DSD24-1824_SOW_-_Section_II.pdf

California Department of Motor Vehicles RFO #DSD24-1824, Section II

Exhibit A, Page 1 of 17

A. BACKGROUND

The Department of Motor Vehicles (DMV) is working to streamline its processes embarking on multiple efforts to ensure that technology is updated and processes are optimized throughout the DMV. Technological solutions have been identified to improve the customer experience and encourage those with DMV business that can be accomplished outside a DMV office to use other channels, thereby reducing congestion and wait times in field offices.

All original and some renewal driver license applicants are required to pass a knowledge test administered in a DMV field office. The DMV Knowledge Testing program delivers over 5 million exams across 21 tests and 35 languages. DMV currently uses automated Touch Screen Terminals (TSTs) in Field Offices and also delivers these exams online. The DMV has recently deployed an eLearning solution hosted on the DMV infrastructure that offers Renewal license applicants the opportunity to take an eLearning course that serves as a Continuing Education alternative to taking a knowledge test. This eLearning solution hosted on the Totara Learning Management System (LMS) has multiple software components and is tightly integrated into the DMV workflows. Customers will be accessing this solution during and outside DMV office hours, including on weeknights and over weekends.

CONTRACT DESCRIPTION AND SCOPE

The Contractor shall provide Maintenance and Operation services for the Totara Software stack, supporting an estimated load of 4,000 concurrent users, with an uptime of 99.9% for the application. The software stack is hosted by the DMV on the Amazon Web Services (AWS) cloud.

The Totara Software Stack includes the following applications and workflow integrations:

1. Totara Learn Subscription - Unlimited v12+

2. mySQL - Backend User Storage, Course Information

3. HTTPS - Security Protocols - Amazon Certificate Manager - (as part of the

Master Template)

4. Ubuntu - Server that Totara rests on -- AWS EC2 - AMI ID (Amazon

Machine Image) into the template

5. PHP code - Both Totara code and Custom code to Support DMV Totara specifications

6. Totara APIs to communicate the completion codes

7. Receipt of authentication through SAML (initial handshake) from requesting Identity Provider

The Maintenance and Operation Services will include, at a minimum, the following:

Exhibit A, Page 2 of 17

1. Responding to defects in the Totara Stack and remediation of such defects.

2. Proactively maintaining software to stay current with new versions and security patches.

3. Providing support and troubleshooting to DMV AWS admins for any application performance issues.

4. Recommending any changes to procedure for automated DMV backups of the Production environment.

5. Assisting the DMV in keeping Disaster Recovery (DR) validation procedures current.

6. Managing and troubleshooting the Totara software stack including the following tasks:

a. Totara System Administration (Vendor will have the administrative rights over the Totara application stack in the DMV environments that hosts it)

b. Totara User Administration includes adding and removing internal DMV users

c. Recommending changes to Load Balancing configuration for Production to manage changes in usage

d. Request and oversee system resource adjustments (CPU, memory, and storage) to the environments by the DMV.

e. Any certificates (patches/updates) that are required to ensure the Totara stack is operating.

f. Enable the DMV in pulling standard reports from the LMS including:

i. User: Courses Started vs Courses Completed

ii. Access for All Users: Session Duration and Frequency

iii. Users Enrolled w/ Filter for Last Login

iv. Course Completion: Activity – Last 30 Days

g. Ensuring eLearning content (SCORM files) is launching

h. Maintaining mySQL (configuration and tables)

i. Tuning and configuration of HTTPS

j. Installing and maintaining any plugins required to ensure the application is operating

k. Installing patches as required (Ubuntu, php code etc.)

7. Performing defect fixes pertaining to the Totara Software stack. Any defect fixes will be first deployed in the Development (Dev) environment, promoted through System Test (ST) and UAT environments and final promotion to PROD.

8. Providing technical expertise as per the service level agreements (SLAs) for the Production environment. This may include all hands-on-deck troubleshooting after the DMV has followed troubleshooting process and determined that the issue is within the Totara Stack.

9. Defect resolution including providing timely resolution based on the agreed upon SLAs for all Critical, Serious, Moderate severity defects in alignment with

Exhibit A, Page 3 of 17 DMV Incidents, Severity_v2.1 document within the Totara software stack in the

Production environment. Defects for the eLearning effort pertaining to Totara including the user experience will be identified in the DMV defect management system (HP-ALM) and will be shared with Contractor.

10. Release and Configuration Management, including progressive promotion of the fixes from Dev to System Test (ST), User Acceptance Test (UAT) and then PROD environments, will have the Release Notes for each promotion after successful testing in the Development environment (no critical, serious, moderate severity defects related to the Totara suite per DMV’s defect management system) has been performed. Release notes are to be submitted to the DMV and the DMV will gain approval within the required timeframe before release.

Contractor is responsible for configuration management including version control, source control (for PHP - GIT Hub) and deployment for the Totara software stack in the PROD environment and will provide release notes for any fixes to the Totara software stack. Release notes will include:

A. a description

B. details surrounding changes (including qualified names) for documentation and necessary approvals within DMV’s change control process.

11. Providing Production problem investigation and root cause report in DMV standard template for DMV Executive Management.

