ESBD_File_341605_HHS0013505 HHS Cloud Fax Solution.pdf

Version 2.0 (12/13/2022) RFO No. HHS0013505 Page 1 of 56

Cecile E. Young, Executive Commissioner

Request for Offers (RFO) for

HHS Cloud Fax Solution RFO No. HHS0013505

Date of Release: December 27, 2023

Responses Due: January 26, 2024 by 10:30 a.m. Central Time

NIGP Class/Item Codes

(*) Automated Information Systems (AIS) 207-32 *Computer Instructional Aids and Training Devices 208-11 *Application Software, (Not Otherwise Classified), Microcomputer 208-44 *E-Mail Software, Microcomputer 208-68 *Project Management Software, Microcomputer 208-81 *Software for Computer Software Training, Microcomputer 715-47 Manuals: Parts, Personnel, Policy, Purchasing, Training, Etc., (Not Otherwise Classified) 915-36 *Facsimile, Fax Services 920-05 *Application, Infrastructure, Hosting, Data Hosting and Cloud Computing Services, Vendor

Hosted and Internally Hosted 920-45 *Software Maintenance and Support Services and Updates and Data Hosting Services 920-47 *Support Services, Computer, Includes Computer Warranties 920-91 *Training, Computer Based, Software Supported 924-16 Course Development Services, Instructional and Training 924-35 In-Service Training, Employees 924-40 *Instructor-Led, Classroom Training, Technical 924-41 Instructor-Led, Classroom Training, Non-Technical 952-90 *Training and Instruction Services, Clients, Not Staff

