2._EXHIBIT_A-_STATEMENT_OF_WORK__SOW__10.02.26.pdf

EXHIBIT A: STATEMENT OF WORK

1. INTRODUCTION

This Statement of Work (SOW) (hereinafter also referred to as “Agreement” or “Contract” is between the State Water Resources Control Board (hereinafter referred to as the “State Water Board,” “SWRCB,” "DDW," or the “State”) and the Contractor to create the Water Technical Access Portal (WaterTAP) solution. The Contractor agrees to provide fixed-rate deliverable-based services including Development, Design, Implementation (DD&I) of the WaterTAP solution and Maintenance and Operations (M&O) Services as described in this Statement of Work.

This engagement consists of services which must be completed in accordance with this Statement of Work. All services rendered under the Contract are based on fixed-rate deliverables. The Contractor is responsible for completing all deliverables, work products, and all services as detailed in the SOW at the costs provided in EXHIBIT E: COST WORKBOOK.

"Contractor" refers to the firm that shall provide the staffing to perform the services. "Consultant(s)" refers to the Contractor's staff who will perform the services. The terms "Contract" or “Agreement” will be used interchangeably throughout the documents.

2. BACKGROUND AND PURPOSE

The State Water Resources Control Board’s mission is to preserve, enhance, and restore the quality of California's water resources and drinking water for the protection of the environment, public health, and all beneficial uses, and to ensure proper water resource allocation and efficient use, for the benefit of present and future generations. To this end, the State Water Resources Control Board develops statewide permits, policies, and regulations to protect water quality, regulates drinking water, administers California’s water rights system, and supports Regional Water Quality Control Board efforts. In addition, the State Water Resources Control Board provides financial assistance in the form of grants and loans for projects that clean up and protect water quality and drinking water supplies, and that protect water resources. The State Water Resources Control Board works to advance several foundational values, including climate change resilience, environmental justice, and racial equity.

The Division of Drinking Water (DDW) has historically maintained several disparate tools and databases to help facilitate regulatory oversight. However, these tools are inadequate to streamline data intake, improve data quality, manage workflows, and ensure transparency of information as required. A new data management solution is needed to ensure ongoing, up-to-date compliance evaluations of the large

State of California Department of Technology

RFP 26-014-280

STATEMENT OF WORK

October 2, 2026 number of public water systems in California.

A secure system is needed to intake documentation, certifications, compliance forms, and data from public water systems; identify potential compliance issues; support staff and management through compliance evaluations, document generation, and recordkeeping; facilitate data-driven decision-making;

and provide automated data publication. DDW does not currently have a system that would allow public water systems to upload the required information for review and approval.

3. TERM OF CONTRACT

Effective upon approval of the California Department of Technology (CDT), Office of Statewide Technology Procurement (OSTP), and SWRCB, the base term of this Contract shall consist of three (3) years. During the first twenty-one (21) months of the base term, the Design, Development, and Implementation (DD&I) must be completed. Upon completion of system implementation, a three-month (3-month) system stabilization and full system acceptance period shall occur. Following system acceptance, the remaining twelve (12) months of the base term shall consist of Maintenance and Operations (M&O) services, which shall run concurrently with the system warranty period.

The State, at its sole discretion, may exercise its option to execute a one-year (1-year) extension for time-related work, to include implementation and full system acceptance. This time-only extension would be at the originally agreed-upon deliverable rates specified in this Contract and at no additional cost to the total Contract.

The State, at its sole discretion, may exercise its option to execute up to two (2) additional one-year (1-year) optional extensions to perform Maintenance and Operations (M&O) services for a maximum Contract term of six (6) years.

The State is not obligated to use any or all of these options. The Contract is of no effect unless approved by CDT and no work shall begin before full execution of the Contract.

The Contractor shall not be authorized to deliver goods or commence performance of services described in this Contract prior to the Effective Date of the Contract. Any delivery of goods or performance of services by the Contractor that is commenced prior to the Effective Date shall be at no cost to the State.

This Contract may be terminated in accordance with the provisions of the Information Technology General Provisions Cloud Computing Services DGS PD 402-ITGP Cloud (Revised and Effective 02/20/2025) - State of California. Notwithstanding any provision in this Contract, if the Contract is terminated by the State for convenience of the State, the termination can be made at the sole and exclusive discretion of the

State of California Department of Technology

RFP 26-014-280

STATEMENT OF WORK

State for any or no reason.

All services to be performed by the Contractor are at the agreed-upon deliverable rates in EXHIBIT E:

COST WORKBOOK specified in this Contract.

4. AMENDMENT

The Contract may be amended, consistent with the terms and conditions of the Contract, and by mutual consent of both parties, subject to approval by the California Department of Technology (CDT), Office of Statewide Technology Procurement (OSTP) under Public Contract Code (PCC) Section 12100.

No amendment or variation of the terms of this Contract shall be valid unless made in writing, signed by the parties, and approved by oversight agencies, if required. No oral understanding not incorporated in the Contract is binding on any of the parties.

