(

)

b(4)

b(4)

b(4)

b(4)

b(4)

b(4)

b(4)

b(4)

b(4)

b(4)

b(4)

b(4)
b(4)

b(4)

b(4)

b(4)

b(4)

b(4)

b(4)

b(4)

b(4)

b(4)

b(4)

b(4)
b(4)
b(4) b(4)
b(4) b(4)

b(4) b(4)

b(4)

b(4)

b(4)

b(4)

b(4) b(4)
b(4)

b(4)

b(4)































































































































b(4)
b(4)
b(4)
b(4)

b(4)

b(4)

b(4)

b(4)

b(4)
b(4)
b(4)

b(4)

b(4)
b(4)
b(4)

b(4)

b(4)

b(4)
b(4)
b(4)

b(4)

b(4)
b(4)
b(4)













































b(4)

Pages 206 through 263 redacted for the following reasons:

- - - - - - - - - - - - - - - - - - - - - - - - - - - -

b(4), b(4) Attachment F - Safety and Health Plan

b(4), b(4) Attachment H - Security Management Plan











b(4)
b(4)

b(4)
b(4)

b(4)
b(4)

b(4)
b(4)

b(4)

b(4)
b(4)

b(4)

b(4)
b(4)

Attachment K

NNH12CF39C 

May 7, 2012

11

APPENDIX 1: 

INCENTIVE FEE QUALITY ASSURANCE PLAN 
Attachment K

NNH12CF39C 

May 7, 2012

12

HEADQUARTERS IT SUPPORT SERVICES (HITSS) CONTRACT 

INCENTIVE FEE QUALITY ASSURANCE PLAN 

This Incentive Fee Quality Assurance Plan (QAP) is developed to provide a disciplined 

process for evaluating the contractor’s performance in order to determine conformity 

with the performance requirements of the Performance Work Statement. It is designed to 

aid the performance monitors in providing effective and systematic surveillance of 

contractor performance, and to provide the contractor with specific details of how the 

performance requirements will be evaluated. This plan consists of a sampling guide for 

each performance requirement identifying how and when surveillance will be performed. 

The following sections of the sampling guide are explained: 

Method of Surveillance – Identifies the method to be used for selecting samples (100% 

Inspection or Random Sample). 

When a random sample will be selected, the following general process will be used to 

choose the samples: 

1. The number of transactions (or tickets or other workload indicator) occurring 

during the time period will be determined and the transactions will be sorted 

by the initiation date (or other appropriate criteria).

2. The samples will be selected in a manner that ensures they are spread across 

the entire time period that is sampled (e.g., every fifth ticket will be a part of 

the sample). The spread between each transaction sampled will vary 

depending upon the sample size and actual number of transactions occurring 

during the evaluation period.

Lot Size – The estimated workload during a 6-month evaluation period. 

Sample Size – The number or percentage of items from the lot that will be sampled. 

Performance Requirement – Identifies the performance standard associated with a work 

requirement. 

Sampling Procedure – Describes the procedure to be used in selecting the samples to be 

inspected, how often samples will be taken, and the relative weight of the samples.

Inspection Procedure – Describes what will be inspected and how, and how the metric 

will be calculated. 
Attachment K

NNH12CF39C 

May 7, 2012

13

METRIC #T&S-1

Completion of Actions from Operational Readiness Review (ORR) 

1. Method of Surveillance: 100% Inspection.

2. Lot Size: Approximately 20 open actions from the ORR that will be due for 

completion during the first six months of the contract.

3. Sample Size: 100% of lot.

4. Performance Requirement: Open actions identified during the ORR shall be 

completed within the required due date.

5. Sampling Procedure: All ORR actions assigned to the contractor that have required 

completion dates during the first six months of the contract will be included in the 

sample. All actions will be of equal weight.

