Att A - scope of work-Tech Proposal - RTP.docx

Attachment A – Scope of Work/Technical Proposal 26-84312 – Legal Case Management System

We are asking that the respondents organize their proposal in the exact order of questions provided in this document. The Respondent may respond in the format of their choosing provided their response maintains the order proposed in this template. A completed Proposal document (Technical Proposal within the proposal and should be uploaded as the Technical Proposal on the Supplier Portal).

I. Functional Requirements Core Case Creation, Management, and Tracking

The LCMS must provide comprehensive capabilities for the creation, management, and tracking of all types of legal cases and matters. This includes but is not limited to the following: Civil litigation, Compliance, Procurement, Freedom of Information Act (FOIA), Interagency Collaboration, Legislative, Claims, Contracts, Employment, Real Estate, and Administrative Proceedings. The system's architecture must be scalable to effectively accommodate a wide range of case types and their varying resolutions. It should support the internal initiation of referrals and complaints, with the functionality of escalating these into formal investigations as required.

A critical feature is the ability to customize menus, fields, and screens to accurately track diverse data pertinent to different case types and departmental divisions. System administrators must have the flexibility to modify the data displayed on screens to align with specific operational needs. Comprehensive, matter-centric organization of files and folders is required to ensure logical and efficient data storage and retrieval. The system must track various phases throughout the lifecycle of a case or matter and enable the clear documentation of its final disposition.

The LCMS needs a dedicated module for managing case parties and witnesses, including their contact information and any associated aliases. It must be capable of handling multiple parties within a single case or matter. The system should allow for the maintenance of both general and private notes on each case or matter. The system must support the re-opening of previously closed cases.

Document and Forms Management

Comprehensive document management capabilities are essential, encompassing version control, document generation, template management, and full-text search across all stored documents. The preference is for document generation to be a native feature of the core product, ensuring seamless integration and functionality. The system must allow for the attachment of digital files of any kind—including photos, videos, PDF documents, Word and Excel files, and audio recordings—to a case record. It should also categorize, search, and preview all supported document formats.

Support for document redaction, the maintenance of document versions, and the secure saving of original documents are mandatory. The system must have the ability to convert documents to PDF format. Automatic or integrated Optical Character Recognition (OCR) functionality is required for all document formats saved within the file system, enabling content searchability. A critical automation feature is the ability to generate batch letters, forms, and other documents, with the capacity to populate these forms by applying logic to pull relevant data from any field within the LCMS. Web forms or portals for electronic submission of various documents and intake of new matters, referrals and complaints must be configurable based on existing forms, supporting free text, yes/no, and other option fields, and allowing for the capture of longer narratives.

Workflow Automation and Task/Deadline Management

The LCMS must feature robust workflow automation capabilities that can be configured by a pseudo-technical user without requiring custom coding, i.e., low code/no code. This empowers internal staff to adapt processes without extensive external support. The system must facilitate the creation of complex automated workflow processes and automate routine business activities, significantly enhancing operational efficiency.

Essential system features include comprehensive task management, calendaring, and deadline tracking, incorporating reminders and critical date notifications. Users must be able to schedule current and upcoming tasks, prioritize them, receive alerts, assign tasks to others, and track the progress of projects and files. The system should automatically add tasks based on the entry of events or calendar entries. It must also support the entry of filing deadlines with automated calculation of the deadline. Automated email notifications and pop-ups triggered by workflow processes are required. The system must generate escalation notices for overdue or inactive cases, providing direct links to the relevant case files. Furthermore, it should be possible to close an investigation file while retaining open actions that require completion at a future date.

Reporting, Analytics, and Search Capabilities

The LCMS must offer extensive reporting capabilities, enabling users to create custom reports and dashboards tailored to their needs. It is imperative that the system can report on all data captured within the solution in real-time. Support for various report types is required, including volume reports (by source, security type, issue), strategic reports (by case number, investigator, subject, outcome), performance reports (on-time completion, average investigation time), financial reports (restitution, fines, license fees), aging reports (overdue cases), and exception reports (overdue actions, inactive cases). Ad-hoc query capabilities are necessary to allow users to generate customized reports. The system must also support the export of reports and views to standard formats such as Word and Excel, and the scheduling of reports for automated distribution to targeted users.

Comprehensive search capabilities are paramount, including full-text search across case data and attachments, along with advanced search filters. The system should allow searching by various criteria such as any party on a case, file date, disposition date range, assigned attorney, hearing type, case status (open/closed/all), or document type filed. Case/matter lookup functionality through tables by name, client, case number, or assigned attorney is also required.