5. LOCATION AND AVAILABILITY

Availability

The Contractor shall provide the services described in the Statement of Work (SOW) during normal State business hours, 7:00AM to 5:30PM PST Monday through Friday, excluding State holidays. However, the Contractor may be required to provide support beyond the normal business hours, as required to successfully provide contracted services. The Contractor will primarily perform work remotely but may be required to provide on-site support as needed based on operational requirements.

Location

All remote work must be performed within the continental United States. Remote access to the Department's network is only authorized for Department-issued or Department-approved computers, while using Department-provided or approved remote access to software and tools. The Contractor may not specify remote access solutions.

The Contractor may be required to travel to site locations at no cost to the State department for meetings or to perform tasks. The State will allow the Contractor to propose remote staff, based only in the continental United States. The State will provide collaboration tools (WebEx, MS Teams, SharePoint, etc.)

to facilitate remote work on Department-issued equipment.

Key Staff must be available to be on-site as needed at the state department's Sacramento headquarters, State of California Department of Technology

RFP 26-014-280

STATEMENT OF WORK

as determined by the State department's Project Manager, during normal state business hours (7:00 AM to 5:30 PM Pacific Time). The state department may consider other options for attendance, such as webinars, phone conferences, and video meetings. Meeting consideration will be at the State department’s sole discretion, under circumstances with advance notice of the Department Contract Manager. All Contractor staff shall have legal authority to work in the United States during the term of the entire Contract and consent to a background check.

State holidays are listed on the California Department of Human Resources (Cal HR) website in the link below, and are subject to change:

https://www.calhr.ca.gov/employees/Pages/state-holidays.aspx

Permanent offsite work arrangements are allowed under this Contract. The State department may consider accommodating temporary offsite work (e.g., remotely; at the resource's home) for extenuating circumstances (including, but not limited to, COVID-19 Stay at Home Order, illness, system outages, and natural disasters) which must receive prior approval by the State department.

Table 5-1: Work Locations

Location Name Location Address

State Water Resources Control Board 1001 I Street, Sacramento, CA 95814

6. CONTRACT REPRESENTATIVES

All notices required by, or relating to, this Contract shall be in writing and shall be sent to the contract parties at the email address below unless changed from time to time, in which event each party shall so notify the other in writing within ten (10) days of such change, and all such notices shall be deemed duly given if deposited, postage prepaid, in the United States mail or e-mailed and directed to the addresses then prevailing.

The WaterTAP contract representatives during the term of this contract will be:

Table 6-1: WaterTAP Contract Representatives

State of California Department of Technology

RFP 26-014-280

STATEMENT OF WORK

October 2, 2026 https://www.calhr.ca.gov/employees/Pages/state-holidays.aspx

WATERTAP CONTRACT REPRESENTATIVES

State Department: State Water Resources Control Board

Contractor: TBD

Name: Name:

Title: Title:

Telephone Number: Telephone Number:

E-mail Address: E-mail Address:

Direct all contract inquiries to:

Table 6-2: Contract Representatives for Inquiries

CONTRACT REPRESENTATIVES FOR INQUIRIES

State Department: State Water Resources Control Board

Contractor: TBD

Name: Name:

Title: Title:

Telephone Number: Telephone Number:

E-mail Address: E-mail Address:

All inquiries during the term of this Contract will be directed to the contract contacts listed above; the contract representatives may be changed by written notice without amending this Contract.

7. CONTRACTOR’S ROLES AND RESPONSIBILITIES

The Contractor shall be responsible for providing all design, development, configuration, testing, integration, coordinating, installation and implementation services, as stated in the Contract. The Contractor shall also be responsible for providing specifications for WaterTAP hardware, software, and services, as applicable. In addition, the Contractor shall be responsible for supporting all WaterTAP

State of California Department of Technology

RFP 26-014-280

STATEMENT OF WORK

components through the Base Contract Term, including M&O year 1 and any extensions exercised by SWRCB. Specific tasks and deliverables are described in SECTION 11. CONTRACTOR DELIVERABLES and key staff responsibilities are described in SECTION 10.2.4. KEY STAFF ROLES

AND RESPONSIBILITIES.

The Contractor shall be responsible for the successful performance of all contractor personnel, subcontractors, and support services. The Contractor must provide all staff necessary to meet the EXHIBIT C: FUNCTIONAL AND NON-FUNCTIONAL REQUIREMENTS as set forth in the Contract. At a minimum, the Contractor must provide the Key Staff identified by the State and the Key Staff must perform the responsibilities described. The Contractor shall audit their staff roster once a month and notify the State Contract Manager of any Contractor staff which are no longer assigned to the Project.

The Contractor shall act as the Prime Contractor under this Contract and provide the following:

1. All meetings shall be scheduled using Microsoft (MS) Outlook and be conducted via MS Teams or in person, as needed. All Contractor staff shall maintain their schedules of availability on their SWRCB MS Outlook calendars.

2. All electronic communication shall be conducted via email and/or MS Teams.

3. All work products and deliverables shall be stored in a State document repository. The most current version of all work products and deliverables shall always be continuously available for State review.

