Attachment_2_Scope_of_Work.docx

Attachment 2: Scope of Work

1. OVERVIEW

The Contractor shall provide a comprehensive telematics solution to the City and County of San Francisco’s (“City’s”) Central Shops on behalf of the San Francisco City Administrator’s Office (“CAO” or “Department”) for the San Francisco Sheriff’s Department (“SFSD”). The scope of work for this Agreement will be an initial fifteen (15) month pilot program (“Pilot Contract Term” or “Pilot Contract”) for SFSD’s approximately 170 mixed fleet assets (light/medium/heavy duty; on/off road; Internal Combustion Engine/Alternative Fuel/Electric Vehicle).

The Contractor must deliver an end-to-end, scalable platform capable of improving operational readiness, safety, and sustainability while reducing downtime and costs. It should provide accurate data collection and proactive notifications for timely decision-making to resolve issues. It should strengthen accountability, enable evidence-based decision-making, and support cross-department collaboration across a diverse fleet portfolio.

The Contractor shall fulfill the following requirements:

1.1 Project Management and Support Services: Project planning, design and configuration; hardware and software provisioning, equipment installation, connectivity, integration with City systems, testing, secure storage and governance of telematics data; change management, training, and knowledge transfer; warranty, technical support, and ongoing project management and support services.

1.2 Safety & Risk Management: Enhance fleet safety and compliance through driver behavior monitoring, incident alerts, geofencing, and risk analytics; reduce false positives in speed alerts and emissions flags.

1.3 Data Management, Security, & Governance: Centralize near real-time, accurate data in raw and summary forms for operations, compliance, and analytics; enable integration with City platforms (e.g., Snowflake/SQL). Strengthen data governance and security through role-based access, audit trails, secure integrations, privacy controls, transparency, and validation of data accuracy. All components must comply with applicable City standards and policies for privacy, security, and data governance.

1.4 Fleet Oversight & Performance: Deliver continuous, real-time vehicle data including GPS location, On-Board Diagnostics (“OBD”), odometer readings, and alerts along with driver safety analytics, maintenance forecasting, and compliance reporting to improve operational readiness and safety.

1.5 Regulatory Compliance: Provide out-of-the-box compliance with California Air Resources Board (“CARB”) Clean Truck Check (“CTC”) periodic emissions testing and pass/fail reporting requirements, and support participation in and timely compliance with the California Bureau of Automotive Repair (“BAR”) Continuous Testing Program (“CTP”) for eligible government vehicles.

1.6 Operational Efficiency: Improve fleet visibility and utilization (real-time location, status, usage metrics) to reduce operating costs through fuel management, idling reduction, route optimization, and asset right-sizing. Provide tools and processes to help City minimize downtime and manual testing through CARB-verified, continuously connected OBD data collection, enabling automated reporting, real-time pass/fail visibility, and streamlined test scheduling.

1.7 Reporting & Collaboration: Enable cross-department reporting and issue resolution through standard dashboards and configurable reports for diverse stakeholders.

1.8 Maintenance Optimization: Capture fault codes, enable predictive maintenance, remote diagnostics, and streamlined work order initiation.

1.9 Vehicle Pooling & Access: Support keyless vehicle access and online reservations to reduce key management overhead.

1.10 Sustainability & EV Readiness: Provide tools and processes to help City advance climate goals through emissions reporting, EV readiness, charging analytics, and sustainability metrics.

1.11 Future-Proof Architecture: Ensure agility and adaptability through modular, scalable design, open APIs, and proactive compliance, security, and sustainability measures to respond to evolving technologies, infrastructure, regulations, environmental priorities, and customer needs.

2. SCOPE OF WORK

The Contractor shall provide the following Scope of Work.

2.1 Hardware & Connectivity

2.1.1 Telematics devices: Support OBDII, J1939/Controller Area Network (“CAN”), and equipment appropriate devices (i.e. telematics hardware that is correctly suited for the specific equipment or vehicle, ensuring full compatibility and compliance with technical and regulatory requirements), including heavy duty, offroad, and specialty assets.

2.1.2 Auxiliary sensors & peripherals: Auxiliary sensors (e.g., Power Take‑off “PTO”, door, temperature), optional dashcams, and GPS/Global Navigation Satellite System “GLONASS”/Galileo support.

2.1.3 Connectivity & firmware: Secure over the air firmware updates and reliable cellular connectivity (with coverage plans and data management).

2.1.4 Connectivity alternatives: Satellite fallback to ensure uninterrupted connectivity where cellular reception is limited.