Time Tracking, Billing, and Financial Management

The system must include robust time tracking functionalities, encompassing time capturing tools and activity logs. It should enable the recording and reporting of time spent on specific actions and the total time expended on individual cases. Comprehensive billing and budgeting capabilities are necessary, including cost and expense tracking, and the ability to manage case budgets and overall costs. The LCMS should be capable of generating invoices and integrating with existing legal billing systems.

A critical requirement for a public sector entity is the ability to track recoupments, such as disgorgement or restitution, with integrated financial calculations, and to provide automatic notifications for missed payments. The system must also track other recoveries, including civil fines and examination costs. This detailed financial tracking extends beyond typical law firm billing, providing crucial transparency and accountability for public funds and the financial impact of legal actions.

Integrations with Enterprise Systems

The LCMS must facilitate common integration with other relevant legal and business systems, such as accounting software, email platforms, e-signature solutions, court e-filing systems, and practice management software. Seamless interfacing with Microsoft Office products, including direct integration with Microsoft Outlook calendar and email, is essential for daily operations. Compatibility with Adobe Acrobat Pro is also required.

The system should enable linking emails directly to case files, synchronizing calendars and tasks, and automatically pulling and updating court dates, with emails auto-saved to the case file upon sending through the solution. The ability to send and receive text messages directly through the case file is also a desired feature. Furthermore, the system must support the building of integrations with other existing State systems that host case and assignment data, promoting a more interconnected and efficient governmental IT ecosystem.

Client and Matter Onboarding

The LCMS must include comprehensive functionalities for client and matter onboarding, streamlining the intake process and ensuring all necessary information is captured efficiently from the outset.

Case Linking and Allegation Management

The system should intelligently suggest relevant cases for linking based on common subjects, witnesses, or schemes, enhancing investigative coherence. It must also provide the ability to associate multiple allegations with a single case and to disposition these allegations independently, allowing for granular tracking of legal issues.

Name and Party Management

The LCMS must assign unique identifying numbers to each individual, with the capacity to attach aliases to these unique identifiers. The system should alert users to duplicate names, addresses, or businesses during data entry and provide functionality to merge duplicate records as needed, maintaining data accuracy. A specific segment dedicated to managing party, including their contact information, is required, along with the ability to streamline data collection for reporting purposes.

Communication Management (Email, Text)

The system must enable the creation and sending of emails directly from within a case record, ensuring a clear audit trail and a copy of the communication are saved within the case file. The capability to send and receive text messages through the case file is also a requirement, supporting diverse communication methods.

User Interface and Experience

The LCMS must feature an intuitive and easy-to-use application interface, complemented by a context-sensitive help function for users. It should offer a central inquiry display listing all open inquiries and a dashboard view of open cases and actions, dynamically presented based on user credentials. Customization options for the user interface are necessary to tailor the experience to different user roles and preferences. Mobile access to the solution is required, with detailed functionalities available on mobile devices and support for offline capabilities. The solution must also include built-in accessibility features, such as WCAG compliance.

II. Technical Requirements

This section outlines the foundational technical specifications and infrastructure considerations for the Legal Case Management System, ensuring compatibility, performance, and future adaptability within the State of Indiana's IT environment.

System Infrastructure, Architecture, and Deployment

The following infrastructure consideration information is provided in this RFI to aid respondents regarding the information sought by the State:

The State strongly prefers a cloud-based service offering. Cloud-based service offerings are required to be within a state-owned cloud tenant. However alternative solutions may be considered if they demonstrate significant value. This section provides details on infrastructure and support requirements, outlining the State’s minimum requirements.

Please note that any proposed cloud-based service offerings submitted in any subsequent RFP’s will need to comply at the time of solution implementation with the Risk and Assurance Management Program (RAMP) policy that is currently being developed in order to comply with a recent executive order that was handed down by Governor Mike Braun, EO 25-19. The new policy will be based on commonly accepted industry practices and standards like NIST 800-53 Revision 5 and is expected to have tiered levels of security requirements which will depend on the type of data involved, its sensitivity, and how the solution interfaces with State resources. The program and subsequent continuous monitoring requirements outlined in the policy are expected to align closely with StateRAMP dba GovRAMP best practice and is expected to be finalized and implemented by October 14, 2025. Prospective vendors should keep all the foregoing in mind as they prepare their response to this RFI and be confident that any proposals they ultimately choose to submit are flexible enough to accommodate commonly accepted industry practices and standards in the typical state government-required RAMP. Please visit the RAMP Cybersecurity Frequently Asked Questions page for additional information.