4. The Contractor shall comply with all applicable SWRCB, Department of General Services (DGS), Department of Finance (DOF), CDT, and other State and federal entities’ policies, procedures, and expectations, including but not limited to policies and procedures regarding Sexual Harassment Prevention, HIPAA, Privacy, IT Security, Workplace Violence Prevention, and Emergency Preparedness.

a. The Contractor shall comply with its responsibilities under California Government Code section 7405.

5. All Contractor's staff shall complete all standard SWRCB training (e.g. Security and Privacy Training, Harassment Prevention Training, etc.).

a. Within two (2) weeks of the commencement of this Contract, the Contractor shall complete said training and sign the State Water Board “Internet Usage Policy” consent form for all staffing resources dedicated to this Project.

b. The Contractor shall not bill the State for time spent completing the annual security training.

State of California Department of Technology

RFP 26-014-280

STATEMENT OF WORK

October 2, 2026 https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=GOV&sectionNum=7405.

6. The Contractor (data custodian) shall be responsible for all costs incurred by SWRCB (data owner) due to any and every security incident resulting from the Contractor’s failure to perform, negligent, or willful acts of its staff, which results in unauthorized disclosure, release, access, review, destruction, loss, theft, or misuse of an information asset. The Contractor shall notify SWRCB Contract Manager immediately by telephone call and email upon the discovery of a breach of security of personal information, sensitive information, or confidential information (PSCI) in computerized form if the PSCI was, or is reasonably believed to have been, acquired by an unauthorized person; or within two hours by email of the discovery of any suspected security incident, intrusion or unauthorized use or disclosure of PSCI in violation of this Contract, this provision, the law, or potential loss of confidential data affecting this Contract. If the State determines notice to the individual(s) whose data has been lost or breached is appropriate, the Contractor shall bear any and all costs associated with the notice or any mitigation selected by the State. These costs include, but are not limited to, consultant time, material costs, postage, media announcements, and other identifiable costs associated with the breach or loss of data. For the purposes of this Agreement, “Contractor-provided personnel” include the Contractor’s Subcontractors, consultants, and agents of each.

7. The Contractor shall comply with all applicable State policies including, but not limited to, State Administrative Manual 5300-5399, State Information Management Manual procedures, and SWRCB security practices including, but not limited to, its Acceptable Use Policy, Confidentiality and Non-Disclosure Policy (i.e., Conflict of Interest Form 700).

a. All Contractor Key Staff who will provide services pursuant to this Contract shall complete a Statement of Economic Interests, Form 700, within thirty (30) calendar days of commencing any work for the State Water Board.

b. All Contractor Key Staff shall thereafter file a Form 700 on an annual basis and shall also file a Leaving Office Form 700 within thirty (30) calendar days of ceasing to perform any work for the State Water Board.

c. In addition, upon beginning work for the State Water Board and every two (2) years thereafter, all Contractor Key Staff shall complete the State’s online Ethics Training Course, as maintained by the California Office of the Attorney General, and submit the certificate of completion to the State Water Board’s Filing Officer. The Contractor shall not bill the State for time spent completing Form 700 or the Ethics Training Course.

8. The Contractor represents that it has or shall secure at its own expense, all staff required to perform the services described in this Agreement. Such personnel shall not be employees of or have any contractual relationship with any California governmental entity.

9. The Contractor shall provide its own equipment necessary to perform the required duties. The

State of California Department of Technology

RFP 26-014-280

STATEMENT OF WORK

Contractor shall adhere to SWRCB policies and procedures, guidelines and templates, including access and security requirements.

10. The Contractor shall design, develop, implement, test, and support a solution within the Contract using an approach that aligns with the State’s Implementation Preferences stated in SECTION

9.3. SOLUTION REQUIREMENTS and that meets all requirements and functionality as defined in

EXHIBIT C: FUNCTIONAL AND NON-FUNCTIONAL REQUIREMENTS.

11. The Contractor shall provide all work products in Microsoft Office Suite formats. (For example, documents are in .docx, spreadsheets are in .xlsx, presentations are PowerPoint .pptx, Project plans are in Microsoft Project .mpp, flowcharts and diagrams in Visio .vsdx)

12. The Contractor shall perform the services required under this Agreement in a manner that will not disrupt the operational needs of the State.

13. The Contractor shall identify all required software licenses on the Software Licensing Program (SLP) including SLP Contract Number and License SKU for all SaaS licensing and related software and tools needed for development, implementation, data migration, ongoing access, support, and hosting of WaterTAP. For products not included within the SLP, the Contractor shall provide all details necessary to identify the specific products and license quantities supporting WaterTAP.

14. The Contractor shall procure, provide, install, and configure all software licenses and tools necessary for WaterTAP. This shall exclude workstations, peripherals, and State-managed network devices and be consistent with the State-approved System Architecture Description, unless otherwise agreed upon by the State.

15. The Contractor shall be responsible for all Contractor-supplied software until transition to the State is completed.

16. The Contractor shall be proficient in using all State-approved tools to perform the work under this Agreement. The Contractor shall not bill the State for time spent training its staff to use State-approved tools.

