Attachment 2 SOW - Time and Material.docx

VEH118 SOW –Time & Materials (7.31.23)

STATEMENT OF WORK

BETWEEN

[AGENCY]

AND

[CONTRACTOR NAME]

FOR THE

[PROJECT NAME]

1. INTRODUCTION

The following document will serve as a Statement of Work (“SOW”) between [AGENCY] (“[AGENCY ABBREVIATION]” or “Agency”) and [CONTRACTOR NAME] (“Contractor”) governing Contractor’s work on the [PROJECT NAME]. The entire agreement (the “Agreement”) between the parties consists of the following documents, in the following order of precedence. In the event of a conflict, the document of higher precedence shall govern.

(1) Commonwealth Terms and Conditions for Information Technology Contracts

(2) Standard Contract Form

(3) Request for Response VEH118 (“RFR”)

(4) Contractor’s response to the RFR

(5) Request for Quotes [RFQ NAME, RFQ NUMBER AND DATE] (“RFQ”)

(6) Appendix A to this SOW

(7) this SOW and any Task Orders or other documents negotiated between the parties

(8) Contractor’s response to the RFQ

2. DEFINITIONS

The following terms shall have the following meanings. All other terms used in this SOW shall have the meaning ascribed to them in the other documents that constitute the Agreement between the Parties.

“Business Days” means all days except for weekends and Commonwealth holidays. A list of Commonwealth holidays is available at https://www.sec.state.ma.us/cis/cishol/holidx.htm.

“Deliverable” means any work product that Contractor delivers for the purposes of fulfilling its obligations to Agency.

“Key Personnel” means Contractor personnel directly responsible for management of the SOW or those personnel whose professional/technical skills are determined to be essential to the successful implementation of the SOW.

“Party” or “Parties” means, as applicable, one or both of Contractor or Agency.

“Services” means the activities engaged in by Contractor for the purpose of fulfilling its obligations under the terms of the SOW, which may or may not result in the creation of a Deliverable.

“Task” means a material activity engaged in by Contractor for the purpose of fulfilling its obligations to Agency.

“Task Order” means an amendment to this SOW that specifies Tasks or Deliverables to be completed by Contractor within a specified time period.

3. EFFECTIVE DATE AND TERM

This SOW’s term (the “Term”) begins on the date it is executed by both Parties (the “Effective Date”) and shall terminate on [INSERT END DATE] (“Termination Date”) unless extended or renewed via written amendment executed by the Parties.

4. PROJECT BACKGROUND AND OVERVIEW

[Provide background and high-level overview of project.]

This engagement will be under RFR VEH118.

5. TIME AND MATERIALS SERVICES

This Section describes the general Tasks and Deliverables to be completed by the Contractor. A Task or Deliverable will be considered “complete” when all the acceptance criteria set forth in this SOW have been met. All written work product shall be delivered in a format specified by Agency. All meetings shall be held on-premises at the address of Agency, unless agreed to otherwise by the Project Managers.

TABLE 1: TASKS AND DELIVERABLES

For the Time and Materials Services, Contractor shall complete the work described in Table 1 or in the relevant Task Order, and as scheduled through [weekly] planning meetings. Contractor will submit weekly reports to the Agency PM detailing the hours worked by each Named Resource. The [weekly] reporting must show actual resource hours worked against assigned Tasks and/or Deliverables and a description of completed Tasks or progress toward completion. Contractor will also report weekly to the Agency PM its expected work effort the forthcoming week, showing each Named Resource’s expected level of effort. Prior review and authorization of each report by the Agency PM is required to authorize any work by the Named Resource.

6 KEY PERSONNEL

6.1 Commonwealth Project Manager(s)

[NAME] ([email address], [phone number]) will serve as the Agency Project Manager (“PM”) and will: (i) work closely with the Contractor PM to ensure successful completion of the project; (ii) consult with Contractor PM to develop the Project Management Plan; (iii) review weekly status reports and schedule weekly meetings with Contractor, as necessary; (iv) coordinate participation from other agencies and/or vendors as required during the engagement; (v) acquire Agency project team members as needed; and (vi) coordinate Agency’s review of the Tasks and weekly report, and sign an acceptance form to signify acceptance for each accepted weekly report.

