6._Exhibit_C_C5-CMCS-G1_530_MFA_Tech_SOW_063026.docx

Bidder’s Name

INVITATION FOR BID

IFB C5-CMCS-G1-26

CALNET Managed Cybersecurity Services

CATEGORY 530 – MANAGED MULTI-FACTOR AUTHENTICATION SERVICE

<Enter Bidder Name Here> Statement of Work

TECHNICAL REQUIREMENTS

JUNE 30, 2026

Issued by:

STATE OF CALIFORNIA

Office of Statewide Technology Procurement PO Box 1810 Rancho Cordova, CA 95741 Disclaimer: The original PDF version and any subsequent addenda to this IFB remain the official version. In the event of any inconsistency between the Bidder’s versions, articles, attachments, exhibits, specifications, or provisions, which constitute the Contract, the official State version of the IFB in its entirety shall take precedence.

ADDENDUM LOG

Table of Contents

Statement of work TECHNICAL REQUIREMENTS Category 530 Managed MULTI-FACTOR AUTHENTICATION Service

530.1 OVERVIEW

The California Department of Technology (CDT), Office of Statewide Technology Procurement (OSTP) is requesting proposals from responsive Bidders to provide Managed Multi-Factor Authentication (MFA) Services and Features.

This Invitation for Bid (IFB) C5-CMCS-G1-26 Category 530 provides the State’s solicitation for best value solutions for Managed MFA Service. This IFB also describes the technical Requirements necessary to support the CALNET Program Requirements.

This IFB will be awarded to Bidders that meet the award criteria as described in IFB C5-CMCS-G1-26 Part 1, Bid Evaluation. The CALNET 5 CALNET Managed Cybersecurity Services (CMCS) Contract(s) that result from the award of this IFB will be managed on a day-to-day basis by CALNET Management and Oversight (CMO).

530.1.1 Bidder Response Requirements

Throughout this IFB, the Bidder is required to confirm their understanding and acceptance of the Requirements by selecting a response in the provided drop-down field.

Example:

“The Bidder understands and shall meet or exceed the Requirements identified in Section 530.X Section Name? Choose an item.”

530.1.2 Designation of Requirements

All technical Requirements specified in this IFB are mandatory and must be responded to as identified in IFB Part 1, SOW mandatory technical Requirements by the Bidder. Additionally, some mandatory Requirements are “Mandatory-Scorable” and are designated as “(M-S).”

530.1.3 Statewide Policies and Standards

The Contractor’s Managed MFA Service shall be aligned with policies and standards set forth in the Statewide Information Management Manual (SIMM) Section 5300, Information Security (SIMM 5360-C, Multi-Factor Authentication, and 5360-D, Multi-Factor Authentication Supplemental).

530.1.4 Pacific Time Zone

Unless specified otherwise, all Requirements are stated in the Pacific Time Zone and the Contractor shall use the Pacific Time Zone.

The Bidder understands and shall meet or exceed the Requirements identified in Section 530.1 Overview? Choose an item.

530.2 MANAGED MULTI-FACTOR AUTHENTICATION SERVICE

The Contractor’s Managed MFA Service shall include, at a minimum, the following Services and Features to support secure, reliable, and scalable authentication for Customer environments.

530.2.1 Managed MFA Services and Features

The Contractor shall provide a centrally managed MFA platform that provides policy-based authentication, support for multiple factors, administration, monitoring, and reporting for all subscribed Customers.

The Contractor’s Managed MFA Service shall include, but not be limited to, the provisioning, configuration, operation, and ongoing management of a functional MFA service instance in accordance with Customer security policies and applicable Requirements.

The Contractor’s Managed MFA Services shall provide authentication and administrative audit logs which shall include the following metrics at a minimum:

Successful and failed authentication attempts;

Enrollment events;

Recovery events; and, Policy or administrative changes.

