10 RFP SCC-26-030-BOI Exhibit E Milestones and Deliverables.docx

RFP SCC-26-030-BOI: BOI Information & Payment Processing System Exhibit E: Milestones & Deliverables

RFP SCC-26-030-BOI

BOI Information & Payment Processing System

Exhibit E: Milestones & Deliverables

< Insert Offeror Name >

Table of Contents

Instructions Offeror must provide a response to Exhibit E: Milestones & Deliverables with their proposal. Exhibit E requires that Offeror provide responses to specific items, including the identification and description of implementation milestones, Offeror’s approach to the development and completion of deliverables, a proposed implementation schedule, and a proposed implementation plan. Diagrams, charts, tables, and other visual content may be included as part of the response to aid the SCC in understanding Offeror’s proposed solution.

Any changes Offeror wishes to propose to SCC-provided language and content in Exhibit E must be provided separately in Offeror’s response to Appendix D – Proposed Changes. Proposed changes and redline edits made by Offeror directly in Exhibit E will not be considered.

Implementation Milestones Based on Offeror’s knowledge and experience and the information provided in this RFP, Offeror must identify and describe the proposed milestones upon which implementation activities and deliverables will be based. Table 1 – Proposed Implementation Milestones below provides a template that should be used by Offeror to describe the implementation milestones it proposes. Each milestone must also indicate the key activities that must be completed, and the deliverables listed in Table 2 – Deliverables Matrix that Offeror proposes be tied to be each milestone. The activities and deliverables associated with each milestone will serve as key inputs to the acceptance criteria for each milestone. The milestones presented in this table should align with the milestones provided by Offeror in Exhibit F – Pricing.

Table 1 – Proposed Implementation Milestones

Deliverables Supplier is required to complete and provide to the SCC the deliverables contained in Exhibit B: Solution Requirements, which are described in Table 2 – Deliverables Matrix below. The Deliverables Matrix provides a description, timing, recurrence, phase, and acceptance criteria for of each deliverable.

Offerors should review the Deliverables Matrix in detail to ensure understanding and alignment with the SCC’s expectations and needs. Any changes that Offeror proposes to the content of the Deliverables Matrix should be submitted to the SCC in the appropriate form in Offeror’s response to Appendix D: Proposed Changes. Proposed changes and redline edits provided by Offeror directly in the Deliverables Matrix will not be considered.

RFP SCC-26-030-BOI: BOI Information & Payment Processing System Exhibit E: Milestones & Deliverables

Deliverables Matrix

O&M: As requested (not a formal deliverable)

· The PMP clearly addresses the items included in the deliverable description.

· Templates and tools that will be used to support execution of the PMP have been fully developed.

· The PMP has been approved by SCC.

· A summary-level schedule that contains project phases and major milestones for key components of the solution.

· A detailed schedule that contains:

· Project phases, milestones, activities, and deliverables required to deliver all components of the proposed solution within the solution timeline indicated above.

· Start date, end date, and estimated duration of each phase, milestone, activity, and deliverable.

· Internal and external dependencies between project phases, milestones, activities, and deliverables.

(Note: this is a one-time deliverable that must be updated bi-weekly during Implementation) O&M: as agreed upon for Solution enhancements and changes

· All defined phases, milestones, activities, and deliverables are represented in the schedule.

· The schedule is accompanied by clearly articulated assumptions.

· The schedule is available and accessible on the online project management tool.

· The Integrated Project Schedule has been approved by SCC.

· Implementation Phase organization structure and how that organization interacts with all stakeholders.

· Key Personnel assigned with clearly defined roles and responsibilities.

· O&M Phase organization structure, with staffing levels and roles and responsibilities described by job title/function.

· Discloses the planned use of companies not owned by the contractor and/or individuals not employed by the contractor to perform functions during solution Implementation and O&M, and the functions these entities will perform.

· Describes retention strategies to minimize the impact of personnel changes during the course of the implementation.

· Describes recruitment strategies and processes to rapidly address any staffing gaps or deficiencies during the course of the implementation.

