8-08 Exh. H - Enterprise LMS Renewal SOW 2026.pdf

2095023

Dallas Area Rapid Transit Authority

Dallas, Texas

EXHIBIT H

STATEMENT OF WORK

SumTotal Learning Management (LMS) Licensing Agreement Renewal Dallas Area Rapid Transit Technology Department

1. Overview and Objective DART implemented SumTotal Learning Management to serve as the Enterprise LMS in July 2020. Since then, SumTotal LMS has been fully supporting all Agency training programs and employee development efforts. It also supports DART's compliance with transit and safety regulations.

2. Scope

2.1. User Base

SumTotal LMS services a user base of 4,000 employees. In addition, SumTotal provides 150 unique login licenses to accommodate DART external contractors who do not have active directory accounts but are required to take certain mandatory safety and security training.

2.2. Instructional Methodology

Most of the DART's training is currently delivered via Instructor-Led Training (ILT) classes or computer-based eLearning. SumTotal LMS also provides the following activity types: virtual sessions, on-the-job classes, quick assessments, observation checklists, curricula, training plans, and activity bundles.

2.3. Data Management

SumTotal LMS currently maintains integration with the DART HR system of records – Workday. This integration facilitates daily employee and organization information updates. DART currently has subscriptions to a third-party training content vendor – Udemy, which is also into the SumTotal LMS.

2.4. User Engagement

Gamification, chat, groups, and other elements of the Learning Experience Platform are not implemented in the SumTotal LMS; however, these functionalities will be considered as a possible future addition.

3. Key LMS Functionality Requirements

3.1. User Interface and Usability

The SumTotal LMS provides a straightforward graphical user interface and navigation for all levels of users:

- Learners are able to easily and efficiently navigate the LMS portal, search for courses, enroll in classes, access their Learner profile and transcript and receive reminders;

- Managers are able to easily maintain oversight of their team members' learning profiles and perform functions such as suggesting and enrolling employees in courses, assigning courses/learning plans, approving enrollment as needed, reporting on employees' learning progress;

- Instructors are able to easily access training schedules, enrollment information, class rosters, as well as have a way to update ILT courses completion in LMS.

3.2. Content Management

3.2.1. Course Delivery and Development: SumTotal LMS provides an array of instructional delivery methods (as mentioned in section 2.2), as well as the ability to combine multiple types of learning (i.e., ILT, eLearning, microlearning, webcasts, video, etc.) into a single blended curriculum.

3.2.2. Course Catalog Management:

• Content Library: SumTotal LMS provides a content library or course catalog that serves as a single source of all DART learning, including on-demand courses as well as scheduled courses.

• Search capability: SumTotal LMS provides a robust search capability across all content types using a variety of filters. Deep links functionality is supported as well.

• Administering training courses: Course scheduling must support a variety of different types of learning events:

- Single event courses: These courses are taken as a single event, however, may be offered multiple times in the catalog/library and should be easily replicated.

- Multi-event courses: Theses courses require participation in two or more scheduled events or recurring sessions.

- Complex curriculum courses: These courses require participation in both scheduled and self-service learning.

- In addition to course types listed above, SumTotal LMS provides flexibility to accommodate situations when curriculum does not have a regular schedule with events on recurring dates.

3.2.3. Course Access Controls: Course access is driven by Audiences, configurable parameters to restrict visibility and access only to appropriate users. Audiences are built based on organizational units, employee hierarchy, role/position, etc.

3.3. Training management

3.3.1. Registration management:

• The SumTotal LMS allows Learners to easily register for a variety of learning activities, such as ILT, eLearning, on-the-job training, etc.

• Managers are able to assign learning plans/courses to individual Learners and groups.

• Automatic enrollment can be configured based on configurable criteria such as organizational groups, Learner position/role in the agency, entering a new position in the agency, etc.

• Batch course enrollment is supported to allow Managers or Administrators to enroll multiple users into a single learning event.

• SumTotal LMS provides the ability to set participants limit for all courses, as well as create waitlist and track enrollment status.

3.3.2. Tracking and scheduling:

• SumTotal LMS provides Administrators and Managers the ability to easily track all types of learning events.

• Instructors have access to the following tools: Learner roster for an enrolled class; check-in and class attendance; tracking student performance, completion, feedback and document management.

• Instructors are able to manually edit tracking and completion data for ILT events.

3.3.3. Resource scheduling: SumTotal LMS supports scheduling physical classrooms, equipment and web-conference based learning events, as well as support managing instructor availability. The system supports the ability to assign all resources at a session level as well as course level and provide ability to assign multiple instructors to a course and/or session.

3.3.4. Notification system: SumTotal LMS is integrated with DART's email system, Microsoft Outlook, to allow seamless communication about learning events, including the following:

• Automatic notifications to Managers and Learners when registering for learning events and cancelling event enrollment

• Pre-event reminders for enrolled Learners

• Notification to Managers when direct reports' enrollment requires approval

• Automatic personalization of notification emails

3.4. Assessments and Quizzes

3.4.1. Course/Instructor Evaluations: SumTotal LMS provides tools to collect Learner feedback on both course and instructor performance, as well as the ability to measure level 1, 2 and 3 course evaluations set at predefined intervals (e.g., upon completion; 30, 60, 90 days after).

