ATTACHMENT 25- APPENDIX A - STATEMENT OF WORK.pdf

ATTACHMENT 25: APPENDIX A - STATEMENT OF WORK

1. Background and Purpose

The Department of Cannabis Control (Department) leverages two separate instances of the Accela platform to manage essential business processes related to cannabis licensure, compliance, and enforcement. The two systems, known as the Cannabis Licensing, Enforcement, and Reporting (CLEaR) system and the Cultivation Licensing System (CLS), address distinct aspects of cannabis regulation in California.

The CLEaR system focuses on the licensure and regulatory oversight of cannabis retailers, distributors, laboratories, transporters, microbusinesses, event organizers and manufactured cannabis. Business processes include processing applications, tracking licensee activities, and ensuring compliance with state laws.The CLEaR system contains functionality to support Compliance and Enforcement activities as applicable to the licensing process within the system.

The CLS is specifically tailored to support the licensure and oversight of cannabis cultivation activities.

This includes processes related to cannabis growers, raw product processing facilities, and nursery operators throughout California. Like CLEaR, the CLS incorporates tools for monitoring compliance and conducting enforcement activities, ensuring that cultivators adhere to state regulations and maintain high standards for safety, sustainability, and legal operations.

While these systems offer configurability, maintaining two separate instances of the Accela platform, creates a layer of complexity. The segregation complicates data integration and increases the potential for inconsistencies between the systems. Users often face challenges navigating the structure, which can hinder efficient coordination across regulatory activities or new mandates.

The Department of Cannabis Control (Department) seeks to consolidate the two instances of their current cannabis licensing software into one solution. These two systems are not integrated to communicate and share real-time data, nor have functionality to streamline current workflows such as document management, validating inputs, case management and the communication needed which could benefit the Department, and external stakeholders. Having the CLEaR and CLS solutions maintained on two separate systems has presented operational challenges.

Many other State departments partner with the Department of Cannabis Control for licensing related activities. These agencies include the California Department of Pesticide Regulation, the California Department of Fish and Wildlife, the Department of Water Resources Control Board, the California Air Resources Control Board, Department of Justice, and California Department of Food and Agriculture. The licensing requirement activities the Department conducts with these organizations can be better tracked and regulated in a new centralized database. These organizations may have an impact on the functionality targeted for the new system.

State of California Department of Cannabis Control

RFP 2026-001

Part 2 - Bidder Response

June 19, 2026

The public will indirectly benefit from the implementation of a more modernized system as enhanced data collection will drive better reporting, policy and business process decisions. Cannabis consumers will be better served should they submit a complaint to the Department as it will be tracked in an improved manner for all license types. Members of the public who are licensees will experience an improved level of service from the Department. Local entities support the Department in licensing and enforcement activities. These organizations may influence the development of functionality for the new system.

1.1. Objective

Currently, the Department must utilize two separate cannabis licensing systems. Having two separate systems does not allow for efficiency in current operations, as duplicate efforts must occur. A centralized database would better track and regulate licensing, compliance, and lab activities.

Enhanced data collection will drive improved reporting, policy development and business process decisions. A centralized system would also provide more streamlined services to cannabis consumers who submit complaints, as their information would be tracked in a unified manner. Additionally, system changes required by legislative and regulatory mandates could be delivered more quickly, ensuring timelier compliance.

A centralized database would improve the Department's cannabis oversight by increasing operational efficiency, enhancing data-driven decision-making, streamlining customer service, and accelerating regulatory compliance.

2. Description of Proposed New System

This Statement of Work (SOW) reflects the services the System Integrator, hereafter referred to as the Contractor, must provide to the Department of Cannabis Control (DCC) during the term of the Contract.

This SOW is governed by, and incorporates the terms and conditions of EXHIBIT D: IT - GP CLOUD - COMPUTING SERVICES, DGS PD 402-ITGP (Cloud). The Contractor must have extensive and demonstrated technical knowledge and experience as identified in this SOW as well as practical project experience.

The State anticipates that Project completion will be achieved through the progressive decommissioning and replacement of two existing legacy systems, with each phase addressing one legacy system independently.

Phase 1 shall include the configuration, development, and implementation of the proposed SaaS solution for one designated legacy system (CLEAR or CLS), including all required data conversion and migration activities necessary to support a production launch and go-live for that system. Upon successful completion of Phase 1, the solution shall be operational and in use by internal and external users.

Deployment of Phase 1 shall not relieve the Contractor of its obligation to continue delivery of Phase 2 functionality.

State of California Department of Cannabis Control

RFP 2026-001

Part 2 - Bidder Response

Phase 2 shall include the configuration, development, and implementation of the proposed solution for the remaining legacy system, including all required data conversion and migration activities, resulting in full Project completion and replacement of both legacy systems.

