CTR072831_Contract_Documents.pdf

Request for Proposal

Solicitation No. BPM005579

Automated Crime Victims Notification System

Arizona Department of Administration State Procurement Office

Solicitation Attachment – Offer and Acceptance | Revision No. 5 | Revised 05-23

Attachment 1 – Offer and Acceptance Form

SUBMISSION OF OFFER: The undersigned hereby offers and agrees to provide an Automated Crime Victims Notification System in compliance with all terms, conditions, specifications, and amendments in the Solicitation and any written exceptions in the Offer indicated by the latest dated version below:

Initial Offer:

Date Signature

Revised Offers:

Date Signature Date Signature

Date Signature Date Signature

Best and Final Offer:

Date Signature

Offeror company name Signature of person authorized to sign Offer

Address Printed name and Title

City, State, ZIP Contact name and Title

CERTIFICATION: By signature in the above, Offeror certifies that it: Contact email address Contact phone number

1. Will not discriminate against any employee or applicant for employment in violation of Federal Executive Order 11246, [Arizona] State Executive Orders 2023-09, 2023-01, 2009-09 or A.R.S. §§ 41-1461 through 41-1465;

2. Has not given, offered to give, nor intends to give at any time hereafter any economic opportunity, future employment, gift, loan, gratuity, special discount, trip, favor, or Service to a public servant in connection with the submitted offer. Failure to provide a valid signature affirming the stipulations required by this clause will result in rejection of the Offer. Signing the Offer with a false statement will void the Offer, any resulting contract, and may be subject to legal penalties under law;

3. Complies with A.R.S. § 18-132 when offering electronics or information technology products, Services, or maintenance;

4. Has submitted this Offer as a firm offer for 180 days following the Solicitation due date and time per the Instructions to Offers. Any extensions to the Offer Acceptance Period shall be made in accordance with the A.A.C. R2-7-C310;

5. Did not and will not involve collusion or other anti-competitive practices; and

6. Is not debarred from, or otherwise prohibited from, participating in any contract awarded by federal, state, or local government.

ACCEPTANCE OF OFFER

The offer is hereby accepted.

The Contractor is now bound to sell the Materials or Services listed by the attached Contract and based upon the Solicitation, including all terms, conditions, specifications, amendments, etc., and the Contractor’s Offer as accepted by the State.

The Contract shall henceforth be referred to as Contract No.

The effective date of the Contract is July 17, 2024

The Contractor is cautioned not to commence any billable work or to provide any Material or Service under this Contract until Contractor receives purchase order, contract release document, or written notice to proceed.

State of Arizona Awarded this day of 20

Procurement officer signature

07/03/2024

Jarrod Carnahan, Vice President Government & Victim Services

Emily Kamer, Client Relationship Manager Louisville, KY 40223

9901 Linn Station Road

Appriss Insights, LLC emily.kamer@equifax.com 502-645-8946

CTR072831

17th July 24 under A.R.S. § 41-2534

Notice Page

Arizona Department of Administration State Procurement Office

100 N 15th Avenue, Suite 305 Phoenix, AZ 85007

Solicitation Requirements | Revision No. 6 | Revised 08-10 | Page 1 of 87

Solicitation Number: BPM005579

Description: Automated Crime Victims Notification System

Solicitation Due Date and Time: As indicated in APP

Pre-Offer Conference: January 4, 2024 / 10:00am – 12:00pm

Google Meet joining info Video call link: https://meet.google.com/fsm-yzmo-iqq Or dial: (US) +1 413-438-4397 PIN: 300 293 035# More phone numbers: https://tel.meet/fsm-yzmo-iqq?pin=3678252067883

Proposals will only be accepted online in the “State’s eProcurement System”, Arizona Procurement Portal (APP), at https://app.az.gov until the “Bid/Offer Due Date” indicated in the “State’s eProcurement System” for the Solicitation No. shown at the top of this page. Proposals must be in the State Procurement Office’s possession online no later than that deadline.

Submit technical inquiries about navigating and/or submitting proposals in the State’s eProcurement System to the State’s eProcurement System Help Desk by phone at (602) 542-7600, option 2; or by email to app@azdoa.gov.

LATE PROPOSALS WILL NOT BE CONSIDERED. No extension or grace period will be given for delays or incomplete proposals caused by internet connectivity problems, file uploading difficulties, or misunderstanding of the requirements or procedures for online submission in the “State’s eProcurement System”.

It is the responsibility of the Prospective Offeror to routinely check the APP website for Solicitation Amendments. Additional instructions for preparing an Offer are included in this solicitation.

