2-11. [Automated Crime Victims Notification System] BPM005579 Solicitation Attachment 11 - Method of Approach_Equifax Response 202.pdf

Solicitation Attachment – Method of Approach | Revision No. 1 | Revised 11-22

Attachment 11 – Method of Approach

The Offeror shall provide a narrative response to each instruction contained below. The narrative response may include screenshots but not web references or references to other information elsewhere. The narrative should demonstrate the Offeror’s understanding of the Scope of Work requirements and describe the Offeror’s overall method of approach for providing the Service(s) stated in this Solicitation. If there is an instruction that is not applicable to the Services required by the Scope of Work, you may mark it “N/A” and note why it appears not applicable

Offeror shall provide a response either after each numbered instruction right in this document or in a separate document entitled: “Attachment - Method of Approach.” If a separate document is used, please clearly designate each section and double-check to ensure that each question has been answered. If any information provided is considered CONFIDENTIAL by Offeror, the information must be specifically included in the Confidential Information Designation Attachment and related documentation to be assessed for confidential treatment under A.A.C. R2-7-103.

Offeror Response:

Solution Overview

As our response to RFP BPM005579, Appriss Insights, LLC, a part of Equifax Inc., (hereafter “Insights”) is pleased to present an expansion of its Victim Information and Notification Everyday (VINE®) solution, which incorporates a collaborative end-to-end notification workflow for victims and public safety agencies in the state of Arizona. The VINE service is the nation’s premier automated system for providing victim notification and currently supports over 90% of the nation’s incarcerated population covering over 3,000 communities. VINE allows survivors, victims of crime, and other concerned citizens to access timely and reliable information about offenders or criminal cases in U.S. jails and prisons, empowering them to participate in the justice process.

Founded in 1994, VINE has provided automated victim notification for nearly 30 years, positioning us well to partner with ACJC to help achieve your goals.

As the current provider of the Arizona Victim Notification system (AZ VINE), Insights has enjoyed a true partnership with Arizona over the last 27 years through the development, implementation, and execution of the VINE solution in the state. VINE provides a central mechanism for survivors and victims to participate in the criminal justice process by providing timely information regarding custody status and criminal case information.

VINE, a Software as a Service (SaaS) solution, is the most cost-effective technology for victim notification and is the only proven, large-scale notification system that informs victims of offender status changes throughout the criminal justice process. As a SaaS provider, Insights fulfills the entire contract to include equipment, software and hardware, IT infrastructure, supplies, materials, and personnel.

The solution being proposed incorporates an engagement between Insights and Versaterm that provides a solution to meet the requirements of House Bill 2482 (H.B. 2482). Independently, Insights’ and Versaterm’s solutions provide distinct parts of the Crime Victim Notification System (CVNS) workflow, but together they provide a comprehensive CVNS experience for victims and concerned citizens that only this unique partnership can provide.

SPIDR Tech is the premier product and service of Versaterm. SPIDR Tech has been helping Law Enforcement Agencies (LEAs) improve workflow and customer service for over 9 years.

As detailed in the Scope of Work below, the proposed CVNS solution incorporates the expansion of the existing Arizona VINE system to include a collaborative end-to-end notification workflow for victims and public safety agencies in the state of Arizona.

This proposal assumes that VINE and SPIDR will maintain the role of system administrator and operator, including the LEA onboarding efforts, once an agency has opted in.

1.0 Referencing Scope of Work, Section 1.1 Desired System Overview, please describe in detail how your solution would meet or exceed the CVNS’s required areas of functionality. Also, with each area of functionality, describe what at the time of preparing your proposal is fully developed and tested vs. what is planned to be developed and tested and by when.

Offeror Response:

Below are the areas of functionality of the CVNS as defined by Section 1.1. Here you will find a summary table and a detailed description of the functionality. It is important to note that portions of this functionality exist in currently deployed VINE and SPIDR solutions throughout the state of Arizona.

Functionality Summary

Details of implementation and functionality are documented in this section. The table below is provided for quick reference.

Fully Implemented Partially Implemented Not Available Required by HB 2482

Feature/Functionality Incident

(CAD)

Investigation

(RMS)

Prosecution

(CMS)

Incarceration

(JMS)

Receive Notifications Victim Text Notification

Victim Email Notification

Victim Phone / Voice Notification

Survey Requests Via Text

Survey Requests Via Email

Receive Multi-Agency Notifications LEA Text Notifications

LEA Email Notification

LEA Phone / Voice Notification

(CAD)

Investigation

(RMS)

Prosecution

(CMS)

Incarceration

(JMS)

Manage Notification Settings Notification Trigger Config

SMS Notification Content Config

Email Notification Content Config

Voice Notification Content Config

Notification Schedule Config

Survey Content Configuration

Manage Notification Attachments Attachment via web links

Attachment via email

Setup Notification and Alerts Victim et al. – Opt Out

Victim et al. – Opt In

Victim Profile with custom alert config

Manage Message Language and Content Automatic or Ad-hoc Language Translation

Conversational Language Services (CLS)