[OPTIONAL: [NAME] ([email address], [phone number]) will serve as the Agency Technical Project Manager (“Technical PM”) and will: (i) work closely with the Agency PM and Contractor PM to ensure successful completion of the project; (ii) consult with the Agency PM and Contractor PM to develop the Project Management Plan; and (iii) serve as a technical resource for Contractor PM and Contractor personnel.]

[OPTIONAL: [NAME][email address][phone number]] will serve as the [OTHER AGENCY] Project Manager (“PM”) and will: (i) work closely with the Agency and Contractor PM to ensure successful completion of the project; (ii) consult with the Agency and Contractor PM to develop the Project Management Plan; (iii) review [weekly] status reports and schedule [weekly] meetings with Contractor, as necessary; (iv) coordinate participation from other agencies and/or vendors as required during the engagement; (v) acquire [OTHER AGENCY] project team members as needed; and (vi) coordinate [OTHER AGENCY]’s review of the Deliverables and sign an acceptance form to signify acceptance for each accepted Deliverable.

This requirement applies only to Executive Departments and other Eligible Entities who use the Commonwealth Network: If this SOW will be placed under VEH118 _______________________ will serve as a point of contact for the Executive Office of Technology Services and Security (“EOTSS”). Agency PM will coordinate with the EOTSS point of contact throughout the Term. In the event that a point of escalation is required within EOTSS, the Agency PM will communicate with the EOTSS Chief Information Security Officer, or designee.

6.2 Contractor Project Manager

[NAME] ([email address], [phone number]) will serve as the Contractor Project Manager (the “Contractor PM”) and will (i) be responsible for administering this SOW and the managing of the day-to-day operations under this SOW, (ii) serve as an interface between the Agency PM and all Contractor personnel participating in this engagement; (iii) develop and maintain the Project Management Plan in consultation with the Agency PM; (iv) facilitate regular communication with the Agency PM, including weekly status reports/updates, and review the project performance against the project plan and facilitate weekly project status meetings for the duration of the engagement; (v) update the Project Management Plan on a weekly basis and distribute it at weekly meetings for the duration of the engagement; (vi) sign acceptance forms to acknowledge receipt; and (vii) be responsible for the management and deployment of Contractor personnel.

The Agency PM and Contractor PM bear the primary responsibility for issue resolution. If an issue cannot be resolved by the PMs, the Agency PM shall escalate to [NAME] and the Contractor PM shall escalate to [NAME]. The PMs shall be responsible for coordinating a meeting with Agency and Contractor leadership to review and resolve any issues.

6.3 Contractor Personnel

Contractor shall assign each of the following Names Resources to this SOW in accordance with Table 2. If a change to the assigned personnel is necessary, the Contractor PM will provide a written change request at least two weeks prior to the change to the Agency PM. The Agency PM may reject or accept such change. The Agency PM may terminate use of any Named Resource by providing five (5) days written notice to the Contractor PM. If termination is for cause, or for a violation of a term of this Agreement, Agency may terminate use of the Named Resource effective immediately by providing written notice to the Contractor PM.

Contractor shall take full responsibility for project management and shall obtain Agency’s written pre-approval for the use of any subcontractor(s). Contractor shall ensure any subcontractor(s) providing work under this SOW comply with all terms of the Agreement and Contractor shall be responsible for the performance, acts, and omissions, of each such subcontractor.

TABLE 2: TIME AND MATERIALS RATES

TOTAL ESTIMATED COST

TOTAL NOT TO EXCEED AMOUNT

7. ACCEPTANCE OR REJECTION PROCESS

The Contractor PM will submit each weekly report to the Agency PM. Agency will review each weekly report and approve these reports based on satisfactory work performance by each Named Resource, satisfactory completion of Tasks listed in Table 1 or in the relevant Task Order, and fulfillment of Metrics of Acceptance in this Agreement.

Within five (5) Business Days of each weekly report, the Agency PM will notify the Contractor PM, in writing, of acceptance or rejection. A rejection will include a written description of any relevant defects or issues. If the Agency PM does not respond with acceptance or rejection within five (5) Business Days of receipt, the Contractor PM shall provide a reminder notice to the Agency PM. If Agency PM fails to respond after the receipt of the reminder notice, Contractor must notify Agency PM and the Parties must agree to a new deadline for acceptance or rejection of the Deliverable. Upon receipt of rejection, Contractor will act diligently to correct the specified defects or issues.

