Attachment A - Scope of Work.pdf

25-43232300-RFP

Data Management Tools Page 1 of 9

Attachment A Scope of Work

1. PURPOSE

The Contractor shall provide Customers with Data Management Tools for statewide use, including Data Management, Data Governance, Data Analytics, and Data Interoperability and Integration which will be referred to as “Data Management Tools”. Data Management Tools shall be provided in accordance with Chapter 282, Florida Statutes (F.S.), Rule Title 60GG, Florida Administrative Code (F.A.C.), and cybersecurity best practices. Data Management Tools shall meet or exceed the applicable state and federal laws.

2. DEFINITIONS

Definitions contained in section 287.012, Florida Statutes (F.S.); Rule 60A-1.001, Florida Administrative Code (F.A.C.); and Attachment D, Enterprise Standard Terms and Conditions; are incorporated by reference. In the event of a conflict, the definitions listed in this section supersede the incorporated definitions for the purposes of this Scope of Work. All definitions apply in both their singular and plural sense.

Add-On Services – Non-core or additional services available for purchase to enhance or support a Solution.

Business Day – Monday through Friday, inclusive, except for those holidays specified in section 110.117, F.S., from 8:00 a.m. to 5:00 p.m. at the Customer’s location.

Business Network – The Business Network (formerly known as Ariba Network) is an online marketplace that connects vendors and buyers for solicitations collaboration and purchasing transactions. A Business Network account is required to submit responses to electronic solicitations.

Confidential Information – Information that is trade secret or otherwise confidential or exempt from disclosure under Florida or federal law.

Criminal Justice Information Services (CJIS) – Services providing access to national or local criminal justice information.

Cross-Domain Interoperability – The ability for multiple organizations to work together to facilitate secure and timely communication and efficient use of data between organizations.

Customer – Means the agency, as defined in section 287.012, F.S., or eligible user, as defined in Rule 60A-1.001, F.A.C., that makes a purchase off the Term Contract. For the avoidance of doubt, this also includes the Department when it purchases off the Term Contract.

Data Analytics – Process of analyzing data to extract insights and make decisions.

Data Catalog – An inventory of an organization’s data assets, including information about those assets.

Data Management Tools Page 2 of 9

Data Governance – Policies, processes, and standards that ensure data is used efficiently and effectively.

Data Integration – The process of consolidating, combining, sharing, or synchronizing data from multiple disparate sources to produce useful business information or to initiate new business functions.

Data Interoperability – The seamless, secure, and controlled exchange of data between multiple disparate systems.

Data Management Tools – Software, processes, and applications that help users collect, analyze, manage, govern, store, and visualize data. May be used interchangeably with “Solution(s)”.

Data Quality – Refers to reliability, accuracy, completeness, consistency of data, and other criteria that may be outlined by the Customer in the Customer Specific Scope of Work.

Department – The Department of Management Services (DMS), a State Agency.

International Organization for Standardization (ISO) – An independent, non-governmental, international standard development organization composed of representatives from the national standards organization of member countries.

Semantic Interoperability – Refers to data being exchanged and accurately interpreted at the data field level between different systems.

Service Level Agreement – A document that defines the level of service expected from a Contractor, that defines clear service expectations in measurable terms and sets obligations for when expectations are not met.

Syntactic Interoperability – The ability for one system or application to communicate with another system through compatible formats.

Term Contract – The legally enforceable State Term Contract, as defined in section 287.012, F.S., between the Department and the Contractor.

Value-Added Services – Value-added services include any additional services the Contractor offers, for no additional cost to the Customer, as part of the Term Contract, and which clearly exceeds the minimum requirements and are within the scope of this Term Contract. An example of value-added services would be, “The Contractor will provide a year of 24/7 support services, at no cost to the Customer.” Any value-added service proposed by the Contractor, if accepted by the Customer, shall become a requirement and be a part of the minimum service specifications contained in any resulting Purchase Order.

3. SCOPE OF WORK

All Data Management Tool Solution(s) must meet the minimum specifications, terms, and conditions outlined in the Term Contract. Any additional specifications exceeding the minimum requirements listed below will be outlined by the Customer in the Customer Specific Scope of Work.