Solution Categories If solution hosting is within scope, respondents must propose one of the following hosting solutions:

1) State-Owned Cloud Tenant (Preferred Cloud Solution) Definition: A vendor hosted solution deployed within a cloud environment owned and managed by the State. This environment is provisioned in either Microsoft Azure, Google Cloud Platform (GCP) or Amazon Web Services (AWS) under the State’s enterprise agreements. The Indiana Office of Technology (IOT) will set up a cloud tenant that the vendor will use to support all aspects of the solution with oversight and minimal support from IOT.

Minimum Requirements

· Tenant Ownership and Access:

· The State retains full ownership and administrative control over the tenant.

· The vendor shall be granted access only to the resources necessary for the deployment, configuration, and maintenance of the solution, as explicitly authorized by the State.

· The State owns the financial consumption charges within the State-Owned cloud tenant.

· Data Residency and Compliance:

· All data associated with the solution must reside within the State-owned tenant.

· The vendor must ensure compliance with all applicable State and federal regulations, including but not limited to data security, privacy, and sovereignty requirements.

· Deployment and Management:

· The vendor is expected to install, update, and manage the application and other unique aspects of the solution during the project to meet the requirements and as part of Day 2 support / Maintenance and Operations.

· The vendor must utilize state approved tenant specific native tools and services for monitoring, backup, and disaster recovery, as specified by the State.

· Security and Access Controls:

· The vendor shall implement robust security measures, including role-based access control, encryption, and multi-factor authentication, in alignment with Information Security Framework (https://www.in.gov/iot/iot-vendor-engagement/).

· Security documentation and audit logs must be provided to the State regularly.

· Security assessments, including vulnerability scans, must be conducted and reported to the State.

· Exit Strategy:

· Upon contract expiration or termination, the vendor shall ensure a seamless transition of all resources, configurations, and data back to the State, without disruption to ongoing operations.

· A detailed exit plan must be submitted no less than 120 days prior to the contract expiration or termination, including but not limited to timelines and responsibilities, to facilitate this transition.

2) Vendor Hosted Cloud Tenant (Exception Based Cloud Solution) Definition: A vendor managed cloud environment outside of the State’s enterprise agreements.

Justification and Minimum Requirements:

Exceptions to the requirement of utilizing a state-owned cloud tenant will only be considered if there are compelling reasons and justifications as to why hosting in a State-owned cloud tenant is not feasible. The State will evaluate these justifications but is not obligated to agree with any external cloud hosting options and the associated scoring will reflect that.

If proposing a hosted solution that does not use a State-owned cloud tenant, your company is required to, at a minimum:

· Provide a clear justification for why hosting within a state-owned cloud tenant is not feasible.

· Demonstrate independently verified compliance with NIST 800-53, Revision 5 (or the most current version at the time of proposed solution go-live).

· Alternatively, provide a detailed plan that includes independent verification of your company's path toward achieving compliance with NIST 800-53, Revision 5 (or the current version at the time of proposed solution go-live).

· Upon contract expiration or termination, the vendor shall ensure a seamless transition of all resources, configurations, and data back to the State, without disruption to ongoing operations.

· A detailed exit plan must be submitted no less than 120 days prior to the contract expiration or termination, including but not limited to timelines and responsibilities, to facilitate this transition.

· Adhere to the applicable security standards, policies and requirements as outlined by the IOT Cloud Provider Questionnaire, and the IOT Cloud Terms available on the IDOA: Procurement: Contract Forms Manuals and Templates, which include Software as a Service (SaaS), Platform as a Service (PaaS), and Infrastructure as a Service (IaaS) Terms.

3) On-Premises Solutions - Vendor Provided Hardware (Preferred On-Premises Solution) Definition: A vendor provided hardware solution deployed within the States data center.

Minimum Requirements

· The vendor is responsible for procuring, deploying, and maintaining hardware hosted within the State of Indiana datacenters.

· Ensuring that all hardware aligns with the State’s standards and specifications, as outlined the State’s established policies and enterprise standards that collectively constitute the Information Security Framework (https://www.in.gov/iot/iot-vendor-engagement/).

· Meeting the service levels, security protocols, and cost expectations detailed in the "Hosting" section of the IOT-Services-Catalog.pdf.

· Providing full documentation of hardware lifecycle management, including installation, updates, maintenance, and upgrades as needed.

· Ensuring compatibility with existing state systems and providing any necessary adjustments for seamless integration.

· Delivering comprehensive reporting on hardware usage, performance metrics, and any troubleshooting activities during the contract period.

· Upon contract expiration or termination, the vendor shall ensure a seamless transition of all resources, configurations, and data back to the State, without disruption to ongoing operations.