6. Inspection Procedure: The Government will review a report of closed ORR actions 

assigned to the contractor on a monthly basis. The actual completion date of all 

actions completed during the month will be examined to determine if they met the 

required due date. At the end of the 6-month period, the total number of actions 

completed by the required due date will be divided by the total number of actions due, 

then multiplied by 100 to determine the percentage completion.
Attachment K

NNH12CF39C 

May 7, 2012

14

METRIC #T&S-2

Content of Selected Initial Plans 

1. Method of Surveillance: 100% Inspection.

2. Lot Size: 29 required plan elements (5 plans and 6 elements each, except that one 

element does not apply to the Application Service Framework). All elements are of 

equal weight). The required plans are: 

Application Service Framework 

Application Service Roadmap and Implementation Plan 

Data Center Modernization Plan 

Legacy Applications Disposition Plan 

Training Program and Outreach Plan 

3. Sample Size: 100% of lot.

4. Performance Requirement: Initial plan content of the five documents listed above 

will contain the 6 required elements listed below. Other required content specific to 

each plan is included in the PWS, but the incentive fee will be based upon the 6

elements that are applicable to all plans. 

5. Sampling Procedure: The initial plans will be uploaded to the Contract Management 

portal or applicable document repository for review by ITCD. 

6. Inspection Procedure: The Government will review each of the five selected plans 

submitted during the six month period to determine if the following elements have 

been addressed: 

Identifies the goal or goals that are addressed in the plan 

Identifies the required skills needed 

States that overall implementation can be accomplished within the estimated cost 

of the contract; or includes an estimated cost and basis of estimate (must provide 

estimated cost and basis of estimate to successfully meet this element) 

Discusses technology maturity that can be supported within the current or 

projected NASA IT infrastructure 

Includes 5-10 quantifiable short-term objectives that will be accomplished over 

the succeeding six months (does not apply to the Application Service Framework) 

Is delivered and available by the due date 

Each element included in each plan counts as successfully meeting the metric. The 

total number of elements included in the plans will be divided by 29, then multiplied 

by 100, to determine if the overall metric has been met. 
Attachment K

NNH12CF39C 

May 7, 2012

15

METRIC #T&S-3

Stakeholder Satisfaction with Transition and Stabilization 

1. Method of Surveillance: 100% Inspection.

2. Lot Size: Approximately 50 customer surveys.

3. Sample Size: 100% of lot.

4. Performance Requirement: Surveys submitted by transition stakeholders shall 

include an Overall Rating of no less than a "4" on a scale of 1-5, with "5" being the 

highest rating.

5. Sampling Procedure: Surveys will be sent to all transition stakeholders, which 

include task monitors on the core requirement and task owners of all tasks issued 

during the first six months of the contract. Surveys will also be sent to all managers 

in the IT and Communications Division. All surveys returned from transition 

stakeholders will be included in the sample. All surveys will be of equal weight.

6. Inspection Procedure: The Government will review the survey responses and will 

count the number of surveys that include an Overall Rating of at least “4”. (Although 

surveys may consist of ratings for more than one element of performance, the only 

rating that will be used to determine this metric is the “Overall Rating”.) Surveys 

meeting the metric will be divided by the total number of surveys received, then 

multiplied by 100, to determine if the metric was met.
Attachment K

NNH12CF39C 

May 7, 2012

16

PROGRAM MANAGEMENT (PWS SECTION 2.0) 

METRIC #1 

Content of Selected Plan Updates 

1. Method of Surveillance: 100% Inspection.

2. Lot Size: 24 required elements of selected plan semi-annual updates (4 plans and 6

elements each – all of equal weight). The required plans included in this metric are: 

Application Service Roadmap and Implementation Plan 

Data Center Modernization Plan 

Legacy Applications Disposition Plan 

Training Program and Outreach Plan 

3. Sample Size: 100% of lot.

4. Performance Requirement: The content of the semi-annual plan updates listed

above will contain the 6 required elements listed below. Other required content 

specific to each plan is included in the PWS, but the incentive fee will be based upon 

the 7 elements that are applicable to all plans. 

5. Sampling Procedure: The plan updates will be uploaded to the Contract 

Management portal or applicable document repository for review by ITCD. 

6. Inspection Procedure: The Government will review each of the four updates

submitted during the six month period to determine if the following elements have 

been addressed: 

Identifies the goal or goals that are addressed in the plan 

Identifies the required skills needed 

States that overall implementation can be accomplished within the estimated cost 

of the contract, or includes an estimated cost and basis of estimate (must provide 

both to successfully meet this element) 

Includes specific actions taken during the past six months, and associated results, 

that definitively demonstrate that the objectives from the previous update or plan 

have been accomplished. 

