ATTACHMENT 19: APPENDIX A - STATEMENT OF WORK

1. Background and Purpose

1.1. Background

The California Interagency Council on Homelessness (Cal ICH) was created by SB 1380 in 2017 as the Homeless Coordinating and Financing Council to oversee the implementation of Housing First policies, guidelines, and regulations to reduce the prevalence and duration of homelessness in California.

In 2021, Governor Newsom signed AB 1220 into law, which renamed and restructured the Council to continue California’s forward momentum towards the state’s broader vision for greater statewide leadership and coordination around its response to the homelessness crisis. The Council, co-chaired by the Secretaries of the Business, Consumer Services and Housing Agency and the California Health and Human Services Agency, is a committee comprising director-level representatives from 18 state departments and agencies, with two individuals representing community organizations appointed by the state Legislature.

The Council regularly seeks guidance from an advisory committee and Lived Experience Advisory Board (LEAB) that reflects the racial and gender diversity of people experiencing homelessness and may also invite stakeholders such as, individuals who have experienced homelessness, members of philanthropic communities and experts to participate in meetings or provide information to the Council as needed.

The Council's mission is to develop policies and identify resources, benefits, and services to prevent and work toward ending homelessness in California.

To support Cal ICH’s mission, the State developed a Software as a Service (SaaS) solution to establish a data warehouse that collects and aggregates local Homeless Management Information System (HMIS) data received from various programs throughout the state and consolidates and aggregates that data into one comprehensive reporting system. This system is referred to as the Homeless Data Integration System (HDIS). The HDIS provides the State with an unduplicated count of people accessing services while experiencing homelessness in California, and allows the state to gain insights into the characteristics of people accessing services and the patterns of services access. The HDIS currently receives data from the forty-four (44) regionally-based California Continuums of Care (CoCs) that coordinate housing and services for homeless individuals in specific geographic areas and enter in data through forty-four separate HMIS modules. A variety of service providers, including nonprofits and local government entities, comprise the CoC, implement the CoCs’ projects. Each CoC manages an HMIS system which collects specific data elements prescribed by the United States Department of Housing and Urban Development (HUD) in the HMIS Data Standards Manual. Each CoC functions uniquely and independently of one another.

State of California California Interagency Council on Homelessness

RFP 27-ICH-001

Part 2 - Bidder Response

July 10, 2026 https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=201520160SB1380 https://www.hudexchange.info/resource/3892/housing-first-in-permanent-supportive-housing-brief/ https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202120220AB1220 https://www.bcsh.ca.gov/calich/hdis.html https://www.bcsh.ca.gov/calich/hdis.html

1.2. PURPOSE

The HDIS is crucial to accomplishing the California Interagency Council on Homelessness (Cal ICH) mission to reduce the prevalence and duration of homelessness in California. Cal ICH is statutorily required by Chapter 847, Statutes of 2016 (SB 1380) to create and maintain this statewide data warehouse and to share this data with Council Member agencies or departments to support statewide efforts to prevent and end homelessness (WIC 8257).

Several other statutory requirements require data from HDIS to implement, including:

• Chapter 397, Statutes of 2021 (AB 977): requires collection of data from state-administered homelessness programs in HDIS, and reporting of this program data back to administering departments.

• Chapter 263, Statutes of 2024 (AB 799): requires publication of metrics for state homelessness programs generated by HDIS data

• HSC 50220.7-50239: requires HDIS-generated local-level performance metrics called California System Performance Measures (CA SPMs) for the Homeless Housing, Assistance, and Prevention (HHAP)grant program (any delays in HDIS data jeopardize the ability to provide cities, counties, and CoCs funding to address homelessness).

• Chapter 69, Statutes of 2021 (SB 914): requires performance metrics related to homelessness among survivors of domestic violence and their children and unaccompanied women.

• Chapter 841, Statutes of 2018 (SB 918): requires performance metrics related to homelessness among unaccompanied youth.

State of California California Interagency Council on Homelessness

RFP 27-ICH-001

Part 2 - Bidder Response

July 10, 2026 https://www.bcsh.ca.gov/calich/mission.html

Figure 1.0 HDIS Conceptual View

2. Description of Services

Cal ICH is seeking the services of a Contractor to continue the maintenance and operation of the HDIS.

The data within HDIS is crucial for gaining insights into characteristics and identifying patterns of services accessed by people experiencing homelessness.

The HDIS was launched in June 2021 and contains vital data dating back to 2017. The data in HDIS is utilized to inform the State of California's response to the homelessness crisis and is vital for providing transparency and accountability of measuring outcomes related to Legislative Mandates, Public Records Act (PRA) requests, and data transfers to council member departments. The HDIS contains both PII and Non-PII Information and Cal ICH has established a governance process and data use agreements to protect and safeguard this information. The Contractor must abide by all applicable information and data security policies.

The HDIS is crucial in the delivery of the following work products (but not limited to):

State of California California Interagency Council on Homelessness

RFP 27-ICH-001

Part 2 - Bidder Response

July 10, 2026

HDIS Work Products

Work Products Description Action Plan Report Cal ICH adopted a three-year Statewide Action Plan to Prevent and

End Homelessness. Cal ICH utilizes measures developed using data from HDIS for the Action Plan. The HDIS team pulls data quarterly in a report to the Council Members, including demographic disaggregation.

Frequency: Yearly

Statewide Homelessness Assessment

Cal ICH published a statewide assessment of homelessness in 2023.

