10_-_Description_of_Work__Scope.pdf

Arizona Department of Corrections, Rehabilition and Reentry (ADCRR) Tab 10 Electronic Payment Transaction Processing Services Description of Work/Scope BPM005375 ©2023 Keefe Group® Page 1

DESCRIPTION OF WORK / SCOPE

Keefe Response: Please see the following for Keefe’s response the Description of Work, Scope of Services.

In addition, Keefe has provided a response to Delivery of Services - Section 4.5 and Experience and Capability.

4.5. DELIVERY OF SERVICES:

4.5.1. Costs and Revenue. The awarded Contractor(s) is required to bear all of its costs to provide the Services. Contractor’s sole compensation and/or revenue shall be its transaction fees collected from the public. No ADCRR or State funds shall be paid to Contractor at any time as payment, compensation, and/or reimbursement, etc., for any part of Contractor’s Services. Offeror should acknowledge it has read and agrees with this Section 4.5.1. Any Offeror unable or unwilling to accept these terms shall be determined not susceptible for award.

Keefe Response: Keefe has read, understands, and shall comply with this Section.

There will be no cost to ADCRR. Keefe recognizes that its Keefe’s sole compensation and or revenue shall be its transaction fees collected from the public and no ADCRR or State funds shall be paid to the Contractor at any time as payment, compensation, and or reimbursement for any part of Keefe’s services.

4.5.2. Minimum Requirements. Contractor shall meet the following minimum requirements:

4.5.2.1. As applicable, Contractor agrees to make all necessary changes to its system (hardware, software, interfaces, etc.), at no cost to ADCRR, to accommodate any future changes to Keefe’s KeepTrak Inmate Banking System, or any future system replacing it, including an option (to be implemented upon request by ADCRR) for real-time or near real-time (at ADCRR’s sole discretion) interaction/processing. Any such changes shall be made in a timely manner on a schedule to be approved by ADCRR.

Keefe Response: Keefe has read, understands, and shall comply with Sections and

Subsections herein.

Keefe adheres to the KeepTrak Deposit Apply Services interface including:

• Automatically Posting individual inmate and offender deposits into the KeepTrak inmate or offender account respectively

• Automatically Posting nightly ACH transactions into the KeepTrak Ledger

Keefe agrees to comply with future changes required for current or future systems at no cost to

ADCRR.

4.5.2.2. As applicable, Contractor agrees to make all necessary changes to its system (hardware, software, interfaces, etc.), at no cost to ADCRR, to accommodate a request by ADCRR to set a daily/hourly schedule for when transactions shall be authorized to be sent to

BPM005375 ©2023 Keefe Group® Page 2

ADCRR’s inmate trust account system. Any such changes shall be made in a timely manner on a schedule to be approved by ADCRR.

Keefe Response: Keefe has read, understands, and shall comply with this Subsection.

Keefe agrees to make changes to its system (hardware, software, interfaces, etc.), to accommodate a request by ADCRR to set a daily/hourly schedule for when transactions shall be authorized to be sent to ADCRR’s inmate trust account system. Keefe adheres to any such changes shall be made in a timely manner on a schedule to be approved by ADCRR. Keefe agrees to comply with future changes required for current or future systems at no cost to ADCRR.

4.5.2.3. Provide a system which:

4.5.2.3.1. Includes all items/components (including all hardware, software, electronic interfaces, etc.) needed for Contractor’s system to successfully interface and work with ADCRR’s systems, and

Keef will provide all items/components (including all hardware, software, electronic interfaces, etc.) needed for Contractor’s system to successfully interface and work with ADCRR’s systems.

4.5.2.3.2. Includes services for ADCRR’s Central Office; Community Corrections

Division; Constituent Services Office; and all Arizona prison facilities, whether existing or future, and whether publicly or privately operated (existing ADCRR locations are shown in Exhibit A); and

Keefe services will be established for all locations listed below:

• ADCRR’ Central Office

• Community Corrections Division

• Constituent Services Office

• All Arizona prison facilities

Keefe recognizes that Keefe will provide service at locations whether existing or future and whether publicly or private operated. Keefe recognizes Exhibit A for all ADCRR locations.

4.5.2.3.3. Accommodates ADCRR’s use of Keefe’s KeepTrak Inmate Banking system

Contractor is required to integrate its system with KeepTrak; and

BPM005375 ©2023 Keefe Group® Page 3

Keefe adheres to the KeepTrak Deposit Apply Services interface including:

• Automatically Posting individual inmate and offender deposits into the KeepTrak inmate or offender account respectively

• Automatically Posting nightly ACH transactions into the KeepTrak Ledger

4.5.2.3.4. Provides reports compatible with ADCRR’s Arizona Correctional

Information System (ACIS); and

Keefe will adhere to provide reports compatible with the ADCRR’s Arizona Correctional Information System (ACIS).

4.5.2.3.5. Includes any future changes in ADCRR’s financial/accounting and/or computer/information technology system (including changes in technology which may occur over the duration of the Contract); and

Keefe will adhere to any future changes in ADCRR’s financial/accounting and/or computer/information technology system including changes in technology which may occur over the duration of the Contract.