17. All Contractor-owned or managed laptops, Ultra books, netbooks, tablets, smartphones, and similar devices, if allowed by the State Contract Manager, shall be encrypted using commercial third-party encryption software. The encryption software shall meet the standards of National Institute of Standards and Technology (NIST), Federal Information Processing Standards (FIPS) Publication 140-2, Security Requirements for Cryptographic Modules. Additionally, antivirus and anti-malware software shall be used and kept up to date along with software patches and supported versions. In the event of a security incident, the Contractor shall assist the State Water Board Information Security Office with the forensic analysis of its devices.

18. The Contractor’s use of removable media storage devices (i.e., Universal Serial Bus [USB] thumb drives, disk tapes, micro-SD, SD cards, CD/DVD, etc.) is not allowed by the State Contract

State of California Department of Technology

RFP 26-014-280

STATEMENT OF WORK

Manager. Any personally identifiable information, personal health information, or other confidential information shall be encrypted when stored on State network file shares or document repositories.

Upon expiration of the Agreement, the Contractor shall stop using any state-provided software.

19. The Contractor shall notify the State Contract Manager, in writing, no later than one (1) calendar day after any of the following events:

a. The filing of a petition for relief under the United States Bankruptcy Code or the institution of any other insolvency proceedings by, against, or on behalf of the Contractor;

b. The appointment of a receiver or trustee for a Contractor;

c. The dissolution or liquidation of a Contractor;

d. The transfer to any person or entity of more than twenty-five percent (25%) of the assets or ownership interest of the Contractor. The Contractor became insolvent. A Contractor shall be deemed to be insolvent if it has ceased to pay or has admitted in writing its inability to pay its debts for at least sixty (60) days in the ordinary course of business or cannot pay its debts as they become due, whether a petition has been filed under the United States Bankruptcy Code; and/or;

e. The execution by the Contractor of a general assignment for the benefit of creditors.

20. Notwithstanding any other provision of this Contract, the State, by written notice to the Contractor, may immediately terminate this Contract upon the occurrence of the events set forth in SECTION

9.9. INFORMATION TECHNOLOGY — GENERAL PROVISIONS CLOUD - COMPUTING

SERVICES, EXHIBIT A: STATEMENT OF WORK and EXHIBIT G: SWRCB SPECIAL TERMS

AND CONDITIONS.

21. The Contractor shall regularly release new functionality in a structured and scheduled manner to the test environment.

22. The Contractor shall design data architectures and processes in WaterTAP to be compliant with State and federal water data standards, existing and expected as specified by the State (system is part of a new federal water data network). The State will work with the Contractor to define and approve the existing and expected data standards to be included via the creation of User Story acceptance criteria during backlog development.

23. The Contractor shall ensure that documentation and artifacts created during the implementation of the project are as useful as possible to other divisions within the Water Board that want to follow the same path (support enterprise development).

24. The Contractor shall consult with SWRCB staff to improve DevOps processes to support the future of WaterTAP.

25. The Contractor shall be responsible for its own operating and travel expenses, overhead, and clerical support.

State of California Department of Technology

RFP 26-014-280

STATEMENT OF WORK

26. Two (2) weeks prior to expiration of the Contract, the Contractor shall return all SWRCB property, including security badges, computing assets, and requested work products, to the SWRCB Contract Manager.

27. The Contractor shall work collaboratively with all other State-hired contractors.

8. STATE’S ROLES AND RESPONSIBILITIES

The State will be responsible for providing systems access and support, software, workspace, and other assets to ensure the smooth and effective operations of the project and project participants. As part of this requirement, the State will provide the following:

1. The State will provide access to State staff, information, resources, and applicable project documentation during normal business hours as approved and needed to facilitate the Contractor's completion of deliverables and tasks described herein.

2. If working onsite, the State will provide the Contractor with access to the work site during normal business hours, with a provision for increased access during critical project periods. Normal business hours are Monday through Friday (7:00 AM - 5:30 PM Pacific Time), excluding state holidays. These hours may be extended with prior State approval.

3. The State will provide the Contractor with physical access to workspace, as needed.

4. The State will provide access to the Microsoft (MS) Office 365 Professional software suite and any other applications as needed.

5. The State will continue to support its existing legacy systems during the Contract. See SECTION

9.4. STATE HOSTED ENVIRONMENT for more information.

6. The State will be responsible for the procurement of all server hardware, and all network and communication hardware for WaterTAP that are outside the scope of the Contractor's responsibilities.

7. The State will be responsible for all server and network patches, upgrades, and configurations.

8. The State will provide access to programming standards that the Contractor must employ during the development of the WaterTAP solution. The State Water Board’s Coding Standards document will be provided to the Contractor upon onboarding.

9. The State will perform the responsibilities as described in Table 8-1: State Roles and Responsibilities. The State will administer and maintain the Project Library for the deposit of Project deliverables and other documents. The Project Library will be maintained on Microsoft Teams or SharePoint for storing electronic documents.

10. The State will provide source control software to enable check-in, check-out, and version control of documents and system code.

11. The State will define specific requirements, timeframes, and priorities for Contractor tasks within

State of California Department of Technology

RFP 26-014-280

STATEMENT OF WORK

the Implementation Plan.

12. The State will provide project-based decisions in a timely manner.

13. The State will review and approve scope documents (e.g., Deliverable Expectation Document

(DED), Deliverable Acceptance Document (DAD), Work Order Authorization (WOA) and deliverables in compliance with contract timelines.