Adjust CLS for tone, verbosity and reading level

Set up & control message headers – SMS

Set up & control message headers – Email

Set up & control message headers – Call

Manage the Virtual Agent (AI bot) Manage Virtual Agent for Case Status

Administer CVNS CVNS administration

Manage Security Security Management by System Admin

Onboard LEAs Onboard LEAs

Operate the 1-800 Desk 1-800 Victim Support Desk

Manage APIs Fully Supported APIs

Support a LEA’s data exchange with CVNS ETL agents between LEA and CVNS

Monitor and act on data connection status changes Data Exchange from LEAs fully monitored

Conduct Analysis ACJC has access to data for analytics

User Group Victim et al.

LEA

Vendors for Data Exchange

CVNS

ACJC

Detailed Description

Receive Notifications: This area of functionality includes notifications that are triggered by defined events regarding a victim’s law enforcement crime report, its investigation and case, subject to approval of the law enforcement agency.

Fully Implemented – Ready for LEA Deployment | Victims et al. will receive Text, Email, or Phone messages triggered from events arising from the initial incident call through potential offender incarceration status changes and case closure. These events are determined by interfacing directly with the LEA’s Computer Aided Dispatch, Records Management Systems, Case Management Systems, Court Management System, and Jail Management systems. Information required for these messages is collected by the ETL (Extract Transform and Load) agent that will be either hosted on premises in agencies’ secure datacenter or will be hosted in the CVNS’s secure government cloud service. The CVNS cloud service will then transform the data and store and transmit notifications to Victims et al. These notifications are fully customizable by agency and trigger type. The notification triggers as defined in SOW 1.3.6 are a subset of all triggers for notifications that can be sent. Notifications can contain simple messages, attachments and links for supplemental information or additional actions for the recipient to take and finally they can contain links to surveys to evaluate the service provided by the LEA.

Not Available Functionality | Due to safety concerns for community members, phone notifications of Incident events are not sent. Call handlers have the option to call a reporting party back at any time should the situation arise.

Currently there is no support for investigating automated event voice notifications over the phone. However, the current methods that officers and attorneys use by making direct calls to the victim is still in place and an option for the agency to leverage as a fall back. There are concerns about the effectiveness and usability of voice notifications for these events as there are often URLs and attachments associated with them. We will happily investigate the need deeper with ACJC and establish and determine an appropriate timeline for this feature.

Receive Multi-Agency Notifications: This area includes the sharing of status of an incident or an investigation with another identified agency. It is currently unclear if receiving a status is intended to trigger an update in the receiving LEA’s RMS system.

Fully Implemented – Ready for LEA Deployment | If the LEA tracks agencies and other interested parties in their RMS or CMS notifications can be triggered and delivered via email or SMS.

Not Available Functionality | Currently, there is no automated voice call back solution for updating LEA’s RMS systems. However, officers, detectives, and attorneys always have the option to directly call the interested agency with a notification.

Additionally, LEA notifications for CAD are not available and generally are not needed as the critical LEAs are involved in the incident in real time in most cases.

Manage Notification Settings: This is the initial creation and management over time of the notification settings available to an LEA.

Fully Implemented – Ready for LEA Deployment | LEA has full control over message and survey content, trigger definition, language support, and notification timing. Many of these are self-serve features, while others are done through the maintenance and support included in our subscription. CVNS, as currently implemented, fully supports all triggers and content as specified in HB 2482.

Manage Notification Attachments: This area includes the initial creation and management over time of the settings relative to attachments to notifications.

Fully Implemented – Ready for LEA Deployment | LEAs have full management of attachments. In most instances, we have found agencies prefer to have most attachments distributed as links to content on their respective sites. This allows quick and easy management for their content and fits within their content and public information policies and processes. In all cases, text messages should always have attachments as links.

Set-up Notification and Alerts: This area includes the options for victims et al. to adjust their personal notification settings from time to time.

Fully Implemented – Ready for LEA Deployment | Reporting Parties and Victims et al. are automatically enrolled in notifications at the start of an incident deriving from a call for service. These parties can opt out of notifications at any time and can re-register to receive notifications on a specific case through the victim and VINELink portals. A user can opt in or opt out using the built-in STOP and START functionality over SMS.

Manage Message Languages and Content: This area of functionality includes features that allow the CVNS Operator to configure and control various message content aspects such as:

• Automatically or ad-hoc invoke language translation or content selection based on language.

• Set up and invoke conversational language services that adjust language for tone, verbosity, reading level and so on. These services may or may not include artificial intelligence support.

• Set up and control message headers, in order to increase ease-of-use and adjust for display changes in texts and emails, and for changes in the introduction at the beginning of an automated phone call.