Data Management Tools Page 3 of 9

3.1 General Requirements Across Service Categories:

3.1.1. Compliance: Solution(s) shall comply with relevant industry standards and regulations applicable to the State of Florida and the relevant Customer (e.g., CJIS, HIPAA, SOX, PCI-DSS, ISO 27001, NIST).

3.1.2. Scalability: Solution(s) shall ensure scalabiltity for accommodating current and future growth of the State of Florida and/or the Customer of the service. Including handling both increased workloads and expansion across additional devices, users, or systems.

3.1.3. Reliability: Solution(s) shall provide high availability and reliability, with minimal downtime and robust disaster recovery capabilities to ensure the Customer’s business continuity.

3.1.4. User-Friendly Interface: Solution(s) shall provide intuitive and easy-to-use interface for both IT staff and end-users, ensuring that tasks can be performed efficiently.

3.1.5. Data Protection: Solution(s) shall ensure data is encrypted both at rest and in transit using industry-standard encryption algorithms.

3.1.6. Access Controls: Solution(s) shall have Role-Based Access Control (RBAC), Attribute-Based Access Control (ABAC), and Multi-Factor Authentication (MFA) for managing user access.

3.1.7. Auditing and Log Forwarding: Solution(s) shall forward logs to external log aggregation systems such as security information and event management systems (SIEMs), ensuring that critical data is available for analysis and audit purposes. Each Solution shall provide comprehensive logging and auditing capabilities to track data access, configuration changes, and security events.

3.1.8. Confidentiality Agreements: Solution(s) shall implement and enforce confidentiality agreements between Customers and the Contractor upon the request of the Customer.

3.1.9. Flexibility and Extensibility:

The Solution(s) shall support Application Programming Interfaces (APIs), Software Development Kits (SDKs), and Cloud and On-Premises Environments.

3.1.9.1 Application Programming Interfaces (API) and Software Development Kit (SDK) Availability/Access support shall:

a) expose or use exposed APIs for custom integrations and extending functionality where needed.

b) import/export data by way of batch or bulk transactions between Customer systems, applications, and infrastructures, as detailed in the Request for Quote, for custom integrations and extending functionality where needed.

3.1.9.2 Support for Cloud and On-Premises Environments:

a) The Solution(s) shall support hybrid environments, including cloud-based, on-premises, and multi-cloud deployments.

b) If a 3rd Party exists within the State of Florida ecosystem, the Solution(s) shall have the ability to transfer data from one tenant to another tenant within the

Data Management Tools Page 4 of 9 same environment where the Customer explicitly controls and authorizes such transfer.

3.1.10. Training and Support:

The Solution(s) shall include comprehensive staff training and ongoing support.

3.1.10.1 Staff Training requires:

a) Training sessions on best practices and implementation.

b) Ongoing training resources and certification programs to ensure staff are knowledgeable about the Solution(s).

c) Training, support, and documentation on installation of the Solution(s) and all related implementation configurations shall be provided to the Customer prior to the contractual agreement ending.

3.1.10.2 Ongoing Support requires:

a) Availability of ongoing support and consultation services, including SLAs for issue resolution and dedicated account managers or customer success teams.

3.1.10.3 Documentation and Resources shall include:

a) Access to applicable comprehensive documentation, user guides, data models, lists of fields and associated descriptions, and online resources for continuous learning and improvement.

b) Regular webinars, user community forums, and knowledge-sharing platforms to keep users informed of updates or best practices.

3.2 Service Categories

3.2.1. Service Category 1: Data Management

The Solution(s) shall provide Data Management Tools to collect, store, process, and use data in a structured way for the Customer.

a) Data Store and Management: Solution(s) should provide Data Lakehouse, Data Lake, Data Warehouse, Data Hubs, Data Storage, Data Archive/E-Discovery, Data Pipelines, or equivalent.

b) Data Processing and Transformation: Solution(s) should use Bulk Data/Batch Data, Extract, Transform, Load/Extract, Load, Transform (ETL/ELT), Streaming, Change Data Capture (CDC), or equivalent.

c) Integration and Governance: Solution(s) should provide API Governance/Management, Integration Governance/Management, or equivalent.

d) Service Orchestration: Solution(s) should provide support Semantic, Interoperability, Business Rules Engine, or equivalent.

e) Data Domains: Solution(s) should provide help to manage data domains for agency data, or equivalent.

f) Data Integration: Solution(s) should be able to ingest, consolidate, transform, and transfer data from its source to destination, or equivalent.