14. The State will assign a SWRCB Project Manager and a SWRCB Technical Lead to oversee the Contractor’s performance, completion of requested services, review of the Work Authorizations, deliverables, invoices, and other reports to SWRCB management on the status of the Contract.

15. The State will provide appropriate access to legacy systems, applications, documentation, and related information that WaterTAP is replacing.

16. The State will provide approval of all WaterTAP production changes prior to implementation, per SWRCB’s standard change management process. Refer to SECTION 10.5. CHANGE CONTROL PROCEDURES for additional information.

The SWRCB WaterTAP project team will be inclusive of Executive Sponsors, Project Director(s), Project Manager, Business Lead, Technical Lead(s), and a Contract Manager. This project team will provide participants with a clear understanding of the authority and responsibility necessary for the successful accomplishment of the WaterTAP project activities and enable the project team members to be held accountable for the effective performance of their assignments. A team member may have multiple project responsibilities.

Table 8-1: State Roles and Responsibilities

Project Role Project Responsibilities

State of California Department of Technology

RFP 26-014-280

STATEMENT OF WORK

State Water Board

Executive Sponsors

• Provide executive sponsorship and support for the Project.

• Establish Project goals and priorities.

• Support Project funding and resources, manage and address staffing and workload needs.

• Assume Project ownership of the WaterTAP solution upon Full System

Acceptance and Transition to the State.

• Serve as key business decision-maker of the Project and provide decision-making authority.

• Provide the highest level of project review, policy leadership, and oversight as needed.

• Review and approve significant changes to project scope, budget, or schedule.

• Remove barriers, resolve and mediate issues, issue resolution, and scope changes that cannot be resolved by the State Water Board’s Project Director.

• Participate in Data Executive Steering Committee (DESC) Meetings and other meetings as necessary.

• Inform/Engage control agencies and other stakeholders, as needed.

State of California Department of Technology

RFP 26-014-280

STATEMENT OF WORK

Board Project

Director

• Ensure overall success of the Project by providing the requisite functionality, business value, and meeting the State Water Board’s technical needs and environment.

• Communicate Project status to State Water Board’s Management and State Water Board’s Executive Sponsors as needed.

• Provide a centralized structure to coordinate and manage the Project, resources, activities, and communication using structured project management methodologies.

• Provide leadership to State staff assigned to manage Project teams.

• Determine if the WaterTAP solution addresses the Project and associated program objectives.

• Monitor Project charter, plan, and performance.

• Resolve technical impediments or blockers.

• Monitor the planning, execution, and control of activities necessary to support the WaterTAP solution.

• Participate in the identification, quantification, and mitigation of Project risks.

• Participate in DESC Meetings and other meetings as necessary.

• Act as liaison between the State Water Board and external stakeholders.

State of California Department of Technology

RFP 26-014-280

STATEMENT OF WORK

State Project Management Contractor

• Coordinate and oversee day-to-day Project activities with the Contractor and State Water Board’s Business Lead and serve as liaison to the Project teams.

• Conduct regular Project meetings to review Project status, performance indicators, changes, issues for resolution, bottlenecks, risk management activities, and assign and review action items for the Project team.

• Regularly communicate the Project status, issue status, and provide updates from the Contractor and Project team to the State Water Board’s Executive Sponsors and the State Water Board’s Project Director.

• Provide monthly and ad-hoc reporting to the State Water Board’s Executive Sponsors and the State Water Board’s Project Director regarding the following: deliverable status, Project work items, key performance schedule, bottlenecks, and resolution actions identified by the Project team and the Contractor.

• Develop, update, and execute Project management plans and other project management-related deliverables. Facilitate, assign, and monitor actions assigned to the State Water Board’s Special Projects Unit.

• Monitor the Contractor's performance to ensure compliance with the Agreement.

• Collaborate with the Contractor to maintain project management plans, institute governance controls, manage quality assurance to plans, schedules, deliverables, and participate in quality ad-hoc planning assurance and risk control.

• Collaborate with the Contractor to determine problems and issues, ensure changes are recorded, maintained, and tracked.

• Assist the State Water Board’s Project Director and State Water Board’s Business Lead in resolving or escalating significant issues related to project management, communication, staffing, and scope.

• Assist with coordinating and leading recurring DESC Meetings and other meetings as necessary.

• Act as the liaison for communications with the CDT.

State of California Department of Technology

RFP 26-014-280

STATEMENT OF WORK

Business Lead

• Manage the Product Vision and Product Roadmap.

• Manage and prioritize the Product Backlog.

• Ensure the Development Team understands the items in the Backlog.

• Make decisions on Sprint development, including defining the Definition of

Done for a Sprint and removing sprint impediments.

• Monitor and support the planning, execution, and control of program activities necessary to support the WaterTAP solution.

• Determine and facilitate active and timely participation of business resources, including SME's (Subject-Matter Experts) and staff to participate in User Acceptance Testing.

• Manage scheduling, accountability, and transparency.

• Assist in resolving or escalating issues related to project management, communication, staffing, and scope.