The report used HDIS data about service use and outcomes from 2018-2021.

Frequency: One-Time

CA Systems Performance Measure (CA SPM) Report

(Statutory Requirement)

Cal ICH has calculated a set of measures (CA SPMs) for the state and each CoC on a quarterly basis. The research and HDIS team pull and validate the measures before sending each CoC their measures in a CA SPM report (in the form of a workbook) and publishing them on the state’s open data portal.

Frequency: Quarterly

CA Systems Performance Measure Dashboard

(Statutory Requirement)

The CA Systems Performance Measure Dashboard will allow CoCs to view the CA SPM reports with trends over time and view crosscuts demographic data. The Dashboard will only contain data already released in the CA SPM report workbook.

Frequency: Quarterly

CoC Data Quality Dashboard

(Statutory Requirement)

The CoCs Data Quality Dashboards are used by CoCs as part of their quarterly HDIS upload process. CoCs upload their HDIS Files to the tool to view a dashboard showing summarized and detailed analytics on missing data and errors in their uploads.

Frequency: Quarterly

AB977 Data Summaries Dashboard

The AB 977 Data Summaries Dashboards provide state department staff administering AB 977 programs insight into service levels, characteristics of populations served, and service outcomes of AB 977

State of California California Interagency Council on Homelessness

RFP 27-ICH-001

Part 2 - Bidder Response

(Statutory Requirement) programs. These dashboards also enable quick aggregation and download of the AB 977 program data for reporting or analysis purposes.

Frequency: Quarterly

AB977 State Department Compliance Dashboard

(Statutory Requirement)

The AB 977 State Department Compliance Dashboards equip state department staff to monitor AB 977 compliance and improve data quality for the programs they are administering. Users can monitor the number of projects and grantees for each program and identify projects, programs and grantees with errors in their AB 977-mandated data.

Frequency: Quarterly

HHAP HDIS Reported Outcomes Dashboard

(Statutory Requirement)

The HHAP, ERF, and FHC HDIS Reported Outcomes Dashboard is a public dashboard, based on the AB 977 Data Summaries dashboards.

The dashboard visualizes service levels, characteristics of populations served, and service outcomes of the HHAP, ERF and FHC programs.

Frequency: Quarterly

HDIS Public Dashboard

(Statutory Requirement)

The HDIS Public Dashboard displays baseline data related to the homelessness response system. The Dashboard includes counts of people experiencing homelessness, statewide and by CoC, broken out by year. Included are counts by household type, racial equity, race, gender, and other special populations.

Frequency: Quarterly

HDIS CoC Dashboard

(Statutory Requirement)

The HDIS CoC Dashboard aims to support CA Continuums of Care by presenting the data submitted by each CoC in various formats. Data includes service counts, in-flows and out-flows, racial equity, exits by project type, and cross-CoC service are all reflected in the dashboard.

Frequency: Quarterly

HDIS Connect Cal ICH’s HDIS Connect is a bi-monthly workshop series for HMIS admins and leads. The mission of the series is to facilitate broad

State of California California Interagency Council on Homelessness

RFP 27-ICH-001

Part 2 - Bidder Response knowledge sharing on HDIS and HMIS best practices. The workshops are interactive and consist of presentations and discussions on specific topics relevant to HMIS admins and leads. Topics covered in this series include discussion of data quality tools and practices.

Frequency: Quarterly

OTSIand CDCR Data Transfers and other Data Transfers through approved BUCP (Business Use Case Proposal)

(Statutory Requirement)

Cal ICH has entered into an agreement to transfer data to the Office of Technology Solutions Integration (OTSI). OTSI was established within Cal HHS to provide leadership in integrating Cal HHS datasets and fostering effective, equitable and consistent data-driven decision-making. This data transfer enables Cal HHS to support efforts to prevent and end homelessness in California by identifying persons experiencing homelessness or housing instability, integrating their data with persons receiving Cal HHS services and programs, evaluating service use as well as service gaps among people experiencing homelessness.

Cal ICH has also entered into an agreement to transfer data to CDCR to identify formerly incarcerated individuals who are experiencing or have experienced homelessness to reduce occurrences of homelessness among this population.

Cal ICH is statutorily required to share data with partner and non-partner agencies through the BUCP (Business Use Case Proposal) Process.

Frequency: Quarterly

Public Records Requests

(PRA)

(Statutory Requirement)

Public Records Requests (PRA) typically start as an email inquiry (to the hdis@bcsh.ca.gov account), where the requestor asks about data that may be in HDIS. PRAs are urgent, and have a legally enforced timeline for response. The majority of external requests are for demographic or outcomes data related to persons experiencing homelessness.

Cal ICH also completes custom data requests for other California State Departments.

Frequency: Ongoing

State of California California Interagency Council on Homelessness

RFP 27-ICH-001

Part 2 - Bidder Response

Internal Data Requests Internal Requests are requests that come from the Research, Grants, Policy, or Local Initiatives teams. Previous examples include reporting for HHAP and ERF grants, or the work we did in October 2023 for the Action Plan Update. Internal requests usually have hard deadlines and concern efforts central to the mission of Cal ICH. These requests can be complex and tailored to specific policy agendas or reporting metrics.

Frequency: Ongoing

SB914 Data Goals and Dashboard

(Statutory Requirement)

Cal ICH has created a set of initial metrics to measure progress towards the state’s goals to end homelessness among unaccompanied youths and survivors of domestic violence. The research team is continuing to develop additional metrics and is working with the HDIS team to calculate these metrics.

