9_S-DASOBO-00008678_RFP Attachment_I_DSSC_SCOPE OF SERVICES DOJ FINAL.docx

OLCC DISTILLED SPIRITS SUPPLY CHAIN SOLUTION

OregonBuys Bid Solicitation: S-DASOBO-00008678

ATTACHMENT I

SCOPE OF SERVICES

Distilled Spirits Supply Chain

1. ANTICIPATED SERVICES: TASKS AND DELIVERABLES

The Services and Deliverables described in this document are those anticipated by the State; Proposer may provide alternate recommendations in its Proposal. The anticipated Tasks and Deliverables in this attachment can be used, in context of the RFP, as an approximate expected level of effort for purposes of estimating time and costs.

The successful Proposer shall utilize a documented and proven secure software development lifecycle (SSDLC) and maintain current and up-to-date documentation of all Distilled Spirits Supply Chain (DSSC) Solution components through the term of the Contract resulting from this RFP.

The successful Proposer shall work with Agency to agree on the appropriate level of DSSC Solution component documentation detail. Documentation may include, but is not limited to, user interface, process flow, business logic, business rules, input validation, workflow, forms, data model, data architecture, web services, infrastructure, system architecture, process flows, business process training manuals and references, and batch processing.

The successful Proposer shall provide documentation and Services necessary to comply with State oversight requirements, and also cooperate with Agency’s independent Quality Management Services (iQMS), Project Management (PM), and Organizational Change Management (OCM) third-party consultants as described in this Scope of Services and as otherwise required to deliver the Solution. The successful Proposer shall work directly with Agency’s independent Liquor Agents for in-store implementation of the Point of Sale (POS) system. The successful Proposer shall work cooperatively with various legacy POS providers for data conversion and migration activities.

The successful Proposer will be on-site at one or more Agency locations, including secure facilities, for certain Implementation Tasks identified in this Scope of Services as well as the independent Liquor Stores being served by the POS system. The successful Proposer and Agency will agree during contract negotiation, and periodically through the period of performance, on those Tasks requiring on-site presence. As to restrictions on the location of performance of off-site or cloud services, Proposers are expected to be familiar with the laws and regulations governing the services, and the restrictions of those laws and regulations on the location of the performance of the work and on data transmission and access restrictions. These laws and regulations are referenced in the RFP, the Statewide Information and Cyber Security Standards (including Attachment J, and the link in Section 3.3.8 of the RFP), the Sample Contract (including its Section 9 and Exhibit K; please note specifically Section 4.1 of that Exhibit K), and the Requirements for each Solution( Attachment H). Proposers are also expected to note and consider the State of Oregon’s requirement (Sample Contract, Section 4.2 and Section 28.1), for its contractor(s) to call to the attention of the State any planned use of subcontractors, including proposed offshore resources. Proposers are expected to account for these restrictions and obligations in Proposals.

The successful Proposer shall deliver a Solution that meets the requirements described in this RFP. Agency anticipates professional consulting and implementation services will be provided as part of the Services delivered under the Contract, including at least:

1. Project management;

2. Solution architecture and design;

3. Software components, development, configuration and customization;

4. Data conversion and migration;

5. Integration and interfaces;

6. Support for organizational change management;

7. Testing;

8. Training;

9. Implementation;

10. Project Close-out Services;

11. Call center/user support;

12. Maintenance and support that meet contractual service levels;

13. Secure hosting;

14. System Security compliance with State of Oregon security standards;

15. Disaster recovery and business continuity; and

16. An escalation plan for Implementation and support issues.

Prior to beginning work on any Deliverable, Contractor shall prepare and deliver to Agency a Deliverable Expectation Document (DED) substantially in the form of Attachment K (final form to be negotiated). A DED may include one or more related Deliverables but must include the description of the Deliverable(s), the due dates for each Deliverable, related Acceptance Criteria, and the dates for submission and response. All Deliverables must be formatted in Word, Excel, or PowerPoint (or as otherwise agreed) and be devoid of marketing type materials. Following Agency authorization to proceed with the Deliverable(s) described in a DED, Contractor shall develop and submit all Deliverables to Agency for review and feedback as set forth in the terms and conditions of the Contract and in compliance with the DED agreed upon by Agency.

Each primary Task is described in more detail below.