Includes 5-10 quantifiable short-term objectives that will be accomplished over 

the succeeding six months 

Is delivered and available on or before the due date 

Each element included in each plan counts as successfully meeting the metric. The 

total number of elements included in the plans will be divided by 24, then multiplied 

by 100, to determine if the overall metric has been met.
Attachment K

NNH12CF39C 

May 7, 2012

17

PROGRAM MANAGEMENT (PWS SECTION 2.0) 

METRIC #2 

Accomplishment of Plan Objectives 

1. Method of Surveillance: 100% Inspection. 

2. Lot Size: Approximately 30 quantifiable objectives (5-10 for each plan) submitted 

with the semi-annual updates of the following plans: 

Application Service Roadmap and Implementation Plan 

Data Center Modernization Plan 

Legacy Applications Disposition Plan 

Training Program and Outreach Plan 

3. Sample Size: 100%. 

4. Performance Requirement: All objectives identified in the semi-annual updates to 

the plans will be met.

5. Sampling Procedure: The Government will review the actions and results identified 

by the contractor for each objective included in the latest plan update, which cover 

the previous 6-month period. All objectives are of equal weight. 

6. Inspection Procedure: Each plan update will identify 5-10 quantifiable objectives 

that the contractor intends to achieve over the following six months. The contractor’s 

list of actions and results against those objectives will be examined. If the contractor 

states that the objective was accomplished, it will be included as a successful 

objective. The number of successful objectives will be divided by the total number of 

objectives evaluated across all four plans, then multiplied by 100, to determine the 

percentage completed.
Attachment K

NNH12CF39C 

May 7, 2012

18

PROGRAM MANAGEMENT (PWS SECTION 2.0) 

METRIC #3 

Adherence to Service Request Schedules 

1. Method of Surveillance: 100% Inspection. 

2. Lot Size: Approximately 25 Service Requests per month or approximately 150 

Service Requests per 6-month period.

3. Sample Size: 100% of all Service Requests with scheduled completion dates within 

the 6 month period of performance. 

4. Performance Requirement: All Service Requests with completion dates that fall 

within the 6 month review period shall be completed by the scheduled completion 

date. 

5. Sampling Procedure: The HQ Service Request (SR) management system shall be 

used to identify the SRs with scheduled completion dates that fall within the period. 

All SRs will be of equal weight. 

6. Inspection Procedure: 

a. At the end of the 6-month period, the Government will access the SR 

management system. 

b. The Government will compare the Service Request scheduled completion 

dates with actual completion dates. If there are interim completion dates 

or milestones associated with an SR, only the final date will be used to 

determine if the metric was met. 

c. The total number of Service Requests with actual completion dates by the 

scheduled dates shall be divided by the total number with scheduled 

completion dates within the 6 month period. 

d. Service Requests that received Government approval to extend the 

scheduled completion date beyond that period shall not be included in this 

calculation. 
Attachment K

NNH12CF39C 

May 7, 2012

19

PROGRAM MANAGEMENT (2.0) 

METRIC #4

Problem Ticket Response Time 

1. Method of Surveillance: Random Sampling. 

2. Lot Size: Approximately 500 tickets per month, or approximately 3,000 tickets per 6-

month period.

3. Sample size: Approximately 10% of tickets. 

4. Performance Requirement: Respond to tickets within 4 business hours (time to 

first response), resolve problem within 3 business days, and notify user of completion 

within 4 hours of ticket closure. All three elements must be completed in the required 

time in order for a single ticket to be counted as successfully meeting the performance 

requirement. 

5. Sampling Procedure: Perform random sampling of ticket logs from the Remedy 

system. All tickets will be weighted equally. 

6. Inspection Procedure: 

a. For each ticket sampled, the Remedy log will be checked to determine the 

following: 

If the customer was contacted within 4 business hours; 

If the ticket was resolved within 3 business days; and 

If the completion notification was sent to the customer within 4 hours of 

ticket closure. 

b. In order for a ticket to count as successfully meeting the metric, all three 

elements above must have been met. For example, if the customer was 

contacted within 4 business hours and the ticket was resolved in 3 business 

days, but the customer was not notified of completion within 4 hours, then 

that ticket will not count as a “successful” ticket. Total number of “successful 

tickets” divided by total number of tickets sampled, multiplied by 100, will 

determine the percentage completion. 
Attachment K

NNH12CF39C 

May 7, 2012

20

PROGRAM-WIDE SERVICES (3.0) 

METRIC #5

Prime Time Password Resets 

1. Method of Surveillance: Random Sampling. 

2. Lot Size: Approximately 180 password resets per month, or approximately 1,080 

per 6-month period. 

