12-10 - Exhibit H - SOW.pdf

EXHIBIT H

STATEMENT OF WORK

1. Project Overview Dallas Area Rapid Transit Mobility Services, Local Government Corporation (LGC) provides Transit Services on behalf of the McKinney Urban Transit District (MUTD) and is seeking a contractor to provide turnkey service utilizing Software as a Service (SaaS) to manage the operations of the MUTD shared ride/on-demand service (Service). The objective of the service is to provide eligible residents of McKinney, Celina, Lowry Crossing, Melissa, Princeton, and Prosper (Attachment 1 – MUTD Service Area Map) curb-to-curb service throughout Collin County. In addition to the municipalities served by the MUTD program, prospective customers must qualify as one of the following criteria: a senior (65 years or over), rider with disability, or a low-income rider. This service is not considered a Paratransit service.

The integrated service model must provide Wheelchair Accessible Vehicles (WAV) that adhere to the Federal Transit Administration (FTA) drug and alcohol requirements. The service can be supplemented by non-dedicated service, such as a Transportation Network Company (TNC). The goals of this service are to increase vehicle availability to meet ridership demand, maintain a wait time of less than thirty (30) minutes, and be financially sustainable.

The customer experience should be considered a priority when planning for this service. It is strongly recommended the Service leverage the DART GoPass mobile application to provide an inclusive platform for trip planning, payment, and the ability to communicate directly with the vehicle operators.

Therefore, any SaaS solution should be able to integrate through an Application Programming Interface with DART GoPass. Any information collected during the booking process will be owned by DART.

Under the current Service, customers are able to book trips for all trip purposes so long as the trip exists in the Collin County area and during the hours of operation (see Service Parameters).

2. Service Parameters The following service parameters shall serve as a framework documenting the current Service to assist the contractor in understanding the attributes of the Service and those that it serves.

• Service Area: Collin County (886 square miles)

• Service Hours: Weekdays – 6:00am to 8:00pm and Weekends – 8:00am to 8:00pm excluding major holidays.

• Average Wait Time: Thirty (30) minute threshold

• Trip Request: Ambulatory customers are encouraged to make trip requests at least one (1) hour in advance. Customers requesting WAV service are encouraged to reserve a trip twenty-four (24) hours in advance. Current service allows eligible customers to book trips up to seven (7) days in advance and the ability to schedule recurring trips such as going to medical appointments on Monday, Wednesday, and Friday at 8:00am.

• Reservations: Customers should have the ability to book trips through a variety of options that best meet their needs (e.g., Call Center, GoPass, Artificial Intelligence Chat Bots, etc.)

• Vehicle Requirement: Four (4) WAVs plus one (1) spare WAV, supplemented by a non-dedicated fleet such as a Rideshare Company for weekday service. One (1) WAV supplemented by a non-dedicated fleet for weekend service.

• Project Term: Service commencing January 2, 2027, through and including December 31, 2029, with the option to extend for two (2) one (1) option years (January 2, 2030 – December 31, 2030, and January 2, 2031 – December 31, 2031).

3. Roles & Responsibilities Contractor Will provide a turnkey service with a focus on a dedicated and non-dedicated fleet, reservation services, and management of any subcontractors. Of significant importance is the SaaS that provides a platform for registering, trip planning, scheduling, dispatching, payment, and reporting. The SaaS platform must be able to integrate with DART GoPass to allow for booking trips and shall collect at a minimum trip data such as latitude and longitude coordinates (Origin & Destination), fare, pick-up and arrival time, ridership statistics, pooling data, cancellation data, trip duration, travel distance, and wait time, trip purpose, rider satisfaction, surge pricing, and incident reports.

DART LGC reserves the right to manage the administration of the eligibility screening and certification for prospective customers based on predetermined criteria established by MUTD.

The contractor will need to demonstrate their ability to provide a dedicated fleet to provide wheelchair accessible trips and a non-dedicated provider (TNC) as a customer option to meet the current demand that reflects ridership trends. The contractor will be responsible for the daily cleaning, fueling, preventative maintenance, and all repairs in accordance with all applicable laws and requirements.

Staffing the operation of the fleet will be the sole responsibility of the contractor. All operators of the dedicated fleet will adhere to safety and securement training and customer service training. Road supervisors, call center staff, and all other staff required for the service will be provided by the contractor.

The contractor will be responsible for providing reports covering all aspects of the Service.

• Provide documentation for WAV operators covering safety and securement, customer service, first aid, and sensitivity training are required on a predetermined basis

• Pre & Post Trip Reports for WAVs

• Dashboard(s) created in SaaS platform tracking Key Performance Indicators

FTA drug and alcohol testing regulations apply to all contract service providers who “stand in the shoes” of the transit system to make or complete a trip. FTA, however, recognizes the practical difficulty of administering a drug and alcohol testing program to companies providing incidental transit service and providing services with independent contractors. Therefore, in certain circumstances FTA drug and alcohol testing rules do not apply. When a patron of a transit system which receives FTA funding can choose from a number of service providers, FTA testing regulations do not apply to those providers companies. If there is only one company from which to choose, the regulations apply to that company. Applying the regulation depends on the degree of “passenger choice” in selecting the provider.

DART LGC acknowledges that TNCs involve independent contractors who choose to use the TNC application to receive ride requests. TNCs state that independent contractors are not employees, but must abide be TNC regulations for licensing, background checks to gain access to the TNC application and receive ride requests.