1.1. PROJECT MANAGEMENT

The successful Proposer will ensure the Project delivers expected outcomes and benefits with regard to the DSSC Solution. Services and Deliverables must adhere to: (i) established Oregon Enterprise Information Services (EIS) oversight requirements, (ii) project management standards and best practices as described within the most recent edition of the Project Management Body of Knowledge (PMBOK), and (iii) quality standards. EIS oversight requirements are accessible at:

Enterprise Information Services : IT Investment Oversight (Stage Gate Model) : Project Portfolio Performance : State of Oregon EIS quality standards are accessible at:

1. EIS Quality Program Web Site: Enterprise Information Services : Independent Quality Assurance Support & Services : Shared Services : State of Oregon.

2. DAS Statewide Policy, Independent Quality Management Services for Information Technology: 107-004-030.pdf (oregon.gov)

3. iQMS Exhibit: eis-ss-iqms-sow-appendix-a-thru-e-20190320.pdf (oregon.gov) The successful Proposer shall provide project management, oversight, and coordination services as those Services relate to system build, configuration, integration, installation, and implementation and support of the DSSC Solution described in this RFP. The successful Proposer shall cooperate with Agency and Agency’s project management team, iQMS vendor, OCM third-party consultants and EIS to ensure processes, methods, and artifacts comply with oversight requirements and industry best practices.

The successful Proposer’s Project approach is expected to follow its proven implementation methodology to take advantage of successful implementations demonstrated in other states or sites. The successful Proposer shall ensure the successful Implementation of the DSSC Solution is consistent with project management best practices and applicable quality standards.

The Project will be carried out by a Project team comprised of State, third party, and the successful Proposer’s resources. The successful Proposer’s project management resources, and some Agency project employees, are expected to be dedicated to the Project, with expanded team members being brought to the Project as tasks are undertaken, and expertise needed.

The successful Proposer is responsible for the implementation approach, the configuration or customization of its DSSC Solution according to its SSDLC, and for cooperatively managing the work of its project team and coordination with State resources.

The Proposed Implementation Plan to be submitted in response to this RFP must include an overview of the proposed project timeline, migration approach, and separate major Deliverables into Milestones with checkpoints. The Proposed Implementation Plan must include at least:

1. Description of each Implementation phase, including the functionality that will be implemented during each phase. The successful Proposer will be responsible for recommending an implementation approach based on previous implementations of its DSSC Solution and in consideration of Agency’s environment and Technical and Business Functionality. The plan may propose a “big bang” approach or an approach that incrementally implements by phase. Any approach should consider Agency’s need to maintain continuity of operations and be completed within the agreed upon schedule.

2. Description of related system Integration and Interface Services to manage the DSSC Solution’s interfaces described in Attachment H, DSSC Solution Requirements as needed for successful implementation.

3. Business process procedures with corresponding business process diagrams for each of the business processes to be implemented.

4. Data cleansing, conversion, and migration plan (including retention and archiving).

5. Migration strategy, including any operational cutover plans, staging environments, or temporary processes required.

6. Plans for Rollout, including any pilot or phased releases. This includes, but is not limited to, all activities related to moving components into production, such as transitioning data and interfaces, ensuring readiness of all systems, data, integrations, people, and processes for Go-Live, incident and change management during the Stabilization Period, communications.

7. Guidance and plans for assisting Agency with moving to the DSSC Solution and processes, including plans for support, incident response, repair of Defects, reporting, and communications during the Stabilization Period that will follow transition to production (including by phase, as negotiated by the parties in the contract). Agency expects that the successful Proposer’s original project and development team will stay with the Project through the end of the Stabilization Period.

8. Approach to provide production support during Rollout, including any phased approach.

9. Support of Project closeout activities, including participation in Project retrospective.

Project Management Deliverables must include at least:

(a) Implementation Plan

(b) Project schedule

(c) Meeting agendas and minutes

(d) Project status reports

(e) Configuration and Customization Plan

(f) Integration and Interface Plan(s)

(g) Data Conversion and Migration Plan

1.2. SOLUTION ARCHITECTURE AND DESIGN

The successful Proposer shall plan and facilitate the processes necessary for the successful Proposer to complete design of the DSSC Solution.