Fully Implemented – Ready for LEA Deployment | All victim et al. messages and notifications in the solution can be translated into any supported language. This process is part of LEA onboarding to ensure tone, accuracy, and messaging is appropriate for the context of the incident, investigation, and agency. The CVNS operator, in this case combined operations by Insights and Versaterm, has all functional capabilities required to support translation. Included in the proposed CVNS is the cost of English and two supplemental languages to be determined during onboarding.

Manage the Virtual Agent (AI bot): This includes the functionality necessary to set up, configure and manage the Chatbot and/or AI, explicitly.

Fully Implemented – Ready for LEA Deployment | The system admin, in this case combined operations by Insights and Versaterm, has the capability to set up the chatbot/conversational AI component for case status updates.

Administer CVNS: This area includes all tasks necessary to administer CVNS, including configuration management, deployments and monitoring.

Fully Implemented – Ready for LEA Deployment | All administration is done by the combined operations of Insights and Versaterm and is included in the subscription agreement.

Manage Security: This area includes ensuring application and data security, as well as compliance with all applicable laws and rules.

Fully Implemented – Ready for LEA Deployment | Security management is fully managed by the system administrators of Insights and Versaterm. See security and compliance attestations in Attachment 14 Arizona Baseline Security Controls Pre-requisite for details.

Onboard LEAs: This area includes all activities necessary to initiate and complete the onboarding of a law enforcement agency to CVNS.

Fully Implemented – Ready for LEA Deployment | LEA Deployments are managed and executed by the service providers in this proposal. All deployment teams have the functionality and established processes to onboard LEAs.

Operate the 1-800 Desk: This area includes the operation of the 1-800 Desk as well as the interactions with callers, automated and not automated.

Fully Implemented – Ready for LEA Deployment | A compliant solution is already available and in operation via the Arizona VINE solution. As per HB 2482, the solution provides a designated statewide toll-free number that is available 24 hours a day, seven days a week, which is operated by trained operators available in multiple languages and allowing victims, surviving immediate family members, witnesses, and other concerned citizens to search for and obtain information about an offender, inmate, or case and to register for notifications.

Manage APIs: This area includes the creation, application, and monitoring of CVNS’s APIs.

Fully Implemented – Ready for LEA Deployment | All APIs required for the functionality of the CVNS and for the use by the system of LEAs, ACJC and administrators are fully implemented, monitored, and maintained to a high level of availability and stability.

Support LEA’s data exchange with CVNS: This area of functionality includes the activities by the LEA’s vendor(s) of their RMS(s) necessary to implement and monitor the data exchanges with CVNS.

Fully Implemented – Ready for LEA Deployment | LEAs exchange data with CVNS via the ETL agent (see diagram in System Overview) — this agent and its connections are actively monitored. Alerts are raised to the system administrator should any of these connections fail. The alerts, monitoring, and resolution are included in the subscription agreement.

Monitor and act on data connection status changes: This area is to monitor the status of each data exchange in and with CVNS. This work may include responding to status changes and to control settings in CVNS that use or are dependent on the status of individual exchanges.

Fully Implemented – Ready for LEA Deployment | LEAs exchange data with CVNS via the ETL agent (see diagram in System Overview), this agent and its connections are actively monitored. Alerts are raised to the system administrator should any of these connections fail. The alerts, monitoring, and resolution are included in the subscription agreement.

Conduct Analytics: This area includes providing data to the ACJC that is necessary to perform data analytics.

Fully Implemented – Ready for LEA Deployment | For LEAs that have agreed to share data with ACJC, data will be available to ACJC.

VINE also provides an administrative portal for incarceration events.

User Groups: The user groups are characterized below:

• Victims, et al. - This group includes victims of crime as noted in police or crime reports, as well as their designees and others.

• LEAs - This group includes Law Enforcement Agencies within the meaning of H.B. 2842.

• LEAs’ RMS Vendors - This group includes the vendor(s) and any data exchange support providers of a participating LEA or a LEA planning to participate.

• CVNS - This group includes the managers of CVNS. The list below shows a breakdown by function:

o Operator o Administrator o Technical Lead o Security Officer

• ACJC - This group includes staff and authorized contractors of the ACJC.

Fully Implemented – Ready for LEA Deployment | Victim users can interact with the CVNS anonymously or via an authenticated profile for incarceration status updates. LEAs users are always authenticated and authorized to perform any action on behalf of the LEA.

RMS and other 3rd party systems are integrated with either service accounts or API tokens. The CVNS administrators (the Vendors in this proposal) have various roles to ensure the rule of least privilege is followed. ACJC will have access to the data and reporting as needed to meet their required functions per HB 2482.

2.0 Describe in detail the steps/process you would follow to plan, implement, ramp up the CVNS to system operational status.

Offeror Response:

The systems that make up the CVNS are currently live and ready to scale to support the onboarding of Arizona LEAs. We can onboard LEAs immediately at contract signing with no delay.

In parallel to onboarding LEAs, we will work with the ACJC to plan and train the team there to ensure all analytic data required is accessible and that the team understands what is available and how to get the most insights from the data.