Version 2.0 (12/13/2022) RFO No. HHS0013505 Page 2 of 56

Table of Content Article I. Executive Summary, Definitions, and Authority

1.1 Executive Summary

1.2 Definitions

1.3 Authority

Article II. Scope of Work

2.1 Scope Overview

2.1.1 Project Scope

2.1.2 Project Scope Exclusions

2.2 Implementation Service Phase

2.2.1 Project & Security Management

2.2.2 Requirements Validation

2.2.3 Solution Design, Development,/Configuration

2.2.4 Testing

2.2.5 User Training

2.2.6 Deployment/Post-Implementation Support

2.2.7 SaaS (Hosting Solution and Provisioning)

2.2.8 Maintenance and Operations

2.2.9 Exit Turnover

2.3 Solution Requirements

2.3.1 Functional Requirements

2.3.2 Technical Requirements

2.3.3 Security Requirements

2.3.4 Texas Risk and Authorization Management Program (TX-RAMP)

2.4 Performance Requirements

2.4.1 Key Milestone Deliverables

2.4.2 Critical and High Severity UAT Defect Resolution Timeframe

2.4.3 Critical and High Security Production Defect Resolution Timeframe

2.4.4 Critical and High Severity Incident Resolution Timeframe

2.4.5 Security Incident Response Time

2.4.6 Disaster Recovery Restoration Timelines

Version 2.0 (12/13/2022) RFO No. HHS0013505 Page 3 of 56

2.4.7 Solution Availability

2.4.8 Solution Availability Notifications

2.4.9 Application Performance

2.4.10 Fax Volume

2.5 Payment Structure

2.5.1 General

2.5.2 Payee on Invoice Statements

2.5.3 Invoice Format

2.5.4 Retainage

2.6 Contract Award, Term, and Historical Compensation

2.6.1 Contract Award and Execution

2.6.2 Contract Term

2.6.3 Historical Compensation

2.7 Supplemental Services

2.8 Reduced Services

2.9 Data Use Agreement and Security Privacy Inquiry

2.10 No Guarantee of Volume, Usage, or Compensation

Article III. Administrative Information

3.1 Schedule of Events

3.2 Ambiguity, Conflict, or Discrepancy

3.3 Inquiries

3.3.1 Sole Point of Contact

3.3.2 Prohibited Communication

3.3.3 Exception to Sole Point of Contact

3.3.4 Solicitation Questions

3.4 Pre-proposal Conference

3.4.1 Attendance

3.4.2 Conference Logistical Information

3.4.3 Questions at Pre-Proposal Conference

3.5 Solicitation Response Composition

3.5.1 General Information

Version 2.0 (12/13/2022) RFO No. HHS0013505 Page 4 of 56

3.5.2 Page Limit and Supporting Documentation

3.5.3 Discrepancies

3.5.4 Exceptions

3.5.5 Assumptions

3.5.6 Binding Offer

3.6 Solicitation Response Submission and Delivery

3.6.1 Deadline

3.6.2 Submission Option

3.6.3 Submission Checklist

3.6.4 Labeling and Delivery for USB Submission and Other Materials

3.6.5 Modifications and Withdrawals

Article IV. Solicitation Response Evaluation and Award Process

4.1 Conformance with State Law

4.2 Best Value Determination

4.2.1 Selection Methodology

4.2.2 Minimum Qualifications

4.2.3 Initial Compliance Screening

4.2.4 Written Solicitation Response Evaluation

4.2.5 Written Response Evaluation Criteria

4.2.6 Summary of Best Value Determination

4.3 Questions or Requests for Clarification

Article V. Narrative/Technical Proposal

5.1 Narrative Proposal

5.1.1 Executive Summary

5.1.2 Project Work Plan

5.1.3 Key Staffing Profile

5.1.4 Implementation Services

5.2 Technical Proposal

5.2.1 Solution Functionality/Business Capabilities

5.2.2 Solution Technical Description

5.2.3 Performance Requirements

Version 2.0 (12/13/2022) RFO No. HHS0013505 Page 5 of 56

5.2.4 System Security and Disaster Recovery

5.2.5 National Institute of Standards and Technology

Article VI. Required Respondent Information

6.1 Company Information

6.1.1 Company Narrative

6.1.2 Company Profile

6.2 TX-RAMP Documentation

6.3 References

6.4 Major Subcontractor Information

6.5 Affirmations and Certifications

6.6 Other Reports

6.6.1 Dun and Bradstreet Reports

6.6.2 Financial Statements and Financial Solvency

6.6.3 Alternate Report

6.7 Corporate Guarantee

6.8 HUB Subcontracting Plan

6.9 Franchise Tax – Right to Transact Business in Texas

Article VII. Cost Proposal

7.1 Cost Proposal

Article VIII. General Terms and Conditions

8.1 General Conditions

8.1.1 Changes, Modifications, and Cancellation

8.1.2 Offer Period

8.1.3 Costs Incurred

8.1.4 Contract Responsibility

8.1.5 Public Information Act - Respondent Requirements Regarding Disclosure

8.1.6 Respondent Waiver – Intellectual Property

8.1.7 Standards of Conduct for Vendors

8.1.8 Disclosure of Interested Parties

8.2 Insurance

8.2.1 Required Coverage

Version 2.0 (12/13/2022) RFO No. HHS0013505 Page 6 of 56

8.2.2 Alternative Insurability

8.3 Protest

Article IX. List of Exhibits

Table of Tables Table 1: Current State Software Table 2: Current State Hardware Table 3: Implementation Service Domains Table 4: Deliverable Traceability (PM) Table 5: Deliverable Traceability (RV) Table 6: Deliverable Traceability (DE) Table 7: Deliverable Traceability (TE) Table 8: Deliverable Traceability (TR) Table 9: Deliverable Traceability (DH) Table 10: Deliverable Traceability (SP) Table 11: Deliverable Traceability (MO) Table 12: Deliverable Traceability (ET) Table 13: Technical Requirement Categories Table 14: Performance Requirements Table 16: HHSC Existing Incoming Fax Volume Table 17: HHSC Existing Outgoing Fax Volume Table 18: HHSC Existing Incoming Fax Peak Table 19: HHSC Existing Outgoing Fax Peak Table 20: HHSC’s Anticipated Future Year-Over-Year Cutover Page Volume

Version 2.0 (12/13/2022) RFO No. HHS0013505 Page 7 of 56

ARTICLE I. EXECUTIVE SUMMARY, DEFINITIONS, AND AUTHORITY

1.1 EXECUTIVE SUMMARY

The Texas Health and Human Services Commission (HHSC) is seeking a qualified Contractor to provide a modern Cloud Fax Solution that shall not modify the existing business processes but provide improved service availability, scalability, and ease of use for public service programs. The existing solution, RightFax, has been in place since 2004 and has a contract end date of August 31, 2024. HHSC is seeking a modern Cloud Fax Solution that is scalable and includes Disaster Recovery capabilities to minimize risk and vulnerability to business operations. The Cloud Fax Solution shall be highly reliable and able to accommodate both increases and decreases in volume.

Key business objectives include:

a. Establish a Cloud Fax Solution with Disaster Recovery and business continuity capabilities;

b. Implement a Cloud Fax Solution that will allow additional programs to be added; and

c. Reduce HHS IT technology and infrastructure footprint by contracting for a Cloud Fax Solution with support and maintenance delivered by a Contractor.