The successful Proposer shall develop and submit Design Documentation that identifies how the DSSC Solution will deliver at least the Technical and Business Functionality stated in this RFP, as well as Documentation that describes the DSSC Solution’s function interactions, components, and conceptual and logical architecture. Design Documentation must include, without limitation, process flow charts, screen and report mock-ups, and mapping of functional design to software components used to deliver Solution Requirements. Additionally, the successful Proposer shall complete a gap analysis that identifies, documents, and addresses the differences between the DSSC Solution and the Technical and Business Functionality required for the Solution.

Design Documentation Deliverables must include at least:

(a) Gap analysis documentation;

(b) Functional Specification Design Documentation;

(c) Mapping of Solution Requirements to system components and features;

(d) Business rules documents;

(e) User interface/presentation layer;

(f) Application architecture;

(g) Interface control documents;

(h) Database design documents;

(i) Security design documentation;

(j) Workflow process documentation; and

(k) Requirements Traceability Matrix (“RTM”).

1.3. DEVELOPMENT, CONFIGURATION, AND CUSTOMIZATION

Agency anticipates that most Solution Requirements will be met through the existing software developed or acquired by the successful Proposer; and that the DSSC Solution may additionally involve foundational components (e.g., operating systems, database management systems, etc.) that are third parties as components of the Solution. See below for Agency preferences for third party components.

Additionally, Agency anticipates that the successful Proposer may need to engage in a variety of software development activities, which are dependent on the nature of the proposed DSSC Solution, and that may impact timeline and the rigor of testing activities required prior to Rollout. Activities may include development of new or modified functionality, customization of existing functionality, or configuration of existing functionality to deliver a DSSC Solution that meets Functionality. Agency preference is that any developments will be offered as part of the successful Proposer’s Solution. The successful Proposer may also deliver functionality by providing and integrating with one (1) or more third-party solutions; see below for preference as to terms applicable to third parties.

The successful Proposer’s DSSC Solution must provide the capability to maintain a centralized database to store and update official records, in near real-time or real-time.

With regards to the choice of technical components (the “stack”) Agency is generally neutral, with the following conditions:

1. Each technical component must meet Solution Requirements when deployed in a complex, business-critical production system. Such components will typically either have the backing of a reputable and proven vendor or, in the case of an open-source component, a history of business-ready performance and community support.

2. Each technical component must be appropriately licensed to allow the successful Proposer (and by extension Agency) to use it as needed for the DSSC Solution, and as necessary to maintain it.

With regards to the choice of configuration, third-party integration, or, if necessary, customization, the choice of one or any combination of approaches is acceptable to Agency with the following conditions:

1. The successful Proposer shall provide Agency with a clearly defined interface and documentation for configuration and a clear and explicit understanding of how existing configurations (e.g., site code, configuration files) will be maintained or re-applied during updates to the base system.

2. Agency strongly prefers that where third-party integration is used, Agency has the option of adopting third party products under a licensing and implementation model that will permit Agency to access full functionality of the licensed products across Agency.

3. While understanding that some customization may be necessary, and in keeping with Agency’s preference to engage a proven Contractor with an established DSSC Solution, Agency prefers base, configuration, or third-party integration options over customization.

For each phase of the project, the successful Proposer shall develop and manage all configuration and customization activities against Solution Requirements, the then-current Accepted Design Documentation, and the then-current Accepted Configuration and Customization Plan. Upon completion of each phase, the successful Proposer shall provide a Configuration Status Report that updates the planned configuration and customization services outlined in the Configuration and Customization Plan.

Subscription services configuration and any customization must be flexible to accommodate Agency for future expansion to include additional products, services or entities Agency regulates or future changes or additions through the legislative process.

Development, Configuration, and Customization Deliverables must include at least:

(a) Configuration and Customization Status Report(s)

1.4. POINT OF SALE HARDWARE

Agency anticipates that the successful Proposer will provide a variety of hardware options that will be available to the Liquor Stores in order to realize the full functionality of the software components. Hardware selection may be based on Liquor Store size, volume of transactions, complexity of transactions, and unique store environment (such as handheld). Successful Proposer’s hardware should provide the ability to process payments as described in Attachment H, Solution Requirements. Proposers should propose hardware that is the most advantageous to OLCC.

Agency may provide some or all hardware at Agency’s expense to all stores. Any additional hardware will be at the Retail Liquor Agents’ expense. Any hardware pricing submitted in response to this RFP and negotiated in the final Contract must be honored for those Liquor Stores wishing to purchase additional hardware.