Each phase shall include, at a minimum, planning, design, development, configuration, data migration, testing, and deployment, performed iteratively and incrementally in accordance with agile Scrum practices and the approved Contractor Tasks and Deliverables per SECTION 15. Contractor Tasks and Deliverable Requirements. Each phase shall result in a separately deployable and usable production release of the solution.

Project utilizes an incremental Agile-based approach to software development, the Project will have a period during which functionality is live in production while the remaining balance of Project scope has yet to be delivered to production. To clearly describe this, the period between the first phase and second phase launch would be a period in which functionality is live in production but the entire Project scope has not yet been delivered. During such a period, the Contractor shall update functionality already delivered to production if directed by the State via the SECTION 14. Change Control Procedures .

The Contractor will propose a Software as a Service (SaaS) to develop, configure and design all requirements identified in EXHIBIT A: FUNCTIONAL AND NON-FUNCTIONAL REQUIREMENTS for a licensing and compliance software solution which is capable of integrating in real-time with internal and external solutions based on ATTACHMENT 21: WORK ORDER AUTHORIZATION FORM approved by DCC. The Contractor will put high importance on enterprise-grade development and reusable components for DCC future enterprise operations. Data conversion from the two Accela instances into one solution is in the scope of this project.

*Detailed as-is and to-be workflows can be found in the Bidder's Library for reference to the number of workflows in project scope.

3. Term of the Contract

Effective upon approval of CDT, Office of Statewide Technology Procurement (OSTP), the base term of the Contract shall be three and a half years (3.5) years from the Contract Execution Date. The project phase is two and a half (2.5) years and one-year of maintenance and operations for implementation services.

The State, at its sole discretion, may exercise its option to execute two (2) additional one (1) year optional extensions for maintenance and operations for a maximum contract term of five and one-half (5.5) years, at the rates specified in the EXHIBIT C: COST WORKSHEETS. The State is not obligated to use any or all of these options. Additionally, the State, at its sole discretion, may exercise an extension of up to six

State of California Department of Cannabis Control

RFP 2026-001

Part 2 - Bidder Response

June 19, 2026 https://cannabis.box.com/s/b5aj4g4deonotg7od9lvgk06mvxvn6pd months for time-related work, to include implementation and full system acceptance. This time-only extension shall be at the originally agreed-upon deliverable rates specified in this Contract and at no additional cost to the total Contract.

The Agreement is of no effect unless approved by CDT and no work shall begin before full execution of the Agreement. The Contractor shall not be authorized to deliver goods or commence performance of services described in this Agreement prior to the effective date of the contract. Any delivery of goods or performance of services by the Contractor that is commenced prior to the effective date shall be at no cost to the State.

4. Amendment

The Agreement may be amended, consistent with the terms and conditions of the Agreement, and by mutual consent of both parties, subject to approval by the CDT Office of Statewide Technology Procurement under Public Contract Code (PCC) Section 12100. No amendment or variation of the terms of this Agreement shall be valid unless made in writing, signed by the parties, and approved by oversight agencies if required. No oral understanding not incorporated in the Agreement is binding on any of the parties.

5. Location and Availability

All Contractor work shall be performed remotely based in the continental United States, unless in-person services are required. The State will provide a set of collaboration tools to facilitate remote development.

No off-shore remote work shall be allowed under this Contract.

Department of Cannabis Control 2920 Kilgore Road Rancho Cordova, CA 95670

Normal hours of access are Monday through Friday, 7:00 a.m. to 5:00 p.m., excluding State holidays. The Contractor is required to perform work duties within the normal hours of work. The Contractor must make prior arrangements and receive approval from the State for access to the project office outside these normal working hours. State holidays are listed on the California Department of Human Resources (Cal HR) website at the link below, and are subject to change:

http://www.calhr.ca.gov/employees/Pages/state-holidays.aspx

6. Contract Representative

All notices required by, or relating to, this Contract shall be in writing and shall be sent to the parties of the

State of California Department of Cannabis Control

RFP 2026-001

Part 2 - Bidder Response

June 19, 2026 http://www.calhr.ca.gov/employees/Pages/state-holidays.aspx

PROJECT/PROGRAM CONTRACT REPRESENTATIVES

State Department: Department of Cannabis Control Contractor: TBD

Name: TBD Name: TBD

Title: TBD Title: TBD

Telephone Number:

TBD Telephone Number:

TBD

E-mail Address: TBD E-mail Address: TBD

CONTRACT REPRESENTATIVES FOR INQUIRIES

State Department: Department of Cannabis Control

Contractor: TBD

Name: TBD Name: TBD

Title: TBD Title: TBD

Telephone Number: TBD Telephone Number:

TBD

E-mail Address: TBD E-mail Address: TBD

Contract at the address set below unless changed from time to time, in which event each party shall so notify the other in writing, and all such notices shall be deemed duly given if deposited, postage prepaid, in the United States mail or e-mailed and directed to the addresses then prevailing.