The contractor will deliver reports capturing customer information, complaint resolution, data collection, accounting, passenger ridership, invoicing, and reconciliation of all invoices.

Of significant importance is the contractor’s ability to provide all pertinent information required for National Transit Database (NTD) reporting of the shared ride service in a timely manner, including but not limited to costs, scheduled and actual revenue, total miles, total hours, passenger miles and passenger boarding information. The Contractor shall provide a SaaS platform that is able to automate the reporting of NTD data to be delivered at regular intervals agreed upon at the beginning of the project.

The contractor will be required to attend an in-person meeting at the commencement of the project and subsequently at the beginning of each year to discuss the performance of the service, refinements, and lessons learned.

DART LGC

Provide a procurement package to solicit contractors to provide the MUTD shared ride service under DART’s established federally compliant Mobility as a Service (MaaS) contract.

Provide a project manager to implement, coordinate, and communicate the shared ride service with stakeholders, contractors, and customers. DART LGC staff will compile monthly reports and submit farebox revenue credits and invoices to MUTD, aid with the GoPass integration, and administer the eligibility task for all new customers.

MUTD

Establish Service eligibility criteria and take the lead role in being the direct reporter for NTD tasks.

Provide non-farebox funding to reimburse expenses associated with the contract.

4. Service Usage Estimate Ridership is estimated based on historical data and trip characteristics of MUTD’s current ride share program (Appendix). The mode split between the dedicated fleet and the non-dedicated fleet is projected to remain at the 1:4 ratio with the goal of creating efficiencies by pooling ridership for the maximum cost effectiveness of the program.

Ridership (see Appendix greater detail):

• 2022 – 29,038 (average weekday ridership – 102)

• 2023 – 67,621 (average weekday ridership – 222)

• 2024 – 81,910 (average weekday ridership – 271)

• 2025 – 82,027 (average weekday ridership – 267)

5. Dedicated Vehicle Revenue Hour Estimate The contractor shall implement a minimum of four dedicated wheelchair accessible vehicles with the option to increase the number of dedicated vehicles to meet ridership demand. The contractor shall develop their cost proposal by taking the annual revenue vehicle hours listed below.

2023 – Dedicated Fleet

• Vehicle Revenue Miles = 185,849

• Deadhead Miles = 28,435

• Total Actual Vehicle Miles = 214,284

2024 – Dedicated Fleet

• Vehicle Revenue Miles = 201,563

• Deadhead Miles = 30,941

• Total Actual Vehicle Miles = 232,504

2025 – Dedicated Fleet

• Vehicle Revenue Miles = 155,320

• Deadhead Miles = 29,082

• Total Actual Vehicle Miles = 184,402

The contractor shall also include the cost to provide a non-dedicated fleet.

6. Fare Structure

• DART expects passengers for this Service to pay for a fare equivalent to the distance of trip. Trips up to seven (7) miles will pay a flat fee of five dollars ($5) and the fare will increase by seventy-five cents ($0.75) per each additional mile with a cap of seventeen dollars ($17) for trips greater than twenty-three miles (23 mi.). The contractor will be required to collaborate with DART Business Innovation and DART’s app vendor to establish fare protocols and pricing to be provided to the customer at the time of booking the trip.

• MUTD policy may limit the number of trips a day, cancellation, and so on. The fare structure has been configured in the DART GoPass app so the dedicated fleet and TNC only need to provide an API integration into GoPass, and the front-end application will determine appropriate fares for the trip.

• No tipping is allowed for the services provided under this contract.

• Farebox revenue will be provided to MUTD to reimburse expenses through the City of McKinney’s local match requirements.

7. Technology Requirements

• Pursuant to retaining and expanding upon current capabilities, the Technology solution sourced by DART must include the following at a minimum to retain parity with the capabilities of our current digital solutions. These capabilities must be fully integrated at the start date of the contract, as the requirements below are a baseline of fulfilling the current array of services we currently provide.

a. Open API architecture. Vendors should provide a comprehensive set of APIs which facilitate a broad set of interactions between the booking platform and third-party applications. The minimum specification is that the vendor maintain APIs which are complete to the requirements for integration to the GoPass App as specified in the following link: https://unwire.stoplight.io/docs/microtransit-apis

b. Deep API based integration with TNCs for estimates and bookings. Integration with multiple TNCs to enable ‘guest ride’ booking services. Estimates may be obtained from the TNC, and bookings must be sent to TNC without requiring the rider to have an account credential or payment method instated with the TNC.

c. To ensure secure API interactions, all APIs must implement OAuth 2.0 authentication for robust security, protecting against unauthorized access and data breaches.

d. Contextual trip plan results through APIs. The ability to receive API requests and provide back estimates for services based on rider eligibility. Estimates should be subjective based on the rider eligibility for the service mode, matched based on rider mobility need conveyed during API request and/or locally stored within provider’s system (ex:

https://unwire.stoplight.io/docs/microtransit-apis https://unwire.stoplight.io/docs/microtransit-apis wheelchair user, service animal), and the API should also return pricing for services based on the distance traveled (dynamic pricing model).

e. Client-side API user account context to include opt-in status to service pools, including TNC service pool.

f. Shapefile presentation. API connectivity or comparable methodology to share shapefiles of mapped service zones on a multi-tenant and service mode basis by type.

• Contractors shall provide open APIs that can be integrated into a backend system as well as the GoPass platform which provide the necessary, customizable data for trips which automatically handles trip scheduling in real time.