2.1.5 Nonpowered assets: Support both OBD connected gateways and battery powered tracking devices for nonpowered assets, providing granular trip data (as negotiated with City) even without vehicle power.

2.1.6 Full hardware and software catalog: Provide City with full catalog of hardware and software available for City consideration and use.

2.2 Device Health, Diagnostics & Replacement

2.2.1 Automated health monitoring: Provide device down alerts within ≤7 days of disconnection; replacement proposal by Day 7; root cause summary within ≤30 days.

2.2.2 Connectivity fault log: Provide device connectivity summary reports and fault logs showing reasons for and percentages of offline status.

2.2.3 Remote troubleshooting, diagnostics, & logistics: Provide remote diagnostics, with proactive troubleshooting, advice, and guidance toward resolution, inventory management, and Return Merchandise Authorization (“RMA”) workflows; device warranty/replacement processes and RMA logistics.

2.2.4 Compatibility assurance: List supported makes/models/years; if a vehicle is not compatible, notify City immediately, remediate, and/or document alternatives.

2.3 General Security & Access Controls:

Contractor shall comply with industry-standard and City-required security practices, including secure device firmware, signed over the air updates, and vulnerability management. Contractor must maintain annual System and Organization Controls (“SOC”) 2 Type II (or equivalent) attestation, with high or critical severity findings remediated within mutually agreed timelines.

Contractor shall implement role-based access, audit logging, encryption in transit and at rest, and least-privilege principles. Administrative and investigative roles shall be segregated.

Contractor shall provide a data flow diagram, application programming interface (“API”) documentation, a data dictionary, and a security whitepaper. All data must be encrypted in transit (Transport Layer Security “TLS” 1.2+), and at rest (Advanced Encryption Standard “AES”‑256).

Data access, security, and privacy requirements include:

2.3.1 Hierarchical security structure with federalization of groups, users, and assets

2.3.2 Role Based Access Control (“RBAC”) following least privilege principles

2.3.3 Comprehensive audit logging for all access and activity, including full traceability of edits to users and vehicles

2.3.4 Single Sign On (“SSO”) for user authentication or other authentication method as negotiated with and approved by the City.

2.3.5 Multi Factor Authentication (“MFA”) required for privileged access

2.3.6 Secure transmission and storage of data (encryption at rest and in transit)

2.3.7 Data retention (minimum of 3 years) and archival policies

2.3.8 Documented incident response and breach notification procedures

2.4 Criminal Justice Information Services (“CJIS”) for San Francisco Sheriff’s Department (“SFSD”):

If Contractor processes or has access to Criminal Justice Information (“CJI”) in the course of services, Contractor shall adhere to the latest version of the FBI CJIS Security Policy, including personnel screening, background checks, encryption standards, and audit readiness. SFSD may designate vehicles or assignments (e.g., investigative or sensitive operations) where tracking is restricted, delayed, or anonymized per policy. Contractor shall provide granular controls to implement such restrictions, including geofencing, selective data masking, and configurable retention.

2.5 Compliance, Testing and Standards: Contractor shall provide:

2.5.1 CARB CTC Eligibility and Certification: “Out of the box” compliance via continuously connected OBD emissions data collection aligned with CARB requirements and test methods. Contractor shall document CARB certification/verification and supported protocols.

2.5.2 CARB CTC Testing Cadence & Deadlines:

· Semi-annual testing for OBD vehicles, then quarterly starting October 2027.

· Submission windows per CTC Vehicle Inspection System (VIS); Contractors must confirm alignment.

2.5.3 CTC certified devices & continuously connected solutions: Reference Executive Orders list and vendor guidance covering OBD test devices and continuously connected requirements.

2.5.4 CTC Pass/Fail Reporting

· User Interface (UI) dashboard.

· Downloadable Excel reports.

· Scheduled email delivery showing test status, due dates, and pass/fail indicators per vehicle.

2.5.5 BAR Clean Truck Program (CTP) Participation: Platform must already be approved/participating or demonstrate documented capability and process for BAR CTP enrollment, daily data feeds, VIN validation, and timely and accurate pass/fail reporting to BAR.

2.5.6 Compliance & Standards

2.5.6.1 Regulatory posture: Adherence to applicable federal, state, and local regulations and City IT/security policies.

2.5.6.2 Open data: Open data practices and transparent algorithms, where feasible.

2.5.7 Sustainability & Emissions

2.5.7.1 Tools: Emissions tracking, idle time analysis, route optimization, and EV readiness planning.

2.5.7.2 Reporting: Reports to support City climate initiatives and regulatory compliance.

2.6 Data Collection, Quality and Usability: For the following, the Contractor shall

2.6.1 Minimum fields: Collect at minimum: VIN, odometer, fault codes (Diagnostic Trouble Codes “DTCs”), fuel level/usage, electric vehicle “EV” charge state, speed, engine on/off, harsh turns, harsh acceleration, GPS location, seat belt status, idling, trip times.