4.5.2.3.6. Includes an option (to be implemented upon ADCRR’s request), for real-time or near real-time (at ADCRR’s sole discretion) interaction/processing with ADCRR’s system, now or in the future, including transactions involving inmate trust account deposits, visitation background check fees, and Community Corrections payments and fees; and

Keefe adheres to the KeepTrak Deposit Apply Services interface for inmate trust account deposits, visitation background check fees, and Community Corrections payments and fees; and including:

• Automatically Posting individual inmate and offender deposits into the KeepTrak inmate or offender account respectively in real time.

• Automatically Posting nightly ACH transactions into the KeepTrak Ledger

4.5.2.3.7. Will only accept inmate trust account deposits for active inmates as of the date of deposit (based upon information provided by ADCRR); and

Keefe will only accept inmate trust account deposits for active inmates as of the day of

BPM005375 ©2023 Keefe Group® Page 4 the deposit. Keefe acknowledges that is based upon the information provided by

ADCRR.

4.5.2.3.8. Will only accept Community Corrections payments and/or fees for offenders under community supervision and for offenders released from community supervision that owe payments and/or fees (based upon information provided by ADCRR); and

Keefe will only accept Community Corrections payments and or fees for offenders under community supervision for offenders released from community supervision that owe payments and or fees. Keefe recognizes that this is based on information provided by

ADCRR.

4.5.2.3.9. Will only accept a visitation background check fee for an active visitation application which requires the fee to be paid (based upon information provided by ADCRR); and

Keefe will only accept visitation background check fee for an active visitation application which requires the fee to be paid. Keefe recognizes that this is based upon information provided by ADCRR.

4.5.2.3.10. Accepts payments from the public via Internet Website/Portal, Telephone, Walk-in Storefront, and Mobile Payment Platform/Application (see section

4.5.5 for more information); and

Keefe will provide a deposit platform that will accept deposits and payments from the public via website and web mobile app, phone, and walk-in retail stores.

4.5.2.3.11. Performs daily verification test(s) to confirm all persons (along with all associated information) included in ADCRR’s daily update to Contractor has been accurately incorporated into Contractor’s system. Verification of successful completion of these daily tests shall be immediately sent to ADCRR upon request; and

4.5.2.3.12. Provides each transaction payer with a transaction receipt; and for inmate trust account transactions, provides to ADCRR an electronic payee receipt

BPM005375 ©2023 Keefe Group® Page 5 for conveyance to the inmate. Record of all receipts shall be available to ADCRR at all times in the event account research is necessary; and

Keefe will provide each transaction payer with a transaction receipt.

Keefe will provide to ADCRR For inmate trust account transactions, an electronic payee receipt for conveyance to the inmate. Keefe recognizes and will adhere to the State request of recording of all receipts and will be always available to ADCRR in the event account research is necessary.

Example of receipt:

4.5.2.3.13. Includes programmable parameters for automatically notifying ADCRR of electronic corrections. Programmable parameters are parameters that may be used to trigger a notification to ADCRR that something previously reported or recorded has changed; and

Report Automation Report Automation functionality gives Agency Manager admins the ability to setup a background process configuration that generate web-based email report attachments to selected email recipients that pertain to specified report transactions.

BPM005375 ©2023 Keefe Group® Page 6

4.5.2.3.14. Includes a toll-free customer service telephone number adequately staffed year-round for a minimum of Mon-Fri 9:00 a.m. to 5:00 p.m. MST (Arizona Time).

Keefe will provide a toll-free customer service number that will be adequately staffed year around and will be available 24/7/365.

4.5.2.4. Ensure that all electronic data is stored on a secure network and encrypted both in transit and at rest. The electronic information relating to each transaction shall be made available to ADCRR via a secure online interface provided by Contractor. This interface will allow ADCRR to look up transactions, print receipts for delivery to inmate(s), add/delete users and change user access privileges through centralized administrative access, and provide an intelligence feature (ability to perform custom searches) that allows ADCRR to track all incoming transactions. All transactions shall remain available to ADCRR for review, whether via the online interface or an archive retrieval process. ADCRR requires a minimum of one (1) years’ worth of data to be provided via the online interface, with a requirement for archived or older data to be made available immediately upon request.

Keefe will ensure all electronic data is stored on secure network and encrypted both in transit and at rest. Keefe will provide its secure online interface called Agency Manager that will give ADCRCC access to all electronic information for inmate trust deposits, community supervision payments and visitation background check fee.

Keefe agreed to keep all transactions available to ADCRR for review, whether via the online interface or an archive retrieval process. Keefe agrees to allow ADCRR a minimum of one (1) years’ worth of data to be provided via the online interface, with a requirement for archived or older data to be made available immediately upon request.

BPM005375 ©2023 Keefe Group® Page 7

Below is a list of all the reports in Agency Manager that will satisfy all requirements noted in 4.5.2.4:

Agency Manager Report Deception Output

Bank Transfer ACH Totals and individual online deposit details

Allows review, print, export and drill down

Applied Transactions

Makes pending transactions not yet cleared in *ACH available for view. Administrators can monitor real-time transactions until the clearing process is complete. The process below walks through how to navigate the Applied Transaction screen view and reports.

Allows review, print, export and drill down

Chargeback

Reports on funds reimbursed to a depositor in the event of an unauthorized transaction received by a resident. Those funds are reported and ultimately are referred to as a "Chargeback".

Allows review, print, export and drill down

Restriction

The Restriction Reports allows administrators to view residents placed on restriction as defined by the agency, along with recipient details, the date the restriction was issued and the type of restriction applied.