• The APIs should be able to present relevant trip details to drivers as needed, as well as those details needed for completing quality assurance activities on reports/invoices. Fields should include the following:

a. Rider Name

b. Pickup Location

c. Drop-off Location

d. Trip Notes

e. Unique trip identifiers

• Contractors shall provide open APIs which will permit customers to make advanced ride request, with priority either on the pickup time or drop-off time.

• Contractor shall provide a downloadable driver application which receives automated routing from the TNC servers, audio and application-based directions, communication features for use by the TNC’s independent driver partners to send and receive contact with riders, DART staff, or DART’s Contractors.

• Contractor shall provide System Performance Monitoring system for use by DART to evaluate use of TNC service in the on-demand zone. If this system is not available, Contractor will provide ridership data which will permit DART to measure system performance.

• TNC contractors shall provide a concierge webservice application which allows staff to submit ride requests for customers or other services such as lost and found.

• Contractor’s Software shall facilitate a shared ride service acceptable by FTA for reporting under the National Transit Database. Shared ride software must allow customers to schedule ride requests where the TNC server will automatically add passengers to existing TNC trips without customer interference. The ability to pool trips is required.

• Contractor’s software shall allow service to be limited to a defined operating zone by importing a GIS shape file or allow DART to define the zone boundaries within the configuration software. Any divergence from operation outside of zones should be captured and identifiable through reporting and dashboards.

• Contractor’s software shall collect data on the trip history which is then used to optimize the scheduling of vehicles to meet customer demand.

• Contractor’s application software shall allow the customer and driver to rate the customer or driver’s performance following each trip. The TNC’s software must be able to deny DART trips to be assigned to TNC driver partners who do not meet the TNC standards for performance over a month’s time. The TNC proposer shall identify the driver rating minimum standard for use of the driver application.

The following data and definitions must be available to DART through a data dashboard with CSV download capability for any data range, including week, month, year, or individual day and for any zone:

Data Column Definitions of Data Required (Needed for each trip)

• Unique Trip Identifier

• Rider Name

• Rider ID: Unique Rider Identifier

• Vehicle ID: A unique vehicle identifier (e.g., License Plate number)

• City Name

• Request Date: (e.g., MM/DD/YYYY)

• Time of Request

• Requested Pickup Time

• Actual Pickup Time

• Requested Drop Time

• Actual Drop Time

• Origin Trip Purpose

• Requested Pickup Location: Address, Latitude, Longitude

• Actual Pickup Location: Address, Latitude, Longitude

• Destination Trip Purpose

• Requested Drop Location: Address, Latitude, Longitude

• Actual Drop Location: Address, Latitude, Longitude

• Request vs Actual Time Variance (minutes): Pickup and Drop

• Request vs Actual Miles Variance: Pickup and Drop

• Status: Status of trip. (e.g., Completed, Cancelled)

• Pickup Zone

• Drop-off Zone

• Trip Type: Shared/Private/Other

• Rider Counts: A count of unique riders on a trip

• Pooled General Public Riders: A count of non-transit riders on pooled trips

• Passenger Miles: For each trip

• Passenger Travel Time (minutes)

• Wait Time

• Base Fare

• Mileage Fare

• Minutes Fare

• Tolls

• Fields for any other category of fee (taxes, state regulatory fees, etc.)

• Type of charge: Fare, fee, refund, etc.

• Surge Pricing

• Customer Satisfaction

Additional Data Requirements from Dashboard

• Trending total monthly spending data

• Average wait time for the date range for all zones or specific zones

• Average travel time for the date range for all zones or specific zones

• Average trip distance for the date range for specific or all zones

• Average cost per trip for the date range for all zones or specific zones

• Average fare paid by user for the date range for all zones or specific zones

• Number of unique customers for the date range for all or specific zones

• Number of trips consumed for the date range for all zones or specific zones

• Average number of trips consumed for the average rider

• Trip status totals and percentages for each category (completed, cancelled, no showed, no drivers available)

• Total number of transit passengers provided for the date range for all zones or specific zones

• Geographic display of pickup polygon and drop off location for each polygon.

• Capability to view on a geographic display a representation of the linkage between pickup and drop off polygons for a defined zone and a defined date range.

• Capability through the display to drill down on total trips completed to a specific polygon.

• Ability to capture a screen print of the geographic display of the origin-destination and trip linkage image for use in presentations

Please note, The TNC contractor is responsible for providing all necessary data required by the FTA National Transit Database (NTD) reporting following FTA required format. Full scope and schedule of required NTD reports shall be provided at the beginning of the contract.

8. Compliance with DART’s Information and Network Security Standards Non-Disclosure Agreement

• DART reserves the right to require any contractor to enter into a non-disclosure agreement (NDA).

Information Assurance

• By accepting this contract/agreement, the contractor and other external parties providing Technology services to DART agree to comply with the applicable Technology security guidelines outlined in this document as well as all Technology policies approved by the president and CEO of

DART.

• If the contractor discovers a cybersecurity breach, new or unanticipated threats, hazards, or if existing safeguards have ceased to function, the discoverer will immediately bring the situation to the attention of the DART VP/CIO, and the DART Head of Information and Network Security. Any cybersecurity breach or threat discovered by the contractor or the contractor’s third-party contracted personnel will be alerted to DART.