The proposed CVNS Implementation and Operations Project Schedule and milestones, including a Work Breakdown Structure (WBS), are included in our response below to Requirement 22.

3.0 Describe in detail how you would familiarize yourself with the state’s current notification system (“VINE”) and what steps you would take to plan and implement integrating CVNS with VINE?

Offeror Response:

The key advantage of partnering with Insights for your CVNS is that we have been providing automated victim notification services in Arizona for over 27 years. As the current provider of the Arizona Victim Notification system (AZ VINE), Insights has integrated with Mesa Police Department, Glendale Police Department, Tempe Police Department, Cochise Sheriff Office, Greenlee Sheriff Office, Maricopa Sheriff Office, Navajo Sheriff Office, Santa Cruz Sheriff Office, and Yavapai Sheriff Office. In 2022, we reached a collaborative milestone by migrating the AZ VINE service to an enhanced platform providing an entirely new experience for victims and survivors of crime that bolstered self-advocacy and empowerment. We did this by using an interactive service provider directory of both national, state, and local specific resources. In 2023, AZ VINE had almost 1,000 service providers searches where victims/survivors sought additional services outside of notification.

VINE currently serves over 12,200 victims and survivors in Arizona. In 2023, the AZ VINE program delivered over 22,000 notifications. SPIDR Tech currently serves 11 agencies in Arizona and is deploying 6 additional agencies, serving a population of 3.5 million with more than 1 million notifications.

Insights and SPIDR Tech, a Versaterm Company, have engaged to deliver a one-of-a-kind, comprehensive, end-to-end criminal justice notification, community engagement, and support services CVNS workflow. This end-to-end CVNS provides a holistic support experience for those impacted by the criminal justice process and incorporates early communication during key points of a victim’s journey. Insights and Versaterm have already connected VINE with SPIDR Tech through a technical interface, creating the end-to-end CVNS workflow as required by HB2482. This CVNS workflow ensures notifications to victims of crime are received as early as the initial call for service, and continues throughout the investigative, judicial, and incarceration processes. This enhanced CVNS provides the state of Arizona with the capability to share information on victim services as well as case information to victims much earlier in the criminal justice process.

This proposal meets all requirements outlined in HB2482 as detailed below.

The automated crime victim notification system must do the following:

a) Automatically, and without

a. the requirement to download a software application or

b. the requirement to opt-in to notifications

b) notify the victim by email or text of all the following regarding a victim's law enforcement crime report, investigation and case, if approved by the law enforcement agency:

1. The date on which the report is filed.

2. The case number.

3. The name of the detective who is assigned to the case.

4. When arrests are made.

5. When warrants are issued.

6. When the case is sent to the prosecuting agency.

7. Initial appearance.

c) Interface with the law enforcement agency's system of record.

d) Provide configurable triggers to send messages to crime victims.

e) Provide the ability to attach informational brochures or other electronic attachments to messages.

f) Provide the ability for victims to find their case status on the vendors' websites with links that are available on the law enforcement agency's website.

g) Be configurable to the requirements of each law enforcement agency in this state.

h) Include the law enforcement agency's branding, email ADDRESS and web DOMAIN for all communications.

i) Provide the ability to send messages in multiple languages.

j) Provide a short code or a long code telephone number with a local area code.

k) Monitor the number of messages sent and the types of messages sent and visualize the data.

Provides a criminal justice information service compliant automated victim notification platform that ensures the following:

a) Crime victims are automatically notified by text, automated telephone call or email following any updates to their case.

b) Law enforcement agencies determine the notifications.

c) Crime victims are able to proactively locate their case status online.

d) No additional staffing is required.

Provides multi-agency notification to enable an agency to automatically share the status of an incident or investigation with an identified partner agency based on configurable criteria. Allows victims to leverage conversational artificial intelligence for bidirectional real-time communication with law enforcement agencies through voice, text messages and emails. The system shall provide a virtual agent that responds to and asks questions based on the victim's questions and responses.

Provides a mechanism to track whether there is a data outage at a law enforcement agency and informs the law enforcement agency and the Arizona Criminal Justice Commission of the data outage. During an outage period, the software system shall have a backup process for law enforcement agencies to ensure that notifications are made in a timely and accurate manner.

Complies with the technical guidelines and standards for the operation of a statewide automated crime victim information and notification system recommended by the United States department of justice's bureau of justice assistance.

Provides a designated statewide toll-free number that is available twenty-four hours a day, seven days a week, that is operated by trained operators available in multiple languages and that allows victims, surviving immediate family members, witnesses, and other concerned citizens to search for and obtain information about an offender, inmate or case and to register for notifications.

The vendors chosen by the Arizona Criminal Justice Commission to be part of the partnership must have previously deployed a solution for a city police department, sheriff's office and prosecutor's office. The previously deployed solutions could have been deployed in Arizona or in another state, or a combination of both.

