National Aeronautics and
Space Administration

Goddard Space Flight Center
Greenbelt, MD 20771

Replytoatinot: 210.H December 19, 2014

Digital Management Inc.

Attn: Neysa Spence

6550 Rock Spring Dr, 7 Floor
Bethesda, MD 20817

Subject: Contract NNH12CF39C, HITSS Incentive Fee Period 4
Dear Ms. Spence,

NASA has completed the evaluation of your company’s technical performance for the fourth reporting
period, April 1, 2014 through September 30, 2014, under NASA Headquarters Contract Number
NNH12CF39C, Headquarters Information Technology Support Services (HITSS) Contract.

The result of NASA’s evaluation was that your company earned a total incentive fee a
The Contracting Officer will prepare and forward the contract modification under separate cover for
payment of the earned incentive fee.

This letter conveys a summary of your company’s performance for the fourth 6-month period. The
scoring scheme used for evaluating performance is detailed in Attachment K of the contract, Incentive
Fee Plan and Incentive Fee Quality Assurance Plan.


Metric

Problem Ticket
Response Time

Percent
of Metric

Met
79%

NASA

Surveillance

Manager
T. Dodson

ORDs
Mapped

NASA Surveillance
Manager
Comments

to Metric
and/or
PWS Area
DRDs 10
& 26

Performance

Level for

incentive Fee
| Minimum

Percent of

the

Incentive
Fee %

5%

Prime Time
Password Resets

82%

T. Dodson

DRD 26

Minimum

4%

Restore Prime time
Service Outages for.
Applications and

| Servers

100%

L. Hong

No outages for the
reporting period.
Reviewed all server
ops tickets\ for the
period and none
were related to
application, service
or server outages.

Maximum

6%

Resolve Prime Time
Application and
Server Hardware
and Software
Problems

100%

L. Hong

No outages for the
reporting period.
Reviewed all server
ops tickets\ for the
period and none
were related to
application, service
or server outages.

Maximum

5%

Customer
Satisfaction Surveys

100%

S. Artis

DRDs 20
&21

Maximum

15%

Post-Release Bug
Fixes

96%

C. McCoy

This metric Is the
result ofhaving
two application |
deployment H
failures for the
reporting period.
There were a total
of 52 planned
deployments of
which 50 were
Successful. The
metric for Post-
Release Bug Fixes
per the PWS is
calculated as the
number of
successful
deployments
divided by the
number of total
deployments
multiplied by 100.
In this case the
result is “96%. For
detailed stats,
please see the
Metric Post-
Release Bug Fixes
Report (ppt).

Maximum

13%



update

Daily Risk Vulnerability Report Daily M
DRD #65
DRD #66 | Monthly Vulnerability Scan Report One month after M
(encrypted) contract start date,
monthly thereafter
DRD #67 | Intrusion Detection Summary One month after M
contract start date,
quarterly thereafter
DRD #58 | Monthly Wireless 802.11 Scanning Two months after M
Report (encrypted) contract start date,
monthly thereafter
DRD #69 | Annual Penetration Test Plan and Rules | On demand M
of Engagement and Schedule
DRD #70 | Annual HQ Penetration Testing Report | On demand M
DRD #71 | IT C&A Security Plan Assessment On demand M
using the NASA standard template ;
DRD #72 | Risk Assessment On demand M
DRD #73 | Security Controls Assessment Report On demand M
Assessment using the NASA standard
template
DRD #74 | Plan of Actions and Milestones On demand M
Assessment using the NASA standard. |
template i
DRD #75 | System Certification Report On demand M
DRD #76 | Monthly POA&M Status Report One month after M
contract start date,
monthly thereafter
DRD #77 | Monthly ISSA Status Report Two months after M
contract start date,
monthly thereafter
{ DRD #78 | Incident Response Training and Test annually by fiscal M
Report year’s end
DRD #79 | Quarterly Metric Report summarizing Due 90 days from M
the transaction history, incidents, and contract start date, and
inventories/inspections for that report every 3 months
thereafter
DRD #80 | HQITS Contingency & Continuity . annually by fiscal M
Plan, Training and Test Report annual year’s end

18


supported Agency transition efforts by providing detailed feedback to
the NSAAR team, drafting requirements for key updates and performing
beta testing on tool revisions.
= The HITSS security team provided thought leadership in our ongoing
initiative to develop the HQ and NASA continuous monitoring
framework and processes.
= The software library tested and deployed automated installation on HQ
end-user devices of commonly requested approved software. This
allowed the team to deploy these applications more quickly and without
the need to schedule time with the user.
= The HITSS security team was instrumental in updating the NASA
external system SA&A policy, based on the HQ external system SA&A
process. The team conducted outreach and answered questions from
across the Agency to facilitate adoption of this cost-effective risk
management process.
co The services and support in the area of Scientific & Technical Information (STI)
support was outstanding. The DMI staff supporting this area continues to
demonstrate great professionalism, preparedness, competencies, and customer
service.

COST PERFORMANCE

Cost performance remained a key concern during period 5 due to budget and funding impacts. Costs on
the Core task order 10.01 were managed well by the DMI HITSS Program Manager. However, due to
increasing impacts to the ITCD budget, the following factors and concerns will require continued
attention to ensure that costs and budget are carefully managed:

allocation of work across SRs

management of work and staff labor hours related to complexity and type of service requests
and related support

allocation of staff across all HiTSS task orders. (Based on review of the task orders, 533s, and
invoices, it appears that Core continues to be used as a charge line for staff when needed.
Resources not planned on the Core task order (10.01) were performing work on the Core task
order instead of performing work on the other task orders to which these resources were
originally proposed and planned. ITCD has requested that a review of the non-Core task order
work be analyzed to determine sufficient resource planning and staffing needs. ITCD continues
to work with non-Core task owners to communicate the burn-rate, funding, and other concerns
that may affect DMI’s resource planning and staffing needs. Some progress was made during
period 5, NASA will continue to scrutinize CORE staffing and hours.)

weaknesses in specific skill sets on the Core task order contribute to challenges with estimation
and execution of work

additional resources/staffing required to mitigate risks and non-delivery for Agency and HQ.
forms

additional resources/staffing required to execute the agile transformation process and pilot
additional resources/staffing required to address ITCD’s requirements for Rational


DRD #32

Legacy application disposition plan

Six months from
contract start date,
modifications reflecting
status and approved
changes every 60 days,
(initial plan due last
business day of
Incentive Fee Period
(3/29/2013); 60 day
status due the first
business day of July,
September, November,
January and March)

DRD #33

Legacy application portfolio report

Six months from
contract start date,
modifications reflecting
status and approved
changes every 60 days.
(Initial plan due last
business day of
Incentive Fee Period
(3/29/2013); 60 day
status due the first
business day of July,
September, November,
January and March)

DRD
#B4A

Framework for Development Program

Due at contract start,
modifications reflecting
approved changes as
required

DRD
#34B

Framework for Web Site Development
Program

Due nine months after
contract start

DRD #35

Interface Control Documents

One month from
contract start date and
| as needed thereafter

| N/A

None required this
contract period.

14


DRD #47 | Availability of hosted and housed One month from M
services contract start date and
monthly thereafter
DRD #48 | Performance of hosted and housed One month from M
services contract start date and
monthly thereafter
DRD #49 | Diagram of server location Three months from NA No updates were
contract start date and requested for this
every three months performance period.
thereafter
DRD #50 | Diagram of servers logical connection Three months from NWA No updates were
to network contract start date and requested for this
on-demand thereafter performance period.
DRD #51 | Capacity and Performance Report Two months from NA No updates were
contract start date, on- requested for this
demand thereafter performance period.
DRD #52 | Quarterly/Monthly Patch Release One month after M
Report contract start date,
monthly thereafter
DRD #53 | Equipment Upgrade Evaluation Report | 90 days of contract start | M
date and semiannually
thereafter
DRD #54 | Moved to DRD#67 NA NA
DRD #55 | Data Center (including SEF) SOP Audit | Six months from M
& Recommendations Report contract start date and
monthly thereafter
DRD #56 | Reserved Reserved NA NA
DRD #57 | Data Center Modernization Plan Initial Plan three M
months from contract
start date; updated plan
at six months; and
every six months
thereafter
DRD #58 | Data Exchange Agreement Audit and Six months from NA No updates were
Gap Analysis contract start date. requested during this
performance period.
However, updates will be
requested during period
5.
DRD #59 | Reserved Reserved NA NA

19


DRD #35 | Interface Control Documents One month from M These were delivered as
contract start date and requested on a per app
as needed thereafter basis when an

application underwent
changes as a result of the
SR process.

DRD #36 | Softwaré Management Guide ‘Interim due three NA Submitted last
months after contract | performance period. No
start date; updated changes were Tequested
SDLC due six months during this performance

period. Agile Pilot is
after contract start; ongoing with a goal of
modifications reflecting testing out the SMG and
approved modifications the associated SOPs.
quarterly thereafter Changes will be required
once
DRD #37 | Standard requirements template that Within two months M Modified template
documents the service or design need from contract start date | delivered to .
from the perspective of effected | accommodate capturing
iscipline areas _ applications tes Addie
lopment, IT security, customer changes may be needed
training, operations) and by level of to accommodate any
need (e.g. mandatory, optional, changes from the Agile
preferred). pilot.
| DRD #38 | System Design Specification Two months from NA Not requested.
contract start date,
j modifications reflecting
approved modifications
as needed thereafter
| DRD #39 | Application Status Review materials Three months from NA Not requested.
contract start, monthly
thereafter
DRD #40 | Portfolio Management Views of Six months from NA Not requested.
Application Services and Inventories _| contract start date,
| continuously thereafter
DRD #41 | As built detailed functional and physical | Two months from NA Not requested.
description of development contract start date,
environment, its interfaces and provided within 2 days
processes of changes to structural
or ITS environment
including patches
DRD Application Delivery Implementation Tnitial draft five months | M Delivered in form of
#42A Plan (Formerly Version Description from contract start; VDD and CR
Document but renamed to Release final six months from Implementation plan.
Implementation Plan Template) contract start date
1

7


DRD Requirements Adherence Report Deliver 3 months after | N/A Report was not delivered.
#25 contract start date,
| monthly thereafter
| DRD Summary and Trend Ticket Reporting | One month from M
#26 including number of tickets opened, | contract start date and
completed and pending (e.g. under a | monthly thereafter
week, under two or over three) number
escalated, rating, closed, times to first
| respond, customer satisfaction. Summary
and reporting of phone support, email
support, and drop-in support.
DRD _| Service Request Processing Plan Within two weeks of |N/A | N/A
| #27 describing overall management and contract start date
execution of the SR system and customer
satisfaction report
DRD NA N/A (This DRD was
#28 removed from the DRD
requirement list.)
DRD Catalog Orders Report/Checkbook Two weeks from M
#29 includes number of orders by category, contract start date,
requisition number and funding source (if | monthly thereafter
known), number complete, funds used
versus available, funds in process,
summary total of monthly catalog invoice
and break out of ITCD funded monthly
total.
DRD Application Service Framework Two months from M Deliverable was received
#30 contract start date, on time and discussed
modifications reflecting hein b eta > APP Dev
approved changes as Changes to oe mmo date
required new agile App Dev
processes and to allow for
clarification of existing
services were proposed.
and will be factored into
the next release. The
results of Knowledge
Management and Portfolio
management will also be
factored into a subsequent
release.

