EINF71823_-_Scope_of_Work.pdf

State Controller’s Office RFQ-ITS Number EINF71823 Sample Agreement, Exhibit A

SCOPE OF WORK

A. Description of Services

The Contractor shall provide the State Controller’s Office (SCO) with annual licenses for online access to cybersecurity training, tools, templates, and cybersecurity guidance, which is a Software-as-a- Service (SaaS) solution.

Agreement Term

The term of this Agreement will be for a period of three years with the option to amend to add/delete licenses, and add funds as deemed necessary by SCO. The rates on Sample Agreement, Exhibit B, Attachment 1, Cost Worksheet will not change as a result of any amendment to this agreement.

Contractors are cautioned that no services will begin until the Agreement has been fully executed. If services are performed prior to agreement approval, and the Agreement for any reason is not approved, all previous services performed by the Contractor is considered donated to SCO and no payment shall be made for that work.

Agreement Amount

The Contractor and SCO Representative listed in Exhibit A, SOW, Section D. Contacts, Item 1 are responsible for monitoring the Agreement to not exceed the maximum amount of the Agreement without an executed amendment.

B. Contractor Responsibilities

1. The Contractor shall:

a. Provide 24 full, annual licenses. Each license shall provide unlimited access to the following:

1) Allow users to set up, coordinate, initiate, and participate in cybersecurity expert calls.

2) Online portal including expert write-ups, research reports, and recordings.

3) Allow users to attend forums, symposiums, and webinars.

b. Provide unlimited requests to a network of cybersecurity experts, which includes:

1) Phone calls up to 60 minutes with a cybersecurity expert to discuss a specific topic or question.

2) The ability to poll cybersecurity experts and receive short written responses from cybersecurity expert members.

3) The ability to receive a written response prepared by a cybersecurity expert member to an SCO request or question..

c. Provide access to a peer community for information and sharing of best practices within the information security (InfoSec) field, which includes:

1) Monthly presentations featuring cybersecurity expert members examining current InfoSec events.

2) Virtual and in-person roundtable discussions exclusively for Chief Information Security

Officers (CISOs) and senior level InfoSec executives to learn and share insights in a confidential setting, led by staff and cybersecurity expert by invitation.

3) Virtual forums and educational events including keynote addresses, cybersecurity expert led breakout sessions, technology spotlight sessions, and networking breaks. Up to five SCO credential holders may attend in-person forums.

4) Virtual symposiums with cybersecurity expert led deep-dive explorations of technical and operational information security topics, free of vendor presence.

d. Provide access to an online portal, which includes:

1) Cybersecurity expert written, topical reports, anonymized write-ups answering client written questions, and anonymized transcripts of expert call discussions.

2) A searchable database of anonymized questions from other member’s cybersecurity expert sessions.

3) On-demand recordings of symposiums and webinars.

4) A collection of tools, toolkits, templates, checklists, matrices, and maps with step-by-step guidance for tackling specific InfoSec initiatives and completing common tasks.

5) Daily coverage on security topics from key news publications, formatted in business language to brief the key internal stakeholders and executive staff. This includes live quarterly cybersecurity expert briefings and incident briefings with recordings.

6) Access to incident command center pages spun up to follow developments on major events.

e. Provide aggregated third-party InfoSec information formatted in ready-to-use Microsoft PowerPoint slides, executive briefings, infographics, and InfoSec themed graphics library, to support internal communications to SCO executive staff.

f. Provides a dedicated stream of research from cybersecurity experts and customers to help research, select, and implement vendors in key security domains. This should contain technology recommendations, market overviews, and real-life case studies of vendor selection and implementation.

g. Provides live and recorded cybersecurity expert-led online instruction. Each course includes three to six hours of expert-led instruction with a hands-on, interactive element built into the session design, delivered in one-day or two-day formats and which include:

1) Accessible live online training available to anyone from SCO.