Persons with a disability may request a reasonable accommodation, such as a sign language interpreter, by contacting the Solicitation contact person. Requests shall be made as early as possible to allow time to arrange for the accommodation.

https://app.az.gov/ https://app.az.gov/ mailto:app@azdoa.gov

Table of Contents Request for Proposal under A.R.S. § 41-2534

Solicitation No. BPM005579 Automated Crime Victims Notification System

Arizona Department of Administration State Procurement Office

Solicitation Requirements | Revision No. 6 | Revised 08-10 | Page 2 of 87

Click here to return to the Table of Contents

Notice Page

Table of Contents

Solicitation Summary 3

Scope of Work 5

Special Terms and Conditions 25

Addendum A to the Special Terms and Conditions 61

Addendum B to the Special Terms and Conditions 666

Uniform Terms and Conditions 70

Exhibit A 877

Solicitation Summary

Solicitation No. BPM005579 Automated Crime Victims Notification System

Arizona Department of Administration State Procurement Office

100 N 15th Avenue

Solicitation Requirements | Revision No. 6 | Revised 08-10 | Page 3 of 87

Solicitation Summary

1. What is the State Soliciting?

The Arizona Department of Administration, State Procurement Office (the State), as authorized under A.R.S. § 41-2501 et seq. is seeking to establish one single-agency Contract on behalf of the Arizona Criminal Justice Commission (“ACJC”) and for their sole use, to provide the services of a Crime Victim Notification System (“CVNS”), The State is soliciting the services of a CVNS for Arizona, and if it is in the best interest of the State, the purchase of the CVNS itself or the right to use it in order to obtain the services.

The State anticipates awarding a contract with the intent to secure service coverage statewide.

Whether or not it actually enters into any contracts, how many contracts it enters into, and how the work is awarded between those contracts are all at the State’s discretion. Furthermore, the State will use any awarded contracts on an as-needed basis, with no guarantee as to its actual spending under them.

The State reserves the right to accept any item or combination of items specified in the Solicitation, unless the Offeror expressly restricts an item or combination of items in its Offer, and conditions its response on receiving all items for which it provided a proposal. In the event of such restriction, the State will evaluate if an award on such a basis will result in the best value and is in the best interest for the State. The State may otherwise determine, at its sole discretion, that such restriction is non-responsive and deem the Offeror ineligible for further evaluation.

2. What is in the Solicitation?

2.1. At the time of publication, the following documents are included in the Solicitation:

2.1.1. Attachment: BPM005579 Solicitation Requirements

2.1.1.1. Notice / Cover Page

2.1.1.2. Table of Contents

2.1.1.3. Solicitation Summary

2.1.1.4. Scope of Work

2.1.1.5. Special Terms and Conditions

2.1.1.6. Addendum A to the Special Terms and Conditions

2.1.1.7. Addendum B to the Special Terms and Conditions

2.1.1.8. Uniform Terms and Conditions

2.1.1.9. Exhibits (if applicable)

2.1.2. Attachment: BPM005579 Solicitation Instructions

2.1.2.1. Special Instructions to Offerors

2.1.2.2. Standard Instructions to Offerors (RFP)

2.1.3. Solicitation Attachments

Solicitation Summary

Solicitation No. BPM005579 Automated Crime Victims Notification System

Arizona Department of Administration State Procurement Office

Solicitation Requirements | Revision No. 6 | Revised 08-10 | Page 4 of 87

2.1.3.1. Offer and Acceptance

2.1.3.2. Boycott of Israel Disclosure

2.1.3.3. Forced Labor of Ethnic Uyghurs Ban

2.1.3.4. Confidential Information Designation

○ Confidential Information Designation (for reference only)

2.1.3.5. Conformance Statements

○ Supplement – Conformance Statements - Exceptions to Instructions

○ Supplement – Conformance Statements - Exceptions to Scope of Work

○ Supplement – Conformance Statements - Exceptions to Contract Terms and Conditions

2.1.3.6. Key Personnel

2.1.3.7. Letter of Insurability

2.1.3.8. Organization Profile

2.1.3.9. Proposed Subcontractors

2.1.3.10. Experience and Capacity Response

2.1.3.11. References

2.1.3.12. Method of Approach

2.1.3.13. AZ Baseline Infrastructure Security Controls

2.1.3.14. Prerequisite Assessment of Arizona Baseline Infrastructure

Security Controls

2.2. The State may issue a Solicitation Amendment at any time after Solicitation publication and before the Offer due date. It is the responsibility of the Prospective Offeror to routinely check the APP website for any Solicitation Amendments and revised documents.

Scope of Work

Solicitation No. BPM005579 Automated Crime Victims Notification System

Arizona Department of Administration State Procurement Office

Solicitation Requirements | Revision No. 6 | Revised 08-10 | Page 5 of 87

Scope of Work

Scope of Work

1. Purpose and Background

1.1. The purpose of this Solicitation is to establish the State’s CVNS Program for Eligible Agencies, Employees, and the State of Arizona. The Program at a minimum includes CVNS notification and other services (SaaS) as described in the requirements, but may include the CVNS system itself as well as the services it provides if the State deems this to be in the best interest of Arizona.

2. Definitions

The table below provides definitions that are applicable to this Solicitation.

Term Abbrev iation Definition Source/R eference Arizona Offenders n/a Offenders that are currently tracked via the Arizona filter available in VINE.

Channel The mode of notifications. See also “Channel Scope”.

Channel scope The notification channels in the System include phone, text and email.

Concerned Citizen notification request profiles

A Concerned Citizen notification request profile specifies criteria that any participating agency’s triggers are checked against when the trigger occurs. In the event of a match, the concerned citizen receives the notification that was triggered.

Example: Concerned Citizen A requests that whenever a suspect or a person of interest is noted in the system of record of a participating agency as having an address that is within the limits of a certain municipality or city.