4.0 Describe your process of working with Law Enforcement Agency (“LEA”) participation prospects towards onboarding them to CVNS using the System’s standard architecture and data exchange specifications determined in the planning phase of the project.

Offeror Response:

Insights will use its proven implementation and project management methodology for the project, which involves key factors: single point of accountability, frequent and open communication, standards integration, frequent internal reviews, and detailed planning and execution. A project manager will be assigned to manage all aspects of implementation using best practices and industry standards. This team member will be the single point of contact for Arizona for all project activities and is responsible for maintaining team integrity and anticipating and proactively managing risk throughout the project. Utilizing project planning, scheduling, regular status calls, internal and external stakeholder communication and ensuring all team members are engaged and on track to deliver the solution. Additionally, an implementation manager and deployment engineer will be assigned to each LEA during the onboarding process. They will manage the project and technical aspects of the project working with Subject Matter Experts (SMEs) within the LEA to ensure compliance with agency security, process, and quality.

A typical deployment will consist of these phases.

• Kickoff

• Technical Deployment

• Configuration

• Quality Assurance

• User Acceptance

• Training

• Go Live

We can begin the onboarding process for two LEAs per week, ensuring the proper engagement and planning to ensure successful integration, training, and go lives.

5.0 Describe your training process and how to ensure there are no gaps in training of various user groups and areas of functionality:

Offeror Response:

The Insights training team has over 25 years of combined training experience with expertise in victim services, law enforcement, and cloud-based technology. Our team delivers training on CVNS-related technology and services in a variety of formats, with a primary focus on expanding CVNS support and reach to crime survivors and those impacted by the criminal justice system.

The training team will work with the state of Arizona to develop a comprehensive training program that educates program administrators and stakeholders. The program will provide flexibility in training delivery options, formats, and timelines. Marketing support will be provided to ensure that training sessions reach as many participants as possible.

The following training plan describes the who, what, when, where and how of training for the proposed CVNS.

WHO: Trainers, participants and organizations

Insights Marketing & Training Team The training team will work with the state of Arizona to develop thorough training session invitation lists based on mutually agreed upon training sessions, locations, and dates. Courses will be directed toward training personnel to serve as end-user trainers for their respective groups (a "train-the-trainer" approach).

Below is an initial list of recommended roles and examples of organizations who will benefit from training.

Recommended Training Participants (Roles):

• Crime Victims/Survivors

• Victim Advocates

• Law Enforcement

• Court Personnel

• Jail/Prison Administrators and IT Staff

• Designated program trainers o Presented to a minimum of three (3) participants using a "train the trainer" model

WHAT: Training content and resources to be delivered

The training team will provide the following training and marketing materials and resources.

Training Materials & Resources provided:

• Ongoing access to the expertise and guidance of the training team

• Training session marketing campaign support, including but not limited to list building, email invitations

• On-demand webinar recordings

• VINE Resource Center (YouTube channel)

• Training presentation (slide deck)

• Product Sheet

SPIDR Tech Training Modules

• Spotlight- Displays, Responses and Surveys, Data Export

• Messages

• Administrative- Patrol, Investigative and Insight

• System- Reports and Users

• Community Engagement

WHEN: Training will be delivered

The training schedule will be set by the Arizona team and the Training Team. This schedule will consider the availability of key personnel and their schedules. Courses will be directed toward training the personnel to serve as end-user trainers for their respective groups. The training schedule will be developed and approved by the Arizona team at least four (4) weeks before each training session begins.

SPIDR Tech training is conducted virtually by the Implementation Manager during the Non-Technical Deliverables and tailored to the customer application. The train-the-trainer sessions occur during deployment. Additional training and support are available through Customer Support and the Agency’s assigned Partner Success Manager.

WHERE: Training will be delivered

In-Person Training Locations

Classroom training for end-user training and train-the-trainer will take place in Arizona. Assignment of training locations will occur when the training schedule is created.

Additionally, the training team recommends targeting the top five (5) most populated cities in Arizona for virtual training.

HOW: Training will be delivered

The training team will work with the Arizona team to select the appropriate combination of training delivery options to meet the goals of the CVNS.

Available Training Delivery Options:

• Synchronous Training: Real-time, live training options that optimize instructor-student interaction and engagement.

o In-person

Onsite location such as a training facility or community center Maximum # of attendees determined by room capacity

• Virtual o Delivered using interactive webinar platform technology incorporating training content, Q&A and surveys o Maximum # of attendees: 1,000

• Hybrid o Combination of in-person and virtual formats

• Train-the-Trainer: A form of synchronous training geared towards teaching students how to teach CVNS training classes on their own.

• Asynchronous Training: On-demand training options that provide flexibility to students to take training when and where they need to.

6.0 Describe your plan for the marketing of CVNS – With the goal being two-fold: Driving participation of LEAs and use of CVNS by victims of crime.

