7._Exhibit_C_C5-CMCS-G1_531_IRR_Tech_SOW_063026.docx

Bidder’s Name

INVITATION FOR BID

IFB C5-CMCS-G1-26

CALNET Managed Cybersecurity Services

CATEGORY 531 – MANAGED INCIDENT RESPONSE RETAINER SERVICE

<Enter Bidder Name Here> Statement of Work

TECHNICAL REQUIREMENTS

JUNE 30, 2026

Issued by:

STATE OF CALIFORNIA

Office of Statewide Technology Procurement PO Box 1810 Rancho Cordova, CA 95741 Disclaimer: The original PDF version and any subsequent addenda to this IFB remain the official version. In the event of any inconsistency between the Bidder’s versions, articles, attachments, exhibits, specifications, or provisions, which constitute the Contract, the official State version of the IFB in its entirety shall take precedence.

ADDENDUM LOG

Table of Contents

Statement of work TECHNICAL REQUIREMENTS Category 531 MANGED Incident Response Retainer Service

531.1 OVERVIEW

The California Department of Technology (CDT), Office of Statewide Technology Procurement (OSTP) is requesting proposals from responsive Bidders to provide Managed Incident Response Retainer (IRR) Services and Features.

This Invitation for Bid (IFB) CMCSC5-CMCS-G1-26 Category 531 provides the State’s solicitation for best value solutions for Managed IRR Service. This IFB also describes the technical Requirements necessary to support the CALNET Program Requirements.

This IFB will be awarded to Bidders that meet the award criteria as described in IFB C5-CMCS-G1-26 Part 1, Bid Evaluation. The CALNET 5 CALNET Managed Cybersecurity Services (CMCS) Contract(s) that result from the award of this IFB will be managed on a day-to-day basis by CALNET Management and Oversight (CMO).

531.1.1 Bidder Response Requirements

Throughout this IFB, the Bidder is required to confirm their understanding and acceptance of the Requirements by selecting a response in the provided drop-down field.

Example:

“The Bidder understands and shall meet or exceed the Requirements identified in Section 531.X Section Name? Choose an item.”

531.1.2 Designation of Requirements

All technical Requirements specified in this IFB are mandatory and must be responded to as identified in IFB Part 1, SOW mandatory technical Requirements by the Bidder. Additionally, some mandatory Requirements are “Mandatory-Scorable” and are designated as “(M-S).”

531.1.3 Statewide Policies and Standards

The Contractor’s Managed IRR Service shall be aligned with policies and standards set forth in the Statewide Information Management Manual (SIMM) Section 5300, Information Security (SIMM 5340-A Incident Reporting and Response Instructions, and SIMM 5340-C Requirements to Respond to Incidents Involving a Breach of Personal Information).

531.1.4 Pacific Time Zone

Unless specified otherwise, all Requirements are stated in the Pacific Time Zone and the Contractor shall use the Pacific Time Zone.

The Bidder understands and shall meet or exceed the Requirements identified in Section 531.1 Overview? Choose an item.

531.2 MANAGED INCIDENT RESPONSE RETAINER SERVICE

The Contractor’s Managed IRR Service provides Customers with on-demand access to expert incident response capabilities to prepare for, investigate, contain, and recover from cybersecurity incidents.

531.2.1 Managed IRR Service and Features

The Contractor shall provide an active incident response retainer Service that ensures 24x7x365 availability of qualified responders; rapid activation and triage; and the ability to mobilize technical, forensic, and investigative resources as needed.

The Contractor’s IRR Service shall ensure that response personnel performing incident response, digital forensics, malware analysis, threat intelligence, and incident coordination functions possess demonstrated knowledge, skills, and abilities consistent with the applicable work roles defined in NIST-NICE Workforce Framework.

Incident response activities shall operate under a shared responsibility model, under which specific response functions may be delegated to the Contractor while overall governance and decision authority remain with the Customer, except where explicitly authorized. The Contractor shall not take unilateral actions that materially impact Customer systems, services, or data, nor disclose incident-related information outside of authorized coordination channels, except as approved by the Customer or required by law. The Contractor shall protect Customer information accessed during incident response activities, including information accessed through privileged system access.

The Contractor shall adhere to the principle of least privilege when accessing Customer systems during incident response activities. Privileged access granted to the Contractor shall be limited to the minimum scope, duration, and permission level necessary to perform the specific response function authorized by the Customer.

The Contractor shall not retain, store, or reuse Customer-provisioned credentials, privileged account tokens, or authentication material beyond the duration of the authorized response engagement without explicit written Customer approval.

