ATTACHMENT L - Penalties - RFP 758 2500000171 Kentucky Analytics Platform Solution (KAPS).pdf

Attachment L –Penalties - RFP 758 2500000171 Kentucky Analytics Platform Solution (KAPS)

KENTUCKY ANALYTICS PLATFORM SOLUTION (KAPS)

Penalties

The penalties below will be negotiated with the highest-ranking vendor regarding the amount or applicability of individual penalties. Bidding vendors shall note any Penalty Requirements as an exception in the response if the vendor wishes to alter any of the requirements in this attachment. The revised penalties will be incorporated into the contract document.

Penalty # Requirement Contract Requirement Penalty/Reduction

P-01 Operational Start Date

Attachment J Minimum Contract Deliverables, Project Work Plan

Compliance with the contractual operational start date is critical to CHFS’ interest.

The Vendor should be liable for all costs incurred by CHFS to continue the current interim solution and operations past the contractual start date.

P-02

Key Milestones Dates

Attachment J Minimum Contract Deliverables

Accomplishment of certain specified activities by the key milestone dates, as defined in the work plan, is necessary to ensure the project is on track. If for any reason the Vendor is delayed in meeting key milestone dates, contract modification, or a change request for a work plan, a change request should be submitted to the Cabinet for Health and Family Services (CHFS).

Approval of a Contract modification or work plan change does not waive CHFS’ ability to impose damages and/or reductions in invoiced compensation if warranted by other terms of the contract.

CHFS may reduce invoiced compensation up to five percent (5%) of the milestone payment amount per calendar day, or any part thereof, for each of the first ten

(10) calendar days of delay in meeting a milestone date or contributing to a delay for another Vendor’s performance.

CHFS may also reduce invoiced compensation up to an additional five percent (5%) of the milestone payment amount for each of the next ten (10) calendar days of delay in meeting a milestone date or contributing to a delay for another Vendor’s performance.

CHFS may reduce invoiced compensation up to an additional five percent (5%) of the milestone payment amount for any delay in the “Go Live” date. For each additional ten (10) calendar days of delay, CHFS may reduce invoiced compensation by up to an additional five percent (5%) of the milestone payment amount each.

P-03 Contract Management – Billing/Invoicing

Attachment A:

Section 3.7.1 Payment Requirements

Provide CHFS, or its designee, each month with an accurate reconciliation of billed charges to expenses incurred for approval.

CHFS may reduce invoiced compensation up to five hundred dollars ($500) for each calendar day, or any part thereof (beginning the next calendar day), after the inaccurate reconciliation of billed charges to expenses incurred has been provided.

P-04 Solution Access

Attachment H Solution Matrix, Attachment I Technical Matrix, and

Attachment A:

Section 3.1.1.7 Help Desk Support

Ensure access to all screens, systems, and data, including all Web-enabled capabilities, Monday-Friday, 7:30 a.m.- 6:00 p.m. Eastern Time (ET), except for CHFS-approved scheduled and emergency outages. Continuously monitor the entire solution uptime and provide a monthly report, and report all unapproved outages to authorized CHFS staff, including CHFS Information Security, immediately after the outage.

Ensure CHFS is notified of the incidents per the category defined below. Ensure the mode of notification and elapsed time between the issue and notification is decided.

The severity of issues that will trigger a notification.

a. Critical: Total system failure or a major component not working and has a critical impact on business.

b. High: Associate function not working with no workaround available. Moderate to severe impact on business functions.

c. Moderate: System/functional error that can be bypassed.

System/functional errors that occur outside the normal routine.

CHFS may reduce invoiced compensation up to three thousand dollars ($3,000) for every percentage point below ninety-nine point nine percent (99.9%) for each month that CHFS does not have online access available as required in the Contract.

d. Low: Low to moderate impact on business function.

Possible design problem questions. Low impact to business function/workaround exists.

P-05 Technical Support

Attachment A:

Section 3.1.1.7 Help Desk Support

Section 3.1.1.8 System, Tool, Report Problems

Establish and maintain a technical support team that is available per the requirements of this RFP.

If the Vendor finds a Severity 1 defect, maintenance issue, or data problem, notify CHFS within one business (1) hour.