Configuration settings of the victim et al

The configuration settings that are available to a victim et al in the System. These options include

• Preferred language

• Preferred channel(s)

• Others as may be requested by ACJC during vendor planning activities

DTMF DTMF Dual tone multi frequency, also known as touch tone sounds

Law Enforcement Agency

LEA Per H.B. 2842, “Law Enforcement Agency” includes a State, City, Town, County, Tribal, University or Prosecutorial Agency”

LEA notification request profile n/a A LEA notification request profile specifies criteria that any participating agency’s triggers are checked against when the trigger occurs. In the

Solicitation No. BPM005579 Automated Crime Victims Notification System

Arizona Department of Administration State Procurement Office

Solicitation Requirements | Revision No. 6 | Revised 08-10 | Page 6 of 87

Term Abbrev iation

Definition Source/R eference event of a match, the requesting agency receives the notification that was triggered. Example:

Agency A requests that whenever a suspect or a person of interest is noted in the system of record of a participating agency as having an address that is within the jurisdiction of Agency A.

Minimum Incident or Investigation Data (MIID)

The Minimum Incident or Investigation Data is the set of data that when entered or otherwise made available in a LEA’s system of record constitutes the trigger for the Initial Notification if a victim is also identified in the system of record, along with at least one notification address. The MIID encompasses the LEA’s case or file number, the incident number or the investigation number, the reporting Officer name and badge number. A notification address may be one of the following: a phone number, a phone number that accepts texts, an email address.

Notification language versioning

The automatic translation of a notification message in English, to another language.

Notification settings of the

LEA

The notification options that are available to a LEA in the System. These options include:

• Applicable triggers

• Notification content, unless LEA defers to

System settings.

• Notification headers

• Attachment options

• Others as may be requested by ACJC during vendor planning activities

Participating

LEA

Law Enforcement Agencies, including jails, detention facilities, correctional facilities and prosecutorial agencies when the agency is signed up and exchanging data with the System.

Prolonged Test Failure

PTF The same test (functional, security, performance or otherwise) fails over more than 6 weeks.

Records Management System

RMS Records Management System, typically the system of record that LEAs use.

System Administrator

The administrative role of a user who administers the System overall.

TTS TTS Text-to-Speech

Victim, also victim et al.

n/a "Victim" means a person against whom the criminal offense has been committed, including a minor, or if http://ww w.azleg.g http://www.azleg.gov/viewdocument/?docName=http://www.azleg.gov/ars/13/04401.htm http://www.azleg.gov/viewdocument/?docName=http://www.azleg.gov/ars/13/04401.htm

Solicitation No. BPM005579 Automated Crime Victims Notification System

Arizona Department of Administration State Procurement Office

Solicitation Requirements | Revision No. 6 | Revised 08-10 | Page 7 of 87

Term Abbrev iation

Definition Source/R eference the person is killed or incapacitated, the person's spouse, parent, child, grandparent or sibling, any other person related to the person by consanguinity or affinity to the second degree or any other lawful representative of the person, except if the person or the person's spouse, parent, child, grandparent, sibling, other person related to the person by consanguinity or affinity to the second degree or other lawful representative is in custody for an offense or is the accused ov/viewdo cument/?

docName =http://ww w.azleg.g ov/ars/13/ 04401.ht m

Victims of Crime Act

VOCA Federal Victims of Crime Act of 1984. In Arizona, The Department of Public Safety (DPS) operates the

VICTIMS OF CRIME ACT (VOCA) VICTIM

ASSISTANCE - DPS VOCA ADMINISTRATION

UNIT

Victims of Crime Act

(VOCA)

Victim Assistanc e - DPS

VOCA

Administr ation Unit | Arizona Departme nt of Public Safety (azdps.go v)

3. Scope of Work

This Section provides the Scope of Work (SOW) for this Solicitation.

3.1. SOW Introduction

The need for the Crime Victim Notification System (CVNS, or the “System”) arises through Arizona House Bill No. 2482 (H.B. 2482). This law entails the expansion of the capabilities of the current Victim Information and Notification Everyday (VINE)1 system for Arizona. The ACJC is charged with funding this expansion.

1 VINE is a national service operated by Appriss Insights LLC, an Equifax Company. VINE’s scope varies by State. It relies on participating agencies to report offender and custody information as this information becomes available in the agencies’ systems, uploaded by them or reported otherwise. In Arizona, VINE http://www.azleg.gov/viewdocument/?docName=http://www.azleg.gov/ars/13/04401.htm http://www.azleg.gov/viewdocument/?docName=http://www.azleg.gov/ars/13/04401.htm http://www.azleg.gov/viewdocument/?docName=http://www.azleg.gov/ars/13/04401.htm http://www.azleg.gov/viewdocument/?docName=http://www.azleg.gov/ars/13/04401.htm http://www.azleg.gov/viewdocument/?docName=http://www.azleg.gov/ars/13/04401.htm http://www.azleg.gov/viewdocument/?docName=http://www.azleg.gov/ars/13/04401.htm http://www.azleg.gov/viewdocument/?docName=http://www.azleg.gov/ars/13/04401.htm http://www.azleg.gov/viewdocument/?docName=http://www.azleg.gov/ars/13/04401.htm https://www.azdps.gov/services/enforcement/crime-victims https://www.azdps.gov/services/enforcement/crime-victims https://www.azdps.gov/services/enforcement/crime-victims https://www.azdps.gov/services/enforcement/crime-victims https://www.azdps.gov/services/enforcement/crime-victims https://www.azdps.gov/services/enforcement/crime-victims https://www.azdps.gov/services/enforcement/crime-victims https://www.azdps.gov/services/enforcement/crime-victims https://www.azdps.gov/services/enforcement/crime-victims https://www.azdps.gov/services/enforcement/crime-victims https://www.azdps.gov/services/enforcement/crime-victims https://www.azdps.gov/services/enforcement/crime-victims https://www.azdps.gov/services/enforcement/crime-victims https://www.azdps.gov/services/enforcement/crime-victims https://www.azdps.gov/services/enforcement/crime-victims https://www.azdps.gov/services/enforcement/crime-victims