· A detailed exit plan must be submitted no less than 120 days prior to the contract expiration or termination, including but not limited to timelines and responsibilities, to facilitate this transition.

4) On-Premises Solutions – State Owned Hardware (Exception Based On-Premises Solution) Definition: A vendor managed a solution operating on state owned infrastructure.

Minimum Requirements:

· Collaborating with the State to ensure a seamless initial setup, including installation, configuration, and integration with the State’s systems.

· Adhering to the service levels, security requirements, and cost structures outlined in the "Hosting" section of the IOT-Services-Catalog.pdf and as outlined within the Information Security Framework (https://www.in.gov/iot/iot-vendor-engagement/).

· Provide ongoing monitoring, performance optimization, data backup, and disaster recovery services to ensure system reliability and availability.

· Coordinating with the State on any necessary warranty claims or hardware replacements, including detailed reporting and documentation of hardware issues and resolutions.

· Transferring knowledge, if applicable, to the State to facilitate collaboration and long-term operational continuity.

· Upon contract expiration or termination, the vendor shall ensure a seamless transition of all resources, configurations, and data back to the State, without disruption to ongoing operations.

· A detailed exit plan must be submitted no less than 120 days prior to the contract expiration or termination, including but not limited to timelines and responsibilities, to facilitate this transition.

Should an on-premises deployment be considered as an alternative, the system must be capable of running on a Microsoft SQL Server back end (current version) and a Microsoft Operating System (current version) environment or NO SQL or a combination of both.

Web-Based: A fundamental requirement is that the LCMS operates as a 100% web-based application, eliminating the need for software installation on individual desktops or servers. This web-based architecture also mandates accessibility and usability on tablets and smartphones through standard web browsers.

Availability: High availability is paramount for a mission-critical legal system, with a target of 99.5% uptime in a calendar month, or ideally 99.9% availability. The vendor must clearly describe the solution's availability and recovery model (e.g., active/active, active/passive).

Scalability: The system must demonstrate robust scalability to handle a growing number of cases, users, and data volume, and vendors should provide typical performance metrics for large deployments. Specifically, the system should accommodate several hundred concurrent users, with a minimum capacity for at least 250 end users across multiple office sites. The hosting environment must consistently provide adequate capacity to ensure prompt response times for all data inquiries and lookups. This emphasis on operational resilience and minimal data loss is a non-negotiable aspect, ensuring continuous government operations and directly impacting public service delivery and trust.

Data Exchange: Should the system infrastructure be required to be hosted in established IOT enterprise-standardized technologies? Considerations for reusability, security and governance, efficiency, cost savings, and total cost of ownership to INDOT and the State. See: https://www.in.gov/iot/policies-procedures-and-standards/applications-standards/

Database and Infrastructure Compatibility

The LCMS solution must demonstrate comprehensive compatibility with Microsoft Office products, including seamless integration with Microsoft Outlook calendar and email functionalities. Compatibility with Adobe Acrobat Pro is also a mandatory requirement. The system should support all currently prevalent major web browsers. Furthermore, it must be compatible with existing State IT infrastructure, specifically Windows 11 and the Operating System of MS Windows Servers in the current State IT environment. The State of Indiana will specify its precise current environment to ensure exact compatibility.

Data Management

Data ownership is a critical concern for the State. All data generated or managed within the LCMS shall remain the exclusive property of the State of Indiana throughout the entire contract term and any subsequent renewals. Data residency requirements dictate that all data must be stored on servers physically located within the United States, subject to US laws. Confidential State data cannot be stored or accessed outside the Continental U.S. Moreover, all State data must be logically and physically isolated from other customers' or the vendor's own assets.

The vendor must detail its policies for data encryption, covering data both in transit and at rest, and specify the encryption standards and algorithms utilized.

The solution must provide robust data backup mechanisms, with backups maintained in geographically diverse locations to ensure resilience. Comprehensive policies and procedures for data retention and secure deletion, ensuring data is purged when no longer required, are also mandatory. The data migration strategy and support services for transferring existing case data and documents into the new system are crucial, ensuring that legacy data is converted and imported in a readable and usable format. Upon contract termination, all data must be furnished to the State upon request, and the awarded vendor shall have no rights or ability to retain or use the data. This strong preference for cloud-based solutions, coupled with strict data residency and ownership clauses, reflects a clear "cloud-first" strategy that prioritizes data sovereignty and control, balancing the benefits of cloud technology with the imperative of data security and legal jurisdiction for government data.