The Contractor shall not create, modify, or expand privileged accounts, service accounts, or access roles on Customer systems without prior written Customer authorization. Emergency or containment actions requiring privileged access shall be limited to actions that have been pre-authorized by the Customer as part of the IRR provisioning and onboarding, incident response plans, or documented response playbooks.

The Contractor shall immediately notify the Customer of any privileged account activity performed during incident response, including the account used, systems accessed, actions taken, and timestamps. The Contractor shall support the Customer in revoking or rotating all credentials and privileged access temporarily provisioned for the Contractor upon conclusion of each IRR engagement or upon Customer request.

Systems or applications designated by the Customer as sensitive, including but not limited to identity and access management platforms, certificate authorities, financial or human resources systems, systems processing personal information or protected health information, operational technology, or air-gapped environments, shall be subject to elevated handling procedures defined during provisioning and onboarding. The Contractor shall document and obtain Customer approval before accessing or interacting with such systems. The Contractor shall not extract, copy, or transmit data from sensitive systems beyond what is minimally necessary for evidence collection and incident scoping, and only in accordance with the Customer's data handling and classification requirements.

The Contractor shall maintain detailed logs of all privileged access activity performed during IRR engagements, including system names, account identifiers, actions performed, and timestamps, and shall provide these logs to the Customer upon request or at the conclusion of the engagement. All remote access sessions involving privileged accounts shall be conducted over encrypted, authenticated channels and, where technically feasible, recorded or monitored in accordance with Customer requirements.

The Contractor’s IRR Service includes response readiness, activation, initial remote triage, containment guidance, and incident coordination activities necessary to support the Customer during an active cybersecurity event.

The Contractor's Managed IRR Services shall include the following Services and Features at a minimum.

531.2.1.1 Provisioning and Onboarding

The Contractor shall establish and maintain an active Incident Response Retainer that includes Customer onboarding, environment familiarization, and the development, review, or integration of incident response governance, escalation paths, communication protocols, and incident coordination procedures.

As part of onboarding, the Contractor shall collaborate with the Customer to review, integrate with, or assist in the development of the Customer’s Incident Response Plan, including defined roles, responsibilities, escalation criteria, communication procedures, and the Contractor’s authority to act during cybersecurity incidents. The Contractor’s services shall align with the Customer’s documented incident response procedures and applicable statewide coordination Requirements.

The Contractor shall work with the Customer to identify and document incident notification and coordination Requirements, including circumstances under which coordination with statewide or external entities may be required, and to define communication pathways and responsibilities to ensure appropriate entities are notified and engaged in a timely manner during cybersecurity incidents.

Environment familiarization shall be substantive and shall include, at a minimum, review of relevant network and system architecture, identity and access management constructs, endpoint management and logging coverage, and communication paths required to support rapid and effective incident response.

As part of onboarding process or effort, the Contractor shall provide initial baseline orientation or training to the Customer to ensure familiarity with incident response processes, procedures, roles, escalation mechanisms, and expectations associated with the Contractor’s Managed Incident Response Retainer Service.

At a minimum, this orientation shall address:

Incident identification, declaration, and activation criteria;

Roles and responsibilities of the Customer and the Contractor during incident response;

Escalation procedures and decision authority;

Communication and reporting mechanisms; and Coordination expectations during active incidents.

The Contractor shall support or facilitate tabletop exercises, scenario walkthroughs, or readiness reviews to validate understanding of incident response procedures and confirm that roles, escalation paths, and communication processes are operational prior to an actual incident.

The Contractor shall validate Customer points of contact, establish secure communication channels, and confirm access methods required to support rapid response activities.

531.2.1.1.1 IRR Readiness Completion Notice

The Contractor shall provide the Customer with an IRR Readiness Completion Notice documenting Incident Response Retainer onboarding and readiness activities have been completed.

The Contractor shall provide a timeframe commitment for delivering the IRR Readiness Completion Notice in Table 531.3.8.2 Provisioning (M-S) in the Technical Service Level Agreements, Section 531.3.8.

The Contractor’s Completion Notice shall include the following items at a minimum:

Documentation of Customer incident response points of contact;

Identification of secure communication and activation methods for initiating IRR Services;

Documentation of incident response escalation paths, coordination procedures, and Contractor roles and responsibilities; and, Confirmation that the Contractor is operationally prepared to activate and deliver IRR Services in accordance with the Contract.