(A data problem does not include a data breach.)

If the Vendor finds a Severity 2 defect, maintenance issue, or data problem, notify CHFS within four (4) business hours.

Notify CHFS of all other defects, maintenance issues, or data problems within one (1) calendar day.

Responsible for all research, coding, and testing required to resolve the issue, defect, or data problem.

CHFS may reduce invoiced compensation up to one thousand dollars ($1,000) for each time the Vendor fails to comply with this Service Level Agreement (SLA).

P-06 Deliverables

Each deliverable, as defined in the approved Project Work Plan, should be delivered to CHFS, in final form, in the number specified and, on the date, specified in the approved Project Work Plan.

Manage the deliverable review process utilizing the 10-5-5 Review Cycle (definition below). If the Vendor deviates without seeking CHFS approval, a penalty may be assessed.

(Definition of 10-5-5 Review Cycle: Once the deliverable is submitted, CHFS and the Vendor review the deliverable according to the time established in the Project Work Plan [schedule], generally ten [10] business days for all deliverables. CHFS provides either a written approval of the deliverable or a written statement that identifies the deficiencies preventing approval once the deliverable has been submitted. The Vendor has five [5] business days from the date it receives the notice of deficiencies to

CHFS may reduce invoiced compensation up to five hundred dollars ($500) for each calendar day, or any part thereof, that a deliverable is late, that includes providing fewer than the required copies or delivery on incorrect media.

CHFS may reduce invoiced compensation up to an additional five hundred dollars ($500) for each calendar day, or any part thereof, that a deliverable continues to not meet minimum content requirements or the approved format after its formal rejection by CHFS, when appropriate.

complete the corrective action. CHFS reviews the corrected deliverable and notifies the Vendor in writing of acceptance or rejection within five [5] business days.)

P-07 Documentation

Attachment A:

Section 3.3.2 Project Management Plan and

Responsible for providing CHFS with complete, accurate, and timely documentation of all modifications made after the Project Management Plan is approved by CHFS. Such documentation is defined through the Deliverable Expectation Document (DED) process, in accordance with specifications approved by CHFS and delivered according to the project schedule.

Document any changes that occur according to specifications approved by CHFS. Documentation of any such changes should be provided to CHFS based on the project schedule.

CHFS may reduce invoiced compensation up to five hundred dollars ($500) for each calendar day, or any part thereof (beginning the next calendar day), after the documentation due date and the required documentation has not been provided by the Vendor to

CHFS.

CHFS may reduce invoiced compensation up to five hundred dollars ($500) for each calendar day, or any part thereof, during which the Vendor’s documentation is unacceptable as to format accuracy, and completeness based on CHFS review. Reduction in invoiced compensation will be imposed until the Vendor provides CHFS with acceptable documentation.

P-08 Change Control

Attachment A:

Section 3.3.1.A Change Control Management

As specified in this RFP, perform systems maintenance and modifications for all parts of the solution within the mutually agreed-upon times, as required by CHFS.

Document at a high-level new change control items within two (2) business days from the date that the Change Control items are identified.

Provide a full impact assessment within ten (10) calendar days from the date that the Change Order is logged.

CHFS may reduce invoiced compensation up to five hundred dollars ($500) for each time the Vendor fails to comply with this

SLA.

P-09 Data Refresh – Reporting/Dashboards

Attachment A:

Ensure that all data is refreshed on the user interface in real-time upon data import completion. In the case where real-time data refreshes are not feasible, the Vendor should submit a batch design, or near real-time user interface

CHFS may reduce invoiced compensation up to one thousand dollars ($1,000) for each time the Vendor fails to correctly refresh

Section 3.1. A – Data Sources and

Section 3.1.C – Data Marts refresh, for approval by CHFS, and propose SLAs for this requirement.

reports, dashboards, and other distributions after data updates.

P-10 Data Refresh – ETL/ELT

Attachment A:

Section 3.1.A – Data Sources

Ensure that all data loads from source data should be completed in the agreed-to and documented frequency.

CHFS may reduce invoiced compensation up to one thousand dollars ($1,000) for each time the Vendor fails to timely load source data according to the schedule.

