ESBD_484604_1769182322879_EXHIBIT A_Statement of Work.pdf

RFO 212-26-0281

EXHIBIT A: STATEMENT OF WORK

Texas Office of Court Administration Judicial Information Security Project

Statement of Work

EXHIBIT A: STATEMENT OF WORK (SOW)

The Office of Court Administration seeks to procure licenses for a System that has the ability to: 1) detect the online display of Covered Information (CI) regarding Texas judges, their immediate family members residing with them, court clerks and additional court personnel, and judicial branch personnel, and 2) request the persons or entities displaying the information remove the information from online publication and cease any dissemination of the information. Ideally, the System would also have the ability to assist with the detection of active threats. The System must comply with the core function requirements outlined in the Requirements Response Workbook (Exhibit C) and the Vendor must meet the requirements of this Statement of Work. The selected Offeror (Contractor) will also be required to provide training for Authorized Users and OCA staff.

1. Implementation Services Contractor must work with OCA to establish a standard implementation of the System. In addition, the selected Offeror will work with OCA to create an implementation schedule that provides a deployment date that is no later than 45 business days from the Effective Date. The Contractor should consider that many Authorized Users may have limited technical expertise. Contract deliverables for Implementation Services are described separately below. Following the completion of each deliverable, OCA will review to determine whether the work meets the specified requirements. Acceptance by OCA of any Deliverable stated in this SOW shall not foreclose or diminish OCA’s right to demand strict compliance with the Contract if defects in the System or deviations from the requirements of the Contract are discovered following acceptance.

1.1. Deliverable 1: Project Initiation

1.1.1. Activities

Contractor must:

1. Conduct a project kick-off meeting with key stakeholders identified by OCA within 10 days of the Effective Date to introduce team members, discuss baseline project schedule, training approach, and deployment approach.

2. Finalize the project schedule with due dates of all deliverables with input from OCA staff not later than thirty (30) days after the Effective Date.

3. Conduct meetings with OCA to develop approach for deploying the System, training Authorized Users, and developing a warranty process.

1.1.2. Work Products

1. Project schedule that includes all tasks, deliverables, dependencies and resource requirements to complete the Project.

2. Final Deployment Plan, developed with input from the OCA team to include the approach for deploying the system to Authorized Users and OCA staff, training plan to ensure a successful implementation, and ongoing production support.

1.2. Deliverable 2: Configuration/Validation

1.2.1. Activities

1. Facilitate design sessions: Capture and confirm requirements and review prototypes through facilitated discussion with OCA Subject Matter Experts.

2. Develop and/or configure features based on agreed upon requirements and deploy to test environment.

3. Assist OCA staff in user acceptance testing and sign-off.

1.2.2. Work Products

1. Requirements specification and design document that includes captured and confirmed requirements and design documents/prototypes.

2. Completed user acceptance testing and documentation of OCA sign-off.

1.3. Deliverable 3: Training

1.3.1. Activities

1. Perform an instructor-led training for the OCA Court Security Team to walk through all functions, features, and processes of the system, allowing time for questions and answers.

1.3.2. Work Products

1. Training guides, Computer Based Training, training videos, and/or webinars, sufficient to guide Authorized Users with limited technical expertise and aid internal OCA users in assisting Authorized Users. Any training tool to be used for training Authorized Users must be submitted to and approved by OCA no later than 15 days before deployment.

1.4. Deliverable 4: Deployment

1.4.1. Activities

1. Contractor will complete and implement all remaining Deployment Plan tasks and begin production support.

1.4.2. Work Products

1. OCA staff have received their account information and have successfully logged into the production system.

2. The number of Authorized Users as agreed upon in the Deployment plan, have been assigned licenses and have successfully logged into the production environment.

2. Maintenance and Support The Offeror shall provide a written proposal for ongoing technical and maintenance support of the product to include scheduled and prior notification of outages. Offeror shall provide information on the number of quarterly and/or annual updates to the system.

The Contractor shall provide OCA with documentation on its Change Management Process. At a minimum, the documentation should detail how the Contractor handles change management and describe the maintenance windows used to update the system.

At a minimum, the Contractor shall provide customer support to all categories of end‐users Monday through Friday, 8:00AM – 6:00PM Central Time. The Offeror may submit optional pricing for an extended hours support window that covers more hours than the minimum support requirement.

2.1. Maintenance

The Offeror shall describe how it performs the following ongoing maintenance functions:

a. Provide product updates for the system. Indicate the normal release schedule and maintenance windows.

b. Provide patches, updates and other enhancements for the system which are not part of the product update releases.

c. Provide documentation updates.

d. Verify all changes to the system in a test environment before promoting the changes into production.

e. Provide maintenance of any third‐party software incorporated into the system.

f. Address end of support or end of life for third‐party product components included in the

System.