The Contractor must obtain Customer acceptance and approval of the IRR Completion Notice in writing, within 30 calendar days of confirmation that the Contractor has completed onboarding activities and is operationally prepared to render IRR activities.

531.2.1.1.2 Tabletop Exercises and Readiness Reviews

The Contractor shall plan, facilitate, and document at minimum one tabletop exercise per Contract year to validate the Customer’s incident response procedures, confirm role and responsibility assignments, test escalation paths, and verify that communication and coordination processes are operational and understood by all relevant stakeholders.

The initial tabletop exercise shall be initiated within 90 calendar days of the IRR Readiness Completion Notice acceptance, as documented in Section 531.2.1.1.1. Subsequent annual exercises shall be completed within twelve months of the prior exercise.

Each Tabletop exercise shall, at a minimum:

Be scenario-based and reflect realistic cybersecurity threat categories applicable to the Customer’s environment, such as ransomware or destructive malware, business email compromise or credential theft, data exfiltration or breach of personal information, or insider threat or unauthorized access;

Be conducted in a discussion-based format led by a qualified Contractor facilitator with documented experience in incident response exercise design and facilitation;

Include a minimum of three exercise injects or decision points designed to test incident detection, escalation, and containment decisions;

Engage Customer personnel in relevant incident response roles, including designated points of contact, technical staff, and, where applicable, executive or management stakeholders; and, Address applicable statewide coordination requirements, including circumstances under which notification to CDT or other state entities may be required.

Within fifteen business days following completion of each tabletop exercise, the Contractor shall provide the Customer with a written After-Action Report (AAR). The AAR shall include, at a minimum:

A summary of the exercise scenario, objectives, and participant roles;

Identification of strengths observed in the Customer’s incident response capabilities;

Identification of gaps, areas for improvement, or procedural deficiencies observed during the exercise;

Prioritized corrective action recommendations with suggested remediation timelines; and, Recommended updates to the Customer’s Incident Response Plan, escalation procedures, or communication protocols based on exercise findings.

Tabletop exercise facilitation and After-Action Report deliverables are included in the monthly Managed IRR recurring price. Additional or optional exercises requested by the Customer beyond the annual minimum, or functional drills requiring live system interaction or technical execution, shall be billed under the hourly Managed IRR Consulting Services defined in Section 531.2.3.1

531.2.1.2 Monitoring, Response Availability, and Mobilization The Contractor shall maintain continuous 24x7x365 availability of qualified incident responders who can be activated on-demand. The Contractor’s IRR Service shall include activation, initial triage, scoping, containment guidance, and incident coordination activities. When required, additional on-stie hands-on technical, forensic, investigative, or remediation support may be provided under the hourly Consulting Services defined in Section 531.2.4.5.

531.2.1.3 Incident Analysis, Containment, and Remediation Support The Contractor shall, upon Customer request or authorized activation, perform initial incident triage, conduct scoping analysis, provide containment recommendations, and coordinate response activities with the Customer.

Technical labor such as evidence collection, deep forensic analysis, malware examination, extended containment engineering, and eradication efforts shall be performed under the hourly Consulting Services defined in Section 531.2.3.1.

531.2.1.4 Forensics, Threat Intelligence, and Reporting

The Contractor shall collect relevant evidence and correlate observed artifacts with known malicious activity and attacker behaviors to provide actionable context supporting detection, containment, eradication, and recovery activities.

Threat intelligence provided as part of the Managed IRR Service shall be narrowly scoped to information directly applicable to the incident and the Customer’s network defense operations, including, as applicable, observed or suspected tactics, techniques, and procedures (TTPs), indicators of compromise (IOCs), and recommended mitigations such as patches, configuration changes, or workarounds. Strategic or generalized threat actor profiling shall not be required unless specifically requested by the Customer.

Initial incident reports, executive summaries, and lessons-learned materials incorporating such incident-relevant threat intelligence are included in the monthly Managed IRR recurring price.

Where appropriate, the Contractor shall support timely sharing of incident-related threat information in commonly accepted, structured formats to enable coordination with authorized partners or other defenders, consistent with Customer direction and information-sharing restrictions.

The Contractor shall not disclose or share incident related information, including indicators, findings, or derived analysis, with any third-party without the Customer’s explicit authorization, except where disclosure is required by law.

The Contractor shall collect, preserve, and handle digital evidence in accordance with industry best practices and applicable standards, including National Institute of Standards and Technology guidance (e.g., NIST SP 800-61 and NIST SP 800-86).

The Contractor shall maintain documented chain of custody for all collected evidence, including identification of evidence source, collection method, date and time of acquisition, handling personnel, and any transfers or access events.