Note: Go Live, of the Solution must be planned for no later than February 25, 2025.

Currently, HHSC programs utilize RightFax and Xerox Multifunctional Printers for all faxing needs. These systems are responsible for processing thirty-two (32) million inbound faxes and eleven (11) million outbound faxes per year with RightFax and a combined sixty-one (61) million inbound and outbound faxes per year with the Xerox Multifunctional Printers. In the event of an unscheduled downtime with the existing fax system, there is an estimated five thousand (5,000) users and two hundred twenty-six (226) HHSC programs affected. The programs most affected by unscheduled downtime are:

a. Access & Eligibility Services (AES);

b. Early Childhood Intervention (ECI);

c. Medical Transport Services;

d. Judicial Review; and

e. Women’s Health.

Table 1: Current State Software

Software Items Description Location

RightFax a. Server Version: 10.6 SR3 FP7

b. Client Version: 10.6.3.7125

On Premise

(HHSC)

Version 2.0 (12/13/2022) RFO No. HHS0013505 Page 8 of 56

Table 2: Current State Hardware

Hardware Items Description Location

Hardware Inventory

a. Nine (9) Production (PROD) Servers;

b. Three (3) Development (DEV) Servers;

c. One (1) Network-Attached Storage (NAS) Drive;

d. Fifty-six (56) Toll Free Numbers (being used);

e. Fifty-five (55) Inbound Circuits;

f. Three (3) Common Language Location Identifier (CLLI’s) codes;

g. Thirty-two (32) Thermoplastic Fixture Wire Nylon (TFN) circuits;

h. Ten (10) Test Toll Free #’s;

i. Eleven (11) DHEC circuits;

j. Ten (10) Brooktrout TR-1034+P24H-T1-1N Fax Cards;

k. One (1) Brooktrout TR-1034+P24-T1 Fax Card; and

l. One thousand-five hundred (1,500) DID’s.

On Premise

(HHSC)

HHSC PCS will administer the procurement process for this Solicitation, which includes RFO publication, handling of communications from vendors, as well as managing the receipt of Solicitation Responses for review and evaluation.

To be considered for award, a Respondent must execute Exhibit A, HHS Solicitation Affirmations v. 2.4 and provide all other required information and documentation as set forth in this Solicitation.

Prior to award of the Contract, Respondent must obtain TX-RAMP Level 2 certification or TX- RAMP Provisional Certification. For this Solicitation, HHSC shall not provide “agency-sponsored” TX-RAMP Provisional Status certification to any Respondent.

Information regarding HHSC and its programs is available online and can currently be accessed at HHSC Website Address: https://www.hhs.texas.gov.

1.2 DEFINITIONS

Refer to Exhibit B, Health and Human Services (HHS) Uniform Terms and Conditions – Vendor, v. 3.4 for additional definitions.

As used in this Solicitation, unless a different definition is specified or the context clearly indicates otherwise, the following terms and conditions have the meanings assigned below:

https://www.hhs.texas.gov/

Version 2.0 (12/13/2022) RFO No. HHS0013505 Page 9 of 56

“Addendum” means a written clarification or revision to this Solicitation issued by HHSC PCS and posted to the ESBD.

“API” stands for Application Programing Interface.

“Award Consideration (AC) Documents” means documents Respondent must submit as part of the Solicitation Response to be considered for negotiations or award.

“Cloud Computing” consistent with Sections 2054.0593(a) and 2157.007 of the Texas Government Code, has the meaning assigned by Special Publication 800-145 issued by the United States Department of Commerce National Institute of Standards and Technology, as the definition existed on January 1, 2015 (https://csrc.nist.gov/pubs/sp/800/145/final) enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.

“Contract Term” means the period of time beginning with the commencement date or Effective Date of a Contract and ending when the Contract expires in accordance with its terms, or when it has been terminated.

“Effective Date” has the same meaning as the definition in Exhibit B, Health and Human Services (HHS) Uniform Terms and Conditions – Vendor, v. 3.4.

“ESBD” means the Electronic State Business Daily, the electronic marketplace where State of Texas bid opportunities over $25,000 are posted. The ESBD may currently be accessed at http://www.txsmartbuy.com/esbd.

"Go Live” refers to when the project and/or product will be live in the production environment for the first time (no later than February 25, 2025).

“HHSC” stands for Health and Human Services Commission.

“HHSC PCS” means Procurement and Contracting Services (PCS), a division of HHSC.