3.4.2. Individual Assessments, Tests and Quizzes: SumTotal LMS provides ability to create quizzes/tests satisfying the following parameters:

- Tests, exercises and surveys can be created from Q&A pools or question banks and imported from either a local/shared drive or 3rd party vendor;

- Multiple response formats are supported (multiple-choice, true/false, etc.);

- System allows to set parameters for tests and exercises such as duration, number of attempts allowed, passing scores, weighted sections;

- Test results can be auto-graded and analyzed by the system.

3.4.3. Assessment/Completion reporting: In addition to automatically tracking eLearning courses completion and ratings, SumTotal LMS provides a tool to allow the same functionality for ILT (e.g., ILT can easily update course completion in LMS).

3.5. Certificates and Continuing education

Beyond administering and delivering Learning Content, a critical component of the LMS is the ability to manage and report training compliance.

3.5.1. Certification requirements: SumTotal LMS supports assigning specific training, continuing education and certifications to Learners based on their role/position/group requirements.

3.5.2. Compliance documentation:

• LMS based training: For all training offered via Content Library/ Course Catalog that results in a formal completion Certificate, the system must be able to generate, track and store a template-based document. It must also have an option to upload, track and store an externally negate Certificate image/document.

• Externally offered training: Learners must be able to upload proof of completion (e.g.

certificate, letter, transcript, etc.) that can be reviewed and accepted by Manager or Administrator via an approval workflow. These completion documents should be easy to upload, track and store.

3.5.3. Renewal Notifications: For any required training/certification that needs periodic renewal, the LMS should track expiration dates and provide options for generating reminder notifications for Learners, Managers and Administrators.

3.6. Reporting and Analytics

SumTotal LMS provides an offering of canned standard reports that can be either ran on-demand or scheduled. Reports offer both graphical and textual representation of data and allow export to other applications, such as Microsoft Office tools. In addition to reports, LMS offers configurable dashboards that visually present key data. Access to reports and dashboards will be based on users' role permissions.

4. Key Technical Requirements

4.1. Overview of DART Technology

4.1.1. Hosted Environment

DART locally hosts enterprise class systems at a primary and secondary data center. Enterprise applications are hosted predominately on virtual servers on the Windows platform, as well as on HP Unix.

Windows servers are standard for other applications. The standard database management systems are Oracle and Microsoft SQL/Server. There are legacy interfaces between different application suites, however integration technology is rapidly migrating to integration Platform as a Service (iPaaS) and ETL solutions.

4.1.2. Major On-Premise Applications

Three ERP systems encompass core business functions: Lawson addresses Financials, Procurement, Materials Management and Human Resources. Trapeze is a transit specific solution that supports Transportation Operations. Its major capabilities include scheduling for rail and bus operations; customer service; dispatch; location services; and operational performance. Infor Spear is a maintenance management solution for DART assets. It is currently being replaced by a fully featured, hosted Enterprise Asset Management system (IBM Maximo).

4.1.3. Cloud Environment

DART evaluates cloud-based alternatives and deploys to the cloud when these solutions provide business value. Cloud principles, guidelines and strategy are in place to effectively migrate and manage cloud-based solutions. New applications, as well as applications scheduled for upgrade or replacement, are first evaluated for cloud suitability. Customer facing websites are delivered via PaaS. Several major business functions are SaaS or externally hosted services.

4.1.4. Network

All DART facilities are connected by a wide area IP network which also carries traffic for VoIP. The network is both logically and physically segmented, and firewall protected. Private Wi-Fi is deployed in all major operating facilities.

4.2. End User Technology Assumptions

4.2.1. Browsers:

- TLS 1.2 or better; https: enabled

- Google Chrome current release

- EDGE current release

- Safari

4.2.2. Mobile Devices – current supported versions of:

- Google Android

- Apple iOS

4.2.3. Desktop / Laptop: current supported versions of:

- Windows 11;

4.3. Requirements for Deployment as a Service (SaaS)

• Data at rest in the cloud will be encrypted

• Data in transit to/from or fully contained in the cloud will be encrypted

• Encryption technique to protect data at rest and in transit, authentication, and digital signatures/hashes shall meet Federal Information Processing Standard (FIPS) 140-2 requirements

• Data will be stored, or transported, only within the United States

• Use transport layer security (TLS) to establish connections and communication

• Data stored in the cloud will be replicated to a DART facility at least daily, or more frequently based on business necessity (on demand), via secured FTP or DART authorized equivalent

• DART maintains exclusive ownership of all data and meta-data DART stores in the cloud

• Access to cloud data will be controlled through DART controlled access rights

• Use of the HTTPS protocol is mandatory

• At a minimum data in transit will always use SSL/TLS protocols to exchange data across separate locations

• Code will be scanned for vulnerabilities prior to deployment

• Identity Management is controlled by Active Directory via cloud based ADFS

• DART maintains the right to audit, inspect or review the information security policies and procedures of the service provider

• The service provider shall provide evidence of an external audit certification Standards for Attestation Engagements (SSAE) No. 18, Service Organization Control 2 (SOC-2) from a third-party audit, conducted by an accredited certification body.

