Attachment F - Penalties.docx

Penalties may be assessed for failure to comply with Contract Requirements.

Attachment F: Penalties

Document at a high level new change control items within two (2) business days from the date that the Change Control items are identified.

Provide a full impact assessment within ten (10) business days from the date that the Change Order is logged.

DMS may reduce invoiced compensation up to five hundred dollars ($500) for each time the Vendor fails to comply with this requirement.

The Vendor should make such payment to DMS within seven (7) calendar days of the expiration of the one hundred and eighty (180) calendar-day timeframe. In addition, DMS may assess up to ten thousand dollars ($10,000) for each instance if item identified as incomplete or not met.

All deliverables should be in a format approved by DMS and meet DMS’ content and accuracy requirements.

These requirements should be further defined and tied to media, format, content, and accuracy specifications outlined in the DEDs.

Manage the deliverable review process utilizing the 10-5-5 Review Cycle.

If the Vendor deviates without seeking DMS approval, a penalty should be assessed.

DMS may assess one hundred dollars ($500) for each business day, or any part thereof, that a deliverable is late, which includes providing less than the required copies or delivery on incorrect media. DMS may assess an additional one hundred dollars ($500) for each business day, or any part thereof, that a deliverable continues to not meet minimum content requirements or the approved format after its formal rejection by DMS, when appropriate.

Any changes that occur to the operational system should be documented according to specifications approved by DMS.

Documentation of any such changes should be provided to DMS based on the project schedule.

DMS may reduce compensation up to five hundred dollars ($500) for each business day, or any part thereof, beginning the next business day after the documentation due date the required documentation has not been provided to DMS. DMS may reduce compensation up to five hundred dollars ($500) for each business day, or any part thereof, during which the documentation is unacceptable as to format, accuracy, and completeness based on DMS review.

Reduction in compensation should be imposed until the Vendor provides DMS with acceptable documentation.

DMS may assess up to five thousand dollars ($5,000) if item identified as incomplete or not met.

Accomplishment of certain specified activities by the key milestone dates, as defined in the work plan, should be necessary to ensure project(s) are on track.

DMS may reduce compensation up to two thousand dollars ($2,000) per business day, or any part thereof, for each of the first ten (10) business days of delay in meeting a milestone date.

DMS may reduce compensation up to five thousand dollars ($5,000) per business day, or any part thereof, for each of the next twenty (20) business days of delay in meeting a milestone date.

DMS may reduce compensation up to seven thousand dollars ($7,000) per business day, or any part thereof, for each additional calendar day of delay in meeting a milestone after thirty (30) business days.

Approval of a Contract or Project Work Plan modification does not waive DMS's ability to impose damages and/or reductions in compensation if warranted by other terms of the Contract.

The reductions in compensation as listed in this RFP should be in addition to any amounts assessed for delays in meeting the operational start date.

DMS may assess up to an additional one thousand dollars ($1,000) in reduction in compensation per calendar day after the initial thirty (30) calendar days allowed for Vendor to find an acceptable replacement for the key or lead personnel and an acceptable replacement has not been provided.

If the Vendor fails to maintain ninety percent (90%) of the mutually agreed to Project Staffing Plan for a period exceeding thirty (30) contiguous calendar days, DMS may assess up to an additional one thousand dollars ($1,000) in reduction in compensation per calendar day after the initial thirty (30) calendar days allowed for Vendor to find an acceptable replacement to maintain the ninety percent (90%) staffing level.

Not commit or permit any act that interferes with the performance of work by any other Vendor or by DMS employees. If the Vendor fails to demonstrate effective collaboration, DMS may assess the situation and take appropriate actions.

DMS may provide formal, written notice with details for correction, including action(s) to be taken. If action(s) are not taken within five (5) business days, DMS may reduce invoiced compensation up to one thousand dollars ($1,000) per business day. If action(s) are not resolved in thirty (30) business days, then DMS may reduce compensation up to two thousand dollars ($2,000) per each business day.

Continuously monitor the entire solution uptime and report all unapproved outages to authorized Commonwealth staff, including DMS Information Security immediately after the outage. Ensure DMS is notified of the incidents per the category defined below.