The Contractor shall ensure the integrity and authenticity of collected evidence through the use of validated collection methods and integrity verification techniques (e.g., cryptographic hashing), and shall protect evidence from unauthorized access, alteration, or destruction throughout its lifecycle.

Detailed forensic reporting, malware analysis documentation, and large-scale compromise assessments shall be billed under the hourly Consulting Services defined in Section 531.2.3.1.

531.2.1.5 Post-Incident Support and Continuous Improvement

The Contractor shall support the Customer in post-incident review activities, including recovery validation, response procedure refinement, and security control tuning. Participation in lessons-learned sessions is included in the IRR Service. Additional technical remediation work shall be billed under Consulting Services.

The Contractor shall conduct or participate in a post incident review and provide a summary of observations and recommendation within the following timeframes following Incident Resolution. For purposes of this Section, Incident Resolution means the point at which containment and recovery actions necessary to restore affected systems to normal operational status have been completed, or an interim corrective action plan has been documented and accepted by the Customer.

· Critical or High Severity Incidents: within five Business Days

· All Other Incidents: within ten Business Days If incident severity is not formally designated, the default timeframe shall be ten Business Days. Severity classification shall be based on the Customer’s determination or mutually agreed criteria and shall not be used to intentionally delay post-incident review activities.

Post-incident activities shall be performed in alignment with recognized industry best practices, including guidance published by the National Institute of Standards and Technology, the Customer’s incident response program requirements, and consistent with applicable California State Administrative Manual (SAM) and Statewide Information Management Manual (SIMM) requirements.

Activities requiring hands-on technical execution, forensic acquisition, deep malware analysis, reverse engineering, extended containment engineering, or multi-day investigative work shall not be considered part of the subscription IRR Service and shall instead be billed under the Managed IRR Consulting Services defined in Section 531.2.3.1.

The Contractor shall provide the Managed IRR Services and Features listed in Table 531.2.1.a.

Table 531.2.1.a – Managed IRR Service

Service

531.2.2 Contractor’s Initial Contact Response Time (M-S)

The Contractor shall ensure rapid response times when a cybersecurity event is suspected or identified by the customer.

Initial Contact Response Time is defined as the elapsed time from when the Customer’s Authorized End-User initiates an IRR activation request to the moment the Contractor completes Initial Contact with the Customer’s Authorized End-User. Initial Contact requires a live verbal engagement between the Contractor’s qualified security analyst and the Customer’s Authorized End-User, followed by a written confirmation via email documenting the activation request, the name and contact information of the assigned analyst, and the next steps the contractor will take. Initial Contact is not satisfied by an automated acknowledgement, ticketing system confirmation, or unmonitored email response.

For purposes of this section, a qualified security analyst is a Contractor employee or subcontractor who meets the minimum qualifications defined in Section 531.2.3.2.1 and has the knowledge and authority to initiate triage, ask scoping questions, and begin coordinating the Customer’s incident response activities.

The Customer may initiate an IRR activation request through any of the following methods:

· Phone call to the contractor’s designated 24x7 IRR activation line;

· Submission through the contractor’s designated IRR activation portal or ticketing system; or,

· Email to the contractor’s designated IRR activation contact, where the contractor’s system generates a timestamped receipt confirming delivery.

Measurement of the Initial Contact Response Time shall begin at the earliest documented timestamp associated with the Customer’s activation request, regardless of the method used. The Contractor shall maintain timestamped records of all activation requests and Initial Contact engagements and shall make such record available to the Customer and the CALNET Program upon request.

The Contractor shall provide a commitment level for Initial Contact Time in Table 531.2.2.a below.

Table 531.2.2.a – Contractor’s Initial Contact Response Commitment Timeframe (M-S)

(B, S or P)

531.2.3 Additional Managed IRR Services and Features

531.2.3.1 Managed IRR Consulting Services

The Contractor’s Managed IRR Consulting Services shall only be utilized in conjunction with the Contractor’s CALNET Category 531 - Managed IRR Service.

The Contractor’s Managed IRR Consulting Services shall provide billable technical labor for incident response activities that exceed Requirements in Section 531.2.1.

The Contractor’s Managed IRR Consulting Services are only to be used for those Consulting Services described below and are considered outside the instance of a working Service as defined by the General Provisions – Telecommunications, Section 15.12, Goods and Services Costs.

The Contractor’s Managed IRR Consulting Services classifications of hours will be as follows:

Regular Hours – Hours worked between 8:00 a.m. and 4:59 p.m., Monday through Friday.

