CDCR_RFQ_C5612566_Addendum_1-_SailPoint_Identity_Expert.pdf

STATE OF CALIFORNIA —DEPARTMENT OF CORRECTIONS AND REHABILITATION GAVIN NEWSOM, GOVERNOR

ENTERPRISE INFORMATION SERVICES

Office of the Chief Information Officer (OCIO) Information Technology Acquisitions Unit 1900 Birkmont Drive, Rancho Cordova, CA 95742

THE STATE OF CALIFORNIA

DEPARTMENT OF CORRECTIONS AND REHABILITATION

INFORMATION TECHNOLOGY SERVICES REQUEST FOR QUOTE

RFQ #C5612566- Addendum 1

The California Department of Corrections and Rehabilitation (CDCR) is requesting quotes to assist the Enterprise Information Services (EIS) with the goal to provide SailPoint Identity Expert Services for the California Department of Corrections and Rehabilitation (CDCR), Infrastructure Services Unit. Quotes must comply with the instructions found herein. Failure to comply with any of the requirements may cause the quote to be rejected, and deemed non-responsive. Refer to Exhibit A, Statement of Work (SOW), for the required services related to this solicitation.

By submitting a quote, the bidder agrees to the terms and conditions stated in this RFQ and in accordance with the requirements contained within.an authorized Key Action Dates and Times may be adjusted by the State of California (State) as conditions warrant.

The period of performance for this agreement shall be from December 23, 2024, or upon CDCR approval, whichever is later, through December 31, 2027. Funding is subject to approval of the project funding requests. If it is determined to be in the best interest of the CDCR, the resulting Agreement may be amended to lengthen the term and/or increase the funding consistent with the original Scope of Services.

This original Agreement may not exceed $195,000.00 $300,000.00.

This RFQ does not constitute a commitment by the CDCR to award an Agreement. The CDCR reserves the right to reject any or all quotes received, if the CDCR determines that it is in the CDCR’s best interest. The CDCR restricts the responding firms replying to this solicitation to be headquartered, and doing business within the United States only. No foreign or International firms are allowed to respond to this solicitation.

Quotes for this IT services agreement are due to Enterprise Information Services (EIS) by the date and time listed in the Key Action Dates listed in the RFO, Section B.1. Bidders shall e-mail (1) copy of their response to the address listed below.

STATE OF CALIFORNIA —DEPARTMENT OF CORRECTIONS AND REHABILITATION GAVIN NEWSOM, GOVERNOR

ENTERPRISE INFORMATION SERVICES

Office of the Chief Information Officer (OCIO) Information Technology Acquisitions Unit 1900 Birkmont Drive, Rancho Cordova, CA 95742

Department Contact:

California Department of Corrections and Rehabilitation

EIS - IT Acquisitions Unit Attention: Faith de Leon

1960 Birkmont Drive, Rancho Cordova, CA 95742

Email: faith.deleon@cdcr.ca.gov

SailPoint Identity Expert Services C5612566 Addendum 1

A. GENERAL INFORMATION

Definitions:

Contractor- A Contractor/Contractor staff is considered to be a staff augmentation that does not offer any consultation services as it relates to the consultation of further purchasing of goods/software or services under any services Contract. A Contractor who does not advise on the procurement or contracting of further services under a services Contract is also not required to submit a Form 700, Statement of Economic Interests. In addition, a Contractor is also called the owner of a company or firm, (services or consulting) and their staff are considered Contractor staff if they do not advise on further procurement or contracting.

Consultant- A Consultant is considered to be that of an advisory nature, and can offer its consulting services which can advise and suggest through the consultation process of the further purchasing of goods/software or services under any services Contract.

A Consultant who does advise on the procurement or contracting of further services under a services Contract will be required to submit a Form 700, Statement of Economic Interests.

This Request for Offer (RFQ) contains the requirements that interested Contractors (hereinafter also referred to as “bidder”) must meet in order to submit a responsive bid. It provides information regarding the format in which bids must be submitted, the material to be included, the requirements that must be met to be eligible for consideration, and the Contractors responsibilities.

Bids submitted in response to this RFQ must contain all data/information requested and must conform to the format prescribed. It is the Contractors responsibility to provide all required data and other information deemed necessary for the CDCR’s Evaluation Team to determine and verify the Contractors ability to perform the tasks and activities defined in Exhibit A, SOW. Bids may be disqualified if they fail to respond completely to RFQ requirements and subsequent Addenda. Only one (1) Contractor will be awarded the resulting Agreement.

1. Key Action Dates

Contractors are advised of the dates and times shown below and are expected to adhere to them. The CDCR may modify any part of the RFQ, prior to the date bids are due, by issuance of one (1) or more Addendum. Addendums will be numbered consecutively and posted to Cal eprocure alongside the original RFQ advertisement. Interested bidders may submit questions and/or requests for clarification, via e-mail on or before the date and time listed in the table below, to:

Faith.Deleon@cdcr.ca.gov and Maleka.Quettewala@cdcr.ca.gov The CDCR’s responses to bidder questions that provide new or additional information will be provided to all bidders via an Addendum, and sent to all potential bidders.