3. Sample Size: 20% per month.

4. Performance Requirement: Respond to application password reset requests during 

Prime Time hours within 30 minutes and accomplish resets within 60 minutes.

5. Sampling Procedure: A random sample will be pulled from all prime time 

password reset tickets on a monthly basis. The sample will be calculated as Total 

Number of Resets per period times .20 giving the sample size x. The sample size (x) 

will be used to select every 5th record from the total for review. Each ticket is of 

equal weight. 

6. Inspection Procedure: 

a. Each ticket will be checked for initial response and resolution time. If the initial 

response is within 30 minutes of ticket creation and the reset was performed 

within 60 minutes of ticket creation, the item will be scored as successful. Both 

elements must meet the performance requirement in order to be considered 

successful. 

b. The results for each month will be added up at the end of the 6-month period. 

c. The calculation for the completion percentage will be the total of the successful 

tickets divided by total number of tickets sampled, multiplied by 100. 
Attachment K

NNH12CF39C 

May 7, 2012

21

PROGRAM-WIDE SERVICES (3.0) 

METRIC #6

Restore Prime Time Service Outages for Applications and Servers 

1. Method of Surveillance: 100% Inspection.

2. Lot Size: 100% of occurrences within a 6 month period. 

3. Sample Size: 100% of lot.

4. Performance Requirement: Restore prime time service outages for 

Applications and servers. For service outages affecting more than one person, 

respond within 5 minutes with a daily updates provided until the outage is 

mitigated. The daily updates will be measured by recording that a status of the 

effort is given each business day at the daily tag-up meeting. The response within 

5 minutes and daily statuses until resolution must both be met to count as 

successful. 

5. Sampling Procedure: All reports will be pulled from Remedy for six month 

activity. It will be reviewed to identify all service outages for the period. The 

tickets selected for review will be all service outages created between the hours of 

6AM and 6PM, noting the initial response and completion date.

6. Inspection Procedure: For each prime-time outage, the Remedy system logs 

will be examined to determine if initial response was made within 5 minutes. 

Records of daily tag-up meetings will be reviewed to determine if statuses were 

provided each business day until the outage was resolved. The number of outages 

that meet both criteria to be successful will be scored as a 1. The total of items 

that received a 1 score will be divided by the total number of outages for the 

period and multiplied by 100 to get the overall percentage. 
Attachment K

NNH12CF39C 

May 7, 2012

22

PROGRAM-WIDE SERVICES (3.0) 

METRIC #7

Resolve Prime Time Application and Server Hardware and Software Problems 

1. Method of Surveillance: 100% Inspection.

2. Lot Size: 100% of occurrences within a 6 month period. 

3. Sample Size: 100% of lot.

4. Performance Requirement: Resolve prime time application and server 

hardware and software problems. For reported hardware and software problems, 

respond within 30 minutes and implement a fix within 12 prime-time business 

hours. Both elements must be accomplished in order for the ticket to be counted 

as successful.

5. Sampling Procedure: A 6 month report from Remedy will be reviewed to 

identify application and server hardware and software outages. The tickets 

selected for review will be all application and server hardware and software 

outages created between the hours of 6AM and 6PM. All tickets are of equal 

weight.

6. Inspection Procedure: The response time report and ticket aging report for the 

selected tickets will be reviewed to determine if the initial response was 

accomplished within 30 minutes and a fix performed within 12 prime-time 

business hours. If the incident meets both criteria it is scored as a 1. The 

percentage will be determined by dividing the total number of items that received 

a 1 score by the total number of incidents for the period multiplied by 100 to get 

the overall percentage. 
Attachment K

NNH12CF39C 

May 7, 2012

23

CUSTOMER RELATIONSHIP MANAGEMENT (4.0) 

METRIC #8 

Customer Satisfaction Surveys 

1. Method of Surveillance: 100% Inspection.

2. Lot Size: 100% submitted (All surveys received during each evaluation periodApproximately 125 per month or 750 per review period). 