2.6.2 Quality guarantees: Provide latency and accuracy service level agreements (“SLAs”) and expose data lineage. Contractor must map each metric to signal origin and document data quality guarantees. Describe how accuracy of raw data is measured, validated and improved.

2.6.3 Accessibility & User-Friendliness

2.6.3.1 Standards: User interfaces conforming to Web Content Accessibility Guidelines “WCAG” 2.1 AA.

2.7 Vehicle Activity Management & Exception Logic

A geofence is a defined geographic area used to track vehicle activity (inside, outside, entering or leaving locations such as: offices or depots, customer sites, delivery areas, restricted geofences, etc.). A rule notification occurs when an event falls outside of normal or desired behavior based on predefined rules or thresholds (e.g. speeding, harsh braking or acceleration, idling too long, entering/exiting a geofence outside of allowed hours, vehicle usage after work hours, safety-related triggers). Rule notifications help organizations identify risk, inefficiency or unauthorized behavior.

For the following, the Contractor shall provide:

2.7.2 Local speed limits: Customizable road speed limits stored locally in City databases, with bulk tools to import road networks (rather than editing tiny segments); retain local speed limits in City databases. Contractor must provide transparency and explanation of how speed limit data is gathered, analyzed, and maintained (including how often updated and method for updating to ensure it is current).

2.7.3 Advanced geofence and rule notification parameters: Geofences vs freeway logic, overpass/on‑/off‑ramp differentiation to reduce false positives. Contractor must provide the flexibility to customize geofences, as well as transparency and explanation of how geofences and rule notifications are established and maintained.

2.7.4 Custom rules: Contractor must allow custom rules (e.g., “exclude all on/off ramps from speeding reports”) via APIs or Software Development Kit “SDK.”

2.7.5 Implementation approach: May leverage Contractor geofences + open APIs to store City road metadata and apply geofence‑based logic.

2.8 Software Platform, UI & Performance: The Contractor shall provide:

2.8.2 Applications: Web and mobile applications for real‑time monitoring, analytics, and configurable alerts.

2.8.3 Scale & performance: Web UI/dashboards capable of 6,000+ assets with modern (e.g. pivot tables and other Excel-based tools are not considered a modern solution, due to lag in real time loading), responsive performance, low‑latency event rendering, and scalable reporting. Ideally, the City seeks a powerful data querying tool with customized and integrated user interface graphics and charts. Visuals should be developed in-house; large data sets should be able to be aggregated, previewed and retrieved on-demand.

2.8.4 Minimum data quality requirements:

· Data refresh frequency (real-time, hourly, nightly, weekly)

· Accuracy thresholds (e.g., GPS accuracy ± X meters)

· Consistency (same fields available across all assets)

· Retention period (e.g., three years for audit purposes)

2.8.5 Reporting Library: Contractor shall provide a reporting library that includes standard and custom reports aligned with recognized telematics fleet management Key Performance Indicators (“KPIs”) such as utilization, safety, fuel/energy, emissions, and maintenance. Reports shall support KPIs defined by major industry frameworks (e.g., National Association of Fleet Administrators “NAFA”, Government Fleet, or comparable) and provide sufficient granularity and context to support operational decision‑making, risk reduction, compliance monitoring, and resource allocation. Reports shall not be limited in ways that impede analysis or decision‑making. All reports (standard and custom) shall be configurable and expansive, supporting:

· user-defined date ranges,

· asset groups or categories,

· behavior thresholds (e.g., speeding = X mph over posted limit), and

· user‑level access permissions.

2.8.5.1 Standard Reports: Contractor shall provide:

· a library of actionable standard telematics reports that support fleet management KPIs and contain accurate, validated, and complete data;

· user-driven filtering, grouping, and date‑range selection; and

· sample reports, field definitions, update frequency, and full documentation for all standard reports.

2.8.5.2 Custom Reports: Contractor shall provide the ability for users to create custom reports using all available data fields through a user‑friendly report builder at no additional cost. Contractor shall provide the capability to define groups by department and by reporting regime (BAR vs CARB), as well as allow cross‑group reporting. Custom reports shall support:

· calculated fields,

· grouping, as previously described,

· visual elements, and

· export to .csv, .xlsx, and .pdf formats.

