8-RFQ Vol. 2 SOW Scope of Work.pdf

Agency for Community Transit Volume 2 Investment Management Services No. 25-2-14401

SCOPE OF WORK

Overview The Contractor shall provide investment management services to oversee and maintain an assigned portion of the Owner’s portfolio. The Contractor will identify, evaluate, purchase, and sell investments on behalf of the Owner.

Investment Management Services

The Investment Management Services shall consist of:

A. Managing the portion(s) of the Owner’s investment portfolio that has been assigned to the Contractor, while complying with all aspects with the Owner’s Investment Policies.

a. As of January 1, 2026, the Owner expects the value of the assigned portfolios to be approximately:

• Non-Endowment = $10,000,000.

• Endowment = $15,000,000.

b. The amount of the portfolios assigned to the Contractor may change over time due to the investment results generated by the Contractor and the needs of the Owner.

c. The types of investments that the Owner would consider purchasing may change over time due to the investment results generated by the Contractor and the needs of the Owner.

d. The Contractor shall evaluate potential investments using disciplined, thorough investment analysis and due diligence.

e. Cash flow forecasting will be conducted by the Owner which will include new deposits and or drawdowns in accordance with the needs of the Owner through the base contract term and any extensions thereof.

B. The Contractor shall use a highly structured investment process which may incorporate, but is not limited to, the following elements in the investment decision making process:

a. Establishing an interest rate forecast for short term and long term time periods

b. Conducting yield curve analysis

c. Determining the proper maturity and duration allocations

d. Performing sector analysis and making sector investment decisions

e. Conducting credit analysis of issuers

f. Selecting securities within the realm of permissible investments described in the Owner’s

Investment Policy C. The Owner, under this contract and not separately priced, shall receive and have access to any of the Contractor's internal or external investment, market and economic research training materials and support capabilities and services in the performance of the Owner's investment responsibilities.

These materials and services do not include proprietary models or information unique to the Contractor's investment process.

D. The Contractor shall maintain close contact with the Owner’s Accounting Department and serve as a resource of economic and investment information and research. The Contractor shall keep the Owner fully informed of the rationale for investment recommendations and changes in the portfolio under its management.

E. The Contractor shall be responsible for immediate notification to the Owner of significant changes in personnel, ownership, resources, or firm direction. The Contractor shall discharge its duties under this contract solely in the interest of the Owner with the care, skill, prudence, and diligence under the circumstances then prevailing that a prudent person acting in like capacity and familiar with such matters would use in the conduct of an enterprise of like character and with like aims. Moreover, the Contractor shall utilize best practices of the investment industry, such practices to include but not limited to the standards issued by the Chartered Financial Analyst Institute.

F. The Contractor shall provide the Owner with immediate notification of any potential issue that could hinder the Contractor’s ability to trade with full discretion on behalf of the Owner. The Contractor shall maintain appropriate operational separation (i.e., an information screen or wall) between trading and investment duties on behalf of the Owner portfolios and any engagement such as creditor committee representation which could affect the Contractor’s full discretion to buy or sell in the marketplace.

G. The Contractor shall work closely with the Owner’s custodian bank to facilitate the efficient and timely recording of purchases, sales, and other activity, reconcile securities and cash balances and provide information necessary to calculate performance results. The Owner will delegate its proxy voting authority to the investment manager. The investment manager shall maintain records of its votes and report the results, at least annually, to the Owner.

3 Deliverables

The following are deliverables of this Contract:

A. By the tenth day of each month, the Contractor shall provide the Owner with reports of the Owner’s portfolio balance as of the end of the prior month, including at a minimum:

a. Investment name

b. Investment type

c. Purchase Date

d. Maturity Date

e. Rate of Return

f. Performance data

g. Analysis of the total portfolio

B. At least twice each fiscal year the Contractor shall attend an Owner board meeting to discuss the performance of the funds that have been assigned to the Contractor for investment.

C. At least once each year (or more frequently if requested by the Owner) the Contractor shall provide the Owner with a report detailing the Contractor’s proxy voting.

D. All reporting for each portfolio must remain separate.

Contractor Assurances A. The Contractor shall communicate recommendations in a timely manner to the Owner if changes or new opportunities arise.