The contract representatives during the term of this contract will be:

Direct all contract inquiries to:

All inquiries during the term of this Agreement will be directed to the contract contacts listed above.

Contract representatives may be changed by written notice without amending this Agreement.

State of California Department of Cannabis Control

RFP 2026-001

Part 2 - Bidder Response

7. Solution Requirements

The Contractor shall complete and implement the DCC requirements as defined in EXHIBIT A:

FUNCTIONAL AND NON-FUNCTIONAL REQUIREMENTS. The DCC EXHIBIT A: FUNCTIONAL AND NON-FUNCTIONAL REQUIREMENTS will be electronically tracked, in DCC's requirements traceability solution as they are completed. The Contractor shall be responsible and accountable for implementing requirements that address DCC's business needs.

The following subsections are the high-level business needs for the DCC software solution.

7.1. Integrations

The Contractor shall configure the Software Solution to integrate with various external systems. All integrations developed shall adhere to the integration requirements and shall be secure and prevent the unauthorized disclosure or release of information. Data within the Solution is confidential and shall be protected. If client-side integration architecture components are needed, the Contractor shall provide recommendations on infrastructure components (hardware and software) to the State to successfully support these integration. The State technical team shall validate these recommendations and the State shall be responsible for procuring the necessary technical components only if suitable infrastructure components and architecture are not already available in DCC’s technical infrastructure. At the State’s direction, the Contractor shall install, configure, and manage this client-side environment.

Specific integration requirements are included in EXHIBIT A: FUNCTIONAL AND NON-FUNCTIONAL REQUIREMENTS . The Contractor shall further develop and define each requirements via an Integration Control Document (ICD) that shall be approved by the State via the Project’s Deliverables management process as described in SECTION 15. Project (Contractor) Tasks and Deliverable Requirements and SECTION 16. Deliverable and Work Product Acceptance/Rejection Process. These ICDs will define the data fields, format, processing logic, scheduling, success and error reporting and technical infrastructure components required of each individual integration. Integrations may consist of outbound data to an external partner, inbound data from an external partner, or both.

While the Contractor shall leverage real-time Application Program Interfaces (APIs) and web services to achieve the business needs of a given integration, the technological capabilities of the external partner will play a role in defining the scope of the integration.

7.2. Applications

To apply for a DCC license, the Applicant shall submit an application to DCC for a specific license type.

The license shall be issued to a specific person or entity (sole proprietor, partnership, corporation, etc.)

and specific location.

State of California Department of Cannabis Control

RFP 2026-001

Part 2 - Bidder Response

June 19, 2026 https://sb.cityinnovate.com/account/solicitations/documents/388797 https://sb.cityinnovate.com/account/solicitations/documents/388797 https://sb.cityinnovate.com/account/solicitations/documents/388777#section-786908 https://sb.cityinnovate.com/account/solicitations/documents/388777#section-786910

DCC requires the Applicant to submit the required application (via an online application portal, in person, or mail), complete the application by providing the required information and documentation, and pay for application and license fees. In addition, the solution shall allow DCC to input application information received via mail or in person.

The Contractor shall configure the solution to allow the Applicant to create an account/profile or log-in to an existing account to submit and/or complete a new or existing application. Applicants shall have the ability to add application materials through an online application portal. The software solution must also allow materials to be manually keyed or uploaded to the application file if they are submitted to the Program via a different method. Once the applicant has submitted an application, the applicant shall be able to obtain the submitted application status information via the online application portal.

Applicants shall have the ability to save applications in progress so that they may log-in to their accounts and resume work on the applications where they left off prior to the applications being submitted. When applicants resume work on applications, they need to identify (select from a list of one or more in-process applications) which application to resume (if multiple applications are in progress), and then begin work where they had stopped on the application process. All data entered up to the point where they had stopped must be saved with the application and shall not need to be re-entered. Applicants may need to review licensing policies, regulations, and other related information to ensure they understand what is required for each specific license type or application. In addition, prior to starting or during the application process, applicants may need additional information and/or guidance on what is required to complete each section of the application. Applicants shall be able to access aides (e.g., frequently asked questions, pop-up instructions, etc.) throughout the application process and not lose their place in the application.

Some application types require third-parties (i.e., business partners) to submit documentation or data (i.e., attestations) related to an application.

If the application is approved, the applicant shall be able to obtain (print or download) the approved license. The Program must be able to communicate through the online application portal or via email or traditional letters to applicants. If applicants are missing any of the required application materials, applicants shall be able to submit those materials or information via the online application portal.

7.3. Licensees

Businesses who previously met all minimum requirements to hold a license(s) shall use the solution to apply for and obtain a license renewal or complete other post licensure maintenance.

Licensees must submit license renewal requests and required fees prior to the license expiration date to avoid a lapse and to avoid paying late fees. Licensees shall have the ability to access a license renewal application for their specific license type, complete all required areas of the application, submit all necessary documents, pay fees, and submit the license renewal application for back-office review.