8. PAYMENT TERMS

Contractor shall provide a bi-weekly invoice to the Agency PM for the actual hours worked per week of the Named Resource identified in Table 2 or in the relevant Task Order. Each invoice must include resource names, dates of service, the hours worked and approved, and the relevant Task/Deliverable Name(s) as specified in Table 1 for each date of service. The Agency PM will review and approve these invoices based on satisfactory work performance by each Named Resource, satisfactory completion of Tasks listed in Table 1 or in the relevant Task Order, and fulfillment of Metrics of Acceptance in this Agreement. Approved invoices will be payable by Agency in accordance with the Commonwealth’s bill-paying policies. Agency reserves the right to reject an invoice submitted more than [XX] Business Days after the Services were rendered.

Unless otherwise agreed to by the parties in the form of an executed written amendment or Task Order hereto, the total amount payable to Contractor by Agency shall not exceed [TOTAL].

9. AMENDMENTS TO THE SOW

The SOW may be amended prior to the end of the Term. The PM who would like to request a change will provide the suggested amendment in writing to the other Party’s PM. The PMs will jointly determine whether the change impacts any terms contained within the Agreement. The Parties may mutually agree to the change through a written signed amendment to the SOW.

10. ADDITIONAL CONTRACTOR REQUIREMENTS

[Include any additional privacy / security requirements based on data being accessed or used by Contractor. Include additional technical specifications, support terms, etc. Refer to attached documents if needed.

e.g. Any personnel providing services under this SOW who will have access to Agency’s premises and/or systems will be subject to Agency’s background screening requirements prior to commencement of such services.] Please note that Contractor may, in the course of performing the services described in this SOW, have access to sensitive data, which may consist of the following, without limitation:

-Personally Identifiable Information (MGL 93H, MGL 66A) -Payment Card Information (Payment Card Industry Council Standards) -Personal Health Information (HIPAA) -Federal Tax Return Information (IRS Pub. 1075) -Criminal Offender Record Information (Security Addendum NCIC 2000 Operating Manual, CJIS Security Policy Title 28, Code of Federal Regulations, Part 20) -Criminal Justice Information (Security Addendum NCIC 2000 Operating Manual, CJIS Security Policy Title 28, Code of Federal Regulations, Part 20) If the Agency determines that any additional certifications, documentation, or other requirements must be entered into under this SOW to allow Contractor’s access to the sensitive data, Contractor will provide such certifications and enter into such documentation or meet such requirements, and the same shall be appended to, and incorporated into, this SOW.

11. AUTHORITY TO EXECUTE

The undersigned hereby represent that they are duly authorized to execute this Statement of Work on behalf of their respective organizations. The signer on behalf of Contractor further represents that he/she is listed as an Authorized Signatory under the applicable Statewide Contract or RFR. This Statement of Work may be signed in two or more counterparts, each of which shall be deemed an original, but all of which together shall constitute one and the same instrument.

[AGENCY] [Enter Contractor Name]

Signature: ______________________________ Signature: ______________________________

Name: _________________________________ Name: ________________________________

Title: __________________________________ Title: __________________________________

Date: __________________________________ Date: __________________________________

This requirement applies only to Executive Departments and other Eligible Entities who use the Commonwealth Network: If this SOW will be placed under VEH118, Agency shall coordinate with, and gain approval of, the Executive Office of Technology Services and Security Chief Information Security Officer, or designee. The CISO, or designee, must authorize this SOW by signing below.

Signature: ______________________________

Name: _________________________________

Title: __________________________________

Date: __________________________________

APPENDIX A

The following terms are entered into by and between the Commonwealth entity and the Contractor signing the Statement of Work (“SOW”) attached hereto. The term “Agency” as used in this Appendix A shall refer to the Commonwealth entity signing the SOW. The following terms cannot be modified unless a written waiver is provided by the Agency General Counsel, or designee. The following Sections shall continue in effect beyond the Termination Date of the SOW: 2, 3, 6, 8, 9, 10, and any other Sections that would under the circumstances reasonably extend beyond the Termination Date of the SOW.

