8._Exhibit_C_C5-CMCS-G1_532_MAPS_Tech_SOW_063026.docx

Bidder’s Name

INVITATION FOR BID

IFB C5CMCS-G1-26

CALNET Managed Cybersecurity Services

CATEGORY 532 – MANAGED ANTI-PHISHING SECURITY SERVICE

<Enter Bidder Name Here> Statement of Work

TECHNICAL REQUIREMENTS

JUNE 30, 2026

Issued by:

STATE OF CALIFORNIA

Office of Statewide Technology Procurement PO Box 1810 Rancho Cordova, CA 95741 Disclaimer: The original PDF version and any subsequent addenda to this IFB remain the official version. In the event of any inconsistency between the Bidder’s versions, articles, attachments, exhibits, specifications, or provisions, which constitute the Contract, the official State version of the IFB in its entirety shall take precedence.

ADDENDUM LOG

Table of Contents

Statement of work TECHNICAL REQUIREMENTS Category 532 Managed Anti-Phishing Security Service

532.1 OVERVIEW

The California Department of Technology (CDT), Office of Statewide Technology Procurement (OSTP) is requesting proposals from responsive Bidders to provide Managed Anti-Phishing Security (MAPS) Services and Features.

This Invitation for Bid (IFB) C5-CMCS-G1-26 Category 532 provides the State’s solicitation for best value solutions for MAPS Service. This IFB also describes the technical Requirements necessary to support the CALNET Program Requirements.

This IFB will be awarded to Bidders that meet the award criteria as described in IFB C5-CMCS-G1-26 Part 1, Bid Evaluation. The CALNET 5 CALNET Managed Cybersecurity Services (CMCS) Contract(s) that result from the award of this IFB will be managed on a day-to-day basis by CALNET Management and Oversight (CMO).

532.1.1 Bidder Response Requirements

Throughout this IFB, the Bidder is required to confirm their understanding and acceptance of the Requirements by selecting a response in the provided drop-down field.

Example:

“The Bidder understands and shall meet or exceed the Requirements identified in Section 532.X Section Name? Choose an item.”

532.1.2 Designation of Requirements

All technical Requirements specified in this IFB are mandatory and must be responded to as identified in IFB Part 1, SOW mandatory technical Requirements by the Bidder. Additionally, some mandatory Requirements are “Mandatory-Scorable” and are designated as “(M-S).”

532.1.3 Statewide Policies and Standards

The Contractor’s MAPS Service shall be aligned with policies and standards set forth in the Statewide Information Management Manual (SIMM) Section 5300, Information Security (SIMM 5315-A Email Threat Protections Standard and SIMM 5320-A – Phishing Exercise Standard).

532.1.4 Pacific Time Zone

Unless specified otherwise, all Requirements are stated in the Pacific Time Zone and the Contractor shall use the Pacific Time Zone.

The Bidder understands and shall meet or exceed the Requirements identified in Section 532.1 Overview? Choose an item.

532.2 MANAGED ANTI-PHISHING SECURITY SERVICE

The Contractor shall provide comprehensive MAPS Services and Features to reduce phishing and social engineering risk through user centric detection, reporting, analysis, and response to strengthen Customers overall security posture.

All Services shall be delivered in accordance with industry best practices and applicable regulatory requirements.

The Contractor shall provide end-to-end Service enablement, including provisioning, configuration, and integration of the service into the Customer’s approved environment. The Contractor will coordinate with the Customer to collect requirements, deploy and validate the service, and confirm successful operation through testing and verification. As part of onboarding, the Contractor will deliver administrative and user training materials, along with documentation outlining reporting tools and escalation procedures.

Once operational, the Contractor will perform continuous monitoring, maintenance, and tuning to ensure effective detection, filtering, and response capabilities. The Contractor shall troubleshoot and remediate issues, apply updates and optimizations as needed, and provide ongoing reporting, performance metrics, and threat intelligence updates to maintain service quality and support the Customer’s cybersecurity posture.

532.2.1 Managed Anti-Phishing Security Services and Features

The Contractor's MAPS Services shall include the following Services and Features at a minimum.