Solicitation No. BPM005579 Automated Crime Victims Notification System

Arizona Department of Administration State Procurement Office

Solicitation Requirements | Revision No. 6 | Revised 08-10 | Page 8 of 87

Pursuant to H.B. 2482, the ACJC intends for the CVNS to provide

• Enhanced notification services to crime victims, families, persons designated by victims and concerned citizens.

• Notifications available to all Arizona Law Enforcement Agencies (“LEA”s).

• Individual notification setting options available to participating LEAs.

• LEA onboarding processes and technical assistance.

• A 24-hour 1-800 Help Desk and real-time chat services available to all users of CVNS

The ACJC intends to procure the services and licenses necessary to plan for, implement and operate CVNS. Hosting of the System may reside with a State Department, the ACJC or a private sector vendor. It is the intent of ACJC for LEAs to onboard with CVNS according to these agencies’ readiness. The ACJC anticipates an initial Go-live scope that addresses most if not all the LEA requirements2 for one or more LEAs, and many if not most or all requirements for the other user groups including crime victims.

The notification scope of H.B. 2482 spans the criminal justice process starting from an incident involving a victim, to a release or discharge of an offender and the satisfaction of related restitution and other conditions.

The table below provides some important events between an incident and a release of an offender.

has been in operation since 2023 and provides offender’s custody status updates to crime victims who have registered with VINE.

2 See CVNS System Requirements document.

Solicitation No. BPM005579 Automated Crime Victims Notification System

Arizona Department of Administration State Procurement Office

Solicitation Requirements | Revision No. 6 | Revised 08-10 | Page 9 of 87

Phase Agencies involved Events Notes Incident LEA Crime Report �iled, LEA Case/File

Number assigned; there can be an arrest3.

Investigation LEA, Prosecutor, Court4

Warrants (sealed or not), pre-trial release.

Charges Prosecutor, LEA, Court

Charge(s) �iled with the Court, charge amendments, charge withdrawals, nolle prosequi.

Adjudication Court, Prosecutor, LEA, Defender

Hearings, sentences. Establishes “Offender” via a �inding of guilty.

Custody Jail, Corrections Check-in, check-out, transfer, incidents

Release Jail, Corrections, Court, Prosecutor, Defender

Release, Conditions, Restitution

Substantial time may pass between an incident and the beginning of offender tracking. This is because the offender is not formally found to be an offender until so adjudicated by a Court. In between are investigation and arrest, not necessarily in this order, as well as charging decisions brought and possibly amended by a prosecutorial agency.

1.1. Desired System Overview

CVNS is intended to provide various areas of functionality to a number of different user groups, as depicted in the diagram below.

3 In the case of an arrest, there could be a release with conditions (pre-trial release).

4 Court has to sign warrants. Also, the Court is involved in the event there is a petition for pre-trial release and/or continued detention.

Solicitation No. BPM005579 Automated Crime Victims Notification System

Arizona Department of Administration State Procurement Office

Solicitation Requirements | Revision No. 6 | Revised 08-10 | Page 10 of 87

The table below provides an alternate overview of which areas of functionality are intended to be available5 to which user group(s).

5 Unless speci�ied otherwise or adjusted on a temporary basis for iterative testing purposes, all areas of functionality in CVNS referenced in DEL-1, DEL-3 and DEL-4 must be available in all environments that the con�iguration management approach to CVNS anticipates, e.g. development, integration, testing, production.

Solicitation No. BPM005579 Automated Crime Victims Notification System

Arizona Department of Administration State Procurement Office

Solicitation Requirements | Revision No. 6 | Revised 08-10 | Page 11 of 87

No. Area of Functionality Victims et al

LEA RMS

Vendor

CVNS ACJC

1 Receive Noti�ications 2 Receive Multi-Agency Noti�ications 3 Manage Noti�ication Settings 4 Manage Noti�ication Attachments 5 Set up Noti�ications and Alerts 6 Manage Message Languages and

Content

7 Manage the Virtual Agent (bot, AI, …) 8 Administer CVNS 9 Manage Security 10 Onboard LEAs 11 Implement and operate the 1-800

Desk

12 Manage APIs (data exchanges) 13 Support data exchange with LEAs’

RMSs

14 Monitor and act on data connection status

15 Conduct Analytics

Work areas and user groups are described in the subsections below.

1.1.1. Areas of Functionality

The areas of functionality6 of CVNS are:

• Receive Notifications. - This area of functionality includes notifications that are triggered by defined events regarding a victim’s law enforcement crime report, its investigation and case, subject to approval of the law enforcement agency.

• Receive Multi-Agency Notifications – This area includes the sharing of status of an incident or an investigation with another identified agency. It is currently unclear if receiving a status is intended to trigger an update in the receiving LEA’s RMS system.