Hardware must include at least:

(a) Registers/Terminals.

(b) Monitors (dual facing for customer and retail clerk).

(c) Scanners.

(d) Cash drawers.

(e) Receipt printers.

(f) Credit card readers (for integrated credit card processing).

(g) Signature/attestation capture for processes such as claims and transfers.

1.5. DATA CONVERSION AND MIGRATION

Document migration and the extraction of data from Liquor Store Agents’ and Agency’s current systems and the loading into the DSSC Solution are tasks that will require close collaboration between Agency and the successful Proposer. Data Conversion and Migration Services are expected to include at least the below-listed activities.

1. The successful Proposer shall perform data and document migration for users to access those records through the DSSC Solution.

2. The successful Proposer shall perform analysis, profiling and cleansing of legacy data. The successful Proposer’s data cleanup efforts are expected to be complex and intensive. Agency is open to considering this effort appropriate for subcontracting.

3. The successful Proposer shall analyze source system data formats and integrity, and correct or reformat if necessary.

4. The successful Proposer shall perform Extract, Transform, and Load (“ETL”) processes on data from source systems to new DSSC Solution.

5. The successful Proposer shall test and validate the quality of the provided data and identify and make improvements in its solution functionality to ensure data integrity.

6. The successful Proposer shall convert and load data and for end-to-end validation of the conversion and loading process.

7. The successful Proposer shall perform data conversion activities including preparation and planning, analysis and design, conversion build, conversion testing, mock conversions, conversion cutover, and support. Support must allow Agency to have transparent access into all steps in data conversion processes and to inspect intermediate and final results.

8. The successful Proposer shall perform the initial and ongoing data loads during data migration, in coordination with Agency and the Project Team.

9. The successful Proposer shall provide access to all tools, code, configuration, documentation, and data products used by the successful Proposer during the data loading process.

10. The successful Proposer shall collaborate on the creation of a tested and fully functional DSSC Solution for maintaining all data integrations, synchronizations, and other flows.

11. The successful Proposer shall provide all documentation and tools necessary for the Implementation and maintenance of the DSSC Solution.

12. The successful Proposer shall provide database documentation and supporting metadata for the DSSC Solution, including without limitation an entity relationship diagram and data dictionary.

Data Conversion and Migration Deliverables must include at least:

(a) Data Conversion and Migration Report, including data dictionary

1.6. INTEGRATION AND INTERFACES

The DSSC Solution must be scalable to quickly accommodate growth and to adapt to changes in applicable laws.

Agency seeks a flexible, open approach to integration, based on a modern integration strategy. For the full Implementation of the DSSC, Agency requires access to the source database via current industry standard APIs (REST, SOAP, XML-RPC, JSON-RPC) instead of flat files, database backups, or direct connections to the database. In order to implement a successful DSSC Solution, the successful Proposer’s DSSC Solution must be fully integrated among the three systems. The successful Proposer will be responsible for integration of its solution to other systems such as the conveyance material handling system in coordination and cooperation with Agency’s staff, Agency third party contractors, and other solution vendors. Data flow between ERP, WMS, and POS can be near-real time. Data flow for product movement within the warehouse must be real time.

The successful Proposer’s integration plans must support a modern enterprise-wide integration strategy for Agency. Minimally:

1. The successful Proposer's DSSC Solution must be able to integrate with multiple systems on various levels, such as through Application Program Interface (API), webservices, and Secure File Transfer Protocol (SFTP) connections.

2. The successful Proposer shall provide support in developing and implementing an integration strategy that meets the specific needs of mixed external stakeholders as well as Agency.

3. The successful Proposer’s DSSC Solution must provide near real-time or real-time data transfer between Agency and liquor stores.

4. The successful Proposer shall implement all Application Programmer Interfaces (“APIs”) that are part of its Solution and provide API documentation.