The Contractor's Service shall make the Features identified below available for Customer use. The Customer shall determine, through Customer defined policy, which Features and authentication factors are required, optional, or disabled within the Customer's environment, consistent with applicable regulatory, compliance, and security requirements.

The Contractor’s managed MFA shall provide the following Features and functionality at a minimum:

Adaptive and Risk-Based Authentication – The Contractor’s Service shall provide or support (via integration with the Customer’s identity provider/conditional access platform) capabilities that evaluate contextual and behavioral signals such as device, location, network, and user behavior to adjust authentication requirements based on assessed risk.

Passwordless and Phishing-Resistant Authentication – The Contractor’s Service shall support passwordless methods and phishing-resistant authenticators, including FIDO2/WebAuthn and other standards-based cryptographic credentials, where supported by Customer devices and applications. Where Customer applications or systems cannot technically support phishing-resistant authentication, the Contractor's Service shall support alternative authentication methods with compensating controls. The Customer is responsible for documenting and accepting the residual risk in a risk treatment plan.

High-Assurance / Step-Up MFA for Privileged and Sensitive Access – The Contractor’s Service shall allow for configurable policies that require stronger or additional authentication factors for privileged accounts and for access to high-risk or sensitive applications, systems, or data.

Self-Service MFA Enrollment and Recovery – The Contractor’s Service shall provide tools that allow secure enrollment, update, and recovery of MFA authenticators, subject to Customer-defined policies and administrative controls.

Tenant Isolation and Administrative Access Controls – The Contractor's Service shall provide logical separation of each Customer's data, configurations, and administrative functions, including separation at the Customer department or organizational unit level where required; role-based access control (RBAC) for all administrative functions; tamper-evident audit logging of administrative actions, including Contractor personnel access to Customer data; and technical controls that prevent unauthorized cross-Customer data access, consistent with SIMM 5310-A and SIMM 5350-A.

The Contractor shall provide the Managed MFA Service listed in Table 530.2.1.a. below. The Contractor’s pricing shall be based on a per End-User, per-month, subscription-based model for authorized End-Users with active MFA enrollment.

Additional volume pricing options may be added to the Contract after Contract Award via the formal amendment process, in accordance with SOW Business Requirements Section CMCS-G1.10 (Contract Amendments).

Table 530.2.1.a – Managed MFA Service

Service

Service

Service

Service

530.2.2 Contractor’s Managed MFA Password Reset Maximum Time

The Contractor shall identify the maximum time it takes to reset an End-User’s password to prevent unauthorized access. The Contractor’s commitment level indicated below is exclusive of any time associated with End-User Identity Validation. The Contractor’s Managed MFA Service shall provide both an automated self-service option and a Contractor admin-assisted option.

Self-service reset time begins when an End-User submits a reset request via the Contractor’s portal/API. The measurement ends when the End-User’s MFA credentials reset has been completed and is usable by the Customer.

Table 530.2.2.a – Contractor’s MFA Password Reset Maximum Time (M-S)

(B, S or P)

530.2.3 Additional Managed MFA Services and Features

530.2.3.1 Managed MFA Configuration and Implementation Consulting Services Managed MFA Consulting Services shall only be utilized in conjunction with the Contractor’s Services and Features listed in Category 530 – Managed MFA Service. These Consulting Services are for custom Managed MFA Service implementations that exceed the basic elements necessary to configure an instance of a working Managed MFA Service as defined by General Provisions – Telecommunications, Section 15.12, Goods and Services Costs.

The Contractor’s Managed MFA Configuration and Implementation Consulting Services classifications of hours described in the following sections will be as follows:

Regular Hours – Hours worked between 8:00 a.m. and 4:59 p.m., Monday through Friday.

Overtime Hours – Hours worked between 5:00 p.m. and 7:59 a.m., Monday through Friday and all-day Saturday, Sunday, or State of California holidays.