State of California Department of Cannabis Control

RFP 2026-001

Part 2 - Bidder Response

Licensees may not be able to complete renewal applications in one session, meaning that they stopped work on the application before the application was submitted. When Licensees resume work on renewal applications, they must identify which application they want to resume, if multiple applications are in progress, then begin work on the application at the application section where they had stopped. All data entered up to the point where the Licensee stopped must be saved with the application information and shall be available when the application process is resumed.

Licensees shall have the ability to access aides (e.g., frequently asked questions, pop-up instructions, etc.) throughout the renewal process. When renewal applications are approved, Licensees shall have the ability to obtain (e.g., print or download) the approved renewed license.

7.4. Back Office Processing

Once an application, renewal, or other license maintenance request has been submitted on-line, by mail, or in-person, and received by the DCC, a back-office review of the application is performed to ensure all sections of the application are complete. If the application is not complete, or attachments are not readable, the application shall be set to a status indicating it is incomplete and requires applicant's action.

The Program shall have the ability to notify the applicant of application status.

7.5. Process and Document Case Activity

The DCC can discipline, suspend, revoke, and take other administrative action against licenses. The software solution must be configured to allow the DCC to receive, document, and track all case activity such as compliance, inspections, complaints, investigations related to a specific License(s) and investigations related to unlicensed activity (individuals or entities who may not already have an account/ profile). In addition, the DCC must be able to archive documentation and correspondence related to a specific License(s) or the subject of the complaint/investigation, record fines associated with the Licensee and their assigned account or the subject of the complaint/investigation, and capture enforcement actions taken, and resolution of enforcement action.

7.6. Reporting

While most initial reporting needs are expected to be met via an integration with DCC's current business intelligence platform, the software solution shall also provide basic ad-hoc reporting and advanced back office search functionality for the data stored natively in the software solution. The software solution shall be able to provide real-time replicated data to the State’s data warehouse.

7.7. Accounting and Cashiering

The Contractor shall configure the software solution to receive various forms of payment options. The options shall include accepting payments online, in person, and by mail. Forms of payment shall include, State of California Department of Cannabis Control

RFP 2026-001

Part 2 - Bidder Response but are not limited to, cash, check, e-check, and credit/debit cards. The solution shall have the ability to create online cashiering receipts, issue refunds, and apply payments to the appropriate applications, licenses, compliance and enforcement related activity. In addition, the solution should have the ability to perform a transfer of funds from one account to another and the ability to identify bad-checks.

7.8. Information Technology Services Division (ITSD) System Maintenance

DCC Information Technology Services Division (ITSD) shall be administrative users of the software solution. A limited set of administrative functions shall be delegated to the Programs if adequate role-based-security can limit the scope of administrative actions available to non-IT staff.

Upon completion of knowledge transfer, to ITSD staff, they shall have the ability to configure, monitor, and administer the operational characteristics of any proposed software solution. This includes such characteristics as configuration, user management, web service modification, performance, availability, and overall utilization.

ITSD shall have the ability to obtain and/or verify Service Level Agreement (SLA) data. ITSD shall have access to the SLA raw data, download this data, and review the information to determine if the contractually agreed to SLAs have been met. ITSD shall have the ability to add, delete, and suspend users of the software solution and to perform other user management functions such as the assignment of roles, generation of initial passwords, generation of password resets, etc.

7.9. Mandatory-Optional Requirements

Mandatory Optional requirements FG-93 through FG-95 (below) and as identified in EXHIBIT A:

FUNCTIONAL AND NON-FUNCTIONAL REQUIREMENTS, are not negotiable. To be considered responsive, all requirements identified as (MO) must receive a cost in the EXHIBIT C: COST WORKSHEETS. It is at the State’s option/discretion on whether to utilize the option and execute an amendment to the contract.

Requirement # Requirement Description

FG-93

The system shall support bi-directional data exchange with state and federal systems, values determined by DCC and provide fail and success reports, for new legislative driven license types.

FG-94

The system shall support the configuration and management of new legislatively-mandated license types (up to five in total), including fees, variable fee rules, expiration date assignment rules, eligibility rules, owner relationship requirements, and required licensing disclosures.

State of California Department of Cannabis Control

RFP 2026-001

Part 2 - Bidder Response

Requirement # Requirement Description

FG-95

The system shall support modification of license types to conform with legislatively-mandated changes to fees, variable fee rules, expiration date assignment rules, eligibility rules, owner relationship requirements, and required licensing disclosures.

8. Contractor Hosted Facility Environment

The cloud solution shall be hosted at a provider-operated facility and must be compliant with GovCloud (US) standards and meet all applicable moderate FedRAMP requirements for security and authorization.

Refer to EXHIBIT D: IT - GP CLOUD - COMPUTING SERVICES, DGS PD 402-ITGP (Cloud).