15


Table 2 — Incentive Fee: Technical Performance

Performance Pool Earned
Metric # Metric Description Score Level Adjective
j Less than 83% of
the required
Content of Selected elements are Minimum
1_| Plan Updates 75% | included. Fee
Less than 81% of
Accomplishment of the objectives are | Minimum
2 | Plan Objectives 75% | completed. Fee
Adherence to
Service Request 94% - 97% meet
3 | Schedules 96% | the criteria. Target Fee
Problem Ticket 93% - 96% meet
4 | Response Time 94% | the criteria, Target Fee
Meet metrics less
Prime Time than 90% of the Minimum
5 | Password Resets 88% | time. Fee
Restore Prime time Meet response
Service Outages for | and mitigation
Applications and metrics 96% - Maximum
6 | Servers 100% | 100% of thetime. | Fee
Resolve Prime Time
Application and Meet response
Server Hardware and mitigation
and Software metrics 96% - Maximum
7 | Problems 100% | 100% of the time. | Fee
Customer 98%-100% meet Maximum
8 | Satisfaction Surveys 100% | the criteria Fee
Post-Reiease Bug 93% - 100% are Maximum
9 | Fixes 96% | error free. Fee
Data Center 99.99%-100% Maximum
10 | Availability 100% | average Fee
Compliance with
Patch Management 99%-100% meet | Maximum
11 _| Plan 100% | criteria Fee
Delivery of Annual
Tactical Plan and
Updates on 100% submitted Maximum
12 | Demand 100% | on time Fee
Vulnerability 98%-100% meet Maximum
13 | Mitigation 100% | the criteria Fee
Meet the criteria
96%-100% of the Maximum
14 | Incident Response 100% | time Fee

Available Fee
pool for 6
months

Earned Fee



DRDs
Mapped Percent of

Percent NASA NASA Surveillance toMetric Performance the
Metric of Metric Surveillance Manager and/or tevel for Incentive
ff Met Manager Comments PWS Area incentiveFee Fee %

100.00% L. Hong Deliverables ORDS 47 Maximum B%
Data Center received monthly &48
10 Availability on time
100% L. Hong Deliverables DRD 52 Maximum 7%
Compliance with received monthly
Patch Management on time
aL Plan
100% S. Artis This metric was Maximum 2%
Delivery of Annual waived for this
Tactical Plan and period. The tactical
Updates on | plan was
12 Demand H reprioritized.
Vulnerability 100% M. Meissner Maximum 10%
13 _| Mitigation
4 Incident Response 100% M. Meissner Maximum 5%



Metric #

Score

Performance Poo! Earned
Level Adjective
metrics 96%-
100% of the
time.

Available Fee
pool for 6 Incentive Earned Fee farned Fee
months (Calculated) (Rounded)

100%

Meet
response
and
mitigation
metrics 96%
- 100% of
the time. Maximum Fee

6%

100%

Meet
response
and
mitigation
metrics 96%
= 100% of
the time, Maximum Fee

5%

100%

98%-100%
meet the
criteria Maximum Fee

15%

86%

75%-92% are
error free Target Fee

13%

10

100%

99.99%-
100%
average Maximum Fee

8%

11

100%

99%-100%
meet criteria_| Maximum Fee

7%

12

100%

100%
submitted
on time | Maximum Fee

2%

2B

98%-100%
meet the
criteria Maximum Fee

10%

4

| 100%
|

100%

Meet the

criteria 96%-
100% of the
time Maximum Fee

5%

Compliance to the DRD requirements and delivery schedules were reviewed as part of the
technical surveillance. During this period, 62 DRDs were eligible for review. Of the 62 DRDs, 9
DRDs failed to meet requirements and/or the delivery schedule. (For specific comments,
reference the DRD rating provided in Addendum A of the Incentive Fee Letter.)

The DRDs that failed to meet requirements and/or delivery schedules outlined in the

Performance Work Statement are as follows:

DRD #8 HQ Enterprise Architecture Plan Updates
DRD #34A Framework for Development Program
DRD #34B Framework for Web Site Development Program



DRD Website Delivery Implementation Plan | Initial draft cight M Delivered as part of the
#42B (Formerly Version Description months from contract website deployment
Document but a secondary plan created | start; final nine months package under the
specifically for Website from contract start date current SLDC/SMG.
Implementations
DRD Release Notes Document Template Initial draft five months | M Template was delivered
#42C from contract start; ina previous
final six months from performance period.
contract start date Template has not been
implemented since the
new SLDC has not been
fully executed.
j DRD 43A | Release Implementation Plan (for each | Scheduled in M Delivered via the VDD
i Application and Website) accordance with CCB for cach application
release/deployment.
! DRD Release Notes Document (for each Scheduled in M Release notes were
#43B Application and website) accordance with CCB delivered as readme
files when
transitioning
| applications from the
| HQ datacenter to the
| | West Prime
H |
H | | environment. These
i
i | release notes were
| delivered on time and
on a per application
basis where required
via an approved PTC.
DRD Biennial Review of Forms Final Report | First report due M
H44A 10/1/2014 and
biennially per NPD
1420.1
DRD Quarterly Data to Produce Forms Quarterly (Dec, March, | M
#44B Bulletin (one for Agency and 1 forHQ) __ June & Sept)
DRD #45 | Data Exchange Agreement Audit and Six months from NA NA
Gap Analysis contract start date
DRD #46 | Service Level Agreement Audit One month from N/A Initial was provided,
contract start date and. a ats
PWS Description says:
ithly thereafter
mony teres Six months from
contract start. I think
this should be changed
to be either quarterly

or on demand,

16


TECHNICAL PERFORMANCE

PWS Men

The tables below provide summary level data for each metric. Specific comments are provided
for each metric in Table 1. Table 2 provides a breakdown of the incentive fee calculation by
metric.

Table 1 — Metrics: Technical Surveillance Results

DRDs

Mapped Percent of
Percent NASA NASA Surveillance to Metric Performance the
of Metric Surveillance Manager and/or —_Level for Incentive
Met Manager Comments PWS Area incentive Fee Fee %

1 See Below (This
metric consists of
Content of four plans. Only
Selected Plan Dennis/McCoy, three of the four
1 | Updates 75% | Shouse, Hong were delivered.) Minimum 7%
Content of Selected
Plan Updates -
Application Service
Roadmap and i
implementation Only one of the two }
Plan, Legacy Liteshia deliverable |
Applications Dennis/Chris requirements were | DRDs 31
1 Disposition Plan 50% | McCoy met. | &32
i
Content of Selected | !
Plan Updates - j i
Training Program |
i and Outreach Plan 100% | Mary Shouse : DRD22A
Content of Selected |
Plan Updates - Data | Received updated
Center Modernization plan
i Modernization Plan 100% | Linda Hong and baselined. ORD 57
See Below (This
metric consists of
i four plans. Only
Accomplishment of Dennis/McCoy, three of the four
1 Plan Objectives 75% | Shouse, Hong were delivered.) Minimum 8%
Accomplishment of
Pian Objectives -
Application Service
Roadmap and H
Implementation Only one of the H
Plan, Legacy Liteshia two deliverable !
Applications Dennis/Chris requirements were | DRDs 31
2 Disposition Plan 50% | McCoy met. & 32
Accomplishment of
Plan Objectives-
Training Program
2 and Outreach Plan 100% | Mary Shouse DRD 22A



regarding the staffing required to support Agency and HQ forms as well as the
stability of the team with regards to turn-over. It is critical for DMI to show
stability and consistency with regards to communication and execution-of work
for Agency forms as well as HQ forms, Furthermore, it is critical that DMI show
that it can support Agency forms and HQ forms with a reasonable and justifiable
staffing level. This is critical to ensure consistency in the deliverables, continuity
in communication, and management of budget.

oO The HITSS security team was short-staffed during period 4. Despite the low
staffing, the HITSS security team has done an excellent job in FY14. NASA
realizes that resource issues are being addressed and looks forward to another
year of outstanding support in FY15. However, NASA is still concerned that the
timeliness of mitigation of the staffing levels for security needs to be aligned
with key deliverables and key projects initiated at the Agency and HQ levels to
ensure continuity of quality of services.

COST PERFORMANCE

Cost performance remained a key concern during period 4 due to funding concerns. Costs on the Core
task order 10.01 continued to burn higher than planned until mitigations were implemented by the DMI
HITSS Program Manager. NASA expressed concerns over the following factors as they pertain to costs
on Core:

allocation of work across SRs

management of work and staff labor hours related to complexity and type of service requests
and related support

allocation of staff across all HITSS task orders. (Based on review of the task orders, 533s, and
invoices, it appears that Core continues to be used as a charge line for staff when needed.
Resources not planned on the Core task order (10.01) were performing work on the Core task
order instead of performing work on the other task orders to which these resources were
originally proposed and planned. NASA continues to work with the HITSS Program Manager
and Deputy Program Manager to address. Some progress was made during period 4, NASA will
continue to scrutinize CORE staffing and hours.)

weaknesses in specific skill sets on the Core task order contribute to challenges with estimation
and execution of work

additional resources/staffing required to mitigate risks and non-delivery for Agency and HQ
forms


DRDs
Mapped Percent of
Percent NASA NASA Surveillance to Metric Performance the

Metric of Metric Surveillance Manager and/or Level for Incentive
# Met Manager Comments PWS Area Incentive Fee Fee %
This metric is the
result of having
two application
deployment
failures for the
| reporting period.
There were a total
of 52 planned
deployments of
which 50 were
' successful. The
j metric for Post-
Relase Bug Fixes
per the PWS is
calculated as the
number of
{ successful
deployments
divided by the
number of total
deployments
multiplied by 100.
tn this case the
| | result is “96%. For
detailed stats,

| please see the
| Metric Post-
| Post-Release Bug Release Bug Fixes
s Fixes 96% | C. McCoy Report (ppt). Maximum 13%
Deliverables
Data Center received monthly DRDS 47
10 Availability 100.00% | L. Hong on time &48 Maximum. 8%
Compliance with Deliverables
Patch Management received monthly
il Pian 100% | L. Hong on time DRD 52 Maximum 7%
This metric was {
Delivery of Annual waived for this
Tactical Plan and ! period. The tactical
Updates on plan was
12 Demand 100% | S. Artis reprioritized. Maximum. 2%
Vulnerability
13 Mitigation 100% | M. Meissner Maximum. 10%
14 Incident Response 100% | M. Meissner Maximum 5%



DRD #47 | Availability of hosted and housed One month from M
services contract start date and
monthly thereafter
DRD #48 | Performance of hosted and housed One month from M
services contract start date and
monthly thereafter
DRD #49 | Diagram of server location Three months from NIA No updates were
contract start date and requested for this
every three months performance period.
thereafter
DRD #50 | Diagram of servers logical connection Three months from NIA No updates were
to network contract start date and requested for this
| on-demand thereafter performance period,
DRD #51 | Capacity and Performance Report Two months from NIA No updates were
contract start date, on- Tequested for this
demand thereafier performance period,
i
DRD #52 | Quarterly/Monthly Patch Release One month after M |
Report contract start date,
monthly thereafter
DRD #53 | Equipment Upgrade Evaluation Report | 90 days of contract start | M
date and semiannually
thereafter
DRD #54 _| Moved to DRD#67 NA NA
DRD #55 | Data Center (including SEF) SOP Audit | Six months from M
& Recommendations Report contract start date and
monthly thereafter
DRD #56_| Reserved Reserved NA NA
DRD #57 | Data Center Modernization Plan Initial Plan three M
months from contract
start date; updated plan
! at six months; and
| every six months
thereafter
DRD #58 | Data Exchange Agreement Audit and Six months from NA No updates were
Gap Analysis contract start date. requested during this
performance period.
However, updates will be
I requested during period
i 5.
DRD #59 _| Reserved Reserved N/A NA
Reserved NA NA
DRD #650 | Contractor Information Security Within one month from | M
Management Plan contract start datc, H
updated annually
thereafter
DRD #61 | Drait Policy, Requirement, Procedure, On demand
or Standard
DRD #52_| eDiscovery Data Search Results On demand M
DRD #53_| Reserved : N/A N/A
DRD #54 _| Security Reviews and Assessments On demand M