Third-Party Dependencies and Low-Code/No-Code Capabilities

The vendor must explicitly list any elements of the solution's capabilities that are dependent on functionality provided by third parties, such as rules engine technology, postcode lookup services, or e-signature providers. Furthermore, the vendor's approach to Low-Code/No-Code solutions must be confirmed. This includes clarifying whether internal development teams within the State will be able to automate or create workflows, integrate data, customize user interfaces, manage document generation, and add logic through a low-code environment or by writing code. This capability is important for enabling internal agility and reducing long-term reliance on vendor-specific development for minor system enhancements.

III. Security and Compliance Requirements

This section details the stringent security and compliance mandates for the Legal Case Management System, reflecting the State of Indiana's unwavering commitment to protecting sensitive legal data and adhering to comprehensive regulatory frameworks. The extensive requirements here indicate a multi-layered and highly stringent security framework, driven by the sensitive nature of legal data and the imperative of public trust.

Information Security Management System (ISMS) and Certifications

The selected vendor must possess a robust Information Security Management System (ISMS), with a preference for GovRAMP Authorized status. Detailed certification information should be provided. A critical requirement is for the selected bidder to undertake a full SSAE-18 SOC 2 Type 2 Annual Audit. This audit must specifically include testing the Five (5) Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy. A copy of the complete audit report, along with a comprehensive plan of action for the remediation of any identified deficiencies, must be submitted to the State. The vendor must also disclose all other security audits and attestations regularly undergone (e.g., SOC 2, HIPAA), providing summary reports or attestations.

Data Privacy Compliance

The LCMS solution must ensure full compliance with all relevant US data privacy regulations, including state-specific privacy laws and federal laws such as HIPAA, where applicable to legal healthcare cases. Specific adherence to Criminal Justice Information Services (CJIS) compliance is mandatory, guaranteeing the utmost security for all data, especially confidential criminal justice information. This encompasses stringent requirements for data encryption and encrypted connections for data transport, coupled with multiple levels of security for system access and authentication. The system must also provide robust protection for other sensitive data categories, including Personal Information (PII Compliance) and Payment Information (PCI Compliance).

Vendors are required to provide Data Processing Agreements (DPAs) that fully comply with all applicable legal requirements. The system must inherently support the exercise of data subject rights, such as access, rectification, erasure, and portability, as mandated by US privacy laws. Furthermore, the vendor's software development lifecycle must demonstrate the incorporation of Privacy by Design principles, embedding privacy considerations from the initial stages of development.

Network and Application Security Measures

The vendor must provide a detailed description of its network security measures, which are to include, at a minimum, robust firewalls, intrusion detection/prevention systems (IDS/IPS), anti-virus and malware protections to all data types being uploaded into the Information System, and comprehensive DDoS protection. The approach to application security must be thoroughly explained, detailing methods for authentication, authorization, and the encryption of data both in transit and at rest. The security model for the solution must be clearly articulated, including aspects such as role-based access control and granular permissions, along with its ability to integrate with State-managed identify provider or other identity management systems used by the State.

Vulnerability Management and Incident Response

A comprehensive vulnerability management program must be in place, with details on the frequency of vulnerability scans and penetration testing, specifying whether these tests are performed internally or by external, independent parties. The vendor must possess a formal incident response plan and provide a clear description of its process for detecting, responding to, and recovering from security incidents. Information on security training and awareness programs for all employees involved in the solution's operation is also required. The vendor must also detail how it assesses and manages the security posture of its third-party vendors and partners, ensuring a secure supply chain.

Audits, Attestations, and Disaster Recovery/Business Continuity

An annual Disaster Recovery test is mandatory, with the results provided to the State of Indiana upon request. The vendor must provide a detailed description of its disaster recovery (DR) and business continuity (BC) plans, including explicit Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO). Information on the frequency of DR/BC plan testing and the results of the most recent tests is required. The geographical locations of all DR sites must also be specified.

Adherence to Indiana Office of Technology (IOT) Policies and Standards

The selected bidder must actively collaborate with the Indiana Office of Technology (IOT) and provide all necessary documentation and information to demonstrate full compliance with IOT policies and standards. This includes, but is not limited to, compliance with IOT's Application Deployment Certification, general Security policies, Digital Accessibility standards, Remote Hosting guidelines, Data Transmission policies, and Enterprise-Standardized Technologies (See https://www.in.gov/iot/policies-procedures-and-standards/applications-standards/). IOT is statutorily mandated to establish standards for the state's technology infrastructure and to ensure the greatest possible security for state IT resources. Vendors conducting business with the State of Indiana are required to adhere to IOT's Information Security Framework (ISF). Access to the confidential ISF necessitates the execution of a Non-Disclosure Agreement (NDA). Furthermore, compliance with the statewide Information Technology Resources (ITR) User Policy and Agreement is mandatory for all state employees and contractors utilizing State-provided Technology Assets. This layered approach to security and compliance, integrating various mandates, means that vendors must demonstrate not just compliance with individual standards but a mature, holistic security posture that addresses each of these overlapping requirements.