9. State’s Roles and Responsibilities

The DCC Contract Representative is the contact person to whom all Contractor communications may be addressed. The following describes the responsibilities of DCC:

A. Review the agreement and associated documents with the Contractor, as needed, to ensure understanding of the responsibilities of both parties.

A. Coordinate and schedule meetings between the Contractor and state key personnel.

B. Review and assess Contractor tasks and deliverables for quality and completeness and en sure the technical requirements of the Agreement are met.

C. Provide Contractor(s) with sufficient and timely access to appropriate documentation and

DCC staff, as appropriate, to facilitate the execution of the Contractor tasks and deliverables as in SECTION 15. Contractor Tasks and Deliverable Requirements .

D. Provide information regarding the data, and schedule the availability of the DCC personne l for interviews, as required by the Contractor to perform its responsibilities.

E. Provide Contractor with standard Department imaged desktop(s), phone equipment, and standard cubicle and/or office working facilities at any of the DCC sites and/or other locations specified by the DCC, as necessary, with limited network connectivity to access team working documents.

F. Provide (and require signature as applicable) the Contractor staff the applicable policies and procedures for review/ signature, such as Sexual Harassment Training Policy, confidentiality, DCC facilities, security, and Internet usage policies

The State will have staff who can perform the following roles and responsibilities:

Role Responsibility

State of California Department of Cannabis Control

RFP 2026-001

Part 2 - Bidder Response

Executive Sponsor The Executive Sponsor plays a vital leadership role by championing the project throughout the State of California within the Programs, Department, Agency, and State Stakeholders.

Product Owner The Product Owner establishes the vision for the product and serves in a leadership role. They prioritize the business needs, provide input to the Vendor regarding defects, and validate requirements. They also determine the severity and priority of any software defects discovered through testing.

Project Director The Project Director assists the Executive Sponsor with external stakeholder management specific to technical scope. The Project Director supports the Project Manager Team by working directly with the Executive Sponsor and external stakeholders to ensure that decisions that impact the technical scope are managed appropriately by defining and implementing a governance structure.

Project Manager Consultant (State)

The Project Manager manages the day-to-day activities of the team and works with the Product Owner and Vendor to ensure an effective, user-focused product that meets the business needs.

Project Management Staff Project Management Support Staff assist the Project Director and Project Manager in the day-to-day project management activities in support of the project.

Subject-Matter Experts Subject-Matter Experts will provide business clarification on requirements and may review project deliverables and participate in testing.

Independent Verification and Validation (IV&V) Staff

IV&V staff provide independent review and analysis of specific project activities and documentation related to the solution and requirements, monitor the requirements to ensure they meet the stated business needs, monitor the solution to ensure it meets the requirements, and review the ongoing project.

State of California Department of Cannabis Control

RFP 2026-001

Part 2 - Bidder Response

10. Contractor’s Roles and Responsibilities

In partnership with the DCC, the Contractor shall provide the software and Key and non-key staff to implement the SaaS solution to meet the DCC’s requirements. The Contractor's scope of work shall include:

A. Provide a licensing and compliance cloud SaaS product and any other software products required to meet all requirements identified in EXHIBIT A: FUNCTIONAL AND NON-FUNCTIONAL

REQUIREMENTS.

B. Set up and provision the production and all required non-production environments of the SaaS product.

C. Provide a Key and non-key staff that meets the minimum Key and non-key staff qualifications/ experience requirements as outlined in this request and the resulting Agreement.

D. Provide technical services for all activities associated with the execution of the deliverables, tasks, and responsibilities identified in this SOW.

E. Unless otherwise specified by the DCC Project Director, Contractor shall use Microsoft Office Professional Suite 2010, for supporting word processing documents, Microsoft Excel 2010 for spreadsheets, Microsoft PowerPoint for presentations and Microsoft Project for the schedule. The media of delivery shall be compatible with the DCC document storage devices.

F. The Contractor shall establish integrations with cloud-based systems of record(s).

G. The Contractor shall work collaboratively with DCC resources for the sole purpose of performing the work specified in this agreement.

H. The Contractor shall not connect non-DCC personal computers to the DCC network without prior written approval.

I. The Contractor shall complete all tasks and deliverables within the periods specified in the State-accepted project System Development Plan and shall submit them to the appropriate DCC project representative.

J. Upon engagement, the Contractor shall comply with and sign all applicable DCC policies and procedures, including but not limited to those relative to discrimination, sexual harassment, confidentiality, conflict of interest, privacy, security, facilities, personal computing device and Internet usage.

K. Prior to the termination of the agreement, the Contractor shall return all DCC property, such as card keys, office equipment, and project documentation upon demand by DCC.