Overtime Hours – Hours worked between 5:00 p.m. and 7:59 a.m., Monday through Friday and all-day Saturday, Sunday, or State of California holidays.

When coordinated scheduling for projects between the Customer and the Contractor occurs, the Customer and the Contractor may mutually agree, in writing, that hours worked between 5:00 p.m. and 7:59 a.m., Monday through Friday and all-day Saturday, Sunday, or State of California holidays can be classified as Regular Hours in accordance with the State of California Department of Industrial Relations.

Consulting Services shall be billed hourly at the rates established in Table 531.2.3.1.a. below.

531.2.3.1.1 Technical Incident Response Support

The Contractor shall provide technical incident response consulting Services to assist Customers with:

Detailed incident triage and extended scoping;

Host- and network-based forensic acquisition and analysis;

Malware analysis and reverse engineering;

Deep log analysis, artifact review, and threat hunting;

Advanced containment engineering and eradication activities; and, Specialized analysis required for major or multi-agency incidents.

531.2.3.1.2 Incident Management and Coordination

The Contractor shall provide incident management and command-level consulting Services to assist Customers with Senior incident coordination and Incident Commander leadership;

Stakeholder communication and escalation management;

Regulatory, reporting, and compliance coordination;

Multi-agency or enterprise-wide incident response management; and, Documentation and support of recovery and eradication planning.

531.2.3.2 Minimum Personnel Qualifications for IRR Consulting Service Personnel assigned to provide Managed IRR Consulting Services shall be aligned to applicable work roles defined in the NIST-NICE Workforce Framework. NIST-NICE work role titles and identifiers referenced in this Section are provided for workforce alignment purposes. Contractors may map personnel to successor or equivalent NIST-NICE work roles where the framework is updated, provided the underlying work functions and competencies remain equivalent.

The Contractor shall ensure that all personnel assigned to provide Managed IRR Consulting Services possess the experience, skills, and documented capabilities necessary to perform the required activities.

The Contractor shall provide personnel who meet or exceed the minimum qualifications listed below.

Upon request by the CALNET Program or the Customer, the Contractor shall provide resumes, certifications, or documentation demonstrating compliance with these Requirements.

531.2.3.2.1 Senior Incident Responder

Minimum Qualifications (Aligned to NICE PD-WRL-003 – Incident Response) The Contractor’s personnel assigned to perform duties shall meet the following minimum qualifications:

A minimum of five (5) years of documented experience conducting cybersecurity incident response activities in enterprise environments.

Demonstrated experience performing incident triage, scoping, containment, eradication, and recovery, including at least three (3) incidents involving ransomware, credential compromise, lateral movement, cloud account compromise, or business email compromise.

Demonstrated proficiency with at least two (2) categories of investigative tools, including:

EDR platforms;

Network packet capture or traffic analysis tools; or, Memory analysis tools.

Demonstrated familiarity with adversary techniques based on MITRE ATT&CK or equivalent frameworks.

Preferred Certifications: GCIH, GCFA, GNFA, CISSP, CISM, OSCP.

531.2.3.2.2 Incident Commander

Minimum Qualifications (Aligned to NICE PD-WRL-003 – Incident Response) The Contractor’s Personnel assigned to perform Incident Commander duties shall meet the following minimum qualifications:

A minimum of seven (7) years of documented cybersecurity incident response experience, including acting as lead coordinator or commander for at least five (5) medium- or high-severity incidents.

Demonstrated experience producing executive-level communications, including situation reports, briefings, timelines, and incident summaries.

Demonstrated experience coordinating incident activities across multiple teams or agencies.

Demonstrated familiarity with incident response processes aligned to NIST SP 800-61.

Preferred Certifications: CISSP, CISM, GCIH, GCFE.

531.2.3.2.3 Digital Forensic Analyst

Minimum Qualifications (Aligned to NICE PD-WRL-002 – Digital Forensics) The Contractor’s Personnel assigned to perform Digital Forensics duties shall meet the following minimum qualifications:

A minimum of three (3) years of documented digital forensic analysis experience.

Demonstrated experience performing forensic imaging, evidence preservation, chain of custody documentation, and analysis of disk, memory, and log artifacts.

Demonstrated proficiency in at least one (1) industry-standard forensic tool, such as:

EnCase

FTK

X-Ways Cellebrite Magnet Axiom Preferred Certifications: EnCE, GCFA, CHFI.

(Note: Tool-specific certification may be required when necessary to support tool use.)