• Provide guidance to the State Water Board’s Project Manager and the State

Water Board’s Contract Manager.

• Identify and monitor the changes and impacts on existing and potentially new policies, standards, and procedures related to business needs.

• Manage stakeholder expectations and work with stakeholders through proper channels.

• Act as liaison between the State Water Board and its external stakeholders, manage the relationship with Advisory Groups.

• Participate in DESC Meetings and other meetings as necessary.

State of California Department of Technology

RFP 26-014-280

STATEMENT OF WORK

Technical Lead(s)

• Manage the technical direction and vision for the WaterTAP solution.

• Coordinate the State Water Board’s Infrastructure Team activities to determine whether Project infrastructure and infrastructure services are planned, acquired, and made available as needed in collaboration with the Contractor.

• Report to the State Water Board’s Project Manager the status of the State Water Board’s Infrastructure Team deliverables, performance indicators, bottlenecks, and bottleneck resolution actions.

• Coordinate the configuration of technical environments.

• Ensure compliance with development and engineering standards.

• Resolve technical impediments or blockers.

• Coordinate resolution of policy, standards, and procedural issues related to business needs.

• Manage the release process.

• Participate in meetings as necessary.

State Water Board Training

Lead(s)

• Translates DDW needs and staff capabilities.

• Advises all training and knowledge transfer planning, training materials and delivery for both internal and external users.

• Reviews the master training plan and the overall training approach and verifies methodology for end user and technical training.

• Confirms the training schedule prior to each release.

• Coordinates with the State OCM Team.

• Finalizes all training supporting material generation, including training guides, Frequently Asked Questions (FAQs), training surveys, etc. and supports the methods of distribution of said materials.

• Reviews analytics from training surveys and collaborates on any course corrections needed.

• Works in collaboration with the OCM team.

State of California Department of Technology

RFP 26-014-280

STATEMENT OF WORK

Contract Manager

• Provide oversight and tracking of the Contract and other project-related contracts.

• Participate in procurement activities and processes related to the Contract.

• Monitor the Agreement to confirm compliance with the provisions, including

SLA's.

• Maintain and manage contract documentation, change requests, and amendments.

• Determine whether products and services are in accordance with the contract, State Water Board standards, and the Project Schedule.

• Escalate issues and concerns to the State Water Board’s Project Manager.

• Track, review, and approve WOAs, DEDs, DADs, detailed specifications and design, and Project deliverables created by the Contractor.

• Process WOAs, purchase orders, invoices, and payments.

• Confirm invoices reflect costs incurred to-date in the performance of the

Contract and that costs are within applicable restrictions.

• Maintain information on contracted costs versus actual costs.

• Responsible for all interactions with the Contractors in the event of a contract or invoice dispute.

• Act as the liaison with CDT.

State of California Department of Technology

RFP 26-014-280

STATEMENT OF WORK

Organizational Change

Management Team

• Work with stakeholders to determine communication between end-users, stakeholders, and Project teams.

• Identify and monitor the changes and impacts on existing and potentially new policies, standards, and procedures related to business needs.

• Support the creation of an organizational change management deployment plan.

• Provide input and validate documentation related to business needs, assessments, and evaluations.

• Provide input into the design and development of the WaterTAP solution.

• Facilitate the definition of current and future data elements, data relationships, and data definitions.

• Participate in integration, system, and UAT.

• Facilitate data cleansing and data conversion activities between the

Contractor and State Water Board’s data owners of legacy systems to be converted.

• Provide input to Project risk and issue efforts, and resolve the issues as assigned.

• Coordinate resolution of policy, standards, and procedural issues related to business needs.

• Participate in Organizational Change Management-related discussions and working sessions with the Project team, the OCM team, and the Contractor.

• Work with the Contractor and the OCM team to implement an organizational change management program.

• Participate in user training as an integrated component of OCM and post-implementation activities, including knowledge transfer.

• Report on the status of team deliverables, team performance indicators, bottlenecks, and bottleneck resolution actions.

• Provide governance of initiatives above.

State of California Department of Technology

RFP 26-014-280

STATEMENT OF WORK

Infrastructure Team

• Assist the Project team as needed, including during planning, analysis, and development activities.

• Participate in technical architecture design with the Contractor.

• Coordinate implementation of technical architecture required for the

WaterTAP solution.

• Coordinate and oversee the setup and operation of the technical environment for the WaterTAP solution.

• Oversee the configuration of the technical environments.

• Report to the State Water Board’s Technical Lead regarding the status of team deliverables, team performance indicators, bottlenecks, and bottleneck resolution actions, including the following:

• Unit, system, and integration tested network layer,

• Support operational Project environment infrastructures (servers, networks, software, etc.),

• Confirm technical architecture meets State and State Water Board’s standards, where applicable, and

• Participate in meetings as necessary.

California Department of

Technology

(CDT)

• Approve agreements and agreement amendments for reportable information technology projects that exceed the Water Board’s delegated authority.

• Provide support and advice regarding project management activities and system development lifecycle best practices.

• Provide monthly project assessment to DESC and other executive stakeholders.

• Identify project risks and mitigation strategies.