The successful Proposer shall provide Integration and Interface Services in accordance with the Integration and Interface Plan and the then-current RTM. The successful Proposer shall provide an Integration Report that validates the successful integration or interface for each system or subsystem. Integration and Interface Services will include at a minimum Services for the following systems:

1. Agency’s Warehouse Management System, two-way.

2. Agency’s Enterprise Resource Planning System, two-way.

3. Agency’s Point of Sale Solution System, two-way.

4. Oregon Department of Treasury, two-way.

5. Any statewide financial system, currently Statewide Financial Services Application (SFMA), two-way.

6. National Alcohol Beverage Control Systems, two-way.

7. Agency’s legacy system(s) via SFTP, two-way.

8. Marijuana and Liquor Licensing and Compliance System (Computronix), one way.

9. Department of Treasury/US Bank (Elavon Card Processing), two-way.

10. Third party ACH solution(s), one way.

11. Agency’s legacy system(s), two-way.

12. Agency’s Data Warehouse, one way.

13. Active Directory, one way.

Integration and Interface Deliverables must include at least:

(a) Integration Report

1.7. SUPPORT ORGANIZATIONAL CHANGE MANAGEMENT

Agency intends to use Prosci® methodology and strategies, including ADKAR®.

The successful Proposer shall provide information and services to augment and complement the Project’s Organizational Change Management (OCM) strategies and activities. OCM will be an integral part of the Project as Agency prepares its employees and leaders to accept and adapt to the DSSC Solution and any related business process changes, and as it guides and equips people who will be affected by the change(s) so that the DSSC Solution is successfully adopted.

Agency expects Agency staff and Agency’s contracted OCM vendor to focus on the “people side of change,” while the successful Proposer focuses on the technical side. The successful Proposer shall support OCM activities by at least: identifying, documenting, and analyzing anticipated changes to functionality and processes; conducting impact assessments; and developing workflow and process documentation for the DSSC Solution. The successful Proposer shall also deliver a Benefits Management Validation Report that indicates realization of benefits by implementing the DSSC Solution. The successful Proposer will participate in stakeholder meetings, including by providing demonstrations and answering technical questions.

Organizational Change Management Deliverables must include at least:

(a) Benefits Validation Report

1.8. TESTING

The successful Proposer shall successfully complete robust and comprehensive testing of its DSSC Solution. The successful Proposer shall validate the functionality in the DSSC Solution and perform integration testing with interfacing and impacted systems. This includes interfaces with internal Agency systems, as well as external systems operated by partner agencies.

The successful Proposer shall provide a comprehensive test plan that includes but is not limited to the following types of testing:

1. Unit testing;

2. Regression testing;

3. System integration testing;

4. Functional (end-to-end) testing;

5. Integration testing;

6. Interface testing;

7. User acceptance testing (facilitated by Agency contracted third-party provider);

8. Pilot testing;

9. Security and penetration testing;

10. Performance and load testing;

11. Stability;

12. Smoke; and

13. Data validation testing.

The successful Proposer shall develop a Testing Plan to identify the approach and activities required for full DSSC Solution testing prior to Go-Live. Each applicable test must be identified in the Testing Plan. Prior to UAT, the Solution must be flexible to handle changes and meet the Requirements of this RFP, including Attachment H2, Distilled Spirits Supply Chain DSSC Solution Functionality. Regression testing must fully test all previously implemented Solution functionality.

The successful Proposer will perform Testing Services in accordance with the Accepted Testing Services Plan. The employment of both manual testing and use of industry-standard automated testing software is strongly encouraged.

The successful Proposer shall ensure an independent third party performs and reports directly to Agency on penetration testing of the DSSC Solution within six (6) months prior to Implementation. Penetration testing must also be performed by an independent third party on at least an annual basis, and the State expects such testing when additions or changes to functionality impact the security framework, architecture or when a new vulnerability is identified. Penetration test report results must be supplied to Agency and any major or critical vulnerabilities mitigated.

As part of its Configuration and Implementation Services, the successful Proposer shall provide a Defect Tracking Report(s) following key testing activities. The Defect Tracking Report(s) must provide traceability to test cases/scripts and allow effective management of the bug/fix cycle. The method for tracking Defects will be collaboratively determined by the parties. This Deliverable must include a Defect Tracking Mechanism – this could be a spreadsheet or automated tracking method as agreed to through collaboration with Agency project team members and the successful Proposer. The successful Proposer must deliver a Testing Report to Agency that will be used as a Stage Gate for moving the phase into either User Acceptance Testing activities or Go-Live Implementation.

The successful Proposer must support User Acceptance Testing (UAT), UAT is the final testing performed when functional, QA, and regression testing is completed by Agency. The successful Proposer must pre-populate look-up values and other reference data into the test environment.