17


DRD #57 | Data Center Modernization Plan Initial Plan three F Provided initial, but have
months from contract not provided updates.
start date; updated plan
at six months; and Government and
every six months HITSS/DMI will need to
thereafter determine a new plan

(but it cannot take a year
to create) that includes
WESTPrime, further
SEF reductions,
NETApp upgrade, etc.
DRD #58 | Data Exchange Agreement Audit and Six months from. M
Gap Analysis contract start date.
DRD #59 | Reserved Reserved N/A NA
Reserved NA NA
DRD #60 | Contractor Information Security Within one month from | M
Management Plan. contract start date,
updated annually
thereafter
DRD #61 | Draft Policy, Requirement, Procedure, On demand M
or Standard

DRD #62 | eDiscovery Data Search Results On demand M

DRD #63 | Reserved NA NA

DRD #64 | Sccurity Reviews and Assessments On demand M

Daily Risk Vulnerability Report Daily M
DRD #65
DRD #66 | Monthly Vulnerability Scan Report One month after M
(encrypted) contract start date,
monthly thereafter
i

DRD #67 | Intrusion Detection Summary One month after M
contract start date,
quarterly thereafter

DRD #68 | Monthly Wireless 802.11 Scanning Two months after M

Report (encrypted) contract start date,
monthly thereafter
DRD #69 | Annual Penetration Test Plan and Rules | On demand M

of Engagement and Schedule

18


Addendum A — Data Requirements Delivery Schedule Compliance and Surveillance Results

provided per the schedule outlined and ail requirements were completed im period |

M-
F-

The DRD requ:rements and delivery schedule were met satisfactorily.
The DRD sequirements and‘or delivery scheduled were not met

Sccre Card Key: N/A — The delivery of the DRD is not applicable for this contract reporting period The DRD was

DRD#

DRD Name/Description

Requirements &

Delivery Schedule

Score
Card

NASA Review Results

DRD Documentation environment of metrics, Updated and available N/A N/A— DRD is related to
#1 analytics and deliverables weekly during the first the contract transition.
implementation plan and migration two months of contract
schedule start; enhancements and
additional content
added monthly |
thereafter until i
established baseline j
schedule is met i
DRD Transition plan and integrated schedule Available at contract N/A N/A— DRD is related to
#2 start with significant the contract transition.
weekly updates for the
transition period up to
Operational Readiness H
Review and acceptance. ;
DRD Contract Status Meeting Monthly — no later than | M
#3 last week of the month
DRD Daily Tag Up Review Daily M
#4 ;
i
DRD | Integrated Master Schedule with ability | Updated every 2 weeks | M
45 to drill down to supporting data, from month 2 of
including resource loading contract start date.
DRD Project Schedule Adherence Report Monthly — no later than | M
#6 second week of the |
month
DRD Logistics Management Plan Three months after NA N/A
#7 contract start date.

10



DRD
#28

NA

N/A (This DRD was
removed from the DRD
requirement list.)

DRD
#29

Catalog Orders Report/Checkbook
includes number of orders by category,
requisition number and funding source (if
known), number complete, funds used.
versus available, funds in process,
summary total of monthly catalog
invoice and break out of ITCD funded
monthly total.

Two weeks from
contract start date,
monthly thereafter

DRD
#30

Application Service Framework

Two months from
contract start date,
modifications reflecting

approved changes as
required

The deliverable was
delivered on time per the
revised delivery date
agreed upon by ITCD and
DML.

DRD
#31

Application Service Roadmap and
Implementation Plan

Six months after
contract start and every
six months thereafter,
modifications reflecting
approved changes as
required. (Due last
business day of each
Incentive Fee Period)

DRD #32

Legacy application disposition plan

| Six months from
contract start date,
modifications reflecting
status and approved
changes every 60 days.
(initial plan due last
business day of
Incentive Fee Period
(3/29/2013); 60 day
status due the first
business day of July,
September, November,
January and March)

N/A

Not requested

DRD #33

Legacy application portfolio report

Six months from
contract start date,
modifications reflecting
Status and approved
changes every 60 days.
(Initial plan due last
business day of
Incentive Fee Period
(3/29/2013); 60 day
status due the first
business day of July,
September, November,
January and March)

NA

Not requested

DRD
#344

Framework for Development Program

Due at contract start,
modifications reflecting
approved changes as
required

Delivered on time.

14


Addendum A — Data Requirements Delivery Schedule Compliance and Surveillance Results

Score Card Key: N/A — The delivery of the DRD 1s not applicable for this contract reporting period. The DRD was

provided per the schedule outhned and all requirements were completed in period 1
M-— The DRD requirements and delivery schedule were met satisfactomly

FL

The DRD requirements andor delivery scheduled were not met

Documentation environment of metrics,

Updated and available

N/A — DRD is related to

#L analytics and deliverables weekly during the first the contract transition.
implementation plan and migration two months of contract
schedule start; enhancements and
additional content
added monthly
thereafter until
established baseline
schedule is met
DRD Transition plan and integrated schedule Available at contract NA N/A — DRD is related to
#2 | start with significant the contract transition.
i weekly updates for the
transition period up to
Operational Readiness
Review and acceptance.
DRD Contract Status Meeting Monthly — no later than |
8 last week of the month i
DRD | Daily Tag Up Review Daily |
#4
DRD Integrated Master Schedule with ability Updated every 2 weeks
#5 to drill down to supporting data, from month 2 of
including resource loading contract start date.
DRD Project Schedule Adherence Report Monthly — no later than | M
H6 second week of the
month
DRD Logistics Management Plan Three months after NA NA
#7 contract start date.
DRD HQ Enterprise Architecture Plan Updates | 8 months after contract | F ITCD reviewed the
#8 start date

second revision submitted
by DMI. The document
still requires extensive
work and content.
Feedback was provided to
DMI. ITCD requests that
this deliverable be
reassigned to a team of
HITSS staff or at least
another Lead.

11



this remains high on NASA’s critical initiatives list and continues to impact
progress on ITCD’s strategic plan.)

oc Deficiency of Technical Skill Sets Required — There continues to he concerns
regarding the skills and experience of the technical staff and the PM staff
executing and managing the technical work. NASA has communicated the
technical areas where skill sets are deficient, and has requested that DMI
address this and that DMI provide a detailed plan for how this deficiency in
technical expertise will be resolved. This impacts estimation, workflow, service
request completion, technical capabilities, ITCD’s strategic plan, etc. This needs
to be addressed by the end of period 4 performance.

o Work Management System — The Work Management System (WMS) was
scheduled for delivery in contract year 1. However, this system has yet to be
delivered. Much progress has been made this performance period, but NASA
requires that this system be implemented immediately in order to support the
transition and implementation of the SMG and other key ITCD initiatives.

© Management of PC Mall Catalog — There was degradation in support and in the
quality of services for the PC Mall Catalog as a result staff changes. Due to
limited guidance, coordination, and or available staff, orders remained in the
queue for extended periods and required customer escalation to ITCD for
resolution, Poor communication was provided to HQ offices/ITCD customers on
where to go and how to obtain assistance. Corrective action was initiated by
hiring new staff and enlisting assistance from retired HITSS staff until the
backlog was satisfied. This issue appears to have been resolved; however there
was a significant impact to service and performance as a result of resource
issues.

COST PERFORMANCE

Cost performance remained a key concern during period 3. Costs on the Core task order 10.01
continued to burn higher than planned. NASA expressed concerns over the following factors as they
pertain to costs on Core:

allocation of work across SRs

management of work and staff labor hours related to complexity and type of service requests
and related support

allocation of staff across all HITSS task orders. (Based on review of the task orders, 533s, and
invoices, Core appears to be used as a charge line for staff when needed. Resources not
planned on the Core task order (10.01) were performing work on the Core task order instead of
performing work on the other task orders to which these resources were originally proposed
and planned. NASA continues to work with the HITSS Program Manager and Deputy Program
Manager to address.)

the perception that remaining funding for ODCs can be used to offset overruns in Labor
weaknesses in specific skill sets on the Core task order contribute to challenges with estimation
and execution of work

Distributed Direct Labor percentage appears to below target for the performance period. (This
has since been mitigated by the HITSS Program Manager.)


DRD #36 | Software Management Guide

DRD #37 ; Standard requirements template that documents the service or design need from
the perspective of effected discipline areas (e.g. applications development, IT
security, customer training, operations) and by level of need (e.g. mandatory,
optional, preferred).

DRD #39 Application Status Review materials

DRD #41 ‘As built detailed functional and physical description of development
environment, its interfaces and processes

DRD #55 Data Center (including SEF) SOP Audit & Recommendations Report

DRD #57 Data Center Modemization Plan

General Technical Performance

The following were identified as either continuing or new concerns by NASA with regards to
technical performance:
e Continuing Concerns
co Delivery of the On Demand system — This system was required for delivery and

implementation six months after the contract transition. As of the conclusion of
period 3 performance, this system has yet to be delivered. NASA requests an
explanation for the| t expended by DMI on this system. NASA also
requests DMI to determine appropriate mitigations and accommodations with
regards to resources assigned, management of the project, and costs incurred
by the government.

Application Migration of HQ Applications to the West Prime Environment —
Since the time that DMI was informed of this project, this project has been used
as a blocker for addressing resourcing of other service requests. NASA has
expressed concerns over the preparation for this project (which affects the most
of the HITSS task orders}. The HITSS Program Manager and Deputy Program
Manager have implemented mitigations to improve the workflow, internal
HITSS communication, and assignment of work for this project. While progress
has improved (largely due to government assistance), NASA continues to
emphasize its concerns and frustration with the schedule and execution of the
schedule for this project.

Software Management Guide — The SMG has been and continues to be a
challenge for DMI to transition and implement. Poor management of the
deliverable and weak resource/staff selection for the development of this
deliverable continues to be a source of frustration for NASA. (This deliverable
was not delivered per the Performance Work Statement (PWS) requirements or
delivery schedule. Consequently, the deliverable was approved by NASA with
the understanding that the SOPs and templates needed for the pilot of the SMG
(and the agile SDLC it governs) would be delivered in early May. However, a
transition plan, the SOPs, the templates, and the implementation plan have yet
to be provided to NASA. Recently, DMI has implemented mitigations to address
these remaining activities, processes, and related documentation. Therefore,



DRD #70 | Annual HQ Penetration Testing Report | On demand M
DRD #71 | IT C&A Security Plan Assessment On demand
using the NASA standard template
DRD #72 | Risk Assessment On demand M
DRD #73 | Security Controls Assessment Report On demand M
Assessment using the NASA standard
template
DRD #74 | Plan of Actions and Milestones On demand M
Assessment using the NASA standard
template
DRD #75 | System Certification Report On demand
DRD #76 | Monthly POA&M Status Report One month after
contract start date,
monthly thereafter
DRD #77 | Monthly ISSA Status Report Two months after M
contract start date,
monthly thereafter
DRD #78 | Incident Response Training and Test annually by fiscal M
Report year’s end
DRD #79 | Quarterly Metric Report summarizing Due 90 days from M
the transaction history, incidents, and contract start date, and
inventories/inspections for that report every 3 months
thereafter
DRD #80 | HQ ITS Contingency & Continuity annually by fiscal M
Plan, Training and Test Report annual year’s end

update

19


SUMMARY

In summary, NASA was concerned with your company’s technical performance and cost performance
during this period. As the contract continues in option year 1, better communication and management
of labor cost is expected.