532.2.1.1 Mandatory and Measurable Phishing Awareness and Simulation Training.

The Contractor’s phishing awareness and simulation training shall include the following functionality at a minimum:

Conduct mandatory, periodic simulated phishing campaigns against all users, with integrated, immediate remedial training for those who fail (e.g., click a link or enter credentials).

Track and report training completion and simulation performance by user and role, providing metrics to demonstrate continuous improvement in human resistance to phishing, in line with NIST's emphasis on security awareness and incident reporting.

Allow customized scheduling intervals for phishing campaigns which shall be mutually agreed upon by the Contractor and Customer and documented in writing.

532.2.1.2 Phishing Analysis, Confirmation, and Coordinated Response The Contractor's Service shall automatically detect, analyze, and quarantine and/or block malicious emails, links, and attachments before delivery, utilizing advanced techniques like sandboxing and AI/ML detection.

The Contractor's MAPS Service shall validate the authentication and alignment of inbound emails using Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC) standards, and shall apply Customer-configurable handling policies for messages that fail authentication or alignment checks, consistent with SIMM 5315-A (Email Threat Protections Standard) and CISA Binding Operational Directive 18-01.

The Contractor's MAPS Service shall provide reporting on inbound email authentication outcomes, including SPF, DKIM, and DMARC pass, fail, and alignment results, to support Customer visibility into spoofing, impersonation, and domain abuse activity, in accordance with Section 532.2.1.4.

Upon Customer request, the Contractor shall provide informational best-practice guidance regarding email authentication standards (SPF, DKIM, and DMARC) to support the Customer's overall anti-phishing posture.

The Contractor's MAPS Service shall include an automated function to search and delete identical or related phishing emails from all user inboxes company-wide once a threat is confirmed, enabling rapid containment per the Incident Response (IR) control family.

The Contractor's MAPS Service shall provide a Customer-configurable approval workflow governing bulk or enterprise-wide remediation actions, including mass deletion, quarantine, or message recall across multiple mailboxes. The workflow shall allow the Customer to require explicit Customer authorization on a per-incident basis, automated execution under pre-approved Customer policies, or a combination of both. The Contractor shall not perform bulk or enterprise-wide remediation actions outside the parameters established by the Customer-approved workflow.

The Contractor shall log each bulk or enterprise-wide remediation action, including the triggering event, scope of affected mailboxes and messages, authorization source.

The Contractor’s automated functions shall support Customer-defined remediation or policy workflows prior to taking unilateral action.

532.2.1.3 Real-Time User Reporting and Automated Incident Triage.

The Contractor’s MAPS Service shall provide intuitive mechanisms that enable end users to easily report suspected phishing or social-engineering attempts. Reporting mechanisms may include, but are not limited to, email client add-ins, buttons, or other Customer-approved interfaces.

The Contractor’s MAPS Service shall automatically ingest and process user reported phishing content and initiate automated or assisted workflows to correlate related reports, assess and prioritize phishing-related activity, reduce duplicate analysis, and support timely investigation, escalation, or response actions.

The Contractor’s MAPS Service shall provide Customer-configurable user awareness capabilities that present contextual warnings, notifications, or visual indicators to End Users when suspected phishing or social-engineering activity is identified. Such indicators shall be designed to assist End Users in recognizing potentially suspicious messages by presenting understandable, risk-relevant information derived from technical, behavioral, or contextual signals associated with the message or sender.

532.2.1.4 Event Logging and Integration for Auditing and Accountability.

The Contractor's MAPS Service shall log all phishing-relevant events, including emails scanned, detected threats, phishing reports received, and remediation actions taken, retaining the data for a period defined by organizational policy.

The Contractor's MAPS Service shall support standardized log forwarding or integration with Customer-designated security monitoring, incident management, or ticketing systems to enable centralized visibility, correlation, and audit support.

The Contractor’s MAPS Service shall provide an environment that includes reporting data, metrics, and logs of phishing-related security events, and supports investigative analysis, correlation, and summarization of reported or confirmed phishing activity for operational review and audit purposes.

The Contractor shall provide the MAPS Service listed in Table 532.2.1.a. below. The Contractor’s pricing shall be based on a per mailbox, per-month, subscription-based model. Multiple aliases associated with a single mailbox shall be counted as one billable unit.