Offeror Response:

Insights practices a strategic marketing approach that applies the optimal mix of digital and traditional marketing methods to build brand awareness, engagement, and utilization for the CVNS. The CVNS marketing strategy centers around executing campaigns targeting key stakeholders, such as victim advocates, law enforcement personnel, jail and court staff, and crime victims and survivors. We focus on educating government agencies, nonprofits, and the general public on the benefits of the CVNS with the goal of making the AZ CVNS a key function of supporting victims of crime in their safety planning process and road to recovery.

For nearly 30 years, Insights has invested millions of marketing dollars and resources in promoting automated victim notification, as evidenced by strong brand recognition of VINE in victim services. In addition to our direct marketing efforts, Insights is fortunate to have legions of victim advocates and law enforcement who promote automated victim notification directly to victims of crime in their day-to-day work.

Insights supports states with a comprehensive suite of marketing services, similar to offerings from third-party marketing agencies. While marketing agencies typically charge $125 to $175 per hour for their services, customers receive a wide range of marketing support from Insights at no additional cost.

Insights knows that understanding the CVNS platform is critical to successful utilization. The comprehensive training plan will leverage instructor-led methodology for delivering hands-on sessions efficiently. Within the training plan, Insights will provide interactive sessions that will cover: the operational use of the CVNS for the end user, reporting features, and more. A wide variety of training support pieces including video tutorials, product sheets, brochures, and posters are also made available. Best of all, we’re happy to allow Arizona program administrators to approve all training materials.

We are happy to work with the state of Arizona to provide training through various mediums, including on-site training or on-demand webinars, on a mutually agreeable timeline, that is customized for your specific learning goals. Videos are also available for ongoing education and awareness.

7.0 Once the CVNS is operational, describe in detail how you perform system monitoring and, when issues are identified, what is your resolution process.

Offeror Response:

The CVNS is assigned a team consisting of a Client Relationship Manager (CRM) and Account Specialist, along with a team of technical support personnel. The team will oversee existing and new solution implementations with support from additional qualified personnel for technical assistance, as needed.

Insights will provide 24/7/365 assistance to the state through the CustomerFirst Center (CFC) via a toll-free support number. The CFC provides an automated solution that verifies calls are routed to a live technical support agent.

Agents are trained specifically on the product and are available to help with research, troubleshooting, and/or escalation needs. The CFC exceeds service level standards of 90% for calls answered within 90 seconds.

The CFC also offers a dedicated support email address to customers/agencies. Emails received by this address will automatically create a support ticket and provide an immediate email response to the submitter. The CFC uses the ServiceNow ticketing system. As stated, upon initial contact a support ticket is automatically generated. When the ticket is resolved, an email notification is sent to the user. If the ticket is escalated, the ticket will be updated with status until completion.

In the event of a critical issue, escalations are made to the on-call support resource and/or operations management. Support issues are escalated to these teams.

Insights has implemented multiple levels of monitoring using off-the-shelf and proprietary monitoring solutions:

• Hardware and network – monitored via Industry Standard Monitoring tools (supports standard SNMP and JMX)

• Web applications – monitored by Industry Standard Application Performance Monitoring Tools

• Service availability – monitored by Industry Standard Business Intelligence tools that includes an enterprise configuration that provides near real-time feedback on application availability and any application outage.

Together, these monitoring systems provide automated ticket creation and escalation to support staff at the Global Support Operations Center

(GSOC).

The Service Level Agreement (SLA) below describes the levels of service that the client will receive from SPIDR Tech.

During the term of the applicable SLA, SPIDR Tech’s API will be operational and available to the client at least 99.9% of the time in any calendar month.

Note that even during API downtime (for whatever reason), once the API availability is reestablished, SPIDR Tech can receive “lost” data. The platform will generate and send any messages that can still be reasonably sent. This reduces the number of messages failed even during unexpected API outages.

Support Services SPIDR Tech shall establish, sufficiently staff, and maintain the organization and processes necessary to provide telephone and/or email-based technical support, troubleshooting, error identification, isolation and remediation, and other assistance directly to the Client and its authorized users.

SPIDR Tech will provide the Client with resources containing information that will aid in problem and error resolution and correction, as well as other technical resources made electronically available to any of SPIDR Tech’s other customers.

Response times The response time measures how long it takes SPIDR Tech to respond to a support request raised via email (support@spidrtech.com) or phone (877- 746-8276).

SPIDR Tech is deemed to have responded when it has replied to the client’s initial request. This may be in the form of an email or telephone call, to either provide a solution, request further information, or propose an estimated timeline for a solution.

Priority and Target Response Times

Priority Response Time Description

Priority 0 < 1 hour Complete Degradation – Impacts the entire agency. SPIDR Tech API completely unavailable

Priority 1 < 2 hours Significant degradation – critical functional unavailable, business impacting.

Messages are incorrect/misleading – citizen impact

Priority 2 1 business day

Limited degradation: minor functionality unavailable, business processes can continue.

Message schedule and timelines Administrative interface issues

Priority 3 Best Effort Very minor degradation: no impact to business processes

Response times apply on a 24x7 basis, and after normal business hours and on holidays, as necessary to support SPIDR Tech’s obligations under this agreement.