Technology Security Training

• The contractor and other external organizations shall ensure that all its employees and subcontractors performing under this contract fulfill all requirements for mandatory security awareness and role-based advanced security training in compliance with Texas House Bill HB3834.

• The contractor will develop and implement an information security awareness program designed to ensure that all employees and contractors receive security education as relevant to their job function.

• All employees of DART, selected vendors, and selected vendor employees, contractors, or third-party vendors are required to complete and provide evidence of annual cyber security awareness training.

Personnel Security The contractor will adhere and/or conduct appropriate background checks on all new employees and routine reviews based on the sensitivity of the role that they are being hired for.

• The contractor shall ensure any privileged access to DART data by contractor employees shall be role-based and the contractor shall revoke such access upon the account owner’s separation, or at DART’s request.

• Contractor personnel will be provided with Visitor badges each day they are on site. Entry to secure areas requires an escort.

• All Contractor personnel will undergo a background investigation before authorization to work on the issued contract. The contractor will be responsible for providing qualified, appropriately skilled staff knowledgeable of data protection and information security procedures to meet the roles and responsibilities and Service Levels outlined in this SOW.

• All DART issued user/admin accounts, VPN/remote access accounts, and user/admin passwords will not be shared amongst Contractor personnel or employees. Accounts are assigned to an individual user only. Violation of this guidance will result in termination of account access and/or contract personnel removal.

• All contractor personnel issued DART accounts or equipment will sign DART’s acceptable use agreement, comply with DART Technology Security policies, and will maintain updated Anti-Virus (AV) software and Windows 10 Operating System (OS) for their end-point device use.

Identity Management, Authentication, and Access Control

• Authentication: The contractor will ensure that all access, by employees or contractors, to DART or its information systems, used to provide services or supply products, will require appropriate authentication controls that at a minimum will include:

a. Strong passwords or multi-factor authentication for users

b. Multi-factor authentication for all remote access

c. The contractor will ensure that all access to its information systems, used to provide services or supply products, will be approved by management.

• Privileged Account Management: The contractor will appropriately manage and control privileged accounts on its information systems that at a minimum will include:

a. Use of dedicated accounts for privileged activity

b. Maintaining an inventory of privileged accounts

• Access Termination: The contractor will develop and maintain a process designed to ensure that user access is revoked upon termination of employment or contract for contractors.

• Single-Sign-On using Active Directory integration or federated access through SAML 2.0 or equivalent shall be utilized where appropriate at the discretion of DART.

• The contractor’s authentication processes, and architecture shall comply with Federation

Assurance Level 3 (FAL3) of the Nation Institute of Standards and Technology (NIST) Digital Identity Guidelines (NIST SP 800-63).

• The contractor shall not install any method of bypassing normal authentication in any DART computer system.

• The contractor shall apply controls to the systems, applications, services, and data to prevent unauthorized personnel from gaining access to resources or performing privileged actions.

Data Security

• The service provider shall not obtain, possess, transfer, or use personal identifying information, as defined in the Texas Identity Theft Enforcement and Protection Act, of another person on behalf of DART without the other person’s consent or effective consent.

• The service provider shall implement and maintain reasonable procedures, including taking appropriate corrective action, to protect from unlawful use or disclosure any personal identifying information collected or maintained by the service provider on behalf of DART in the regular course of business.

• The service provider shall destroy or arrange for the destruction of customer records containing sensitive personal information within the service provider’s custody or control that are not to be retained by the service provider by shredding, erasing, or making the information unreadable or indecipherable through any means.

• DART's information systems contain sensitive information and contain personal information subject to the Privacy Act of 1974. It will be the contractor's responsibility to familiarize and brief employees and subcontractors on the provisions of the Privacy Act.

• The contractor will perform all work hereunder in compliance with all applicable federal, state, and local laws and regulations. The contractor will only use licensed personnel to perform the work required by law to be performed by such personnel.

• The contractor will ensure that all laptops, mobile devices, and removable media, including those that are owned by their employees or contractors, which may be used to store, process, or transport DART data are always encrypted.

• The contractor will ensure that all media that may be used to store, process, or transport organizational data is disposed of in a secure manner.

• The contractor shall use appropriate Data Loss Prevention (DLP) controls to prevent the leakage of sensitive data belonging to DART and its customers.

• The contractor will treat all DART data as confidential and shall not disclose any DART data to third parties without DART’s consent.

Systems Security

• The application must run on the following Windows versions: Windows 10 or later; Windows

Server 2019 or later. Non-windows systems must be on manufacturer supported versions with latest software updates applied.

• All operating systems and applications should be hardened using industry standard configuration hardening guidelines such as NIST or CIS. If NIST or CIS hardening standards are not available, the operating system or application manufacturer’s configuration hardening standards shall be utilized.

• The contractor shall maintain a vulnerability management program and install security-relevant software and firmware updates within a reasonable patch management cadence approved by DART based on criticality and risk exposure.

Secure Coding

• The contractor will test all source code before deploying to production.

• The contractor shall review all code for any security issues.

• The contractor will review all code for any security issues. The contractor will search for security vulnerabilities embedded in the application’s code or architecture. Secure coding practices must be incorporated into all life cycle stages of the application development and deployment processes. Perform automated application security testing as part of the overall existing code, code creation, changes, and application testing process to detect any vulnerabilities before submitting changes. Development and testing environments will redact all malicious code, sensitive data, or de-identified data.

