RFP 27-87814

Attachment K

STATEMENT OF WORK

I. EXECUTIVE SUMMARY

This Statement of Work (SOW) describes the services the State of Indiana, acting through the Indiana Department of Administration (IDOA) on behalf of the Indiana Office of Technology (IOT), seeks to procure for an Enterprise Observability Platform supporting the IOT NextLevel Observability Program and the broader executive-branch agency portfolio. This engagement enables the State to modernize observability capabilities, reduce mean‑time‑to‑detect/resolve incidents, and support a scalable enterprise monitoring framework aligned with statewide technology standards.

IOT currently provides observability coverage for 213 applications across 37 State agencies serving 6.8 million Indiana residents, producing $14.15 million in documented business value against a $5.7 million platform investment (a validated 148.2% return on investment). Through this engagement the State will sustain and extend these outcomes: maintaining coverage without service interruption, scaling toward a target of 500 monitored applications, and improving detection, resolution, and alert-quality outcomes against measurable service levels. The platform shall span application performance, digital experience, network path, infrastructure, application security, and event & data analytics — ingesting and analyzing log and event data from the State’s existing logging and security systems — integrated with the State’s ServiceNow environment and aligned to the program’s operating philosophy that observability is thirty percent tools and seventy percent people and process.

II. BACKGROUND AND CURRENT STATE

Program Overview.

IOT operates the NextLevel Observability Program as a statewide enterprise initiative supporting the operational reliability of citizen-facing applications. The Program delivers coverage for 213 applications across 37 agencies, a champion-based agency engagement model with 35+ certified champions across Bronze, Silver, Gold, and Platinum tiers (scored on a 148-point assessment), a formal Observability Center of Excellence, and five concurrent statewide SMART Goals (ServiceNow CSDM integration, citizen experience and business value, platform optimization, automated remediation, and champion maturity).

Current Platform Architecture.

The current stack is Cisco AppDynamics (application performance and business-transaction visibility), Cisco ThousandEyes (synthetic network path, DNS/HTTP analytics), and Cisco Secure Application Monitoring (runtime application self-protection). The environment is hybrid, with approximately 70-75% of workloads on-premises (VMware, Cisco UCS) and the balance across Microsoft Azure, AWS, Google Cloud Platform, and Oracle Cloud Infrastructure. Supporting tooling includes MuleSoft, ServiceNow ITSM, Microsoft Power BI, and Cribl. Applications span Java, .NET, Node.js, PHP, Python, and select Go, with growing container and Kubernetes adoption.

Environment at a Glance

Compute — On-Premises The on-premises estate is virtualized on VMware vSphere and managed through vCenter, comprising approximately 3,000–4,000 virtual machines across two data-center sites (a primary site and a disaster-recovery site). The operating-system mix is approximately 75% Windows and 25% Linux. Respondents should assume agent-based and agentless collection paths appropriate to a predominantly Windows, VMware-virtualized estate, including vCenter-level integration.

Cloud Approximately 30% of total workload runs in the cloud today, distributed across multiple providers. The current cloud estate is Azure-dominant; the State-owned target tenant for the new platform is AWS. Respondents should plan to monitor a heterogeneous multi-cloud estate while deploying the platform into a State-owned AWS tenant (see §9, Hosting).

Applications The State currently instruments approximately 213 applications, at or near the capacity of the current enterprise agreement. The design target for the new platform is approximately 500 applications, which may shift with cloud migrations; Respondents shall provide sizing and pricing that scales to ~500 applications. Predominant application stacks include .NET and Java (heavy), with some Node.js, along with PeopleSoft and mainframe workloads. Software-as-a-Service applications are monitored via synthetic / network-path testing rather than in-application agents.

Databases

Identity Enterprise identity and single sign-on are provided through Okta and Microsoft Entra ID (both primary). Respondents should support role-based access and SSO integration with these providers.

Telemetry Volume & Retention

Retention — particularly the multi-year cold-storage requirement for IRS Pub 1075 agencies — is a material cost driver; Respondents shall price the long-term archive tier explicitly.

The State currently operates an enterprise observability capability spanning application performance monitoring, synthetic / network-path intelligence, and runtime application security, which the resulting Contract is expected to replace or consolidate. Product-specific details are provided to shortlisted Respondents under the Confidential Annex.