Ensure the mode of notification and elapsed time between issue and notification is decided during JAD. Severity of issues that trigger a notification.

1. Critical: Total system failure or a major component not working and has critical impact to business.

2. High: Associate function not working with no work-around available. Moderate to severe impact to business functions.

3. Moderate: System/functional error that can be bypassed. System/functional errors that occur outside normal routine.

4. Low: Low to moderate impact to business function. Possible design problem questions. Low impact to business function/workaround exists.

DMS may reduce compensation up to five thousand dollars ($5,000) for every percentage point below ninety-nine percent (99%) for each month in which Commonwealth does not have online access available as required in the contract.

In addition, DMS may assess up to five thousand dollars ($5,000) per calendar day if item identified as incomplete or not met.

1. Critical: Total system failure; major component is not working; mission critical impact to business function.

2. High: Associated function not working with no workaround available; moderate to severe impact to business function.

3. Medium: System/functional error that can be bypassed; system/functional errors that occur outside normal routine.

4. Low: Low-to-moderate impact to business function; possible design problem; low impact to business function/workaround exists.

DMS may reduce invoiced compensation as follows:

1. Critical: Two thousand dollars ($2000) for each incident when response time is greater than one (1) clock hour.

2. High: One thousand dollars ($1000) for each incident in which response time is greater than four (4) clock hours.

3. Medium: Two hundred dollars ($200) for each incident in which response time is greater than twenty-four (24) clock hours.

4. Low: Fifty dollars ($50) for each incident in which the response time is greater than seventy-two (72) clock hours.

DMS defines a Security Incident and a Data Breach as the following: Security Incident - Any event that violates DMS security policies and procedures. Security Breach - A security incident that affects data confidentiality, integrity, or availability, which requires the notification of affected individuals, regulatory agencies, and other affected parties.

Provide comprehensive reports documenting the results of all security testing activities on a timely basis as mutually agreed upon.

Meet exit criteria for each phase of testing as mutually agreed upon by the Vendor and DMS.

Failure of the Vendor to notify DMS of a suspected data breach within the specified timeframe may result in a penalty of five thousand dollars ($5,000). DMS may reduce invoiced compensation up to five thousand dollars ($5,000) per event (multiple occurrences during a single event) in which the Vendor’s solution fails to meet a security requirement, control, or service. DMS may also pursue consequential or liquidated damages.

Comply with this requirement of a third-party security assessment to be completed within the first quarter of every calendar year.

DMS may reduce invoiced compensation up to five thousand dollars ($5,000) per calendar month after the first quarter, until this requirement is met.

Continuously monitor the entire solution response time and report all Contract failures to authorized DMS staff.

DMS may reduce compensation up to one thousand dollars ($1,000) per calendar day for any online transactions that has a documented response time greater than three (3) seconds.

If the Vendor finds a Severity 1 defect, maintenance issue, or data problem, should notify DMS within one business (1) hour. (A data problem does not include a data breach.).

If the Vendor finds a Severity 2 defect, maintenance issue, or data problem, should notify DMS within four (4) business hours.

Notify DMS of all other defects, maintenance issues, or data problems within one (1) calendar day.

Perform all research, coding, and testing required to resolve the issue, defect, or data problem.

DMS may reduce invoiced compensation up to one thousand dollars ($1,000) for each time the Vendor fails to comply with this requirement.

If, for any reason, the Vendor is delayed in meeting these key milestone dates and a Contract Modification to the Turnover Plan is not approved, a reduction in compensation may be assessed. Approval of a Contract or Turnover Plan modification does not waive DMS's ability to impose damages and/or reductions in compensation if warranted by other terms of the Contract. The reductions in compensation should be in addition to any amounts assessed for delays in meeting the operational start date.

DMS may reduce compensation up to ten thousand dollars ($10,000) per calendar day, or any part thereof, for each of the first ten (10) calendar days of delay in meeting a milestone date.

DMS may reduce compensation up to twenty thousand dollars ($20,000) per calendar day, or any part thereof, each of the next twenty (20) calendar days of delay in meeting a milestone date. DMS may reduce compensation up to thirty thousand dollars ($30,000) per calendar day, or any part thereof, for each additional calendar day of delay in meeting a milestone after thirty (30) calendar days.