Cal ICH’s Research and HDIS teams developed a dashboard to display a set of measures specifically for unaccompanied women and survivors of domestic violence at the statewide and local level. Cal ICH is working on a second version of this dashboard.

Frequency: Yearly

SB918 Data Goals and Dashboard

(Statutory Requirement)

Cal ICH will develop a set of metrics to measure progress towards the state’s goals to end homelessness among unaccompanied youths.

Cal ICH will then develop a dashboard to display the metrics.

Frequency: Yearly

AB799 Outcome Measures

(Statutory Requirement)

AB 799 requires Cal ICH to report on outcomes data from state funding programs utilizing HDIS data. Cal ICH is working to develop new performance measures and will report on those measures in a dashboard.

Frequency: Quarterly

Open Data Portal Upload Cal ICH uploads and maintains several datasets to the state's Open data Portal, including Yearly Statewide and by Continuum of Care total counts of individuals receiving homeless response services by age group, race and ethnicity, and gender. The Open Data Portal

State of California California Interagency Council on Homelessness

RFP 27-ICH-001

Part 2 - Bidder Response

July 10, 2026 https://dcao365.sharepoint.com/:f:/r/sites/CALICH-SP-Policy-and-Research-Team/Shared%20Documents/Data%20Requests/Action%20Plan%20Report%20Metrics%20(Policy%20Team)?csf=1&web=1&e=qeh7Du https://dcao365.sharepoint.com/:f:/r/sites/CALICH-SP-Policy-and-Research-Team/Shared%20Documents/Data%20Requests/Action%20Plan%20Report%20Metrics%20(Policy%20Team)?csf=1&web=1&e=qeh7Du allows the public to access and download the data in various formats.

Frequency: Ongoing

These work products are essential for informing the Administration, the Legislature and the public on the progress and the impact of the State's response to the homelessness crisis.

The diagram below illustrates the process by which data from the 44 Continuums of Care (CoC) is loaded, transformed, and presented as it moves through the various software components that make up the HDIS Platform. A detailed process is described in SECTION 7.3. HDIS Data Management.

Figure 2.0 HDIS Data Lineage

3. Term of Contract

Effective upon approval of CDT, Office of Statewide Technology Procurement (OSTP), the base term of the Contract is three (3) years with an estimated start date of July 1st, 2027.

The State, at its sole discretion, may exercise its option to execute two (2), one-year extensions for a maximum Contract term of five (5) years at the rates specified in the EXHIBIT A: COST WORKBOOK .

State of California California Interagency Council on Homelessness

RFP 27-ICH-001

Part 2 - Bidder Response

The State is not obligated to use any or all of these optional extensions.

The Contractor shall not be authorized to deliver goods or commence performance of services described in this Agreement prior to the Effective Date. Any delivery of goods or performance of services by the Contractor that is commenced prior to the Effective Date shall be at no cost to the State.

4. Amendment

The Agreement may be amended, consistent with the terms and conditions of the Agreement, and by mutual consent of both parties, subject to approval by the CDT Office of Statewide Technology Procurement under Public Contract Code (PCC) Section 12100. No amendment or variation of the terms of this Agreement shall be valid unless made in writing, signed by the parties, and approved by oversight agencies if required. No oral understanding not incorporated in the Agreement is binding on any of the parties.

5. Location and Availability

The Contractor shall provide the services described in this Statement of Work (SOW) during normal State business hours, which are 8AM to 5PM PT, Monday through Friday, excluding State holidays. However, the Contractor may be required to provide support beyond the normal business hours, as required to successfully provide contracted services. Some tasks not requiring the Contractor's on-site presence may be performed offsite if pre-approved in writing by the State. All remote work must be performed within the continental United States. The Contractor may be required to travel to Cal ICH's headquarters for meetings or to perform tasks at no cost to the State. The State will allow the Contractor to propose remote staff, based only in the continental United States.

State holidays are listed on the California Department of Human Resources (Cal HR) website in the link below, and are subject to change:

https://www.calhr.ca.gov/employees/Pages/state-holidays.aspx

Work Location and Address

Work Location Name Work Location Address

Cal ICH Headquarters

May Lee State Office Complex

651 Bannon Street

Sacramento, CA 95811

State of California California Interagency Council on Homelessness

RFP 27-ICH-001

Part 2 - Bidder Response

July 10, 2026 https://www.calhr.ca.gov/employees/Pages/state-holidays.aspx

6. Contract Representatives

All inquiries during the term of this Agreement will be directed to the contract contacts listed below.

Contract contacts may be changed by written notice without amending this Agreement.

CONTRACT MANAGER

STATE CONTRACTOR

Name: TBD Name: TBD

Title: Title:

Telephone Number: Telephone Number:

E-mail Address: E-mail Address:

PROJECT MANAGER

STATE CONTRACTOR

Name: TBD Name: TBD

Title: Title:

Telephone Number: Telephone Number:

E-mail Address: E-mail Address:

7. Maintenance and Operation

The Contractor shall perform all the activities in SECTION 7. Maintenance and Operation .

7.1. Project/Program Management

The Contractor shall coordinate and conduct regular check-in meetings with Cal ICH to review the status of new, ongoing, or planned activities. These meetings shall address progress tracking, issue resolution and escalation, risk mitigation strategies, and other relevant operational matters. Check-in meetings shall be held at a minimum frequency of twice per week.