GovRAMP/StateRAMP Compliance Considerations

For cloud service providers, rigorous documentation and assessment processes are required to achieve GovRAMP/StateRAMP compliance. Compliance involves meeting specific security controls categorized by impact levels (low, moderate, high) and establishing corresponding baseline controls. Key documentation includes comprehensive security control documentation, a detailed System Security Plan (SSP), risk assessment reports, and evidence of security control implementation. Engagement with an accredited Third-Party Assessment Organization (3PAO) is mandatory to conduct independent security assessments, which include in-depth security control reviews, vulnerability scans, and penetration testing. Continuous monitoring is a core requirement, encompassing the completion of Plans of Action and Milestones (POAM) documents, regular updates to vulnerability scans, maintenance of current inventory worksheets, and submission of monthly reports to the StateRAMP Program Management Office (PMO). GovRAMP is founded upon NIST SP 800-53 standards, This emphasis on proactive risk mitigation, through stringent security measures, continuous monitoring, and adherence to public records laws, is fundamental to safeguarding the integrity of legal processes and maintaining public confidence in government services.

Public Records and Data Access Controls

The system must provide robust logging and auditing capabilities for all data access. Audit logs must be viewable by authorized users at the case, user, team, or system level. The State of Indiana is subject to the Access to Public Records Act (APRA), IC 5-14-3 et seq.. Information submitted in response to this RFI will be kept confidential unless a subsequent solicitation results and is awarded. Upon award, the entire solicitation file, including proposal information, may become publicly viewable and copyable. Vendors claiming statutory exemption to APRA must clearly list such documents, specify the applicable statutory exception, and provide a detailed description explaining how the exception applies. Confidential information must be distinctly marked and provided in a separate folder, with a redacted version made available for public records requests. It is explicitly stated that pricing information is not considered confidential.

IV. Implementation and Project Management

This section outlines the expectations for how the Legal Case Management System will be implemented, managed, and deployed, ensuring a seamless transition and successful adoption within the State of Indiana's legal operations. The approach to implementation and project management is critical for minimizing disruption and maximizing the return on investment.

Implementation Methodology and Key Phases

The selected vendor must present a clear and comprehensive typical implementation methodology for new clients, detailing the key phases involved and approximate timelines for each. Detailed project timelines, preferably utilizing Gantt charts, are expected to illustrate the various phases, including installation, comprehensive training, rigorous testing, and the eventual Go-live. The initial phase of implementation, encompassing the creation and installation of the complete LCMS solution along with all necessary training, should adhere to a clearly defined and aggressive timeline, such as the example of completing by June 30, 2018, as seen in other state procurements. The State of Indiana will establish its specific target dates.

A crucial step in the implementation process involves the vendor meeting with State IT staff and selected end-users early in the project to identify any necessary modifications or customizations to the product. This collaborative engagement will also include discussions on how State IT staff and selected users will be integrated and involved throughout the customization, installation, and system implementation processes. This collaborative approach is essential for ensuring that the system is tailored to the State's unique operational needs and that internal teams are prepared for its adoption and ongoing management.

Customer Resource Requirements and Responsibilities

The vendor must clearly specify the resources typically required from the customer during the implementation phase. This includes outlining personnel requirements (e.g., project managers, subject matter experts, technical staff) and any necessary technical infrastructure or environmental prerequisites that the State of Indiana must provide or prepare. This transparency ensures that the State can adequately allocate internal resources and budget for any required infrastructure upgrades, preventing unforeseen delays or costs during deployment.

Data Migration Strategy and Support

A detailed data migration strategy and comprehensive support services are mandatory for transferring existing case data and documents into the new system. The implementation plan must explicitly include the conversion and importation of all legacy data from current systems, ensuring that this imported data is fully readable and usable within the new LCMS solution. This is a critical and often complex aspect of system implementation, and a clear, well-defined strategy is necessary to preserve historical records and ensure business continuity.

Customization and Configuration Services

The vendor must confirm whether they offer professional services for custom development or advanced configuration of the LCMS. This is important for addressing any unique or evolving requirements of the State that may not be met by out-of-the-box functionalities. The extent to which the solution can be configured to meet changing requirements without custom coding, and whether users can customize fields, forms, and templates, should also be detailed. This flexibility promotes long-term adaptability and reduces reliance on vendor-specific development for minor adjustments.