1. Equipment and Workplace

Agency will provide standard workspace, office equipment, and network connectivity, as provided to state employees, and as required to enable Contractor personnel working on-site to provide the services contemplated under the SOW. Contractor will submit a list of personnel who will need access to the building and to state systems before execution of the SOW. Any Contractor personnel who have access to IT resources must comply with the Acceptable Use of Information Technology Policy (https://www.mass.gov/policy-advisory/acceptable-use-of-information-technology-policy) and any other workplace policies provided to Contractor by Agency.

2. System Security

Contractor shall comply with the Commonwealth’s Enterprise Information Security Policies and Standards (https://www.mass.gov/handbook/enterprise-information-security-policies-and-standards).

Contractor will be required to use data provided by Agency (“Commonwealth Data”) and will implement commercially reasonable safeguards necessary to: (i) prevent unauthorized access to Commonwealth Data from any public or private network; (ii) prevent unauthorized physical access to any information technology resources involved in the SOW project; and (iii) prevent interception and manipulation of Commonwealth Data during transmission to and from any servers.

If Contractor uses, or receives access or potential access to, Commonwealth personal data under M.G.L. c. 66A or personal information under M.G.L. c. 93H (collectively, “Commonwealth Personal Data”). Contractor shall implement the maximum feasible safeguards reasonably needed to: (i) ensure the security, confidentiality and integrity of electronic personal data and personal information; (ii) prevent unauthorized access to electronic personal data or personal information or any other Commonwealth Personal Data from any public or private network; and (iii) notify Agency immediately if any breach of such system or of the security, confidentiality, or integrity of electronic personal data or personal information occurs.

3. Accessibility Contractor shall comply with the obligations and requirements set forth in the Accessibility for IT Solutions Contract Language (https://www.mass.gov/service-details/accessibility-for-it-solutions-contract-language).

4. MassGIS Web Mapping Services

MassGIS is the Commonwealth’s Bureau of Geographic Information. Its legislative mandate includes coordinating GIS activities in the Commonwealth’s public agencies and distributing GIS data. MassGIS has also developed and is the host for the Commonwealth’s web mapping services.

If the Deliverables include the capability for viewing maps and related information as part of an Internet browser-based client application or in mobile mapping applications, and if those applications will display map information available through MassGIS web mapping services (e.g., parcels, orthophotos, streets, wetlands or any of MassGIS’ tile-cached map services), then Contractor shall use MassGIS geospatial web mapping services. Additionally, if the Deliverables include an application that relies on validating street addresses or geocoding addresses to determine a coordinate location for that address, the Contractor must discuss the possibility of using MassGIS address validation and geocoding services with MassGIS. MassGIS provides low or modest demand address validation and geocoding services which MassGIS may determine to be suitable for an application’s specific needs. MassGIS may grant a waiver of these requirements if Contractor demonstrates to MassGIS’ satisfaction that using the MassGIS services for the proposed application is not reasonably practical due to one or more of the following: (i) performance of the application would be degraded due to using the MassGIS services; (ii) the proposed application requires reliability that exceeds those that MassGIS can reasonably be expected to provide; (iii) the security requirements of the application preclude using the MassGIS services; and (iv) cost. Waivers are not valid under this Agreement unless they are provided in writing by the Director of MassGIS or, if the Director is not available, MassGIS’ Web Mapping Services Manager.

5. Code Review

If the Deliverables include software code or applications developed by Contractor for Agency, such code or applications shall follow current industry design and best practices, including, but not limited to those published by the National Institute of Standards & Technology (NIST), the SANS (SysAdmin, Audit, Network, Security (SANS) Institute), and other recognized bodies.

If the Deliverables include software or code that will be developed by Contractor and migrated into a production environment, Contractor shall implement the following controls for the purpose of maintaining software integrity and traceability throughout the software or code creation life cycle, including during development, testing, and production: (i) Contractor shall configure at least two software environments including a development/quality assurance (QA) environment and a production environment; (ii) Contractor shall implement a change management procedure to ensure that activities in the development/QA environment remain separate and distinct from the production environment; (iii) Contractor shall segregate duties between development and testing of software changes and migration of changes to the production environment; (iv) Contractor shall implement security controls to restrict individuals who have development or testing responsibilities from migrating changes to the production environment; (v) Contractor shall create a process to log and review all source control activities; (vi) Contractor shall implement a source control tool to ensure that all changes made to the production system are authorized, tested, and approved before migration to the production environment; (vii) Contractor shall not make any development or code changes in a production environment; and (viii) Contractor shall implement additional internal controls as specified in the Agreement.