3. Sample Size: 100% of lot.

4. Performance Requirement: Surveys submitted by customers shall include an 

Overall Rating of no less than a "4" on a scale of 1-5, with "5" being the highest 

rating. 

5. Sampling Procedure: Surveys will be accessed each month for the duration of the 

evaluation period, and will be reviewed for the Overall Ratings assigned by 

customers after receipt of IT related services. Surveys starting the first day of each 

review period through and including the last day of that review period will be 

included in the sample size. All surveys are of equal weight. 

6. Inspection Procedure: The Government will review the survey responses and will 

count the number of surveys that include an Overall Rating of at least “4”. (Although 

surveys may consist of ratings for more than one element of performance, the only 

rating that will be used to determine this metric is the “Overall Rating”.) Surveys 

meeting the metric will be divided by the total number of surveys received, then 

multiplied by 100, to determine if the metric was met. 
Attachment K

NNH12CF39C 

May 7, 2012

24

APPLICATION DEVELOPMENT AND INFORMATION MANAGEMENT (5.0) 

METRIC #9 

Error-free Releases 

1. Method of Surveillance: 100% Inspection.

2. Lot Size: Approximately 75 releases per 6-month period.

3. Sample Size: 100% of lot.

4. Performance Requirement: All application version releases shall be error free and not 

require any post-release bug fixes. 

 

5. Sampling Procedure: Each deployment will be monitored for defects that require bug 

fixes. All deployments will be of equal weight. 

6. Inspection Procedure: The Government will review all releases for defects. Releases with 

no defects will count as a successful releases and will meet the metric. The percentage for 

the metric shall be calculated as the number of successful releases divided by the total 

number of releases multiplied by 100. 
Attachment K

NNH12CF39C 

May 7, 2012

25

HEADQUARTERS DATA CENTER (6.0) 

METRIC #10 

Data Center Availability 

1. Method of Surveillance: 100% Inspection.

2. Lot Size: Approximately 1,000 systems and services.

3. Sample Size: 100% of Lot.

4. Performance Requirement: Data Center systems and services (hosted and housed) 

shall be available (i.e., operational) at all times (24 X 7 X 365). Availability is measured 

in seconds; the total number of seconds a system is up and running is divided by total 

number of seconds during the period, then multiplied by 100 to determine the percentage 

of availability. 

5. Sampling Procedure: A monthly automated report from monitoring software (Nagios 

and SolarWInds) will be reviewed to determine the percentage of time that systems were 

available. The overall availability calculation from the report (combined availability of 

all systems and services) will be recorded each month. All systems will have equal 

weight.

6. Inspection Procedure: The overall availability calculation from the report (combined 

availability of all systems and services), will be recorded each month. The monthly 

overall availability percentages for the 6-month period will be added and divided by 6 to 

calculate the average availability for the six month period. 
Attachment K

NNH12CF39C 

May 7, 2012

26

HEADQUARTERS DATA CENTER (6.0) 

METRIC #11 

Compliance with Patch Management Schedule 

1. Method of Surveillance: 100% Inspection.

2. Lot Size: Approximately 60 Windows Servers and 50 non-Windows servers (Mac, Unix, 

Linux).

3. Sample Size: 100% of Lot.

4. Performance Requirement: Data Center Servers shall be patched in accordance with 

the approved patch management schedule. 

5. Sampling Procedure: Pull reports monthly from the Agency Patch Management 

System. 

6. Inspection Procedure: On a monthly basis review reports from Agency Patch 

Management System to verify FDCC compliance level. Each server that has been 

patched within the required schedule counts as meeting the metric for that month. The 

performance level will be determined by dividing the total number of servers that meet 

the metric by the total number of servers inspected during the period, multiplied by 100.
Attachment K

NNH12CF39C 

May 7, 2012

27

SYSTEMS ENGINEERING AND INTEGRATION (7.0) 

METRIC #12 

Delivery of Annual Tactical Plan and Quarterly Updates 

1. Method of Surveillance: 100% Inspection

2. Lot Size: Two events per period: 1 Tactical Plan and 1 quarterly Status Report

(Incentive Periods 2, 4, 6, 8, and 10); or 2 quarterly Status Reports (Incentive Periods 3, 

5, 7, and 9).