When coordinated scheduling for projects between the Customer and the Contractor occurs, the Customer and the Contractor may mutually agree, in writing, that hours worked between 5:00 p.m. and 7:59 a.m., Monday through Friday and all-day Saturday, Sunday, or State of California holidays can be classified as Regular Hours in accordance with the State of California Department of Industrial Relations.

530.2.3.1.1 Customer Environment Consulting and Survey

The Consulting Services described are project based, non-recurring, and optional Services that exceed the standard provisioning, configuration, and operational activities included in the Managed MFA Service.

These Consulting Services shall be utilized only where a Customer requires custom architecture, complex integration, migration, or environment-specific analysis that is not reasonably achievable through standard Managed MFA Service onboarding or ongoing operations.

The Contractor shall provide Customer environment consulting and survey Services to assist Customers with activities that shall include, but not be limited to:

Assess the Customer’s current identity, authentication, and access control architecture;

Identify existing authentication mechanisms, directories, identity providers, and dependencies;

Assist Customer(s) with Identifying applicable regulatory, compliance, or policy requirements impacting authentication, including, but not limited to, Criminal Justice Information Services (CJIS) requirements, Health Insurance Portability and Accountability Act (HIPAA) requirements, Internal Revenue Service (IRS) Publication 1075 requirements, State Administrative Manual (SAM) Sections 5300–5399, State Information Management Manual (SIMM) 5300-A (Information Security), SIMM 5310-A (Access Control), SIMM 5320-A (Incident Response), SIMM 5350-A (Security Monitoring and Logging), and other Customer-specific federal, state, or industry security standards, as applicable to the Customer environment;

Evaluate current incident response, audit, and access review processes as they relate to authentication events;

Identify high-risk user populations, privileged roles, and sensitive applications requiring elevated assurance; and Develop high-level solution strategies and recommendations to support a Managed MFA implementation aligned with Customer security objectives.

530.2.3.1.2 Planning and Integration

The Contractor shall provide planning and migration consulting Services to assist Customers with activities that shall include, but not be limited to:

Gather functional, technical, and security requirements for MFA deployment;

Designing MFA architecture for cloud, on-premises, and hybrid environments;

Design integration with Customer applications, identity providers, VPNs, remote access systems, and legacy platforms;

Document application inventories, authentication flows, and system dependencies;

Develop phased deployment or migration plans, including pilot groups and cutover strategies;

Plan for scalability, redundancy, and high availability;

Review and validating security posture and authentication assurance levels; and Develop implementation documentation and configuration standards.

530.2.3.1.3 Execution and Implementation

The Contractor shall provide execution and implementation consulting Services that exceed the standard Managed MFA Service Requirements identified in Section 530.2.1 to assist Customers with activities that shall include, but not be limited to Configure advanced or customized authentication policies, risk-based rules, and conditional access controls;

Implement integrations with Customer security and operations platforms, including EDR, SIEM, SOAR, ITSM, or identity governance solutions;

Support onboarding of complex or legacy applications requiring non-standard integration methods;

Establish customized dashboards, reports, or alerting aligned to Customer operational needs;

Execute phased migrations from legacy or third-party MFA solutions;

Support testing, validation, and user acceptance activities;

Provide project coordination or project management support to execute the approved implementation or migration plan.

The Contractor shall offer Consulting Services in Table 530.2.3.1.a Table 530.2.3.1.a – Managed MFA Consulting and Implementation Services

Service

Service

Service

Service

530.2.4 Managed MFA Geographic Service Area

The Contractor shall provide their Managed MFA Service statewide.

The Bidder understands and shall meet or exceed the Requirements identified in Section 530.2 Managed Multi-Factor Authentication Service? Choose an item.

530.3 SERVICE LEVEL AGREEMENTS (SLA)

The Contractor shall provide Service Level Agreements (SLAs) as set forth below. The intent of this section is to provide Customers, the CALNET Program and the Contractor with Requirements that define and assist in the management of the SLAs. This section includes the SLA formats, general Requirements, Stop Clock Conditions, and the Technical SLAs for the Services identified in this solicitation.