Confidential Annex Precise counts, data-center locations, network topology and segmentation, per-agency application and telemetry breakdowns, the current tool inventory, and named regulated systems are provided to shortlisted Respondents under a Confidential Annex, subject to the State's confidentiality terms.

Drivers for this Engagement.

The current platform investment approaches the end of its term. The State is conducting a competitive procurement to determine the best-value platform and partner for the next term, preserve continuity of citizen-facing observability, consolidate 45 or more legacy monitoring tools, deepen ServiceNow CSDM integration, add log & event data analytics that ingests and analyzes data from the State’s existing logging and security systems (augmenting, and not replacing, those systems), and ensure vendor-neutral, OpenTelemetry-aligned data portability to avoid future rip-and-replace risk.

III. SCOPE OF WORK

The Contractor shall provide, implement, integrate, and support an Enterprise Observability Platform meeting the requirements below. The scope is outcome-based: the State is procuring measured operational outcomes (see Objectives of Engagement), not a fixed feature list. The platform shall support the current portfolio of 213 applications and scale to a target of 500 applications during the initial Contract term. In-scope capability domains:

The State strongly prefers a cloud-based service offering. Cloud-based service offerings are required to be within a state-owned cloud tenant. However alternative solutions may be considered if they demonstrate significant value. This section provides details on infrastructure and support requirements, outlining the State’s minimum requirements. Review and completed Attachment [M] – Infrastructure Overview for more detailed information.

Out of Scope.

Unless expressly added by written amendment, the following are out of scope: procurement or replacement of the State’s underlying network, compute, or storage infrastructure; application remediation or code changes beyond observability instrumentation; provision of the State’s ServiceNow, MuleSoft, Power BI, Tableau, or Cribl licenses; and security incident-response services beyond the SIEM/SOAR integration defined herein. The Platform is not intended to serve as the State’s system of record for enterprise logging or as the State’s primary security information and event management (SIEM) system; it ingests from, analyzes, and interoperates with those systems. The State retains ownership of all telemetry, configuration, and derived data.

a. OBJECTIVES OF ENGAGEMENT Through the resulting Contract, the State seeks to achieve the following measurable, outcome-focused objectives during the initial Contract term:

1. Maintain or exceed current observability coverage of 213 applications with no service interruption during transition (if the awarded Respondent is not the incumbent).

2. Scale the monitored application portfolio toward a target of 500 applications across the executive-branch agency footprint.

3. Achieve 99.9% availability for the observability platform itself.

4. Reduce mean time to detect (MTTD) production-impacting incidents by 20% relative to the current baseline within 24 months of Contract start.

5. Reduce mean time to resolve (MTTR) production-impacting incidents by 20% relative to the current baseline within 24 months of Contract start.

6. Reduce alert noise from the current 64% baseline to 30% or less within 12 months of Contract start.

7. Sustain documented business value through the State’s Business Value Assessment framework supporting a return on investment of 100% or greater across the Contract term.

8. Support the consolidation of 45 or more legacy monitoring tools identified for retirement under the program’s platform-optimization goal.

b. DELIVERABLES AND DEADLINES The Contractor shall provide, at a minimum, the following deliverables according to a mutually agreed upon schedule. Each deliverable must include the required compliance evidence and will be subject to formal review and approval by the State. Deliverables should be submitted in both editable and PDF formats and stored in a state-owned repository.

Implementation & Transition Plan

Phased plan with milestones, staffing, risk mitigation, acceptance criteria; if non-incumbent, a >=90-day parallel run and migration approach.

Platform Provisioning & Onboarding

Production environment provisioned; security documentation accepted; initial agency cohort onboarded.

ServiceNow / CSDM Integration

Bidirectional incident, change, and CI synchronization validated against CSDM.

Full Operational Readiness (213-app portfolio)

All in-scope domains operational; incumbent decommissioned (if applicable) with no coverage gap.

Enablement & Certification Program

Role-based curricula delivered; certification aligned to the 148-point Champion Maturity Scorecard.

Quarterly Business Reviews

QBR with documented attendees, agenda, KPI review, and measurable outcomes.

End-of-Contract Transition Package

Knowledge transfer, final documentation, data export, and access turnover.

c. PAYMENT MILESTONES Compensation shall be tied to completed and State-accepted deliverables and to ongoing subscription/service periods. The State will not pay a milestone until the associated deliverable is accepted in writing. This framework will be reconciled against the awarded Cost Proposal during contract finalization.