12. Providing Technical Expertise to DMV personnel, as per the SLAs, when needed, collaboratively troubleshooting issues with the eLearning solution or disruptions to a customer experience.

13. Providing technical expertise to DMV admins to monitor and maintain the cloud instance including infrastructure support (if needed) to ensure the continued performance and uptime of the Totara software stack in DMV’s Production environment. Contractor AWS team will work with the DMV to ensure proper monitoring of the application stack.

14. Customization or modifications, as needed, to the eLearning solution including system upgrades, but not limited to API changes, content updates, modifications to the user journey, UI changes or translation utilizing the Deliverable Expectation Document process in Section H.

15. Providing weekly timesheets and status reports for the technical support provided with summary of activities performed.

16. Knowledge transfer and training the DMV team on M&O of the solution.

B. CONTRACT TERM

The base term of the contract shall be (1)year(s). The contract shall include two (2), one (1) year options to extend and add funds accordingly.

Exhibit A, Page 4 of 17 It is understood that no funds sufficient for the purpose of this order have been appropriated until such time as the budget for each fiscal year covered by the agreement has been adopted by the Legislature and signed by the Governor.

C. CONTRACTOR’S RESPONSIBILITIES

1. The Contractor shall assume responsibility for completion of work identified in

Exhibit A, Statement of Work and in accordance with Exhibit G, Information Security and Privacy Provisions (4/2022).

2. The Contractor’s staff listed in this contract shall have legal authority to work in the United States during the term of the entire contract if they are on-site staff.

3. The Contractor’s staff listed in this contract shall undergo and clear a background check prior to that individual commencing any work under this contract if they are working on the DMV’s physical site or have access to sensitive or personal data (including Personally Identifiable Information (PII)). The background check shall be processed by an authorized Department of Justice (DOJ) Live Scan site. Failure of the proposed staff to pass the background check will ban that individual from commencing any work under this contract and the Contractor shall propose a replacement staff person within five (5) business days.

The DMV will provide authorized DOJ Live Scan services at DMV Headquarters in Sacramento, CA, at no additional cost to the Contractor’s staff listed in this contract until the DMV discontinues the service to all Contractors. At that point, the Contractor is responsible for any costs incurred to complete the required background check. In any case, if the Contractor staff listed in this contract use the DOJ Live Scan at other locations, the Contractor is responsible for any costs incurred to complete the required background check. NOTE: The DOJ background check is only available for staff located in the United States;

therefore, staff located outside of the United States shall not have access to sensitive or personal data.

4. Contractor shall ensure that contractor’s staff maintain telecommunication and internet connectivity to perform all duties required in this contract.

5. The Contractor shall prepare all deliverables, where applicable, in accordance with the State’s, and DMV’s, applicable business and information technology documentation standards and requirements, including format and content.

6. If requested, the Contractor shall attend project meetings and periodic briefings for DMV’s management as indicated by the DMV Contract Manager (refer to Section F, #6 for identification of DMV Contract Manager).

7. If the Contractor staff are determined to be part of the conflict-of-interest program, then the staff listed in this contract shall comply with Government Code section 87302 and the Fair Political Practices Commission rules. The Contractor shall not permit any staff to work on this contract unless the staff is in compliance with Government Code section 87302 and the Fair Political Practices Commission rules (http://www.fppc.ca.gov/the-law/fppc-regulations/regulations-index.html). Staff may be required to complete and file a Form 700, “Statement of Economic Interests,” which is a disclosure of financial

Exhibit A, Page 5 of 17 interested. Refer to this link for additional information:

http://www.fppc.ca.gov/Form700.html\.

8. If the Contractor staff are determined to be part of the conflict of interest program, then the staff (and replacement staff) listed in this contract shall comply with Conflict of Interest Program, Article 12 (commencing with section 11146) of Chapter 1 of Part 1 of Division 3 of Title 2 of the Government Code, requires that all staff in designated conflict of interest (COI) positions attend ethics orientation training within six months of becoming a filer, and at least once during every consecutive period of two calendar years commencing on the first odd-numbered year thereafter. The purpose of the orientation is to familiarize Contractor staff with California's ethics policies in order to help avoid conflict of interest situations. No compensation for completion of the ethics training or related expenses will be provided.

9. The Contractor’s staff listed in this contract shall:

a. Complete the Department of Motor Vehicles online Privacy & Information Security Awareness Training, prior to commencement of work on this contract and annually thereafter.

b. Provide a signed hardcopy of Exhibit E, Confidentiality Statement prior to commencement of work on this contract.

c. Provide a signed hardcopy of Exhibit F, DMV Acceptable Use Statement, (DMV 350) prior to work on this contract.

d. Complete the Department of Motor Vehicles Telework/Remote Access Security Standard Training (when applicable).

10. The Contractor Official responsible for overseeing completion of services, approval of Deliverable Acceptance Documents (DAD), approval of Personnel Change Orders (PCO), and to whom all communications relative to those services be addressed is:

Name:

Telephone Number:

Email Address:

11. It is DMV policy that “User authentication and access authorization decisions will be performed within a security layer that is separate from the application business logic”. Before application business logic is initiated, the security layer will verify the user’s authorization to perform the requested process. For any proposed applications that will be used by DMV employees or Government and Industry Partner employees, the Contractor shall integrate the web-based application with the Secure Access Infrastructure (SAI) (ISAM and ISIM) deployment, including security header contents and proposed access groups or the non-web based application will utilize Microsoft Active Directory (AD) or some other repository that utilizes Lightweight Directory Access Protocol (LDAP).