The DCC Projects follow a hybrid/modular approach with aspects similar to the California Agile Framework (CA-Agile) and the California Project Management Framework (CA-PMF). The CA-Agile was developed by the California Department of Technology’s (CDT) California Project Management Office an d it provides practical guidance for managing iterative incremental project delivery activities. The CA-

State of California Department of Cannabis Control

RFP 2026-001

Part 2 - Bidder Response

June 19, 2026 https://projectresources.cdt.ca.gov/agile/ https://capmf.cdt.ca.gov/

PMF is a customized project management methodology derived from the Project Management Institute’s process groups. The CA-PMF follows best practices based on the State processes and the Project Management Body of Knowledge. The Contractor will direct and implement the CSI project’s SaaS solution through a development approach, as presented in their ATTACHMENT 17:

NARRATIVE RESPONSE. Upon contract award, a more defined and detailed description will be provided in the System Development Plan in order to meet the requirements in this SOW.

11. Key Staff Qualifications and Skills

KEY STAFF QUALIFICATIONS AND SKILLS

The Contractor is fully responsible for providing staffing resources to successfully complete the tasks, deliverables, and performance standards set forth in this SOW. The proposed staff must be capable of fulfilling all roles and tasks/deliverables outlined in this SOW.

Based upon DCC business needs, DCC requires the following number of key staff personnel to provide support under this Agreement.

Mandatory Minimum qualifications Desirable Qualifications Key Staff: Project Manager (1)

1.Bachelor degree in Business Administration, Information Technology, Project Management or Computer Science.

If the degree is not in English, it must be accompanied by an evaluation performed by a member of the National Association of Credential Evaluation Services (NACES).

1. One (1) to three (3) years of experience as the Project Manager implementing or maintaining a Cannabis Licensing and Compliance system.

2.Four (4) years of experience as a Project Manager on a large scale complex IT project for a government agency (City, State, County or Federal), managing the end-to-end design, development and implementation (DDI) of software solutions.

3. Two (2) years managing cross-functional project teams, ensuring alignment with organizational goals, budgets, and timelines.

State of California Department of Cannabis Control

RFP 2026-001

Part 2 - Bidder Response

4. Two (2) years developing, updating, and executing project management plans, and must have experience in managing all the following: scope, schedule, resource allocation, risk, and stakeholder communication.

5. Two (2) years applying standard project management methodologies and Agile, Scrum, or hybrid approaches using modern project management tools.

6. Project Management Institution (PMI) Project Management Professional (PMP) certification.

Key Staff: Scrum Master (1) Desirable Qualifications

1. Bachelor's degree in Business Administration, Information Technology, Project Management or Computer Science.

If the degree is not in English, it must be accompanied by an evaluation performed by a member of the National Association of Credential Evaluation Services (NACES).

1. One (1) to three (3) years of experience as the Scrum Master implementing or maintaining a Cannabis Licensing and Compliance registration system.

2. Four (4) years of experience as a Scrum Master on a large-scale complex IT project and must have experience in managing all the following: facilitating Agile ceremonies, daily stand-ups, sprint planning, reviews, and retrospectives.

2. Scrum Master Certificate

3. Two (2) years of experience maintaining sprint velocity, ensuring a collaborative and self-organizing environment.

4. Two (2) years of experience partnering with Product Owners and must have experience in managing all the following: prioritize and refine backlogs, manage stakeholder expectations, and deliver increments.

Key Staff: Business Analyst Lead (1) Desirable Qualifications

1. Bachelor degree in Business Administration, Information Technology, Project Management or Computer Science.

If the degree is not in English, it must be accompanied by an evaluation performed by a member of the National Association of Credential Evaluation Services (NACES).

State of California Department of Cannabis Control

RFP 2026-001

Part 2 - Bidder Response

1. One (1) to three (3) years of experience as the Lead Business Analyst implementing or maintaining a Cannabis Licensing and Compliance system.

2. Four (4) years of experience as a Business Analyst on a large-scale complex IT project and experience must be in a regulatory, licensing, and compliance system.

3. Two (2) years overseeing a team of business analysts and coordinating with cross-functional teams to ensure consistency and quality of analysis deliverables (e.g., business process models, user stories, use cases).

4. Two (2) years leading business analysis efforts across the full project lifecycle, and must have experience in all of the following: requirements analysis, user story development, documentation, validation, and traceability.

Key Staff: Configuration Lead (1) Desirable Qualifications

1. Bachelor degree in Information Technology, Computer Science, Information Systems Management, or Engineering.

If the degree is not in English, it must be accompanied by an evaluation performed by a member of the National Association of Credential Evaluation Services (NACES).

1. One (1) to three (3) years of experience as the Configuration Lead implementing or maintaining a

2. Four (4) years of experience as a Configuration Lead in a large-scale complex IT project and must have experience in managing all the following: coordinating cross functional teams (e.g. development, QA, or security, operations) to promote, deploy, and validate configuration changes across multiple environments (e.g. dev, test, staging, or prod).

3. Two (2) years of experience in managing all the following: establishing and governing configuration management processes, defining standards, policies, and baselines for code, infrastructure, and environment configurations.

