2-04. LMS Exhibit 3 - Compliance Standards.pdf

696-TL-26-O020 Exhibit J.3

Identifier Compliance Standard Unacceptable Performance

Measure Resolution Time Payment Adjustment

C.3.A The Contractor shall maintain uninterrupted operability of the LMS and all functional components, ensuring that each feature operates according to its intended design and purpose at all times.

Noncompliance occurs when any required LMS function is unavailable, degraded, or fails to perform as specified.

4 hours A $1,500.00 deduction from the Contractor's invoice for each incident, per Day, until the issue is resolved.

C.5.D The Contractor shall provide a detailed implementation plan to the Department within 10 Working Days after the introductory kick-off meeting.

The implementation plan is submitted more than 10 Working Days after the introductory kick-off meeting.

N/A $1,500.00 deduction from the Contractor's invoice invoice per Day the plan is late.

Exhibit J.5 Data Integrity and Destruction: Data storage and data destruction will meet state, federal, and industry standards.

Any data not stored or destroyed as required.

N/A $1,500.00 deduction from the Contractor's invoice per incident.

C.3.6.B System Availability and Reliability 24x7 measured weekly with no more than 1% downtime within any week. The Contractor shall immediately notify the Department of any interruption of Service.

More than 1% downtime in a week.

N/A A $1,500.00 deduction will be from the Contractor's invoice per week with more than 1% downtime.

C.8.D Maintenance, updates, and upgrades may be performed during Business Hours. If performed during Business Hours, they must be coordinated with the Department's designated point of contact at least 48 hours in advance. Updates and upgrades should be implemented to improve and provide needed functionality in accordance with requirements listed in the Contract.

Maintenance, updates, and upgrades are not coordinated at least 48 hours in advance.

N/A $1,500.00 deduction from the Contractor's invoice per incident.

C.8.F Support requests from the Department must be acknowledged by the Contractor within 24 hours of the initial request. Acknowledgement may be via telephone, email, or on-site visit if deemed necessary by the Department.

Responses not received within the allotted 24 hours of the initial request by the department.

N/A A $1,500.00 deduction from the Contractor's invoice after the initial 24 hour period, and for each 24 hours, until the response is acknowledged.

Compliance Standards

The below listed Compliance Standards have been identified as critical to the success of the Learning Management System (LMS) Service. The Contractor shall ensure the stated outcomes are achieved at the required standard. Compliance shall be measured from Contract implementation and continue through the Contract Term. Multiple violations of any standards may lead to termination of the Contract.

696-TL-26-O020 Exhibit J.3

Identifier Compliance Standard Unacceptable Performance

Measure Resolution Time Payment Adjustment

Exhibit J.4 The Contractor is responsible for following all federal and state laws as well as the Information Resources Security Program (IRSP), the Department’s security policy based on NIST 800-53.

Any instance of not following security standards.

Six hours to report a security incident.

30 hours to resolve a security incident.

$1,500.00 deduction from the Contractor's invoice per instance, security incident not reported within six hours, and/or security incident not resolved within 30 hours.

C.3.5.A The Contractor shall verify CAPPS HR synchronization of employee records.

Any error in synchronized employee records.

Seven Days. A $1,500.00 deduction from the Contractor's invoice per Day past the Resolution Time.

C.3.8.A The Contractor shall verify and successfully test all historical data migration by end of UAT.

Any error in migrated historical data.

N/A A $1,500.00 deduction from the Contractor's invoice per Day after UAT that errors are not corrected.

C.8.1.A The Contractor shall provide written notice of product end-of-life (EOL) at least one year prior, including key dates for end of support and end of extended maintenance.

Less than one year notice. N/A $1,500.00 deduction from the Contractor's invoice, per month short of the required one year notification.

C.8.1.B The Contractor shall maintain critical security patches and technical support through the published end-of-life date and provide documentation of any residual risks post-EOL.

Not providing critical security patches, technical support, or documentation of post- EOL risks.

N/A $1,500.00 deduction from the Contractor's invoice per incident per Day

C.8.1.C The Contractor shall provide migration guidance, data export options, and recommended replacement solutions to ensure continuity of operations.

Not providing migration guidance, data export options, or recommended replacement solutions.

N/A $1,500.00 deduction from the Contractor's invoice per incident, per Day