12. Contractor staff shall provide, with each deliverable, detailed Network and/or System Architecture Diagrams for any network/system created or altered.

Exhibit A, Page 6 of 17

13. The Contractor shall ensure employee compliance with all sexual harassment training requirements under California law (Government Code section 12950.1). In the event that the Contractor has less than five employees in California, the Contractor shall ensure that its employees have sexual harassment training commensurate with the requirements under California law.

14. All tasks associated with this contract may be performed remotely and/or on-site at 2415 First Avenue, Sacramento, CA 95818, as determined by the DMV Contract Manager. The approval to work remotely is required in writing from the DMV’s Contract Manager and Chief Information Security Officer (CISO), to ensure the work has a secure remote connection and storage on DMV drives/servers. If remote work is approved, it must be performed within the continental United States. Contractor personnel shall perform their duties on the premises of the DMV or remotely, if approved, during DMV’s regular business days and normal work hours of 7:00 am to 5:00 pm Pacific Time except State holidays, except as specifically agreed to otherwise in writing by the DMV Contract Manager. There will be no increase in hourly rates for extended hours or days.

15. The Contractor shall comply with all applicable health and safety laws and regulations at the Contractor’s own expense. Upon notice by the DMV, the Contractor shall also comply with the DMV’s specific health and safety requirements and policies. The Contractor also agrees to include in any subcontract related to the performance of this Agreement, a requirement that the subcontractor comply with all applicable health and safety laws and regulations, and upon notice by the DMV, the DMV’s specific health and safety requirements and policies.

16. Contractor shall comply with the Department of Transportation Federal Motor Carrier Safety Administration Non-Discrimination Assurances located at:

https://www.dmv.ca.gov/portal/file/fmcsa-appendix-a-and-e-pdf/

17. Prior to expiration of the contract, the Contractor shall return all State property, including security badges to the DMV Contract Manager.

18. SMALL BUSINESS PARTICIPATION AND DVBE PARTICIPATION REPORTING

REQUIREMENTS:

A. If for this Contract the Contractor made a commitment to achieve small business participation, then the Department requires the Contractor upon completion of this Contract to report the actual percentage of small business participation that was achieved. (Govt. Code § 14841)

B. If for this Contract the Contractor made a commitment to achieve the disabled veteran business enterprise (DVBE) participation goal, then, pursuant to Mil. & Vets. Code § 999.5(d), upon completion of this Contract, the Department requires the Contractor to certify using the Prime Contractor’s Certification – DVBE Subcontracting Report (STD 817), all of the following:

(i) The total amount the prime Contractor received under the Contract;

Exhibit A, Page 7 of 17

(ii) the name, address, Contract number and certification ID number of the DVBE(s) that participated in the performance of this Contract;

(iii) the amount and percentage of work the prime Contractor committed to provide to one or more DVBE(s) under the requirements of the Contract and the total payment each DVBE received from the prime Contractor;

(iv) that all payments under the Contract have been made to the DVBE(s); and

(v) the actual percentage of DVBE participation that was achieved.

Upon request, the prime Contractor shall provide proof of payment for the work.

C. If for this Contract the Contractor made a commitment to achieve the DVBE participation goal, the Department will withhold $10,000 from the final payment, or the full final payment if less than $10,000, until the Contractor complies with the certification requirements above. The Contractor shall e-mail the STD 817 to dmvasdsbdvbeadvocate@dmv.ca.gov.

D. A Contractor that fails to comply with the certification requirement shall, after written notice, be allowed to cure the defect. Notwithstanding any other law, if, after at least 15 calendar days but not more than 30 calendar days from the date of written notice, the prime contractor refuses to comply with the certification requirements, the Department shall permanently deduct $10,000 from the final payment, or the full payment if less than $10,000. (Mil. & Vets.

Code § 999.7).

E. A person or entity that knowingly provides false information shall be subject to a civil penalty for each violation. (Mil. & Vets. Code § 999.5(d); Govt. Code § 14841).

F. Contractor agrees to comply with the rules, regulations, ordinances, and statutes that apply to the DVBE program as defined in Section 999 of the Mil.

& Vets. Code, including, but not limited to, the requirements of Section 999.5(d). (PCC Code § 10230).

19. Contractor shall comply with Executive Order N-6-22, Economic Sanctions Against Russia. The Executive Order is available at the following website:

https://www.gov.ca.gov/wp-content/uploads/2022/03/3.4.22-Russia-Ukraine- Executive-Order.pdf.

On March 4, 2022, Governor Gavin Newsom issued Executive Order N-6-22 (the EO) regarding Economic Sanctions against Russia and Russian entities and individuals. “Economic Sanctions” refers to sanctions imposed by the U.S.

government in response to Russia’s actions in Ukraine, as well as any sanctions imposed under state law. By submitting a bid or proposal, Contractor represents that it is not a target of Economic Sanctions. Should the State determine Contractor is a target of Economic Sanctions or is conducting prohibited transactions with sanctioned individuals or entities, that shall be grounds for rejection of the Contractor’s bid/proposal any time prior to contract execution, or, if determined after contract execution, shall be grounds for termination by the State.