P-11 Data Refresh – Data Marts

Attachment A:

Section 3.1.A – Data Sources and

Section 3.1.C – Data Marts

Ensure that all data refreshes in data marts should be in real-time upon data import completion. In the case where real-time data refresh is not feasible, the Vendor should submit a batch design, or near real-time data mart refreshes for approval by CHFS and propose SLAs for this requirement.

CHFS may reduce invoiced compensation up to one thousand dollars ($1,000) for each time the Vendor fails to correctly refresh data marts after data.

P-12 Delay or Interruption of Operations

Attachment H Solution Matrix

Attachment J Minimum Contract Deliverables

Delays or interruptions in the operations and related services caused by any failure, act, or omission of the Vendor constitutes a material breach. Regardless of whether or not CHFS elects to terminate this Contract upon such a breach, CHFS is entitled to recoup:

a. The difference between the cost to CHFS under this contract and the cost to it under any interim or substitute Contract or other methods of operation.

b. The liability of CHFS to any third party arising directly or consequentially out of the Vendor’s breach and cancellation of this Contract.

c. The cost to CHFS of all actions taken by it to locate and secure a substitute or interim Vendor or method of operation.

The Vendor should be liable for all costs incurred by CHFS to continue the current solution and operations.

P-13 Lack of Collaboration

Attachment H Solution Matrix

Commit to full cooperation with all other CHFS Vendors, and employees. Not commit or permit any act that interferes with the performance of work by any other Vendor or by CHFS employees. If the Vendor fails to

CHFS may provide formal, written notice with details for correction, including action(s) to be taken. If action(s) are not taken within five demonstrate effective collaboration, CHFS may take appropriate actions.

(5) calendar days, CHFS may reduce invoiced compensation up to one thousand dollars ($1,000) per calendar day.

P-14 System Compliance

Attachment A:

Section 5.1 Procurement Requirements and

Attachment R KOG Integration and

Attachment H Solution Matrix

Attachment I Technical Matrix

Comply with all statutes, laws, regulations, policies and rules under System Compliance throughout the life of the project.

CHFS may reduce invoiced compensation up to one thousand dollars ($1,000) per calendar day for each requirement not met.

P-15 Privacy and Confidentiality

Attachment A:

Section 3.1.1.2 Security and

Section 3.4.2 Vendor Responsibilities and

Section 6.8 Proposed Solution Content

Meet all CHFS and Commonwealth privacy and confidentiality requirements within the Vendor’s operation.

CHFS may pursue consequential or liquidated damages for each violation as deemed necessary and appropriate.

Attachment P Business Associate Agreement and

Attachment S Security Requirements for Vendor Cloud Hosted Systems

P-16 Security

Section 3.1.1.2 Security and

Attachment G Security Requirements for

Create and maintain security controls and services listed in this RFP at all times.

Upon discovering a suspected data breach, the Vendor should notify CHFS within the time specified in Section 3.1.1.2, Security. Failure to notify CHFS within the specified time may result in a penalty.

Be responsible for security-related scans and testing and ensuring all guidelines/standards/ requirements are met.

Provide comprehensive reports documenting the results of all security testing activities on a timely basis as mutually agreed upon.

Failure of the Vendor to notify CHFS of a suspected data breach within the specified time may result in a penalty of five thousand dollars ($5,000).

CHFS may reduce invoiced compensation up to five thousand dollars ($5,000) per event (multiple occurrences during a single event) in which the Vendor’s solution fails to meet a security requirement, control, or service. CHFS may also pursue consequential or liquidated damages.

P-17 Security Testing/Assessment

Attachment A:

Section 3.1.1.2 Security and

Section 3.1.1.3 Security Review and

Responsible for conducting application testing as defined in the RFP, including security-related scans and testing, and ensuring all guidelines/standards/ requirements are met.

Provide comprehensive, full, unredacted, and unfiltered assessments and reports documenting the results of all testing activities on a timely basis as mutually agreed upon to align with the latest compliance and security needs.

Perform Security Testing as defined in a modern and well-documented Development Security Operations

CHFS may reduce invoiced compensation up to five thousand dollars ($5,000) per calendar month after the first quarter until this requirement is met.