• Manage Notification Settings – This is the initial creation and management over time, of the notification settings that are available to a LEA.

6 A comprehensive listing of functional requirements is available in the CVNS System Requirements documentation <add link>

Solicitation No. BPM005579 Automated Crime Victims Notification System

Arizona Department of Administration State Procurement Office

Solicitation Requirements | Revision No. 6 | Revised 08-10 | Page 12 of 87

• Manage Notification Attachments – This area includes the initial creation and management over time, of the settings relative to attachments to notifications.

• Set up Notification and Alerts – This area includes the options for victims et al, to adjust their personal notification settings from time to time.

• Manage Message Languages and Content– This area of functionality includes features that allow the CVNS Operator to configure and control various message content aspects such as:

o Automatically or ad-hoc invoke language translation or content selection based on language.

o Set up and invoke conversational language services that adjust language for tone, verbosity, reading level and so on. These services may or may not include artificial intelligence support.

o Set up and control message headers, in order to increase ease-of-use and adjust for display changes in texts and emails, and for changes in the introduction at the beginning of an automated phone call.

• Manage the Virtual Agent (AI bot) – This includes the functionality necessary to set up, configure and manage the Chatbot and/or AI, explicitly.

• Administer CVNS – This area includes all tasks necessary to administer CVNS, including configuration management, deployments and monitoring.

• Manage Security – This area includes ensuring application and data security, as well as compliance with all applicable laws and rules.

• Onboard LEAs – This area includes all activities necessary to initiate and complete the onboarding of a law enforcement agency to CVNS.

• Operate the 1-800 Desk - This area includes the operation of the 1-800 Desk as well as the interactions with callers, automated and not automated.

• Manage APIs – This area includes the creation, application and monitoring of CVNS’s APIs.

• Support a LEA’s data exchange with CVNS – This area of functionality includes the activities by the LEA’s vendor(s) of their RMS(s) necessary to implement and monitor the data exchanges with CVNS7.

• Monitor and act on data connection status changes – This area is to monitor the status of each data exchange in and with CVNS. This work may include responding to status changes and to control settings in CVNS that use or are dependent on the status of individual exchanges.

• Conduct Analytics – This area includes providing data to the ACJC that is necessary to perform data analytics.

7 It is not anticipated that noti�ications received by a LEA are presented to a LEA system at all. These noti�ications are intended for review by LEA staff. However, in order to assist a LEA wishing to further channel CVNS noti�ications, the CVNS System Requirements provide for the need of a data standard for noti�ications and the ability of the receiving LEA to save a noti�ication using that standard.

Solicitation No. BPM005579 Automated Crime Victims Notification System

Arizona Department of Administration State Procurement Office

Solicitation Requirements | Revision No. 6 | Revised 08-10 | Page 13 of 87

1.1.2. User Groups

The user groups are characterized below:

• Victims, et al - This group includes victims of crime as noted in police or crime reports, as well as their designees and other8s.

• LEAs - This group includes Law Enforcement Agencies within the meaning of H.B. 2842.

• LEAs’ RMS Vendors - This group includes the vendor(s) and any data exchange support providers of a participating LEA or a LEA planning to participate.

• CVNS - This group includes the managers of CVNS. The list below shows a breakdown by function:

o Operator o Administrator o Technical Lead o Security Officer

• ACJC - This group includes staff and authorized contractors of the ACJC.

8 For a full de�inition, refer to the glossary section of this document.

Solicitation No. BPM005579 Automated Crime Victims Notification System

Arizona Department of Administration State Procurement Office

Solicitation Requirements | Revision No. 6 | Revised 08-10 | Page 14 of 87

1.2. Description of Work to be performed

The work to be performed includes project management for, and planning, implementation and operation of CVNS. ACJC expects a proposer will identify all required tasks in their proposal (Proposal DEL-1). The work described in this section is meant to describe what the ACJC believes is minimally necessary in order to deploy and operate the System. Once a winning vendor(s) is identified, ACJC expects that vendor(s) to submit an adjusted task list (Contract DEL-1) at least one week prior to project kick-off.

The ACJC may choose to perform some or none of the Scope of Work. In any case, at project kick-off ACJC will identify which if any work it intends to carry out.

1.2.1. Project Management

The project management work includes creating, maintaining, organizing, delivering and reporting tasks. It also includes leading the team through the progression from a plan to the System in operation. Specific responsibilities include:

• Project management deliverables (DEL-1 and DEL-2).

• Workload forecasts for resources required to implement and operate CVNS.

• Bi-weekly project status updates including the gathering of data and context necessary to update the status, identify variances from the schedule and other plans, identify options to proceed and prepare the decision-making necessary

• Meetings as required, with policy makers, executives, project stakeholders, user groups, project team members, applicable vendors, and others as may be required to implement and operate CVNS.

1.2.2. Planning

The planning work for the System encompasses all work required to understand and validate the needs and requirements. From there, one must identify the resources required to address the needs and requirements. Finally, the work includes establishing the intended architecture and design of the System, designing its planned integration into the business processes of its users and defining the metrics and key success factors that the ACJC and the CVNS stakeholders consider successful. Specific work includes but is not limited to:

• Validate the requirements - The purpose of this work is to ensure that the requirements as stated are fully understood by the vendor(s) and that there is agreement between the vendor(s), the ACJC and proxies of the System’s user groups about what the requirements entail and how they will be implemented.