4. Two (2) years of experience in managing all the following: leading continuous improvement by

Department of Cannabis Control

RFP 2026-001

Part 2 - Bidder Response analyzing configuration incidents, root causes, and metrics to streamline releases and reduce defects.

Key Staff: Technical Architect Lead (1) Desirable Qualifications 1.Bachelor degree in Computer Science, Software Engineering, Information Systems Management, Computer Engineering or Systems Engineering.

If the degree is not in English, it must be accompanied by an evaluation performed by a member of the National Association of Credential Evaluation Services (NACES).

1. One (1) to three (3) years of experience as the Technical Architect implementing or maintaining a

2. Four (4) years of experience as a Technical Architect Lead on a large complex IT project and must have experience on systems integration and data exchange between enterprise platforms and third-party applications.

3. Two (2) years of experience in all of the following: leading data conversion and migration efforts, data mapping, transformation logic, data quality validation, and secure transfer of data between legacy systems and modern platforms.

4. Two (2) years of experience in developing and maintaining technical architecture designs and artifacts ensuring traceability, auditability, and compliance with frameworks such as ITIL, ISO 20000, or

NIST.

5. Two (2) years of experience leading the design and implementation of application programming interfaces (APIs).

11.1. NON-KEY STAFF QUALIFICATION

All Contractor staff designated to perform the activities outlined in SECTION 31. Maintenance and Operations (M&O) must have no less than one (1) year of demonstrated experience providing monthly operational support for the proposed solution. However, any replacement of non-key staff shall follow the SECTION 12. Key Personnel Changes

At the State’s discretion, the Contractor shall provide evidence of minimum qualifications for personnel assigned to perform monthly service activities.

State of California Department of Cannabis Control

RFP 2026-001

Part 2 - Bidder Response

12. Key Personnel Changes

The Contractor must commit to the continuing availability and participation of the staff filling the key role(s) for the duration of the Project or for their proposed period of involvement (as defined in the System Development Plan). Except in the case of a leave of absence, sickness, death, termination or resignation of employment or association, or other circumstances outside the reasonable control of Contractor, the individual(s) designated to fill any of the key role(s) in Contractor’s Response shall not be removed by Contractor from performing their assigned tasks during the period of performance without the prior written approval of the State. The State recognizes that an unforeseen resignation or other events may cause key staff to be unavailable. The State Project Director reserves the right to approve or deny all of the Contractor’s proposed replacement key staff designated to fill any of the key role(s). Any of the proposed replacement must have the same or higher-level skills and experience as those requirements stated in the Contractor's response (including Desirable qualifications that the Contractor proposed). Contractor must request approval of replacement staff designated to fill any of the key staff role(s) from the State Project Director in writing at least 10 State business days before they are scheduled to begin work on the project and such replacement staff shall not start on the Project without the State Project Director’s written approval.

If staff designated to fill any of the keyrole(s) submitted by the Contractor for the Contract is unable to participate in this Contract due to leaving the firm or having a significant health issue, they must be replaced within 20 State business days.

The Contractor must provide a replacement key staff member who has equal or better qualifications and ratings. Replacement staff shall be subject to all the same requirements as the original proposed key staff. The Contractor must submit to the State Project Director, for consideration of any replacement staff, the applicable Key Staff Qualifications Form using SECTION Key Staff Replacement Form, that indicates how the replacement staff meets or exceeds all the minimum requirements and any of the desirable project characteristics that were evaluated as part of the award and the resulting Agreement. The Contractor’s request to replace staff must be approved in writing by the State prior to the replacement staff beginning work.

The State Project Director may, at its sole discretion, request additional information to substantiate whether the replacement staff is in compliance with the Contractor's response requirements.

The State Project Director will respond, in writing, indicating approval or rejection of the proposed replacement staff within five State business days after receipt of the request to replace staff; if the State Project Director requires additional information regarding the replacement personnel from references, such five-day period shall be increased by the number of days required to receive responses from all references in excess of one State business day. The State Project Director must approve replacement staff designated in writing before they begin work on the project.

State of California Department of Cannabis Control

RFP 2026-001

Part 2 - Bidder Response

If any of the proposed replacement staff designated to fill any of the key role(s) is rejected, the Contractor shall work diligently to promptly provide a qualified replacement to the State for approval withi n 10 State business days of the rejection.

The State will notify the Contractor concerning any issues and/or concerns the State has regarding the poor or otherwise unsatisfactory performance of any Contractor staff and the Contractor will have 10 Stat e business days in which to remedy the State’s issues and/or concerns. If Contractor has not remedied the issues and/or concerns regarding the Contractor staff within this period of time, the State reserves the right in its sole discretion to require the Contractor to replace such staff at any time thereafter. The State will notify the Contractor in writing when exercising that right. The Contractor, no later than 20 State business days of such notification, shall provide a replacement candidate.