Allows review, print, export and drill down

Reciepent Activity records of submitted transactions to a recipient from a depositor, providing details of how funds were received and processed.

Allows review, print, export and drill down

Depositor Activity report of transactions made by a Depositor to a Recipient. Use this report to track transaction details by a depositor for investigative purposes.

Allows review, print, export and drill down

Top Depositors allows administrators to view depositors who have made deposits to multiple recipients.

Allows review, print, export and drill down

Transaction History gives administrators the ability to view transactions submitted within a thirty-one (31) day period. The "Date Picker" gives administrators are able to go back as far as desired to view transaction history at any time.

Allows review, print, export and drill down

Audit

Audits allows management to tracks administrator navigation activity for report verification and information access within the application.

Allows review, print, export and drill down

BPM005375 ©2023 Keefe Group® Page 8

4.5.2.5. Acknowledge and agree that ADCRR is, and/or shall be considered, the owner of all data provided by ADCRR and/or its Constituents (unless prohibited by law), and that ADCRR shall have access to all such data, as well as all transaction data, in Contractor’s system and/or records at all times and/or immediately upon request.

Keefe acknowledges and agrees that ADCRR is, and/or shall be considered, the owner of all data provided by ADCRR and/or its Constituents (unless prohibited by law), and that ADCRR will have access to all such data, as well as all transaction data, in Keefe’s system and/or records at all times and/or immediately upon request.

4.5.2.6. Guarantee maintenance of service at all times.

Please see the following pages for Keefe’s Service Level Agreement.

BPM005375 ©2023 Keefe Group® Page 9

BPM005375 ©2023 Keefe Group® Page 10

BPM005375 ©2023 Keefe Group® Page 11

4.5.2.7. Guarantee funds for all transactions and be responsible for reconciling any transaction(s) back to the original payer.

Keefe guarantees funds for all transactions. Keefe will be responsible for reconciling any transactions back to the original payer.

4.5.2.8. Acknowledge and agree that, as applicable, source codes for software developed or modified by Contractor specifically for use with the Department’s system shall become the property of the Department and shall be immediately provided to the Department upon request. Software provided by the Contractor to the Department shall contain a provision for perpetual licensing with all upgrade options. The Department may decide to maintain the software in escrow; therefore the licensing agreement(s) shall also contain a provision for maintaining a version of the software in escrow in the event the Contractor is unable to continue service for financial or other business reasons.

Keefe acknowledges and agrees that the source code from the software developed or modified by Keefe specifically for use with the Departments system shall become the property of the Department and shall be immediately provided to the Department upon request.

4.5.2.9. Comply with Payment Card Industry Data Security Standard (PCI DSS) throughout the

Contract term (Offeror is to provide a copy of its current PCI DS validation/certification with Offeror’s proposal).

Please see Attachment C for a copy of Keefe’s current PCI Attestation of Compliance.

4.5.2.10. Hold a valid Arizona Money Transmitter License at all times during the term of any resultant contract. Offeror must submit a copy of its valid Arizona Money Transmitter License with its proposal if it has one, or within thirty (30) days of its proposal submission if it does not currently have one. Contractor shall keep and maintain such license throughout the term of any resultant contract.

Please see the following page for Keefe’s valid Money Transmitter License for the State of Arizona. Keefe agrees to keep this license valid the entire term of the resultant contract.

BPM005375 ©2023 Keefe Group® Page 12

4.5.2.11. Provide for funds for the electronic transactions to be transferred daily via wire transfer to an Arizona State Treasury account (under ADCRR’s current practices, Sundays and certain holidays are excluded from this requirement, however, this practice is subject to change).

Keefe will provide funds for the electronic transactions to be transferred daily via wire transfer / ACH to an Arizona State Treasury account. Keefe recognizes that under ADCRR’s current practices, Sundays and certain holidays are excluded from this requirement, however, this practice is subject to change.

4.5.2.12. Ensure that each day the funds transfer amount(s) exactly matches the total balance(s) shown on the transactions report(s) for that day.

Keefe will ensure each day the funds transfer amount(s) exactly matches the total balances shown on the transactions report(s) for that day. The report Bank Transfer, available on Keefe’s Online reporting portal, Agency Manager, will validate the amount sent to ADCRR on a daily basis. This report will be available 24/7/365 to ADCRR.

Bank Transfers - displays specific information regards daily ACH’s to the states bank account.

The user will be able to view the following with the Bank Transfer tool:

• Date of the Batch: The user will select a beginning and end date to review sent ACH’s.

BPM005375 ©2023 Keefe Group® Page 13

• The Batch ID- Unique ID number given to a specific ACH for reference. Batch ID is a hyperlink and will give the user the capability to view all transactions for a given date.

• Transactions - The number of transactions from a single batch for a specific date.

• Net Payment - The total amount of the ACH being sent on a given day.

• The reports from Keefe’s Agency Manager have the capability to select a start and end date.

4.5.2.13. Ensure that each of its Subcontractors are obligated, by written contract, to comply with the requirements, terms, and conditions of this RFP and any resultant contract which are related to the Subcontractor’s services provided to Contractor, including the following:

4.5.2.13.1. Subcontractors shall meet the same licensing requirements and standards required of the Contractor.

Keefe Response: Keefe has read, understands, and shall comply with this Subsection.