The mitigation plan your company implemented to address the cost overruns from period 2
performance is appreciated. However, there are some actions in the mitigation plan that have not been
fully executed or implemented. NASA looks forward to concluding the first option year of the contract
when these and other mitigations can be realized.

Overall, NASA is not satisfied with the technical performance during this period. There continues to be
concern regarding progress made on some of the DRDs that failed compliance with requirements and/or
delivery schedules. NASA must see progress on these DRDs as some of these DRDs are vital to NASA’s,
specifically ITCD’s, strategic plan and goals. Furthermore, the inability to deliver on some of these DRDs
implies that there is an apparent lack of appropriate skills and expertise on the contract. As such
deficiency manifests itself in the technical performance, impacts and risks are incurred for overall cost,
budget, and service delivery for this contract.

NASA understands that there is a change in the Program Manager for this contract and understands that
the new Program Manager and Deputy Program Manager are assessing the DRDs, cost, and specific
areas of technical performance. While they have made some progress, NASA requests that DMI provide
them with the resources and support to assist them with addressing the aforementioned concerns and
risks. HQ ITCD appreciates the involvement and partnership from the new Program Manager and Deputy
Program Manager as their communication has improved the relationship with HQ ITCD. As stated in the
last incentive fee letter, thoughtful management of cost and technical performance is imperative to
ensure that the IT services and support required by ITCD and HQ organizations are sustained and
enriched. NASA/HQ ITCD still expects that the areas of concern for cost and technical performance will
be managed closely and that completion of critical deliverables and the deficient DRDs, listed above, will
be achieved.

Bervrnce ff 24
Terence Haynes
Contracting Officer

Cc: HO/ITCD/Victor Thompson
HQ/ITCD/Liteshia Dennis


Compliance to the DRD requirements and delivery schedules were reviewed as part of the
technical surveillance. During this period, 51 DRDs were eligible for review. Of the 51 DRDs, 4
DRDs failed to meet requirements and/or the delivery schedule. (For specific comments,
reference the DRD rating provided in Addendum A of the Incentive Fee Letter.)

The DRDs that failed to meet requirements and/or delivery schedules outlined in the
Performance Work Statement are as follows:

DRD #41

DRD #8 HQ Enterprise Architecture Plan Updates i
DRD #16 Diagrams of Application logic, connectivity, interdependence and data
flow
DRD #31 Application Service Roadmap and Implementation Plan
As built detailed functional and physical description of development

environment, its interfaces and processes

General Tech: Performance

The following were identified as either continuing or new concerns by NASA with regards to
technical performance:
e Continuing Concerns
© Delivery of the On Demand System — During period 4 performance, a partial

solution was delivered. The solution delivered only addressed about 15% of the
total requirements outlined in the PWS and expected by ITCD and DMI for use
at the program, service, and contract levels of operations. After
implementation of this partial solution, NASA requested that the software
vendor be engaged to provide technical expertise to DMI on providing ITCD and
DMI with an operational, scalable, and manageable solution that addresses PWS
requirements, ITCD’s internal operational and service needs as well as DMI’s
needs for the HITSS program. DMI engaged the vendor who is now working
with DMI to redesign a scalable architecture and solution. NASA still requests a
deep-dive analysis from DMI with regards to the YE) expended on this
project prior to the implementation of the partial solution deployed during
period 4. Although DMI has assigned a different technical team and project
management team to the effort, NASA still requests weekly checkpoints with
both the vendor and DMI teams to ensure integration, collaboration, and
awareness of progress made.

Software Management Guide and Agile Implementation - The HITSS Program
Manager has implemented mitigations to improve the workflow, internal HITSS
communication, and assignment of work for this project. While progress
improved (largely due to government assistance) and SOPs have been delivered,
ITCD’s implementation and execution of an agile lifecycle required for
enhancement of many of ITCD’s services has yet to be realized. Asa result,
NASA has authorized an agile coach for DMI to assist with this transition. NASA
still has concerns that this expertise did not appear to reside within the DMI


National Aeronautics and
Space Administration

Goddard Space Flight Center
Greenbelt, MD 20771

Repiytoatn of = 210. July 3, 2014

Digital Management Inc.

Attn: Neysa Spence

6550 Rock Spring Dr, 7" Floor
Bethesda, MD 20817

Subject: Contract NNH12CF39C, HITSS Incentive Fee Period 3
Dear Ms. Spence,

NASA has completed the evaluation of your company’s technical performance for the third reporting
period, October 1, 2013 through March 31, 2014, under NASA Headquarters Contract Number
NNH12CF39C, Headquarters Information Technology Support Services (HITSS) Contract.

The result of NASA’s evaluation was that your company eared a total incentive fee of IZ
The Contracting Officer will prepare and forward the contract modification under separate cover for
payment of the carned incentive fee.

This letter conveys a summary of your company’s performance for the third 6-month period. The
scoring scheme used for evaluating performance is detailed in Attachment K of the contract, Incentive
Fee Plan and Incentive Fee Quality Assurance Plan.


NASA continues to request that a thoughtful management of cost and technical performance (based on
DMI management engagement with staff, DMI corporate’s assistance to the HITSS Program Manager
with addressing technical deficiencies and needed skill sets on the HITSS contract, and a true, fact based
analysis of the technical deficiencies with staff and of the deficiencies with regards to the execution of
work on this contract) is imperative to ensure that the iT services and support required by ITCD and HQ
organizations are sustained and enriched. NASA/HQ ITCD expects that the areas of concern for technical
performance will be fully addressed in preparation for the HITSS option year 3 (fiscal year 2016) in order
to realize stability in process, execution, and delivery in the various HITSS contract services. This
stabilization is essential as Mission Directorates, offices, and organizations begin to consider potential
collaboration across their teams for technical capabilities and begin to assess budgets against technical
services and support rendered across the various IT contracts. With more integration across the NASA
HQ offices, organizations, and Mission Directorates, it Is imperative that HITSS, specifically, DMI have a
better handle on resource planning, technical skills/capabilities, and work estimation to ensure that
execution of work across the HITSS task orders is timely and supportable.

Thank you for your support during period 5 performance and we look forward to making much progress
in the areas of concern during period 6 performance.

Terence Haynes pop

Contracting Officer

Cc: HQ/ITCD/Victor Thompson
HQ/ITCD/Liteshia Dennis

11


DRD Occupational Injuries and Illnesses One month from M
#19 Report contract start and
monthly thereafter
DRD Customer Service Metrics Proposal Deliver final three NA NA
#20 months after contract
start
DRD Customer Satisfaction Survey Report Deliver at contract start | M
#21 with the customer
satisfaction survey,
monthly summary
analytics and trending i
; DRD Training Program & Outreach Plan, Initial Draft 45 days M
#22A detailing materials, methods and from contract start;
approach and to include communications, | Final two months from.
and facilitating relationship building contract start.
activity. Two plans submitted cach year | Subsequent draft plan
with each plan covering the period of due each August 1 with
performance April 1 thru September 30 final due Oct 1; and
and October 1 thru March 31. Feb 1 with final due
April 1.
DRD ITCD Communications Plan Draft 45 days from NA No updates were
#22B contract start; final six requested,
months from contract
start. Updates as
required by ITCD.
DRD Customer Advisory and Service Review, | As required within 2 M
#23 meeting notes, action items, results, and _| business days of
schedule. meetings.
t
DRD | On-Boarding and Off Boarding Statistics | Deliver weekly M
#23A Report beginning 3 months
from contract start.
DRD Customer Requirements Adherence Deliver within 75 days | M
#24 Metrics Proposal of contract start; final
due 3 months after
contract start
DRD Requirements Adherence Report Deliver 3 months after | M
#25 contract start date,
monthly thereafter

12


DRD HQ Enterprise Architecture Plan Updates | 8 months after contract | F This DRD is under NASA
#8 start date review and will need to be
updated per NASA
feedback.
DRD Operational Level Agreements. Initial set due 4 months | M Requirement and
#9 after contract start; deliverable was addressed
subsequent due in in the IDAs and ICDs
accordance with updated for individual
Government schedules applications.
DRD Report on response times, ticket aging, 1 month after start date | M
#10 and customer satisfaction, delivered and monthly after that.
DRD Root Cause Analysis and Corrective as requested by ITCD M
#11 Action Plan
DRD Configuration Management Plan Update as required by | N/A No updates were
#12 TCD requested this
DRD CCB Meeting Minutes Weekly — 2 days after | M
#13 meeting
DRD __| Spare Parts Inventory Report 3 months after contract [M
#14 start, quarterly
thereafter
DRD | Summary of updates to ROSA showing | One time deliverable | M
#15A what was created due with Data
Migration Plan for
RAM
DRD Summary of updates to RAM showing Available quarterly M
#15B what was created and modified over after RAM
previous 3 months Implementation
DRD Diagrams of Application logic, 90 days after contract M
#16 connectivity, interdependence and data start and update
flow continuously
DRD Diagrams of Server dependencies Draft three months after | M
#17 (sinks/sources), physical placement and contract start; final six
relationship months and update
continuously
DRD Health & Safety Plan Submit with proposal N/A NIA
#18

11


The DRDs that failed to meet requirements and/or delivery schedules outlined in the
Performance Work Statement are as follows:

DRD #

DRD Description

N/A

N/A

General Technical Performance

The following were identified as either continuing or new concerns by NASA with regards to
technical performance:
* Continuing Concerns

°

Delivery of the On Demand System —Aithough DMI has assigned a different
technical team and project management team to the effort, progress towards a
final redesign and deployment of technical solution that meets NASA’s needs
continues to be slow.

Agile Implementation — Although the agile pilot is in progress and NASA is
beginning to see the transformation in how software development is executed,
there continues to be much concern with the estimation, planning, and
execution of work. Many of the concems regarding estimation appear to be
related to DMI’s ability to estimate the various types of technical
activities/work. Other concerns such as planning and execution appear to be
related to a learning curve with regards to agile/scrum methodology. Although,
the agile coach has done a good job with the pilot, NASA requests that DMI
provides training to the DMI staff to ensure that they are more equipped and
knowledgeable to execute software development work based on an agile
process.

Deficiency of Technical Skill Sets Required — There continues to be concerns
regarding the skills and experience of the technical staff and the PM staff
executing and managing the technical work. NASA has communicated the
technical areas where skill sets are deficient, and has requested that DMI
address this and that DMI provide a detailed plan for how this deficiency in
technical expertise will be resolved. This impacts estimation, workflow, service
request completion, technical capabilities, ITCD’s strategic plan, etc. This should
have been addressed by the end of period 4 performance. However, little
progress was made with regards to technical staff and skill sets. NASA continues
to request a mitigation plan and strategy accompanied with an actual
implementation schedule for addressing this deficiency. NASA still awaits
resolution and a thoughtful, realistic, executable plan from DMI.