Event Date Time

RFQ Release date 11/26/2024 2:00 PM RFQ Questions Due 12/3/2024 12/5/2024 2:00 PM RFQ Response to Questions 12/6/2024 12/10/2024 4:00 PM RFQ Solicitation Due Date 12/12/2024 2:00 PM RFQ Evaluations* 12/12/2024 – 12/13/2024 Intent to Award (5-Day Period)* 12/13/2024 Award of Agreement (Proposed)* 12/20/2024 Proposed Agreement Start Date* 12/23/2024

*Dates subject to change

The CDCR will not consider bids submitted by fax. The CDCR reserves the right to reject all bids and reissue this RFQ.

2. Period of Performance

The period of performance for this Agreement shall be from December 23, 2024, or upon final execution of this Agreement by the CDCR, whichever is later, through December 31, 2027 with one (1) optional one (1) year extension, consistent with the original Scope of Services and at the contracted hourly rate as referenced in Exhibit B-1, Rate Sheet, and the dollar amount of the first year amendment shall not exceed the first full fiscal year funds encumbered.

a. The selected Contractor shall not be authorized to start work under this

Agreement until notified by the CDCR. If the Contractor starts performance before final approval (execution) of the Agreement, it shall be considered voluntary on the part of the Contractor and non-compensable by the CDCR.

b. Any and all Amendments must be in writing and signed by both parties prior to commencement of additional work.

3. Admonishment Regarding Follow-On Contracts

Per Public Contract Code (PCC) 10365.5, no person, Contractor or subsidiary thereof, who has been awarded a consulting services contract, or a contract which includes a consulting component, may be awarded a contract for the provision of services, delivery of goods or supplies, or any other related action which is required, suggested, or otherwise deemed appropriate as an end product of the consulting services contract. Therefore, any Contractor who contracts with the CDCR to develop and provide formal recommendations for the acquisition of IT products or services is precluded from contracting for any work recommended in the formal recommendation.

4. Written Questions

a. All questions regarding the content of this RFQ must be submitted via email.

The CDCR shall be notified immediately if clarification is needed. Consultants (or Contractors, whichever is applicable) that fail to report a known or suspected problem with the RFQ, or fail to seek clarification, shall submit an bid at their own risk. All questions must be received by the date and time listed in the Key Action Dates. Questions submitted via email after the deadline may be answered at the CDCR’s option. At its discretion, the CDCR may contact and inquire to seek clarification of any inquiry received.

b. When the CDCR has completed its assessment of the questions, all questions and answers will be posted to Cal eprocure alongside the original RFQ advertisement.

What to include in an inquiry:

a. Contractor’s firm name, individual’s name submitting the question or inquiry, e-mail address, and RFQ number.

b. A description of the subject, issue, or discrepancy found.

c. RFQ section, page number, and/or other information useful in identifying the specific problem or issue in question.

d. Remedy sought, if any.

5. Proprietary Information

Any documentation submitted which has been marked “Confidential” or “Proprietary” will not be accepted. All documents submitted in response to this RFQ are the property of the CDCR and are subject to review or release to the public under the California Public Records Act (PRA), GC 6250 et seq.

6. Cost for Developing Bids

Costs for developing bids are entirely the responsibility of the Contractor and shall not be chargeable to the CDCR.

7. Proposed Staff Availability

a. All Contractor shall actively participate in providing technical leadership, expertise, documentation, planning meetings, product demonstrations, and team retrospectives. This includes supporting the CDCR in business analysis to clarify its business needs.

b. The Contractor shall produce and deliver (as applicable) to the CDCR the following documentation:

1) Formal and informal meeting notes.

2) Fact-finding notes.

3) Working session notes.

4) Presentations.

5) General communication notes.

6) System requirement specifications, use cases, or user stories as directed.

7) Technical design documentation/as-built specifications as directed.

8. Method of Award

This evaluation will be based on RFQ. The CDCR will compare bids submitted in response to this RFQ based on lowest cost to the CDCR, which means the bid that best meets, and potentially exceeds, CDCR’s requirements at the lowest proposed hourly rate. If award of an Agreement is made, it will be made on an “All or None” basis in accordance with the RFQ assessment requirements to a responsible Contractor whose bid complies with all the requirements (administrative and technical), terms and conditions of the RFQ, and any Addenda thereto, except for such immaterial defects as may be waived by the State. The Contractor, including all proposed candidates and/or subcontractors, shall be headquartered and doing business within the United States only. No foreign or international firms, including all proposed candidates and/or subcontractors, shall be allowed to respond to this RFQ. In the event of a tiebreaker, the CDCR may use references to determine a winner.

B. RESPONSE FORMAT AND REQUIREMENTS

1. Format

a. Contractors must submit a bid in a format compatible with the CDCR’s standard software applications (i.e., Microsoft [MS] Office). Printed documents must be single-spaced, using a 12-point font. A smaller font may be used for tables.

The CDCR’s standard software applications include MS Windows XP Professional, MS Office Professional (including Outlook) 2010, Excel 2010, and Project 2010. Contractors are required to submit their response in one (1) complete PDF or Word doc. Multiple documents submitted will be rejected and deemed non-responsive.

b. The CDCR must receive one (1) copy via email of a bid no later than the date and time specified in the Key Action Dates. Bids not received by the date and time specified in the Key Action Dates may be rejected.

c. Any copy of the bid emailed must be clearly marked "RFQ C5612566.”

d. For any services, including Consulting services awarded by the CDCR, the maximum amount of Subcontracting shall not exceed 40%. If the amount of Subcontracting exceeds 40%, the responding Contractor must include a letter of explanation which clearly defines the need for further Subcontracting. Any of bid submission that is received by the CDCR that indicates more than 40% Subcontracting, as noted on the Bidder Declaration GSPD-05-105, and does not include a letter of explanation, will be deemed non-responsive by the CDCR Administrative Evaluation Team, and subsequently disqualified from further evaluation of this quote. In addition, the CDCR Evaluation Team will be the final determining body that approves any Subcontracting of more than 40% as indicated on the Bidder Declaration form GSPD-05-105, and that is also accompanied by the Contractors letter of explanation.

