2. Multi-Year DOB APLD Contract FINAL CORRECTED 04302026~1.docx

The Parties to this contract are the State of Illinois acting through the Illinois Department of Financial and Professional Regulation (“IDFPR” or “Agency”) undersigned Agency (the State of Illinois and the Agency are collectively the “State”) and the Vendor. This contract, consisting of the signature page and numbered sections listed below and any attachments referenced in this contract, constitute the entire contract between the Parties concerning the subject matter of the contract, and in signing the contract, the Vendor affirms that the Certifications and Financial Disclosures and Conflicts of Interest attached hereto are true and accurate as of the date of the Vendor’s execution of the contract. This contract supersedes all prior proposals, contracts and understandings between the Parties concerning the subject matter of the contract. This contract can be signed in multiple counterparts upon agreement of the Parties.

Contract includes BidBuy Purchase Order? (The Agency answers this question prior to Contract filing.)

☐ Yes ☐ No Contract uses Illinois Procurement Gateway Certifications and Disclosures?

☐ Yes (IPG Certifications and Disclosures including IPG Active Registered Vendor Disclosure (formerly named Forms B)) ☐ No

1. DESCRIPTION OF SUPPLIES AND SERVICES

2. PRICING

3. TERM AND TERMINATION

4. STANDARD BUSINESS TERMS AND CONDITIONS

5. SUPPLEMENTAL PROVISIONS

6. STANDARD ILLINOIS CERTIFICATIONS

7. FINANCIAL DISCLOSURES AND CONFLICTS OF INTEREST (IF APPLICABLE)

8. CONTRACT SPECIFIC CERTIFICATIONS AND DISCLOSURES – “IPG Active Registered Vendor Disclosure (formerly called FORMS B)” (IF APPLICABLE)

9. PURCHASE ORDER FROM BIDBUY (IF APPLICABLE)

In consideration of the mutual covenants and agreements contained in this Contract, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree to the terms and conditions set forth herein and have caused this Contract to be executed by their duly authorized representatives on the dates shown on the following CONTRACT SIGNATURES page.

STATE OF ILLINOIS

INFORMATION AND TECHNOLOGY CONTRACT

Illinois Department of Financial and Professional Regulation Multi-Year DOB Anti-Predatory Lending Database IFB BidBuy Bid Number 26-440DFR-BANKI-B-50508

State of Illinois Chief Procurement Office for General Services Information and Technology Contract V.26.1

VENDOR

Email: Click here to enter text.

Date:

STATE OF ILLINOIS

Email: FPR.Procurement@illinois.gov

Printed Name: Mario Treto, Jr.

Official’s Title: Secretary.

Legal Printed Name: Louis A. Klapp.

Legal’s Title: General Counsel.

Fiscal’s Printed Name: Gloria Gibson

Fiscal’s Title: Chief Financial Officer

State of Illinois IFB Contract: Description of Supplies and Services V. 14.1

AGENCY USE ONLY NOT PART OF CONTRACTUAL PROVISIONS

· Agency Reference #: R-276538

· Project Title: Multi-Year DOB Anti-Predatory Lending Database IFB

· Contract #: 27 DOB

· Procurement Method (IFB, RFP, Small Purchase, etc.): IFB

· BidBuy / Bulletin Reference #: B-50508

· BidBuy / Bulletin Publication Date:

· Award Code: A

· Subcontractor Utilization? |_| Yes |_|No Subcontractor Disclosure? |_| Yes |_|No

· Funding Source:

· Obligation #:

· Other Preferences?

State of Illinois Chief Procurement Office for General Services Information and Technology Contract V.26.1

1. DESCRIPTION OF SUPPLIES AND SERVICES

1.1. GOAL: The Illinois Department of Financial and Professional Regulation’s (“IDFPR”) Division of Banking (“DOB”) is executing a contract with Click here to enter text (“Vendor”) for the administration, maintenance, and support of the statutorily required Anti-Predatory Lending Database (“APLD”). Public Act (“PA”) 94-280 amended the Residential Real Property Disclosure Act, (765 ILCS 77) (“Act”) and originally established the Predatory Lending Database Pilot Program for designated areas of Cook County. The Act required IDFPR to create, maintain, and administer a database created under this program herein referred to as the APLD. The Act was later amended to expand the program to Kane, Peoria, and Will Counties.

The APLD must allow brokers, originators, housing counselors, title insurance companies, and closing agents (“public users”) to enter borrower application and closing information through a secure online solution, as specified by the Act and IDFPR’s administrative rules. The Act requires IDFPR to determine whether housing counseling is recommended for the applicant-borrower based upon statutory standards.

The Vendor shall provide a hosted/cloud, managed, standard cloud-based enterprise technology solution, business processes, and support for the APLD in order to track residential mortgage loan transactions that are initiated by licensed loan originators or mortgage brokers in Cook, Kane, Peoria and Will counties, through the closing of the real estate sale or refinancing. The Vendor shall ensure the APLD fully complies with all statutory requirements of the Act along with all requirements and deliverables of this contract.