The Contractor shall use JIRA to present the progress of all the activities in HDIS. The Contractor shall be

State of California California Interagency Council on Homelessness

RFP 27-ICH-001

Part 2 - Bidder Response responsible for creating agendas, documenting notes and decision points, and assigning action items.

7.2. HDIS Platform Management

As depicted in the diagram below, the HDIS solution is constructed on a resilient and scalable architecture utilizing best-in-class, industry-standard software components.

Figure 3.0 HDIS Platform

HDIS is currently using the following software. The table below lists the software name and description.

Further details, including number of licenses and specifications, are provided in EXHIBIT A: COST

WORKBOOK.

HDIS Software and Description

SOFTWARE DESCRIPTION

GitHub GitHub serves as a version control platform, leveraging Git to track and manage changes in code efficiently. It facilitates streamlined collaboration between the Contractor and Cal ICH teams by providing capabilities for

State of California California Interagency Council on Homelessness

RFP 27-ICH-001

Part 2 - Bidder Response hosting repositories (organized collections of code files), reviewing and managing code modifications, creating branches for isolated development or experimentation, and integrating contributions through merge operations.

JIRA JIRA serves as the project management and issue tracking platform utilized by the Contractor and Cal ICH teams. It facilitates bug tracking, sprint planning, task management, and the monitoring of project workflows. JIRA offers a versatile and structured environment for organizing and prioritizing tasks, ensuring that the Contractor and Cal ICH teams maintain operational efficiency and adhere to project timelines.

Informatica The HDIS uses Informatica, the provider of data integration and management solutions. It offers a scalable platform for data integration, quality, governance, master data management, and cloud data management, enabling real-time processing and supporting seamless business operations across industries.

Snowflake The HDIS uses Snowflake, a cloud-based data platform for data warehousing, analytics, and management. It is highly scalable, fully managed, and natively cloud-based, providing features like data warehousing, compute and storage separation, multi-cloud support, data sharing, and support for semi-structured data.

Tableau The HDIS uses Tableau Enterprise, a data visualization and business intelligence tool that transforms raw data into actionable insights through interactive and shareable dashboards. It supports data connectivity, advanced analytics, and collaboration, making it ideal for data analysis, performance tracking, and decision-making across industries.

Okta The HDIS uses Okta, a cloud-based IAM platform that centralizes identity management, streamlining authentication and authorization for secure access across applications, devices, and services. Key features include Single Sign-On (SSO), Multi-Factor Authentication (MFA), user provisioning, adaptive security, directory integration, and API access management.

Datto RMM Datto RMM is a cloud-based platform that enables MSPs to remotely monitor, manage, and support IT environments. It provides a centralized interface for deploying software, automating maintenance tasks, monitoring system health, and enforcing cybersecurity policies.

AWS The HDIS uses Amazon Web Services (AWS) for hosting and storing the data, managing databases and applications all through the cloud. The HDIS also uses AWS for Disaster Recovery.

State of California California Interagency Council on Homelessness

RFP 27-ICH-001

Part 2 - Bidder Response

Sentinel One

SentinelOne is a next-generation endpoint security platform that uses AI-powered autonomous threat detection and response to protect endpoints, cloud workloads, and IoT devices. It is used by IT teams and Managed Security Service Providers (MSSPs) to secure environments against modern cyber threats, including ransomware, fileless malware, and zero-day exploits.

BlackPoint

Blackpoint Cyber is a leading Managed Detection and Response (MDR) provider that delivers real-time threat detection, response, and containment. It is designed to help organizations and MSPs protect their environments from advanced cyber threats by combining proprietary technology with a 24/7 Security Operations Center (SOC).

Datto (Box Style) This is a backup capability for CoCs to submit their files.

The Contractor is responsible for maintaining the HDIS Platform. This includes proactive system monitoring, performing regular diagnostic checks, optimizing hardware and software configurations, managing updates and patches, addressing any identified vulnerabilities, and ensuring adherence to industry best practices for data integrity and cybersecurity. Additionally, the Contractor must provide detailed performance reports, implement scalability measures, and swiftly resolve incidents to minimize downtime and ensure seamless functionality of the platform.

These activities are detailed in the succeeding subsections.

7.2.1. Licensing Management

The Contractor shall facilitate the procurement, invoicing and renewal of the following software required for the HDIS Platform. All licenses must be procured in Cal ICH’s name, with Cal ICH designated as the owner. The Contractor will manage these licenses on behalf of Cal ICH; however, this arrangement must ensure that, when needed, Cal ICH (or its designee) can transition full management and control of the licenses without restriction.

HDIS Software Licenses

Line # Software No of Users/Description

Project Management

1 Atlassian JIRA (Standard Edition) 25

State of California California Interagency Council on Homelessness

RFP 27-ICH-001

Part 2 - Bidder Response

2 GitHub (Enterprise Edition) 6

Amazon Web Server (AWS)

3 3 IDMC

vCPU: 4

RAM: 16GB

4 2 MDM

vCPU: 4

RAM: 16GB

5 2 RDS

vCPU: 2

RAM: 16GB

6 1 Domain Controller vCPU: 4

RAM: 16GB

Okta

7 Okta Support Silver Package 1

8 Okta IT Products Single Sign-on 325 Users 325

9 Okta IT Products Universal Directory 325 Users 325

10 Tableau Enterprise

11 Tableau Cloud - Creator 7

12 Tableau Cloud - Explorer 10

13 Tableau Cloud - Viewer 250

Snowflake

14 Compute Cost HDIS on average uses 1.5K units per month.

Storage at Terabyte (unused consumption will roll over the following year)