2. Requirements

This RFQ and the Contractor’s response will be made part of the CDCR Procurement documents and Contract file. Bids submitted in response to this RFQ must include the following information:

a. Signed/date Request for Quote - IT Goods/Services - Informal Competitive EIS

4004(C) (all pages)

b. The Contractor’s Small Business and/or Disabled Veteran’s Business

Enterprise (SB/DVBE) Certification, if applicable. The State will verify SB/DVBE certifications are valid at the time the responses are due. In accordance with GC Section 14837(d) and Military and Veterans Code Section 999, all SB and DVBE contractors, subcontractors, and suppliers that bid on or participate in a State contract, regardless of being an oral or written solicitation, must perform a Commercially Useful Function (CUF). See CUF Policy.

c. A copy of the Contractor’s valid California city or county business license (if applicable); or, if a corporation located within the State of California, incorporation documents or letter from the Secretary of State; or, if not a California business, an affidavit that the business is in good standing with the state, province, or country in which the business is headquartered.

d. The total number of years the Contractor has been in business performing services as described in Exhibit A, SOW.

e. A statement outlining the Contractor’s qualifications as listed in Exhibit A, SOW.

f. A detailed description of the Contractor’s approach for completing the activities and tasks identified in Exhibit A, SOW, including the functions, roles, and responsibilities of the proposed Candidate(s).

g. Resumes of each proposed Candidate Resumes must document years of experience in performing the services as described in Exhibit A, SOW.

Descriptions must include the company/project name and start and end dates that relate to the specific experience of the proposed Candidate(s).

Assessment will be based on the breadth, duration, and successful achievement of an individual. The referenced experience must be within the past 10 years and comparable with the needs of this project. References more than 10 years old will be accepted, but references will only be evaluated up to 10 years old.

h. At least three (3) client references for the Contractor and Contractor staff from prior Agreements similar in size and scope. Complete Attachment #2, Customer Reference Form for each reference to include a contact person, phone number, and e-mail address. Reference descriptions must include the department/project name that relates to the experience. The CDCR may contact referenced organizations when reviewing an bid to verify the information provided. A reference must be external to a Contractor’s organization and corporate structure.

i. Completed Rate Sheet Exhibit B-1. The rate sheet must be complete, including an authorized signature and price extension (if applicable).

(Note: Some attachments as noted below may not be applicable to this type of solicitation, therefore, they may not be included and the CDCR may not list all 13 required or optional Attachments.)

j. Completed Bidder Declaration Form (GSPD-05-105), Attachment #3.

All Contractors must complete GSPD-05-105 and include it with the bid response. When completing the declaration, Contractors must identify all subcontractors proposed for the Agreement. The Contractor awarded the resulting Agreement is contractually obligated to use the subcontractors for the corresponding work identified, unless the CDCR agrees to a substitution incorporated by an amendment to the Agreement.

k. Completed Payee Data Record (STD 204) and Supplemental Payee Data

Record (STD 205), Attachment #4.

l. Completed Disabled Veteran Business Enterprise Declaration (STD. 843), Attachment #7, if applicable.

m. Completed California Civil Rights Laws Certification, Attachment #10

n. Completed TACPA Preference Request Form (STD. 830), Attachment #11, if applicable.

o. Completed and signed STD 1000 form Generative Artificial Intelligence

(GenAI) which is in compliance with Executive Order N-23-23

3. Other Requirements

The Contractors and/or Candidates shall be required to complete the following prior to award. Do not submit the following with a bid response.

a. Confidentiality Statement and Non-Disclosure Agreement Attachment #6.

b. A copy of a Liability Insurance Certificate.

The Contractor must furnish to the CDCR a certificate of insurance stating that there is liability insurance presently in effect for the Contractor of not less than $1,000,000 per occurrence and $2,000,000 aggregate for bodily injury and property damage liability. The certification of insurance must include the following provisions:

1) The insurer will not cancel the insured’s coverage without thirty (30) calendar days’ prior written notice to the CDCR.

2) The State of California/CDCR is included as additional insured.

c. Proof of Workers Compensation Insurance.

The Contractor shall furnish to the CDCR a certificate of insurance stating that there is Workers’ Compensation insurance on all employees engaged in the performance of this contract. The certificate of insurance must include the provision that the insurer will not cancel the insured’s coverage without thirty

(30) calendar days’ prior written notice to the CDCR.

d. Additional Insurance Requirements (if applicable)

Refer to Exhibit D – CDCR Special Provisions.