Current estimated database size: 95.5 GB

APLD ACTIVE USER REPORT

# of Loans Entered into APLD (April 2025 through September 2025)*

*These quantities fluctuate based on consumers’ interest in applying for new mortgages in the program’s counties. The six-month period from October 2020 through March 2021 had 153,497 total loans with loan data entered by brokers and originators, which was 111% higher than the April 2025 through September 2025 total.

Lis Pendens Foreclosure Notices Filed

Current APLD site: https://www.ilapld.com/

IDFPR’s APLD News & Report site: IDFPR | Anti-Predatory Lending Database

1.2. SUPPLIES AND/OR SERVICES REQUIRED: This contract contains all requested solution criteria, including minimum technology, business process, and support requirements. Section 6 of this contract includes several attachments which are incorporated into this contract. To the extent a conflict may exist between this State contract and any other document relating to this subject matter, including but not limited to the attachments referenced in this contract, the contract shall prevail.

1.2.1. Technology: Vendor shall design the APLD based on the following design requirements itemized below. Additionally, Vendor shall comply with the requirements of Attachment 6.4 State Cloud Appendix as a condition of this contract.

1.2.1.1 Cloud Based & W3C Compliant: The APLD shall be a cloud-based, software-as-a-service (SaaS) solution that is accessible through a secure, online login page. The APLD shall be web services-compliant, built with HTML and CSS code that is fully compliant with the standards set by the World Wide Web Consortium (“W3C”). All users must use the APLD’s W3C-compliant Web Access Layer to request secure authorization to use the APLD.

1.2.1.2 APLD Availability: Vendor shall guarantee a minimum of 99.97% service uptime for the APLD. Vendor shall make the APLD accessible in real time, 24 hours a day, 7 days a week (except for pre-approved maintenance windows), via internet browsers such as Mozilla Firefox, Google Chrome, Microsoft Edge, and Safari, on Mac and Windows/PC, and via mobile devices, such as tablets and cellular phones, that have internet access. Users shall not need to install or download software to use the APLD. Scheduled maintenance must be performed between the hours of 2:00 a.m. Central Time and 6:00 a.m. Central Time on any day. Vendor must publish a notice of scheduled maintenance at least 48 hours in advance via the APLD website. The notice of scheduled maintenance must be reviewed and approved by IDFPR prior to the 48 hours advanced notice.

1.2.1.3 Environments: The Vendor shall employ separate environments for: 1. Development; 2. Testing; and 3. Production. All environments shall be provisioned together.

1.1. Development Environment: The development environment is the only environment in which configurations are made. The development environment is only available to the Vendor.

1.2. Testing Environment: The testing environment is used to train state users on the APLD and is where the APLD configurations are set and tested prior to them being approved and transferred to the production environment before go-live. The testing environment can be used to test potential configuration changes and new APLD functionality before release to the production environment. Upon the States request, the testing environment shall be made available to the State, for early access, testing, configuration, and training. The testing environment shall match the production environment and will be updated when the Vendor releases updates or new configurations and enhancements to the APLD.

1.3. Production Environment: This environment is utilized by all users to record all data entered and actions executed to comply with the mandates of the Act along with satisfying the requirements and deliverables of this contract. State users will utilize this environment to access any data (archived or live) for reporting purposes. This environment is configured based on the State’s regulatory and technology requirements and is maintained to the most current version of the APLD platform.

1.2.1.4 Continuous Service: IDFPR and its users (including without limitation, public users) may use and otherwise fully exploit the APLD in accordance with the terms of this contract, and Vendor represents and warrants that it owns or has acquired, and Vendor hereby grants to IDFPR and its users, all necessary licenses, permissions, or other authorizations for IDFPR and its users to do so.

1.1. The Vendor shall ensure that the APLD is fully functioning and available to the State and its users where at least 95% of normal transactions (i.e., excluding long-running transactions) take 3 seconds or less, calculated monthly.

1.2. Long-running transactions refer to APLD operations where the user controls the amount of data being requested or modified, often with minimal or no constraints imposed by the APLD, as determined by the State. Long-running transactions are tasks that include, but are not limited to, uploading or downloading large CSV files, executing actions within the user interface, or generating complex reports – where the data being processed or retrieved can be vast or interconnected – leading to extended execution times.

1.3. In the event that the Vendor files for bankruptcy, ceases business operations in a disruptive manner, or otherwise undergoes a business disruption that prevents the State or its users from accessing, using, or otherwise receiving the full benefit of the APLD under this contract, the State may take control of the APLD as necessary to ensure its uninterrupted and undiminished access and use, and Vendor grants to the State all licenses, assignments, and other rights necessary for the State to do so.

1.2.1.5 Scalable: The APLD shall be capable of expansion to scale program growth and usage fluctuation in order to accommodate changes due to consumers’ interest along with administrative, executive, legislative, or judicial mandates that impact the program. APLD scalability shall come at no cost to IDFPR.