Testing and Deployment Procedures

The vendor must provide a thorough description of its testing and deployment procedures designed to ensure a smooth Go-live. This includes details on various testing phases (e.g., unit testing, integration testing, user acceptance testing), defect management processes, and strategies for minimizing disruption during the transition to the new system. The overall project management approach should ensure all project deliverables are met and the work is performed in a timely manner, with clear accountability for reporting and oversight.

V. Training and Ongoing Support

This section outlines the comprehensive training and ongoing support requirements for the Legal Case Management System, ensuring that State personnel are proficient users and that the system remains operational, secure, and up to date throughout its lifecycle.

Training Programs

The selected vendor is responsible for providing comprehensive training programs for all State of Indiana legal staff who will be LCMS users. This training must be delivered within a reasonable timeframe, aligning with the State's commitment to its end-users. Initial training must be provided for administrators, power users, and general users. The training approach should include both in-person and web-based training options, ideally incorporating a "train-the-trainer" model to enable the State to conduct additional in-house training and leverage electronic resources for ongoing self-service learning. Training should be segmented by specific user groups (e.g., administrators, project managers, contractors) to ensure relevance and effectiveness. Ongoing training for new hires and refreshers for existing users on infrequently used features (e.g., yearly processes, audit logs, system modifications) is also required.

Advanced training must be provided for the Case Management System Administrator Team, covering, at a minimum, all system customization capabilities, rules-based customization for document generation and management, report writing, user access and controls, managing tables, updating configuration settings, and application system maintenance. The vendor must specify the recommended duration for System Administrator Team training and the recommended levels of initial user technical system training. The staff designated to conduct training must possess the requisite experience and qualifications for this task.

Support Availability, Channels, and Service Level Agreements (SLAs)

The vendor must clearly state its standard support hours and availability, specifying coverage (e.g., 24/7, US business hours). A comprehensive list of available support channels (e.g., phone, email, web portal, ticketing system) is required. Detailed Service Level Agreements (SLAs) for response and resolution times, categorized by issue severity, must be provided. This includes specifying average response times for different levels of support, from routine inquiries (e.g., help running a report) to critical incidents (e.g., system crashes).

Bug Fixes, Patches, and System Updates

The vendor must describe its bug fix and patch release cycles, and how updates are communicated and deployed to the State. Regular updates to the software are a mandatory requirement. A formal process for product upgrade and issue requests must be established and communicated.

Documentation, Resources, and User Community

The vendor must provide comprehensive documentation, online resources, or knowledge bases to support self-service by State personnel. The existence of a user community or forum where customers can share best practices and seek advice is a desirable feature.

Account Management

The vendor must confirm whether a dedicated account manager will be provided for ongoing relationship management with the State of Indiana. This ensures a consistent point of contact for strategic discussions and issue resolution.

VI. Vendor Qualifications and Experience

This section outlines the critical qualifications, experience, and references required from prospective vendors to demonstrate their capability in delivering a high-quality Legal Case Management System for the State of Indiana. The evaluation of these criteria will assess the vendor's proven track record, stability, and expertise in the legal technology sector, particularly within a governmental context.

Company Overview and Financial Stability

Vendors must provide a brief overview of their company, including the number of years in business and the total number of employees. Financial performance data, such as annual revenue and profitability for the past three fiscal years (e.g., 2022, 2023, 2024), is required. Any recent mergers, acquisitions, or significant changes in company ownership or structure must be detailed. This information is essential for assessing the vendor's stability and long-term viability as a partner.

Relevant Experience with Similar Projects and Client References

Vendors must demonstrate extensive experience in providing and implementing Legal Case Management Solutions, particularly those with established timelines and within environments comparable to the State of Indiana's IT infrastructure. This includes experience with large-scale implementations, specifically systems supporting a minimum of 250 end-users and several hundred concurrent users across multiple office sites. Experience in managing or providing consulting services for LCMS solutions with defined timeframes is also critical.

A key requirement is the provision of four (4) client references for projects similar in size and scope to the proposed LCMS for the State of Indiana. For each reference, the vendor must provide the organization name, address, contact person, phone number, date of services, and a detailed description of the services provided. These references should be available for contact during standard business hours (e.g., 8:00 AM to 5:00 PM Eastern Time, Monday through Friday). The State reserves the right to consider its own prior contract history with the vendor, regardless of whether it is provided as a reference.

Proposed Project Staffing and Organizational Structure

The vendor must describe its ability to provide adequate project staffing levels to meet the requirements of this initiative. This includes providing the names and titles for all staff members proposed for the project, with particular emphasis on the proposed project manager and contract manager. Resumes for all key staff members assigned to the project are required, detailing their qualifications and relevant experience. The vendor must also outline its plan for ensuring the availability of its project manager, contract manager, and key project staff throughout the entire contract period.