The State recognizes that changes to Subcontractor(s) may be necessary and in the best interests of the State; however, advance notice of a contemplated change and the reasons for such change must be given to the State no less than seven State business days prior to the existing Subcontractor’s termination. The State Project Director or designee must approve any changes to the Subcontractor(s) prior to the termination of the existing Subcontractor(s) and hire of the new Subcontractor(s) and such approval will not be unreasonably withheld or delayed. This also includes any changes made between submittal of the Contractor’s RFP Response and Contract Award Date. The State will not compensate the Contractor for any of the Contractor’s time or effort to educate or otherwise make the new Subcontractor(s) ready to begin work on the Contract.

13. Escalation Process

The parties acknowledge and agree that certain technical and project related problems or issues may arise, and that such matters shall be brought to the DCC’s attention. Problems or issues shall normally be reported in regular status reports. There may be instances, however, where the severity of the problems justifies escalated reporting. To this extent, the Vendor will determine the level of severity and notify the appropriate DCC personnel. The DCC personnel notified, and the time period taken to report the problem or issue, shall be at a level commensurate with the severity of the problem or issue. Additional information regarding performance when submitting deliverables is defined in SECTION 16. Acceptance, Review, and Correction of Deliverables, Work Products, and Other Contractor‑Performed Work and SECTION 35. Service Level Agreements (SLAs) defines other areas of service. To notify the DCC, the personnel include, but are not limited to, the following:

First level: DCC ITSD Project Director

Second level: DCC ITSD PMO Supervisor

Third level:DCC ITSD Chief Information Officer

State of California Department of Cannabis Control

RFP 2026-001

Part 2 - Bidder Response

14. Change Control Procedures

To ensure effective governance of CSI project, decision-making and operational oversight need to be executed as close as possible to the point where the action is required. The development framework approach identified by the Contractor to execute the CSI project will support decision-making at the lowest levels of the organization. This requires empowerment of the individuals by the decision body and excellent communication horizontally across the product teams and vertically throughout the governance hierarchy.

Minor refinements may be agreed upon between the Contractor and DCC Project Director or designee.

Minor refinement of deliverables and/or work products are defined as having twenty-hours (20-hours) or less from contractor time from the original agreed upon scope of work. If both parties agree the request falls within a minor changes, then a formal change request is NOT required.

Minor refinements necessary for project inclusion will be approved by the DCC Project Director or designee and implemented within the appropriate project development phase either in phase 1, which could constitute a production support refinement if phase 1 has been released to production, or included in phase 2 for release with the final project scope.

Major refinement may be agreed upon between the Contractor and DCC Project Director or designee.

Major refinement of deliverables and/or work products are defined as having twenty one hours (21-hours) or more refinement from contractor time from the original scope of work. If both parties agree the request falls within a major refinement, then a formal change request IS required. If a formal change request is required, a ATTACHMENT 23: REQUEST FOR CHANGE FORM will be required.

Major refinement will be submitted to the DCC's Information Technology Governance Council (ITGC) for discussion and recommendation and implemented either in phase 1, which could constitute a production support if phase 1 has been released to production, or included in phase 2 for release with the final project scope.

Formal ATTACHMENT 23: REQUEST FOR CHANGE FORM submitted and approved by the ITGC will be incorporated into the project scope and may require contract amendments to be executed, if beyond the Unanticipated Tasks referenced in SECTION 37. Unanticipated Tasks .

In circumstances where a project requirement or integration cannot be implemented due to factors beyond DCC’s or the Contractor’s control—such as an external entity’s inability or refusal to participate, or dependency on unsupported legacy systems—DCC reserves the right to modify or remove the affected requirement or integration through the established Request for Change (RFC) process.

Changes through the RFC process shall not constitute non-performance by either party. When feasible, DCC and the Contractor will collaborate to identify reasonable alternatives that meet the project’s intent

State of California Department of Cannabis Control

RFP 2026-001

Part 2 - Bidder Response within existing resource and technical constraints. Any resulting adjustments to cost, schedule, or deliverables will be managed through the standard RFC review and approval process and, if necessary, formal contract amendment.

Unless explicitly stated otherwise, all RFC's and Change Log documentation shall be created using 2010 (or later) versions of the following Microsoft applications: Word; Excel; PowerPoint; Visio; or Project.

SharePoint may be used as an alternative, but the Contractor shall verify application compatibility with the DCC Project Manager prior to creation or delivery of any electronic documentation. The delivery media shall be compatible with the State storage devices.

15. Contractor Tasks and Deliverable Requirements

The Contractor shall comply with all tasks and deliverables in SECTION 15. Contractor Tasks and Deliverable Requirements and subsections throughout the project execution.

The State, with the assistance of the Contractor, will determine the scope, sequence, and timing of WOAs as they relate to the execution of tasks described in this section.

15.1. Project Management Tasks

The Contractor’s tasks outlined in the SOW and the Deliverables required from the Contractor for Project Management are defined in the following tables.