Data Management Tools Page 5 of 9

3.2.2. Service Category 2: Data Governance

The Solution(s) shall provide tools to make the Customer data secure, accurate, available, and usable for the Customer.

a) Data Governance Policy & Sharing Agreement Management: Solution(s) should facilitate the management of data governance policies, compliance tracking, and secure data sharing agreements, or equivalent.

b) Data Taxonomy: Solution(s) should improve the searching and organization of data, or equivalent.

c) Data Classification:

Solution(s) should automate classification with manual refinements for rules based on observed classifications and required frameworks.

Solution(s) should automate identification of potential data duplication and highly sensitive data such as Personally Identifiable Information (PII), Health Insurance Portability and Accountability Act (HIPAA), Criminal Justice Information Services (CJIS), etc.

Solution(s) should automate and manual data tagging and data labeling capability.

d) Data Ingestion/Transmission monitoring: Solution(s) should provide real-time tracking and validation of data as it moves across systems; or equivalent.

e) Master Data Management/Reference Data Management: Solution(s) should standardize, consolidate, and maintain data to create a single source across multiple platforms and applications; or equivalent.

f) Data Marketplace: Solution(s) should enable Customers to catalog, access, and share data assets internally and externally while maintaining governance and security controls; or equivalent.

g) Data Quality Management/Observability: Solution(s) should provide real-time data monitoring, validation, and anomaly detection to improve data accuracy, completeness, and reliability; or equivalent.

h) Language Modeling: Solution(s) should provide natural language processing, text analysis, and structured data interpretation, enabling automated decision-making and deeper insights; or equivalent.

3.2.3. Service Category 3: Data Analytics

The Solution(s) shall support and convert Customer data into actionable insights to drive better business outcomes and/or decisions for the Customer.

a) Data Science/Artificial Intelligence/ Machine Learning/ Decision

Intelligence: Solution(s) should support and enable Predictive, Generative Analysis, Deep Learning, Reinforcement Learning or equivalent.

b) Model Management: Solution(s) should provide model management and graph theory; or equivalent.

c) Reporting and Visualization: The Solution(s) should provide comprehensive reporting, interactive dashboards, and data visualizations to support data-driven decision-making.

3.2.4. Service Category 4: Data Interoperability and Integration The Solution(s) for this category shall only be submitted with the Contractor response if the Contractor is submitting a response for service categories Data Management, Data Governance, and/or Data Analytics as outlined above.

Data Management Tools Page 6 of 9

a) Data Interoperability and Integration tools

The Solution(s) shall provide one or more of the following capabilities:

The Solutions(s) enables the ability to exchange and use data across different systems, applications, and organizations to enable seamless integration for the Customer.

The Solution(s) enables the ability to provide seamless integration with Customer systems, applications, and infrastructures ensuring that the Solution can coexist within the Customer’s IT ecosystems without requiring major overhauls.

The Solution(s) enables the ability to provide augmented services that integrate existing Customer systems, applications, and infrastructures detailed in the Request for Quote that promote interoperability modernization efforts.

The Solution(s) supports Syntactic Interoperability, Semantic Interoperability, Cross-Domain Interoperability, or equivalent categories.

3.3 Solution Equivalents

If the Solution(s) is not available, the Contractor may provide an equivalent or superior Solution option to the Customer, at no additional cost, which is subject to the Customer's prior approval.

An equivalent Solution is one that meets or exceeds the specifications of the Customer’s order.

3.4 Optional Add-On Services

Only Add-on Services on the Price Proposal may be purchased with a Solution under a Purchase Order. Add-On Services without a corresponding price entry on the Price Proposal shall be free of charge and considered a Value-Added Service if included on a resultant Purchase Order.