Additional volume pricing options may be added to the Contract after Contract Award via the formal amendment process, in accordance with SOW Business Requirements Section CMCS-G1.10 (Contract Amendments).

Table 532.2.1.a – MAPS Service

Service

Service

Service

Service

532.2.1.5 – Contractor’s MAPS Service Threat Detection Accuracy (M-S) The Contractor’s MAPS Service shall ensure accurate detection of inbound email threats and minimize False Negative classification or False Positive classification as described in this section.

The Contractor’s MAPS Service shall block sophisticated phishing attacks that use email and other collaboration apps to exploit users and gain unauthorized access.

False Negatives shall refer to any inbound email that is not identified by the Contractor’s MAPS Service as a threat or spam but is later confirmed by the Customer’s security operations team to be a threat or spam. The False Negative Detection Accuracy shall be calculated as a percentage using the following formula: (False Negatives / All processed emails) X 100%.

False Positives shall refer to any inbound email that is identified by the Contractor’s MAPS Service as a threat or spam but is later confirmed by the customer’s security operations team to be a legitimate business email. The False Positive Detection Accuracy shall be calculated as a percentage using the following formula: (False Positives / All processed emails) X 100%.

Table 532.2.1.5.a – Contractor’s MAPS Service Threat Detection Accuracy (M-S)

(B, S or P)

532.2.2 Additional MAPS Services and Features

532.2.2.1 MAPS Configuration and Implementation Consulting Services MAPS Consulting Services shall only be utilized in conjunction with the Services and Features listed in Category 532 – Managed Anti-Phishing Security Service. These Consulting Services are for custom MAPS Service implementations that exceed the basic elements necessary to configure an instance of a working MAPS Service as defined by General Provisions – Telecommunications, Section 15.12, Goods and Services Costs.

532.2.2.1.1 Customer Environment Consulting

The Contractor shall provide Customer environment consulting Services to assist Customers with:

Identifying current defense posture, tools, and existing systems;

Identifying Customer regulatory requirements based on the Customer’s business model(s);

Identifying the Customer’s incident reporting and response capabilities; and Developing solution strategies for implementation.

532.2.2.1.2 Planning and Integration

The Contractor shall provide planning and integration consulting Services to assist Customers with:

Gathering requirements;

Designing architecture;

Designing solution integration;

Documenting application inventory and dependencies;

Planning capacity; and Reviewing security posture.

532.2.2.1.3 Execution and Implementation

The Contractor shall provide execution and implementation consulting Services that go beyond the required services identified in Section 532.2.1 Managed Anti-Phishing Security Service Requirements to assist Customers with:

Establishing customized dashboard information;

Integration with EDR, SIEM, SOAR or ITSM Customer platforms; and Project management to implement a migration plan.

The Contractor shall offer Consulting Services in Table 532.2.2.1.a Table 532.2.2.1.a – MAPS Consulting and Implementation Services

Service

Service

Service

532.2.3 Managed Anti-Phishing Geographic Service Area

The Contractor shall provide their MAPS Service statewide.

The Bidder understands and shall meet or exceed the Requirements identified in Section 532.2 Managed Anti-Phishing Security Service? Choose an item.

532.3 SERVICE LEVEL AGREEMENTS (SLA)

The Contractor shall provide Service Level Agreements (SLAs) as set forth below. The intent of this section is to provide Customers, the CALNET Program and the Contractor with Requirements that define and assist in the management of the SLAs. This section includes the SLA formats, general Requirements, Stop Clock Conditions, and the Technical SLAs for the Services identified in this solicitation.

532.3.1 Service Level Agreement Format

The Contractor shall adhere to the following format and include the content as described below for each Technical SLA added by the Contractor throughout the Contract Term:

SLA Name – Each SLA Name must be unique;

Definition - Describes what performance metric will be measured;

Measurements Process - Provides instructions on how the Contractor will continuously monitor and measure SLA performance to ensure compliance. The Contractor shall provide details describing how and what will be measured. Details should include source of data and define the points of measurement within the system, application, or network;

Service(s) - All applicable Services will be listed in each SLA;

Objective(s) – Defines the SLA performance goal/parameters;

Rights and Remedies;

Per Occurrence: Rights and remedies are paid on a per event basis during the bill cycle; and Monthly Aggregated Measurements: Rights and Remedies (as set forth below) are paid once during the bill cycle based on an aggregate of events over a defined period of time.