C. ASSESSMENT AND SELECTION PROCESS

1. All bids will be reviewed for being Responsive and Responsible (R&R) as defined in the State Contracting Manual, Volume 2, Section 1404.2, to the requirements of this RFQ. Incomplete bids will not be considered. If a response is missing required information, it will be deemed non-responsive. The CDCR may, at its discretion, determine if a response is either non-responsive or non-responsible. Bids will be assessed based solely upon the information presented in the written response.

a. Completeness of a bid and adherence to all Response Requirements of this

RFQ.

b. Qualifications of the proposed Candidates as listed in the Statement of Work (SOW), Scope of Work Section G, Mandatory/Minimum Contractor Qualifications and Section H, Mandatory/Minimum Contractor Staff Qualifications. These qualifications are in addition Section “d” listed below.

c. Rate Sheet – Exhibit B-1.

d. Compliance with all Mandatory Qualifications and Desirable Qualifications (if applicable, as listed below).

The CDCR intends to Contract with a Contractor that proposes one (1) Candidate for each CDCR Classification Title listed in the SOW who has the required skill sets indicated. If the Contractor proposed more than one candidate for each position/classification, the hours and time will be split between the staff members classification and cannot exceed the approved budget as noted in this Agreement.

Contractor Staff, who have been involved with projects/programs that meet these skill sets, but who do not propose candidates with the required experience and required skill sets listed in the SOW, will not be considered for award. Each individual Candidate must meet qualifications for the respective classification/job title under which they are submitted. All references will be contacted for verification.

3. Administrative Requirements (100 % Pass/Fail)

The Assessment Team will review the bids to determine whether all Administrative Requirements were provided. Administrative Requirements will be assessed as 100% pass or fail. Responsiveness to the requirements in this RFQ will be either given a “pass” (e.g., complied with requirement, completed and returned document) or “fail” (e.g., did not comply with requirement, did not complete or return document). Only those bids that receive a 100% passing approval will proceed to the next step, cost evaluation. Administrative requirements shall include:

Item Administrative Requirements Score a.

Cover letter typed on Contractor’s company letterhead and signed by an authorized officer of the company who has legal and binding authority.

Pass/Fail

b. Company name, mailing address, and telephone number. Pass/Fail c.

Name, telephone number, and email address of the Contractor’s contact person.

Pass/Fail

d. Date of the submitted bid. Pass/Fail

f. Contractor’s SB/DVBE Certification, if applicable. Pass/Fail g.

A copy of the Contractor’s valid California city or county business license (if applicable).

Pass/Fail h.

Total number of years the Contractor has been in business performing services as described in Exhibit A, SOW.

Pass/Fail i.

Statement outlining the Contractor’s qualifications as listed in Exhibit A, SOW.

Pass/Fail j.

Detailed description of the Contractor’s approach for completing the activities and tasks/deliverables identified in Exhibit A, SOW, including the functions, roles, and responsibilities of the proposed Candidate(s).

Pass/Fail k.

Resumes of each proposed Candidate. Resumes must document years of experience in performing the services as described in Exhibit A, SOW.

Pass/Fail l.

At least three (3) references for each proposed Contractor and Candidate, must be reported on Attachment #2, Customer Reference Form. References should be for Agreements of the same complexity and magnitude as proposed in Exhibit A, SOW.

Pass/Fail m.

Completed Rate Sheet Exhibit B-1. The Contractor must submit one (1) staff member per CDCR Classification/Title.

Proposing one staff member for multiple titles cannot exceed 100%, if applicable.

Pass/Fail

n. Completed Bidder Declaration Form (GSPD-05-105) Pass/Fail

o. Completed Supplemental & Payee Data Record (STD 204) Pass/Fail q.

Signed California Civil Rights Laws Certification, if applicable.

Pass/Fail r.

Disabled Veterans Business Enterprise Declarations (STD 843), if applicable.

Pass/Fail s.

Completed and signed STD 1000 form Generative Artificial Intelligence (GenAI) which is in compliance with Executive Order N-23-23

Pass/Fail

4. Mandatory Qualifications (Pass/Fail)

The Assessment Team will review the Classification Qualifications, and determine whether the proposed Contractor candidates meet the experience and/or education requirements for designated job classifications as listed in the SOW Section G and Section H. Classification Qualifications shall be assessed on a 100% pass/fail basis. Only those bids that receive a 100% pass score will proceed to the next step, cost evaluation. Contractors must provide substantiation as to how the company and its staff members meet the qualifications listed in the SOW.

Contractors must provide substantiation as to how the company and its proposed staff members meet the qualifications listed in the SOW.

5. Interviews –If requested, will be used in the event of a tiebreaker.

D. UNANTICIPATED TASKS

The CDCR expects that during the Agreement term, legislative and/or program changes may necessitate modifications to this Agreement. Unanticipated Tasks may result in an Amendment, and the Amendment rates are based on the Contractor Staff hourly labor rates as identified on Exhibit B-1, Rate Sheet. The agreed upon rates shall be to support Amendments (change requests) to this Agreement.

Unanticipated Tasks are defined as additional work that must be performed, and are generally within the original SOW, but were unforeseen and not identified at the time of bid. Both parties shall agree upon the work that needs to be performed, which shall result in Unanticipated Costs and Tasks as identified on the Work Authorization (WA) form, Exhibit A-1. No work shall be performed in advance of the Contractor’s written proposal and the CDCR’s approved Amendment of Unanticipated Tasks.

The CDCR limits the budget for unanticipated tasks as to not exceed 10% of the sum of the original Contract, and are in accordance with rates as listed in Exhibit B-1.

1. A WA shall be performed for each item of unanticipated work that is not specified in Exhibit A, SOW. All unanticipated work shall be clearly defined on Exhibit A-1, Work Authorization.