1.2.1.6 Highly Flexible & Adaptable: The APLD shall be highly flexible and adaptable. Vendor shall ensure the APLD meets all applicable statutory mandates and regulations, at the direction of IDFPR. Vendor will periodically review the State’s statutes and regulations to identify any necessary changes, which shall be configured and implemented upon IDFPR’s approval and at no cost to IDFPR.

1.2.1.7 Modification: If IDFPR requests any material modification to the APLD that falls outside the scope of this Contract and its attachments, the Vendor shall submit a system modification Statement of Work (“SOW”) to IDFPR for review and approval. The SOW shall include, at a minimum, the purpose, detailed scope, required resources, timeline, milestones, deliverables, acceptance criteria, assumptions, dependencies, roles and responsibilities, impacts to services, SLAs, and support requirements and deliverables, as well as the approach for development, testing, reporting, escalation, and documentation.

1.1. No Modification shall be developed or implemented without prior written approval from IDFPR.

1.2. Modification costs shall be based on the mutually agreed upon hours documented in the approved SOW and the applicable Blended Hourly Rate, listed in the Items Tab in the BidBuy Purchase Order.

1.2.1.8 ADA Compliance and Accessibility: With configuration, the APLD shall accommodate diverse populations of users, including those with disabilities as defined by the Americans with Disabilities Act (ADA), as may be amended; the Americans with Disabilities Act Amendments Act (ADAAA), as may be amended; limited English proficiency as defined in Section 504 of the Rehabilitation Act of 1973, as may be amended; or as defined by the Illinois Information Technology Accessibility Act (30 ILCS 587 et seq.).

1.2.1.9 ADA Policy Compliance and Training: Vendor acknowledges that IDFPR has a written policy for assisting individuals with disabilities who are members of the public or receive aid, benefits, or services from IDFPR (“ADA Policy”) and an associated training for employees who are reasonably expected to interact with the public on IDFPR’s behalf (“ADA Training”). Vendor shall follow the ADA Policy for the services it provides to IDFPR under this contract, including without limitation by ensuring that Vendor’s employees follow the ADA Policy when delivering such services. Vendor shall ensure that Vendor’s employees who deliver services to IDFPR under this contract take the training within 60 days of the effective date of this Contract.

1.2.1.10 Additional Compliance: In addition to ADA compliance listed in 1.2.1.7 of this contract and the State Cloud Appendix in Attachment 6.4 of this contract, Vendor and the APLD must comply with all applicable laws including, but not limited to, all Federal and State laws, rules and regulations regarding the security and privacy of data and records, including protected health information, which includes, but is not limited to the Health Insurance Portability and Accountability Act (HIPAA), the Health Information Technology (HITech), the Social Security Act, the Code of Federal Regulations at 45 CFR 95, 160, 162, and 164, the Illinois Personal Information Protection Act (815 ILCS 530), and the security and privacy standards contained in Pub. L. 104-191 as amended or recodified from time to time.

1.2.1.11 Integrations and Interfaces: The APLD shall have the capability to integrate and interface with other State information technology (“IT”) solutions, as required by the State. Vendor shall provide a flexible APLD that allows IDFPR to modify, enhance, and allow additional integrations and interfaces at no additional cost to the State. This includes, but is not limited to, configuration changes, Application Program Interface (“API”) integrations, and interface customizations necessary to meet and maintain compliance of the Act and meet the evolving regulatory and operational requirements of the program and this contract.

1.1. Known Integration - Multi-Factor Authentication: Vendor shall integrate with the State’s multi-factor authentication (“MFA”) solution to control secure user access to the APLD. All State user authentication shall be supported by the State’s identity and access management solution.

1.2. Known Interface – IDFPR Regulatory System: Vendor shall interface with IDFPR’s regulatory system (e.g., CORE) and other solutions identified and deemed necessary by IDFPR at any time during the term of this contract and its subsequent renewal terms.

1.2.1.12 Major System Functionalities: The APLD shall include the following major functionalities, described in greater detail below:

1.1. User Access: The APLD shall have and maintain user access controls during the life of the contract. The APLD shall provide a report or list of users, roles, and access types. The Vendor shall provide APLD user role definitions immediately following the execution of this contract. Vendor shall provide IDFPR any supplementary user access information upon request to ensure state audit compliance and controls are met and maintained. The APLD shall be capable of two user types:

1. State Users: The APLD shall integrate with the state’s MFA solution. Shall be able to establish differing views dependent on the state user’s duties and the functions they need to execute in the APLD. For example, a “State User Administrator” can navigate to all areas of the APLD and be able to edit inputs, data fields, pull archive data for comprehensive reports, modify users, etc. and a “State User Representative” is more limited in their navigation, can’t edit, and can only pull recent data for reporting. The Vendor and IDFPR shall collaborate to establish, document, and define the State User, their capabilities, and how to properly manage and maintain users during the life of the contract.

2. Public Users: The APLD shall integrate with the state’s MFA solution. APLD shall be able to establish a single view for each user dependent on the company and the input requirements within the APLD. The Vendor and IDFPR shall collaborate to establish, document, and define the Public User, their capabilities, and how to properly manage and maintain the users during the life of the contract.