IV. PROJECT MANAGEMENT

The Contractor shall manage the engagement with transparency and discipline, providing at a minimum: a weekly project status meeting during implementation and transition, transitioning to a monthly operational meeting at steady state, plus quarterly business reviews; weekly written status reports during active phases and monthly operational reports thereafter; a named single point of contact (Project Manager) with a defined escalation path; and use of a State-accessible project-tracking and collaboration toolset, with documentation and change records integrating with or exportable to the State’s ServiceNow and document-management environments.

a. PROJECT MANAGEMENT PLAN The Contractor shall deliver an initial draft of the Project Management Plan (PMP) within [Insert timeframe, for example 30 business days] of contract start. A comprehensive PMP will be delivered at a mutually agreed upon timeframe. Final acceptance of the PMP is defined in the deliverables section. The PMP will include an integrated schedule with milestones and dependencies; a project organization and staffing plan; a requirements traceability matrix; issue and risk management processes with escalation paths; a communication plan for stakeholder engagement; a quality management plan with standards and acceptance criteria; training and deployment plans; and descriptions of approved tools and collaboration platforms. The PMP shall include a change control process to evaluate and approve scope changes. The PMP will be reviewed and approved by the State and updated as necessary.

b. KEY PERSONS The Contractor shall identify Key Persons accountable for delivery. For each, the Contractor shall provide name, role, relevant qualifications, and expected availability. At a minimum, the following key roles are required:

Individuals designated for these roles will be appointed during the development of the PMP. Any substitution of key persons must be approved in writing by the State. The Contractor shall ensure that any proposed replacement meets or exceeds the qualifications of the originally designated individual. The State reserves the right to request the replacement of any key person if, in the State’s judgment, the individual does not meet performance expectations or project needs. Additionally, the State shall have the opportunity to interview any proposed replacement prior to approval to ensure suitability for the role.

c. OTHER PROJECT STAFF The Contractor shall provide sufficient staffing levels with appropriate qualifications to meet the State’s delivery timelines and performance expectations. The Contractor shall prepare a Project Resource Staffing Plan that includes:

· The number, type, and categories of staff proposed for the engagement.

· Role descriptions and minimum qualifications for each position.

· Work location details and any remote work arrangements.

· Ongoing training requirements to ensure compliance and quality standards.

· A plan for onboarding new staff or replacing personnel during the engagement.

The State reserves the right to review staffing and to request changes if, in the State’s judgment, personnel do not meet performance expectations or project needs. The State will have the opportunity to interview proposed replacements prior to approval, and any replacements must meet or exceed the original qualifications.

d. DOCUMENT MANAGEMENT All engagement documentation shall be organized, stored, shared, and controlled to the State’s standards. The Contractor shall store deliverables and project records in a State-approved repository with appropriate access controls; maintain documents in State-compatible formats (e.g., Microsoft Word, Excel, PDF) with version control and change history; and meet the State’s security, confidentiality, and retention expectations, including compliance with the Indiana Access to Public Records Act (IC 5-14-3) and applicable IOT data-handling standards. All documentation shall remain accessible to the State and shall be turned over at contract end.

e. STATUS UPDATES AND REPORTING The Contractor shall keep the State informed of progress, risks, and milestones through structured, standardized reporting:

1. Weekly status reports during implementation and transition (accomplishments, planned work, risks/issues, decisions needed).

2. Monthly operational reviews at steady state (platform health, KPI/SLA performance, open items).

3. Quarterly Business Reviews with documented attendees, agenda, KPI review, value reporting, and roadmap input.

4. Standardized reporting formats agreed with the State and, where feasible, integrated with or exportable to ServiceNow.

V. INDEPENDENT VERIFICATION AND VALIDATION

In the event the State determines that any independent verification and validation ("IV&V") oversight is required by the State during the term of this Contract, the Contractor shall comply with any such oversight during the term of this Contract, pursuant to which an independent third-party review may be conducted by a reviewer selected by the State, for the purpose of verifying that the Contractor has performed its obligations in compliance with the terms of this Contract. In the absence of any such IV&V oversight, the Contractor shall comply with any other appropriate methods or means for verification and validation required by the State during the term of this Contract for the purpose of verifying and validating that the Contractor has performed its obligations in compliance with the terms of this Contract. The Contractor shall provide all information and documentation requested during the State's IV&V oversight or verification and validation efforts related to this Contract and in connection with any IV&V oversight or verification and validation efforts related to an initiative of which this Contract is a part.