The Contractor shall proactively apply a credit or refund when an SLA Objective is not met. CALNET SLA Rights and Remedies do not require the Customer to submit a request for credit or refund.

532.3.2 Technical Requirements versus SLA Objectives

Section 532.2 (Managed Anti-Phishing Security Service) defines the technical Requirements for each Service. These Requirements are the minimum parameters each Bidder must meet to qualify for Contract Award. Upon Contract Award the committed technical Requirements will be maintained throughout the remainder of the Contract.

Committed SLA Objectives are minimum parameters which the Contractor shall be held accountable for all Rights and Remedies throughout the Contract Term.

532.3.3 Methods of Outage Reporting: Customer or Contractor

There are two methods in which CALNET Service failures or quality of Service issues may be reported and Contractor trouble tickets opened: Customer reported, or Contractor reported.

The first method of outage reporting results from a Customer reporting Service trouble to the Contractor’s Customer Service Center via phone call or opening of a trouble ticket through the Contractor’s portal.

The second method of outage reporting occurs when the Contractor opens a trouble ticket as a result of network/system alarm or other method of Service failure identification. In each instance the Contractor shall open a trouble ticket and monitor and report to Customer until Service is restored.

532.3.4 Response to Service Level Agreements

Many of the Service Level Agreements described below include multiple Objective levels – Basic, Standard and Premier. Bidders shall indicate one specific Objective level they are committing to for each Service in the space provided in the “Objective” section of each SLA description.

532.3.5 Contractor SLA Management Plan

Within 90 calendar days of Contract Award, the Contractor shall provide the CALNET Program with a detailed SLA Management Plan that describes how the Contractor will manage the Technical SLAs for Services in this IFB. The plan will be updated as needed by the Contractor and the State throughout the Contract Term. The SLA Management Plan shall define the following:

Contractor SLA manager and supporting staff responsibilities;

Contractor’s process for measuring Objectives for each SLA. The process shall explain how the Contractor will continuously monitor and measure SLA performance to ensure compliance. The Contractor shall provide details describing how and what will be measured. Details should include source of data and define the points of measurement;

Creation and delivery of SLA Reports;

SLA invoicing credit and refund process;

Contractor SLA problem resolution process for SLA management and SLA reporting. The Contractor shall provide a separate process for Customers and CALNET Program;

Contractor SLA Manager to manage all SLA compliance and reporting; and, The Contractor shall include SLA Manager contact information for SLA inquiries and issue resolution for Customer and CALNET Program.

532.3.6 Technical SLA General Requirements

The Contractor shall adhere to the following general Requirements which apply to all CALNET Technical SLAs (Section 532.3.8):

With the exception of the Provisioning SLA (Section 532.3.8.3), the total SLA rights and remedies for any given month shall not exceed the sum of 100% of the Total Monthly Recurring Charges (TMRC);

If a Service fails to meet one or more of the performance Objectives, only the SLA with the largest monthly Rights and Remedies will be credited to the Customer, per month;

The Contractor shall apply CALNET SLAs and Rights and Remedies for Services provided by Subcontractors and Affiliates;

The Definition, Measurement Process, Objectives, and Rights and Remedies shall apply to all Services identified in each SLA. If a Category is listed in the SLA, then all Services and Features under that Category are covered under the SLA. SLAs apply to both Services and Features. Exceptions must be otherwise stated in the SLA;

TMRC Rights and Remedies shall include the Service, option(s), and Feature(s) charges.

The Contractor shall proactively and continuously monitor and measure all Technical SLA Objectives.

The Contractor shall proactively credit all Rights and Remedies to the Customer within 60 calendar days of the trouble resolution date on the trouble ticket or within 60 calendar days of the Due Date on the Service Request for the Provisioning SLA.

