
approved modifications contractor and will be
i quarterly thereafter submitted to NASA for
i | review.
DRD #37 1 Standard requirements template that | Within two months
: documents the service or design need from contract start date
from the perspective of effected
discipline areas (e.g. applications
development, IT security, customer
training, operations) and by level of {
necd (e.g. mandatory, optional,
preferred).
|
DRD #38 | System Design Specification Two months from
contract start date,
modifications reflecting
approved modifications
as needed thereafter

13


DRD #

DRD Name!Description

DRD #52 | Quarterly/Monthly Patch Release One month after M
Report contract start date,
monthly thereafter
DRD #53 | Equipment Upgrade Evaluation Report | 90 days of contract start | M
date and semiannually
1 thereafter
i
DRD #54 | Moved to DRD#67 ] NIA N/A
DRD #55 | Data Center (including SEF) SOP Audit | Six months from M The DRD delivery
& Recommendations Report contract start date and requirement was changed
monthly thereafter from monthly to on
demand.
DRD #56 | Reserved Reserved NA NA
i
i :
| 4
DRD #57 | Data Center Modemization Plan Initial Plan three M
months from contract
start date; updated plan
at six months; and
every six months
thereafter
DRD #58 { Data Exchange Agreement Audit and Six months from M
Gap Analysis contract start date.
DRD #59 | Reserved Reserved NA NA
Reserved NA NA
DRD #60 | Contractor Information Security Within one month from | M
| Management Plan contract start date,
j { updated annually
| thereafter
DRD #61 | Draft Policy, Requirement, Procedure, | On demand M
or Standard
DRD #62 | eDiscovery Data Search Results On demand M
DRD #63 | Reserved NA NA
DRD #64 | Security Reviews and Assessments On demand M

16