B. The Contractor shall act as custodian and record-keeper for all the Owner’s holdings at no extra fee.

The Contractor’s wealth management division will work seamlessly with the bank to coordinate any necessary movement of funds between the Owner’s investment accounts and bank accounts. This can be requested via phone call or email from Owner’s authorized personnel to Contractor’s wealth management division contacts. The Owner’s authorized personnel are:

- SJ Morrison, Executive Director; or

- Michelle Domer, Director of Accounting; or

- Nicholas Bingheim, Accounting Manager

C. Unlike the bank side deposit accounts held for Owner which must be collateralized, collateral requirements are not required for wealth management investments which conform to the Owner’s Investment Policy provisions set out in Exhibit A, provided, however, that any funds held for Owner by Contractor in accounts with financial institutions which are insured by the Federal Deposit Insurance Corporation (FDIC) or any similar agency, shall be collateralized to the extent that such deposits exceed insured limits with respect to such accounts.

D. Funds are to be transferrable on a same-day basis between accounts at Contractor’s institution, and next day to external organizations via ACH, except in extenuating circumstances. Funds are to be swept into a liquid, institutional money market position until funds are invested by Contractor.

E. Training will be provided to Owner’s staff by Contractor’s Investment Team and Operations Team, at no additional charge, to facilitate efficient investment account start-up and performance.

Owner’s Investment Policy

Owner’s Investment Policies are attached:

a. Non-Endowment investment policy adopted July 14, 2022

b. Endowment Governing Document adopted June 12, 2025

[Continued on next page]

6 Cybersecurity and Data Protection Requirements The Contractor shall comply with the following cybersecurity and data protection requirements while performing all services under this contract:

1. Governance & Compliance

a. Comply with the NIST Cybersecurity Framework, CIS Controls, and all applicable federal, state, and local regulations (e.g., Illinois Local Records Act, HIPAA, PII, PCI-DSS).

b. Maintain a written information security program (WISP) and provide documentation upon request.

2. Access and Identity Management

a. Implement multi-factor authentication (MFA) for all administrative, privileged, and remote access.

b. Enforce role-based access control (least privilege).

c. Disable access within 24 hours of employee termination.

d. Shared accounts are prohibited.

3. Data Security

a. Encrypt all sensitive data in transit (TLS 1.2+) and at rest (AES-256 or equivalent).

b. Not transfer or store confidential data outside of the United States without the prior written consent of the Owner.

c. Maintain data retention and disposal policies in compliance with Illinois law.

4. System and Network Security

a. Maintain patch management, applying security updates for critical vulnerabilities within 30 days.

b. Implement endpoint detection and response (EDR) tools on all systems handling Owner’s data.

c. Use secure VPNs for any remote access.

d. Segregate production and development environments.

5. Incident Response and Breach Notification

a. Maintain a documented incident response plan, updated and tested annually.

b. Notify the Owner of any actual or suspected data breach within 24 hours of discovery.

c. Cooperate fully in forensic investigation and remediation efforts.

d. Maintain cyber liability insurance with coverage of not less than $5M per occurrence. The

Owner, Madison County Transit, and their officials, employees, and agents shall be named as additional insured.

6. Vendor Risk and Subcontractors

a. Not use subcontractors without prior written approval from the Owner.

b. Ensure subcontractors meet the same cybersecurity requirements.

c. Provide, upon request, an annual third-party risk assessment report.

7. Audit and Verification

a. Permit the Owner to audit Contractor’s security practices and request evidence of controls.

b. Provide annual SOC 2 Type II, ISO 27001 certification, or equivalent.

c. Undergo annual penetration testing and vulnerability scans, with remediation plans shared upon request.

8. Training and Awareness

a. Ensure all personnel with system or data access complete annual cybersecurity awareness training.

b. Provide role-specific training for personnel handling sensitive data.

9. Business Continuity and Disaster Recovery

a. Maintain a Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP), tested at least annually.

b. Define and meet Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) consistent with Owner requirements.

10. Termination and Data Return

a. Upon termination, return or securely destroy all Owner data within 30 days.

b. The obligation to report security incidents involving Owner data shall survive contract termination.