2) Online training library through on-demand access to all users.

h. Provide participants with one Continuing Professional Education (CPE) credit per hour for utilizing:

1) Expert phone calls.

2) Decision making Support Webinars.

3) Forums.

4) Symposiums.

5) Live Online Trainings.

6) On-demand recordings on portal, including but not limited to, symposium replays, webinar replays, executive communications briefings, tech briefings, and online trainings.

i. Provide customer support services during normal business hours, Monday through Friday, 8:00 a.m. to 5:00 p.m. Pacific Time (PT), excluding weekends and State holidays. State observed holidays may be found at http://www.calhr.ca.gov/employees/pages/state-holidays.aspx.

C. SCO Responsibilities

1. SCO shall:

a. Identify a Contract Manager to be the primary contact and administer licenses.

b. Provide the Contractor with a user list and inform Contractor of any changes to the user list during the Agreement term.

c. Contact customer support as needed.

d. Provide additional details to the Contractor as requested.

D. Contacts

1. The Contract Manager for technical service inquiries will be:

State Controller’s Office –

Information Security Office (ISO)

Contractor

(TBD)

Name: Name:

Address: Address:

Phone: Phone:

E-mail: E-mail:

2. Direct all agreement inquiries to:

State Controller’s Office –

Contracts & Procurement Office

Contractor

(TBD)

Name: Name:

Address: Address:

Phone: Phone:

E-mail: E-mail:

3. Contacts may be changed upon written notice to either party without an agreement amendment.

Sample Agreement, Exhibit B

BUDGET DETAIL AND PAYMENT PROVISIONS

A. Invoicing and Payment

1. For services satisfactorily rendered, and upon receipt and approval of the invoices, SCO agrees to compensate the Contractor for actual expenditures incurred in accordance with the rates specified in Exhibit B, Attachment 1, Cost Worksheet.

2. Itemized invoices shall be submitted on Contractor’s letterhead, not more frequently than annually, in arrears, and include at a minimum:

Agreement Number INF71823 Dates of Service Description of Service Provided

If submitting electronically, send one PDF copy to: ADMAP@sco.ca.gov

If invoices cannot be submitted electronically, please mail one copy to:

State Controller's Office

Departmental Accounting Office P.O. Box 942850

Sacramento, CA 94250-5877

Direct invoice inquiries to: ADMAP@sco.ca.gov

B. Budget Contingency Clause

1. It is mutually agreed that if the Budget Act of the current year and/or any subsequent years covered under this agreement does not appropriate sufficient funds for the program, this agreement shall be of no further force and effect. In this event, SCO shall have no liability to pay any funds whatsoever to Contractor or to furnish any other considerations under this agreement and Contractor shall not be obligated to perform any provisions of this agreement.

2. If funding for any fiscal year is reduced or deleted by the Budget Act for purposes of this program, SCO shall have the option to either cancel this agreement with no liability occurring to SCO, or offer an agreement amendment to Contractor to reflect the reduced amount.

C. Prompt Payment Clause

1. Payment will be made in accordance with, and within the time specified in, Government Code (GC) Chapter 4.5, commencing with Section 927 et seq.

Sample Agreement, Exhibit B, Attachment 1

COST WORKSHEET

Cost Worksheet to be inserted upon Agreement award.

Sample Agreement, Exhibit C

GENERAL TERMS AND CONDITIONS

General Provisions – Cloud Computing – Software as a Service (SaaS) General Provisions (Effective and Revised 6/21/2022) shall be incorporated by reference only and made part of the Agreement as if attached hereto.

Cloud Computing – Software as a Service (SaaS) General Provisions (Rev. 6/21/2022) https://www.dgs.ca.gov/-/media/Divisions/PD/PTCS/OPPL/Model- Language/CloudComputing_SaaSGeneralProvisions062122.pdf?la=en&hash=7B3D8F241D1486B9CA44

AAE0932AA21BBBE19D74