1.2. Notifications: The APLD shall have notification capabilities. The notifications shall be within the APLD, such as flags or banners, along with providing email notice to the identified users when a notification is required. Vendor and IDFPR shall collaborate to establish, document, and define a notification matrix to determine what actions require a notification, the type of notification, the timing and interval of the notification, and how to resolve the notification to complete actions.

1.3. Audit Log/Trail: The APLD shall track all activities executed within the APLD. The activities shall be tracked with a timestamp of the activity and the user who executed the activity, including but not limited to IP address, user account ID, date/time stamp, event source, device/browser information, the outcome of an event (success or failure), and any other supplemental information related to the event in accordance with IDFPR’s needs. The APLD shall allow IDFPR to access the audit log/trail of all activities in the APLD at any given time.

1.4. Reporting: The APLD shall have a robust reporting function that provides IDFPR with canned and manual reports available in near-real-time, viewable and exportable in a non-proprietary format (e.g., Microsoft Excel, CSV, Adobe PDF). Refer to section 1.3.1 of this contract for Reporting deliverables.

1.5. Training: Vendor shall provide training resources for all users of the APLD before it launches, prior to any updates to the APLD, and on an ongoing, as-needed basis. Training shall be unlimited and offered at no additional cost to users and include, at minimum, process flows, course descriptions, competency testing, training materials, and other educational/collaboration resources. The APLD shall include a training environment that is maintained and updated to match the production environment. The Vendor’s training resources shall be based in the continental United States.

The Vendor shall submit a Training Plan which conforms to the requirements of this contract for IDFPR’s approval prior to conducting any training with users.

1. For state users, Vendor resources shall establish a Train the Trainer program for state users. This program shall give state users the capabilities to navigate, use, and administer the APLD independently and correctly. Vendor shall also provide documents (manuals, maps, guides, FAQs, etc.) to assist state users in their continued independent and correct use of the APLD.

2. For public users, Vendor resources shall provide training materials for public users prior to their initial use of the APLD. These resources shall give public users the capabilities to navigate and use the APLD independently and correctly. Vendor shall also provide documents (manuals, maps, guides, FAQs, etc.) to assist public users in their continued independent and correct use of the APLD.

3. Any work product generated from the Train the Trainer program, documents, or materials shall be delivered to IDFPR in a non-proprietary format, shall not contain any proprietary information, and enable IDFPR to own, maintain, and manage any of the delivered work product during the life of the contract.

1.2.1.13 Security: Vendor shall ensure that the APLD prevents unauthorized third parties from accessing any data in or otherwise managed by the APLD. The Vendor shall ensure that the APLD prevents authorized users from accessing any data to which such users lack access rights. The Vendor shall adhere to the State Cloud Appendix of Attachment 6.4 of this contract. The Vendor shall also comply with the below provisions:

1.1. Security Approach: The APLD shall utilize the latest industry best practices (NIST, SANS, and SOC 2 Trust Service Criteria) and comply with federal security standards for security categorization (FIPS 199). The APLD shall protect the confidentiality of data and protection of proprietary software/data, and controls for developing a secure and resilient federal information system (NIST 800-53).

1.2. Physical Barriers: The Vendor’s hosting provider shall have ISO/IEC 27001:2013 compliant data centers. Access shall be controlled by biometric authentication, keycards, and 24x7x365 surveillance to ensure that only authorized provider engineers have access to infrastructure.

1.3. Data / Application / OS Protection: All APLD data is confidential. The Vendor shall maintain controls to limit who has access to APLD data. The State may direct the Vendor to limit who has access to APLD data.

1.4. Network: The Vendor shall use the following network tools and components:

1. Intrusion Detection System (IDS) installed within the APLD environments.

2. Web Application Firewall (WAF) appliance installed within the APLD environments.

3. Vulnerability scans (internal and external).

4. Penetration testing.

5. Distributed Denial of Service (DDoS) mitigation service.

1.5. Security Assessment / Security Controls: The Vendor shall maintain NIST 800-53 and SOC 2 standards during the term of this contract. SOC 2 controls shall be annually assessed by a third-party auditor, and compliance with NIST 800-53 Security Codes shall be assessed internally and periodically. The Vendor shall submit a copy of their SOC 2 Type II report, or equivalent compliance documents, to IDFPR prior to contract execution. Vendor shall also submit their SOC 2 Type II report annually during the initial term of this contract and subsequent renewals.

1.6. Security Incidents Response: The Vendor shall immediately notify the State of any security incidents, any information breach, or any other security incident which impacts the State of Illinois data. The Vendor shall notify the State of Illinois’ Chief Information Security Officer at DoIT.Security@illinois.gov and any other identified point of contact.

1.7. Role-Based Security:

1. Set Permissions: The APLD shall be a role-based security system that restricts APLD access based on permissions and privileges designated by IDFPR. Defined user roles can be added and adjusted at any time by IDFPR and the Vendor. Role changes shall be mutually agreed upon by IDFPR and the Vendor and will be effective to all users assigned to the role in near-real time.