HDIS uses around .5 TB per month

Informatica

Customer (B2C) per consolidated records (S) Production Annual Subscription

1,900,000

17 Premium Success for Subscription 4

State of California California Interagency Council on Homelessness

RFP 27-ICH-001

Part 2 - Bidder Response

Informatica MDM - Customer 360 (S) Production Annual Subscription

Intelligent Management Cloud -IPU per consecutive month

Informatica BPM Option for MDM and MDM Product 360 Production Annual Subscription

AWS

21 SSL Certificates 1

DATTO

22 Box Style License 44

DATTO RMM

23 Kaseya 365 Ops

8 24 Kaseya 365 Endpoint

25 Kaseya 365 User

SentinelOne Singularity Commercial

26 SentinelOne Singularity Commercial 1

BlackPoint Cloud Response

27 MDR (Managed Detection & Response)

8 28 Cloud Response

29 Application Control

Acquisition of new software applications is prohibited under this contract; only an increase in the quantity of existing, pre-approved licenses as in EXHIBIT B: COST WORKBOOK may be procured (due to user access expansion and data growth), and such increases must be executed through a formal contract amendment.

The total number of licenses may increase, but the associated cost will not exceed 20% of the combined total cost outlined in Tabs 3. Product Cost (monthly), 4. Hosting Cost (monthly), and 5.

Product Cost (annually) in EXHIBIT B: COST WORKBOOK for Years 2 through 5. The additional licenses will be allocated and utilized based on the operational needs of Cal ICH.

State of California California Interagency Council on Homelessness

RFP 27-ICH-001

Part 2 - Bidder Response

July 10, 2026 https://sb.cityinnovate.com/account/solicitations/documents/378854 https://sb.cityinnovate.com/account/solicitations/documents/378854

7.2.2. Performance Management

The Contractor shall perform monthly monitoring tasks to ensure the HDIS Platform performs at a baseline performance threshold consistent with the SLA's defined below.

HDIS Performance Management SLA

Title Description

Name HDIS Performance Management

SLAs

1. 90% of the dashboard pages are loaded completely in less than five (5) seconds, 24 hours a day, and 7 days a week.

2. 90% of the HDIS queries are completed in less than sixty (60) seconds.

Measurement Process

Measurement will be performed using the web log analysis tool that is native to Snowflake and Tableau. This functionality allows for parsing the server log files from a web server, System Response Time SLA 1: For Tableau, the web log analysis will be used to determine the page load speeds for all web pages of the HDIS application and verify if 90% of the pages are loaded in less than five(5) seconds.

System Response Time SLA 2: For Snowflake, the web log analysis will be used to evaluate the query execution of HDIS queries to be completed in less than 60 seconds for medium to complex SQL.

Liquidated Damages

System Response Time for SLA 1 and SLA 2: The State will evaluate the Contractor’s performance on a monthly basis. For each month in which the Contractor fails to meet the required SLA, the State may assess Liquidated Damages in the form of price credits. Price credits shall be applied as deductions against future invoice(s) until fully satisfied.

For purposes of Liquidated Damages, the State shall count and assess failures on a monthly basis. At the beginning of each month, the Failure count resets. Cal ICH will calculate the Liquidated Damages amount by applying the percentage listed in the table below to the annual Maintenance and Operations (M&O) and Product Cost of the Contract. The annual amount is defined as the twelve (12)‑month period beginning on the

State of California California Interagency Council on Homelessness

RFP 27-ICH-001

Part 2 - Bidder Response

Title Description

Contract Start Date and recurring in successive twelve (12)‑month intervals thereafter.

FAILURE TO MEET SLA LIQUIDATED DAMAGES AMOUNT

First Failure Meeting to discuss, no LDs assessed.

Second Failure 0.020% Price credit

Third Failure 0.040% Price credit

Fourth Failure 0.060% Price credit

Greater than four failures 0.080% Price credit

Measurement Period Monthly, throughout the duration of the contract

Reporting The Contractor shall provide a Monthly System Performance Report and an immediate report should any of the SLA's are not met.

7.2.3. Availability Management

The Contractor shall be responsible for monitoring the HDIS Platform to ensure availability and verifying system backups. This role guarantees uninterrupted access to HDIS, in alignment with the Service Level Agreement detailed in the table below, covering uptime, availability, and recovery. Additionally, the Contractor is accountable for performing scheduled or unscheduled maintenance activities and assigning appropriate personnel to handle these tasks. Furthermore, the Contractor must notify Cal ICH of any maintenance activities, whether scheduled or unscheduled.

HDIS Availability Management SLA

Title Description

Name HDIS Availability Management: Production Environment

SLA

The HDIS must be available 99.00%, 24 hours a day, 7 days a week except scheduled downtime.

State of California California Interagency Council on Homelessness

RFP 27-ICH-001

Part 2 - Bidder Response

Measurement Process

The Contractor shall be responsible for meeting the HDIS Availability

SLA.

The HDIS Availability SLA shall be calculated as follows:

• (100 * Data Element A) / (Data Element B)

• Definitions:

1. Data Element A = (Month Minutes) – (Contractor-Scheduled Downtime Minutes) – (Downtime Minutes Not Attributable to the Contractor) – (Unscheduled Downtime Minutes Attributable to the Contractor)

2. Data Element B = (Month Minutes) – (Contractor-Scheduled Scheduled Downtime Minutes) – (Downtime Minutes Not Attributable to the Contractor)

3. Month Minutes: The number of minutes within the reporting period.

4. Contractor-Scheduled Downtime Minutes = The number of minutes of Contractor-scheduled, State-approved downtime during the reporting period. All planned maintenance Downtime and requests for HDIS System Downtime shall be made to the State in advance and approved by the State.

