2-696-IG-26-O012 Exhibit J.3.pdf

696-IG-26-O012 Exhibit J.3

Identifier Compliance Standard Unacceptable Performance Measure Resolution Time Priority Payment

Adjustment C.2.1.B.1 All information and databases associated with the

RMS are the property of the OIG and shall not be given, sold, or used for any other purpose outside of the RMS without express written consent from the OIG.

Unauthorized use, sharing, or sale of data.

Immediate cessation and report within 24 hours.

Critical Up to 25% deduction from invoice or contract termination depending on severity.

C.2.1.E.2 The Contractor is responsible for following all federal and state laws as well as the Information Resources Security Program (IRSP), the TDCJ security policy based on NIST 800-53.

Failure to comply with applicable laws, IRSP, or NIST 800-53 controls;

audit findings indicating non-compliance.

15 Working Days to remediate non-compliance after written notice.

Critical 10% deduction from invoice per unresolved compliance issue

C.2.3.B All Contractor staff must complete Department security and data training at intervals determined by the Department.

Staff performing duties without current training certification.

Seven Days. Medium Staff suspension and $1,000.00 invoice deduction.

C.2.3.H The TDCJ shall perform security penetration testing of the RMS as the TDCJ deems necessary. Any shortcomings identified through the security penetration testing shall be resolved within 30 Days of the results being submitted in writing to the Contractor.

Failure to resolve identified shortcomings within 30 Days.

30 Days. High 10% deduction from invoice per unresolved finding.

C.2.3.L The Contractor shall notify the OIG ISO and the TDCJ OCISO of a security incident, including but not limited to cybersecurity breaches or suspected cybersecurity breaches, within six hours of discovery.

Notification exceeds six hour window. Within six hours of discovery. Critical 10% deduction from invoice per late notification.

C.2.3.M The Contractor shall resolve a security incident within 30 hours.

Failure to resolve incident within 30 hours.

30 hours. Critical 15% deduction from invoice per unresolved incident.

C.3.A Contractor shall provide access to the entire RMS, including software, hardware, components, and maintenance support.

Partial or denied access to system components or support services.

Eight hours. High 5% deduction from invoice per Day.

C.3.C Contractor shall have complete end-to-end responsibility to ensure Quality operational service for full system functionality.

System failures or degraded performance due to Contractor oversight.

Eight hours. High Escalation to Contract review.

The below listed Compliance Standards have been identified as critical to the success of the Records Management System (RMS) Service. The Contractor shall ensure the stated outcomes are achieved at the required standard. Compliance shall be measured from Contract implementation and continue through the Contract Term. Multiple violations of any standards may lead to termination of the Contract.

Compliance Standards

696-IG-26-O012 Exhibit J.3

Identifier Compliance Standard Unacceptable Performance Measure Resolution Time Priority Payment

Adjustment C.5.B.2 Uptime Service Level Agreement (SLA) (99% availability) with minimal unplanned downtime.

Downtime exceeding 1% monthly threshold or repeated outages.

Immediate. Critical 10% invoice deduction.

C.5.C.4 System meets FBI CJIS Security Policy security requirements.

Non-compliance with CJIS Security Policy.

30 Working Days to achieve compliance.

Critical 10% deduction from invoice per compliance failure.

C.5.B.6 The Contractor shall ensure that the RMS provide user response times measured over one hour as determined by the OIG.

No more than three seconds 98% of the time for any transaction and no more than two seconds 90% of the time for any transaction.

Eight hours. High $500.00 per Day deduction from invoice until resolved.

C.5.D.3 Mobile apps or browser-based modules should function reliably on both major mobile operating systems for officers in the field.

Incompatibility or frequent crashes on iOS or Android platforms.

72 hours. Medium $500.00 per Day deduction from invoice until resolved.

C.8.A The Contractor shall meet with the OIG on a regular basis. Meetings shall provide a management-level review of the Contractor’s operations, assessment of services, discussion and resolution of problems, and coordination of the activities of all parties concerned.

Failure to meet at least quarterly or failure to provide meeting documentation.

10 Working Days to reschedule or submit documentation.

Medium 2% deduction from invoice per missed or undocumented meeting.

C.9.E The Contractor shall describe in detail any Disaster Recovery Plan in place. In the event of a database or central processor failure, the system shall retain all capabilities, restrictions, validations, and system integrity.

Failure to provide a current Disaster Recovery Plan or failure to restore system/data as specified.

Eight hours to provide plan;

Eight hours for full restoration.

High 5% deduction from invoice per incident.

C.9.2.G Acceptance testing shall not in any way relieve the Contractor of its responsibilities to correct any defect during the Contract Term.

System flaw severity is categorized by impact on the system's functionality or security, typically using levels like Critical, High, Moderate, and Low. Critical flaws block the entire system, while high-severity issues affect main functions.

Moderate flaws cause specific functions to misbehave but have workaround solutions, and low-severity issues have a minor impact or are cosmetic.

Failure to correct post-acceptance defects according to the defect severity level.

* Critical level defects - Eight hours from defect identification/reporting.

* High level defects - 24 hours from defect identification/reporting.

* Moderate level defects - Seven Days from defect identification/reporting.

* Low level defects - 30 Working Days from defect identification/reporting.

High 5% deduction from invoice per unresolved defect.

C.10.I Recovery Point Objective (RPO) for disaster recovery: The maximum acceptable data loss (how recent the last data backup can be) must be one hour.

Failure to restore complete, accurate, and consistent data older than one hour from the system failure time.

Eight hours. Critical 10% deduction from invoice per compliance failure.

Sheet1