“HTTP” stands for Hypertext Transfer Protocol.

“HUB” means Historically Underutilized Business, as defined by Chapter 2161 of the Texas Government Code.

“HUB Subcontracting Plan” or “HSP” means written documentation regarding the use of subcontractors, which is required to be submitted with all responses to state agency contracts with an expected value of $100,000 or more where the state agency has determined subcontracting opportunities are probable. The HSP subsequently becomes a provision of the awarded Contract and shall be monitored for compliance by the state agency during the term of the Contract.

“M&O” stands for Maintenance and Operations.

“NIST” stands for National Institute of Standards and Technology.

“PII” stands for Personal Identifiable Information.

http://www.txsmartbuy.com/esbd

Version 2.0 (12/13/2022) RFO No. HHS0013505 Page 10 of 56

“Respondent” means the individual or entity responding to this Solicitation.

“RPO” stands for Recovery Point Objective.

“Recovery Time Objective” or “RTO” means the maximum time to take to restore the data.

“Software-as-a-Service” or “SaaS” means the service model described by the National Institute of Standards and Technology (NIST) in Special Publication No. 800-145 (https://csrc.nist.gov/publications/detail/sp/800-145/final) to be the capability provided to the consumer is to use the provider’s applications running on a cloud infrastructure. The applications are accessible from various client devices through either a thin client interface, such as a web browser (e.g., web-based email), or a program interface. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings.

“SLA” stands for Service Level Agreement.

“SLR” stands for Service Level Requirements.

“Solicitation” means this RFO including all exhibits, attachments, forms, and Addenda, if any.

“Solicitation Consideration (SC) Documents” means documents that must be submitted by Respondent with the Solicitation Response in order to be considered for evaluation and cannot be resubmitted or have errors remedied after the submission due date and time in the Schedule of Events has passed.

“State” means the State of Texas and its instrumentalities, including HHSC, and any other state agency, its officers, employees, or authorized agents.

“Turnover” or “Turnover Phase” means the turnover by Contractor to HHSC of the day-to-day management of client activities, including all requisite project management activities, for the Cloud Fax Solution.

“TX-RAMP” means the Texas Risk and Authorization Management Program established by the Department of Information Resources (DIR) that provides a standardized approach for security assessment, authorization, and continuous monitoring of Cloud Computing Services that process the data of a state agency. To become TX-RAMP certified, entities must submit prescribed documentation to DIR. Information regarding TX-RAMP is currently located at:

https://dir.texas.gov/texas-risk-and-authorization-management-program-tx-ramp.

“UAT” stands for User Acceptability Testing.

“VPTS” means Vendor Performance Tracking System, as defined under Section 2262.055 of the Texas Government Code and Title 34 of the Texas Administrative Code Part 1, Chapter 20, Subchapter B, Division 2, Rule §20.115 and Subchapter F, Division 2, Rule §20.509.

https://csrc.nist.gov/publications/detail/sp/800-145/final https://dir.texas.gov/texas-risk-and-authorization-management-program-tx-ramp https://dir.texas.gov/texas-risk-and-authorization-management-program-tx-ramp https://statutes.capitol.texas.gov/Docs/GV/htm/GV.2262.htm#2262.055 https://texreg.sos.state.tx.us/public/readtac$ext.TacPage?sl=R&app=9&p_dir=&p_rloc=&p_tloc=&p_ploc=&pg=1&p_tac=&ti=34&pt=1&ch=20&rl=115 https://texreg.sos.state.tx.us/public/readtac$ext.TacPage?sl=R&app=9&p_dir=&p_rloc=&p_tloc=&p_ploc=&pg=1&p_tac=&ti=34&pt=1&ch=20&rl=509

Version 2.0 (12/13/2022) RFO No. HHS0013505 Page 11 of 56

1.3 AUTHORITY

HHSC is soliciting the Services stated in this Solicitation under of the authority Texas Government Code Section 2157.006(a)(2) and Title 34 of the Texas Administrative Code Par 1, Chapter 20, Subchapter C, Rule §20.222.

ARTICLE II. SCOPE OF WORK

2.1 SCOPE OVERVIEW

2.1.1 Project Scope

HHSC seeks a qualified Contractor to provide development of all necessary capabilities and staff to plan, manage, implement, test, and maintain a highly available, managed cloud-hosted and scalable, Software as a Service (SaaS), secure Cloud Fax Solution with Disaster Recovery and business continuity capabilities as described in Exhibit F, Requirements Traceability Matrix- Tab 5, Service Requirements. Initial deployment, Go Live, of the Cloud Fax Solution must be planned for no later than February 25, 2025.