5. Downtime Minutes Not Attributable to the Contractor = The number of minutes of downtime during the reporting period that is not attributable to or caused by the Contractor (e.g., State-directed downtime, interruption of services due to State connectivity issues, etc.)).

6. Unscheduled Downtime Minutes Attributable to the Contractor = The number of minutes of unscheduled, non-State-directed downtime as defined by the duration of all Priority Level 1 and Priority Level 2 incidents that are caused by the Contractor that impact the system during the reporting period.

State of California California Interagency Council on Homelessness

RFP 27-ICH-001

Part 2 - Bidder Response

Liquidated Damages

The State will evaluate the Contractor’s performance on a monthly basis. For each month in which the Contractor fails to meet the required SLA, the State may assess Liquidated Damages in the form of price credits. Price credits shall be applied as deductions against future invoice(s) until fully satisfied.

For purposes of Liquidated Damages, the State shall count and assess failures on a monthly basis. At the beginning of each month, the Failure count resets. Cal ICH will calculate the Liquidated Damages amount by applying the percentage listed in the table below to the annual Maintenance and Operations (M&O) and Product Cost of the Contract.

The annual amount is defined as the twelve (12)‑month period beginning on the Contract Start Date and recurring in successive twelve (12)‑month intervals thereafter.

FAILURE TO MEET SLA LIQUIDATED DAMAGES AMOUNT

First Failure Meeting to discuss, no LDs assessed

Second Failure 0.020% Price credit

Third Failure 0.040% Price credit

Fourth Failure 0.060% Price credit

Greater than four failures 0.080% Price credit

Measurement Period Monthly, throughout the duration of the contract.

Reporting

Any Unscheduled Downtime Minutes Attributable to the Contractor must be reported to the State within thirty (30) minutes of occurrence and documented and explained in writing to the State within forty-eight (48) hours.

The Contractor shall report all occurrences and duration of each such Downtime, on the fifth day of the calendar month for the prior calendar month.

State of California California Interagency Council on Homelessness

RFP 27-ICH-001

Part 2 - Bidder Response

7.2.4. Scalability Management

As data volume, query complexity and user concurrency increase over time, the ability to scale the HDIS Platform to continue to support Cal ICH is crucial.

The Contractor will include scalability planning into quarterly reviews aligned with anticipated growth in data sources, user base, reporting demands and implementation of Statutory or Council Mandates.

Scalability planning should also include recommendations on data cleanup and re-allocation of resources i.e. review of unused Tableau licenses, etc. These reviews will inform licensing adjustments.

7.2.5. Environment Management

The Contractor shall be responsible for establishing, managing, and monitoring all environments related to the HDIS Platform, including Development, Test, Staging, and Production.

The Contractor shall implement a structured environment management strategy that ensures workload isolation, minimizes operational risks, and facilitates seamless testing and deployment of platform enhancements. Each environment shall be distinctly defined with dedicated configurations, access controls, and data refresh policies to support various development lifecycle stages, such as data modeling, ETL testing, query optimization, and user acceptance testing (UAT).

The Contractor shall also manage environment monitoring and access governance by utilizing audit trails, activity logs, and real-time monitoring tools to prevent misuse and safeguard sensitive data in compliance with applicable State and regulatory requirements.

Environment refresh procedures shall be followed to ensure timely updates of Test and Staging environments with production-like data, incorporating appropriate data masking or anonymization as required. Furthermore, the Contractor shall document change management processes for environments, including version control, deployment scheduling, and rollback mechanisms to address potential failures.

The Contractor shall perform regular environment health checks and audits to assess performance, stability, and resource utilization. Results of these assessments shall be reported to the State on a monthly basis and leveraged to guide ongoing improvements to environment configurations and access governance.

7.2.6. User Management

The Contractor shall follow the user access management framework for the HDIS Platform. The Contractor shall implement role-based access control (RBAC) to ensure user permissions are aligned strictly with operational roles, enforcing the principle of least privilege.

The Contractor, in coordination with Cal ICH shall perform regular access reviews and audits to promptly

State of California California Interagency Council on Homelessness

RFP 27-ICH-001

Part 2 - Bidder Response identify and remove any unnecessary or outdated permissions, thereby mitigating security risks. On a quarterly basis, the Contractor is required to update the User List Documentation and coordinate a review with Cal ICH to review existing users for purposes of deletion or updates to roles and permissions.

Cal ICH will be the final approver of 1) adding users 2) deleting users 3) updating a user's access.

7.2.7. Security Incident Management

The Contractor should promptly resolve any breach and must employ prompt mitigation of threats to minimize business impact.

California law requires a state agency to notify any California resident whose unencrypted personal information, as defined, was acquired, or reasonably believed to have been acquired, by an unauthorized person. (California Civil Code s. 1798.29(a).)

Any agency that is required to issue a security breach notification to more than 500 California residents as a result of a single breach of the security system shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General.

(California Civil Code s. 1798.29(e).)

Cal ICH requires Contractor to report any breach within 24 hours and to prepare a report that contains the required notice information in California Civil Code section 1798.29(d).

The Liquidated Damages will only apply to security breaches that are resulting from the Contractor's mismanagement or negligence.