530.3.1 Service Level Agreement Format

The Contractor shall adhere to the following format and include the content as described below for each Technical SLA added by the Contractor throughout the Contract Term:

SLA Name – Each SLA Name must be unique;

Definition - Describes what performance metric will be measured;

Measurements Process - Provides instructions on how the Contractor will continuously monitor and measure SLA performance to ensure compliance. The Contractor shall provide details describing how and what will be measured. Details should include source of data and define the points of measurement within the system, application, or network;

Service(s) - All applicable Services will be listed in each SLA;

Objective(s) – Defines the SLA performance goal/parameters; and, Rights and Remedies Per Occurrence: Rights and remedies are paid on a per event basis during the bill cycle; and, Monthly Aggregated Measurements: Rights and Remedies (as set forth below) are paid once during the bill cycle based on an aggregate of events over a defined period of time.

The Contractor shall proactively apply a credit or refund when an SLA Objective is not met. CALNET SLA Rights and Remedies do not require the Customer to submit a request for credit or refund.

530.3.2 Technical Requirements versus SLA Objectives

Sections 530.2 (Managed Muti-Factor Authentication Service) define the technical Requirements for each Service. These Requirements are the minimum parameters each Bidder must meet to qualify for Contract Award. Upon Contract award the committed technical Requirements will be maintained throughout the remainder of the Contract.

Committed SLA Objectives are minimum parameters which the Contractor shall be held accountable for all Rights and Remedies throughout the Contract Term.

530.3.3 Methods of Outage Reporting: Customer or Contractor

There are two methods in which CALNET Service failures or quality of Service issues may be reported and Contractor trouble tickets opened: Customer reported, or Contractor reported.

The first method of outage reporting results from a Customer reporting Service trouble to the Contractor’s Customer Service Center via phone call, opening of a trouble ticket, or through the Contractor’s portal.

The second method of outage reporting occurs when the Contractor opens a trouble ticket as a result of network/system alarm or other method of Service failure identification. In each instance the Contractor shall open a trouble ticket and monitor and report to Customer until Service is restored.

530.3.4 Response to Service Level Agreements

Many of the Service Level Agreements described below include multiple Objective levels – Basic, Standard and Premier. Bidders shall indicate one specific Objective level they are committing to for each Service in the space provided in the “Objective” section of each SLA description.

530.3.5 Contractor SLA Management Plan

Within 90 calendar days of Contract Award, the Contractor shall provide the CALNET Program with a detailed SLA Management Plan that describes how the Contractor will manage the Technical SLAs for Services in this IFB. The plan will be updated as needed by the Contractor and the State throughout the Contract Term. The SLA Management Plan shall define the following:

Contractor SLA manager and supporting staff responsibilities;

Contractor’s process for measuring Objectives for each SLA. The process shall explain how the Contractor will continuously monitor and measure SLA performance to ensure compliance. The Contractor shall provide details describing how and what will be measured. Details should include source of data and define the points of measurement;

Creation and delivery of SLA Reports;

SLA invoicing credit and refund process;

Contractor SLA problem resolution process for SLA management and SLA reporting. The Contractor shall provide a separate process for Customers and CALNET Program;

Contractor SLA Manager (including contact information) to manage all SLA compliance and reporting; and, The Contractor shall include SLA Manager contact information for SLA inquiries and issue resolution for Customer and CALNET Program.