The successful Proposer shall provide the environment that will be used for UAT activities and must provide the following:

1. The UAT test environment will be a “production like” environment.

2. The UAT test environment will be visibly distinguishable from production, development, and other environments used.

3. Software release number and description of changes in release (release notes) must be provided to Agency.

4. Software release cycles into the UAT test environment must be rigorously managed by the successful Proposer, and each release number/name prominently displayed where the UAT tester can see it.

5. The UAT test environment must be maintained and updated as necessary to support effective UAT.

6. Any data used in UAT must be de-identified and contain no personally identifiable or sensitive information. Agency will assist with determining data that must be de-identified.

7. Look-up values, and other reference data will be pre-populated into the test environment.

Testing Deliverables must include at least:

(a) Test Plan;

(b) UAT environment;

(c) Defect Tracking Report(s); and

(d) Testing Report.

1.9. TRAINING

The successful Proposer’s DSSC Solution must be consistent with user-centered design principles and be as simple as possible, easy to use, and quick to learn.

The successful Proposer shall provide a robust and high-quality training program, customized to the needs of Agency and external stakeholders, informed by best practices in adult education, to prepare end users to work with the DSSC Solution and support their ongoing mastery and success.

The successful Proposer shall provide training and user support in these three major areas: external stakeholder training (the largest area); training for Agency staff; and systems administration training.

The successful Proposer shall provide training at various phases of the Project. The two most significant phases for this Task are the Rollout phase and the ongoing services phase. In the Rollout phase, before Go-Live, the successful Proposer shall provide training for all impacted staff and applicable external stakeholders on new processes and the DSSC Solution. In the operations and maintenance phase, the successful Proposer shall provide refresher training, advanced training, training associated with new features or DSSC Solution updates, and introductory training for new users. In addition to end-user training, the successful Proposer shall provide training and support to prepare Agency specialists to support and maintain the DSSC Solution as appropriate to the proposed DSSC Solution. This may include a combination of system administration training, knowledge transfer services, documentation, technical manuals, and user manuals. Timing for delivery of this training and support will be determined based on the extent and duration of post-implementation support that is agreed upon.

The successful Proposer shall provide content, materials, and tools, created and maintained by the successful Proposer, to support both initial (Rollout) and ongoing (operations and maintenance) training. Agency strongly prefers to have unlimited rights to use and modify all training materials without additional cost for purposes of training users of the DSSC Solution. Materials are expected to be provided in editable digital formats for re-use and modification by Agency, consistent with the Contract terms and conditions.

Training may include a variety of methods and approaches such as:

1. Online self-paced training modules to provide basic system exposure and instruction.

2. Instructor-led, classroom-based, hands-on training at multiple sites.

3. Instructor-led online training.

4. Self-directed, just-in-time training such as job aids and task-based instructional video clips.

5. Built-in support such as embedded help and mouse overs.

6. Knowledge repository and tool tips relevant to the information displayed on the current page.

The successful Proposer shall provide a training plan based on tested and validated training practices. Curriculum must be thoroughly supported by appropriate instructional materials. The successful Proposer shall develop training that includes: context (for example, documentation of the old and new business processes and the reasons for the change); specific scenarios; sample data to be used in examples and hands-on training; presentations; interactive learning exercises; and reference materials such as job aids that are available to support Agency staff success during and after training. The training plan must define an approach to prepare Agency trainers to continue delivery of training to new employees after the initial Rollout, and to keep Agency trainers current and well-supported in this role for the duration of the State’s use of the DSSC Solution.

Training Deliverables must include at least:

(a) Training Plan.

(b) Training Materials.

(c) Training Assessment Report(s).

(d) Help functionality within the application.

1.10. IMPLEMENTATION

The successful Proposer shall Implement the DSSC Solution. Implementation includes activities related to integrating the DSSC Solution and Services, including related components, into the workflow and data flow of Agency to achieve the desired outcomes of the Project.

Following Acceptance of Testing and Training Deliverables, receipt of all required State of Oregon approvals, and written notice from Agency to proceed with Go-Live, the successful Proposer shall implement the Subscription Services in accordance with the Accepted Implementation Plan.

The successful Proposer shall provide Implementation Services, Go-Live support, and prepare for successful ongoing Subscription Services.