2. Add New Users: Authorized users shall be able to add new users and provide permissions. State users shall be able to create and maintain new and existing users and define permissions based on user type or individually expressed permissions. Defined user roles can be added and adjusted at any time by IDFPR and the Vendor. Role changes shall be mutually agreed upon by IDFPR and the Vendor and will be effective to all users assigned to the role in near-real time.

3. One Log-In for Multi-Branch Businesses: The APLD shall enable public users to access as many business licenses the user is associated with by using a single log-in.

1.2.1.14 Plans and Plan Documentation: The Vendor shall provide the following documented plans within ninety (90) calendar days of contract execution:

1.1. Solution Development and Implementation Plan: The Vendor shall provide a high-level project plan (“Project Plan”) for the implementation and ongoing support of the project with staffing and timelines included. The Project Plan shall include the approximate length of time required after the Contract execution date, at which services could be fully operational, if required. This Project Plan shall include but not be limited to:

1. The defined timeframes for each implementation activity and requirement to be fulfilled.

2. The major project or service milestones and associated deliverables identified.

3. All defined dependent services, including any services that would be the responsibility of the State.

1.2. Change Management Plan: This plan shall include but not be limited to the process, staffing needs, roles, responsibilities, and documentation required to manage change(s) created by the implementation, development, or redevelopment and the subsequent operation(s) of the proposed APLD. The Vendor shall propose a process that efficiently and effectively manages technical, programmatic, and operations change(s).

1.3. Training Plan: This plan shall include but not be limited to a cohesive and responsive training program to ensure that both state and public users can properly and efficiently use the APLD to perform their respective job duties. The Vendor’s training plan shall encompass the use of all available tools and functionality within the APLD and describe how the Vendor will provide the training. The Vendor shall provide accessibility of all materials produced from this plan before, during, and after training. Refer to Section 1.2.1.10.5 of this contract for more details pertaining to training requirements.

1.4. Exit Transition, Data Migration, and Decommissioning Plan: Vendor shall develop for the State's approval an exit transition plan for the orderly transition of service responsibilities at least 180 days before the conclusion of the State contract term, or within 30 days of notification of termination of the state contract, whichever is earlier. Notwithstanding the foregoing, Vendor shall deliver a preliminary exit transition plan within 180 days of executing the state contract. This plan shall describe the activities needed to ensure an uninterrupted and transparent turnover to the State and/or a new Vendor at the completion of this contract, early termination, or default. This plan shall fully address both scheduled (contract expiration) and exigent (termination, default) scenarios. This shall include the conversion and migration of all pertinent information and any works in progress, etc. Additionally, this plan shall discuss roles and responsibilities of the organizations and the workflow(s) between the current Vendor and IDFPR, and/or a new Vendor. This plan’s action items shall ensure continued compliance with the Act along with state IT and auditing requirements. High-level timelines and contingency plans should also be included. Refer to Section 1.3.7 of this contract for more details pertaining to exit transition deliverables.

1.5. Disaster Recovery and Continuity of Operations Plan: This plan shall describe the processes and procedures to prepare for and recover from any event that may result in the loss of online and/or physical business operations.

1.2.2. Business Process: The APLD shall be used to input and store data and serve as IDFPR’s centralized anti-predatory lending database for all users as defined by the Act.

1.2.2.1 Under the law, IDFPR-licensed companies offering mortgage loans to Illinois consumers in the program area of Cook, Kane, Peoria, and Will counties are required to input loan terms on each loan offer into the APLD. From the loan terms the companies input, the APLD shall identify consumers who must attend a housing counseling session before accepting the loan offer and closing on the loan. IDFPR notifies these consumers about the required housing counseling session.

1.2.2.2 When a consumer attends a housing counseling session, the housing counselor shall input data about the session into the APLD.

1.2.2.3 After a loan’s closing occurs, the title company or closing agent accesses the APLD to enter additional data and generate a certificate. This certificate is required to file the mortgage on the property’s title record.

1.2.2.4 Some loans are exempt from data entry but will require the APLD to generate a certificate of exemption to file the mortgage on the property’s title record.

1.2.2.5 If a lender files a foreclosure case, the APLD shall accept electronic filing of the notice by the lender or their representative. The APLD shall electronically submit a notice to IDFPR of the foreclosure.

1.2.2.6 The APLD shall store the data input from these various companies, referred to as public users. IDFPR utilizes the data input by public users for their regulatory reviews to ensure compliance with the law.

1.2.2.7 The APLD shall have an intuitive reporting function that is capable of aggregating all loan data for IDFPR.

1.2.3. Support: Vendor shall provide appropriate support staffing and resources from initial implementation through the life of this contract. Vendor agrees to manage, administer, maintain, support, and host the APLD which includes providing program management services, customer service functions, technical support, regulatory compliance support, data entry services and program review as required by IDFPR pursuant to the Act.

1.2.3.1 Vendor agrees to provide a technical and business solution to enable IDFPR to:

1.1. Track mortgage application information entered by brokers, originators, housing counselors, title insurance companies and closing agents.