Management and Allocation of Staff Across the Contract — NASA requested a
resource allocation and management plan (that provided details on what
resources/staff currently support HITSS, how those resources/staff members
would be assigned work, how work would be managed, etc.) from DMI during
period 4. DMI’s response to this request was insufficient. ITCD technical


{ DRD Customer Satisfaction Survey Report Deliver at contract start | M
#21 with the customer
satisfaction survey,
| Monthly summary
| analytics and trending
DRD Training Program & Outreach Plan, | Initial Draft 45 days M Contractor has met base |
#22A detailing materials, methods and from contract start; plan requirements, H
approach and to include communications, | Final two months from however, one key training
and facilitating relationship building contract start. component, the HR
activity. Two plans submitted each year | Subsequent draft plan Training Support Plan
with each plan covering the period of due each August 1 with Elements, is still pending
performance April 1 thru September 30 | final due Oct 1; and final completion. It
and October | thru March 31. Feb 1 with final due should be noted that
April 1. additional information
was requested by HITSS
{ from the government to
| complete this training
{ | component, The
{ | requested information was
provided but completion
of the training component
is still in progress,
DRD ITCD Communications Plan Draft 45 days from M | Updates were requested
#22B contract start; final six | during period 4 and were
months from contract | approved by ITCD,
start. Updates as i
required by ITCD. H
| DRD Customer Advisory and Service Review, | As required within 2 NA | Requirements to meet this
#23 meeting notes, action items, results, and _| business days of | DRD were relieved as a
schedule, meetings. result of non-government
: activity.
DRD On-Boarding and Off-Boarding Statistics | Deliver weekly M
#234 Report beginning 3 months
from contract start.
DRD Customer Requirements Adherence Deliver within 75 days | N/A Deliverable was required
#24 Metrics Proposal of contract start; final for contract year 1.
due 3 months after
contract start
DRD Requirements Adherence Report Deliver 3 months after i N/A Marked N/A for this
#25 contract start date, period because of its
monthly thereafter dependence on DRD 24.
DRD Summary and Trend Ticket Reporting One month from M
#26 including number of tickets opened, contract start date and
completed and pending (e.g. under a monthly thereafter
week, under two or over threc) number
escalated, rating, closed, times to first
respond, customer satisfaction. Summary
and reporting of phone support, email
support, and drop-in support.
DRD Service Request Processing Pian Within two weeks of NA N/A
#27 describing overall management and contract start date
execution of the SR system and customer
satisfaction report

13


Addendum A — Data Requirements Delivery Schedule Compliance and Surveillance Results

Score Card Key: N/A — The delivery of the DRD 1s not applicable for this contract reporting period. The DRD was
provided per the schedule outlined and all reqmrements were completed in period 1
M-~ The DRD requirements and delivery schedule were met satisfactorily.
F- The DRD requirements and/or delivery scheduled were not met.

DRD# DRD Name/Description Requirements & Score NASA Re

Delivery Schedule

DRD Documentation environment of metrics, | Updated and available | N/A N/A -— DRD is related to
#1 analytics and deliverables weekly during the first the contract transition,
implementation plan and migration two months of contract
schedule start; enhancements and
additional content
added monthly
thereafter until

j established baseline
schedule is met

DRD Transition plan and integrated schedule Available at contract NA N/A ~ DRD is related to

#2 start with significant the contract transition.
weckly updates for the
transition period up to
Operational Readiness
Review and acceptance.
DRD Contract Status Mecting Monthly — no ater than | M
#3 last week of the month
DRD Daily Tag Up Review Daily M
#4
DRD Integrated Master Schedule with ability | Updated every 2 weeks | M * IMS configuration is
#5 to drill down to supporting data, from month 2 of under review by both
including resource loading contract start date. ITCD and'DMI to
improve content and

usability. For reporting
period 5, both ITCD and
DMI have agreed to re-
assess for period 6 and to
implement configuration
changes for option year 3.

12


DRD Operational Level Agreements Initial set due 4 months | N/A No updates were
#9 after comme start; requested during the
subsequent due in .
accordance with performance period.
Government schedules
DRD Report on response times, ticket aging, 1 month after start date | M No updates were
#10 and customer satisfaction, delivered and monthly after that. requested this
performance period.
: DRD Root Cause Analysis and Corrective as requested by ITCD M
#11 Action Plan.
{ DRD Configuration Management Plan Update as required by | N/A ‘No updates were
#12 ITcD requested this i
performance period.
DRD CCB Meeting Minutes Weekly — 2 days after M
#13 meeting
DRD Spare Parts Inventory Report 3 months after contract | M
#14 start, quarterly
thereafter
DRD Summary of updates to ROSA showing One time deliverable N/A No updates were
#1SA what was created due with Data requested.
Migration Plan for
RAM
DRD Summary of updates to RAM showing Available quarterly N/A No updates were
#15B what was created and modified over after RAM requested.
previous 3 months Implementation
DRD Diagrams of Application logic, 90 days after contract F DRD 16 has been
#16 connectivity, interdependence and data start and update delivered at the server
flow continuously level via the deployment
diagrams but there is no
trace of application logic |
within those diagrams. |
The intent of this DRD
has been mis-interpreted.
However, this will be
satisfied by the Software
Architecture Documents
that are being delivered
in the current period.
DRD Diagrams of Server dependencies Draft three months after | N/A No updates were
#17 (sinks/sources), physical placement and contract start; final six requested during this
relationship months and update performance period.
continuously However, updates will be
requested during period 5.
DRD Health & Safety Plan Submit with proposal NIA N/A
#18
DRD Occupational Injurics and Illnesses One month from M
#19 Report contract start and
monthly thereafter
DRD Customer Service Metrics Proposal Deliver final three N/A N/A
#20 months after contract
start

12


© an increase in indirect rates for staff working at a DMI office location.

® numerous resources allocated to the delivery of the Software Management Guide (SMG}, SMG
related artifacts and processes, On Demand development and implementation, DMS redesigns,
etc.

e ITCD’s allocation of funding and a PM resource to address DMI’s lack of addressing deficiencies
in management and communication on task order 10.06. ITCD covered this cost to improve the
communication on task 10.06 in order to improve customer confidence. However, cost

continues to be an area of frustration for the task 10.06 customer and a challenge for DMI as
they continue to provide support on that task.

The table below outlines the planned versus actual period 3 performance for option year 1 (FY14).

Table 3 - Cost Performance: Labor

Piatined (Altowabie}

| Cost atthe Completion | Actual Cost at the

of Period 3 Completion of Period
Metric Deseniption Performance 3 Performance Variance Perfarmance Level Fee

Minimum Fee (Due to Slight
Overrun)

Maximum Fee (Due to Underrun)

Performance Level is TBD:
pending cost management for
‘the remainder of the Option Year

Core Variance (Fv34)

Asa result of the aforementioned factors, NASA has requested that DMI consider providing additional
guidance to HITSS staff developing estimates, ROMs, and pricing plans to ensure that an appropriate
model and technique is utilized on Core as well as all other HITSS task orders. While this request is
actively worked by the HITSS Program Manager and Deputy Program Manager to address with HITSS
staff contributing to estimates, ROMS, and pricing plans, much progress needs to be made in order to
prevent gross over/under estimation, staff assignments, and allocation of WYEs across task orders.

Based on the cost performance above, NASA considers cost performance as a high risk on this contract.


DRDs
Mapped Percent of

Percent NASA NASA Surveillance to Metric Performance the
ofMetric Surveillance Manager and/or Level for incentive
Met Manager Comments PWS Area incentiveFee Fee %

| Execution of plan
i objectives for
server reductions -
decommissioned i
12 servers,
including 3 Solaris
servers. Tested '
proposed solution
for moving e-
Delivery to VM
cluster and began
‘SR work. Enhanced
HQ VM cluster to
accommodate
applications that
were in process for |
West Prime. Moved |
Accomplishment of one application
Plan Objectives- NVDB from West
Data Center H Prime to the VM
2 Modernization Plan | 100% | Linda Hong cluster. DRD 57
Adherence to |
Service Request i DRDs 5 &
3 Scheduies 96% | 7. Dodson i 6 Target 5%
Problem Ticket | | DRDs 10 |
4 Response Time 94% | T. Dodson | &26 Target i 5%
Prime Time
5 Password Resets 88% | T. Dodson DRD 26 Minimum 4%
No outages for the
reporting period.
Reviewed all server
| ops tickets (847)
Restore Prime time | for the period and
Service Outages for i none were related
Applications and ‘to application or
6 Servers 100% | L. Hong server outages. Maximum 6%
No outages for the
reporting period.
Reviewed all server
Resolve Prime Time ops tickets (847)
Application and for the period and
Server Hardware | none were retated
and Software ‘to application or
7 Problems 100% | L. Hong server outages. Maximum. 5%
Customer DRDs 20
8 Satisfaction Surveys 100% | S. Artis &21 | Maximum 15%



TECHNICAL PERFORMANCE

PWS Metrics

The tables below provide summary level data for each metric: Specific comments are provided
for each metric in Table 1. Table 2 provides a breakdown of the incentive fee calculation by
metric.

Table 1— Metrics: Technical Surveillance Results

DRDs
Mapped Percent of
Percent NASA NASA Surveillance toMetric Performance the

Metric of Metric Surveillance Manager and/or Level for Incentive
# Met Manager Comments PWS Area IncentiveFee Fee %

Dennis/McCoy, See Below (This Maximum
Shouse, Hong metric consists of
Content of four plans. Only
Selected Plan three of the four
Updates were delivered.)
100% Liteshia DRD31- The DRDs 31
Dennis/Chris Application Service | & 32
McCoy Roadmap i
Deliverable was H
received on time
and discussed in
detail between |
HITSS App Dev and
ITCD App dev. This
deliverable was |
accepted for this
performance
period. Further
changes will be
required to
accommodate
changes in existing
Processes and
service domain
definitions.

DRD32 - The Legacy
Application
Disposition Plan
was received on
time and discussed
in detail between
HITSS App Dev and
ITCD App Dev. This
Content of Selected This deliverable
Plan Updates - was accepted for
Application Service this performance
Roadmap and period. Further
Implementation changes will be
Plan, Legacy required during the
Applications next performance
1 Disposition Plan period to

rn



DRDs
Mapped Percent of

Percent NASA NASA Surveillance toMetric Performance the
Metric ofMetric Surveillance Manager and/or Level for Incentive
& Met Manager Comments PWS Area incentivefee Fee %

accommodate
changes in
approach for i
retiring and
replatforming
legacy
applications...
100% Mary Shouse DRD 22A
Content of Selected
Plan Updates - j
Training Program }
1 and Outreach Plan
Content of Selected | 100% Linda Hong Received updated DRD 57
Plan Updates - Data Modernization plan
Center } and baselined. |
1 Modernization Plan
75% Dennis/McCoy, See Below (This Minimum 8%
Shouse, Hong metric consists of |
four plans. Onty
Accomplishment of three of the four
1 Plan Objectives were delivered.)
Accomplishment af | 50% Liteshia Only one of the DRDs 31
Plan Objectives - Dennis/Chris two deliverable &32
Application Service McCoy requirements were
Roadmap and met. |
Implementation |
Plan, Legacy
Applications i
2 Disposition Plan i
Accomplishment of | 100% Mary Shouse DRD 22A,
Plan Objectives-
Training Program
2 and Outreach Plan
100% Linda Hong Execution of plan DRD 57
objectives for
server reductions -
Successfully
migrated all
resources in the
data center that
could be migrated
to the VM Cluster.
Reduced the
number of physical
Accomplishment of servers by 20.
Plan Objectives-
Data Center |
2 Modernization Plan
Adherence to 96% T. Dodson DRDs5 & | Target 5%
Service Request 6
3 Schedules



DRD Website Delivery Implementation Plan | Initial draft eight M Delivered in form of
#42B (Formerly Version Description months from contract VDD and CR
Document but a secondary plan created | start; final nine months Implementation plan.
specifically for Website from contract start date
Implementations
DRD Release Notes Document Template Initial draft five months | M Delivered in form of
#42C from contract start; VDD and CR
final six months from Implementation plan.
contract start date
DRD 43A | Release Implementation Plan (foreach | Scheduled in M Delivered in form of
Application and Website) accordance with CCB VDD and CR
Implementation plan.
DRD Release Notes Document (for each Scheduled in M Delivered in form of
#43B Application and website) accordance with CCB VDD and CR
Implementation plan.
DRD Biennial Review of Forms Final Report j First report due M Although the
HAGA 10/1/2014 and deliverables were
biennially per NPD submitted to ITCD, there
1420.1 were several process
issues, resource issues,
and concerns with
regards to the content of
the report. ITCD and
DMI continue to work to
mitigate these issues and
concerns.
DRD Quarterly Data to Produce Forms Quarterly (Dec, March, | M Although the
#44B Bulletin (one for Agency and 1 for HQ) | June & Sept) deliverables were
submitted to ITCD, there
were several process
issues, resource issues,
and concerns with
regards to the content of
the report. ITCD and
DMI continue to work to
mitigate these issues and
concerns.
DRD #45 | Data Exchange Agreement Audit and Six months from N/A NA
Gap Analysis contract start date
DRD #46 | Service Level Agreement Audit Onc month from NA Initial was provided,
contract start date and PWS Description says:
monthly thereafter Six months from contract
start. I think this should
be changed to be either
quarterly or on demand.