To the extent that the Contractor offers additional SLAs, or SLAs with more advantageous rights and/or remedies for the same or similar services offered through tariffs, online service guides, or other similarly situated government contracts (Federal, State, County, City), the State will be entitled to the same rights and/or remedies therein. The Contractor shall present the SLAs to CALNET Program for possible inclusion via amendment;

The Contractor shall apply CALNET 5 CMCS SLA Rights and Remedies to Services provided in all areas the Contractor provides Service;

The election by CALNET Program of any SLA Rights and Remedies covered by this Contract shall not exclude or limit CALNET Program or any Customer's Rights and Remedies otherwise available within the Contract or at law or equity;

The Contractor shall apply Rights and Remedies when a Service fails to meet the SLA Objective even when backup or protected Services provide the Customer with continuation of Services;

The Contractor shall act as the single point of contact in coordinating all entities to meet the State’s needs for provisioning, maintenance, restoration and resolution of Service issues or that of their Subcontractors and Affiliates under this Contract;

The Customer Escalation Process and/or the CMO Escalation Process shall be considered an additional Right and Remedy if the Contractor fails to resolve Service issues within the SLA Objective(s);

Trouble reporting and restoration shall be provided 24x7 for CALNET Services;

SLAs apply 24x7 unless the SLA specifies an exception;

The Contractor invoices shall clearly cross reference the SLA credit to the Service ID in accordance with SOW Business Requirements Section CMCS-G1.5 (Invoicing);

The Contractor shall provide a CALNET 5 CMCS SLA Manager responsible for CALNET 5 CMCS SLA compliance. The SLA Manager shall attend regular meetings and be available upon request to address CALNET Program SLA oversight, report issues, and problem resolution concerns. The CALNET 5 CMCS SLA Manager shall also coordinate SLA support for Customer SLA inquiries and issue resolution; and, The Contractor shall provide Customer and CALNET Program support for SLA inquiries and issue resolution.

532.3.7 Trouble Ticket Stop Clock Conditions

Only the following conditions shall be allowed to stop the duration of the Service Level Agreements. The Contractor shall document durations using the Stop Clock Condition (SCC) listed in Table 532.3.7, which must include start and stop time stamps in the Contractor’s trouble ticket reporting tool or Contractor’s provisioning service request tool for each application of a SCC.

The Contractor shall not consider “cleared while testing” or “no trouble found” as a SCC.

The Contractor observation timeframes, not requested by End-User, after incident resolution shall not be included in Outage Duration reporting.

Table 532.3.7 – Stop Clock Conditions

Access necessary to correct the problem is not available because access has not been arranged by site contact or End-User representative;

Site contact refuses access to technician who displays proper identification;

The Customer provides incorrect site contact information which prevents access, provided that the Contractor takes reasonable steps to notify End-User of the improper contact information and takes steps to obtain the correct information; or, Site has limited hours of business that directly impacts the Contractor’s ability to resolve the problem.

If it is determined later that the cause of the problem was not at the site in question, then Access SCC shall not apply.

532.3.8 Technical Service Level Agreements (SLAs)

The Contractor shall provide and manage the following Technical SLAs.

532.3.8.1 Service Availability (M-S)

SLA Name: Service Availability Definition:

The percentage of time a CALNET Managed Anti-Phishing Security Service is Fully Functional and available for use each calendar month.

Measurement Process:

The monthly Availability percentage shall be calculated using the following formula:

((Scheduled Uptime – Unavailable Time) / Scheduled Uptime) x 100% Unavailable Time shall be calculated on the accumulative total of all Unavailable Time derived from all trouble tickets closed for the affected Service ID per calendar month. All Unavailable Time applied to other SLAs which result in a Remedy will be excluded from the monthly accumulated total.

The Service Availability calculation shall exclude approved Contractor or Customer scheduled maintenance windows.

Services:

Managed Anti-Phishing Security Service Objectives:

The objective will be based on the service Type identified in the table below:

(B, S or P)

Rights and Remedies:

Per Occurrence:

N/A Monthly Aggregated Measurements:

The first month the Service fails to meet the committed SLA objective shall result in a 25% credit or refund of the TMRC.

The second consecutive month the Services fails to meet the committed SLA objective shall result in a 35% credit or refund of TMRC.