531.2.3.2.4 Malware Analyst / Reverse Engineer

Minimum Qualifications (Aligned to NICE IN-WRL-002 – Digital Evidence Analysis) The Contractor’s Personnel assigned to perform Malware Analysis duties shall meet the following minimum qualifications:

A minimum of three (3) years of documented malware analysis or reverse engineering experience.

Demonstrated proficiency using at least two (2) static or dynamic analysis tools, including:

IDA Pro Ghidra x64dbg or OllyDbg Cuckoo Sandbox Experience analyzing malware associated with at least three (3) categories, including ransomware, loaders, RATs, web shells, or credential harvesters.

Preferred Certification: GREM.

531.2.3.2.5 Threat Intelligence Analyst

Minimum Qualifications (Aligned to NICE PD-WRL-006 – Threat Analysis) The Contractor’s Personnel assigned to perform Threat Intelligence duties shall meet the following minimum qualifications:

A minimum of three (3) years of documented experience producing tactical or operational cyber threat intelligence.

Demonstrated experience using the MITRE ATT&CK framework for adversary mapping or threat correlation.

Demonstrated experience correlating threat intelligence with incident data to support scoping and containment.

Demonstrated experience producing written assessments or threat actor reports.

Preferred Certifications: CTIA, GCTI.

The Contractor shall offer all Managed IRR Consulting Services in Table 531.2.3.1.a.

Table 531.2.3.1.a – Managed IRR Consulting Services

Service

Service

Service

Service

Service

Service

Service

Service

Service

Service

531.2.4 Managed IRR Geographic Service Area

The Contractor shall provide their Managed IRR Service statewide.

531.2.4.5 Optional On-Site Incident Response Consulting Services

531.2.4.5.1 Optional On-Site Incident Response Consulting Services The Contractor may provide on-site Incident Response Consulting Services to assist Customers with the following on-site activities. The Contractor’s on-site Incident Response Consulting Services are only available for use in conjunction with the Contractor’s Category 531 – Managed IRR Service.

Physical forensic collections, interviews, chain of custody evidence gathering, and asset handling.

Containment or eradication assistance.

Response support where remote analysis is insufficient.

Support for incidents involving disconnected, air-gapped, or restricted systems.

531.2.4.5.2 Optional On-Site Incident Response Responder Minimum Qualifications Minimum Personnel Qualification Requirements (Aligned to NICE PD-WRL-003 – Incident Response) The Contractor’s Personnel assigned to perform on-site incident response duties shall meet the following minimum qualifications:

A minimum of three (3) years of hands-on incident response or cybersecurity investigation experience.

Demonstrated experience conducting host triage, log collection, evidence gathering, and endpoint isolation.

Demonstrated familiarity with evidence handling and physical chain of custody procedures.

Ability to support on-site response activities in disconnected, restricted, or sensitive environments.

Demonstrated ability to communicate effectively with Customer technical staff, management, and other stakeholders during incident response activities, including the ability to clearly explain technical findings, response actions, and next steps in both verbal and written form.

Demonstrated experience organizing, documenting, and presenting incident response activities and findings in a manner suitable for Customer review, coordination, and decision-making during active incidents.

Preferred Certifications: GCIH.

531.2.4.5.3 Optional On-Site Incident Response Geographic Service Area Regions Four Service Area Regions have been identified in Table 531.2.4.5.3.a below. By committing to Service Area Region(s) listed in the Table below, the Contractor shall provide on-site Managed IRR Service(s) to all counties identified within that region.

Table 531.2.4.5.3.a – Optional On-Site Managed IRR Support Geographic Service Area Regions

1. Butte

2. Colusa

3. Del Norte

4. Glenn

5. Humboldt

6. Lake

7. Lassen

8. Mendocino

9. Modoc

10. Nevada

11. Plumas

12. Shasta

13. Sierra

14. Siskiyou

15. Sutter

16. Tehama

17. Trinity

18. Yuba

1. Alpine

2. Amador

3. Calaveras

4. El Dorado

5. Fresno

6. Inyo

7. Kings

8. Madera

9. Mariposa

10. Merced

11. Mono

12. Placer

13. Sacramento

14. San Joaquin

15. Stanislaus

16. Tulare

17. Tuolumne

18. Yolo

1. Alameda

2. Contra Costa

3. Marin

4. Monterey

5. Napa

6. San Benito

7. San Francisco

8. San Mateo

9. Santa Clara

10. Santa Cruz

11. Solano

12. Sonoma

1. Imperial

2. Kern

3. Los Angeles

4. Orange

5. Riverside

6. San Bernardino

7. San Diego

8. San Luis Obispo

9. Santa Barbara

10. Ventura

For Contractor’s providing on-site Incident Response Consulting Services, the Contractor shall indicate where their on-site Incident Response Consulting Services are available by identifying which region(s) are supported and the Contractor’s on-site arrival window in Table 531.2.4.5.3.b below.