Upon successful completion of testing for each phase, the successful Proposer shall prepare module(s) for production and prepare for the initial Go-Live activities for Implementation. The successful Proposer must prepare, test, and deliver documentation that each production-ready module:

1. Is functioning in the Production Environment,

2. The Implementation methodology for the module is confirmed,

3. Authorized user preparedness activities have been satisfactorily completed,

4. The Application Services Security Plan is current and complete, and

5. Is operating in material conformance with the then-current Requirements Traceability Matrix.

Implementation Deliverables must include at least:

(a) Go-Live Readiness Assessment

1.11. PROJECT CLOSE-OUT

The successful Proposer shall participate in close-out activities at the end of each phase following Go-Live. Close Out services include participating in Agency lessons learned session(s). The successful Proposer shall deliver Project Close-out Documentation following Acceptance of all Testing and Implementation Deliverables. The Close-Out report denotes transition to ongoing delivery of Services and specifies what will be included in on-going delivery of Services, and who will be involved.

The successful Proposer shall develop and deliver a Project Close-Out Report that documents the successful Proposer’s completion of all configuration and Implementation activities and correction of remaining Defects in accordance with the Contract. The successful Proposer shall also ensure that the Subscription Services are fully operational and deliver all functionality in accordance with the RTM and meet Service Level Agreements.

Project Close-Out Deliverables must include at least:

(a) Lessons Learned documentation

(b) Project Close-Out Report

1.12. CALL CENTER/USER SUPPORT

The successful Proposer’s end user support services must have quick response time and immediate response for emergency situations. The successful Proposer’s user support will provide services to onboard Agency staff, new Liquor Agents and Liquor Store employees as needed on an ongoing basis.

The successful Proposer shall coordinate with and provide support to Agency for incidents and service request management and provide Hosting Services that ensure maximum DSSC Solution uptime.

Warehouse Management System and Point of Sale:

The successful Proposer’s Call Center/User Support must provide services to Agency and Liquor Store personnel. The successful Proposer’s end user support services must have 24/7/365 customer support services in the contract.

Enterprise Resource Planning:

The successful Proposer’s Call Center/User Support must provide services Monday through Sunday 6:00am to 11:00 p.m. (Pacific Time). Agency requires ongoing call center/help desk support services for the Agency’s Distribution and external customers (Liquor Agents, Distilled Spirits Suppliers, and Freight Carriers) with access to the ERP System. Call Center/User Support Deliverables must include at least:

(a) Monthly User Support Performance Report

1.13. MAINTENANCE, SUPPORT, AND SERVICE LEVELS

The successful Proposer shall host and perform maintenance and support activities that encompass a range of actions necessary to keep the DSSC Solution, including its underlying technologies, up to date, operating reliably and securely, and effectively delivering necessary business functionality. Services must include functionality upgrades, enhancements, and the application of updates to underlying technology.

The successful Proposer shall provide a Maintenance Plan that shows how each component will be kept current as part of ongoing maintenance and support of the DSSC Solution, including a plan for replacing any components that, over the life of the DSSC Solution, become deprecated or outdated or code refactoring to reduce technical debt. The Maintenance Plan must identify specific target ranges for component currency (e.g., “current or current minus one”, or “within 18 months of current”).

The Maintenance Plan must also include mechanisms for promptly and transparently applying critical updates to every component. Critical updates generally include those that correct security vulnerabilities or flaws or that correct functional errors that have or could have serious consequences.

The Maintenance Plan must include provisions for regular updates to and validation of all DSSC Solution Documentation, regardless of whether that Documentation is intended for use by the State or by the successful Proposer.

The Service Level Agreement applicable to the ongoing delivery of Services following Final Acceptance must include at least the following:

1. Metrics.

2. Service levels, rankings, and priority.

3. Service response.

4. Exceptions and limitations.

5. Responses and responsibilities.

6. Service management.

The successful Proposer shall provide Knowledge Transfer Services (see Sample Contract) to Agency staff, including supporting Agency experience in design, programming, testing, and operations, as well as ad hoc training throughout the Project consistent with Agency staff roles and responsibilities for operations and maintenance. The successful Proposer’s project plan and schedule must include a realistic strategy for incorporating Agency staff in day-to-day activities of the Project.

Ongoing Operations Statement of Work Deliverables must include at least:

(a) Maintenance Plan.

(b) Annual Performance Report.

(c) Service Level Agreement Reporting.