Each additional consecutive month the Service fails to meet the committed SLA objective shall result in a 50% credit or refund of the TMRC.

532.3.8.2 Threat Mitigation (M-S)

SLA Name: Threat Mitigation Definition:

The maximum time allowed for the Contractor’s Managed Anti-Phishing Security Service to detect a security incident and fully resolve the incident through containment, remediation, and mitigation.

Measurement Process:

The Mitigation time is measured from the time a security event is detected by the Contractor’s system or reported by the Customer to the time the Contractor has provided containment, remediation, or a formally accepted corrective action plan is completed and agreed to in writing by the Customer.

Services:

Managed Anti-Phishing Security Service Objectives:

The Objective Threat Mitigation time will be:

(B, S or P)

Rights and Remedies:

Per Occurrence:

50% credit or refund of the TMRC for each End-User Service not meeting the committed Objective.

Monthly Aggregated Measurements:

N/A

532.3.8.3 Provisioning (M-S)

SLA Name: Provisioning Definition:

Provisioning shall include new Services, moves, adds, changes, and disconnects/deletes, completed by the Contractor on or before the due dates. The Provisioning SLA shall be based on committed installation intervals established in this SLA or due dates negotiated between the Customer and the Contractor documented on the Contractor’s order confirmation notification or Managed Project Work, Scope Of Work, in accordance with SOW Business Requirements Section CMCS-G1.3.3, Provisioning and Implementation. The Contractor shall meet the committed interval dates or due date negotiated with the Customer. If the Customer agrees to a negotiated due date, the negotiated due date supersedes the committed interval. At the Customer’s discretion, if the scope of the Service Request(s) meets the Managed Project criteria, negotiated due dates will be established and documented in the Project Timeline per SOW Business Requirements Section CMCS-G1.14.1, Managed Project Work General Requirements.

Features must be installed in conjunction with the Service except when listed below.

Provisioning SLAs have two Objectives:

Objective 1: Individual Service installation; and, Objective 2: Successful Install Monthly Percentage by service type.

Note: Provisioning timelines include extended demarcation wiring when appropriate.

Measurement Process:

Objective 1: Individual Service Installations:

Install intervals are based on the committed installation intervals established in this SLA or due dates negotiated between the Customer and the Contractor. This Objective requires the Contractor to meet the due date for each individual Service installation. This includes individual Service installations for Managed Projects.

Objective 2: Successful Install Monthly Percentage per Service Type:

The Contractor shall sum all individual installations per Service, as listed below, meeting the Objective in the measurement period and divide by the sum of all individual Service installations due per Service in the measurement period and multiply by 100 to equal the percentage of Service installations completed on time. The Contractor must meet or exceed the Objective below in order to avoid the Rights and Remedies.

Services:

Managed Anti-Phishing Security Service Objectives:

Objective 1: Individual Service installation: Service provisioned on or before the due date per installation Service Request.

Objective 2: Monthly Average percent by Service Type:

(B or P)

Rights and Remedies:

Per Occurrence:

Objective 1: Individual Service installations: 50% of installation fee credited to the Customer for any missed committed Objective.

Monthly Aggregated Measurements:

Objective 2: 100% of the installation fee credited to the Customer for all Service installations (per Service Type) that did not complete within the committed Objective during the month if the Successful Install Monthly Percentage is below the committed Objective.

532.3.8.4 Service Enhancement SLAs

All Service enhancements shall be considered a Feature of the Service and therefore shall be included as such under the SLAs.

532.5.8.5 Non-Mandatory Service Offerings

The Contractor shall provide SLAs as defined in SLA Section 532.5.8 for each Service added after Contract Award via Contract amendment that is determined by the CALNET Program not to be a Feature of a Service or a component of an unbundled Service. SLA tables shall be amended at time of Contract amendment to include all new Services.

532.3.8.6 Contract Amendment Service Enhancement SLAs

All Contract amendments for Service enhancements shall be considered a Feature of the Service, therefore included as such under the SLAs as defined in Section 532.3.

The Bidder understands and shall meet or exceed the Requirements identified in Section 532.3 Service Level Agreements (SLA)? Choose an item.