• Procure the Independent Verification and Validation (IV&V) ancillary procurement that is related to this Agreement.

Independent Verification &Validation

(IV&V)

Contractor

• Develop IV&V monthly activity reports;

• Conduct risk and issue list reviews;

• Perform traceability matrix analysis;

• Perform system requirements evaluation;

• Develop IV&V task reports.

9. DESCRIPTION OF NEW SYSTEM OR SERVICES

State of California Department of Technology

RFP 26-014-280

STATEMENT OF WORK

9.1. DESCRIPTION OF PROPOSED SOLUTION

SWRCB is seeking Salesforce as a cloud-based SaaS solution (WaterTAP) that will be an enterprise-level application, developed to address current and future information and business needs. It will include an overarching architecture to connect existing foundational data systems as well as integrate new data systems from disparate spreadsheets to databases currently used, into a single, cohesive system to streamline information access for internal staff and external stakeholders. It will also include data and document submission, workflow routing, and compliance decision support.

EXHIBIT H: DATA CONNECTIONS discusses the SWRCB expectations for existing applications with respect to WaterTAP. Specifically:

The following applications are within the proposed WaterTAP scope. The applications with an asterisk (*) are expected to sunset once all critical functionality has been incorporated into WaterTAP. Depending upon feasibility, this may not occur until after WaterTAP rollout for some of these applications. The applications without asterisks are expected to continue to exist, either as a standalone application that WaterTAP utilizes data from (CLIP) or be integrated into WaterTAP where the user experience is seamless (OnBase ECM and SAFER – Clearinghouse.)

• SDWIS – Safe Drinking Water Information System*

• CLIP – California Laboratory Intake Portal

• SABL – System Area Boundary Layer*

• OnBase ECM – Enterprise Content Management

• eAR – electronic Annual Report*

• SAFER – Clearinghouse

• WQM – Water Quality Management*

• CDSS – Child Care Lead*

Critical functionality associated with the following applications is expected to be included in WaterTAP in the future. While it is the expectation that WaterTAP will be scalable to connect to them in the future, these applications are not included in the current scope.

• ELAP – Environmental Laboratory Accreditation Program

• OPCERT – Operator Certification (DWOCIS)

• RTCR – Electronic Coliform Reporting

The following applications are sunsetting immediately at WaterTAP rollout, with all critical functionality incorporated into the solution prior to Final System Acceptance.

State of California Department of Technology

RFP 26-014-280

STATEMENT OF WORK

• LSLI – Lead Service Line Inventory

• WQIR – Water Quality Information Report

The WaterTAP Project is detailed in SECTION 10. SCOPE OF SERVICES .

WaterTAP shall replace the legacy systems with a configurable, cloud-based SaaS aiming to minimize customization.

The Contractor shall meet the EXHIBIT C: FUNCTIONAL AND NON-FUNCTIONAL REQUIREMENTS to support the following users of WaterTAP:

• SWRCB estimates a total of ~65,000 total active users who will need to be able to log in and report.

• SWRCB estimates a total of ~7,200* Water System Administrators will need to be able to log in at the launch of WaterTAP, associate other users' accounts with their Public Water System (PWS)(s), submit/modify documents and data, and attest to submissions that are created either by them or other users associated with their PWS(s).

• SWRCB estimates a total of ~35,000* external user accounts that will need to be able to log in within the first eighteen (18) months of the launch of WaterTAP, associate their profile with one or multiple PWS's, and prepare submissions.

• SWRCB estimates a total of ~550* internal users that need to be able to log in and save progress at the launch of WaterTAP to the staff part of WaterTAP.

• SWRCB estimates a total of ~300* internal users who need to be able to log in with read-only permissions within 12 months of the launch of WaterTAP.

• SWRCB estimates a total of ~20* System Administrators who will need to be able to manage and administer WaterTAP and its associated functionality (e.g., configurations, workflows, etc.).

• SWRCB estimates a total of ~400* users (Labs) to submit requests via WaterTAP for routing and response.

NOTE: All user counts denoted with an asterisk (*) are included in the "total active users" described above.

Figure 9-1: WaterTAP Conceptual Architecture

State of California Department of Technology

RFP 26-014-280

STATEMENT OF WORK

WaterTAP Conceptual Architecture

In summary, WaterTAP will be a cloud-based SaaS solution that will replace legacy systems and create new functionalities. This includes meeting system requirements defined in the remainder of EXHIBIT A:

STATEMENT OF WORK.

9.2. DATA SECURITY

The Contractor shall be responsible for maintaining a secure computing environment supporting the hosted application. The Contractor must manage the applications, WaterTAP data, and infrastructure according to the security requirements described in the Cloud Computing Services General Provisions, including but not limited to SECTION 9.2.2. SECURITY.

Throughout the term of the agreement, the Contractor shall comply with the State’s special provisions for data security, data handling, and data ownership. Refer to applicable provisions within SECTION 9.2.2.

SECURITY.

State of California Department of Technology

RFP 26-014-280

STATEMENT OF WORK

The Contractor certifies to SWRCB that it has complied with all applicable industry standards and guidelines, including, but not limited to those referenced in this Contract and relevant security provisions of the California State Administrative Manual (SAM), California Statewide Information Management Manual (SIMM), the National Institute of Standards and Technology (NIST) 800-53 v5 and Federal Information Processing Standard (FIPS) Publication 199 which protect and minimize risk to the State.