1.14. HOSTING

The DSSC Solution must be robust, responsive, scalable, secure, and highly available. Consistent with the State’s “cloud forward” policy, Agency prefers a cloud-hosted DSSC Solution, but is open to alternatives and encourages proposals that provide options for DSSC Solution hosting. Hosting options include Agency hosting the DSSC Solution onsite and managed by the State’s Data Center (which is managed by the State’s Enterprise Information Services), dedicated hosting at a Proposer-managed or third-party data center, fully managed cloud services, or Proposer-managed hosting with a cloud service provider.

If the DSSC Solution in whole or part is hosted at the State’s Data Center, the successful Proposer must collaborate with the State to design, implement, and manage the hosting environment. If the DSSC Solution is hosted outside the State’s Data Center, special provisions apply, including the obligation for the successful Proposer to comply with the State’s Cloud and Hosted Systems Policy (https://www.oregon.gov/das/policies/107-004-150.pdf) including providing for regular independent information security audits as required by State policy and best practice. The State currently prefers SOC II Type 2 audits across all trust services criteria and is open to considering other audit standards. The successful Proposer shall provide the State with complete access to any audit reports. All Agency data stored off-site (including data in the cloud) must be stored in data centers residing within the continental United States of America. Data centers must meet all requirements for hosting outlined in the Contract and the EIS 2019 Statewide Information and Cyber Security Standards (including as the standards are updated).

1.15. SYSTEM SECURITY PLAN

The successful Proposer shall complete a System Security Plan (“SSP”) before Go-Live. This effort will involve collaboration with Agency, and the degree of that collaboration will depend on the architecture of the proposed DSSC Solution (on-prem vs. cloud), as roles between Agency and the successful Proposer could vary greatly. The successful Proposer may follow the Oregon SSP template, or, if the successful Proposer already has created one for its product, may submit it so long as it follows a comparable structure, preferably based on the FedRAMP moderate SSP template, or NIST SP800-171, and properly outlines each parties' respective roles. Such a plan must comply with State standards and must be reviewed and acceptable to Agency and EIS. The Oregon SSP template can be found at:

Statewide Information Security Plan (oregon.gov) The DSSC Solution must protect Agency Data against unauthorized or accidental alteration or destruction. The DSSC Solution must meet confidentiality and integrity requirements applicable to the DSSC Solution, Services, and Agency Data, including as specified in Attachment H, DSSC Solution Requirements, Attachment A, Sample Contract, and the EIS 2019 Statewide Information and Cyber Security Standards at the Moderate Level(including as the standards are updated throughout the term of the Contract).

System Security Plan Deliverables must include at least:

(a) System Security Plan (required prior to Go-Live and updated annually)

1.16. DISASTER RECOVERY (DR) AND BUSINESS CONTINUITY PLAN (BCP)

The successful Proposer shall provide the DSSC Solution functionality and expertise to develop the DR and BCP plans and successfully demonstrate the successful testing and execution of the plans. The successful Proposer shall develop the plans with input from Agency.

The successful Proposer shall provide mechanisms to ensure high availability, particularly of Agency’s critical business functions. Agency is open to various approaches to meeting this need, including traditional backup-and-restore disaster recovery, high availability based on redundant and failover systems, or cloud-based systems that rely on abstracted interfaces to cloud-vendor-maintained high-availability storage, compute, and networking functions.

DR and BCP Deliverables must include at least:

(a) DR & BCP Plan (required prior to Go-Live and updated annually)

1.17. ESCALATION PLAN

The successful Proposer shall provide an escalation plan that includes at minimum: procedure to be used during the Implementation of the Project, and a process to be followed during ongoing operations.

The Escalation Plan must include at least a contact prioritization matrix and guidelines including names, titles, and contact information.

1.18. OREGON DEPARTMENT OF TREASURY COMPLIANCE FOR POINT OF SALE

The successful Proposer providing financial transaction processing services to State agencies are required to comply with Oregon State Treasury’s Third-Party Vendor Requirements:

https://www.oregon.gov/treasury/public-financial-services/Documents/Public-Financial-Services-Cash-Management/FIN214.pdf

1. The successful Proposer will be required to complete the Third-Party Vendor Qualification Application and satisfy all requirements.

2. Agency requires that Merchant Card transactions need to process via Elavon or an Elavon certified gateway.

Cash management services must be approved by Oregon Department of Treasury.

image1.jpg