1.2. Identify and notify applicants for housing counseling based upon IDFPR standards, Vendor shall work with assigned IDFPR DOB staff to document and implement the preferred method of notification to borrowers to meet this requirement.

1.3. Track mortgage loan closings for compliance.

1.4. Facilitate the issuing of certifications of compliance and certificates of exemption as generated by the database.

1.5. Vendor shall provide quarterly and semi-annual reports as required by IDFPR which will assist IDFPR DOB in the preparation of required reports to the Illinois General Assembly

1.2.3.2 Vendor agrees to provide the management reporting system for the APLD.

1.2.3.3 Maintenance and Operations: The Vendor’s maintenance and operations of the APLD shall conform with all requirements of this section. The Vendor shall submit a Maintenance and Operations Plan for the State’s approval. The plan shall detail the Vendor’s approach, preventative maintenance, data retention, enhancements, release management, user support, IT service management, and service level agreements, in compliance with the below requirements.

1.1. Approach: The Vendor’s maintenance and support services shall deliver continuous, consistent, high-quality support for IDFPR and the APLD’s users for the duration of this contract.

1. Vendor shall maintain the APLD’s application and infrastructure for optimum performance, to ensure system security, and to support continuous enhancements. Vendor shall ensure that all APLD software and hardware components are current and supported technology to ensure optimal performance and system security in compliance with the State’s service level targets. The Vendor’s IT service management shall be based on the most current Information Technology Infrastructure Library (“ITIL”) standards.

2. The Vendor shall use a standard support tool to support preventative maintenance, upgrades and patching, and system enhancements. The Vendor’s support tool shall offer a methodical assessment of tickets for implementation that supports prioritization of all tickets in the backlog, factoring in urgency and development team capacity.

3. Routine maintenance is maintenance which the Vendor may perform while the APLD is online and without interrupting user access to the APLD and can be successfully completed without unscheduled downtime. The Vendor shall perform non-routine maintenance during the window outlined in section 1.2.1.2 of this contract.

1.2. Preventative Maintenance: While the APLD is provided to IDFPR as a cloud-based Software-as-a-Service (SaaS) solution, Vendor shall provide routine preventive maintenance on APLD components, including but not limited to adding new servers, memory, processors, additional storage, and upgrading server operating systems. When providing preventative maintenance measures, Vendor shall make every effort to limit any impact to the APLD operations and its users.

1.3. Vendor Data Retention: The Vendor shall adhere to the State’s specific data retention requirements detailed in Section 4 and Attachment 6.4 of this contract.

1. Data Extraction: Upon the State’s request, and at any time during the duration of this contract, the Vendor shall provide a solution for the extraction of any and all data, except security sensitive information. Security sensitive information shall be mutually agreed upon by the State and the Vendor, and may include, but is not limited to, sensitive personally identifiable user information, access tokens, encryption and cryptographic information, hashed passwords, non-State internal sessions and audit information, from the APLD in a non-proprietary format with data dictionaries and relationship information. Data extraction and data delivery shall be completed in a format approved by the State and at no additional cost to the State.

1.4. Enhancements: The Vendor shall be responsible for applying enhancements to all environments. The Vendor shall develop, test, and implement all necessary and ordinary APLD enhancements at no cost to the State. These enhancements include, but are not limited to, any necessary and ordinary enhancements to improve the functionality or performance of the APLD without fundamentally altering its core features, to improve security, or because of administrative, legislative, or judicial mandates. Unless an enhancement is specifically designed to be implemented by the State, the Vendor shall provide reasonable advance notice to the State of all enhancements prior to implementing any such enhancements. Vendor shall follow an agreed upon process to ensure the enhancement is developed and implemented within the State’s approved timeframe. The Vendor shall not charge the State for any of these enhancements. The Vendor’s enhancements made in other jurisdictions shall be made available to the State for the State’s approval or refusal at no additional cost to the State. The State shall have the right to choose not to adopt or incorporate the enhancement(s) from other states into the State’s APLD.

1.5. Release Management: The Vendor shall communicate release notes to the State as updates are released to the State’s testing environment, no less than two weeks before anticipated production release. While the update is in the testing environment, the Vendor shall provide the State with demonstrations and documentation as necessary to convey essential information. The Vendor shall also release notices via the APLD to provide notice to industry users before the releases. Upon release to the production environment, Vendor shall confirm with the State that the release was successful. The Vendor’s change management process shall include, at a minimum, version control of the State’s source code and server patching.

1.6. User Support: The Vendor shall provide the appropriate customer support staffing and resources from initial implementation through the life of this contract. The vendor’s support program shall be available to all users for quick, personal, and unlimited service, including call-ins, emails, and web-based support.