Exhibit A, Page 8 of 17

20. During the term of this contract, Contractor must notify the State in writing if their services or any work under this contract includes, or makes available, any previously unreported GenAI technology, including GenAI from third parties or subcontractors. Contractors shall immediately complete the GenAI Reporting and Factsheet (STD 1000) to notify the State of any new or previously unreported GenAI technology. At the direction of the State, Contractor shall discontinue the use of any or previously undisclosed GenAI technology that materially impacts functionality, risk, or contract performance, until use of such GenAI technology has been approved by the State. Failure to disclose GenAI use to the State and submit the GenAI Reporting and Factsheet (STD 1000) may be considered a breach of the contract by the State at its sole discretion and the State may consider such failure to disclose GenAI and/or failure to submit the GenAI Reporting and Factsheet (STD 1000) as grounds for the immediate termination of the contract. The State is entitled to seek any and all relief to which it may be entitled to as a result of such non-disclosure. The State reserves the right to amend the contract, without additional cost, to incorporate GenAI Special Provisions into the contract at its sole discretion and/or terminate any contract that presents an unacceptable level of risk to the State.

21. The Contractor shall provide to the DMV Contract Manager a copy of the insurances listed below within 10 calendar days after contract award. The State requires that the Certificate Holder on the Certificate of Insurance include the DMV’s address as: Department of Motor Vehicles, 2415 1st Avenue, Sacramento, CA 95818, and the DMV Contract Number.

A. General Provisions Applying To All Insurance Policies

1. Coverage Term:

Coverage shall be in force for the entire term of this contract. If insurance expires during the term of this contract, a new certificate of Insurance shall be received by the DMV at least ten (10) business days prior to the expiration of the insurance. Any new insurance shall comply with the original terms of this contract.

2. Policy Cancellation of Termination and Notice of Non-Renewal:

The Contractor shall provide to the DMV, within five (5) business days following receipt by the Contractor, a copy of any cancellation or non-renewal of insurance required under this contract. In the event the Contractor fails to keep the required insurance coverage in effect at all times, the DMV may, in addition to any other remedies it may have, terminate this contract upon the occurrence of such event.

3. Deductible

The Contractor is responsible for any deductible or self-insured retention contained within their insurance program.

4. Primary Clause

Any required insurance specified under this contract shall be primary, and

Exhibit A, Page 9 of 17 not excess or contributory to any other insurance carried by the DMV.

5. Insurance Carrier Required Rating

All insurance companies shall carry a rating acceptable to the Department of General Services (DGS), Office of Risk and Insurance Management (ORIM). Per DGS ORIM, an acceptable rating is “A” or better, and financial size category of “VII” or better to the latest edition of the A.M. Best Key Rating Guide. If the Contractor is self-insured for a portion or all of its insurance, a review of the Contractor’s financial information, including a letter of credit, may be required.

6. Endorsements

Any required endorsement shall be physically attached to all requested certificates of insurance and not substituted by referring to such coverage on the certificate of insurance.

7. Inadequate Insurance

Inadequate insurance or lack of insurance does not negate the Contractor’s obligations under this contract.

When requested by the DMV, the awarded contractor shall provide the DMV with all of the following certificate(s) of insurance (Note: The DMV shall not be responsible for any premiums or assessments on insurance policies).

B. Commercial General Liability

1. Throughout the term of this contract, the Contractor shall provide the DMV with a valid certificate of insurance stating that there is commercial general liability insurance presently in effect for the Contractor with limits of not less than $1,000,000.00 per occurrence for bodily injury and property damage liability combined. The policy shall include coverage for liabilities arising out of premises operations, independent contractors, products/completed operations, personal and advertising injury, and liability assumed under an insured contract. This insurance shall apply separately to each insured against whom claim is made or suit is brought subject to the Contractor’s limit of liability.

2. The insurance policy shall include the following additional insured endorsement that shall be supplied under form acceptable to DGS, ORIM:

The State of California, its officers, agents and employees are included as additional insured, but only with respect to work performed for the State of California.

C. Automobile Liability

By signing this contract, the Contractor certifies that the Contractor and any of their employees or subcontractors using a vehicle in the performance of

Exhibit A, Page 10 of 17 work under this contract possesses valid automobile liability coverage in accordance with California Vehicle Code Sections 16450 to 16457, inclusive.

The DMV reserves the right to request proof at any time.

D. Workers Compensation

1. Throughout the term of this contract, the Contractor shall provide the DMV with a valid certificate of insurance stating that there is workers compensation insurance presently in effect for the Contractor, if the Contractor employs any person, in any manner, that is subject to the Workers Compensation Laws of California. The Contractor shall maintain statutory worker’s compensation and employer’s liability coverage for all its employees who will be engaged in the performance of this contract.

Employer’s liability limits of not less than $1,000,000.00 are required. If the Contractor does not employ any person, in any manner, so as to not become subject to the Workers Compensation Laws of California, the Contractor shall complete and submit to the DMV Contract Manager or Administrator, a Workers Compensation Exemption Certification form.