• Application coding will be implemented with proper security requirements, secure coding practices, and a focus on security risks that must be integrated into the contractor’s coding procedures. The contractor will provide a documented process to DART of their current procedure to safeguard client code and client information. The contractor is responsible for following DART’s application security practice of scanning all code for malicious code during testing before implementing the code to production servers (live).

• The contractor will request all code changes to DART’s Change Advisory Board (CAB) for all changes and updates to applications or servers.

• The contractor will report any identification of malicious code or loss of DART sensitive information to the DART Contract Officer Technical Representative (COTR) and Project Manager.

DART’s Security Response Team and the Contractor will perform remediation steps against the vulnerabilities or malicious code.

• The contractor will not expose DART systems to any malicious or insecure source code or install any method of bypassing standard authentication in any of DART’s computer systems.

General Security Requirements

• All services and DART information assets will remain “onshore.” At no time will services or DART information assets be issued or stored outside of the United States of America (USA).

• The contractor will notify DART if they procure a third-party contractor to assist with the requirements of this contract. All Third-Party contractors will undergo the selection requirements herein stated for the primary contractor.

• Data at rest shall be encrypted.

• Data in transit to/from or fully contained in the cloud shall be encrypted.

• Encryption techniques to protect data at rest and in transit, authentication, and digital signatures/hashes will meet Federal Information Processing Standard (FIPS) 140-2 requirements

• Use transport layer security (TLS) version 1.2 or higher to establish connections and communications. Insecure protocols, such as TLS 1.1 or below or SSL versions are prohibited.

• Data stored in the cloud will be replicated to a DART facility at least daily, or more frequently based on business necessity (on demand), via a secured transport application or DART authorized equivalent.

• DART retains exclusive ownership over all its data; contractors acquire no rights or licenses through the agreement, including intellectual property rights or licenses, to use the organization’s data for its own purposes; the contractor does not acquire and may not claim any interest in the data due to security.

• The contractor will also provide DART with unrestricted on-demand access to the data without charge.

Information Security Policies and Procedures

• DART maintains the right to audit, inspect, or review the contractor's information security policies and procedures. This includes a security assessment during contractor onboarding and at a regular cadence of, at most, yearly or sooner if there are any contract scope changes.

• The contractor will provide evidence of an external audit certification Standards for Attestation Engagements (SSAE) No. 18, Service Organization Control 2 (SOC-2) from a third-party audit conducted by an accredited certification body. Contractors and third-party partners are routinely assessed using audits, test results, or other forms of evaluations to confirm they are meeting their contractual obligations.

• The contractor will develop, implement, and maintain an information security incident response process and will test it regularly, at least annually.

System Acquisition, Development, and Maintenance

• The contractor will ensure that information security requirements are defined for all new information systems, whether acquired or developed.

• Separation of Environments: The contractor will ensure that development and testing environments are separated from their production environment.

• Data Anonymization: The contractor will ensure that DART’s data will not be used in the development or testing of new systems unless the data is appropriately anonymized.

Physical and Environmental Security

• The contractor will use a formal risk assessment methodology to identify physical and environmental threats and implement controls to minimize the risks.

Change Management

• The contractor shall provide DART with notice of upcoming changes and document the purpose, expected outcomes, and risk assessment.

• The contractor shall provide DART with an appropriate sandbox environment to test changes before promoting them to production.

• If an out-of-band emergency change is implemented, the contractor will have an Emergency

Review with DART to discuss result.

Contingency Planning

• The contractor shall take appropriate measures to safeguard its infrastructure and supporting services used to host DART applications, services, and data against hardware and software failures caused by natural or man-made disasters such as overheating, humidity, denial of service, cyber-attacks, sabotage, power outages, equipment failures, terrorist attacks, accidents, tornados, hurricanes, fires, floods, and earthquakes.

• The contractor shall employ data redundancy mechanisms and fault-tolerant systems to back up the persistent data stored on primary application systems hosting DART data and services.

• The contractor shall maintain capabilities to rapidly restore data and services at a secondary site within established Service Level Agreements (SLAs) in the event where the primary site becomes unavailable or incapable of hosting the DART applications, services, or data. If no SLAs are established, it is DART's expectation that services will be restored near real time (at most 5 minutes).

• The contractor shall conduct planned failovers to test the performance of secondary database nodes and share the testing results with DART.

• The contractor shall maintain a documented, annually validated disaster recovery plan and provide DART access to historical records of system uptime.

Data Sanitization

• All DART resources made available to the contractor under the terms of the service agreement such as data, programs, scripts, as well as any other equipment and documentation owned by DART shall be returned to DART or expunged as specified in the agreement.

• After the specified retention period, the contractor shall securely sanitize or destroy all physical storage media containing DART data consistent with the NIST guidelines for media sanitization

(NIST SP 800-88).

• The contractor will provide DART with written certification and system logs as verification that DART’s data has been purged from their environment.

Continuous Monitoring

• The contractor will continuously monitor the security of the cloud service and maintain the ability to detect, contain, and remediate malicious software, unauthorized use, exfiltration of data and unauthorized system changes. Scan reports shall be sent to DART for review monthly.

• The contractor will enlist a certified third-party to conduct penetration and vulnerability testing.

The results of this testing shall be made available to DART for review.

• The contractor shall remediate any discovered vulnerabilities within DART’s documented severity and risk assessment guidelines.

• The contractor will have the capability to safeguard logs and other audit information from unauthorized access, alteration, and deletion.