Resolution times SPIDR Tech will always endeavor to resolve problems as swiftly as possible. It recognizes that the client’s operational systems and community relationships are key to its mission and that any downtime can have significant consequences. However, SPIDR Tech is unable to provide guaranteed resolution times. This is because the nature and causes of problems can vary enormously.

In all cases, SPIDR Tech will make its best efforts to resolve problems as quickly as possible. It will also provide frequent progress reports to the client.

8.0 When CVNS system maintenance is required, describe your process for notifying key stakeholders, how you plan on minimizing downtime, and what are the contingency plans and their triggers in the event of prolonged downtime.

Offeror Response:

Most components of the CVNS do not require down time for maintenance due to the redundancy and recovery mechanisms implemented. In the case where planned down time will be required, this is communicated to the LEAs at least 24 hours in advance. When a prolonged outage happens, the system is self-healing and will collect data that may have been missed during the outage and has logic to determine what notifications should still be sent based on context and severity.

9.0 Describe in detail the end user support that you will provide.

Offeror Response:

The proposed solution for the CVNS has 24x7 LEA user support. There are toll-free support lines along with email options for support.

Victim et al. support is provided via email.

Escalation process Insights offers around-the-clock customer and data support backed by tested escalation processes that guarantee timely remediation of any issues.

Escalation via the CustomerFirst Center:

While striving to provide callers with comprehensive support so they can get the answers they need on the first call, if for some reason an agent needs to escalate an inquiry, below is an overview of the escalation process:

• Tier 1: Agents review for complete information and examples. Based on the request, Tier 1 agents will resolve or escalate the request. This level of escalation is available 24/7/365.

• Tier 2: Agents will perform initial research on the VINE related issue. Based on their research, Tier 2 agents will either resolve or escalate the request. This level of escalations is available Monday-Friday during normal business hours.

• Tier 3: Agents address issues that require a fix and facilitate remediation with the required Insights operational support team(s). This level of escalations is available Monday-Friday during normal business hours.

Escalation via data support – available 24/7/365:

The Data Support team will also be available through the CFC. Below is an overview of the data escalation process:

• Data support staff will provide Tier 1 response to all alarms from the monitoring systems that indicate when data transition has been interrupted.

• If Tier 1 support staff is unable to resolve the incident or if a change in the software is required, the incident is escalated to the appropriate Insights operational support team(s).

10.0 Describe the steps you’ve taken to ensure the data being received, stored, transmitted, and processed by your CVNS solution is sufficiently protected.

Offeror Response:

We know the importance of keeping data secure because we know it is critical to ensure there is no disruption of services for victims and survivors, the community, and program managers/administrators. All data handling in the CVNS complies with the latest standards for Moderate NIST 800-53.

All data in transit, including ingestion and egress, is encrypted with FIPS compliant techniques. All data at rest is encrypted with FIPS compliant encryption.

Insights uses conditional access policies, e.g., role-based access, quarterly entitlement reviews and MFA, to prevent unauthorized access. In addition, the company uses Intrusion Detection Systems and Intrusion Prevention Systems to detect and respond proactively to unauthorized network activity.

All of this activity uses a central logging and analysis system (e.g., a Security Information and Event Management System) to aggregate and correlate logs from network sources and identify suspicious activity for alerting. These alerts are triaged by Incident Response Technical requirements.

Finally, the process is audited.

Insights encryption is applied at rest/in transit/while processing/in backup using AES256 NIST approved ciphers. Restricted data (Class 5 data) requires application-level encryption and is also encrypted at rest. Equifax/Insights uses CMEK (Equifax controls the encryption keys) for restricted data at AES256 with the NIST approved ciphers. Symmetric keys are rotated every 90 days. At rest, the encryption is via a Data Encryption Key (DEK), which is further wrapped again with a Key Encryption Key (KEK), both of which are using NIST approved AES-256 ciphers. MFA is also required, as well as VDI for data protection. For data in transit, we use multiple mechanisms to help establish and maintain trust, including Transport

Layer Security (TLS) 1.2+ (with any number of various algorithms used in the TLS1.2 protocol) and HTTPS token-based authentication that can control access by domain and user. Equifax Insights uses TLS to resolve in the handshake for a mutual encryption strength match in transit; Insights will not resolve the connection below TLS 1.2. If a client cannot resolve the handshake to at least TLS 1.2, then the State will get a “403 error” (e.g., if they are using a weaker encryption such as TLS 1.1). The server side at Equifax sets the order determined in the match to ensure TLS 1.2 is applied and can enforce TLS with any indicated domain, e.g., email. Equifax Insights performs daily incremental and weekly full tape backups; the backup tapes are encrypted using the AES256 encryption algorithm as well. No data is ever allowed on mobile devices or workstations, yet Insights still encrypts these items at AES256 (e.g., Bitlocker) as well. No personally owned devices can connect to the Equifax Insights corporate network (only managed machines are allowed on it). In addition, Insights prevents users from attaching a USB storage device to a managed device and prevents users from attaching a personally owned storage device to an Equifax Insights managed device, as well as ensuring a block for writing to CDs/DVDs with Consumer Protected or Restricted data.