2. In the event the Contractor becomes subject to the Workers Compensation Laws of California during the term of this contract as a result of hiring employees to perform required services under this contract, the Contractor shall provide the DMV within ten (10) calendar days of hiring employee, with a valid certificate of insurance stating that there is workers compensation insurance presently in effect for the Contractor.

The Contractor shall maintain statutory worker’s compensation and employer’s liability coverage for all its employees who will be engaged in the performance of this contract. Employer’s liability limits of not less than $1,000,000.00 are required.

3. The Contractor’s workers compensation insurance policy shall be endorsed with a waiver of subrogation in favor of the State of California in the event the Contractor employs any person, in any manner, that is subject to the Workers Compensation Laws of California.

E. Professional Liability

1. Throughout the term of this Agreement, the Contractor shall provide the DMV with a valid certificate of insurance stating that there is professional liability insurance presently in effect for the Contractor with limits of not less than $1,000,000.00 per occurrence and $3,000,000.00 in the aggregate, covering any damages caused by a negligent error, act, or omission.

2. By signing this Agreement, the Contractor certifies that the carrier of any professional liability insurance required in the performance of this Agreement has knowledge of the Contractor’s extension of services to the DMV.

Exhibit A, Page 11 of 17

D. DMV’S RESPONSIBILITIES

1. Provide access to business and technical documentation as necessary for the Contractor to complete the tasks identified under this contract.

2. Provide access to the DMV staff, management, offices and operation areas as required to complete the tasks defined under this contract.

3. The DMV will be available to provide general guidance, information, and facilitation activities including access to DMV Subject Matter Experts such as, DMV business analyst(s), DMV system analyst(s), and DMV programming staff as necessary for the Contractor to complete the tasks defined under this Contract.

DMV will not provide any resources to complete the Contractor responsibilities.

4. Provide contractor staff with normal office working facilities and equipment if work occurs at DMV Headquarters.

5. If needed, invite the Contractor to appropriate project meetings.

6. The DMV Contract Manager is responsible for overseeing the Contractor’s performance, the Contractor’s completion of requested services, and approval of the Deliverable Acceptance Documents (DAD), Invoices and Personnel Change Orders (PCOs) is:

Name:

Telephone Number:

Email Address:

or

Name:

Telephone Number:

Email Address:

7. The DMV Contract Administrator is the department’s point of contact responsible for coordinating communication and contract documentation between the Contractor and the DMV Contract Manager and to whom all communications relative to those services be addressed. The DMV Contract Administrator is also responsible for the approval of the Personnel Change Orders (PCO) and invoices. The Contract Administrator will forward approved invoice(s), the related DAD(s), deliverable(s), status reports, and timesheets to the IT Acquisitions Unit for auditing purposes.

Name:

Exhibit A, Page 12 of 17 or

Name:

E. CONTRACTOR TASKS/DELIVERABLES

The following table identifies tasks and deliverables that are required by this SOW.

The final version of each deliverable is to be presented to the DMV’s Contract Manager for review and approval or rejection. Do not begin work on a deliverable unless written authorization has been obtained by the DMV Contract Manager.

TASKS/DELIVERABLE

1. Task #1: Maintenance and Operations Service:

The Contractor shall provide maintenance and operation services for the Totara Software stack, supporting an estimated 4,000 concurrent users, throughout the term of this contract.

Maintenance and Opeations Service Deliverable #1: Technical Support

1. Technical Support that meets SLAs

Include Training and Knowledge Transfer for the DMV team.

Deliverable #2: Reports:

1. Upon request of the DMV, step by step instructions for the DMV to pull standard reports below from the LMS using existing documentation:

a. User: Courses Started vs Courses Completed

b. Access for All Users: Session Duration and Frequency

c. Users Enrolled w/Filter for Last Login

d. Course Completion: Activity – Last 30 Days

2. Provide monthly reports listed below with standard cadence or within 2 days of DMV request:

a. # Users enrolled Labeled in LMS as “Users Enrolled w/ Filter for Last Login”

Exhibit A, Page 13 of 17

b. # Users who complete the course Labeled in LMS as “Course Completion: Activity – Last 30 Days”

Deliverable #3: Documentation:

1. Documentation (RCA template) of Production Issues, Problem Investigation and root cause reports for DMV Executive Management (facilitated by DMV IT) pertaining to the Totara Software Stack.

2. Release Notes

A. Payment for Maintenance and Operation Services will be monthly in arrears, upon DMV Contract Manager written acceptance, in accordance with the Section J, Payment Terms and Invoicing Requirements.

2. The tasks listed below may be initiated by the DMV. As specific tasks and deliverables are identified, DMV and the Contractor will execute a DAD in accordance with the process described in Section H of this SOW.

a. TASK 1 – Course customization and updates: Modify or update the developed content to satisfy a specific DMV Business need.

b. TASK 2 – Workflow modifications:

Develop new Integration capabilities to support DMV designed workflows.

c. TASK 3 – Translation: Translate the course into any of the languages that the DMV supports for Knowledge testing.

d. Task 4 – System Upgrades Customization or modifications, as needed, to

The Contractor will submit each deliverable to the DMV Contract Manager with the level of detail and quality consistent with the DAD approved by the DMV.