Contractor shall also support automated scheduling, role‑based access controls, and API‑based retrieval of custom reports. For custom report requests requiring Contractor development, Contractor shall complete such requests within 10 business days.

2.8.6 Dashboards, Templates, Channels and Rule-Based Alerts: Contractor shall provide configurable dashboards for SFSD and other City managers and users, automated weekly and monthly reports (in PDF/CSV format), and tracking aligned to the pilot’s Performance Metrics and Outcomes. Contractor shall support benchmarking across departments after expansion, using privacy‑preserving aggregation. The City retains the right to build custom dashboards via APIs.

Contractor shall provide fully customizable templates, fields, and schedules (daily/weekly/monthly), with delivery available via email/SMS.

Contractor shall provide rule‑based alerts, including but not limited to:

· speeding,

· seat belt usage,

· harsh driving events,

· idling, and

· emissions exceptions.

2.8.7 Data Validation Tool: Contractor shall provide a data validation tool that:

· flags speed anomalies and corrects origin data,

· auto‑detects and corrects false speeding reports within ≤30 minutes, and

· provides transparency and easily understood explanations of the correction method.

Contractor must demonstrate its ability to supply detailed documentation of validation algorithms and correction workflows.

2.9 Integrations, APIs & Data Platform: Contractor shall provide a single telematics-centered solution that integrates and documents multiple service domains and City systems through a unified identity and API architecture via an open telematics platform (primary system of record) with documented REST APIs, webhooks, SDKs, and as a marketplace of partner integrations. All such integrations must meet the functional, API, and security requirements described in this Agreement. All APIs that are integrated shall be fully-functional and fully-implemented, well-documented, have minimal restrictions or limits with the ability to query the source data system directly. Contractor shall allow City testing access to APIs to ensure they work as represented as well as providing City with information on coverage of system data accessible via API. Contractor shall support scheduled exports and webhooks or provide a means for data to be queried into Snowflake. Contractor shall monitor and update APIs regularly and as data elements are added to the platform. Contractor shall not impose additional licensing fees for API access required for City’s internal integrations. Contractor shall deliver reference integrations or middleware as applicable.

2.9.2 City systems: APIs and connectors for City systems (e.g., fleet maintenance/CMMS/work orders, ERP/financials, data warehouse/BI, fuel card/dispensing, identity/roster).

2.9.3 Data exchange: Data export/import capabilities (batch and streaming), with schema documentation.

2.9.4 Event triggers: Event‑based triggers (e.g., automated work order creation on fault detection).

2.9.5 Open platform: Open APIs/SDK for data extraction (events, faults, GPS, exceptions) and bulk feeds; documented authentication.

2.9.6 Data lake & hosting: Support secure integration to Snowflake (or equivalent) and provide the option to host a managed SQL instance for City if needed.

2.9.7 Webhooks & connectivity: Unrestricted, documented REST APIs, webhook support, and outbound SSO/OAuth; must permit City to build custom connectors to third‑party systems beyond Bluedot/PowerFlex.

2.9.8 Bluedot and/or Epic Charging and PowerFlex integrations:

· Bluedot and/or Epic Charging(EV charging management; automated payment & charging activity tracking).

· PowerFlex (Adaptive Load Management; SOC/charging visibility).

2.9.9 AssetWorks FA/FleetFocus integrations: Native or marketplace integration with AssetWorks FA/FleetFocus.

2.9.10 Vehicle pooling & keyless operation Online reservations, utilization reporting, keyless access (digital keys via phone/Near Field Communication “NFC”), and integration with pooling software. In-house pooling capabilities preferred.

2.9.11 Ancillary services management: The Contractor shall either provide or integrate one or more of the following:

· Car wash automation integration (radio frequency identification “RFID”/license plate recognition “LPR”/Quick Response “QR”) with gate control, program triggers, and automated invoicing.

· Vehicle‑initiated, cardless payment integration for fuel/tolls (and to wash and service vendors) with dynamic authorization using vehicle telemetry.

· Towing telemetry integration (GPS proximity, timestamps, dashcam/electronic logging device “ELD” event capture) to support billing verification and claims defense.

· Tire service integration (depot automation or smart tire alerts) with automated work orders and invoice synchronization in the City’s fleet maintenance platform.

3.10

3.11 Project Management and Support Services: Project planning, design and configuration, and ongoing project management and support services.