2. Before work can begin, a WA shall be completed by the CDCR Contract Manager (CM), and signed by both the CDCR and the Contractor Staff.

3. Each WA shall outline in detail the purpose, objective, goals, and costs.

4. The CDCR may, at any time, order the Contractor to stop work on any WA. The

Contractor Staff shall be compensated for any and all work performed prior to any work stoppage.

5. The Contractor Staff shall inform the CDCR CM if a WA needs to be revised for additional work hours. It is at the discretion of the CDCR CM to accept or reject the request, and the revised WA must be signed by both the CDCR CM and the Contractor.

6. The WA shall not supersede the terms of this Agreement; all terms within this

Agreement shall remain in full force.

7. The Contractor Staff shall be compensated under the WA by the rates as provided on Exhibit B-1, Rate Sheet.

E. WORK AUTHORIZATION AND AMENDMENT LIMITS

1. Work Authorizations (WA’s) shall not exceed 10% of the original Agreement, not including or related to any time and/or money Amendments. WA’s must be justified, and be completely separate from any time and/or money Amendment.

Once a WA has been approved, it will be added and considered as an Amendment, separate from any time and/or money Amendment.

2. Period of Performance language may indicate that amendment for optional years may be executed. Upon the execution of these optional years, any further Amendments that add either time and/or money shall not exceed 1-year, and with a maximum dollar increase of no more than 20% of the original Agreement

3. Amendments that add either time and/or money shall not exceed 1-year, and with a maximum dollar increase of no more than 20% of the original Agreement, not including WA’s. Under Emergency justification, special circumstances, or Legislatively mandated conditions, some agreements may be Amended beyond 1-year and/or 20% of the original Agreement amount, and will be solely at the discretion of the CDCR and/or the CDCR Program Manager. Any Amendment that adds funding will be subject to the CDCR’s Delegated Purchasing Authority thresholds.

F. EXHIBITS AND ATTACHMENTS

Exhibit A Statement of Work

Exhibit A-1 Work Authorization Form - Unanticipated Tasks

Exhibit A-2 Service Report

Exhibit B Budget Detail and Payment Provisions

Exhibit B-1 Rate Sheet

Exhibit C General Provisions for Information Technology

Exhibit D CDCR Special Provisions

Attachment #2 Customer Reference Form

Attachment #3 Bidder Declaration Form (GSPD 105)

Attachment #4 Payee Data Record and Supplemental Payee Data (STD 204)

Attachment #6 Confidentiality and Non-Disclosure Agreement

Attachment #7 Disabled Veteran Business Enterprise Declaration (STD 843)

Attachment #10 California Civil Rights Laws Certification

Attachment #11 Target Area Contracting preference Act (TACPA)

SailPoint Identity Expert Services RFQ # C5612566 California Department of Corrections and Rehabilitation (CDCR) Exhibit A

STATEMENT OF WORK

A. PURPOSE

The California Department of Corrections and Rehabilitation (CDCR), Enterprise Information Services (EIS), Infrastructure Services Unit is seeking a Contractor to provide professional services for an Identity and Access Management (IAM) program from SailPoint Identity Licenses within a SailPoint hosted cloud environment. The professional services for Identity Security Cloud (ISC) will provide Identity Managed Support services, Real-time Dashboard, and Root Cause & Documentation Updates.

The terms “shall” and “must” are considered by the CDCR to mean mandatory or required. The terms “may” or “can” are considered to be optional, and are at the discretion of the CDCR.

B. PERIOD OF PERFORMANCE

The period of performance for this Agreement shall be from December 23, 2025, or upon final execution of this Agreement by the CDCR, whichever is later, through December 31, 2027, with one (1) optional one (1) year extension, consistent with the original Scope of Services and at the contracted hourly rate as referenced in Exhibit B-1, Rate Sheet, and the dollar amount of the first year amendment shall not exceed the first full fiscal year funds encumbered.

C. SUBCONTRACTING

For any services, including Consulting services awarded by the CDCR, the maximum amount of Subcontracting shall not exceed 40%. If the amount of Subcontracting exceeds 40%, the responding Contractor must include a letter of explanation which clearly defines the need for further Subcontracting. Any offer or quote submission that is received by the CDCR that indicates more than 40% Subcontracting, as noted on the Bidder Declaration GSPD-05-105, and does not include a letter of explanation, will be deemed non-responsive by the CDCR Administrative Evaluation Team, and subsequently disqualified from further evaluation of this offer or quote. In addition, the CDCR Evaluation Team will be the final determining body that approves any Subcontracting of more than 40% as indicated on the Bidder Declaration form GSPD- 05-105, and that is also accompanied by the Contractors letter of explanation.

D. TIME AND MATERIALS

The Contractor must follow Payment Provisions guidelines regarding invoicing instructions and requirements as spelled out specifically in Exhibit B.

This agreement shall be based on Time and Materials and shall be task oriented.

Tasks shall be clearly defined in the Scope of Work, Section F and Tasks, Section I.

Time and Material is defined as an hourly staff augmentation that supports the overall effort of this agreement, and where the staff member provides labor at an hourly rate as noted in Exhibit B-1, in exchange for payment, billed monthly in arrears. Time and Materials/Services are billed in the Fiscal Year the Services are rendered and cannot cross Fiscal Years.