Exhibit A, Page 14 of 17 the eLearning solution including upgrades, but not limited to API changes, content updates, modifications to the user journey, UI changes or translation utilizing the Deliverable Expectation Document process in Section H.

F. DELIVERABLE ACCEPTANCE OR REJECTION

All work shall be submitted for review and approval or rejection with the following process:

1. The Contractor shall submit each deliverable with the level of detail and quality consistent with Section G. Contractor Tasks/Deliverables to the DMV Contract Manager for review and approval or rejection, via an Exhibit B, Deliverable Acceptance Document.

2. A signed Exhibit B, Deliverable Acceptance Document, is required from the DMV Contract Manager before processing an invoice for payment. The DAD shall accompany any invoice submitted by the Contractor.

3. Should a DAD be rejected, the DMV Contract Manager will provide written documentation to the Contractor Official to correct the deficiencies in the deliverable.

4. All Deliverables shall be provided in a format compatible with the DMV Project Office standard applications (Microsoft Office 2019 or above). In all cases, the Contractor shall verify application compatibility with the DMV Contract Manager prior to creation or delivery of any electronic documentation. Any deviations from these standards shall be approved in writing by the DMV Information Systems Division (ISD) and Information Security Office (ISO).

5. All deliverables are the sole property of the DMV.

6. Payment for tasks performed under this contract shall be by deliverable. It shall be the DMV’s sole determination as to whether a deliverable has been successfully completed and is acceptable to the DMV.

G. PAYMENT TERMS AND INVOICING REQUIREMENTS

1. Payment will not be issued until the DMV Contract Manager and Contractor

Official have approved the DAD as stipulated in this contract.

2. Invoices submitted shall reference the DAD number, and the IT Acquisitions Contract Number TAXX-XXX.

Exhibit A, Page 15 of 17

3. The DMV will pay the Contractor flat monthly rate in arrears as noted in Exhibit D.

4. The DMV will not be obligated to pay on an invoice until the status reports and timesheets required herein are received by the DMV Contract Manager or Contract Administrator. The DMV may dispute an invoice that does not comply with this Contract’s requirements, including requirements for invoices, timesheets and status reports, and a dispute notice given on that basis shall satisfy the requirements of the California Prompt Payment Act.

5. In the event a deliverable is not completed prior to the contract expiration or termination date, the DMV may pay for partial work completed in accordance with the General Provisions – IT (GSPD-401IT).

6. Project costs related to items such as travel, per diem and travel time to the designated base of operation for the engagement are costs to be included within the contractor rates. DMV will not pay for such costs as a separate item.

7. DMV Accounts Payable will pay only those invoices approved by the DMV Contract Manager or Contract Administrator and verified by the IT Acquisitions Unit.

8. Invoices shall be emailed to: ACCT_INV@dmv.ca.gov

H. REPORTING REQUIREMENTS

1. The Contractor shall prepare a (monthly) written status report to the DMV

Contract Manager with the current status and future activities. This report shall include, but not be limited to, the following information:

a. A summary of the work completed during the reporting period, including the identity of the person doing the work and the task or deliverable to which the work is attributable;

b. A summary of the work planned for the next reporting period including the identity of the person doing the work and the task or deliverable to which the work is attributable;

c. The status of the over-all project, including all phases and tasks, and any problem(s) encountered and solution(s) implemented or proposed.

d. A list and description of issues encountered during the reporting period.

2. Status reports shall be submitted with the invoices.

I. PROBLEM OR ISSUE ESCALATION

Disputes will follow the process identified in the General Provisions - IT. (GSPD-401IT)

J. CURE NOTICES

Cure notices will follow the process identified in the State’s General Provisions.

Exhibit A, Page 16 of 17

K. STAFF REPLACEMENT

1. The Contractor shall act as the prime contractor under this contract. In addition to identifying all classifications and staff proposed to work under this contract, the Contractor shall also identify their sub-contractor affiliation as applicable.

2. The DMV reserves the right to disapprove the continuing assignment of Contractor staff and require the Contractor to provide replacement staff (during the contract and any applicable optional years). If the DMV exercises this right, the Contractor shall terminate the staff from the contract within three (3) business days of notice by the DMV. The Contractor shall then submit replacement staff within five (5) business days. Before services can be rendered, each replacement Contractor staff added to this contract will require approval by DMV in accordance with the PCO process described in paragraph 6 below. An amendment to the contract is not required for Contractor staff replacements.

3. The Contractor shall notify the DMV Contract Manager at least five (5) business days prior to any Contractor staff being replaced or removed by the Contractor under the terms of this contract, along with their sub-contractor affiliation as applicable. Before services can be rendered, each Contractor staff replacement will require approval by DMV in accordance with the PCO process described in paragraph 6 below. An amendment to the contract is not required for Contractor staff changes.

4. In the event replacement staff are rejected by the DMV Contract Manager, the Contractor shall continue to submit replacement staff until the DMV Contract Manager approves such replacement staff. A failure to provide suitable replacement staff, as determined solely by the DMV, shall constitute a breach of this contract and shall entitle the DMV, at its sole election, to pursue all of its available legal remedies.