HDIS Security Incident Management: Notification Response Time SLA

Title Description

Name HDIS Security Incident Management: Notification Response Time

SLA

Any breach of the HDIS shall be reported to Cal ICH immediately upon discovery.

Measurement Process Measurements will be performed from the time the Contractor learned of the incident to when Cal ICH received written notification.

Liquidated Damages

The State will evaluate the Contractor’s performance on a monthly basis.

For each month in which the Contractor fails to meet the required SLA, the State may assess Liquidated Damages in the form of price credits.

State of California California Interagency Council on Homelessness

RFP 27-ICH-001

Part 2 - Bidder Response

July 10, 2026 http://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.29 http://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.29

Price credits shall be applied as deductions against future invoice(s) until fully satisfied.

For purposes of Liquidated Damages, the State shall count and assess failures on a monthly basis. At the beginning of each month, the Failure count resets. Cal ICH will calculate the Liquidated Damages amount by applying the percentage listed in the table below to the annual Maintenance and Operations (M&O) and Product Cost of the Contract.

The annual amount is defined as the twelve (12)‑month period beginning on the Contract Start Date and recurring in successive twelve (12)‑month intervals thereafter.

FAILURE TO MEET SLA LIQUIDATED DAMAGES AMOUNT

First Failure 0.15% Price credit

Second Failure 0.25% Price credit

Third Failure 0.35% Price credit

Fourth Failure 0.45% Price credit

Greater than four failures 0.50% Price credit

Measurement Period Per Incident

Reporting

Any breach of the HDIS shall be reported to Cal ICH immediately upon discovery. Within 24 hours of the discovery of the breach, Cal ICH shall be provided with details related to the breach, including the specific data accessed, whether the data was encrypted or unencrypted, whether it included personal identifying information (e.g. name, date of birth, social security number), and the approximate date range, to the greatest degree of confidence possible, that the breached data was accessed and all other required notice information contained in Civil Code section 1798.29(d).

State of California California Interagency Council on Homelessness

RFP 27-ICH-001

Part 2 - Bidder Response

HDIS Security Incident Management: Resolution Response Time SLA

Name HDIS Security Incident Management: Resolution Response Time

SLA

When determining the resolution timeframe criteria, it shall be defined by the most sensitive data included in the breach.

CATEGORY

RESOLUTION TIMEFRAME

CRITERIA

Data Breach Involving PII (Personal Identifying Information)

Not more than 1 hour from the discovery

Data Breach Involving All Other Data Types

Not more than 12 hours from the discovery

Measurement Process If the actual resolution response time is greater than the SLA for the resolution timeframe criteria, the SLA is not met.

Liquidated Damages

The State will evaluate the Contractor’s performance on a monthly basis.

For each month in which the Contractor fails to meet the required SLA, the State may assess Liquidated Damages in the form of price credits.

Price credits shall be applied as deductions against future invoice(s) until fully satisfied.

For purposes of Liquidated Damages, the State shall count and assess failures on a monthly basis. At the beginning of each month, the Failure count resets. Cal ICH will calculate the Liquidated Damages amount by applying the percentage listed in the table below to the annual Maintenance and Operations (M&O) and Product Cost of the Contract.

The annual amount is defined as the twelve (12)‑month period beginning on the Contract Start Date and recurring in successive twelve (12)‑month intervals thereafter.

FAILURE TO MEET SLA LIQUIDATED DAMAGES AMOUNT

First Failure 0.40% Price credit

Second Failure 0.50% Price credit

State of California California Interagency Council on Homelessness

RFP 27-ICH-001

Part 2 - Bidder Response

FAILURE TO MEET SLA LIQUIDATED DAMAGES AMOUNT

Third Failure 0.60% Price credit

Fourth Failure 0.70% Price credit

Greater than four failures 0.80% Price credit

Measurement Period Per Incident

Reporting

Any breach of the HDIS shall be reported to Cal ICH immediately upon discovery. Updates to the mitigation of an ongoing incident shall require hourly updates to Cal ICH until the incident is resolved.

Cal ICH requires the contractor to report any breach within 24 hours and to prepare a report that contains the required notice information in California Civil Code section 1798.29(d).

7.2.8. Incident Management

The Contractor shall be responsible for promptly restoring normal service operations with minimal disruption to the HDIS platform. This responsibility encompasses all production and pre-production environments. The Contractor’s core duties include the triage, prioritization, escalation, resolution, and comprehensive documentation of all incidents, in accordance with established service level agreements (SLAs) and operational procedures.

The Contractor shall provide:

Support/Coverage:

Normal Business Hours:

8:00 AM to 5:00 PM PST - Monday through Friday

Extended Hours:

6:00 AM to 6:00 PM PST - 365 Days/Year

Response and Resolution:

State of California California Interagency Council on Homelessness

RFP 27-ICH-001

Part 2 - Bidder Response

The Contractor shall provide technical support via remote access, telephone, and email. Response times according to the SLA are detailed in the table below:

HDIS Incident Management SLA

Title Description

Name HDIS Incident Management

Priority Definition

1. Priority 1 (Critical Impact-Service Unusable in Production) – business impact is critical, and no workaround is available. Examples of Priority 1 incidents include, but are not limited to, the following: the application or infrastructure is unusable in production, having a significant rate of user-facing errors.

2. Priority 2 (High Impact – Service Use Severely Impaired) – the infrastructure is degraded in production, having a noticeable rate of user-facing errors. A workaround to mitigate the critical business impact is available.