O&M: As requested or as needed to reflect resource, team, or access changes

· The plan clearly addresses the items included in the deliverable description.

· The Staffing Plan has been approved by SCC.

The RTM will be updated, maintained, and made available to the SCC on an on-going basis during both Implementation and O&M phases.

During the early stages of Solution Design;

Updated prior to Go-Live

O&M: Annually

· All requirements have been formally reviewed and approved by SCC.

· All requirements have been accepted by the Supplier.

· All changes to requirements have been documented and traceability is intact.

· Requirements are available and accessible to all parties.

· A requirements management and change control process, along with associated tools, has been developed and approved by SCC.

· The RTM has been approved by SCC.

O&M: As needed to reflect changes to the solution

· System design documents clearly address the items included in the deliverable description.

· System design documents have undergone SCC Enterprise Architecture Review when appropriate.

· System design documents have undergone SCC information security review when appropriate.

· Additional criteria will be defined during contract negotiations to ensure alignment with the Supplier’s approach, methodology, and capabilities.

· Solution Design Documents have been approved by SCC.

In addition, the data management plan must identify and provide:

· Master data and metadata definitions.

· End-to-end data model for all business processes, workflows, interfaces, reports, and operational specifications.

· Data archiving and data retention plans.

· Database management and administration standards and practices.

· Offeror’s plans to ensure that data management plans and procedures meet all federal and state data protection and security policies.

Implementation: N/A O&M: N/A

· The plan clearly addresses the items included in the deliverable description.

· The plan has undergone SCC information security review.

· Additional criteria will be defined during contract negotiations to ensure alignment with the Supplier’s solution.

· The Data Management Plan has been approved by SCC.

Implementation: N/A O&M: N/A

· Clear entrance and exit criteria have been defined for each phase of testing.

· Testing roles and responsibility have been agreed to.

· The Testing schedule has been agreed to.

· The Testing Plan has been approved by SCC.

Implementation: N/A O&M: N/A

· A defect management methodology has been defined and agreed to.

· All supporting tools and processes have been developed and approved.

· The Defect Management Plan has been approved by SCC.

Implementation: N/A O&M: N/A

· Clear entrance and exit criteria have been defined for training.

· Training roles and responsibility have been agreed to.

· The Training schedule has been agreed to.

· The Training Plan has been approved by SCC.

O&M: As needed to reflect system enhancements and changes, operational changes, and other solution changes that impact users

· An inventory of Training Materials has been developed.

· Training Materials targeted to each user group have been developed and approved.

· All Training entrance and exit criteria have been satisfied and documented.

· All user groups have completed training courses to SCC’s satisfaction.

· SCC has signed off on Training Materials and Delivery.

· Describes security requirements and the management, operational, and technical controls to address those requirements. Security requirements and controls should include input from key stakeholders.

· Describes controls for protecting the security and privacy of sensitive data, particularly PHI/PII.

· Identifies improvements needed for the protection of information system resources.

· Describes roles and responsibilities for all elements of system security.

· Describes expected behavior of all users who access the system and the controls in place to ensure the integrity of the system and data.

Provides processes and procedures to meet security requirements and maintain controls.

O&M: Annually

· The Systems Security & Privacy Plan clearly addresses the items included in the deliverable description.

· All supporting procedures, tools, templates, etc. have been developed and signed off by SCC.

· The Systems Security & Privacy Plan has been approved by SCC.

· The Information Exchange Security Agreement is executed (if required).

O&M: As needed to reflect changes to O&M and end user support

· The Operations & Maintenance and End User Support Plan clearly addresses the items included in the deliverable description.

· All supporting procedures, tools, templates, etc. have been developed and signed off by SCC.

· The Operations & Maintenance and End User Support Plan has been approved by SCC.

Implementation: N/A O&M: N/A

· A step-by-step deployment plan has been developed.

· Clear deployment and go-live entrance and exit criteria have been defined.

· Clear solution acceptance criteria have been documented.

· The Solution Deployment, Go-Live and Acceptance Plan has been approved by SCC.