Contractor shall cooperate with Agency’s code review of the relevant software or application Deliverables. Prior to implementation or acceptance of a Deliverable, Contractor shall subject such Deliverable, if it includes software code or script, to independent application review by Agency or its delegated reviewer to validate that all applicable enterprise IT standards and security policies have been met, as well as other specifications as identified in this Agreement. The review shall be performed by individuals other than Contractor’s or Agency’s personnel who developed the Deliverables. For purposes of this requirement, "independent" may include other staff of the Agency provided that no direct reporting relationships exist between the development and review organizations.

6. Intellectual Property Rights

The term Property includes patents, copyrights, trademarks, trade secrets, technical or business information, and works of authorship fixed in any tangible medium, including without limitation, computer programs in object and/or source code form, scripts, data, documentation, content related to layout and graphical representation, and training materials.

Contractor Property includes: (1) Property created by Contractor for the open market, (2) Property developed by Contractor for other clients, and (3) Property developed by Contractor for internal purposes. Contractor will retain all right, title and interest in and to Contractor Property. The Agency’s possession, installation or use of Contractor Property will not transfer to it any title to such property. Except as expressly authorized, the Agency will not copy, modify, distribute, transfer, display, sublicense, rent, reverse engineer, decompile or disassemble Contractor Property.

Commonwealth Property includes: (1) Property developed by the Commonwealth, (2) Property owned by the Commonwealth independent of this Agreement, and (3) Deliverables created under this Agreement by Contractor, subcontractor, or both, in exchange for State or Federal funds. The Commonwealth retains all right, title and interest in and to the Commonwealth Property and all derivative works thereof. The Commonwealth grants to Contractor a non-exclusive, revocable, temporary license to use Commonwealth Property as described in categories (1) and (2) of this paragraph, as reasonably needed solely to perform the services contemplated under this Agreement. In accordance with the Commonwealth Terms and Conditions for IT Contracts, all Deliverables described in category (3) of this paragraph are works made for hire.

Contractor hereby sells, transfers, and assigns to the Commonwealth, all rights, title, and interest in and to the Deliverables, and any derivative works thereof. CONTRACTOR HEREBY WAIVES IN FAVOR OF THE COMMONWEALTH (AND SHALL CAUSE ITS PERSONNEL TO WAIVE IN FAVOR OF THE COMMONWEALTH) ANY AND ALL ARTIST’S OR MORAL RIGHTS IT MAY HAVE PURSUANT TO ANY STATE OR FEDERAL LAWS OF THE UNITED STATES IN RESPECT TO ANY DELIVERABLE AND ALL SIMILAR RIGHTS UNDER THE LAWS OF ALL OTHER APPLICABLE JURISDICTIONS. Contractor agrees to execute all documents and take all actions that may be reasonably requested by Agency to evidence this transfer of ownership, including providing any code used to develop such Deliverables to Agency and the documentation for such code.

Notwithstanding the foregoing, if Contractor is engaged by Agency to customize or configure Contractor Property, and if the resulting customization or configuration provides no functionality independent of the Contractor Property, Contractor shall retain ownership of the Contractor Property and the customization or configuration, provided that it grants to the Commonwealth a fully-paid, royalty-free, non-exclusive, non-transferable, worldwide, irrevocable, perpetual, assignable license to such customization or configuration to use, reproduce, distribute, modify, publicly display, publicly perform, digitally perform, transmit, copy, sublicense, and create derivative works therefrom. Contractor shall not encumber or otherwise transfer any rights that would preclude a free and clear license grant to the Commonwealth.

If Contractor is engaged by Agency for the development of a web site, Agency will bear sole responsibility for registering the software or system domain name or URL, applying for any trademark registration relating to the software or system domain name or URL and applying for any copyright registration related to its copyright ownership with respect to any Commonwealth Property.

If the Deliverables contain or will contain any third-party Property, Contractor must provide to Agency documentation providing a sublicense of such third-party Property to the Commonwealth (“Sublicense Agreements”). The Sublicense Agreements must be included in Contractor’s initial quotation to Agency, or, if the requirement to use sublicensed third-party Property is not known at the outset of the project, as soon as the requirement becomes known. Sublicenses to third-party Property can only be provided under the Agreement if they are provided at no charge to the Commonwealth.