Data Conversion Environment DART shall require an exact duplicate of contractor’s production environment for DART’s use in data conversion activities. This environment shall:

• Contain full business functionality as contractor’s production environment, utilizing the same software release as production

• Have enough capacity to support conversion activities, no less than the capacity of the production environment

• Comply with DART’s security requirements

• Available for multiple cycles of data conversion, with the ability to remove all or some previously converted data

• Allow for exact data transfer to/from the production environment for all data or a subset of data

Quality Assurance (QA) Environment The bidder is expected to provide an actionable Quality Assurance Plan (QAP) to identify invalid trips and process adjustment. The QAP shall include the policies, procedures, monitoring, corrective action, reports, and procedures for all services. The contractor must ensure they work diligently with DART in developing the QAP. This plan shall be submitted to DART within 30 days after the start of the contract.

The Contractor will be responsible in ensuring QAP is up to date and keeping with the standards. The Contractor shall report their findings monthly to DART in a format and date that is mutually agreed upon DART shall require exact duplicates of contractor’s production environment for DART’s use in QA testing and training on every release of contractor software prior to moving DART to the new release. These environments shall:

• Be available on demand as DART deems necessary

• Contain full business functionality as contractor’s production environment, utilizing the same software release as production

• Have enough capacity to support DART’s testing activities, no less than the capacity of the production environment

• Comply with DART’s security requirements

• Available for multiple test cycles

• Allow DART to pull data from production for testing purposes

• Allow DART to report, prioritize and monitor defects

• Additionally, DART shall require an environment for use in data conversion/migration on demand as needed. This environment should be sufficiently sized to support DART’s data conversion efforts

Incident Response

• The contractor shall inform DART of any suspected security breach or detection of any suspicious intrusion that is occurring or has occurred that jeopardizes DART’s data or processes.

The contractor shall give notice of any breach or potential breach to DART within 2 hours of its discovery.

• The contractor shall make full disclosure of the assets that might have been jeopardized. In addition, the contractor shall inform DART of the actions it is taking or will take to reduce the risk of further loss to DART.

• If the breach requires public notification, the contractor shall coordinate all communication with DART.

• The contractor shall cover the costs of response and recovery from a data breach. DART will expect to recover all breach costs from the contractor.

• The contractor shall provide pertinent information including logs and system snapshots to support post-mortem analysis of an incident.

9. Insurance Requirements Required Coverage. The Contractor shall, at all times during the term of this contract and extended terms thereof, provide and maintain the following types of insurance protecting the interests of the Authority and the Contractor with limits of liability not less than those specified below.

1) Commercial Automobile Liability insurance or its equivalent, listing DART, City of McKinney, and the

McKinney Urban Transit District as an additional insured, on primary and non-contributory basis, with waiver of subrogation, covering all owned, hired and non-owned vehicles used in connection with the work performed under this contract with a combined single limit for bodily injury and property damage liability of not less than $5,000,000 per accident. At Contractor’s discretion, Subcontractors may maintain lower limits of auto liability insurance, but Contractor will be responsible, and will indemnify DART, for all losses caused by Subcontractor negligence. In the event the Contractor will drive or take custody or control of a DART owned vehicle, the insurance policy shall provide physical damage coverage for non-owned autos with a deductible not to exceed $2,500.00.

2) Commercial General Liability insurance or its equivalent, listing DART, City of McKinney, and the McKinney Urban Transit District as an additional insured, on primary and non-contributory basis, with waiver of subrogation, providing limits of not less than $2,000,000 for bodily injury and property damage per occurrence, with a general aggregate of $4,000,000, and products and completed operations aggregate of $4,000,000. The policy shall be endorsed with Additional Insured endorsements for ongoing operations and completed operations performed by or on behalf of the contractor. At Contractor’s discretion, Subcontractors may maintain lower limits of Commercial General Liability insurance, but Contractor will be responsible, and will indemnify DART, for all losses caused by Subcontractor negligence.

The Contractor shall maintain this coverage for a period of 3 years following project completion.

There shall not be any policy exclusions or limitations for the following:

i. Contractual Liability covering Contractor's obligations herein

ii. Personal Injury Advertising Liability

iii. Medical Payments

iv. Fire Damage Legal Liability

v. Broad Form Property Damage

vi. Liability for Independent Contractors

3) Workers' Compensation Insurance, providing benefits comparable to those provided under the Workers' Compensation Act of the State of Texas and/or any other State or Federal law or laws applicable to the Contractor's employees performing work under this contract. Employer's Liability Insurance with limits of liability of not less than $1,000,000 each accident, $1,000,000 each employee for disease and $1,000,000 policy limit for disease. This insurance shall be endorsed with a Waiver of Subrogation Endorsement, waiving the carrier's right of recovery under subrogation or otherwise from DART and from any other entities as requested by DART.

4) Professional Liability – The Contractor shall provide Professional Liability insurance with limits of not less than $2,000,000 per claim. Coverage is to remain in effect for the entire duration of the contract and two years after contract expiration date. At Contractor’s discretion, Subcontractors may maintain lower limits of Professional Liability insurance, but Contractor will be responsible, and will indemnify DART, for all losses caused by Subcontractor negligence.