Suggested, but not required, Add-On Services or Value-Added Services include:

3.4.1 Implementation (Optional)

Support for the initial implementation and successful deployment of the Solution for the Customer, including initial training and integration with existing systems.

3.4.2 Managed Security Services (Optional)

Deploy and maintain managed security services to support Customers, particularly with Productivity Tools Contract No. 43231513-25-STC Page 6 of 8 advanced administration of the Solution to support cybersecurity and incident response.

3.4.3 Application Management (Optional)

Distribute and manage native applications, provide stand-alone management for applications on unmanaged devices and application and data containment, and differentiate or isolate personal and corporate data.

3.4.4 On-Going Training (Optional)

Include any Solution training.

3.5 Value-Added Services

Contractors may offer additional services which clearly exceed the minimum requirements and are within the scope of this Contract, at no additional cost to the Customer. If the Contractor proposes Value-Added Services in response to a Request for Quote and are accepted by the Customer, the Value-Added Services shall become a requirement and be a part of the minimum service specifications contained in any resulting Purchase Order.

Data Management Tools Page 7 of 9

3.6 Pricing

The Contractor shall adhere to the Cost Proposal submitted in Exhibit C, Price Sheet(s), which is incorporated into the Term Contract. The Contractor shall provide the lowest available Tiered Pricing to the Customer which meets the specifications of this Scope of Work.

If the Exhibit C, Price Sheet(s), offers Tiered Pricing for the offerings being requested by the Request for Quote (RFQ), the Contractor shall reflect the Tiered Pricing that applies after factoring in all current purchases under the Term Contract. For example, if a new Customer submits an RFQ for 1,000 units and the Contractor offers a tier that is for 50,000 - 100,000 units and currently provides 80,000 units to other Customers, the Contractor shall honor the Tiered Pricing that applies to the 50,000 - 100,000 range in its quote to the new Customer.

This obligation shall also apply to renewal term pricing. For example, if Customer A was the first to purchase from the Contractor under the Term Contract, but the Contractor now sells 80,000 units to Customer B, the renewal pricing for Customer A shall be decreased to reflect the higher tier.

3.7 Compliance and Compatibility

It is the Contractor’s responsibility to ensure that the Solution(s) supplied are compliant with the Term Contract requirements, specifications, terms, and conditions. Additionally, the Contractor shall ensure that all Commodities ordered by the Customer are fully compatible with each other and with any associated pre-existing Commodity possessed by the Customer and disclosed to the Contractor by the Customer. The Contractor’s acceptance of the Customer’s order shall indicate that the Contractor agrees to deliver a Solution(s) that is fully compliant and compatible with the Customer’s order requirements, specifications, terms, and conditions.

3.8 Request for Quotes Requirement

Customers shall use a Request for Quotes to all Contractors in the applicable Service Category in accordance with sections 287.056(2) and 287.0591, F.S., and Rule 60A-1.043, F.A.C., when making purchases off this State Term Contract (Term Contract). For any purchases off the Term Contract, the Contractor recognizes its responsibility for all tasks and deliverables contained in the Term Contract and any Customer Request for Quote, warrants that it has fully informed itself of all relevant factors affecting accomplishment of the tasks and deliverables, and agrees to be fully accountable for the performance thereof.

3.9 Customer Specific Scope of Work (SOW)

Customers may develop a Customer Specific SOW which establishes additional Customer specific preferences, other requirements, or minimum service levels. If applicable, Customers shall include the Customer Specific SOW in the RFQ issued to the Contractors in a Solution, and the Customer SOW shall be incorporated into any purchase order or contract issued by the Customer. Customers are permitted to negotiate terms and conditions which supplement those contained in this Term Contract. The Customer SOW may include, but is not limited to, the following information:

Solution(s) Customer-specific scope of work requirements/service level agreement Customer-specific payment terms Customer-specific financial consequences for non-performance Customer-specific terms and conditions Anticipated timeline for work to be performed Additional Contractor responsibilities

Data Management Tools Page 8 of 9

Kick off meeting requirements Reporting requirements Implementation plan, if applicable Security agreements, if applicable Florida Digital Service consultation, if applicable

3.10 Punchout Catalog and Electronic Invoicing

The Contractor is encouraged to provide an MFMP punchout catalog.