11.0 Describe all the notification channels supported by your CVNS solution.

Fully Implemented Partially Implemented Not Available Required by HB 2482

(CAD)

Investigation

(RMS)

Prosecution

(CMS)

Incarceration

(JMS)

Receive Notifications- Victim Victim Text Notification

Victim Email Notification

Victim Phone / Voice Notification

Service Survey Requests Via Text

Service Survey Requests Via Email

Receive Multi-Agency Notifications LEA Text Notifications

LEA Email Notification

LEA Phone / Voice Notification

12.0 Describe your CVNS solution’s reporting capabilities.

The solution provides many built-in reporting and dashboarding capabilities. This includes web-based access for agency users with access to statistical data to monitor the notifications and surveys being sent to the victims. Agency users also have an in-depth range of administrator functions within the web-based portal. The users will have access to several program level and service level reports that track and manage the CVNS program including usage, performance, and outcomes.

Also, the CVNS solution provides agency personnel with emailed statistical reports of their notification status and survey response data. This includes statistics on successful and unsuccessful notifications.

Agency administrators will have unlimited online access to many on-demand reports. Reports feature several customizable parameters that can offer administrators an in-depth look at available data.

13.0 Describe the scope and degree of configuration available to each participating LEA.

Offeror Response:

The platform is highly configurable and modular, allowing for customization to match a LEA’s policy. All messaging is disabled by default. During the deployment process, our implementation team will work with the agency’s personnel to determine the specific scenarios in which messages should or should not be delivered.

Configuration options include (but are not limited to):

• What call types and offense codes should generate messages

• What call types and offense codes should prevent messages from being generated

• The contents of most messages (on a per-category basis)

• The amount of time to delay before sending a message (on a per-category basis)

• “Do Not Disturb” windows

• The maximum age of data received (to prevent undesired messaging for old cases)

14.0 Describe the performance indicators and benchmarks your CVNS provides to System Administrators to enable them to readily gauge System health and detect any system outages?

Offeror Response:

We use the latest industry standard monitoring tools to evaluate, detect, and alert in accordance with Product and Customer Operational Level and Service Agreements.

Monitoring includes the health of the products and the infrastructure. It includes near real-time monitoring of the product services and transactions.

We also use a state-of-the-art tracking system for reporting on all Issues, Incidents, Problems, and Changes for the products and services.

The administrative portal of VINE provides an Agency Outage Report which includes a summary of Agencies placed in Outage for user specified period. It includes when the outage began and when the agency outage ended. We frequently can identify an outage from a LEA long before the LEA has detected the issue and work proactively with the LEA to resolve it.

15.0 Describe the steps you will take to ensure your CVNS solution has the most recent security settings and patches installed.

Offeror Response:

To ensure that the CVNS has all needed security setting and patches, we employ a variety of techniques including:

• Static Analysis (Build Time) for CVEs (Common Vulnerabilities and Exposures)

• Environment Scanning o Real Time monitoring of Environment Configuration via Cloud provider tools o Real Time CVE monitoring of deployed software for known vulnerabilities.

16.0 Describe how and when you will make your CVNS solution available to security tests including penetration tests, vulnerability assessments, cross-scripting and other attempts of accessing the CVNS system or any of its data in a non-authorized way as determined by ACJC.

Offeror Response:

The CVNS works with 3rd party vulnerability testing agencies to regularly do security tests and vulnerability assessments. These reviews are done annually at a minimum and summary results are available upon request. This work is managed and maintained by the system administrators.

Insights conducts annual penetration testing by a third-party, independent, nationally recognized vendor, and will make the Executive Summary available upon request. The Penetration Test will address vulnerabilities tested for, including OWASP Top 10, e.g., cross-site scripting and injection attacks. Insights has strictly defined vulnerability remediation SLAs and processes, which are observed and noted in the SOC2 Type II report as "no gaps noted." Insights does not share the specifics of vulnerabilities outside of the company, as they are proprietary secrets. At the conclusion of the remediation SLA in accordance with the Vulnerability and Security Risk Management Technical Requirements, Insights will update the penetration test to ensure that the vulnerability was addressed within the risk assessment provided via the CVSS model, NVD scoring or equivalent standard. The Technical Requirements apply the Information Security Program based on the NIST Cybersecurity Framework ("CSF") and NIST Privacy Framework ("PF") and is documented in Equifax's Information Security Policy and is supported by controls and technical requirements that operate together in a robust, industry leading defense in depth approach. Other compliance documents will also be made available, upon request, including the SOC2 Type II, ISO27001, and PCI DSS AOC, to name a few, as further independent assurance that Insights is applying industry security standards.

17.0 Describe…