2.10.2 Installation, Deinstallation, Hardware and Software Logistics: Hardware and software provisioning and site coordination. City asset onboarding/equipment installation shall include device installation plans minimizing downtime, batch scheduling by yard, installation playbooks, and training for City technicians where applicable. Contractor shall provide weekly reports of count of installations made that week, listing devices completed and plan for the following week. Contractor shall ensure device connectivity, integration with City systems, testing, secure storage and governance of telematics data. Contractor shall maintain spare device inventory and an RMA process with cross-shipping. Deinstallation and transfer between vehicles shall be supported with clear standard operating procedures “SOPs.” All hardware shall include warranty coverage for the term of the Agreement and replacement for defects or failures.

2.10.3 Training, Change Management, & Adoption Services: Change management, training and knowledge transfer, and technical support including but not limited to:

· Training sessions covering installations, dashboards, workflows, reporting, and policy implementation;

· Step-by-step guides for CTC/BAR workflows;

· Knowledge base and recorded sessions;

· Operating procedures and knowledge transfer;

· Go‑live criteria: Demonstrated CTC pass/fail reports, BAR feed verification, and keyless pool working in production;

· Data governance & ownership: Retention, export, schema documentation—City owns all raw and derived data;

· Performance tests: Dashboard load times p95 ≤ 3 sec, bulk export throughput defined, and API rate capacity sufficient for included assets.

2.10.4 Customer Service, SLAs & Lifecycle Services: Contractor shall provide platform uptime ≥99.9% monthly; incident notification within 24 hours; critical bug remediation within 5 business days; standard support and emergency support hours as negotiated and approved by City. Performance credits or fee reductions shall apply for repeated service level agreement “SLA” breaches. City may terminate for persistent non-performance without penalty and obtain transition assistance.

· Service commitments: SLAs, uptime commitments, incident response times, escalation paths and remediation/resolution expectations.

· Issue management: Bug reporting cadence; proactive notifications about data issues and remediation ETAs.

· Lifecycle & roadmap: Periodic performance reviews and roadmap alignment.

2.10.5 Project Implementation and Customer Service Deliverables

· Device inventory & deployment plan: Asset mapping, weekly installation planning, schedules, and completions, and site logistics.

· Platform configuration: Roles, alerts, dashboards, reports, and data retention settings.

· Integration package: API documentation, test plans, and production cutover.

· Training & change management: Curricula, materials, and session schedules.

· Operational playbook: SLAs, support workflows, escalation matrix, and maintenance procedures.

· Performance baseline & metrics: Initial performance metric and outcome baselines; quarterly improvement targets.

3 PILOT CONTRACT PERFORMANCE

During the Pilot Contract Term, the City will use the following Performance Metrics and Outcomes to determine pilot success. The Contractor shall gather, validate, and obtain City’s approval of pre-pilot solution performance baseline data and track baseline data against these Performance Metrics and Outcomes.

3.1 Pilot Contract Performance Metrics and Outcomes

3.2 Pilot Deliverables

· Project Plan and Installation Schedule

· Baseline Performance Metric/Outcome Report

· Monthly Performance Metric/Outcome and Adoption Reports

· Final Outcomes Report with Recommendations

Failure to meet Performance Metrics and Outcomes may result in:

· Non-Renewal: Contract will not be continued.

· Performance Holdback: A percentage of monthly payments may be withheld for months where Outcomes achievement falls below 80%.

· Corrective Action Plan: Contractor must submit and implement a remediation plan within 30 days of notice.

· Termination for Cause: Persistent failure to meet Outcomes or material compliance breaches may result in early termination without penalty to the City.

3.4 Pilot Expansion Option: The City reserves sole discretion to determine pilot success based on these criteria and overall risk/benefit for expanding the telematics program to additional City departments under negotiated pricing and terms. If the pilot is deemed successful by City, City may, at its sole discretion, exercise an expansion option to include additional City vehicles, divisions and departments without re-solicitation or re-competition either by amending the existing contract or by entering into new contracts for the services described or substantially similar to those described in this Agreement. Such amendments and new contracts may include broader fleet categories, additional features, and integrations, subject to availability of funds, mutual agreement and applicable law.

Contractor shall furnish an implementation plan for each expansion option within twenty (20) business days of City’s request and maintain dedicated customer success resources to support adoption across divisions and/or departments.

3.5 Expansion Option Deliverables

· Expansion Option-specific implementation plan

· Division or Department onboarding/training

· Device installations

· Updated Service Level Agreement (“SLA”) performance summaries

· Consolidated Citywide analytics with Division or Department drill-down

Contractor agrees to extend all pricing, terms, service levels, and warranties negotiated in the Pilot Contract to additional City departments on a pro-rata basis for the term of subsequent agreements or amendments and/or as mutually agreed to with City.

P-690 (1-26): Attachment 2 5 Sourcing Event #0000012088 Scope of Work September 16, 2026