E. CONTRACTOR ONBOARDING - CALIFORNIA PROCESS

All Contractors, and any of the Contractor’s staff who will be onboarded, must be able to pass the onboarding process, which includes, but not limited to, fingerprinting (Live Scan), criminal background checks, and Tuberculosis testing, Form 700 approval, if required. The Contractor, and any of their proposed staff, are required by the CDCR to be physically Live Scanned either at CDCR HQ or at a CDCR institution. Only an EIS Contract Management Unit staff member will schedule the live scan appointment.

All costs of onboarding a Contractor and the Contractors staff (which includes transportation, lodging, and any incidentals associated with travel) shall be borne by the Contractor, with the exception of the actual LiveScan itself. Should a staff member fail the process, the Contractor shall be required to propose a substitute replacement.

During the onboarding process, anyone convicted of a felony will be rejected, including the Contractor (if applicable). If a Contractor cannot pass the onboarding process, or fails to submit acceptable staff who can pass the onboarding process, the Contractor will be deemed to be non-responsible, and their proposal shall be rejected, and the agreement canceled. This section applies to any staff replacements or substitutions as well.

F. SCOPE OF WORK

The Contractor’s Managed Support program shall follow industry standards and a best practices architecture, Managed Support and operational model. The Contractor’s knowledge transition shall be divided into four (4) stages: Plan, Guide, Shadow, and Perform. At the completion of each phase, the CDCR and the Contractor shall conduct transition review meetings and validate the level of understanding in the current phase. If the level of understanding is acceptable to the CDCR and the Contractor, then the transition proceeds to the next phase. After the completion of the Perform phase, the Contractor shall consider the knowledge transition complete and start delivering the full support under the defined Service Level Agreement (SLA).

The Contractor will provide Managed Support in a SailPoint Cloud hosted environment by resources equipped with relevant experience and certifications to deliver the requested services. The Contractor shall provide the services in Section I, Tasks, remotely unless otherwise explicitly stated.

G. MANDATORY/MINIMUM CONTRACTOR QUALIFICATIONS

1. Be a certified SailPoint SaaS Delivery Admiral.

2. Be a certified SailPoint Managed Services Partner.

3. Minimum 10 years’ experience delivering identity governance.

4. Minimum 2 years experience with State of California delivering identity governance

5. Minimum 2 years experience delivering identity governance in a correctional environment.

6. Minimum 2 years experience integrating IIQ/ISC into Microsoft Active Directory environment.

7. Minimum 2 years experience integrating IIQ/ISC into Microsoft Entra ID.

8. Minimum 2 years experience integrating SAP SuccessFactors with SailPoint

IIQ/ISC.

H. MANDATORY/MINIMUM CONTRACTOR STAFF QUALIFICATIONS

The Contractor Staff will work under the direction of a CDCR Program Manager or other agency personnel as directed by the CDCR Program Manager.

The Contractor Staff resumes shall be compared by the CDCR against both the MQ’s and the stated and verified related experience in the resume. Interviews may not be part of the selection process; however, they may be conducted at the discretion of the CDCR in the event of a tie score.

The Contractor’s Contractor staff must meet all of the MQ’s listed below in order for the Contractor to be considered for Agreement award. Not meeting any one (1) MQ in this area may result in disqualification, and is at the discretion of the CDCR.

1. Minimum of 2 years experience delivering identity governance with IIQ and ISC.

2. Minimum of 1 year experience delivering identity governance in a correctional environment.

3. Minimum of 2 years experience with Bean Shell programming.

Requests Type of Personnel

CDCR Working Title

1 Contractor Staff IDentity Management (IDM) Administrator

I. TASKS

1. Incident Management The support and maintenance services team shall perform Incident Management with a focus on the restoration of a service affected by occurred or potential interruptions, which may have an impact upon the quality of the system or service.

The team shall work based on the following primary objectives:

a. Takes complete ownership of incidents from open to close.

b. Recover standard service operation from incidents as quickly as possible in order to minimize disruption to the business caused by an incident.

c. Resolve Incidents within committed SLA.

d. Minimize the duration and impact of service outages associated with an incident.

e. Assist CDCR to minimize the impact of its business during an incident

(business impact mitigation).

f. Execute appropriate communication activities (notification and escalation) for the duration of the major incident.

g. Reduce the cycle time for service restoration of critical business impact incidents by:

1) Clearly assigning ownership of the incident.

2) Providing resources/skills to work on the incident.

The CDCR has estimated an approximate ticket volume of twenty-five (25) tickets a month. This process will be reviewed and finalized with the CDCR during the knowledge transition phase.

2. Major Incident Management The Major Incident Management process shall be executed to work in parallel with Incident Management to facilitate the recovery of standard service operations as quickly as possible when it is disrupted by Priority-1 incidents, which cause severe disruption or extreme impact.

3. Monitoring The Contractor Managed Support team shall monitor the ISC production instance to check the health and status of the system(s) and proactively identify any potential problems.

The objectives for the monitoring service are:

a. Define the basic components that are essential for system stability and performance.

b. Establish a threshold for monitoring infrastructure.

c. Establish notification, warning and alerting thresholds.

d. Implement distributed monitoring at various levels of infrastructure.

e. Analyze notifications, warnings, and alerts using a standardized process to ensure each is effectively and efficiently assessed.

f. Effectively communicate with the CDCRs when events may impact the quality of their service.