Each Service Requirement domain is further described in Section 2.2 (Implementation Service Phase).

2.1.2 Project Scope Exclusions

The following Services are not included in the scope of this Solicitation:

a. Decommissioning of legacy software/hardware; and

b. Any Cloud Fax Solution features that are not identified in Exhibit F, Requirements Traceability Matrix, to ensure the future Cloud Fax Solution features remains like-for-like with HHSC’s legacy system.

2.2 IMPLEMENTATION SERVICE PHASE

The table below provides the categories of implementation services to be delivered along with definitions of each, and entrance and completion criteria. All implementation service requirements and associated deliverables for each of these service domains are further defined in Exhibit F, Requirements Traceability Matrix-Tab 5, Service Requirements. Full traceability of deliverables to their associated requirement, applicable due date and SLR, and RFO section are provided in Exhibit F, Requirements Traceability Matrix-Tab 9, Deliverables, Column C.

Sub-sections 2.2.1 (Project and Security Management) through 2.2.9 (Exit Turnover) below provide a high-level introduction into each of these implementation services.

https://texreg.sos.state.tx.us/public/readtac$ext.TacPage?sl=R&app=9&p_dir=&p_rloc=&p_tloc=&p_ploc=&pg=1&p_tac=&ti=34&pt=1&ch=20&rl=222

Version 2.0 (12/13/2022) RFO No. HHS0013505 Page 12 of 56

Table 3: Implementation Service Domains Descriptions, and Entrance and Completion Criteria

Service Domains

Description Entrance and Completion Criteria

Project & Security Management

Oversite and management of all aspects of project and foundational security requirements to achieve specific objectives within agreed parameters and acceptance criteria.

Entrance: These Services are expected to initiate with Contract start and continue throughout the Contract term.

Completion: End of Contract term.

Requirements Validation

Confirms the Cloud Fax Solution technical and functional requirements, and documents all changes, revisions, and clarification needed to the requirements in the Requirements Traceability Matrix (RTM).

Entrance: Upon Contract start.

Completion: Upon approval of the Requirements Validation Report deliverable.

Solution Design and Development/ Configuration

Establishing of a blueprint for what needs to be built and how for the overarching Cloud Fax Solution.

Entrance: Upon Contract start.

Completion: Upon approval of the System Design Document deliverable.

Testing Examination of every component of the Cloud Fax Solution to ensure they all work as expected.

Entrance: Upon successful completion of data migration.

Completion: Upon approval of the User Acceptance Test (UAT) Results Report deliverables.

User Training Education of end users about how to use the Cloud Fax Solution.

Entrance: Upon successful completion of user acceptance testing.

Completion: Upon approval of the End User Training Completion Report deliverable.

Deployment/ Post- Implementation Support

Contractor support during and immediately following go live of the Cloud Fax Solution.

Entrance: Upon meeting approved go/no-go criteria as agreed upon in the Deployment Plan deliverable.

Completion: Upon meeting approved exit criteria as agreed upon in the Deployment Plan deliverable.

Version 2.0 (12/13/2022) RFO No. HHS0013505 Page 13 of 56

Table 3: Implementation Service Domains Descriptions, and Entrance and Completion Criteria

Service Domains

Description Entrance and Completion Criteria

SaaS (Hosting Solution Provisioning)

Creation and setup of the Cloud Fax Solution infrastructure, and end user access management.

Entrance: These services are expected to initiate with Contract start and continue throughout the Contract term.

Completion: End of Contract term.

Maintenance and Operations

Ongoing monitoring, upgrading and maintenance of the Cloud Fax Solution, and support of the client.

Entrance: Upon approval of Successful Deployment Report deliverable.

Completion: Upon Contract end date.

Exit Turnover

Identification of Contractor and HHSC responsibilities when transitioning from Contractor-to-HHSC or Contractor-to-successor.

Entrance: As agreed upon in the Project Workplan.

Completion: Upon approval of the Final Acceptance Document deliverable.

2.2.1 Project & Security Management

The Contractor shall provide staff who possesses the required skills, experience, and certifications necessary to lead a successful project fully compliant with all appropriate security laws, policies, procedures, and regulations throughout the Contract term. The Contractor staff must include a project manager who will communicate and coordinate with the HHSC project manager throughout the Contract term, ensure delivery of all project and security management requirements as defined in Exhibit F, Requirements Traceability Matrix-Tab 5, Service Requirements, PM- 1 through PM-57.