An organizational chart for the proposed project is required, clearly identifying all project personnel by job title, their specific responsibilities, and their names and email addresses. If subcontractors are to be utilized, a list specifying their name, address, phone number, contact person, and a brief description of their organizational capacity and qualifications is mandatory. The vendor must also describe how subcontractors will interact with the primary organization, including oversight and management.

Legal Industry Accreditations and Certifications

Vendors should provide details of any legal industry accreditations, certifications, or partnerships relevant to the US market. This demonstrates specialized knowledge and commitment to the legal technology sector.

Litigation History and Insurance Coverage

Vendors must attach a list of all current litigation in which they are named, as well as a list of all closed cases within the past five years where the vendor paid the claimant as part of a settlement or by decree. For each, the entity suing, the complaint, the accusation, amount, and outcome must be listed. If no litigation has occurred, this should be explicitly stated.

The selected vendor must maintain comprehensive insurance coverage, including general liability insurance at a minimum of $2,000,000 and cyber security coverage at a minimum of $5,000,000. A certificate of insurance on a standard Acord form (or equivalent) evidencing the vendor’s general liability, professional liability, and any other relevant liability insurance policies associated with the proposed services is required.

VII. Cost and Commercials

This section outlines the required cost information and commercial terms for the Legal Case Management System, enabling the State of Indiana to evaluate the total cost of ownership and ensure financial transparency.

Licensing Model and Pricing Tiers

The vendor must describe its typical licensing model (e.g., per user, per case, subscription-based, perpetual license). If different pricing tiers or packages are offered, a brief overview of what each tier includes must be provided.

Estimated Implementation and Training Costs

A detailed estimate or breakdown of typical implementation costs is required. This should include costs for hosting the setup, project planning, analysis and design, configuration, customization, testing, and delivery. Any costs associated with training programs, both initial and ongoing, must be outlined. If any portion of the implementation or training is proposed at an hourly rate rather than a fixed fee, a schedule of hourly rates for all proposed staff and the estimated time commitment for each person must be included.

Annual Support and Maintenance Fees

The vendor must specify the annual support and maintenance fees, clarifying whether these are included in the licensing fee or are billed separately. Costs and pricing for annual maintenance or per-transaction fees for the next five years are required. Any other ongoing or annual costs for software licensing, support, or maintenance that are required or recommended must be indicated. If licensing is required, the basis (e.g., site, name, concurrent users, machine) must be specified.

Total Cost of Ownership (TCO) Considerations

Vendors should provide any information that would help the State understand the Total Cost of Ownership (TCO) for the solution over a 3–5-year period. This includes outlining any necessary hardware or peripheral requirements of their system and providing itemized pricing if they supply this equipment.

Payment Terms and Reimbursable Expenses

The vendor's standard payment terms must be clearly stated. Any reimbursable expenses requested by the vendor to be paid by the State must be explicitly defined. If the proposed system requires specific payment processing or if it can be configured (e.g., credit card processing through a specific vendor), this must be indicated, along with the frequency and method by which receipts are transmitted to the State. Any associated fee schedules for payment processing must also be included.

VIII. Conclusion

The development of this Scope of Work for a Legal Case Management System for the State of Indiana reflects a comprehensive approach to modernizing legal operations. The detailed functional and technical requirements underscore the State's commitment to enhancing efficiency, ensuring robust data management, and fostering improved collaboration across its legal departments. The emphasis on a cloud-based solution, coupled with stringent data residency and ownership clauses, highlights a strategic balance between leveraging scalable technology and maintaining critical data sovereignty and control.

Furthermore, the extensive security and compliance mandates, encompassing ISMS certifications, CJIS adherence, and alignment with Indiana Office of Technology (IOT) policies and GovRAMP/StateRAMP considerations, demonstrate a multi-layered commitment to protecting sensitive legal data. This proactive stance on risk mitigation, through continuous monitoring, regular audits, and robust disaster recovery planning, is fundamental to safeguarding the integrity of legal processes and maintaining public trust in governmental services.

The detailed expectations for implementation, training, and ongoing support services indicate a desire for a partnership that ensures not only successful system deployment but also long-term operational proficiency and adaptability. The structured approach to vendor qualifications and cost transparency aims to identify a partner capable of delivering a solution that offers the best overall value to the State. Ultimately, this initiative is poised to transform the State of Indiana's legal landscape, enabling more efficient, secure, and data-driven legal service delivery for the benefit of its citizens.