CHFS may reduce invoiced compensation up to five thousand dollars ($5,000) per event (multiple occurrences during a single event) in which the Vendor’s solution fails to meet a security requirement, control, or service. CHFS may also

Attachment J Minimum Contract Deliverables, Test Management Plan – Internal Security Testing and

Attachment S Security Requirements for

(DevSecOps) plan to be reviewed by CHFS OATS Information Security staff.

Meet with CHFS OATS Information Security monthly to discuss the latest Static Application Security Testing report, Dynamic Application Security Testing report, and the internal Penetration Testing report conducted on the most current version of the application/system.

Perform Vulnerability Scans at least once a month, Penetration Tests quarterly, and major functional changes.

Provide comprehensive, full, unredacted, and unfiltered Third-Party assessments as required in the contract and as per the agreed-upon schedule.

Provide Static Code Analysis reports, detailing vulnerabilities discovered within source code.

Meet exit criteria for each phase of testing as mutually agreed upon by the Vendor and CHFS.

pursue consequential or liquidated damages.

P-18 Disaster Recovery

Attachment A Section 3.3.2 F.

Attachment J Minimum Contract Deliverables, Disaster Recovery (DR) and Business Continuity Plan (BC)

Create and maintain a Business Continuity Plan and Disaster Recovery Plan (BC/DR) throughout the life of the Contract. The BC/DR should detail each aspect as it relates to both Vendor and CHFS responsibilities to support CHFS plans and processes and satisfy all requirements.

Complete initial and annual testing of the plan.

Failure to update the Disaster Recovery Plan (DRP), Business Continuity Plan (BCP) at a minimum annually, may result in penalties from the deliverables section.

CHFS may reduce invoiced compensation up to two thousand dollars ($2,000) per calendar day, or any part thereof, for each calendar day after a declared disaster in which the Vendor’s solution fails to recover within four

(4) hours of the disaster event.

CHFS may also pursue consequential or liquidated damages.

CHFS may reduce invoiced compensation up to one thousand dollars ($1,000) per calendar day, or any part thereof, for each calendar day of delay in conducting a DR Test.

CHFS may assess up to five thousand dollars ($5,000) for each failed test.

P-19 Training

Section 3.1.1.4 Training

Ensure all Training activities are planned no later than thirty

(30) calendar days before the training.

CHFS approves all trainings (e.g., date, time, audience, agenda, and materials) thirty (30) calendar days before the scheduled training.

Ensure training evaluations are conducted for each session and the results are shared with CHFS within five (5) business days of the training event.

CHFS may reduce invoiced compensation up to five hundred dollars ($500) for each business day after the Vendor fails to comply with this SLA.

P-20 Project Staff

Section 3.2 Project Staffing

Personnel commitments contained in the Vendor's proposal for all phases of the Contract should not be changed without a thirty (30) calendar-day advance notice and prior written approval of the CHFS Contract Administrator, unless due to the death, disability, resignation, termination, or military recall of any project individual. Staffing includes the staff proposed for all positions required within this RFP at the levels of effort proposed or as specified in the contract.

CHFS may reduce invoiced compensation up to ten thousand dollars ($10,000) in a reduction in invoiced compensation for each personnel proposed in the Vendor’s response to the RFP who is changed for reasons other than death, disability, resignation, termination, or military recall.

CHFS may reduce invoiced compensation up to an additional one thousand dollars ($1,000) per calendar day after the initial thirty

(30) calendar days allowed for Vendor to find an acceptable replacement for each project personnel and an acceptable replacement has not been provided.

P-21 Help Desk Support Help desk operations and support procedures for the Solution should be developed and documented.

CHFS may reduce invoiced compensation up to five hundred dollars ($500) for each calendar day

Section 3.1.1.6 Operational Support and

Section 3.1.1.7 Help Desk Support

A help desk for submission of system defect requests by CHFS staff, providing ad hoc assistance on system functionality, notifications of system downtime, and other related support activities should be maintained.

Provide CHFS with available support Monday through Friday, 7:30 a.m. to 6:00 p.m. Eastern Time (ET) with the exception of Commonwealth holidays.

the Vendor fails to comply with this

SLA.

P-22 Turnover Phase

Attachment J Minimum Contract Deliverables, Implementation Plan/Turnover Plan

Provide full support for system turnover at the conclusion of the Contract period according to the CHFS-approved Turnover Plan.