530.3.6 Technical SLA General Requirements

The Contractor shall adhere to the following general Requirements which apply to all CALNET Technical SLAs (Section 530.3.8):

With the exception of the Provisioning SLA (Section 530.3.8.3), the total SLA rights and remedies for any given month shall not exceed the sum of 100% of the Total Monthly Recurring Charges (TMRC);

If a Service fails to meet one or more of the performance Objectives, only the SLA with the largest monthly Rights and Remedies will be credited to the Customer, per month;

The Contractor shall apply CALNET SLAs and Rights and Remedies for Services provided by Subcontractors and Affiliates;

The Definition, Measurement Process, Objectives, and Rights and Remedies shall apply to all Services identified in each SLA. If a Category is listed in the SLA, then all Services and Features under that Category are covered under the SLA. SLAs apply to both Services and Features. Exceptions must be otherwise stated in the SLA;

TMRC Rights and Remedies shall include the Service, option(s), and Feature(s) charges.

The Contractor shall proactively and continuously monitor and measure all Technical SLA Objectives.

The Contractor shall proactively credit all Rights and Remedies to the Customer within 60 calendar days of the trouble resolution date on the trouble ticket or within 60 calendar days of the Due Date on the Service Request for the Provisioning SLA.

To the extent that the Contractor offers additional SLAs, or SLAs with more advantageous rights and/or remedies for the same or similar services offered through tariffs, online service guides, or other similarly situated government contracts (Federal, State, County, City), the State will be entitled to the same rights and/or remedies therein. The Contractor shall present the SLAs to CALNET Program for possible inclusion via amendment;

The Contractor shall apply CALNET 5 CMCS SLA Rights and Remedies to Services provided in all areas the Contractor provides Service;

The election by CALNET Program of any SLA Rights and Remedies covered by this Contract shall not exclude or limit CALNET Program or any Customer's Rights and Remedies otherwise available within the Contract or at law or equity;

The Contractor shall apply Rights and Remedies when a Service fails to meet the SLA Objective even when backup or protected Services provide the Customer with continuation of Services;

The Contractor shall act as the single point of contact in coordinating all entities to meet the State’s needs for provisioning, maintenance, restoration and resolution of Service issues or that of their Subcontractors and Affiliates under this Contract;

The Customer Escalation Process and/or the CMO Escalation Process shall be considered an additional Right and Remedy if the Contractor fails to resolve Service issues within the SLA Objective(s);

Trouble reporting and restoration shall be provided 24x7 for CALNET Services;

SLAs apply 24x7 unless the SLA specifies an exception;

The Contractor invoices shall clearly cross reference the SLA credit to the Service ID in accordance with SOW Business Requirements Section CMCS-G1.5 (Invoicing);

The Contractor shall provide a CALNET 5 CMCS SLA Manager responsible for CALNET 5 CMCS SLA compliance. The SLA Manager shall attend regular meetings and be available upon request to address CALNET Program SLA oversight, report issues, and problem resolution concerns. The CALNET 5 CMCS SLA Manager shall also coordinate SLA support for Customer SLA inquiries and issue resolution; and, The Contractor shall provide Customer and CALNET Program support for SLA inquiries and issue resolution.

530.3.7 Trouble Ticket Stop Clock Conditions

Only the following conditions shall be allowed to stop the duration of the Service Level Agreements. The Contractor shall document durations using the SCC listed in Table 530.3.7, which must include start and stop time stamps in the Contractor’s trouble ticket reporting tool or Contractor’s provisioning service request tool for each application of a SCC.

The Contractor shall not consider “cleared while testing” or “no trouble found” as a SCC.

The Contractor observation timeframes, not requested by End-User, after incident resolution shall not be included in Outage Duration reporting.

Table 530.3.7 – Stop Clock Conditions

Access necessary to correct the problem is not available because access has not been arranged by site contact or End-User representative;

Site contact refuses access to technician who displays proper identification;

The Customer provides incorrect site contact information which prevents access, provided that the Contractor takes reasonable steps to notify End-User of the improper contact information and takes steps to obtain the correct information; or, Site has limited hours of business that directly impacts the Contractor’s ability to resolve the problem.

If it is determined later that the cause of the problem was not at the site in question, then Access SCC shall not apply.

530.3.8 Technical Service Level Agreements (SLAs)

The Contractor shall provide and manage the following Technical SLAs.