Implementation: Monthly until acceptance of Solution O&M: N/A

· The Report clearly addresses the items included in the deliverable description.

· All open items related to the Implementation Phase have been addressed and documented with SCC’s approval.

· The Implementation Phase Closeout Report has been approved by SCC.

O&M: Annually

· The SOC 2 Report clearly addresses the items included in the deliverable description.

· The SOC 2 Report has been demonstrably conducted by a qualified, independent third party.

· Remediation plans for all SOC 2 Report findings have been developed and approved by SCC.

· The SOC 2 Report has been approved by SCC.

O&M: As needed to reflect changes to transition out and turnover plans

· The Transition Out & Turnover Plan clearly addresses the items included in the deliverable description.

· All supporting procedures, tools, templates, etc. have been developed and signed off by SCC.

· Clear entrance and exit criteria have been defined for each major step in the transition and turnover process.

· The Transition Out & Turnover Plan has been approved by SCC.

The DRP must include, at a minimum:

· Procedures for the identification and declaration of a disaster.

· Procedures for communicating with stakeholders.

· Procedures for the orderly recovery of the solution and resumption of system availability.

· Back-up and protection procedures to include files, software, hardware and network connectivity.

· Description of any proposed alternate site(s), including a detailed schedule for back-up operations and any proposed clustering methodology for high availability.

· Recovery time objectives.

· Recovery point objectives.

· Risk analysis and risk mitigation for each business process.

· Processes and procedures for DRP testing and reporting the results of testing, to include failover/fallback functionality, back-up/recovery functionality, business continuity, and plan updates.

O&M: Annually

· The DRP clearly addresses the items included in the deliverable description.

· DRP processes, procedures, and roles and responsibilities have been clearly documented and signed off.

· DRP tests and exercises have been defined, documented, and planned.

· The DRP has been approved by SCC.

The BCP must include, at a minimum:

· Documented and prioritized business functions.

· Enablers and systems that support each business function.

· Resources and supplies needed for each business function.

· Prioritized, step-by-step procedures for the recovery of business functions.

· Communication plans and procedures.

· Delegations of authority and decision-making processes.

· Processes and procedures for BCP testing and reporting the results of testing.

O&M: Annually

· The BCP clearly addresses the items included in the deliverable description.

· BCP processes, procedures, and roles and responsibilities have been clearly documented and signed off.

· BCP tests and exercises have been defined, documented, and planned.

· The BCP has been approved by SCC.

Table 2 – Deliverables Matrix

Proposed Implementation Schedule Offeror must provide with their response a proposed Implementation Schedule that incorporates and builds on the solution timeline, key milestones, and deliverables addressed in the preceding sections of this Exhibit. The proposed implementation schedule must clearly demonstrate Offeror’s approach to ensuring a successful, on-time delivery of the solution. The schedule should also provide the best possible balance between rapid implementation, cost effectiveness, and efficiency in the design, development, testing, and implementation of the solution. The solution should be implemented and services Commenced prior to June 30, 2028.

For the purposes of Offeror’s response to this RFP, the proposed implementation schedule should provide a “big-picture” perspective with sufficient detail to enable understanding of the timing, sequence, inter-relationships, and dependencies between key elements of the schedule. However, a full implementation schedule that includes detailed tasks and sub-tasks is neither required nor expected at this stage. A detailed Integrated Project Schedule deliverable will be developed by Supplier during the early stage of the Implementation Phase.

Offeror’s proposed implementation schedule should include the following, at a minimum, which should be prepared using a combination of visual and written elements:

· Phases

· Milestones

· Key Activities

· Deliverables

· Key Interdependencies

· Major Assumptions

· Major Risks

· Strategies to ensure successful, on-time implementation of the solution relative to:

· Other potential challenges or obstacles, based on Offeror’s experience, that could adversely impact the implementation timeline if not managed effectively.

The following page is provided for Offeror use in displaying the proposed implementation schedule, if needed.

< Page for Offeror use in displaying the proposed implementation schedule, if needed. Delete if not used. > image1.png