5. Upon approval of the replacement of existing staff’s by the DMV Contract Manager, a PCO shall be initiated as follows:

a. Contractor staff changes shall be initiated by the Contractor via Exhibit C, Personnel Change Order.

b. Each PCO shall include the replacement staff that has been accepted by the DMV Contract Manager or Contract Administrator.

c. The replacement staff will not begin work on a contract deliverable until the Contractor Official, DMV Contract Manager or Contract Administrator, DMV IT Acquisitions Analyst, and DMV IT Acquisitions Manager have approved the PCO.

6. The PCO shall be initiated when contractor staff leave the contract (removal of staff) or are added to the contract (replacement of staff).

7. Replacement of the DMV Contract Manager, DMV Contract Administrator, or Contractor Official may be completed through the PCO process described above. An amendment to the contract is not required for replacement of the DMV Contract Manager, DMV Contract Administrator, or Contractor Official.

Exhibit A, Page 17 of 17

8. If working on the DMV’s physical site or have access to sensitive or personal data

(including Personally Identifiable Information), replacement staff or staff added to this contract shall undergo and pass the Department of Justice background check prior to that individual commencing any work under this contract (refer to Section E, #3 of this SOW for specific details).

L. AMENDMENTS

1. Should, during the course of this contract, it become necessary to modify the terms of this Statement of Work (Exhibit A), those modifications shall be through a written amendment to the contract.

2. A written contract amendment shall not be effective until fully executed by both parties. No oral understanding or agreement not incorporated through the proper contractual process shall be binding on either the Contractor or the DMV.

3. Contractor resources will not be expended, at a cost to the DMV, in excess of the authorized contract cost.

4. Any amendment to the contract not in the scope of the contract will require a fully approved Non-Competitively Bid justification.

Exhibit B, Page 1 of 1

DELIVERABLE ACCEPTANCE DOCUMENT

CONTRACTOR NAME:

DMV CONTRACT NUMBER: DAD NUMBER:

DELIVERABLE TITLE:

DELIVERABLE COMPLETION DATE:

TOTAL COST OF APPROVED DELIVERABLE: $

AMOUNT TO INVOICE $

DELIVERABLE DESCRIPTION:

DMV’S ACCEPTANCE OR REJECTION:

AUTHORIZED AND APPROVED:

CONTRACTOR OFFICIAL

PRINT NAME, SIGN, AND DATE

DMV CONTRACT MANAGER

PRINT NAME, SIGN, AND DATE

Payment will not be issued until the DMV Contract Manager and Contractor Official have approved the DAD as stipulated in this contract.

Exhibit C, Page 1 of 1

PERSONNEL CHANGE ORDER

CHANGE ORDER NO._______________

Contractor Name: __________________________ Contract Number: ________________

Start Date: ___________________ or upon approval by the DMV IT Acquisitions Manager, whichever occurs later.

Description of Change:

Staff Name: __________________________________________

Phone Number: ___________________________________________

Email Address: ____________________________________________

Reason for Change:

Approval:

Changes identified above are in accordance with the terms and condition of the contract.

By signing below, the Contractor Official has confirmed that the proposed staff meets the requirements and qualifications listed in Exhibit A, Statement of Work.

The DMV Contract Manager or Contract Administrator’s signature below indicates that he/she has confirmed that the proposed staff meets the qualifications listed in Exhibit A, Statement of Work.

Contractor Official Print Name, Sign, and Date

DMV Contract Manager and/or Contract Administrator

By signing below, the DMV IT Acquisitions Manager and DMV IT Acquisitions Analyst have confirmed that the proposed staff meets the requirements.

DMV IT Acquisitions Manager

DMV IT Acquisitions Analyst/Date

Notes: (1) The DMV Contract Manager or Contract Administrator will submit Personnel Change Order forms to the IT Acquisitions Analyst to obtain DMV IT Acquisitions Manager approval.

Exhibit D, Page 1 of 1

COST DATA SHEET

PLACEHOLDER PAGE – INTENTIONALLY LEFT BLANK

VENDOR’S RFO SECTION I COST DATA SHEET

WILL BE INSERTED HERE AS AN EXHIBIT UPON CONTRACT AWARD

Exhibit E, Page 1 of 2

CONFIDENTIALITY STATEMENT

Confidentiality Statement for Contractor

As an authorized representative or corporate officer of the company named below, I have the authority to bind the company contractually, and I agree that all persons employed by this company will adhere to the following policy:

All information belonging to the California Department of Motor Vehicles (DMV) is considered sensitive and confidential and cannot be disclosed to any person or entity that is not directly approved to participate in the work required to execute this Agreement.

I certify that I will keep all project information including (but not limited to) information concerning the planning, processes, development or procedures of the project, and all communication with DMV or its affiliates related to any procurement process, confidential and secure. I will not copy, give or otherwise disclose such information to any other person unless DMV has on file a Confidentiality Statement signed by the other person(s), and the disclosure is authorized and necessary for the project. I understand that the information to be kept confidential includes, but is not limited to, specifications, administrative requirements, terms and conditions, concepts and discussions, as well as written and electronic materials. I further understand that if I leave this project before it ends, I must still keep all project information confidential. I agree to follow any instructions provided by the project relating to the confidentiality of project information.

I fully understand that any unauthorized disclosure I make may be basis for civil and/or criminal penalties.

I agree to advise the DMV Contract Manager immediately in the event of an unauthorized disclosure, inappropriate access, misuse, theft or loss of data.