18


The table below outlines the planned versus actual period 4 performance for option year 1 (FY14).

Table 3 — Cost Performance: Labor and ODCs

perjbc 4: April 1,
2014 « September 30,
2014

Actual Cost at the
Completion of Period
APerformance

Allowable Cost at the
Completion of Period 4
Performance

Metnc Description
The cost performance
incentive fee payable
shall be determined
based on the final
total allowable cost at
the completion of the
contract compared

j against the target cost
in accordance with
the share retios and
procedures specified
in Clauses B.8 and B.9.

Earned Fee

Maximum Fee (Due to
Care Labor Underrun)
Maximum Fee (Due to
Core ODC Underrun)

Core Total

Asa result of the aforementioned factors, NASA has requested that DMI consider providing additional
guidance to HITSS staff developing estimates, ROMs, and pricing plans to ensure that an appropriate
model and technique is utilized on Core as well as all other HITSS task orders. While this request is
actively worked by the HITSS Program Manager to address with HITSS staff contributing to estimates,
ROMS, and pricing plans, much progress needs to be made in order to prevent gross over/under
estimation, staff assignments, and allocation of WYEs across task orders.

NASA considers cost performance as a key focus on this contract due to the remediation of technical
debt and mitigation of deficiencies in technical talent required for NASA to execute on many of its key
initiatives. The DMI HITSS Program Manager has done a great job managing costs for this period. Close
management of costs should continue to ensure timely preparation for potential budget impacts.

SUMMARY

In summary, NASA was concerned with your company’s technical performance and cost performance
during this period. As the contract continues into option year 2, continued monitoring and
management of labor costs is expected to ensure that potential for overruns is minimized.

Overall, NASA is not satisfied with the technical performance during this period. There continues to be
concern regarding progress made on some of the DRDs that failed compliance with requirements and/or
delivery schedules. NASA must see progress on these DRDs as some of these DRDs are vital to NASA’s,
specifically ITCD’s, strategic plan and goals. Furthermore, the inability to deliver on some of these DRDs
implies that there is an apparent lack of appropriate skills and expertise on the contract. As such


DRD #76 | Monthly POA&M Status Report One month after
contract start date,
monthly thereafter

DRD #77 | Monthly ISSA Status Report ; Two months after
contract start date,
monthly thereafter

DRD #78 | Incident Response Training and Test annually by fiscal

Report year’s end
DRD #79 | Quarterly Metric Report summarizing Due 90 days from
the transaction history, incidents, and contract start date, and
inventories/inspections for that report every 3 months
thereafter

DRD #80 | HQ ITS Contingency & Continuity annually by fiscal

Plan, Training and Test Report annual year’s end
update

21



PWS
Section

PWS Area

Metric
#

of
Metre
Met

NASA Surveillance
Manager
Comments
number of total
releases multiplied
by 100. For the
reporting period in
question there
were a total of SO
releases with 43 of
those being
categorized as
successful. Per the
calculation, the %
of Metric Met was
derived to be 86%
and is therefore
denoted as such.

Performance
Level for

Incentive Fee

ofthe
Incentive
Fee

6 Headquarters Data Center
Datacenter 10__| Availability 100% Maximum Fee 8%
6 Headquarters Compliance with
Datacenter Patch Management i
11__| Plan 100% MaximumFee | 7%
7 Systems This is waived for 1
Engineering Delivery of Annual this reporting
and Tactical Plan and period since the !
Integration Updates on tactical plan was j |
12 Demand 100% | reprioritized. MaximumFee | 2% |
8 IT Security Vulnerability i
13 Mitigation 100% } Maximum Fee 10% H
8 Security 14__| incident Response 100% | Maximum Fee 5% |

Metric #

a 75%

Table 2— Incentive Fee: Technical Performance

Performance
Level

Less than
83% of the
required
elements are
included.

Available Fee

Pool Earned
Adjecti

pool for 6
months

Minimum Fee

Incentive
Fee

Earned Fee
(Calculated)

Less than
81% of the
objectives
are
completed.

Minimum Fee

Less than
94% meet
the criteria,

Minimum Fee

4 92%

Less than
93% meet
the criteria.

Minimum Fee

5 99%

Meet

Maximum Fee

Earned Fee
(Rounded)


The table below outlines the planned versus actual period 5 performance for option year 2 (FY15).

Table 3 — Cost Performance: Labor and ODCs

Peribd 5- October 1,
2034 - March 31,
2035

Allowable Cost atthe — | Actual Cost at the
Completion of Period 5 | Completion of Period 5
Metric Description Performance Performance Variance Performance Level Earned Fee
‘The cost performance
ncentive fee payable
shall be determined
based on the final
total allowable cost at
‘the completion of the
contract compared
against the target cost
i in accordance with
‘the share ratios and
procedures specified
in Clauses B.8 and B.9.

Maximum Fee (Due
to Underrun)

Maximum Fee (Due
to Underrun)

Core Labor

Core ODC |
Core Total

Asa result of the aforementioned factors, NASA has requested that DMI consider providing additional
guidance to HITSS staff developing estimates, ROMs, and pricing plans to ensure that an appropriate
model and technique is utilized on Core as well as all other HITSS task orders. While this request is
actively worked by the HITSS Program Manager to address with HITSS staff contributing to estimates,
ROMS, and pricing plans, much progress needs to be made in order to prevent gross over/under
estimation, staff assignments, and allocation of WYEs across task orders.

NASA considers cost performance as a key focus on this contract due to the remediation of technical
debt and mitigation of deficiencies in technical talent required for NASA to execute on many of its key
initiatives, The DMI HITSS Program Manager has done a great job managing costs for this period. Close
management of costs should continue to ensure timely preparation for potential budget impacts.

SUMMARY

In summary, NASA was concerned with your company’s technical performance during this period.
Overall, NASA is not satisfied with the technical performance during this period. Although there is great
appreciation for the support and services provided in the area of Information Security, deficiencies in
other technical areas continue to plague this contract, specifically on the Core task order, and the
requirements requested of DMI to fulfill during this and previous performance periods. Due to slow
resolution of deficiencies in technical performance, NASA, specifically ITCD, continues to incur risks to
delivery of services, to experience delays with improvement of technologies and related resources that
are critical to the NASA HQ offices and organization.

10


monitors and ITCD leadership continue to express frustration and concern
regarding (but not limited to) the following:
Work performed is often single threaded or performed serially.
= DMI can rarely provide an explanation of resource assignments.
= DMI cannot provide a percentage allocation for each resource/staff
member across the contract and across task orders.
= DMI still not appear to have a strong understanding of the skills and
expertise of its HITSS staff.
= DMI continues to express that its concern regarding sufficient staffing,
however, when asked to produce a staffing plan, it cannot.
= DMI projects potential overruns for labor, but the amount of service
requests does not support the projected cost overrun on labor.
= Some DMI HITSS managers (at the COE level) do not demonstrate a
good grasp on cross training, cross utilization, matricing, and managing
resources and work to ensure timeliness of deliverables.
= Some HITSS staff do not appear to have a sense of schedule or of
urgency with regards to product delivery and completion of work. It
takes HITSS too long to complete service requests and this impacts
stakeholder operations.
Due to the above concerns, NASA requested escalation to DMI executive
management. NASA expected resolution by end of period 5; however, NASA
still waits for resolution.
© Agency and HQ Forms —NASA requested a change in resourcing/staffing in this
area to ensure that there was appropriate oversight and execution of work,
NASA still waits for the remaining mitigations and staff changes requested to be
completed,
© Agency and HQ Forms - NASA/ITCD still has concerns regarding the staffing
required to support Agency and HQ forms as well as the stability of the team
with regards to turn-over. It is critical for DMI to show stability and consistency
with regards to communication and execution of work for Agency forms as well
as HQ forms. Furthermore, it is critical that DMI show that it can support
Agency forms and HQ forms with a reasonable and justifiable staffing level. This
is critical to ensure consistency in the deliverables, continuity in communication,
and management of budget.
© Mitigation of Vacancies Across the HITSS Task Orders — There appears to be
difficulty in addressing backfills for new and vacant positions across the
contract. Several task orders have had vacant positions for months. While
NASA appreciates DMI’s commitment to finding qualified candidates, NASA is
concerned that DMI does not appear to have sufficient resources (internal/DMI
or external (via partners and other staffing resources)} to address these
vacancies ina timely manner. Timeliness in addressing new and vacant
positions on this contract is critical to continuity and quality of services.
* Strengths This Performance Period
© Overall, the performance of the HITSS security team has been outstanding
during this performance period. Some key accomplishments include:
= The HITTS security compliance team successfully transitioned all HQ
SA&A documentation and processes to the new NASA Security
Authorization and Assessment Repository. In addition, the team


DRD #36 | Software Management Guide Interim due three This document was H
months after contract delivered on 2-28-2014.
; Start date; updated This date is quitesome |
SDLC due six months time after the agreed |
| after contract start; upon date. The document |
| modifications reflecting was in sucha condition |
approved modifications as to require multiple |
quarterly thereafter comment and revision |
cycles, This document is |
currently partially |
complete as there area |
number of related |
| supporting artifacts that |
will need to be created. |
DRD #37 | Standard requirements template that Within two months
documents the service or design need from contract start date |
from the perspective of effected
discipline areas (e.g. applications
development, IT security, customer
training, operations) and by level of
need (c.g. mandatory, optional,
preferred).
DRD #38 | System Design Specification Two months from H
contract start date, | ;
modifications reflecting | i
approved modifications i |
as needed thereafter | i
; H
i i
DRD #39 | Application Status Review materials Three months from | This DRD was not i
contract start, monthly delivered.

thereafter

DRD #40 | Portfolio Management Views of Six months from i
Application Services and Inventories contract start date, i
continuously thereafter !
DRD #41 | As built detailed functional and physical | Two months from
description of development contract start date, |
environment, its interfaces and provided within 2 days
processes of changes to structural
or ITS environment |
including patches