1.7. Support Service Management: The Vendor’s Support System shall include a self-service support center, a question-and-answer knowledgebase, and a support desk assistance option. All support inquiries shall be ticketed and logged by the Vendor. Issues are assigned a severity level – critical, high, medium, or low – and are resolved as expeditiously as possible, per agreed-upon standards. The Vendor’s support desk shall have a specific and documented escalation process. The support desk’s problem management responses shall be measured and reported by the Vendor. IDFPR shall have access to view all issue management and responses. Upon request from IDFPR, the Vendor shall provide IDFPR with a monthly report of the type of issues and questions users have submitted to the Vendor’s support desk along with any information regarding the Vendor’s support responses and solutions.

1.8. Service Level Agreements: The Vendor’s Service Level Agreement (“SLA”) are attached to this contract as Attachment 6.5. The Vendor’s SLA focuses on the APLD’s availability and operation along with the Vendor’s support team availability and responsiveness to user issues and inquiries. IDFPR shall review and approve any changes the Vendor proposes to the SLA prior to the Vendor implementing any changes.

1. Service Level Deficiencies: If any service level deficiencies occur within the contract, or the minimum thresholds are not met, the following steps may be implemented by IDFPR in lieu of declaring a breach of contract, and the Vendor shall comply with such steps.

1. Warning: IDFPR and the Vendor meet to discuss the issues and agree on a documented Service Improvement Plan to resolve the issues within two (2) months.

2. Probation: If the issues have not been resolved within two (2) months, the Vendor may be placed on a Probation Period to improve their performance. IDFPR may develop a Corrective Action Plan (“CAP”) for the Vendor to document and improve the Vendor’s performance.

3. Incentive Discount: The Vendor shall provide a three percent (3%) discount off its invoice rates for all line items during the Probation Period to IDFPR. The Vendor shall document the discount on its monthly invoices to the invoice contact during the Probationary Period. The 3% discount is not compensatory and nothing in this contract establishes the harm that IDFPR and the State will suffer from service level deficiencies or failures to meet minimum thresholds. The State will review the Vendor’s performance during the probationary period after three (3) months, and may implement one of the following actions:

1.1. If the deficiencies are successfully resolved within the three (3) month Probationary Period, the penalty will be removed, and the Vendor will be reinstated to satisfactory performance.

1.2. DFPR may extend the Probationary Period if marginal improvements are made but deficiencies still persist, during which the penalty shall remain effective, and conduct another review of the Vendor’s performance during the extension.

1.3. IDFPR may declare a breach of contract.

1.9. Optional Services: Use or non-use of any optional services by users shall not, in any manner or means whatsoever, impact the availability of the database to the users related to compliance with the Act.

For procurements conducted in BidBuy, the State may include in this Contract the BidBuy Purchase Order as it contains the agreed Supplies and/or Services.

1.3. MILESTONES AND DELIVERABLES: Below are the milestones and deliverables to be executed during the contract term and subsequent renewal terms.

1.3.1. If APLD creation, development, or redevelopment is necessary, the Vendor must deliver a test module to IDFPR and allow 30 calendar days for evaluation prior to acceptance of the database.

1.3.2. If APLD creation, development, or redevelopment is necessary, the Vendor must deliver a draft of the user training plan to IDFPR and allow 30 calendar days for evaluation prior to acceptance of the training plan.

1.3.3. If APLD creation, development, or redevelopment is necessary, the vendor must deliver a draft of the customer service plan to IDFPR and allow 30 calendar days for evaluation prior to acceptance.

1.3.4. Reporting: IDFPR shall have the discretion to request reporting requirements, including, but not limited to, what is itemized below, throughout the duration of this contract. This shall include, at no cost to IDFPR or the State, professional services for development and all associated program management, business analytics, technical analytics, training, supplementary documentation, and implementations.

1.3.4.1 Vendor shall work with assigned IDFPR staff to document and implement the preferred reporting methods, data, and delivery.

1.3.4.2 Vendor’s solution shall eliminate “blind spot” or “limited data” when data reports are pulled by IDFPR; if users enter data into the APLD, IDFPR shall be capable of pulling all data requested into a single source report without pulling multiple reports and manually merging the data. The APLD’s performance and system response time shall not be impacted when these reports are generated.

1.3.4.3 The APLD shall allow regulator reports to be pulled during varied time increments, including but not limited to daily, weekly, monthly and annually.

1.3.4.4 The APLD shall allow all agreed upon reports to be downloaded into a consistent, non-proprietary format (e.g. Microsoft Excel, CSV, etc.) as requested by IDFPR.

1.3.4.5 Information Access: IDFPR or its written designee(s) shall have access to the reporting capability from the APLD to conduct regulatory oversight including, but not limited to, monitoring, examination, enforcement and other lawful purposes. IDFPR may request additional data and information from the APLD at any time.

1.3.4.6 Data Retention: All data recorded in the APLD shall be maintained online for a minimum of six (6) years from the date of entry of the information. Any data that is removed from online retrieval shall be maintained in an archived database that shall be made available to IDFPR upon request and upon the termination of this agreement. All data collected in the APLD is the exclusive property of IDFPR. The Vendor retains no property interest whatsoever in the data collected or its use to determine the eligibility of consumers for housing counseling under the APLD Program. The Vendor shall not remove or delete any data records in the APLD without the proper written consent of IDFPR.