I warrant that if my company is awarded the Contract, it will not enter into any agreements or discussions with a third party concerning such materials prior to receiving written confirmation from the DMV that such third party has an agreement with the DMV similar in nature to this one.

All materials provided for this Project, except where explicitly stated will be promptly returned or destroyed, as instructed by an authorized DMV representative. If the materials are destroyed and not returned, a letter attesting to their complete destruction, which documents the destruction procedures, must be sent to the DMV Contract Manager before payment can be made for services rendered. In addition, all copies or derivations, including any working or archival backups of the information, will be physically and/or electronically destroyed within ten (10) calendar days immediately following either the end of the Contract period or the final payment, as determined by the DMV.

All staff assigned to this project shall be provided a Confidentiality Statement and will be expected to sign and return it to the DMV’s Contract Manager before beginning work on this project.

Representative Name: Title:

Phone Number:

Company Name:

Address:

City/State/Zip Code:

Signature:

Date:

Exhibit E, Page 2 of 2

CONFIDENTIALITY STATEMENT, continued

Confidentiality Statement for Staff

As an authorized representative of the company named below, I agree to adhere to the following policy:

All information belonging to the California Department of Motor Vehicles (DMV) is considered sensitive and confidential and cannot be disclosed to any person or entity that is not directly approved to participate in the work required for this Contract.

I certify that I will keep all project information including (but not limited to) information concerning the planning, processes, development or procedures of the project, and all communication with DMV or its affiliates, confidential and secure. I will not copy, give or otherwise disclose such information to any other person unless DMV has on file a Confidentiality Statement signed by the other person(s), and the disclosure is authorized and necessary for the project. I understand that the information to be kept confidential includes, but is not limited to, specifications, administrative requirements, terms and conditions, concepts and discussions, as well as written and electronic materials. I further understand that if I leave this project before it ends, I must still keep all project information confidential. I agree to follow any instructions provided by the project relating to the confidentiality of project information.

I fully understand that any unauthorized disclosure I make may be basis for civil and/or criminal penalties.

I agree to advise the DMV Contract Manager immediately in the event of an unauthorized disclosure, inappropriate access, misuse, theft or loss of data.

All materials provided for this Project, except where explicitly stated will be promptly returned or destroyed, as instructed by an authorized DMV representative. If the materials are destroyed and not returned, a letter attesting to their complete destruction, which documents the destruction procedures, must be sent to the DMV Contract Manager before payment can be made for services rendered. In addition, all copies or derivations, including any working or archival backups of the information, will be physically and/or electronically destroyed within ten (10) calendar days immediately following either the end of the Contract period or the final payment, as determined by the DMV.

Representative Name: Title:

Phone Number:

Company Name:

Address:

City/State/Zip Code:

Signature:

Date:

Exhibit F, Page 1 of 2

DMV ACCEPTABLE USE STATEMENT

Exhibit F, Page 2 of 2

DMV ACCEPTABLE USE STATEMENT, continued

Exhibit G, Page 1 of 8

INFORMATION SECURITY AND PRIVACY PROVISIONS (04/2022)

In the performance of this Agreement, [Contractor] agrees to protect all Department of Motor Vehicles (DMV) information by implementing the necessary controls to comply with State mandated security and privacy requirements provided in California State Administrative Manual (SAM), National Institute of Standards and Technology (NIST), Federal Information Processing Standards (FIPS), Government Code §11015.5 and §11019.9, Vehicle Code, and California Information Practices Act (IPA) Civil Code §1798 et seq. The Contractor further agrees to implement the minimum administrative, physical, technical, and safeguards identified in this Agreement. The Contractor shall protect DMV information for the terms and length of this Agreement and while in possession of, maintaining, or accessing DMV information. The Contractor shall ensure any third parties adhere to these same provisions.

A. DEFINITIONS – For purposes of this Exhibit, the following definitions shall apply:

1. Contractor shall generally refer to any entity, private or public organization hired or working in conjunction with or for DMV to provide deliverables.

2. Data shall mean a representation of facts, concepts, or instructions in a formalized manner suitable for communication, interpretation, or processing by humans or by automated means.

3. DMV Information shall refer to DMV provided data.

4. Confidential Information shall have the same meaning as those terms in SAM, IPA, Civil Codes, and related Government Codes.

5. Personal Information shall have the same meaning as those terms in SAM, IPA, Civil Codes, and related Government Codes.

6. Sensitive Information shall have the same meaning as those terms in SAM, IPA, Civil Codes, and related Government Codes.

7. Personnel shall refer to any Contractor employees, volunteers, contractors, sub-contractors commissioned, employed by, or otherwise engaged in the performance of work associated with the Contractor.

8. Systems shall refer to workstations, laptops, servers, network, and other information processing components managed and hosted by Contractor which process, store, or transmit DMV information.

9. Users shall refer to any Contractor personnel with access to DMV information.

Exhibit G, Page 2 of 8

B. ADMINISTRATIVE SAFEGUARDS

1. DATA OWNERSHIP

DMV information provided under this Agreement remains DMV exclusive property. Confidential, sensitive, and personal information is not open to the public and requires special precautions to protect from loss and unauthorized use, disclosure, modification, or destruction.