4. Problem Management The Problem Management process includes the functions associated with diagnosing the underlying cause of incidents and identifying a means to remove that cause. A problem is the unknown cause of one or more incidents.

The Incident Management process majorly focuses on the restoration of a service affected by incidents. In contrast, Problem Management aims to resolve the root causes of incidents, minimize the adverse impact of incidents, and prevent recurrence of incidents.

Problem management is accomplished through root cause analysis. Root cause analysis shall be performed for all Priority Level 1 incidents. The support and maintenance team shall perform root cause analysis with the following goals:

a. Detecting problems by recognizing multiple incidents with the same resolution.

b. Investigating and diagnosing the root cause of problems.

c. Reducing the number and priority of incidents and problems where possible.

d. Minimizing the impact of incidents that cannot be prevented to minimize disruption to the business.

e. Documenting the details of the problem and resolution to be available for the support team and the CDCRs via request system, and knowledge bases.

Problem Management includes the following activities:

a. Opening a problem record.

b. Problem validation.

c. Problem investigation and diagnosis, analyzing the problem and associated incidents.

d. Perform root cause analysis.

e. Assign the problem to a support engineer or resolver group.

f. Create a "known error" record.

g. Create a bug fix (change) service request.

h. Update the incident knowledge base to assist with future incident and problem investigation and diagnosis that details the actual root cause, short term fix, and long-term solution.

i. Provide regular progress notifications or as reasonably requested by the

CDCR or delivery team and, as necessary, through any follow-up communication and work required post resolution of the problem or related Incidents.

j. Close the problem record.

k. Work to implement the workaround or resolution for the problem, for example: Change / Release / Deployment, System Support, Incident Management, and record the progress and results of the solution implementation.

l. The process document will be reviewed and finalized with the CDCR during the knowledge transition phase.

5. Change Management The Managed Support team shall follow the change management process to make changes to the CDCR’s systems across different environments.

Changes will follow a predefined policy and procedure along with adequate communication and coordination with the CDCR team members.

The following Change Management Process articulates the steps between CDCR and the Contractor Managed Support personnel:

a. Oversee the change management activities and process.

b. Receive the change records from the support team.

c. Determine the feasibility of change requests.

d. Review change record and update them.

e. Seek approval from Change Advisory Board (CAB), which consists of CDCR reviewers and approvers for major changes.

f. Get approval through normal process for small and medium changes.

g. Communicate the CDCR/relevant stakeholders about the deployment plan (schedule, downtime if applicable).

h. Work with the CDCR Support Engineer and make sure that the system is up again and running.

i. Verify that the problem is resolved, and the Incident is closed.

The CDCR has estimated two (2) change management support activities a month. The process for Change Management will be reviewed and finalized with the CDCR during the knowledge transition phase.

Examples of changes include, but are not limited to:

a. Scheduled outage and maintenance activities.

b. Emergency change to correct an incident.

c. Deployment and migration of code across environments.

d. Limited fix or patch for the issue (for functionality or UI element).

e. Support for improvement/enhancement for new requirements.

6. Knowledge Management The Contractor’s support and operations team shall perform Knowledge Management through managing and storing information or knowledge that assists in the successful operation of a system. This may include, but is not limited to, legacy documents, connection details, and common workarounds and solutions to known problems. The knowledge management repository shall act as a glossary of information, FAQ, and collection of procedures that help facilitate the recovery of standard service operation as quickly as possible when it is disrupted by incidents.

Knowledge Management will be utilized by Contractor’s support analysts and engineers alike to manage and minimize the impact of current or future Incidents that may affect services. By recording and storing details of incidents, problems, changes, workaround, and solutions on a regular basis, a knowledge base can be accessed to provide solutions to current or future incidents and problems.

The Contractor shall use an incident/service management system for FAQ and document storage (CDCR has ServiceNow BMC Remedy and is willing to explore contractor utilizing this system).

7. Monitoring The Contractor Managed Support team shall monitor the IdentityIQ production instance to check the health and status of the system(s) and proactively identify any potential problems.

The objectives for the monitoring service are as follows:

a. Define the basic components that are essential for system stability and performance.

b. Establish a threshold for monitoring infrastructure.

c. Establish notification, warning and alerting thresholds.

d. Implement distributed monitoring at various levels of infrastructure.

e. Analyze notifications, warnings, and alerts using a standardized process to ensure each is effectively and efficiently assessed.

f. Effectively communicate with the CDCR Program Manager when events may impact the quality of their service.

8. Application Monitoring

Application Monitoring checks the health of services or applications running on hosts at regular intervals, as defined by service definitions.

a. Application (Up/Down): Check if the application up/down.

b. Application URL Response Time: Check response time while accessing the first page of an application.

c. Application URL Login as user: Check by simulating he login as a user (through scripts).

9. Minor Enhancements The Contractor’s Managed Support team shall perform minor enhancements and configuration changes in the production instances of IdentityIQ. These changes are part of the operational support to modify the configuration that would require development, testing, and promotion of configuration or code.

The in-scope minor enhancements include, but are not limited to:

a. Configuration change in an existing application.

b. Rule modification.

c. New role and/or policy configuration.

d. Update role and/or policy configuration.

e. Update configuration settings for an existing application.

f. Configure campaign filters.

g. Changes to email templates.