4.5.2.13.2. Subcontractors shall meet all Scope of Work requirements related to their work.

Keefe Response: Keefe has read, understands, and shall comply with this Subsection.

4.5.2.13.3. Subcontractors shall comply with all ADCRR written instructions related to their work.

BPM005375 ©2023 Keefe Group® Page 14

4.5.2.13.4. Subcontractors shall be required to maintain the insurance requirements specified in the Special Terms and Conditions. Within twenty-four (24) hours of request, Contractor shall provide to ADCRR a copy of any such Subcontractor contract (Contractor may redact its fees/payments). ADCRR reserves the right to deny any employee of the Contractor, or of any Subcontractor, access to its facilities, information, or Constituent information as a result of confidential information obtained during the course of an ADCRR security clearance process or for violation of an ADCRR policy.

If, after Contract award, Contractor wishes to use a Subcontractor not identified in Attachment 6, such Subcontractor shall be subject to review and a written determination by ADCRR whether it may participate in the Services; such determination shall be at ADCRR’s sole discretion, but Subcontractor’s participation will not be unreasonably denied.

Offeror should confirm in its proposal that it will comply with all provisions of this Section 4.5.2 Minimum Requirements; however, any provisions that Offeror does not agree to comply with are to be listed and described in Offeror’s completed Attachment 5 Supplement, Deviations and Exceptions included with Offeror’s submission.

4.5.3. Transaction Reporting. Offeror should describe how its system will comply with the following guidelines:

4.5.3.1. Provide for Electronic Funds Transfer (EFT) Reports to include:

4.5.3.1.1. Daily Transaction Summary Report

4.5.3.1.2. Monthly Reconciliation Report

4.5.3.1.3. Activity Report Detailing:

4.5.3.1.3.1. Location

4.5.3.1.3.2. Number of Transactions

4.5.3.1.3.3. Status successful or rejected

4.5.3.1.3.4. Dollar Amounts

4.5.3.1.3.5. Type of payment

Please refer to report samples and cross reference the below and following pages.

Requirement Description Access Corrections Report data Element Access Corrections Report

Name

4.5.3.1.1. Daily Transaction Summary Report Bank Transfers Report

4.5.3.1.2. Monthly Reconciliation Report Transaction History Report

BPM005375 ©2023 Keefe Group® Page 15 data Element Access Corrections Report

Name

4.5.3.1.3. Activity Report Detailing: Bank Transfer Details Report

4.5.3.1.3.1 Location Inmate Location Bank Transfer Details Report

4.5.3.1.3.2 Number of Transactions Transactions Bank Transfer Details Report

4.5.3.1.3.3 Status successful or rejected Transactions - approved Bank Transfer Details Report

4.5.3.1.3.4 Dollar Amounts Net Amount Bank Transfer Details Report

4.5.3.1.3.5 Type of payment Source Bank Transfer Details Report

BPM005375 ©2023 Keefe Group® Page 16

4.5.3.2. Provide a methodology to audit transaction history reports on an hourly basis. Data format criteria will be provided upon award. Reporting shall include the ability to generate “Payment by day” summary reports, and allow for custom reporting where flexible search criteria are given. All transactions are required to capture the information listed below and then be transmitted electronically as part of the financial transaction. No funds shall be accepted without the verified Name, Address and Telephone Number of the individual sending the funds. Gift Cards, “burner cards” and prepaid/preloaded credit/debit cards will not be accepted.

4.5.3.2.1. Sender Name

4.5.3.2.2. Sender Address

4.5.3.2.3. Sender Phone #

4.5.3.2.4. Payee Name (ADCRR Number supplied by the customer)

4.5.3.2.5. Money Transfer Control Number (MTCN)

4.5.3.2.6. Sequence Number or any unique transaction identification number

4.5.3.2.7. Identification Code

4.5.3.2.8. Transaction Date

4.5.3.2.9. Period (Same Day? Week? Month?)

4.5.3.2.10. Processing time

4.5.3.2.11. Credit/Debit card information

4.5.3.2.12. Account Number

4.5.3.2.13. Method of payment (credit/debit card, cash, mobile app, etc.)

4.5.3.2.14. Transaction Amount

4.5.3.2.15. Currency

BPM005375 ©2023 Keefe Group® Page 17

4.5.3.2.16. Agent City

4.5.3.2.17. Country

4.5.3.2.18. Transaction Status (Valid, NSF, etc.)

4.5.3.2.19. Transaction Description (identify fee being paid)

4.5.3.2.20. Delivery Status (Pending, Delivered, etc.)

4.5.3.2.21. Delivery Method (Online, Storefront, Telephone, Mobile)

Any provisions shown above that Offeror does not agree to comply with are to be listed and described on the Deviations and Exceptions form (Attachment 5 Supplement) and included with Offeror’s submission.

Please refer to report samples and cross reference below and on the following pages.

Data Element Access Corrections

Report Name

4.5.3.2.1. Sender Name Depositor Name Bank Transfer Details

4.5.3.2.2. Sender Address Depositor Address Bank Transfer Details

4.5.3.2.3. Sender Phone # Stored for OFAC in depositor user User Account

4.5.3.2.4.

Payee Name (ADCRR Number supplied by the customer) Recipient Name Bank Transfer Details

4.5.3.2.5.

Money Transfer Control Number (MTCN) Batch ID Bank Transfer Details

4.5.3.2.6.