The Contractor shall identify which regions their on-site Managed Incident Response Consulting Service is available by providing a commitment in Table 531.2.4.5.b – Contractor’s on-site Managed IRR Geographic Service Availability.

Table 531.2.4.5.3.b – Optional On-Site Contractor’s Geographic Service Offering and On-Site Arrival Commitment (D-S)

The Contractor may offer optional on-site Incident Response Consulting Services in Table 531.2.4.5.3.c in conjunction with their on-site arrival window commitment to the State in Table 531.2.4.5.3.b.

Table 531.2.4.5.3.c – Optional On-Site Incident Response Consulting Services

Service

Service

The Bidder understands and shall meet or exceed the Requirements identified in Section 531.2 Incident Response Retainer Service? Choose an item.

531.3 SERVICE LEVEL AGREEMENTS (SLA)

The Contractor shall provide Service Level Agreements (SLAs) as set forth below. The intent of this section is to provide Customers, the CALNET Program and the Contractor with Requirements that define and assist in the management of the SLAs. This section includes the SLA formats, general Requirements, Stop Clock Conditions, and the Technical SLAs for the Services identified in this solicitation.

531.3.1 Service Level Agreement Format

The Contractor shall adhere to the following format and include the content as described below for each Technical SLA added by the Contractor throughout the Contract Term:

SLA Name – Each SLA Name must be unique;

Definition - Describes what performance metric will be measured;

Measurements Process - Provides instructions on how the Contractor will continuously monitor and measure SLA performance to ensure compliance. The Contractor shall provide details describing how and what will be measured. Details should include source of data and define the points of measurement within the system, application, or network;

Service(s) - All applicable Services will be listed in each SLA;

Objective(s) – Defines the SLA performance goal/parameters; and, Rights and Remedies Per Occurrence: Rights and remedies are paid on a per event basis during the bill cycle; and, Monthly Aggregated Measurements: Rights and Remedies (as set forth below) are paid once during the bill cycle based on an aggregate of events over a defined period of time.

The Contractor shall apply a credit or refund when SLAs are missed as described in this section.

Missed Time-to-Activate SLA – Must be requested by the Customer:

Must be requested by the Customer when Time-to-Activate SLA Objective is not met. The Customer shall be responsible for providing specific details such as date(s), time(s), and documented requests or additional details that validate the Customer’s eligibility for the missed Time-to-Activate SLA. The Contractor shall accept SLA credit requests up to 60 calendar days after the missed Time-to-Activate SLA occurrence.

Missed Provisioning SLA – Proactively applied by Contractor:

The Contractor shall proactively apply a credit or refund when the Provisioning SLA Objective is not met. CALNET SLA Rights and Remedies for the Provisioning SLA do not require the Customer to submit a request for credit or refund.

531.3.2 Technical Requirements versus SLA Objectives

Sections 531.2 (Managed Incident Response Retainer Service), defines the technical Requirements for each Service. These Requirements are the minimum parameters each Bidder must meet to qualify for Contract Award. Upon Contract award the committed technical Requirements will be maintained throughout the remainder of the Contract.

Committed SLA Objectives are minimum parameters which the Contractor shall be held accountable for all Rights and Remedies throughout the Contract Term.

531.3.3 Methods of Outage Reporting: Customer or Contractor

There are two methods in which CALNET Service failures or quality of Service issues may be reported and Contractor trouble tickets opened: Customer reported, or Contractor reported.

The first method of outage reporting results from a Customer reporting Service trouble to the Contractor’s Customer Service Center via phone call, opening of a trouble ticket, or through the Contractor’s portal.

The second method of outage reporting occurs when the Contractor opens a trouble ticket as a result of network/system alarm or other method of Service failure identification.

531.3.4 Response to Service Level Agreements

Many of the Service Level Agreements described below include multiple Objective levels – Basic, Standard and Premier. Bidders shall indicate one specific Objective level they are committing to for each Service in the space provided in the “Objective” section of each SLA description.