5) Certificates of Insurance. Before commencing execution of this contract, the Contractor shall respond to insurance related questions and attach a certificate of insurance satisfactory to the Authority (or, as and when the Authority may direct, copies of the actual insurance policies) in the Questions section of the Supplier Portal, as follows:

i. Go to https://suppliers.dart.org

ii. Login

iii. Click on “Update Account Information”

iv. Under Questions section, click Answer

a) The certificates of insurance shall evidence insurance required by paragraph (a), stating policy number, dates of expiration, and limits of liability thereunder. The certificates shall also attach all relevant endorsements required in subparagraphs to

(a) and shall be acceptable to the Authority.

b) Approval of Forms and Companies. All coverage described in this contract shall be in a form and content satisfactory to the Contracting Officer. All insurance should be provided by insurance companies with a Best's Rating of A-/ VIII, or better.

c) Additional Insured Endorsement. The policy or policies providing Commercial Automobile Liability and Commercial General Liability shall be endorsed to name DART, its directors, officers, representatives, agents, and employees, as well as any other interests directed by DART, as Additional Insureds under this contract. The policies shall also be endorsed to name other interests as directed by DART.

d) All policies shall be endorsed to provide thirty (30) days advanced written notice of policy cancellation or modification, except (10) days for non-payment of Premium.

e) Multiple Policies. The limits of liability as required above may be provided by a single policy of insurance or a combination of primary, excess, or umbrella liability policies.

https://suppliers.dart.org/

But in no event shall the total limit of liability of any one occurrence or accident be less than the amount shown above.

f) Deductibles. Companies issuing the insurance policies and the Contractor shall have no recourse against the Authority for payment of any premiums or assessments for any deductibles, as all such premiums and deductibles are the sole responsibility and risk of the Contractor.

g) Subcontractors. If any part of the work is sublet, Contractor shall require any and all subcontractors performing work under this contract to carry Workers' Compensation Insurance, in accordance with paragraph (a) (3) above. The Contractor shall determine any other types of insurance and the limits of liability that Contractor shall deem appropriate and adequate to protect the interests of the Authority. In the event a subcontractor is unable to furnish any insurance required under this Contract, the Contractor shall endorse the subcontractor as an Additional Insured or become an Alternate Employer. The Contractor shall obtain and furnish to the Authority certificates of Insurance evidencing subcontractors' workers' compensation insurance coverage. All other insurance certificates for subcontractors shall be furnished to the Authority upon request.

h) No Release. The carrying of the above-described coverage shall in no way be interpreted as relieving the Contractor of any other responsibility or liability under this agreement or any applicable law, statute, regulation, or order.

10. Cancelation Policy The contractor will develop a rules-based framework to analyze service cancellations, enabling MUTD to identify violations and take appropriate action in accordance with its established cancellation policy.

Appendix

MUTD Service Area

The following tables demonstrate the Key Performance Indicators, by year, for the Collin County Transit Program. GoPass booking was not available until November.

Table 1: MUTD Key Performance Indicators for 2022

Metric Jan-22 Feb-22 Mar-22 Apr-22 May-22 Jun-22 Jul-22 Aug-22 Sep-22 Oct-22 Nov-22 Dec-22 Riders 996 1,007 1,449 1,487 2009 2,285 2,387 3,125 3,159 3,431 3,670 4,190 Cancellations 693 706 753 717 882 933 711 972 949 1032 984 1,038 No Shows 163 74 76 94 148 106 84 159 108 145 180 192 Cancellation % 41.00% 41.21% 34.20% 32.50% 30.50% 29.00% 23.00% 23.70% 23.10% 23.12% 21.14% 19.85% No Show % 9.70% 4.32% 3.50% 4.30% 5.10% 3.30% 2.70% 3.80% 2.60% 3.25% 3.87% 3.67% Total Requests 1,638 1,688 2,196 2,143 2,780 3,068 2,950 3,873 3,888 4,144 4,261 4,727 Completed Requests 956 976 1,406 1442 1933 2,162 2,267 2,946 2,988 3,183 3,354 3,771 No Drivers Available 6 36 64 13 4 6 4 6 0 0 0 2 Average Travel Duration (minutes) 17.4 20.05 22.32 20.16 17.8 15.6 15.5 16.7 16.9 16.6 15.8 14.7

Average Travel Distance (miles) 6.4 7.1 7.4 7.2 6.9 6.5 6.6 7.2 7.3 7.2 7.2 6.8

Median Wait Time 19.39 22.45 30.02 24.35 16.5 12.9 12.5 14.3 14.3 12.7 11.8 11.3 Booking Method - Call Center 100% 100% 100% 100% 100% 100% 100% 100% 100% 100% 99.92% 96.95% Booking Method - GoPass - - - - - - - - - - 0.08% 3.05% Average Weekday Ridership 42 45 57 63 87 94 104 124 134 139 156 178 New Riders Added 62 19 36 41 34 35 35 56 34 36 52 27 Unique Riders 117 121 151 153 167 181 195 210 212 238 250 263

The following tables demonstrate the Key Performance Indicators, by year, for the Collin County Transit Program. Booking trips through an Interactive Voice Recognition system came online in October.