15


Reserved. [N/A NA
DRD #60 | Contractor Information Security Within one month from | M
Management Plan contract start date,
updated annually
thereafter
DRD #61 | Draft Policy, Requirement, Procedure, | On demand M
or Standard
DRD #62 | eDiscovery Data Search Results On demand M
DRD #63 | Reserved N/A NA
DRD #64 | Security Reviews and Assessments On demand M
DRD #65 | Daily Risk Vulnerability Report Daily
DRD #66 | Monthly Vulnerability Scan Report Onc month after
(encrypted) contract start date,
monthly thereafter
DRD #67 | Intrusion Detection Summary One month after M
! contract start date,
! quarterly thereafter
DRD #68 | Monthly Wireless 802.11 Scanning Two months after M
Report (encrypted) contract start date,
monthly thereafter
DRD #69 | Annual Penetration Test Plan and Rules | On demand M
of Engagement and Schedule
DRD #70 | Annual HQ Penetration Testing Report | On demand
DRD #71 | IT C&A Security Plan Assessment On demand
| using the NASA standard template
DRD #72 | Risk Assessment On demand
DRD #73 | Security Controls Assessment Report On demand
Assessment using the NASA standard
template
DRD #74 | Plan of Actions and Milestones On demand M
Assessment using the NASA standard
template
DRD #75 | System Certification Report On demand M

20


DRD Quarterly Data to Produce Forms Quarterly (Dec, March, | M
#44B Bulletin (one for Agency and i for HQ) | June & Sept)
DRD #45 | Data Exchange Agreement Audit and Six months from. NIA NA
Gap Analysis contract start date
DRD #46 | Service Level Agreement Audit One month from N/A Initial was provided,
contract start date and. PWS Description says:
monthly thereafter Six months from contract
start. I think this should
be changed to be either
quarterly or on demand.
DRD #47 | Availability of hosted and housed One month from M
services contract start date and
monthly thereafter
DRD #48 | Performance of hosted and housed One month from M
services contract start date and
monthly thereafter
DRD #49 | Diagram of server location Three months from M
contract start date and
every three months
thereafter
DRD #50 | Diagram of servers logical connection Three months from M
to network contract start date and
on-demand thereafter
DRD #51 | Capacity and Performance Report Two months from M
contract start date, on-
demand thereafter
DRD #52 | Quarterly/Monthly Patch Release One month after M
Report contract start date,
monthly thereafter
| DRD #53 | Equipment Upgrade Evaluation Report | 90 days of contract start | M
! date and semiannually
thereafter
DRD #54 | Moved to DRD#67 NIA NA
DRD #55 | Data Center (including SEF) SOP Audit | Six months from F Provided initially, but
& Recommendations Report contract start date and have not provided
monthly thereafter monthly
DRD #56 | Reserved Reserved N/A NA

17


Pws
Section

PWS Area

% of
Metric
Met

NASA Surveillance
Manag
Comments

Performance
Level for

Incentive Fee

% of the
Incentive
Fae

2 Program (400% metric
Management given} The Legacy
Applications
H Disposition Plan
| objectives identified
for period 3 were
Accomplishment of either met or
Plan Objectives - reprioritized per the
Application Service government. {0%
Roadmap and ‘metric given) - The
Implementation Application Service
Plan, Legacy Roadmap and
Applications Implementation
Disposition Plan 25% | Plan,
2 bi el ent Accomplishment of
Plan Objectives- 100% of the
Training Program objectives were
and Outreach Plan 25% | met.
2 Program None of the
| Management objectives were met
since the plan was
Accomplishment of not approved by
Plan Objectives- ITCD and no revised !
Data Center | plan was submitted
Modernization Plan 0% | by the contractor.
2 Program Adherence to
Management Service Request
Schedules 66% Minimum Fee 5%
2 Program
Management Problem Ticket Actual metric
Response Time 92% | report: 91.95% Minimum Fee 5%
3 Program Wide
Services Prime Time Actual metric
Password Resets 99% | report: 98.65% Maximum Fee 4%
8 Program Wide Restore Prime time
Services Service Outages for
Applications and H
Servers 100% Maximum Fee 6%
3 Program Wide
Services Resolve Prime Time
Application and
Server Hardware
and Software
Problems 100% Maximum Fee s%
4 Customer
Relationship Customer
Management Satisfaction Surveys 100% Maximum Fee 15%
5 Application The % of metric
Development met was calculated
| and using the
j Information measurement as
Management described within
the PWS. The
| measurement for
this metric is
computed as the
number of
Post-Release Bug successful releases
Fixes 86% | divided by the Target Fee 13%



National Aeronautics and
Space Administration

Goddard Space Flight Center
Greenbelt, MD 20771

Repytoatinot; 210.H August 11, 2015

Digital Management Inc.

Attn: Thelma Miles

6550 Rock Spring Dr, 7 Floor
Bethesda, MD 20817

Subject: Contract NNH12CF39C, HITSS Incentive Fee Period 5
Dear Ms, Miles,

NASA has completed the evaluation of your company’s technical performance for the fifth reporting
period, October 1, 2014 through March 31, 2015, under NASA Headquarters Contract Number
NNH12CF39C, Headquarters Information Technology Support Services (HITSS) Contract.

The result of NASA’s evaluation was that your company earned a total incentive fee of I
The Contracting Officer will prepare and forward the contract modification under separate cover for
payment of the earned incentive fee.

This letter conveys a summary of your company’s performance for the fifth 6-month period. The scoring
scheme used for evaluating performance is detailed in Attachment K of the contract, Incentive Fee Plan
and Incentive Fee Quality Assurance Plan.


employee base and that additional funds outside of the labor dollars budgeted
for the contract were needed to supplement this lack of expertise.
Deficiency of Technical Skill Sets Required — There continues to be concerns
regarding the skills and experience of the technical staff and the PM staff
executing and managing the technical work. NASA has communicated the
technical areas where skill sets are deficient, and has requested that DMI
address this and that DMI provide a detailed plan for how this deficiency in
technical expertise will be resolved. This impacts estimation, workflow, service
request completion, technical capabilities, TCD’s strategic plan, etc. This should
have been addressed by the end of period 4 performance. However, little
progress was made with regards to technical staff and skill sets. NASA continues
to request a mitigation plan and strategy accompanied with an actual
implementation schedule for addressing this deficiency. NASA still awaits
resolution and a thoughtful, realistic, executable plan from DMI.
Management and Allocation of Staff Across the Contract ~ NASA requested a
resource allocation and management plan (that provided details on what
resources/staff currently support HITSS, how those resources/staff members
would be assigned work, how work would be managed, etc.) from DMI during
period 4. DMIs response to this request was insufficient. ITCD technical
monitors and ITCD leadership continue to express frustration and concern
regarding (but not limited to) the following:
= Work performed is often single threaded or performed serially.
= DMI can rarely provide an explanation of resource assignments.
= DMI cannot provide a percentage allocation for each resource/staff
member across the contract and across task orders.
= DMI still not appear to have a strong understanding of the skills and
expertise of its HITSS staff.
= DMI continues to express that its concern regarding sufficient staffing,
however, when asked to produce a staffing plan, it cannot.
= DMI projects potential overruns for labor, but the amount of service
requests does not support the projected cost overrun on labor.
= Some DMI HITSS managers (at the COE level} do not demonstrate a
good grasp on cross training, cross utilization, matricing, and managing
resources and work to ensure timeliness of deliverables.
= Some HITSS staff do not appear to have a sense of schedule or of
urgency with regards to product delivery and completion of work. It
takes HITSS too long to complete service requests and this impacts
stakeholder operations.
Due to the above concerns, NASA requests escalation to DMI executive
management. NASA expects resolution by end of period 5.
Agency and HQ Forms — The Agency Forms Manager and the HQ Forms
Manager communicated concerns to ITCD and DMI regarding the lack of
completion of the Biennial Forms Review project and the Agency & HQ Form
Conversion project. NASA requested a change in resourcing/staffing in this area
to ensure that there was appropriate oversight and execution of work.
Furthermore, communication was weak and compliance with Agency SOPs and
ITCD’s service request workflow/process was lacking. Although DMI was able to
regain stakeholder confidence at the Agency level, NASA/ITCD still has concerns

7


TECHNICAL PERFORMANCE

PWS Metrics

The tables below provide summary level data for each metric. Specific comments are provided
for each metric in Table 1. Table 2 provides a breakdown of the incentive fee calculation by

metric.

Pws PWS Area
Section

Metric

"

Manager
Comments

Table 1 — Metrics: Technical Surveillance Results

Performance
Level far
Incentive Fee

% of the
Incentive
Fee

2 Program
Management Content of Selected
1 | Plan Updates 75% | See Below Minimum Fee T%
2 Program {200% metric
Management given) -The Legacy
Applications
Disposition Pion
was updated and
reviewed by the
government. The
plan does require
an update before
9/30/2014 and this
next update must
meet ITCD
requirements and
Content of Selected match iTCD pionned
Plan Updates - initiatives. {100%
Application Service metric given) - The
Roadmap end Application Service
Implementation Roadmap and
Plan, Legacy Implementation
Applications Plan was approved
Disposition Plan 50% | by the government.
2 Program Updates to the
Management Training Program
. and Training Plan
Content of Selected were approved by
Plan Updates - technical monitor.
Training Program Updates met
and Outreach Plan 25% | expectations.
2 Program Per technical
Management monitor, there were
no updates to the
Data Center
Modernization Pian
this period. The
initial plan was not
| accepted by ITCD,
| Content of Selected therefore, no
Plan Updates - Data updates to the plan
Center were proposed or
Modernization Pian 0% | initiated.
2 Program
Management Accomplishment of
l i Plan Objectives 50% | See Below Minimum Fee 38%



DRD Project Schedule Adherence Report Monthly — no later than | N/A See notes above.
#6 second week of the
month
DRD Logistics Management Plan Three months after NA
#7 contract start date.
DRD HQ Enterprise Architecture Plan Updates | 8 months after contract | N/A _! Per ITCD request, the EA
#8 start date Plan updates were
deferred until reporting
period 6.
DRD Operational Level Agreements Initial set due 4 months | N/A * No OLA updates were
#9 after contract start; requested during reporting
subsequent due in period 5.
accordance with
Government schedules
DRD Report on response times, ticket aging, 1 month after start date | M
#10 and customer satisfaction, delivered and monthly after that.
DRD Root Cause Analysis and Corrective as requested by ITCD M
#11 Action Plan
DRD Configuration Management Plan Update as required by | N/A No updates were
#12 ITCD requested during reporting
period 5,
DRD CCB Meeting Minutes Weekly— 2 days after | M
#13 meeting
DRD Spare Parts Inventory Report 3 months after contract | M
#14 start, quarterly
thereafter
DRD Summary of updates to ROSA showing | One time deliverable N/A ROSA is no longer
#15A what was created due with Data’ referenced for updates due
Migration Plan for to use of RAM.
RAM
DRD Summary of updates to RAM showing Available quarterly N/A No updates were \
#15B what was created and modified over after RAM requested. j
previous 3 months Implementation
DRD Diagrams of Application logic, 90 days after contract | M
#16 connectivity, interdependence and data start and update
flow continuously

13


DRD Framework for Web Site Development ] Due nine months after Delivered on time.
#34B Program contract start
DRD#35_ | Interface Control Documents One month from Multiple submitted on a
contract start date and per application basis
as needed thereafter where applicable as
prescribed within an
approved PTC,
i
|
DRD #36 | Software Management Guide | Interim due three iM Was delivered last
months after contract | performance period with
start date; updated ' a due out that SOPs
SDLC due six months would be developed to
after contract start; define the low level
modifications reflecting processes and
approved modifications procedures. These SOPs
quarterly thereafter were developed and
delivered on time.
DRD #37 | Standard requirements template that Within two months M Was delivered in the
documents the service or design need from contract start date form of an Agile SOP for
from the perspective of effected user story creation and a
discipline areas (c.g. applications Production backlog
development, IT security, customer template.
training, operations) and by level of
need (e.g. mandatory, optional,
preferred).
DRD #38 } System Design Specification Two months from N/A Not requested.
contract start date,
modifications reflecting
approved modifications
|_as needed thereafter
DRD #39 | Application Status Review materials Three months from N/A Not requested.
contract start, monthly
thereafter
DRD #40 | Portfolio Management Views of Six months from N/A Not requested.
Application Services and Inventories contract start date,
continuously thereafter
DRD #41 | As built detailed functional and physical | Two months from F Technical Monitor did
description of development i contract start date, not receive this DRD
environment, its interfaces and | provided within 2 days during this period.
processes i of changes to structural
| or ITS environment
| including patches
DRD Application Delivery Implementation —_| Initial draft five months | M Delivered with each
#42A Plan (Formerly Version Description | from contract start; application release as
Document but renamed to Release final six months from part of the deployment
Implementation Plan Template) contract start date package. Due to current
SDLC/SMG, the
document is still referred
toas VDD
interchangeably by
HITSS staff.