531.3.5 Contractor SLA Management Plan

Within 90 calendar days of Contract Award, the Contractor shall provide the CALNET Program with a detailed SLA Management Plan that describes how the Contractor will manage the Technical SLAs for Services in this IFB. The plan will be updated as needed by the Contractor and the State throughout the Contract Term. The SLA Management Plan shall define the following:

Contractor SLA manager and supporting staff responsibilities;

Contractor’s process for measuring Objectives for each SLA. The process shall explain how the Contractor will continuously monitor and measure SLA performance to ensure compliance. The Contractor shall provide details describing how and what will be measured. Details should include source of data and define the points of measurement;

Creation and delivery of SLA Reports;

SLA invoicing credit and refund process;

Contractor SLA problem resolution process for SLA management and SLA reporting. The Contractor shall provide a separate process for Customers and CALNET Program;

Contractor SLA Manager to manage all SLA compliance and reporting; and, The Contractor shall include SLA Manager contact information for SLA inquiries and issue resolution for Customer and CALNET Program.

531.3.6 Technical SLA General Requirements

The Contractor shall adhere to the following general Requirements which apply to all CALNET Technical SLAs (Section 531.3.8):

With the exception of the Provisioning SLA (Section 531.3.8.3), the total SLA rights and remedies for any given month shall not exceed the sum of 100% of the Total Monthly Recurring Charges (TMRC);

If a Service fails to meet one or more of the performance Objectives, only the SLA with the largest monthly Rights and Remedies will be credited to the Customer, per month;

The Contractor shall apply CALNET SLAs and Rights and Remedies for Services provided by Subcontractors and Affiliates;

The Definition, Measurement Process, Objectives, and Rights and Remedies shall apply to all Services identified in each SLA. Exceptions must be otherwise stated in the SLA;

TMRC Rights and Remedies shall include the Service, option(s), and Feature(s) charges.

The Contractor shall proactively and continuously monitor and measure all Technical SLA Objectives.

The Contractor shall proactively credit all Rights and Remedies to the Customer within 60 calendar days of the trouble resolution date on the trouble ticket or within 60 calendar days of the Due Date on the Service Request for the Provisioning SLA.

To the extent that the Contractor offers additional SLAs, or SLAs with more advantageous rights and/or remedies for the same or similar services offered through tariffs, online service guides, or other similarly situated government contracts (Federal, State, County, City), the State will be entitled to the same rights and/or remedies therein. The Contractor shall present the SLAs to CALNET Program for possible inclusion via amendment;

The Contractor shall apply CALNET 5 CMCS SLA Rights and Remedies to Services provided in all areas the Contractor provides Service;

The election by CALNET Program of any SLA Rights and Remedies covered by this Contract shall not exclude or limit CALNET Program or any Customer's Rights and Remedies otherwise available within the Contract or at law or equity;

The Contractor shall apply Rights and Remedies when a Service fails to meet the SLA Objective even when backup or protected Services provide the Customer with continuation of Services;

The Contractor shall act as the single point of contact in coordinating all entities to meet the State’s needs for provisioning, maintenance, restoration and resolution of Service issues or that of their Subcontractors and Affiliates under this Contract;

The Customer Escalation Process and/or the CMO Escalation Process shall be considered an additional Right and Remedy if the Contractor fails to resolve Service issues within the SLA Objective(s);

Trouble reporting and restoration shall be provided 24x7 for CALNET Services;

SLAs apply 24x7 unless the SLA specifies an exception;

The Contractor invoices shall clearly cross reference the SLA credit to the Service ID in accordance with SOW Business Requirements Section CMCS-G1.5 (Invoicing);

The Contractor shall provide a CALNET 5 CMCS SLA Manager responsible for CALNET 5 CMCS SLA compliance. The SLA Manager shall attend regular meetings and be available upon request to address CALNET Program SLA oversight, report issues, and problem resolution concerns. The CALNET 5 CMCS SLA Manager shall also coordinate SLA support for Customer SLA inquiries and issue resolution; and The Contractor shall provide Customer and CALNET Program support for SLA inquiries and issue resolution.

531.3.7 Trouble Ticket Stop Clock Conditions

Only the following conditions shall be allowed to stop the duration of the Service Level Agreements. The Contractor shall document durations using the Stop Clock Condition (SCC) listed in Table 531.3.7, which must include start and stop time stamps in the Contractor’s trouble ticket reporting tool or Contractor’s provisioning service request tool for each application of a SCC.

The Contractor shall not consider “cleared while testing” or “no trouble found” as a SCC.

The Contractor observation timeframes, not requested by End-User, after incident resolution shall not be included in Outage Duration reporting.

Table 531.3.7 – Stop Clock Conditions