7. Warranty Contractor represents and warrants that (i) Contractor and its subcontractors are sufficiently staffed and equipped to fulfill Contractor’s obligations under this Agreement; (ii) Contractor’s services will be performed: by appropriately qualified and trained personnel; with due care and diligence and to a high standard of quality as is customary in the industry; in compliance with the Due Dates and the terms and conditions of this Agreement; and in accordance with all applicable professional standards for the field of expertise; (iii) Deliverables delivered under the SOW will substantially conform with the Tasks and Deliverable descriptions set forth in this Agreement; (iv) all media on which Contractor provides any software under this Agreement shall be free from defects; (v) all software delivered by Contractor under the SOW shall be free of Trojan horses, back doors, and other malicious code; (vi) Contractor has obtained all rights, grants, assignments, conveyances, licenses, permissions and authorizations necessary or incidental to any materials owned by third parties supplied or specified by Contractor for incorporation in the Deliverables to be developed; (vii) documentation provided by Contractor under the SOW shall be in sufficient detail so as to allow suitably skilled, trained, and educated Agency personnel to understand the operation of the Deliverables and Contractor shall promptly, at no additional cost to Agency, make corrections to any documentation that does not conform to this warranty; and (viii) any systems created or modified by Contractor under the SOW shall operate in substantial conformance with the specifications for the system or modifications for a minimum of six months (the “Warranty Period”) after Agency accepts such system or modifications pursuant to Section 7 (Acceptance or Rejection Process) of the SOW. During the Warranty Period, Contractor shall correct any defects, at no charge to Agency.

8. Transfer of Engagement Products at Contract Termination

As of the Termination Date of the SOW, Contractor shall make available all Commonwealth Data to Agency in a format to be agreed upon by Agency and Contractor. Contractor shall provide reasonable assistance at no charge to provide knowledge transfer to Agency personnel, or Agency designees. Agency and Contractor may execute a Task Order or Change Order governing the transfer period if additional services are required by Agency.

9. Other Representations

Contractor agrees and shall ensure that is personnel and subcontractor personnel agree to the following terms.

Contractor shall not use for its own benefit, or divulge or disclose to anyone, except to (i) persons within the Commonwealth whose positions require them to know it and (ii) persons designated by Agency who have a need to know, any information not already lawfully available to the public concerning the Commonwealth (“Confidential Information”), including but not limited to information regarding any project of the Commonwealth, any e-commerce products or services, any web development strategy, any financial information or any information regarding users of or vendors to the Commonwealth. Confidential Information also includes, without limitation, any technical data, design, pattern, formula, computer program, source code, object code, algorithm, subroutine, manual, product specification, or plan for a new, revised or existing product or web site; any business, marketing, financial or sales information; and the present or future plans of the Commonwealth.

As of the termination of the Agreement with the Commonwealth, Contractor agrees to return to the Commonwealth all Commonwealth Property, Commonwealth Information and materials, documents and property, in Contractor’s possession or control, including without limitation, all materials relating to work done while assigned to Commonwealth projects. Contractor shall return to the Commonwealth all materials concerning past, present and future or potential products and/or services of the Commonwealth. Contractor shall return to the Commonwealth all materials provided by persons doing business with the Commonwealth and all teaching materials provided by the Commonwealth.

Contractor represents and warrants that it is not a party to any agreement or arrangement which would constitute a conflict of interest with the obligations undertaken under the SOW or would prevent Contractor from carrying out its obligations hereunder.

Contractor represents and warrants that it has paid all due state and federal taxes, or, if its tax status is in dispute or in the process of settlement, that it has responded as directed and within the required timeframes to all communications received from the state or federal government.

Contractor acknowledges that it is not an employee of any Massachusetts state or municipal government agency, and is not entitled to any benefits, guarantees or other rights granted to state or municipal government agencies, including but not limited to group insurance, disability insurance, paid vacations, sick leave or other leave, retirements plans, health plans, or premium overtime pay. Should Contractor be deemed to be entitled to receive any such benefits by operation of law or otherwise, Contractor expressly waives any claim or entitlement to receiving such benefits from Massachusetts state or municipal government agencies.