Table 4: Deliverable Traceability (PM) Exhibit F, Requirements Traceability Matrix- Tab 9. Deliverables

Deliverable Name Associated Requirement

Associated Due Date (if applicable) Associated SLR

Project Schedule Workplan (PSW) PM-22 30 days after Contract execution PR-1

Project Management Plan PM-9 N/A N/A

The Contractor’s identified staff must possess a combination of the following skills, certifications, and experience:

a. Active Project Management Professional (PMP) certification from the Project Management Institute, Version 2.0 (12/13/2022) RFO No. HHS0013505 Page 14 of 56

b. IT Infrastructure Library (ITIL) certification Practitioner (or higher),

c. Certified Information Systems Security Professional (CISSP) or documented training in the field of Security and Risk Management, Software Development Security, Security Assessment and Training, or Security Operations and

d. Experience implementing proposed Cloud Fax Solution with a minimum of one (1) client.

e. Experience with Cloud Fax application functional and technical design and architecture.

The Contractor must ensure that all staff assigned to this project and all subcontractors (if applicable) complete the required security and cybersecurity training and ensure the compliance of all applicable laws and regulations governing the handling of HHSC confidential information and protected data.

2.2.1.1 Key Staffing Replacements

The Contractor must maintain adequate staffing, with the capacity to adjust its levels of qualified staff to meet the requirements of the Contract, applicable State and Federal requirements and changing HHSC and consumer needs. Without limitation, the Contractor must:

a. Submit an initial organizational chart within thirty (30) calendar days after the Effective Date or by any other date specified by HHSC, including the names and positions of all staff assigned to the Contract. The organizational chart must designate who are key staff.

b. Submit notification to HHSC in writing within ten (10) calendar days after a key staff vacancy occurs for any reason, or prior to making any changes in key staff. Notification must include a plan to recruit key staff.

Key staff replacements must be in place no later than thirty (30) calendar days from the separation date of the vacating staff and should be of similar experience and skill. The Contractor must provide HHSC a detailed resume for a proposed key staff replacement. Replacements are subject to HHSC approval prior to any assignment.

2.2.2 Requirements Validation

The Contractor shall collaborate with HHSC to establish a formal Requirements Management Plan to be included in the Project Management Plan deliverable and shall manage requirements as agreed upon in this deliverable throughout the Contract. In partnership with HHSC, the Contractor shall coordinate requirement validation sessions to review and prioritize all requirements. Any necessary requirement updates identified must be documented and approved by HHSC.

Requirement validation requirements are defined in Exhibit F, Requirements Traceability Matrix-Tab 5, Service Requirements, RV-1 through RV-10.

Version 2.0 (12/13/2022) RFO No. HHS0013505 Page 15 of 56

Table 5: Deliverable Traceability (RV) Exhibit F, Requirements Traceability Matrix- Tab 9. Deliverables

Deliverable Name

Associated Requirement

Associated Due Date (if applicable) Associated SLR

Requirements Validation Report RV-9 60 days after

Contract execution PR-1

2.2.3 Solution Design, Development, Configuration

The Contractor shall develop and implement a Configuration Management Plan detailing the solution design, development, and configuration in accordance with Exhibit F, Requirements Traceability Matrix-Tab 5, Service Requirements, DEV-1 through DE-124.

The Configuration Management Plan describes changes to:

a. Policies;

b. Procedures;

c. Processes; and

d. Approvals.

In coordination with HHSC, the Contractor shall also conduct planning sessions quarterly to establish design consensus and establish system(s) configuration. Throughout the Contract Term, the Contractor must maintain an inventory of software, up-to-date documentation of changes made to the underlying environment, and configuration review sessions to ensure compliance with HHSC standards.

Table 6: Deliverable Traceability (DE) Exhibit F, Requirements Traceability Matrix- Tab 9. Deliverables

Deliverable Name

Associated Requirement

Associated Due Date (if applicable) Associated SLR

Configuration Management Plan DE-1 N/A N/A

System Design Document DE-14 90 days after

Contract execution PR-1

2.2.4 Testing

The Contractor shall develop a Test Management Strategy deliverable that lists all test events:

a. Entrance and exit criteria;

b. Roles and responsibilities;

c. Defect management processes;

d. High-level data requirements; and

e. Tools used, including User Acceptance Testing (UAT).