10. Reporting The Contractor will provide reports, containing a reasonable level of detail that is acceptable to the CDCR, based on the actions taken and the health of the Managed Support during the month. The reports will be generated periodically (biweekly, monthly, or quarterly) to cover:

a. Incident Management (number of Incidents, response time, SLA status).

b. Planned and emergency changes to the system.

c. Enhancements performed on the system.

d. Root cause analysis summary.

e. Knowledge management.

f. Future plan for activities.

The CDCR may request additional reports not immediately identified but focused on the in-scope system and/or service, and the parties will discuss and reasonably agree upon the scope and frequency of such reports. The Contractor management will meet with the CDCR team to review the system and/or service activities and health periodically (bi-weekly, monthly, or quarterly, based on the CDCR requirements).

11. Support Plan The Contractor Managed Support plan is the premier service offering for the Contractor technical support for Managed Support clients.

12. Priority Levels The Contractor looks to the CDCR to assist in priority identification associated with a given call. While The Contractor has knowledge of the client environment, and the CDCR does not always know the impact of a given service affecting event. The Contractor support personnel utilize priority levels to gain focus on incidents that have the greatest business impact. This allows the Contractor to ensure the closure of critical incidents in a timely fashion. All reported incidents are addressed, but only the highest priority incidents will be expedited through the resolution process.

13. Acceptable Contact Methods The Contractor will respond to support issues and requests via the specified methods. While there are other methods available, the primary and fully supported method of reporting incidents or requests is through the CDCR provided Service Desk. This is to ensure that incidents and requests are tracked, and the proper response is executed.

a. Support site

b. Dedicated email

c. Direct email interactions

d. Support Hotline

e. Tool: The Contractor will use an incident/service ticketing tool for Incident

Management, Change Management, Problem Management, and Knowledge Management.

14. Response Times (SLA) The Contractor’s response times (i.e. initiation of support work) and resolution times are based on Priority Levels 1, 2, 3, and 4 incidents. Response Times and Performance of the SLA are defined below for the production environment by the Contractor.

Incident Level

Response Time Restoration

Time Business Hours

Priority 1

The Contractor shall acknowledge receipt within one (1) hour of a support request Engagement of the Contractor support via a phone call from the CDCR followed by an email.

4 hours 24 hours x 7 days per week x 365 days per year

Priority 2

During support hours, the Contractor shall acknowledge receipt within four (4) hours of a support request the Contractor will provide ongoing updates.

8-12 hours

See link below

Priority 3 acknowledge receipt within one (1) business day of a support request.

Three (3) Business

Days

Priority 4 acknowledge receipt within one (1) business day of a support request.

Five (5) Business

Days

Resolution is defined as the following:

a. A solution to the incident has been provided that restores service.

b. A workaround to the incident has been provided to continue service.

c. Determination by the Contractor that the incident is an enhancement request and forwarding the request to the Contractor development and implementation personnel.

d. Escalation of identified commercial product deficiencies requiring analysis by the vendor support organization.

e. Where identified commercial product, deficiencies require a proprietary vendor software development effort.

f. In the case of commercial product software, "bugs" or "enhancements" requiring an update to the commercial product.

A resolution email will be sent to CDCR approval. Approval from CDCR should occur within seventy-two (72) hours.

15. Support Model

The Contractor will follow an approach wherein our resources are distributed across various regions in the United States. The Contractor will provide support and maintenance services remotely. However, if needed, the Contractor can also provide onsite support based on the solution discussion with the CDCR.

16. Support Workflow

a. The CDCR can reach out to the Contractor through any of the mentioned contact methods.

b. At any point in time (24 x 7 x 365) there will be the Contractor’s analyst monitoring these channels and will act accordingly.

c. A team of the Contractor’s Sr. Support Analysts and Support Analysts will work on Incidents, RCAs, knowledge articles, changes, etc. based on the service management system.

d. The Contractor’s Operations Manager(s) will be monitoring the overall progress, provide reports, and will drive major incidents (Priority Level 1.)

17. Onboarding, Knowledge Transition & Setup

The Contractor has a well-defined onboarding process for the successful delivery of projects (Example below):

a. Resourcing and Welcome Packet

1) Assign Managed Support resources to the project.

2) Share the welcome packet covering Managed Support policies and procedures.

3) Document Agenda for the kick-off.

b. Kick-off and Planning

1) Project Kick-off meeting with the key CDCR stakeholders.

2) Prepare the overall project plan with roles and responsibilities.

3) Define Knowledge Transition schedule.

4) Access request to support and service management systems.

c. Knowledge Transition

1) Gather and document information on the environments from the CDCR.

2) Follow Plan → Guide → Shadow → Perform methodology.

3) Record all sessions.

4) Prepare Implementation and Operations Guides.

5) Checkpoint for each Knowledge Transition phase to identify any gaps ensuring a successful Knowledge Transition.

d. Set-up

1) Service Management tool set-up.

2) Queue creation.

e. Delivery

1) Managed Support delivery.

2) Incident Management.

3) Major Incident Management.

4) Problem Management (RCA).

5) Change Management.

6) Knowledge Management.

7) Minor Enhancements.

8) Reporting (bi-weekly, monthly, or quarterly).

9) Quarterly Business Review.

There will be a continuous management review and executive oversight for a successful onboarding and ongoing delivery by the Contractor.

18. Management Plan

Project Governance and Communication Plan:

The Contractor team, listed below, will be…