3. Sample Size: 100% of Lot 

4. Performance Requirement: Tactical Plan shall be delivered annually within 30 days 

after IT Board of Director’s approval; and/or Tactical Plan Status Report shall be 

provided each three months thereafter to reflect current status and projections.

5. Sampling Procedure: The delivery of each Plan or Status Report will be monitored by 

the Government. Each plan or update is of equal weight.

6. Inspection Procedure: The Government will compare the actual submission date to the 

due date to determine if the plan or update was submitted on time. The total number of 

on-time deliveries will be divided by 2 and multiplied by 100 to determine on-time 

percentage. 
Attachment K

NNH12CF39C 

May 7, 2012

28

IT SECURITY (8.0) 

METRIC #13 

Vulnerability Mitigation

1. Method of Surveillance: 100% Inspection 

2. Lot Size: All critical, high, and moderate vulnerabilities (approximately 100 per 6-month 

period) 

3. Sample Size: 100% of lot 

4. Performance Requirement: All system vulnerabilities shall be mitigated within the 

specified times in accordance with NPR 2810.1 and NITR 2810.24. 

5. Sampling Procedure: Each performance period, Agency ITSEC-EDW data from 

Patchlink/KACE will be examined to determine the total number of vulnerabilities for the 

period and the total number successfully patched on time. All vulnerabilities will have equal 

weight. 

6. Inspection Procedure: 

The following items will be checked: 

a. The Agency’s ITSEC-EDW data from Patchlink/KACE will be examined to 

determine if there were any delinquent patching actions. 

b. For each delinquent item, the applicable contractor provided monthly vulnerability 

scan report will be consulted to determine if no patch was available, the risk was 

accepted by the Government, or another Government-approved mitigation was put in 

place by the action due date. If so, the item will be marked as successfully 

completed. 

c. The total number of vulnerabilities patched on time (i.e., successfully completed) will 

be divided by the total number of vulnerabilities and multiplied by 100 to yield the 

completion percentage. 
Attachment K

NNH12CF39C 

May 7, 2012

29

IT SECURITY (8.0) 

METRIC #14 

Incident Response

1. Method of Surveillance: Random Sampling 

2. Lot Size: Typically within a range of approximately 20-100 prime-time incidents and calldowns during a 6-month period.

3. Sample Size: Up to 50 non-Prime Time incidents and call-downs – Sample 50% 

 Over 50 non-Prime Time incidents and call-downs – Sample 25% 

4. Performance Requirement: During non-Prime Time hours, respond to a phone call, a 

NASA Security Operations Center (SOC) or NASA Help Desk notification, or other 

Government notification within 15 minutes and arrive on-site, if necessary, within two hours 

of the initial notification. 

5. Sampling Procedure: Each performance period, a random sample will be pulled from all 

non-Prime Time incidents and call-downs. If the total number of non-Prime Time incidents 

and call-downs is 50 or less, every other one (50%) will be examined. In cases where the 

total number of non-Prime Time incidents and call-downs is greater than 50, every fourth one 

(25%) will be examined. All incidents and call-downs are of equal weight. 

6. Inspection Procedure: 

a. For each non-Prime Time incident or call-down examined, one or several of the 

following items will be checked, as required, to determine the notification time, the 

response time, and the arrival on-site time: 

SOC IMS system records for the incident. The handling of each incident is required 

to be reported in the system. 

Help Desk tickets will be consulted to identify to whom the initial notification was 

made. The contractor is the first point of contact for the Help Desk and multiple 

contractor POC’s are on the call down list. 

The Civil Service Call Down members will be contacted to determine if any afterhours call downs reached them after a failure to reach a contractor call down 

responder. 

HQ Security Office after-hours sign in roster. 

If the contractor responded within 15 minutes of initial notification and arrived on-site 

within 2 hours of notification (when applicable), the item will be recorded as successful. 

Both elements (when applicable) must have been completed in order for the item to be 

considered successful. 

b. The total number of successful items determined in step a divided by the total number of 

items examined and multiplied by 100 will yield the completion percentage.