2.2. Support

The Offeror shall provide a written proposal for ongoing technical support of the delivered product. The Proposal shall discuss Help Desk support and problem resolution, including:

a. Access method(s) (such as a 1.800 number, Internet chat, email)

b. Days and hours of operation, holiday and after‐hours coverage, including initial response time commitments for each.

c. Problem logging and tracking mechanism

d. Documentation of problem history and resolution

e. Service Level Agreement (SLA) for all issue resolutions

f. Penalty schedule in the event that the SLA is not met

g. Application and distribution process for system fixes

h. Escalation process for unresolved reported or identified issues

i. How any third‐party software incorporated as part of the System shall be supported

j. Availability to act as the single point of contact (if multiple vendors are used)

3. Service Levels and Reporting The purpose of these requirements is to ensure that the proper elements are in place to provide the system users with the optimal level of system performance. The Service Level Standards define the terms, conditions, requirements, responsibilities, and obligations of OCA, system users, and the Contractor. The Contractor shall begin providing Service Level Reporting when the System moves into the Maintenance, post‐Warranty.

3.1. Service Level Reporting

The Contractor shall provide monthly reporting to OCA on the following metrics, at a minimum:

a. Number of incident tickets raised, number of tickets resolved, and average time to resolve. These numbers must be grouped by Service Level Defect Types, as defined in Section 3.3.

b. System outages (both planned and unplanned) along with the amount of time the system was unavailable.

c. Copies of any root cause analysis (due to unplanned outage) from the past month.

d. Statistical information that indicates that Service Level Standards are being met. If any

Service Level Standard is not met, Contractor must provide a written plan (and must execute the plan) to resolve the issue(s) which contribute to the failure to meet the Service Level Standard.

e. Any security incidents and responses to them.

3.2. Service Level Standards

The Contractor must meet, at a minimum, the following service levels each month.

a. Application Availability – The Contractor must guarantee a 99.9% monthly average of scheduled availability for all application components. In the event the application is not available; OCA shall be notified of operational impact and updated every two hours until service is restored.

b. Defect Resolution – All Critical level defects must be resolved within 4 hours of notification of the defect by OCA or an Authorized User to the Contractor. All High level defects must be resolved within 3 business days of notification of the defect by OCA or an Authorized User to the Contractor. All Medium level defects must be resolved within 10 business days of notification of the defect by OCA to the Contractor. Low level defects must be resolved within 90 business days of notification of the defect by OCA to the Contractor.

3.3. Service Level Defect Types

The following definitions will be used to identify the levels of defect types, after the system has gone into Maintenance.

a. Critical ‐ System is down or unusable, resulting in a negative impact to business operations. There is no alternative or bypass available.

b. High – System does not operate as described in the user documentation resulting in impaired business operations, no alternative or bypass is available.

c. Medium – System performance is degraded but there is no critical impact on business operations. An alternative or bypass is available.

d. Low – Minor fault or cosmetic issue discovered, but there is no impact on System functionality or operations, or to business operations.

4. Firm Fixed Price Respondent must complete all requirements stated herein, including subsequent revisions and clarifications, for the firm fixed price listed on the cost workbook for deliverables and licenses within the time frame noted in the Baseline Project Schedule for each deliverable. The fixed-deliverable price is for conducting the work described in the SOW, and change orders for cost are only considered for increases in that defined work. OCA is greatly committed to this project and will work with Contractor to mitigate risk and resolve issues

5. Definitions Unless otherwise defined, the definitions set forth below define terms used in this Statement of Work, Service Level Agreements, Service Level Requirements, and Requirements Workbook.

Authorized User means a person licensed to use the System, as authorized by the Texas Office of Court Administration.

Court Security Division means the personnel assigned to OCA’s Judicial Security Division established pursuant to Texas Government Code Sec. 72.015.

Covered Information (CI) has the meaning assigned under Texas Government Code Section 92.001(3) and includes the following:

(i) a home address, including primary and secondary residences;

(ii) a home or personal telephone number, including a mobile telephone number, used exclusively for purposes other than a business or commercial purpose;

(iii) an e-mail address;

(iv) a social security number or driver's license number;

(v) bank account, credit card, or debit card information;

(vi) a license plate number or other unique identifier of a vehicle owned, leased, or regularly used;

(vii) the identity of a child younger than 18 years of age;

(viii) a person's date of birth;

(ix) information regarding current or future school or day care attendance, including the name or address of the school or day care, schedules of attendance, or routes taken to or from the school or day care;

(x) employment information, including the name or address of the employer, employment schedules, or routes taken to or from the employer's location; and

(xi) photographs or videos that reveal information listed in subparagraphs (i)-(x).

Effective Date means the date a purchase order is signed.

Live Customer Support means real-time, human-delivered assistance provided to Authorized Users through communication channels such as phone, online chat, or other support channels allowing users to receive immediate help, answers, or problem resolution from a trained support representative without waiting for delayed responses (such as email or ticket systems), such as but not limited to password resets and user administration.

Program Summary Report means a concise, structured overview of the activities, performance, and outcomes over a defined reporting period. A summary of operational metrics and resource usage. A high-level summary of the information in Requirement 110 for all Authorized Users.