Sequence Number or any unique transaction identification number Receipt # Bank Transfer Details

4.5.3.2.7. Identification Code ACH ID KeepTrak General Ledger

4.5.3.2.8. Transaction Date Batch Date Bank Transfer Details

4.5.3.2.9.

Period (Same Day? Week?

Month?) Start Date - End Date Filter Bank Transfer Details

4.5.3.2.10. Processing time DateTime Bank Transfer Details

4.5.3.2.11. Credit/Debit card information Type Bank Transfer Details

4.5.3.2.12. Account Number Agency Bank Transfer Details

4.5.3.2.13.

Method of payment (credit/debit card, cash, mobile app, etc.) Source Bank Transfer Details

4.5.3.2.14. Transaction Amount Net Deposit Bank Transfer Details

4.5.3.2.15. Currency Net Deposit USD$ Bank Transfer Details

4.5.3.2.16. Agent City Agency Bank Transfer Details

4.5.3.2.17. Country US Only Bank Transfer Details

4.5.3.2.18.

Transaction Status (Valid, NSF, etc.) Transaction Grid Applied Transactions

4.5.3.2.19.

Transaction Description (identify fee being paid) Purpose Bank Transfer Details

BPM005375 ©2023 Keefe Group® Page 18

Data Element Access Corrections

Report Name

4.5.3.2.20.

Delivery Status (Pending, Delivered, etc.)

NA / all transactions delivered when completed by depositor - no batch file processing Bank Transfer Details

4.5.3.2.21.

Delivery Method (Online, Storefront, Telephone, Mobile) Source Bank Transfer Details

BPM005375 ©2023 Keefe Group® Page 19

4.5.4. Data and Network Access/Security. Security of the EPTP system is essential, and Contractor is hereby notified that a single security breach will be considered cause for contract termination (at ADCRR’s sole discretion). Contractor is to maintain complete confidentiality of all information through security practices and/or systems and, when applicable, execute confidentiality agreements with its employee(s) and Subcontractors (copies of which are to be promptly made available to ADCRR upon request).

Contractor must keep all information about inmates, offenders under community supervision, and offenders released from community supervision that owe payments and/or fees, confidential and make no disclosure thereof to any third party, except as may be required by law. Contractor agrees to notify ADCRR within twenty-four (24) hours of any such disclosure (ADCRR contact instructions, which may include email, text, system message, and/or phone call, etc., will be provided after contract award).

Security and privacy policies, standards and procedures will be continuously maintained by both the Contractor and ADCRR, and are subject to change during the term of the Contract in accordance with State or Federal legislation, administrative rules, court orders, or industry or national standards (e.g., PCI DSS, NIST CSF, etc.).

4.5.4.1. Offeror should describe its system security, including, but not limited to, measures and features related to the following areas:

4.5.4.1.1. Unauthorized Access/Theft. Offeror’s protection should address potential threats both internal and external, whether electronic or physical. Contractor is responsible to ensure the integrity of, and to prevent unauthorized access

BPM005375 ©2023 Keefe Group® Page 20 to, all ADCRR data, including the Identity Information of all persons for whom such information is used, transmitted, or stored by Contractor’s system; this obligation includes, but is not limited to, Contractor’s owners, officers, agents, Subcontractors, employees, and any other person for whom Contractor may be held responsible and/or liable. Identity Information includes, but is not limited to, an individual’s first name or initial, and last name in combination with any of the following information: 1) Social Security Number; 2) Driver’s License number; 3) system access IDs and associated passwords; and 4) account information such as: account number(s), credit/debit card number(s) and/or passwords and/or security codes. Offeror’s response should include a copy of its PCI DSS compliance validation/certificate.

Please see Attachment B - Keefe Group Security Program Overview.

Subcontractor - 4.5.4.1.1. Security of Customer Data. In addition, InComm will connect to each Approved InComm Retailer such that Transaction Data will be transmitted from such Approved InComm Retailer to InComm by secure electronic means. InComm will ensure that the interface it connects to each Approved InComm Retailer will only allow for the collection of Transaction Data and that no other Customer Data may be collected by such Approved InComm Retailer in connection with a Payment. All Company Customer Data relating to a Customer is subject to the terms and conditions governing information that is considered “cardholder data” under the PCI Standard and that it shall establish administrative, technical and physical safeguards for such Company Customer Data in its control or possession from time to time. Such safeguards shall be designed for the purpose of: (i) ensuring the security of such records and information, (ii) protecting against any anticipated threats or hazards to the security or integrity of such records and information; (iii) insuring the proper disposal of such records and information, and (iv) protecting against unauthorized access to or use of such records and information that would result in substantial harm or inconvenience to any Customer. Such safeguards shall be established in accordance with Applicable Law, including, without limitation, Section 501 of GLBA and the Interagency Guidelines Establishing Information Security Standards adopted pursuant to Section 501 of GLBA. InComm shall at all times perform its obligations hereunder in accordance with the PCI Standard.

4.5.4.1.2. Disaster Protection/Recovery. Offeror should include details such as update/restore point frequency, remote backup/mirror site(s) locations, time needed for full recovery after a disaster, method and frequency of self-testing its backup and recovery procedures, date of last disaster recovery test, etc.

Offeror’s response should make clear ADCRR’s maximum theoretical potential loss using Offeror’s system.

BPM005375 ©2023 Keefe Group® Page 21

Please see Attachment D – TKC Holdings – IT Recovery Plan – Executive Summary.