4.4. LMS specific Technology requirements

4.4.1. SumTotal LMS has a responsive design and provides a mobile app.

4.4.2. The system supports the import of SCORM compliant eLearning courses.

4.4.3. The system access is integrated into DART ADFS via Single Sign-On to provide seamless experience for the Learners.

5. Information Security Specifications All bidders must provide the following information in order for their proposal to be considered.

5.1. Non-Disclosure Agreement:

Dallas Area Rapid Transit (DART) reserves the right to require any Bidder/Respondent to enter into a non-disclosure agreement (NDA).

5.2. Information Assurance:

By accepting this contract/agreement, the Bidder/Contractor/Vendor and other external parties providing Technology services to DART agrees to comply with the applicable IT security policy as outlined in this document.

If new or unanticipated threats or hazards are discovered by the Contractor or if existing safeguards have ceased to function, the discoverer will immediately bring the situation to the attention of the DART Security Operations Center/Incident Response Team and the COTR of this contract.

5.3. IT Security Training:

The Contractor and other external organizations will ensure that its employees performing under this contract fulfill all requirements for mandatory security awareness and role-based advanced security training.

5.4. Security:

All services and DART information assets will remain "onshore." At no time will services or DART information assets be issued or stored outside of the United States of America (USA).

5.5. Data Security:

DART's information systems contain sensitive information and contain personal information subject to the Privacy Act of 1974. It will be the Vendor's responsibility to familiarize and brief employees and subcontractors on the provisions of the Privacy Act.

5.5.1. The vendor shall perform all work hereunder in compliance with all applicable federal, state, and local laws and regulations. The vendor shall only use licensed personnel to perform the work required by law to be performed by such personnel.

5.5.2. Inspection of services. DART maintains the right to audit, inspect, or review the information security, policies and procedures of the contractor/vendor rendering services to this SOW.

5.5.3. Vendor personnel will be provided Visitor badges each day they are on site. Entry to secure areas require an escort.

5.5.4. All contract personnel will undergo a background investigation prior to authorization to work on the issued contract. The vendor will be responsible for providing qualified, appropriately skilled staff knowledgeable of data protection and information security procedures to meet the roles and responsibilities and Service Levels set forth in this SOW.

5.5.5. The selected bidder/contractor/vendor will notify the COTR if the selected bidder procures a Third-Party vendor to assist with the requirements of this contract. All Third-Party vendors will undergo the selection requirements herein stated.

5.5.6. All DART issued user/admin accounts, VPN/remote access accounts, and user/admin passwords will NOT be shared amongst Contractors. Accounts are assigned to an individual user only. Violation of this guidance will result in termination of account access and/or contract personnel removal.

5.5.7. All contractors will comply with DART IT Security policies and will maintain updated Anti-Virus (AV) software and Windows 10 Operating System (OS) for their end-point device use.

5.6. Operating Systems:

The application must run on the following Windows versions: Windows 10 or later; Windows Server 2012r2 or later.

5.7. Secure Coding:

5.7.1. The Vendor shall test all source code before deploying to production.

5.7.2. The Vendor shall review all code for any security issues. The Vendor will search for security vulnerabilities embedded in the application's code or architecture. Secure coding practices must be incorporated into all life cycle stages of the application development and deployment processes. Perform automated application security testing as part of the overall existing code, code creation, changes, and application testing process to detect any vulnerabilities prior to submitting changes. Development and testing environments will redact all malicious code, sensitive data or de-identified data.

5.7.3. Application coding shall be implemented with proper security requirements, secure coding practices and a focus on security risks must be integrated into the Supplier's coding procedures. The Supplier will provide a document process to DART of their current procedure to safeguard client code and client information. The Supplier is responsible for following DART's application security practice of scanning all code for malicious code during testing before implementing the code to production servers (live).

5.7.4. The Vendor shall request all code changes to DART's Change Advisory Board (CAB) for all changes and updates to applications or servers.

5.7.5. The Vendor shall report any identification of malicious code or loss of DART sensitive information to the DART Contract Officer Technical Representative (COTR) and Project

Manager. DART's Security Response Team and the Vendor will perform remediation steps against the vulnerabilities or malicious code.

5.7.6. The Vendor shall not expose DART systems to any source code or install any method of bypassing normal authentication in any of DART's computer system.

6. Contract and Performance Period DART requires a three-year agreement, renewable licensing for SumTotal LMS solution for 4000 users with the ability to true up at the end of each year enabling DART to add new users if staffing changes.

The expected period of this contract is estimated as April 30, 2026 – April 30, 2029.

The period of performance for this LMS agreement will start upon issuance of a notice to proceed and the work tasks are estimated to continue for duration of this contract. The client has the right to extend or terminate this SOW in accordance to the agreed upon terms of the contract. The supplier will provide a project timeline indicating all the necessary tasks to be completed up to completion. The services goal is to have the supplier's final recommendations within 30 days of the contract award.