The punchout catalog provides an alternative mechanism for suppliers to offer the State access to Products awarded under the Term Contract. The punchout catalog also allows for direct communication between the MFMP eProcurement System and a supplier’s Enterprise Resource Planning (ERP) system, which can reflect real-time Product inventory/availability information.

The punchout catalog enables Florida buyers to “punch out” to a supplier’s website. Using the search tools on the supplier’s Florida punchout catalog site, the user selects the desired Products.

When complete, the user exits the supplier’s punchout catalog site and the shopping cart (full of Products) is “brought back” to MFMP. No orders are sent to a supplier when the user exits the supplier’s punchout catalog site. Instead, the chosen Products are “brought back” to MFMP as line items in a purchase order. The user can then proceed through the normal workflow steps, which may include adding, deleting, and editing Products (i.e., line items) in the purchase order.

An order is not submitted to a supplier until the user approves and submits the purchase order, at which point the supplier receives an email with the order details.

The Contractor may supply electronic invoices in lieu of paper-based invoices for those transactions processed through MFMP. Electronic invoices may be submitted to the Customer through one of the mechanisms as listed below:

1) EDI (Electronic Data Interchange) This standard establishes the data contents of the Invoice Transaction Set (EDI 810) for use within the context of an Electronic Data Interchange (EDI) environment. This transaction set can be used for invoicing via the Business Network (formerly known as Ariba Network) for catalog and non-catalog goods and services.

2) PO Flip via BN This online process allows Contractors to submit invoices via the BN for catalog and non-catalog goods and services. Contractors are able to create an invoice directly from their inbox in their BN account by simply "flipping" the PO into an invoice. This option does not require any special software or technical capabilities.

The Contractor warrants and represents that it is authorized and empowered to and hereby grants the State and the third-party provider of MFMP, a State contractor, the right and license to use, reproduce, transmit, distribute, and publicly display within MFMP. In addition, the Contractor warrants and represents that it is authorized and empowered to and hereby grants the State and the third-party provider the right and license to reproduce and display within MFMP the Contractor's trademarks, system marks, logos, trade dress, or other branding designation that identifies the Products made available by the Contractor under the Term Contract.

3.11 Financial Consequences

Failure to comply with the requirements of the Term Contract will result in the imposition of financial consequences. The following financial consequences will apply for the Contractor’s failure to meet the performance metric standard and due date corresponding with the deliverables

Data Management Tools Page 9 of 9 under the Term Contract. The Customer may impose additional Financial Consequences beyond those stated herein to apply to that Customer’s purchase. The State of Florida reserves the right to withhold payment or implement other appropriate remedies, such as Term Contract termination, or nonrenewal, when the Contractor has failed to comply with the provisions of the Term Contract.

The financial consequences below will be paid and received by the Department of Management Services within 30 calendar days from the due date specified by the Department. These financial consequences below are individually assessed for failures over each target period beginning with the first full month or quarter of the Term Contract performance and every month or quarter, respectively, thereafter.

Financial Consequences Chart

No favorable action will be considered when Contractor has outstanding Term Contract Quarterly Sales Reports, MFMP Transaction Fee Reports, or any other documentation owed to the Department or Customer, to include fees / monies, that are required under this Term Contract.

Deliverable Performance Metric Performance Due Date

Financial Consequence for Non-Performance

Contractor will timely submit complete Term Contract Quarterly Sales Reports

All Term Contract Quarterly Sales Reports will be submitted timely with the required information

Completed reports are due on or before the 30th calendar day after the close of each State fiscal quarter

$250 per day late

Contractor will timely submit complete MFMP Transaction Fee Reports

All MFMP Transaction Fee Reports will be submitted timely with the required information

Completed reports are due on or before the 15th calendar day after the close of each month

$100 per day late