Version 2.0 (12/13/2022) RFO No. HHS0013505 Page 16 of 56

The Test Management Strategy must be maintained to reflect HHSC approved revisions. test plans must also be provided for each test event that includes the detailed testing approach. Testing requirements are defined in Exhibit F, Requirements Traceability Matrix-Tab 5, Service Requirements, TE-1 through TE-16.

Table 7: Deliverable Traceability (TE) Exhibit F, Requirements Traceability Matrix- Tab 9. Deliverables

Deliverable Name Associated Requirement

Associated Due Date if applicable

Associated

SLR

Test Management Strategy TE-1 N/A N/A User Acceptance Test (UAT) Results

Report TE-15 120 days after Contract execution PR-1

Deployment Test Plan TE-2 N/A N/A Disaster Recovery Test Plan TE-2 N/A N/A

Functional Test Plan TE-2 N/A N/A Integration Test Plan TE-2 N/A N/A

Parallel Comparison Test Plan TE-2 N/A N/A Performance (Load and Stress) Test Plan TE-2 N/A N/A

Regression Test Plan TE-2 N/A N/A Security Test Plan TE-2 N/A N/A

User Acceptance Test (UAT) Plan TE-2 N/A PR-2

2.2.5 User Training

The Contractor shall develop and implement an End-User Training Plan for HHSC’s end-users as mutually agreed upon by HHSC and the Contractor. All final training materials must be provided to HHSC and be tailored to reflect HHSC’s specific business processes and training needs. User training requirements are defined in Exhibit F, Requirements Traceability Matrix-Tab 5, Service Requirements, TR-1 through TR-9.

Table 8: Deliverable Traceability (TR) Exhibit F, Requirements Traceability Matrix- Tab 9. Deliverables

Deliverable Name Associated Requirement

Associated Due Date if applicable

Associated

SLR

End User Training Plan TR-1 N/A N/A End User Documentation TR-4 N/A N/A Final Training Materials TR-4 N/A N/A

End User Training Strategy TR-6 N/A N/A

Train-the-Trainer Completion Report TR-8 130 days after Contract execution PR-1

End User Training Completion Report TR-9 140 days after Contract execution PR-1

Version 2.0 (12/13/2022) RFO No. HHS0013505 Page 17 of 56

2.2.6 Deployment/Post-Implementation Support

The Contractor shall develop a detailed Deployment Plan, and perform deployment as agreed upon in the approved plan. Immediately following a system Go Live in production, provide post implementation support to ensure the seamless adoption of the new capabilities and a report confirming the success of the employment according to success criteria documented in the approved Deployment Plan. Deployment/post-implementation support requirements are defined in Exhibit F, Requirements Traceability Matrix-Tab 5, Service Requirements, DH-1 through

DH-11.

Table 9: Deliverable Traceability (DH) Exhibit F, Requirements Traceability Matrix- Tab 9. Deliverables

Deliverable Name Associated Requirement

Associated Due Date if applicable Associated SLR

Deployment Plan DH-1 N/A N/A Successful

Deployment Report DH-11 150 days after Contract execution PR-1

2.2.7 SaaS (Hosting Solution and Provisioning)

The Contractor shall develop an Infrastructure Management Plan for hosting and provisioning the Cloud Fax Solution, and manage the acquisition, delivery, installation, and configuration of the development and production hardware, software, and Cloud Computing services. The Contractor must ensure that appropriate level of documentation regarding the provisioned infrastructure is made available to HHSC representatives, and that the Cloud Fax Solution is in a single-tenant environment that adheres to all regulatory requirements. The Contractor must also propose an Infrastructure and Solution Recovery Plan which must include disaster recovery plans and system failover methodologies. The Contractor shall provide a Cloud Fax Solution that meets the NIST standard definition of SaaS provided in NIST Special Publication No. SP 800-145.

SaaS (hosting solution and provisioning) requirements are defined in Exhibit F, Requirements Traceability Matrix-Tab 5, Service Requirements, SP-1 through SP-28.

Table 10: Deliverable Traceability (SP) Exhibit F, Requirements Traceability Matrix- Tab 9. Deliverables

Deliverable Name Associated Requirement

Associated Due Date if applicable

Associated

SLR

Infrastructure Management Plan SP-10 at least 60 days prior to Go Live N/A

Infrastructure and Solution Recovery Plan SP-20 N/A N/A

2.2.8 Maintenance and Operations

The Contractor must provide Maintenance and Operations Support in accordance with the agreed upon Production Support Plan during the Post Go-Live/Post-Implementation Support and https://csrc.nist.gov/publications/detail/sp/800-145/final

Version 2.0 (12/13/2022) RFO No. HHS0013505 Page 18 of 56

Maintenance and Operations (M&O) Support period through the remainder of the Contract term.