Subcontractor - 4.5.4.1.2. Disaster Protection/Recovery. In addition, InComm maintains documented business continuity and disaster recovery plans that include procedures for recovering critical business functions and the technology resources essential for supporting them. These plans cover key business functions identified through business impact analysis. Business and operational recoveries are documented in contingency plans, while technology areas are covered in disaster recovery plans that include provisions for network infrastructure, servers, storage, applications, emergency response and operations, communication strategy, and other technical resources. These plans are tested annually, and test results provide opportunities for improvement.

InComm has geographically dispersed data centers supporting business units with primary data centers, and backup, hot-site, redundant data centers in large, professionally managed third-party colocation facilities. The use of cloud services has provided additional redundancy and resilience.

4.5.4.1.3. Cyberattack Protection and Recovery. Describe Offeror’s safeguards and preparations for potential cyberattack, including, as applicable, compliance with NIST Cybersecurity Framework (if applicable, include copy of Offeror’s compliance certificate) and/or ADCRR’s Information Technology Policies, Standards and Procedures, which may be found at:

https://aset.az.gov/resources/policies-standards-and-procedures.

Keefe’s Information Security Policy is based on NIST 800-53 rev 4 framework.

Subcontractor - 4.5.4.1.3. Cyberattack Protection and Recovery. InComm’s security program is aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and complies with the Payment Card Industry Data Security Standard (PCI DSS), the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, and the Health Information Trust Alliance (HITRUST) framework where applicable. The program also satisfies other requirements and regulations such as the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and New York Department of Financial Services (NYDFS) 23 NYCRR Part 500 where they apply. Industry standard certification assessments are performed annually by independent third parties as needed to satisfy laws, regulations, and agreed customer requirements.

BPM005375 ©2023 Keefe Group® Page 22

This description of InComm’s information security program is organized around the five functions making up the NIST CSF: Identify (ID), Protect (PR), Detect (DE), Respond (RS), and Recover (RC).

4.5.4.1.4. Subcontractor Vulnerability. If Offeror intends to use any Subcontractors in providing the Services, Offeror should also provide the information requested above in subsections 4.5.4.1.1 – 4.5.4.1.3 for the Subcontractor’s system.

4.5.4.1.5. Penetration Testing. Describe Offeror’s policies and/or practices regarding its own system penetration testing, as well as its accommodation of, and responsiveness to, penetration testing by ADCRR (ADCRR intends that it may perform penetration testing of Contractor’s system at any time and that Contractor will promptly begin satisfactory resolution following notification by ADCRR of any vulnerabilities found).

A third-party test our system annually. A summary of that report can be provided upon request. Keefe responds to all findings and those efforts are noted in the report summary. Keefe does not authorize our customers penetration testing our system.

4.5.5. Access and Types/Methods of Payment. The Department requires that Constituents have multiple options in carrying out transactions. Offeror should describe its provisions for payments via the following required delivery methods:

4.5.5.1. Internet Website/Portal. Offeror’s response should include a description, preferably with examples, of its user interface as it applies to the three different types of ADCRR payments (inmate trust account deposit, visitation background check fee, community supervision payments). Offeror’s Web service is presumed to be available to the public at all times, and Offeror is to clearly state if its available hours differ from 24/7/365.

Offeror’s system is expected to provide an end-to-end solution for real-time transactions (real-time refers to the ability to collect the necessary information from a web-based entry point, perform the necessary interrogation to sustain a positive transaction, and then electronically report a successful transaction to ADCRR, all of which appears to take place, or actually takes place, instantaneously upon data entry or receipt of a command). User-friendly design (intuitive interface, clear instructions, minimal clicks, hyperlinks, etc.) is preferred, as well as providing the payer with immediate confirmation its transaction has been successfully completed.

BPM005375 ©2023 Keefe Group® Page 23

Access Corrections, Keefe’s deposit service division, is one of the current providers for ADCRR Trust Deposits, Visitor Background Fee and Community Supervision Fee.

Some key attributes Access Corrections is proving for the ADCRR include:

1. Provided one of the lowest fees for friends and family and community corrections resident to make deposits and payments.

2. Successfully completed over 200,000 transactions for friends and family and community corrections resident to make deposits and payments.

3. Offered Visitors Background transaction fees for free.

Along with being one of the State current Payment and Deposit provider for ADCRR Trust Deposits, Visitor Background Fee and Community Supervision Fee, Keefe is also the State’s current cloud banking software, Keep Track Banking.

Key Features with using Access Corrections deposit interface with Keefe Cloud Banking:

Speed

• Deposits are applied to the inmate’s account when the depositor completes the transaction

– no wait time for hours until the vendor sends a deposit file.

o Accelerates collections of debt and provides timely funds for commissary or other disbursements.

• Constant communication between Keefe Cloud Banking and Access Corrections removes inactive accounts promptly to avoid inadvertent postings to released inmate accounts.

Completeness

• Nightly ACH transfers are posted automatically to the Keefe Cloud Secure Deposits account receivable for a self-reconciling ledger experience.

• Automatic ACH deposits appear in the Keefe Cloud Bank Reconciliation with the timestamp of the actual transfer of funds.

One stop reporting

• All Access Corrections reporting is embedded into the Keefe Cloud banking site – no need to log into a separate web site to see your deposit activity, investigate depositor and recipient relationships, review restrictions, or view audit trail.