530.3.8.1 Service Availability (M-S)

SLA Name: Service Availability Definition:

The percentage of time a CALNET Managed Multi-Factor Authentication Service is Fully Functional and available for use each calendar month.

Measurement Process:

The monthly Availability percentage shall be calculated using the following formula:

((Scheduled Uptime – Unavailable Time) / Scheduled Uptime) x 100% Unavailable Time shall be calculated on the accumulative total of all Unavailable Time derived from all trouble tickets closed for the affected Service ID per calendar month. All Unavailable Time applied to other SLAs which result in a Remedy will be excluded from the monthly accumulated total.

The Service Availability calculation shall exclude approved Contractor or Customer scheduled maintenance windows.

Services:

Managed Muti-Factor Authentication Service Objectives:

The objective will be based on the service Type identified in the table below:

(B, S or P)

Rights and Remedies:

Per Occurrence:

N/A Monthly Aggregated Measurements:

The first month the Service fails to meet the committed SLA objective shall result in a 25% credit or refund of the TMRC.

The second consecutive month the Services fails to meet the committed SLA objective shall result in a 35% credit or refund of TMRC.

Each additional consecutive month the Service fails to meet the committed SLA objective shall result in a 50% credit or refund of the TMRC.

530.3.8.2 MFA Time-to-Authenticate (TTA) (M-S)

SLA Name: MFA Time-to-Authenticate (TTA) Definition:

MFA Time-to-Authenticate (TTA) measures the time from when the Contractor’s MFA service receives an authentication request to when the service returns the final allow/deny decision, excluding End-User interaction time (e.g., time waiting for user approval/input) and excluding delays due to Customer networks, physical authentication systems, or Customer-managed identity providers.

TTA is measured from the moment the authentication request is submitted to the Managed Multi-Factor Authentication Service until the Service returns the final authentication decision. This measurement applies to all supported authentication methods and flows provided under the Managed Multi-Factor Authentication Service.

Measurement Process:

The Contractor shall continuously collect timestamped authentication telemetry for all Managed Multi-Factor Authentication transactions associated with each End-User. For each authentication attempt where the Service is reachable and functioning, the Contractor shall record:

The timestamp when the Managed Multi-Factor Authentication challenge is initiated by the Service; and, The timestamp when the Service returns an allow or deny decision.

TTA shall be calculated as the difference between these two timestamps.

The Contractor shall utilize a 95th Percentile (P95) calculation in determining Time-to-Authenticate response times for monthly SLA reporting Requirements. The P95 measurement will account for outlier requests outside the control of the Contractor.

The Contractor shall calculate the P95 performance metric as described below:

Compile a list of all valid Customer authentication attempts in ascending order from smallest to largest.

Remove any authentication attempts meeting the Requirements of Section 530.3.7, Stop Clock Conditions (SCC).

Multiply the total number of data points to determine the P95 rank within the Contractor’s data set.

P95 rank = 0.95×(N+1), using the Contractor’s calculated number of valid attempts and round to the nearest whole number.

Use the P95 rank associated response time as the Contractor’s Time-to-Authenticate metric for the reporting month.

SLA Rights and Remedies are applied when the measured 95th percentile Time to Authenticate for the calendar month exceeds the committed Basic Objective, excluding transactions impacted by SCC defined in Section 530.3.7.

Example of a Missed SLA Calculation and Application This example is provided solely to illustrate the required calculation methodology and does not provide usable data; all values shall be derived from Customer use of the Contractor’s managed service.

The Contractor shall perform the following calculation using the Contractor’s own month of timestamped authentication telemetry, after applying all applicable SCC.

Measurement Period: Each calendar month.

Valid authentication attempts after exclusions: 100,000 (example of a Customers calculated number of valid attempts).

95th Percentile Calculation: Rank = 0.95×(N+1), using the Customers calculated number of valid attempts.