3. Priority 3 (Medium Impact – Service Use Partially Impaired) – the issue is limited in scope and/or severity. The issue has no user-visible impact. Business impact is low (i.e. inconvenience or minor business processes affected).

4. Priority 4 (Low Impact – Service Fully Usable) – little to no business or technical impact. Suitable for consultative tickets where in-depth analysis, troubleshooting or consultancy are preferred to more frequent communications.

SLA

1. Priority 1 incidents shall have an initial response time of one hour. The Contractor shall then continuously work on the resolution 24 hours a day, 7 days a week until complete resolution of the system issue or agreement from the Department to lower the priority to Priority 3 or 4.

2. Priority 2 incidents shall have an initial response time of four hours. The Contractor shall then continuously work during normal business hours(8:00 AM to 5:00 PM Pacific Standard Time) on resolution until complete resolution of the system issue or agreement from the Department to lower the priority to Priority 3 or 4.

3. Priority 3 incidents shall have an initial response time of 24 hours. The Contractor shall then work on the resolution during normal business hours until resolution.

4. Priority 4 incidents shall have an initial response time of 48 hours. The Contractor shall then work on the resolution during normal business hours until resolution.

The Contractors' incident or ticketing system tool of record shall serve as the system

State of California California Interagency Council on Homelessness

RFP 27-ICH-001

Part 2 - Bidder Response of record for the purposes of enforcing the durations identified.

Resolved = Incident remediation released to production and the incident has not re-occurred.

Measurement Process

If a production system incident resolution time is greater than the SLA for the incident priority, the SLA for that incident is not met.

Liquidated Da mages

The State will evaluate the Contractor’s performance on a monthly basis. For each month in which the Contractor fails to meet the required SLA, the State may assess Liquidated Damages in the form of price credits. Price credits shall be applied as deductions against future invoice(s) until fully satisfied.

For purposes of Liquidated Damages, the State shall count and assess failures on a monthly basis. At the beginning of each month, the Failure count resets. Cal ICH will calculate the Liquidated Damages amount by applying the percentage listed in the table below to the annual Maintenance and Operations (M&O) and Product Cost of the Contract. The annual amount is defined as the twelve (12)‑month period beginning on the Contract Start Date and recurring in successive twelve (12)‑month intervals thereafter.

FAILURE TO

MEET SLA

LD AMOUNT

PRIORITY 1

LD AMOUNT

PRIORITY 2

LD AMOUNT PRIORITY 3

First Failure 0.010% Price credit

0.05% Price credit Meet to discuss, no LDs assessed

Second Failure 0.020% Price credit

0.010% Price credit

0.0025% Price credit

Third Failure 0.030% Price credit

0.015% Price credit

0.005% Price credit

Fourth Failure 0.040% Price credit

0.020% Price credit

0.010% Price credit

Greater than four failures

0.050% Price credit

0.025% Price credit

0.015% Price credit

There is no Liquidated Damages for Priority 4 Incidents.

Measurement Per Priority 1, 2, 3, or 4 Incident throughout the duration of the contract

State of California California Interagency Council on Homelessness

RFP 27-ICH-001

Part 2 - Bidder Response

Period

Reporting The Contractor shall generate a monthly report from the Contractor's service management tool based on Incident Priority Level, Opened Date, Target and Actual Resolution Dates, Impact to Operations, Mitigation Steps, and Recovery Plan.

7.2.9. Software Updates, Vulnerability Scanning and Patch Management

The Contractor shall be responsible for managing vulnerability scanning, software updates and patching activities for the HDIS Platform.

The Contractor shall perform monthly vulnerability scanning to securely hardened HDIS against malicious attacks and potential security breaches.

The Contractor shall implement a formal software updates/patch management process encompassing the evaluation, scheduling, testing, deployment, and validation of software updates. This process shall be designed to minimize disruption to production workloads while ensuring the timely application of security patches, performance enhancements, and critical bug fixes.

All software updates/patches and updates shall first be applied to non-production environments, including Development, Test, and Staging. The Contractor shall conduct comprehensive regression and performance testing in these environments to verify compatibility with existing workflows, data models, and reporting tools, thereby preventing any adverse impact on business operations.

Following successful validation, the Contractor shall coordinate the deployment of patches to the Production environment during scheduled maintenance windows. The Contractor shall establish communication protocols to notify all relevant stakeholders in advance and maintain clear contingency and rollback plans to address any issues that may arise.

To ensure compliance with applicable State and industry security standards, the Contractor shall prioritize security-related software updates/patches and continuously monitor for emerging vulnerabilities relevant to the HDIS Platform. The Contractor shall leverage automated software updates/patch management tools and platform-native update mechanisms to streamline software updates/patching activities and maintain detailed audit trails for accountability.

The Contractor shall provide regular reports to the State detailing vulnerability scans, software updates/ patch status, upcoming scheduled updates, and any exceptions encountered during vulnerability scans/ software updates/patch management activities as outlined in SECTION 15. Deliverable Requirements.

State of California California Interagency Council on Homelessness

RFP 27-ICH-001

Part 2 - Bidder Response

7.3. HDIS Data Management

The diagram below illustrates the comprehensive data lineage of HDIS Data, detailing the flow and transformation processes as updates are implemented on a quarterly basis.

Figure 4.0 HDIS Lineage

The table below describes the HDIS data lineage:

HDIS Data Lineage

Componen t

Purpose Key Characteristics Security…