Safety

• All deposits guaranteed. You won’t be asked to reverse a deposit in the Keefe Cloud

Banking system or to reimburse Access Corrections for depositor chargebacks.

• Keefe Cloud Banking uses account locks to let customers remove an active inmate from the recipients searchable in Access Corrections

Please see the below/following pages for Access Corrections Deposits & Payments Overview.

BPM005375 ©2023 Keefe Group® Page 24

Access Corrections Deposits & Payments™ Overview

Access Corrections, established in 2007, provides comprehensive, end-to-end money management solutions that help the broad range of corrections audiences – offenders, their loved ones and the agencies serving those constituents – move and manage money throughout the criminal justice continuum. From arrestee intake to inmate discharge, our automated services provide users easy, convenient, safe ways to make trust fund deposits, post bail and make parole, probation and court-ordered payments. Agencies can expand payment methods, improve collections, reduce cash management risk and increase productivity. Access Corrections currently processes millions of transactions per year for more than 600 state and county agencies and eighteen (18) state department of corrections. We are the only one-stop-shop provider able to offer such a holistic suite of payment technologies.

In the State of Arizona, Access Corrections currently processes trust deposit for five (5) counties: Cochise County, Gila County, Graham County Detention Center, Santa Cruz County and Yuma County.

Key Features:

1. Access Corrections offers a comprehensive suite of hardware and software solutions designed to support and automate money management processes throughout an offender’s incarceration – including intake funds, trust fund deposits, payments and release cards.

2. We offer most of these services at no cost to the agency.

3. As a payment provider, we make it easy and convenient for arrestees and their loved ones to complete a variety of automated, digital transactions, including trust fund deposits, bail payments and parole/probation/court-ordered payments. The service features flexible transaction methods – online, mobile app, toll-free telephone or in person.

4. Every program is customized to the agency’s specific needs and is supported by a dedicated team of account representatives and technicians.

Internet Website/Portal Keefe will provide a website/portal for the public to make three different find of payments including inmate trust deposits, community supervision payments and visitation background check fee. All payments will sent in real time and all funds are guaranteed.

In order to make deposit or payment online, Keefe operates a secure website that is available to the public 24/7/365 – www.accesscorrections.com. All that is required to set up an account is an email address and a personal password. Once a person has completed this process, they can log onto the secure website and will have the following functions available to them:

• Recipient list – Users are allowed to create a recipient list that will allow them to add as many inmates as they choose. This list allows the users to efficiently add funds to an inmate’s account.

• View payment history – Each user is able to view their history for every payment made from the website to each inmate’s account. This same history is available for any payment a debtor has made.

BPM005375 ©2023 Keefe Group® Page 25

• Edit account information – Users are able to enter in current information such as address and telephone number that will be used to process all payment

• Make a Deposit/Payment – Users can simply click on a button, provide their debit/credit card information, and make a payment

How to Make a Deposit/ Payment for ADCRR Trust Deposits, Visitor Background Fee and Community Supervision Fee:

To start the process, a depositor will need to Create an Account by clicking on “Create Account”

BPM005375 ©2023 Keefe Group® Page 26

After creating an account on www.accesscorrections.com, a depositor would need to “Select the State” of Arizona and For Trust deposits: the customer the customer will select Arizona DOC Trust Deposits under “Select Agency.”

For Visitation Background Fee: the customer will select Arizona DOC Visitor Background Fee under “Select Agency”

For Community Supervision Payments, the customer will select Arizona DOC Community Corrections under “Select Agency.”

http://www.accesscorrections.com/

BPM005375 ©2023 Keefe Group® Page 27

Input Recipient ID or Last Name and First Name: Next a depositor would search the recipient by their ID Number or name to locate them in the system.

For Arizona DOC Visitor Background Fee, a Case ID or name will be inputted.

Next, the depositor will enter in the amount they would like to send. Please note that all recipient’s information will be at the top of the screen to verify.

BPM005375 ©2023 Keefe Group® Page 28

Keefe clearly displays the fees per transaction before to keep the depositor well informed before they decided the amount to send.

For Arizona DOC Visitor Background Fee after enter case ID, the balance due will be displayed to pay.

BPM005375 ©2023 Keefe Group® Page 29

The last step gives the depositor to review all information for the transaction and enter their card information.

By easily clicking on “Now Pay”, complete the transaction.

Additional Website Features:

Access Corrections LifeChat Support

LifeChat offers two (2) methods of assistance making real-time support needs quick and easily accessible.

• LifeChat assistance. A debtor can start a chat to receive real-time assistance during a transaction. A

LifeChat operator is readily available to work with the debtors to address immediately needs.

• LifeChat Knowledgebase. A debtor can search for AC.com help topics without starting a chat.

http://ac.com/

BPM005375 ©2023 Keefe Group® Page 30

The My Recipients Dashboard screen displays a log of all completed transactions, which includes the Names of the recipient(s), Date of Birth, and Agency where funds have been added. The My Recipients information displayed in the Dashboard offer the following options – Make Payment and View History:

4.5.5.2. Telephone. As applicable, Offeror’s response should discuss its provisions for: Live

Agent and/or Interactive Voice Response (IVR) service; Hours of service; English only or multilingual service; etc.

PHONE

Keefe will provide phone deposit/payment capability for ADCRR Trust Deposits, Visitor Background Fee, and Community Supervision Fee.