The Contractor shall accept responsibility for Data Breaches as provided in the Information Technology - General Provisions - Cloud - Computing Services, DGS PD 402-ITGP Cloud (Revised and Effective 2/20/ 2025), Section 21: Data Protection Provisions, Section 21.11 Data Breach, is responsible for the confidentiality, integrity, and availability of the data under its control. The Contractor shall implement and maintain all appropriate administrative, physical, technical, and procedural safeguards at all times during the term of the Contract to secure such data from data breach or loss, protect the data and information assets from breaches, introduction of viruses, disabling of devices, malware and other forms of malicious or inadvertent acts that can disrupt the State’s access to its data or affects the integrity of that data.

Please refer to Information Security and Privacy Provisions in SECTION 9.2.2. SECURITY.

The Contractor shall maintain all data containing personal information in compliance with Chapter 1 of Title 1.8 of Part 4 of Division 3 of the California Civil Code (Information Practices Act of 1977).

The Contractor shall comply with statewide policies and laws regarding the use and protection of information assets and data. Unauthorized use of data by the contractor or third parties is prohibited.

The Contractor shall have all Contractor personnel: Key Staff, Non-Key Staff, and Subcontractors sign a SWRCB-provided Confidentiality Statement for the term of this Contract.

The Contractor shall help coordinate, with SWRCB and applicable third parties, the necessary security patches, updates, and upgrades that will enable SWRCB to keep its virus protection software up to date on applicable information assets (including but not limited to software, code, servers, and other storage devices, as well as data in transit) on which data may be stored, processed, or transmitted.

The Contractor shall notify the SWRCB Information Security Office via email (iso@waterboards.ca.gov) immediately, if a security incident involving the information asset occurs.

The State shall have the right to participate in the investigation of a security incident involving its data or conduct its own independent investigation. The Contractor shall allow the State complete access to security logs, latency statistics, and other related security data that affects this Contract and the State’s data, at no cost to the State.

State of California Department of Technology

RFP 26-014-280

STATEMENT OF WORK

Additional security and data protection requirements:

1. The Contractor shall be responsible for the implementation, assessment, and monitoring processes that shall be put in place prior to releases.

2. The Contractor shall develop system security controls using the NIST 800-37 Risk Management Framework.

3. The Contractor shall assist the Water Board Information Security Office in the completion of a System Security Plan that includes moderate level NIST 800-53, and is compliant with SIMM 22 COTS/SaaS Acquisition, SIMM 5315-B Cloud Security Standard, and EXHIBIT F: SWRCB IT

SECURITY POLICIES.

4. The Contractor shall update the System Security Plan during each Product Increment and Release, and as needed.

5. The Contractor shall work with the State to establish a specific timetable for conducting risk analysis when the State determines a significant change to the System’s physical security, hardware or operating system software occurs as described in the System Security Plan and in accordance with the Project Schedule.

6. The Contractor shall conduct security and access management activities across all environments that are related to requesting access, verification, providing rights (user provisioning), monitoring identity status, logging, tracking access, and removing and restricting rights identified in the System Security Plan.

7. The Contractor shall develop and deliver a Security Incident Report (SIR) whenever the conditions for reporting a security incident are met as described in the System Security Plan.

8. The Contractor shall actively monitor WaterTAP using comprehensive third-party malicious code protection mechanisms at information asset entry and exit points, including but not limited to:

Intrusion Prevention System (IPS), endpoint defense, Security Event Information Management, and log correlation services per the State Administrative Manual (SAM) 5355 and 5355.1.

9. The Contractor shall develop the Security Acceptance Test Description (SATD) which documents the approach for security testing. Security testing shall include verification that security infrastructure requirements have been met, external and internal vulnerability assessment, penetration testing, and web services vulnerability testing.

10. The Contractor shall develop the Security Acceptance Test Report (SATR) which documents the expected and actual results of the security testing and is used in the determination of operational readiness.

11. The Contractor shall plan and conduct all WaterTAP access management activities consistent with the State Water Board’s Information Security and Privacy Policies.

12. The Contractor shall hire an independent third-party specialist security firm to conduct application

State of California Department of Technology

RFP 26-014-280

STATEMENT OF WORK

security assessments prior to Full System Acceptance of WaterTAP. The assessment shall be provided by the third-party specialist security firm directly to the State.

13. The Contractor shall practice secure coding standards such as the Open Web Application Security Project (OWASP) top 10 (https://owasp.org/www-project-top-ten/) and comply with EXHIBIT F:

SWRCB IT SECURITY POLICIES.

14. The Contractor will partner with the DIT Information Security Office and the DIT Application Development Unit to complete a risk assessment prior to Full System Acceptance, of the Software Development Life Cycle (SDLC) using the OWASP Testing Guide (https://owasp.org/www-project-web-security-testing-guide/) to ensure WaterTAP is secure and fully tested.

9.2.1. DATA HANDLING AND OWNERSHIP

Data…