• Design the System – This work includes developing detailed architecture and design documents including UI design that trace back to the validated requirements. This work will also review the expansion options or integration

Solicitation No. BPM005579 Automated Crime Victims Notification System

Arizona Department of Administration State Procurement Office

Solicitation Requirements | Revision No. 6 | Revised 08-10 | Page 15 of 87 options relative to VINE, and include the applicable decision-making and planning for the integration option chosen.

• Design the System’s configurations – This work needs to produce a full list of the system configurations that govern the System behavior at runtime and that implement the validated requirements. These configurations should be grouped by the user group that is intended to administer them, e.g. overall system configurations administered by the CVNS operator team, LEA configurations administered by each participating LEA, crime victim configurations administered by a proxy of crime victims, and so on.

• Design the System’s configuration management – This work focuses on identifying and provisioning the System’s environments needed and the purpose of each, e.g. Development, Integration, Testing, Production. Provisioning includes making the applicable hosting arrangements with the vendor, a State Agency or ACJC at the discretion of the ACJC. This work also identifies the planned deployment processes between the environments for software/functionality, settings, data, documents, interfaces and logs. Finally, this work includes a detailed plan for introducing, testing and deploying System changes across environments prior to and including deployment on production.

This work needs to inform DEL-8 System Configuration Management Plan.

• Design the Systems’ performance management approach – This work includes setting performance objectives for the System. In turn, this includes defining what is meant by performance and establishing acceptable performance thresholds and allowance for outliers, for select individual System actions and for select user experiences of the various user groups. Once thresholds are established, this work moves on and produces a design document that lays out how the System is intended to achieve the desired performance targets and how performance will be measured, reported and if needed, acted on, after Go-live.

• Establish the System’s Test Plan – This work includes the identification of what is intended to be tested and what the applicable test methods are. The minimum scope of testing is functional, security and performance.

• Define the Training Plan – This work is about confirming the training needs and generating an initial version of DEL-11. The work considers the various user groups and areas of functionality of the System. Train-the-trainer training methods should be available but not relied upon as the only or the primary method for delivering training.

• Plan the marketing of CVNS – This work is intended to assist in the adoption of CVNS. Adoption includes both use by crime victims and LEA participation.

1.2.3. Implementation

The implementation work for the System uses the work performed and the work products generated during Planning, and delivers a working production system. This work includes:

Solicitation No. BPM005579 Automated Crime Victims Notification System

Arizona Department of Administration State Procurement Office

Solicitation Requirements | Revision No. 6 | Revised 08-10 | Page 16 of 87

• Developing software - Code the notification system and implement the software configurations based on the approved design.

• Integrate with LEAs’ RMSs and other applicable services and systems, such as multi-modal messaging e.g. text, phone, email; language translation, artificial intelligence services, e.g. chatbot, language proposal service; and so on.

• Iteratively test the System during implementation – This work includes functional, performance, and security tests at a minimum. Test results that are consistently above acceptable thresholds will be used to make decisions about adjusting project scope, budget and/or time. Prolonged Test Failures can give rise to a contract cancellation for cause.

• Perform the initial Go-live Deployment – This work includes deploying the system to production. Depending on the VINE integration option selected during Planning, this work may also include data, document and user migration.

• Conduct training – This work consists of delivering training as described in DEL-

11. This work will include achieving sign-off by each participating LEA and by the

ACJC.

• Perform Initial LEA(s) onboarding – This work spans the preparations for, the implementation and the testing of data exchanges necessary with the participating LEA(s) prior to the System’s initial Go-live.

• Carry out the marketing plan – This work includes implementing the marketing plan defined during Planning.

1.2.4. Operation

The operation work is focused on ensuring the System keeps operating, new users are sufficiently trained, user experiences are not diminishing, new software versions including those that deliver enhancements are properly and safely integrated and newly participating LEAs are onboarded from time to time.

• Perform system monitoring - This includes the identification, tracking and resolution of issues.

• Conduct System Maintenance – This work provides regular update and maintenance of the system to ensure optimal performance. It also includes the deployment of system enhancements.

• Perform Support Operations – This work includes end-user support and training as required, but also consulting and onboarding support for LEAs that are considering opting into CVNS.

• Implement LEA Onboarding – This work includes all tasks necessary to onboard a LEA and ensure that the applicable data exchange is implemented in accordance with the CVNS data exchange architecture, applicable security requirements and CVNS data exchange monitoring.

• Conduct ongoing Marketing – this work includes the activities of a CVNS client relationship manager. The client relationship manager will coordinate and assist

Solicitation No. BPM005579 Automated Crime Victims Notification System

Arizona Department of Administration State Procurement Office

Solicitation Requirements | Revision No. 6 | Revised 08-10 | Page 17 of 87 in developing marketing material templates9 such as brochures, posters, tear-pads in physical and digital formats, as well as banners, ads and marketing communications content for online marketing.

• 1-800 Desk – This area of work includes the planning for, implementation and operation of the Statewide Dedicated Crime Victim Services 24x7x365 toll-free line. <needs the corresponding planning and implementation>

1.3. Mandatory Requirements:

1.3.1. Offerors are required to complete and pass the Arizona Mandatory Control Baseline Prerequisite Assessment (https://azdohs.gov/file/4357) and submit as part of their Offer. Arizona Department of Homeland Security (AZDOHS) Cyber Command will evaluate and rank submitted Arizona Baseline Infrastructure Security Controls for completeness, attention to detail, and understanding of NIST security controls and framework. AZDOHS Cyber Command will forward assessment results and recommendations to the Procurement Officer. Results of these IT security control reviews are for internal use only and will not be shared with responding bidders, though the results may be used by the Procurement Officer to determine Offeror susceptibility for award.