VI. COMPLIANCE REQUIREMENTS

The Contractor shall comply with all applicable State and federal requirements and with the following, at a minimum:

1. GovRAMP Authorized status as the State baseline authorization for the Platform; FedRAMP authorization (FedRAMP High) is required for any component that stores, processes, or transmits federal tax information subject to IRS Publication 1075, and FedRAMP-authorized offerings are otherwise accepted on a reciprocity basis. Respondents shall disclose authorization status, impact level, expiration, and continuous-monitoring posture; a Respondent lacking GovRAMP Authorized status shall provide a documented timeline to achieve it within 12 months of Contract execution.

2. Compliance with the Statewide IT Policies, Procedures, & Standards (https://www.in.gov/iot/policies-procedures-and-standards/) that are applicable, including the assistive technology standard. The Contractor will be required to sign a Non-Disclosure Agreement (NDA) to access the more sensitive standards and policies. The Contractor should review the Statewide IT Policies, Procedures, & Standards and ensure their proposed solution meets all standards therein.

3. Encryption of telemetry in transit and at rest using current NIST-approved standards; SOC 2 Type II, ISO 27001, or equivalent third-party validation.

4. Documented handling controls for PII, PHI, and Federal Tax Information where applicable, including data minimization and redaction.

5. Disclosure of all subprocessors, third-party data integrations, data-residency options (preference for U.S.-resident hosting), and any cross-border transfers.

6. The State has adopted an enterprise-level policy governing the use of Artificial Intelligence (AI) within state government. The State’s AI Policy is issued and monitored by the Office of the Chief Data Officer (OCDO), in cooperation with the Chief Privacy Officer (CPO) and the Management Performance Hub (MPH). As a complement to the AI Policy, the State Agency Artificial Intelligence Systems Standard outlines the rationale behind the AI Readiness Assessment Process required for the implementation or any use of AI by a state agency. That Standard outlines the requirement for the submission of a Readiness Assessment Questionnaire prior to implementation or use of an AI tool or system. Any proposed solution meeting these requirements must support the State’s AI Policy and follow the AI Readiness Assessment Process. See https://www.in.gov/mph/AI/ for more detailed information.

6.1. For AI and agentic capabilities: a written commitment on whether State data is used to train or fine-tune models (with the State’s right to prohibit), an AI-layer subprocessor list and Data Processing Agreement, cross-tenant segregation, human-in-the-loop gates and audit trails for agentic actions, model change-management notification, and alignment with the NIST AI Risk Management Framework and applicable State of Indiana AI governance policy.

7. Compliance with the Indiana Access to Public Records Act (IC 5-14-3) and applicable accessibility standards.

VII. KEY PERFORMANCE INDICATORS

The State will use Key Performance Indicators (KPIs) to measure performance and outcomes of the Contract. The specific KPIs and their targets will be defined and agreed upon by the State and the Contractor during the initial phases of the requirements under the Contract. At a minimum, on time delivery at quality standards of the scope provided within the budget set forth in the Contract will each be measured. Additionally, the State will collect a modified Net Promoter Score from customers to this Contract in its discretion. Low ratings on the modified Net Promoter Score or failure to meet any other KPIs may be deemed, at the discretion of the State, to constitute default under the Contract.

In addition to the foregoing standard measures, the State anticipates the following service-level and performance indicators, to be finalized with the Contractor:

The Contractor shall propose service-level credits applicable in the event of a service-level miss, with the proposed credit structure included in the Cost Proposal.

VIII. END OF CONTRACT TRANSITION AND TURNOVER

The Contractor shall develop a turnover plan [six (6) months] prior to contract end, detailing activities for transferring responsibilities, non-proprietary components, data, and operational documentation to the State or its agent. The Contractor shall maintain mutually agreed upon staffing levels during turnover and commence training and shadowing [four (4) months] prior to contract end for staff who will assume operations. The State will approve the designated Turnover Manager. The Contractor shall provide a knowledge transfer checklist (for example procedures, contacts, training materials) and deliver a data disposition certificate confirming deletion or return of State data within [thirty (30) days] after contract completion unless otherwise agreed.