Example Calculation: Rank = 0.95 × (100,000+1) = 95,000.95 Rounded to nearest whole number = 95,001st entry in Contractor’s data set.

Contractor’s TTA response time based 95th percentile calculation (95,001 entry in the data set) correlates to a 3.3 second response time based on Bidder’s data set.

Bidder’s Commitment Objective: Premier (P) ≤ 3 seconds Missed Premier SLA Objective results in Rights and Remedies being issued to the Customer.

Services:

Managed Muti-Factor Authentication Service Objectives:

The Objective Time-to-Authenticate for 95% of authentication requests will be:

(B, S or P)

Rights and Remedies:

Per Occurrence:

50% credit or refund of the TMRC for each End-User Service not meeting the committed Objective for each calendar month.

Monthly Aggregated Measurements:

N/A

530.3.8.3 Provisioning (M-S)

SLA Name: Provisioning Definition:

Provisioning shall include new Services, moves, adds, changes, and disconnects/deletes, completed by the Contractor on or before the due dates. The Provisioning SLA shall be based on committed installation intervals established in this SLA or due dates negotiated between the Customer and the Contractor documented on the Contractor’s order confirmation notification or Managed Project Work, Scope Of Work, in accordance with SOW Business Requirements Section CMCS-G1.3.3, Provisioning and Implementation. The Contractor shall meet the committed interval dates or due date negotiated with the Customer. If the Customer agrees to a negotiated due date, the negotiated due date supersedes the committed interval. At the Customer’s discretion, if the scope of the Service Request(s) meets the Managed Project criteria, negotiated due dates will be established and documented in the Project Timeline per SOW Business Requirements Section CMCS-G1.14.1, Managed Project Work General Requirements.

Features must be installed in conjunction with the Service except when listed below.

Provisioning SLAs have two Objectives:

Objective 1: Individual Service installation; and, Objective 2: Successful Install Monthly Percentage by service type.

Measurement Process:

Objective 1: Individual Service Installations:

Install intervals are based on the committed installation intervals established in this SLA or due dates negotiated between the Customer and the Contractor. This Objective requires the Contractor to meet the due date for each individual Service installation. This includes individual Service installations for Managed Projects.

Objective 2: Successful Install Monthly Percentage per Service Type:

The Contractor shall sum all individual installations per Service, as listed below, meeting the Objective in the measurement period and divide by the sum of all individual Service installations due per Service in the measurement period and multiply by 100 to equal the percentage of Service installations completed on time. The Contractor must meet or exceed the Objective below in order to avoid the Rights and Remedies.

Services:

Managed Muti-Factor Authentication Service Objectives:

Objective 1: Individual Service installation: Service provisioned on or before the due date per installation Service Request.

Objective 2: Monthly Average percent by Service Type:

(B or P)

Rights and Remedies:

Per Occurrence:

Objective 1: Individual Service installations: 50% of installation fee credited to the Customer for any missed committed Objective.

Monthly Aggregated Measurements:

Objective 2: 100% of the installation fee credited to the Customer for all Service installations (per Service Type) that did not complete within the committed Objective during the month if the Successful Install Monthly Percentage is below the committed Objective.

530.3.8.4 Service Enhancement SLAs

All Service enhancements shall be considered a Feature of the Service and therefore shall be included as such under the SLAs.

530.5.8.5 Non-Mandatory Service Offerings

The Contractor shall provide SLAs as defined in SLA Section 530.5.8 for each Service added after Contract Award via Contract amendment that is determined by the CALNET Program not to be a Feature of a Service or a component of an unbundled Service. SLA tables shall be amended at time of Contract amendment to include all new Services.

530.3.8.6 Contract Amendment Service Enhancement SLAs

All Contract amendments for Service enhancements shall be considered a Feature of the Service, therefore included as such under the SLAs as defined in Section 530.3.

The Bidder understands and shall meet or exceed the Requirements identified in Section 530.3 Service Level Agreements (SLA)? Choose an item.