1.3.2. Pursuant to State Data Classification Policy P8110, and the Data classification defined in the Special Terms and Conditions, the Contractor will have access to the following type of Data as part of its work under the Contract:

☐ Low Impact Data (AZRAMP 125 / NIST Low Impact) ☐ Moderate Impact Data (AZRAMP 325 / NIST Moderate Impact)

*** System Functionality – 1. Receive Notifications ***

1.3.3. The System must send a notification to the applicable victims et al, and any LEAs that have requested to be notified via one or more LEA notification request profiles, as soon as Minimum Incident or Investigation Data (MIID) is readily available in a participating LEA's system of record.

1.3.4. This Initial Notification must be sent in accordance with the notification settings of the LEA that is following up on the incident or investigation, or otherwise is deemed to maintain a case or file number of the incident or investigation.

1.3.5. Once the System has sent the initial notification under 3.1.3, the System must keep sending notifications every time another defined notification trigger occurs and is entered in the system of record of participating LEAs, in accordance with the prevailing notification settings at the time a trigger occurs, as requested by the victim et al, those set the participating LEAs and those of the System.

9 Templates are intended for use by participating LEAs and to support branding requirements shown in the System Requirements document under Work Area 4 – Manage Noti�ication Attachments.

https://azdohs.gov/file/4357 https://azdohs.gov/information-security-policies-standards-and-procedures

Solicitation No. BPM005579 Automated Crime Victims Notification System

Arizona Department of Administration State Procurement Office

Solicitation Requirements | Revision No. 6 | Revised 08-10 | Page 18 of 87

1.3.6. The System must minimally support the following notification triggers:

• Incident or investigation with a file or case number. For notifying victims et al, one known phone, phone with a text feature, or email contact option with a victim is required.

• Crime report filing date

• Detective assigned to the file or case.

• Arrests

• Warrants

• Case or file sent to prosecuting agency.

• Initial appearance of a defendant.

• Others as may be requested by ACJC during vendor planning activities

1.3.7. The System must support the following notification channels: phone, texting and email. The default channel scope of any notification is all three channels. The System must provide an option to temporarily reduce the available notification channels system-side.

1.3.8. The System must send notifications using the channel(s) per the channel settings of the participating LEA, and within these settings per the notification preferences of a victim et al and LEAs that are receiving notifications.

1.3.9. The System must allow the LEA to attach one or more files to any notification.

File formats include but are not limited to PDF.

1.3.10. The System must provide the LEA, System Administrators and ACJC with a notification preview function in each applicable channel for each notification trigger.

1.3.11. The System must allow for any notification to be configured in English, and automatically versioned for other languages.

1.3.12. The System must support the following notification options for a victim et al:

• Channels

• Language(s)

• Headers

• Notification Content

• Attachments

• Others as may be requested by ACJC during vendor planning activities

1.3.13. For a concerned citizen, the System must support notification options that are the same or a subset of those available to a victim at al. for a concerned citizen:

1.3.14. The System must provide a participating LEA the capability to set notification options as determined by the ACJC during the planning activities for CVNS as described in this SOW.

1.3.15. The System must allow any Arizona LEA to set up and maintain one or more LEA notification request profiles.

1.3.16. The System must allow a concerned citizen to set up and maintain one or more concerned citizen notification request profiles.

1.3.17. The System must feature all notification headers in a way that communicates the subject and importance at the beginning of the header.

Solicitation No. BPM005579 Automated Crime Victims Notification System

Arizona Department of Administration State Procurement Office

Solicitation Requirements | Revision No. 6 | Revised 08-10 | Page 19 of 87

1.3.18. The System must support notifications that include one or more clickable links, attachments and other actionable items such as a clickable/tappable phone number.

1.3.19. The System must provide the ability for any Arizona LEA to retrieve or otherwise obtain status information at any time on a case or file that is readily available in the system of record of a participating LEA. This is in addition to notifications that an Arizona LEA may be receiving on the basis of LEA notification profiles it may have set up.

1.3.20. The System must provide a victim et al and a concerned citizen who is receiving notification an option to temporarily suspend and an option to permanently cancel their account. A temporary account suspension must stop all notifications to and access to the notification settings of the victim et al and the concerned citizen. An account cancellation will disallow the victim et al and the concerned citizen to log in.

1.3.21. The System must maintain a log of activities and notifications for each user type, including administrative System and LEA users.

1.3.22. They System must connect a victim et al and a concerned citizen who may have canceled their account, with their personal notification and activity history on their canceled account in the event that the victim et al and a concerned citizen elect to request access to CVNS again.

1.3.23. The System must provide any user who can manage notification options with a re-set function that sets all notification options to the full extent available to the user.

*** System Functionality – 2. Multi-agency Notifications ***

1.3.24. The System must give each participating LEA the option to configure and maintain the notification settings available in the System thar relate to their cases, files and offenders in the LEA's custody.