15


Table 2 — Incentive Fee: Technical Performance

Available Fee

Performance PoolEamed pool for 6 incentive
Metric # Metric Description Score Level Adjective months Fee Earned Fee
100% 98%-. of the Maximum 7%
Content of Selected required elements
1 | Plan Updates are included.
75% Less than 81% of =| Minimum
Accomplishment of the objectives are
2 | Plan Objectives completed.
Adherence to 96% 94% - 97% meet Target
Service Request the criteria. 3
3 | Schedules
Problem Ticket 79% Less than 93% Minimum
4 | Response Time meet the criteria.
82% Meet metrics less | Minimum
Prime Time than 90% of the
5 | Password Resets time.
Restore Prime time | 100% Meet response Maximum
Service Outages for and mitigation
Applications and metrics 96% -
6 | Servers 100% of the time.
Resolve Prime Time | 100% Meet response Maximum
Application and and mitigation
Server Hardware metrics 96% -
and Software 100% of the time.
7 | Problems
Customer 100% 98%-100% meet Maximum
8 | Satisfaction Surveys the criteria.
Post-Release Bug 96% 93% - 100% are Maximum
9 | Fixes error free.
Data Center 100% 99.99% - 100% Maximum
10 | Availability average
Compliance with 100% 99% - 100% meet | Maximum
Patch Management the criteria.
11_| Plan
Delivery of Annual 100% 100% submitted Maximum
Tactical Plan and ‘on time.
Updates on
Demand
Vulnerability 100% 98% - 100% meet | Maximum
Mitigation the criteria.
100% Meet the criteria Maximum
96% - 100% of the
14 | Incident Response time

Compliance to the DRD requirements and delivery schedules were reviewed as part of the
technical surveillance. During this period, 51 DRDs were eligible for review. Of the 51 DRDs, 0
DRDs failed to meet requirements and/or the delivery schedule. (For specific comments,
teference the DRD rating provided in Addendum A of the Incentive Fee Letter.)


deficiency manifests itself in the technical performance, impacts and risks are incurred for overall cost
for projects/service requests, budget, and service delivery for this contract.

NASA continues to request that a thoughtful management of cost and technical performance (based on
DMI management engagement with staff, DMI corporate’s assistance to the HITSS Program Manager
with addressing technical deficiencies and needed skill sets on the HITSS contract, and a true, fact based
analysis of the technical deficiencies with staff and of the deficiencies with regards to the execution of
work on this contract) is imperative to ensure that the IT services and support required by ITCD and HQ
organizations are sustained and enriched. NASA/HQ ITCD still expects that the areas of concern for cost
and technical performance will be managed closely and that completion of critical deliverables and the
deficient DRDs, listed above, will be achieved.

NASA also requests careful scrutiny with regards to the current communications and escalation protocol
across the HITSS staff. Expectations with regards to appropriate communication and escalation protocol
must be established by DMI with HITSS staff to ensure that the staff understands, acknowledges, and
complies with the guidelines for how information is communicated for the following:
¢ Between the HITSS Contract and ITCD (as the owner of governance for HQ IT services
offered under the HITSS contract)
¢ Between the HITSS Contract and NASA/Agency (as the owner of policy}
¢ From the Contractor to Government — (understanding that contractors cannot act on
behalf of the government)
¢ Appropriate relationships between contractors and civil servants — (understanding that
civil servants provide direction and guidance for work to be executed and performed;
understanding that there is a political climate on every contract and being mindful
regarding what and how to communicate as well as the implications for thoughtless
communication.)
NASA expects that this concern regarding communication protocol be addressed immediately and that
DMI provides a sufficient framework for managing HITSS staff communication compliance and a
consequences for non-compliance.

Thank you for your support during period 4 performance and we look forward to making much progress
in the areas of concern during period 5 performance.
FLR

Terence Haynes y
Contracting Officer

Cc: HO/ITCD/Victor Thompson
HQ/ITCD/Liteshia Dennis

10


DRD Summary and Trend Ticket Reporting One month from M |
426 including number of tickets opened, contract start date and :
completed and pending (e.g. under a monthly thereafter {
week, under two or over three) number i
escalated, rating, closed, times to first i
respond, customer satisfaction. Summary |
and reporting of phone support, email |
support, and drop-in support.
DRD Service Request Processing Plan Within two weeks of NA NWA
#27 describing overall management and contract start date
execution of the SR system and customer
satisfaction report
DRD NA N/A (This DRD was 4
#28 | removed from the DRD
i requirement list.)
i
DRD | Catalog Orders Report/Checkbook Two weeks from M
#29 includes number of orders by category, contract start date,
requisition number and funding source (if | monthly thereafter
known), number complete, funds used
versus available, funds in process,
summary total of monthly catalog invoice
and break out of ITCD funded monthly
| total.
DRD Application Service Framework Two months from NIA Was delivered late. This
#30 contract start date, document has a
modifications reflecting dependency on the SMG
approved changes as methodology
required implementation therefore
this document will remain
in draft form. The SMG
completion timeline has
had a negative effect on
this deliverable.
DRD Application Service Roadmap and Six months after NA Dependent upon
#1 Implementation Plan contract start and every completion of the Service
six months thereafter, Framework Document.
modifications reflecting
approved changes as
required. (Due last
business day of each
Incentive Fee Period)

13


DRD Diagrams of Server dependencies Draft three months after | N/A | No updates were
#IT (sinks/sources), physical placement and | contract start; final six | ee during this
oe performance period.
relationship months ca However, updates will be
requested during period 5.
DRD Health & Safety Plan Submit with proposal N/A N/A
#18 i
j
i
DRD Occupational Injuries and LlInesses ! One month from M
#19 Report contract start and
monthly thereafter
DRD Customer Service Metrics Proposal Deliver final three NIA NA
#20 months after contract
start
DRD Customer Satisfaction Survey Report Deliver at contract start | M
#21 with the customer
satisfaction survey,
monthly summary
analytics and trending
DRD Training Program & Outreach Plan, Initial Draft 45 days M
#22A detailing materials, methods and from contract start;
approach and to include communications, | Final two months from
and facilitating relationship building contract start.
activity. Two plans submitted each year | Subsequent draft plan
with each plan covering the period of due each Angust 1 with
performance April 1 thru September 30 final due Oct 1; and
and October 1 thru March 31. Feb 1 with final due |
April 1, i
DRD ITCD Communications Plan Draft 45 days from M
#22B contract start; final six
months from contract
start. Updates as
required by ITCD.
DRD Customer Advisory and Service Review, | As required within 2 NA Requirements to meet this
#23 meeting notes, action items, results, and | business days of DRD were relieved as a
schedule. meetings. result of non-government
activity.
DRD On-Boarding and Off-Boarding Statistics | Deliver weekly M
#23A Report beginning 3 months
from contract start,
DRD Customer Requirements Adherence Deliver within 75 days | N/A Deliverable was required
#24 Metrics Proposal of contract start; final for contract year 1.
due 3 months after
contract start

14



DRD Application Service Roadmap and Six months after M Deliverable was received
#31 Implementation Plan contract start and every on time and discussed in
six months thereafter, detail between HITSS
ee ge : Dev and ITCD
modifications reflecting nd Further ange on
{ approved changes as be required to
required. (Due last accommodate changes in
business day of each ! existing processes and
Incentive Fee Period) ; Service domain
| definitions.

DRD #32 | Legacy application disposition plan Six months from M Deliverable was received
contract start date, on time and discussed
modifications reflecting | between HITSS App Dev
status and approved and ITCD App Dev.

Changes to
changes every 60 days. accommodate an AWS
Mnitial plan duc last Hosting Environment
business day of will be factored into the
Incentive Fee Period next release.
(3/29/2013); 60 day
status due the first
business day of July,
September, November,
January and March)

DRD #33 | Legacy application portfolio report Six months from N/A Did not request this
contract start date, artifact for this
modifications reflecting peormance fe Period.

i le! wit
status and approved the current performance
changes every 60 days. period.

{Initial plan due last

| business day of

Incentive Fee Period
(3/29/2013); 60 day
status due the first
business day of July,
September, November,
January and March)

DRD Framework for Development Program —_| Due at contract start, NA Did not request this

#B4A modifications reflecting artifact for this
approved changes as performance period.
required

DRD Framework for Web Site Development -| Due nine months after { N/A Did not request this

#34B Program contract start artifact for this

I performance period.

16


DRD Application Delivery Implementation Initial draft five months | M Still called VDD. Tied
#42A Plan (Formerly Version Description from contract start; toSMG. DRDs 42A,
Document but renamed to Release final six months from 42B, 42C, 43A, 43B
Implementation Plan Template) contract start date were delivered
based on redefined
requirements per ITCD
and DMI collaborative
efforts.
DRD Website Delivery Implementation Plan | Initial draft eight M DRDs 42A, 42B, 42C,
#42B (Formerly Version Description months from contract . 43A, 43B were delivered
| Document but a secondary plan created | start; final nine months based on redefined
specifically for Website from contract start date requirements per ITCD
Implementations and DMI collaborative
efforts.
DRD Release Notes Document Template Initial draft five months | M Started with
#42C from contract start; WestPrime effort.
final six months from Currently takes the
contract start date form of “Read Me”
files. This will be
retitled to Release
Notes.
DRDs 42A, 42B, 42C,
43A, 43B were delivered
based on redefined
requirements per IFCD
| and DMI collaborative
| efforts.
|
f DRD 432A | Release Implementation Plan (foreach | Scheduled in M Met via VDD and CR
Application and Website) accordance with CCB implementation plans.
DRD Release Notes Document (for each Scheduled in M Meet via VDD and CR
#43B Application and website) accordance with CCB implementation plans.
DRDs 424A, 42B, 42C,
43A, 43B were delivered
based on redefined
requirements per ITCD
and DMI collaborative
| efforts.
DRD Biennial Review of Forms Final Report | First report due NA Will be delivered during
H44A 10/1/2014 and | performance period 4 of
biennially per NPD | option year 1.
1420.1

16