1.3.5. User Interface: Vendor shall make continuous improvements and update the APLD, website, and user interfaces that make the APLD more accessible to all users at no cost to IDFPR and the State.

1.3.5.1 The APLD shall allow for intuitive and automated workflow(s) through its website for all users which reduces multiple clicks and manually navigating multiple pages to submit the required information and data.

1.3.6. Integrations and Interfaces: Vendor shall establish and maintain integrations and interfaces with the following State solutions during the first year of the initial contract term:

1.3.6.1 Okta MFA: The State’s current identity and access management solution is Okta. Okta’s “ILWorkforce” solution is used for State users and Okta’s “ILogin” solution is used for non-State or public users.

1.3.6.2 CORE: IDFPR’s regulatory system is the Comprehensive Online Regulatory Environment (“CORE”), a web-based solution within a vendor-maintained cloud environment.

1.3.6.3 The State may identify and request additional integrations and interfaces to the APLD at any time during the duration of the contract and its subsequent renewal terms. The State will initiate these requests with the Vendor. Upon receiving the request, the Vendor will document it using a standardized template and include the following:

1.1. A detailed description of the request.

1.2. Technical specifications of the request.

1.3. Assessment of complexity and estimated time to implement the request.

1.4. Data mapping requirements.

1.5. Security and compliance requirements and considerations.

1.6. Testing and quality assurance (“QA”) plans.

1.7. Stakeholder coordination and feedback.

1.8. Change management plans.

1.9. Final approval process for production deployment

The Vendor shall make available all request documents to the State.

Unless otherwise agreed in writing, all such integrations and interfaces shall be implemented at no additional cost to the State, provided they are within the scope of the APLD’s system architecture and capabilities.

1.3.7. Exit Transition Plan: Vendor shall develop for IDFPR’s approval an Exit Transition Plan for the orderly transition of service responsibilities at least 180 days before the conclusion of the contract term, or within 30 days of notification of termination of the state contract, whichever is earlier.

1.3.7.1 Data: Vendor shall provide a copy of all State data (in a non-proprietary format) to IDFPR prior to determination of the contract in a manner approved by IDFPR. Vendor shall also provide a knowledge transfer as defined in the Exit Transition Plan, that includes at minimum the data, data dictionaries of data fields, table mapping, and relationships of the data.

1.3.7.2 Exit Transition Report: Vendor must execute the Exit Transition Plan and report on the successful completion of the exit transition in an exit transition report.

1.3.7.3 Services: Vendor shall provide all exit transition services to include project knowledge and documentation prior to contract termination, not to include Vendor’s trade secrets and other proprietary or confidential information. If the data needs to exit from the Vendor’s solution to a different solution owned by another provider, Vendor shall coordinate with IDFPR and the other provider and ensure all data is properly transferred and accepted from the Vendor’s solution to the different solution.

1.3.8. New Products: All products furnished shall be new, unused, most recent manufacture and not discontinued. Given the changing marketplace and the evolution of technology, the State, during any term of this contract, may review new and enhanced products, maintenance and support services, or equipment offered by Vendor that are within the scope of this contract and underlying procurement. In addition, if an item becomes discontinued or otherwise not available during the term, the Vendor may propose to substitute an equivalent product or a product with greater functionality. All proposed substitutions must be approved by the State. Prices and rates for any product or service offered may be revised downward from the contract price, but not upward unless otherwise allowed in this contract. Any new technology the State takes advantage of must, at a minimum, replace a function or solution that this contract already covers.

1.4. VENDOR / STAFF SPECIFICATIONS: Below are the vendor/staff specifications that shall be met and maintained during the contract term and subsequent renewal terms.

1.4.1. Vendor shall be responsible for providing professionals with the necessary experience to execute all requirements and deliverables as set forth in this contract. Vendor shall be responsible for establishing and maintaining staffing resources that IDFPR can utilize for the APLD along with additional resources upon request. These additional resources upon request will be utilized to implement any enhancements for any newly required Administrative, Legislative, or Judicial mandate(s) during the term of the contract. All resources shall be identified and anticipated to execute technology, business, or hybrid functions, depending on the documented work needed for the APLD, mandated enhancements, and to meet any imposed timelines.

1.4.2. Vendor shall be responsible for assigning qualified resources that provide regular system maintenance, including, but not limited to, bug fixes, patches, updates and upgrades, to ensure continuous and uninterrupted operations of the APLD.

1.4.3. Vendor shall remain an authorized Partner, Reseller, or Provider of the APLD, perform all services as an authorized Partner, Reseller, or Provider, and accomplish such tasks, including the furnishing of all materials and equipment necessary for full performance thereof, as are identified and designated as service provider responsibilities as set forth in this Contract.

1.4.4. Vendor shall keep IDFPR fully informed as to the progress of matters covered by this contract. Unless Vendor is otherwise prohibited from doing so, Vendor shall offer IDFPR the opportunity to review relevant documents prior to filing with any public body or adversarial party.

1.4.5. IDFPR may conduct a post (or periodic) performance review(s) of the Vendor’s…