If, for any reason, the Vendor is delayed in meeting these key milestone dates, a reduction in invoiced compensation may be assessed.

The reductions in invoiced compensation below may be in addition to any amounts assessed for delays in meeting the operational start date.

CHFS may reduce invoiced compensation up to five thousand dollars ($5,000) per calendar day, or any part thereof, for each of the first ten (10) calendar days of delay in meeting a milestone date.

CHFS may reduce invoiced compensation up to ten thousand dollars ($10,000) per calendar day, or any part thereof, each of the next twenty (20) calendar days of delay in meeting a milestone date.

CHFS may reduce invoiced compensation up to thirty thousand dollars ($30,000) per calendar day, or any part thereof, for each additional calendar day of delay in meeting a milestone after thirty (30) calendar days.

P-23 Performance Report Card (Operations Reporting)

Produce within fifteen (15) calendar days of the end of the previous month, a Monthly Operations Performance Report Card. Due to the changing data and refreshes, report card performance standard Contract requirements and Vendor-

CHFS may reduce invoiced compensation up to five hundred dollars ($500) per calendar day, starting on calendar day eleven (11) https://personnel.ky.gov/Pages/Holidays-and-Leave.aspx

Section 3.7.2 Retainage and Service Level Agreements supplied Measurements should be re-evaluated quarterly for appropriateness. Any additions to the report card should be finalized through joint negotiation between CHFS and the Vendor.

through calendar day twenty (20), or any part thereof, that the Report Card has not been supplied to the Commonwealth.

CHFS may reduce invoiced compensation up to one thousand dollars ($1,000) per calendar day, or any part thereof, for each additional calendar day of delay after the first twenty (20) calendar days, and continuing thereafter, that the Report Card has not been supplied to the Commonwealth.

P-24 DDI - Test Results Exit Quality

Attachment H: Solution Matrix

Testing Requirements and

Attachment J Minimum Contract Deliverables, Test Management Plan

The Test Results Exit Quality Rate should be determined using the results executed testing cases, including functionality, performance, integration/interfaces, operational suitability, and other test coverage items comprising a thorough vendor-implemented testing effort for the implementation release.

Test Results Exit Quality Rate means the inventory of all test cases performed as part of the Vendor’s and Commonwealth’s Testing efforts, presentation of resultant test performance inclusive of identified errors or issues (by priority), impact areas, and overall testing results to CHFS otherwise referred to as “Testing Results.”

This SLA should be calculated as follows: “Test Results Exit Quality Rate” equals “Total Test Cases Passing Vendor and Commonwealth Testing Efforts” divided by “Total Test Cases Executed during implementation release testing.”

CHFS may reduce invoiced compensation up to five hundred dollars ($500) for each business day after the Vendor fails this SLA causing a Project Work Plan delay.

P-25 Plan of Action and Milestones (POAM) Remediation Service

Attachment A:

Section 3.1.1.2.F POAM Strategy

The vendor should follow CMS guidance for POAM documentation. The vendor should complete the exercise prescribed by CMS for every newly identified POAM item during the term of the contract within the vendor’s responsibility.

CHFS may reduce invoiced compensation up to five hundred dollars ($500) per calendar day, starting on calendar day eleven (11) through calendar day twenty (20), or any part thereof, that the POAM remains incomplete per its deadline.

CHFS may reduce invoiced compensation up to one thousand dollars ($1,000) per calendar day, or any part thereof, for each additional calendar day of delay after the first twenty (20) calendar days, and continuing thereafter, that the POAM remains incomplete per its deadline.

P-26 System Performance Incident Notification

Attachment A:

Section 3.1.1.8 System, Tool, Report Problems

The Vendor should comply with the incident notification requirements in this RFP.

Failure of the Vendor to notify CHFS of a system performance incident within the specified time may result in a penalty of one thousand dollars ($1,000) for each instance.

P-27 Root Cause Analysis

Attachment A:

Section 3.1.1.8 System, Tool, Report Problems

The vendor should provide a root cause analysis as required in this RFP.

Failure of the vendor to complete a Root Cause Analysis for each System Performance Issue results in a $1,000 for each instance.