Table 2: MUTD Key Performance Indicators for 2023

Metric Jan-23 Feb-23 Mar-23 Apr-23 May-23 Jun-23 Jul-23 Aug-23 Sep-23 Oct-23 Nov-23 Dec-23 Riders 4,397 4,610 5,994 5,526 5,864 5,315 4,947 6,464 5,941 6,260 6,305 5,998 Cancellations 1,174 1,293 1,608 1,515 1,574 1,401 1,575 1,649 1,884 1,791 1,756 1,735 No Shows 195 253 246 284 240 258 411 378 358 224 238 248 Cancellation % 21.07% 21.90% 21.15% 21.52% 21.16% 20.86% 24.15% 20.33% 24.08% 22.25% 21.78% 22.44% No Show % 3.50% 4.29% 3.24% 4.03% 3.23% 3.84% 6.30% 4.66% 4.58% 2.78% 2.95% 3.21% Total Requests 5,147 5,399 6,961 6,281 6,673 6,257 5,842 7,363 7,208 7,455 7,483 7,344 Completed Requests 4,049 4,207 5,481 4,962 5,296 4,943 4,450 5,854 5,533 5,816 5,898 5,706 No Drivers Available 0 0 0 0 0 0 0 0 0 0 0 0 Average Travel Duration (minutes) 15.91 16.6 15.75 15.77 15.85 16 15.65 16.34 16.19 16.93 17.18 16.77

Average Travel Distance (miles) 7.32 7.04 7.13 7.21 6.82 6.76 6.92 7.18 7.15 7.63 7.48 7.62

Median Wait Time 10.6 12.4 12.1 11.32 10.56 10 10 11 12 12.59 11.1 10.81 Booking Method - Call Center 93.81% 90.13% 90.87% 86.75% 79.67% 76% 74% 67% 67% 66% 65% 65% Booking Method - GoPass 6.19% 9.87% 9.13% 13.25% 20.33% 24% 26% 33% 33% 31% 32% 33% Booking Method - IVR - - - - - - - - - 3% 3% 2% Average Weekday Ridership 172 194 227 228 221 209 200 243 215 244 269 245 New Riders Added 34 38 34 23 27 29 41 28 26 47 26 29 Unique Riders 278 287 316 318 318 313 320 360 352 355 354 376

The following tables demonstrate the Key Performance Indicators, by year, for the Collin County Transit Program.

Table 3: MUTD Key Performance Indicators for 2023

Metric Jan-24 Feb-24 Mar-24 Apr-24 May-24 Jun-24 Jul-24 Aug-24 Sep-24 Oct-24 Nov-24 Dec-24 Riders 5,504 6,323 6,626 6,600 6,361 5,744 6,404 7,429 6,973 8,486 7,612 7,845 Cancellations 1,591 1,457 1,656 1,754 1,703 1,391 1,664 1,647 1,673 1,977 1,875 1,906 No Shows 231 213 224 257 238 181 147 190 194 261 262 279 Cancellation % 22.42% 18.73% 20.00% 21.00% 21.12% 19.50% 20.62% 18.15% 19.35% 18.90% 19.76% 19.55% No Show % 3.26% 2.74% 2.70% 3.08% 2.95% 2.54% 1.82% 2.09% 2.24% 2.49% 2.76% 2.86% Total Requests 6,861 7,447 7,977 8,068 7,763 6,852 7,705 8,725 8,293 10,148 9,228 9,522 Completed Requests 5,318 6,054 6,389 6,368 6,130 5,507 6,092 7,096 6,676 8,225 7,397 7,629 No Drivers Available 5 10 4 4 12 4 9 33 3 7 6 22 Average Travel Duration 16.86 17.03 1705 17.94 17.69 17.39 18.22 18.67 18.71 18.74 18.05 17.45 Average Travel Distance 7.84 7.73 7.68 8.04 7.74 7.83 8.23 8.38 8.5 8.44 8.15 7.7 Median Wait Time 9.77 10.27 10.66 10.25 10.3 9.72 9.73 10.4 11.35 11.37 10.45 10.52 Booking Method - Call Center 64% 63% 61% 47% 46% 48% 51% 49% 39% 37% 38% 38% Booking Method - GoPass 33% 34% 35% 33% 33% 33% 34% 34% 38% 43% 46% 46% IVR Booking 3% 3% 4% 21% 21% 19% 15% 17% 23% 20% 16% 16%

The following tables demonstrate the Key Performance Indicators, by year, for the Collin County Transit Program. The distance-based fare began in February.

Table 4: MUTD Key Performance Indicators for 2025

Metric Jan-25 Feb-25 Mar-25 Apr-25 May-25 Jun-25 Jul-25 Aug-25 Sep-25 Oct-25 Nov-25 Dec-25 Riders 7,296 7,275 7,140 7,241 6,917 6,100 6,405 6,749 6,853 7,510 5,941 6,600 Cancellations 1,896 1,884 1,434 1,212 1,192 1,007 928 1,042 1,051 1,350 1,048 1,378 No Shows 286 249 259 217 172 155 136 173 181 213 173 220 Cancellation % 20.63% 20.57% 16.72% 14.34% 14.70% 14.17% 12.66% 13.37% 13.30% 15.24% 14.99% 17.27% No Show % 3.11% 2.72% 3.02% 2.57% 2.12% 2.18% 1.85% 2.22% 2.29% 2.40% 2.48% 2.76% Total Requests 9,223 8,868 8,319 8,183 7,855 6,818 7,014 7,490 7,666 8,686 6,806 7,758 Completed Requests 6,998 7,063 6,931 7,000 6,707 5,856 6,126 6,491 6,654 7,352 5,785 6,406 No Drivers Available 25 7 12 8 10 6 0 6 4 33 14 40 Average Travel Duration 17.99 18.03 17.22 17.08 16.81 16.44 16.43 17 17.3 17.11 17.56 17.39 Average Travel Distance 7.94 8.0 7.55 7.39 7.11 7.21 7.26 7.