1.3.25. The System must send notifications to another LEA when the other LEA has subscribed to receiving notifications on a specific case, file or known offender, subject to the notification settings of the sending LEA.

1.3.26. The System must give the sending LEA visibility into which notifications were not received and/or not read/opened by the recipient.

1.3.27. The System must provide the sending LEA with a feature that allows the LEA to re-send any notifications, in particular but not only those that the System shows as not having been received and/or not been read/opened.

1.3.28. The System must, at the option of the receiving LEA for one or all of the messages it receives, save any notification to the LEA's network or local device/machine in a standard format. The standard format must use one or more of the following: Comma Separated Value (CSV), Extensible Markup Language (XML), Java Simple Object Notation (JSON).

Solicitation No. BPM005579 Automated Crime Victims Notification System

Arizona Department of Administration State Procurement Office

Solicitation Requirements | Revision No. 6 | Revised 08-10 | Page 20 of 87

1.3.29. The System must provide an option to withdraw or otherwise roll-back a notification sent in error as determined by the sending LEA at any time after the withdrawn or roll-back message was sent.

1.3.30. The System must maintain all user and System activity and notification data.

1.3.31. The System must provide a user interface to LEA and System administrative users for viewing, filtering, sorting and exporting data maintained per requirement 2.7.1, as well as current and historic notification settings.

1.3.32. The System must identify and maintain as data, per requirement 3.1.32, all technical notification errors including sending and receiving errors.

Note that requirements for System Functionality areas 3 and 4 as depicted in Section

1.1 are not shown individually. This is because requirements in other areas provide substantive coverage.

*** System Functionality – 5. Set up Notification and Alerts ***

1.3.33. The System must show the victim et al, and the concerned citizen what the current and historic System and LEA notifications options are.

Note that requirements for System Functionality areas 6 and 7 as depicted in Section

1.1 are not shown individually. This is because requirements in other areas provide substantive coverage.

*** System Functionality – 8. Administer CVNS ***

1.3.34. The System must provide System management consoles and/or dashboards in order monitor the notification and data exchange activity across the System and in respect to individual LEAs, victims et al, and concerned citizens.

1.3.35. The System must provide performance indicators and benchmarks in a manner that is sufficient for the System Administrator to gauge System health and behavior, and to address questions and concerns about system downtime, unavailability and slow performance.

1.3.36. The System must provide user account management features to the various administrator type users as follows:

• To a LEA administrator, in respect to individual LEA users.

• To a LEA RMS vendor administrator, in respect to individual LEA RMS vendor users.

• To a Systems administrator, in respect to individual System users, LEA users, LEA RMS vendor users, victim et al. users, concerned citizens users.

• To an ACJC administrator, in respect to individual ACJC users.

1.3.37. The System must provide features for users to be presented with, review and accept/reject usage and account policies from time to time. The System must

Solicitation No. BPM005579 Automated Crime Victims Notification System

Arizona Department of Administration State Procurement Office

Solicitation Requirements | Revision No. 6 | Revised 08-10 | Page 21 of 87 maintain a log of policy acceptance/rejection actions and display the currently active policies.

*** System Functionality – 9. Manage Security ***

1.3.38. The System must not be developed, implemented or operated in a way that violates criminal justice security provisions and frameworks, such as the NIST Cybersecurity Framework, CJIS Security Policy, and others as identified by the ACJC during the planning activities for the System as described in this SOW.

1.3.39. The System must at all times have the most recent security settings and patches installed. This requirement applies to the System under development and in operation, in any of its environments unless so approved by ACJC and for the purpose of iterative testing and deployment across environments.

1.3.40. The System must be subject to security tests including penetration tests, vulnerability assessments, cross-scripting and other attempts of accessing the System or any of its data in a non-authorized way as determined by ACJC.

*** System Functionality – 10. Onboard LEAs ***

1.3.41. The System must provide API options and one or more alternative ways for exchanging data.

*** System Functionality – 11. 1-800 Desk ***

1.3.42. The System must include a 1-800 Desk that provides 24x7x365 access to live operators. The 1-800 Desk must support DTMF, TTS, and multi-lingual technology. The 1-800 Desk must support multiple languages.

1.3.43. The System must record when outbound notifications are sent/made, when a recipient sees a text, when a recipient answers a call, when an answering machine answers a call, when a call is unanswered, when an email is opened and when any of the action options are chosen that may be part of the notification sent, for example click on links, click/tap on a phone number.

1.3.44. When it fails, the System must gracefully fail over, without an interruption that is onerous on the users or creates a notification void.

*** System Functionality – 12. APIs ***

Solicitation No. BPM005579 Automated Crime Victims Notification System

Arizona Department of Administration State Procurement Office

Solicitation Requirements | Revision No. 6 | Revised 08-10 | Page 22 of 87

1.3.45. The System must provide a list and applicable status of its APIs and any other data exchange mechanisms implemented, whether in use or not. For data exchanges in use, the System must indicate which API or other data exchange mechanism is used with which participating agency, when that use started and ended, and what data was exchanged during use.

*** System Functionality – 13 Support data exchange with LEAs’ RMSs **

1.3.46. The System must have an identified data integration architecture and at least two integration methods, with one method via Application Programming Interface (API), that support starting, monitoring and interrupting data exchanges with the RMSs of participating LEAs.

1.3.47. The System must have a user interface available to the vendor or support service provider of a LEA's RMS, as…