Keefe offers a 24/7/365 toll-free phone number for friends and family to make deposit using their Mastercard or Visa debit/credit card into an inmate’s account. Our bilingual (English & Spanish) Customer Service Representatives (“CSR’s”) collect all account holder information that is required to gain approval for the use of the credit card.

Keefe has in-house customer service representatives and also provides support through a third-party call center. All CSRs are specifically trained to handle phone calls for deposits, review transaction histories, as well as deal with complaints and financial discrepancies. Keefe provides support and allows for phone deposits 24 hours a day, 7 days a week. In addition to live agency or Customer Service Representatives (CSR’s), users can use Keefe’s Interactive Voice Response System (IVR) for a quick and easy payment option.

All call center employee candidates must successfully pass a thorough background check, a satisfactory credit check, and drug testing before they are considered for employment. We take full responsibility for our employees.

BPM005375 ©2023 Keefe Group® Page 31

We have two separate and independent call centers which operate daily as backup and disaster recovery. Should one call center experience technical difficulties, all calls would automatically route to the other call center to continue providing uninterrupted service.

4.5.5.3. Walk-in Storefront. Offeror’s response should include a description of its available services and operating hours, including a listing and/or complete description of locations throughout Arizona; at Offeror’s option, map locations may be shown in lieu of a listing provided the map(s) are detailed enough to accurately portray the type and location of available services. Offeror should also describe (but not necessarily provide a listing for) the type(s) and number of walk-in storefront locations available in other parts of the U.S. 4.5.5.3.1. Walk-in Storefront Requirements: Must have an in-store person (clerk/agent/representative) trained and able to assist a customer in completing any ADCRR-related transaction, from start to finish, for a customer who has no internet access or phone, and may have only cash for the transaction. If internet access or a phone call is required to complete the transaction, the clerk/agent/representative is available to assist the customer in carrying out those processes during the customer’s store visit using the store’s equipment. If applicable, it is permissible to have the customer insert cash into a kiosk machine or fill out a paper form, and to require the customer to have the inmate/offender’s name, ADCRR number, and location, as well as all relevant payment information (what type, how much, etc.). Standard requirements for customer identification are the customer’s responsibility (name, address, etc.).

Customer is to be provided with a hard copy payment receipt upon completion of the transaction.

Keefe will provide Walk-In Storefront capability for ADCRR Trust Deposits, Visitor Background Fee and Community Supervision Fee.

BPM005375 ©2023 Keefe Group® Page 32

Walk-In Storefront Keefe subcontracts with Incomm Financial Services to provide Walk-In Storefront payment services. Incomm Financial Services partners with ACH Payments, doing business as Cash Pay Today, to provide software and website access for the consumer to create an account, and provide barcodes for payments transactions. Incomm Financial Services, Inc., doing business as Vanilla Direct, is a licensed money transmitter in the State of Arizona for Walk-In Storefront payments and has contracts with retailers nationwide to provide payment services. Incomm Financial and its partner ACH Payments allow Keefe to deliver the best Walk-In Storefront payment services to the friends and families to send money to their loved ones and or make payments to their probation obligations.

Keefe is partnered with CashPayToday, a leading payment technology company automating cash transactions via its network of over 80,000 national and regional retailers in the U.S. These locations will accept cash transactions on behalf of Keefe. The walk-in locations include Walmart

– Available at Service Desk or Money Center, CVS, Walgreens, 7-Eleven, Dollar General, Family Dollar stores and others.

These national retailers align with the demographics of our customer base. Our customers are already shopping at these stores making it very convenient way to make a payment or deposit for your agency.

In Arizona specifically our primary retail locations number 1,842 locations* include over 7-Eleven, Circle K, CVS, Dollar General, Empire Petroleum, Family Dollar, Flying J, Pilot Travel, Speedway, Travel America, Walgreens, Walmart and more all throughout in Arizona. Below is a map displaying all retails located in Arizona and Listing is provided in attachment.

*Please see Attachment G – Walk-in Storefront Locations for a complete list of locations.

BPM005375 ©2023 Keefe Group® Page 33

Convenience Like No Other Provider Customers have the choice to get their CashPayToday account information right on their smart phone or mailed to their address. Consumers love the convenience of the smart phone option because they always have their phone with them. In addition, it provides a real-time retailer location map based on their GPS along with transaction history and an account bar code to send money quick. Also, there is no need to tell the cashier what you are sending the money for. They just know it is being sent to Access Corrections!

Our service offering consists of a staged transaction, linked to a token that can be scanned at retail where a cash payment is then accepted. Effectively, the customer provides the relevant, required information pertaining to a money transmission from an individual to a prison commissary account. That transaction is then ‘staged,’ tied to a token (barcode), and completed when the individual visits one of our 80,000+ retail store point-of-sale locations, tenders cash funds to the store associate and the transaction is completed with a receipt provided. The entire process takes seconds, CashPayToday does not receive any of the information that is tied to the token, and there is no unmanned kiosk component to our program.

Available at Service Desk or

BPM005375 ©2023 Keefe Group® Page 34

CashPayToday process and practices for payment agency (retailer) selection: CashPayToday is a Licensed Money Transmitter in every state as required in the United States. We conduct initial and recurring due diligence on our participating retailers, and we appoint them as Agents under our licenses, which confers Money Service Business, Anti-Money Laundering, and other training obligations.