The Contractor shall provide:

a. Technical and functional support as agreed upon;

b. Data and system fixes;

c. Solution and service diagnostics; and

d. Maintained updated documentation.

The Contractor must also develop and implement a Release Management Plan that details the Contractor’s processes and procedures related to the promotion of software components through each environment. All maintenance and operations requirements are defined in Exhibit F, Requirements Traceability Matrix-Tab 5, Service Requirements, MO-1 through MO-63.

Table 11: Deliverable Traceability (MO) Exhibit F, Requirements Traceability Matrix- Tab 9. Deliverables

Deliverable Name Associated Requirement

Associated Due Date if applicable

Associated

SLR

Production Support Plan MO-1 N/A N/A System Security Plan MO-38 N/A N/A

Disaster Recovery Test Report MO-43 160 days after Contract execution PR-1

Plan of Action and Milestones (POAM) MO-51 N/A N/A Release Management Plan MO-63 N/A N/A

2.2.8.1 Disaster Recovery Test

At least once per State Fiscal Year, for no additional compensation, the Contractor shall conduct a Disaster Recovery Test, in accordance with the Disaster Recovery Test procedures developed in coordination with HHSC, to assess the effectiveness of the Contractor’s Disaster Recovery Plan as agreed upon in the approved Infrastructure and Solution Recovery Plan.

The Contractor shall provide HHSC, at least thirty (30) calendar days advance written notice of each Disaster Recovery Test. HHSC may monitor the Contractor’s Disaster Recovery Testing activities. During the Disaster Recovery Test, the Contractor shall simulate daily operations that occur in a production setting and, at a minimum, test the recovered environments, accessibility, data integrity, and functionality.

On or before the ninetieth (90th) calendar day following each Disaster Recovery Test, the Contractor will provide HHSC, with a Disaster Recovery Test Report detailing the results of the Disaster Recovery test. Upon HHSC, written request, the Contractor shall make Contractor staff available to discuss with HHSC, the results of the Disaster Recovery test. A lesson(s) learned meeting will be conducted by the Contractor no later than thirty (30) calendar days following the completion of the Disaster Recovery Test.

Version 2.0 (12/13/2022) RFO No. HHS0013505 Page 19 of 56

If a Disaster Recovery Test is unsuccessful, the Contractor will (i) develop a remediation plan on or before the thirtieth (30th) calendar day following the unsuccessful Disaster Recovery Test and

(ii) implement such remediation plan on before the ninetieth (90th) calendar day following the unsuccessful Disaster Recovery Test unless an alternate timeframe is mutually agreed upon by HHSC, and the Contractor.

Upon HHSC, written request, the Contractor shall conduct, for no additional compensation, an additional Disaster Recovery Test during the State Fiscal Year to validate the successful implementation of the Contractor’s remediation activities. The Contractor shall use commercially reasonable efforts to resolve issues identified during the Disaster Recovery Test and, for each unsuccessful test, the Contractor shall conduct an additional Disaster Recovery Test in a timely manner (as specified in the HHSC-approved Disaster Recovery Test Plan deliverable, refer to Service Requirements within Exhibit F, Requirements Traceability Matrix) to validate the successful implementation of the Contractor’s remediation activities.

2.2.9 Exit Turnover

The Contractor shall develop an Exit Turnover Plan identifying all activities necessary at the end of the Contract term. This plan is to ensure a successful turnover from the Contractor to HHSC or a successor. The Contractor must continue to provide all Services under the Contract without disruption while supporting turnover to HHSC operations. The Contractor shall also develop a Final Acceptance Document to acknowledge successful turnover of knowledge to HHSC, and confirm all activities and documentation identified in the Exit Turnover Plan have been successfully completed. Exit turnover requirements are defined in Exhibit F, Requirements Traceability Matrix-Tab 5, Service Requirements, ET-1 through ET-9. Note that Exit Turnover activities and deliverables are to ensure an orderly transition from the Contractor to a successor at the end of the Contract term or earlier, at the state’s discretion.

In the event the Contractor is unable to achieve TX-RAMP Level 2 Certification or re-certification, as applicable, and consistent with Section 2.3.3 (Texas Risk and Authorization Management Program (TX-RAMP)), the Contractor shall provide, at no cost to HHSC, Exit Turnover services in accordance with Section 2.2.9 (Exit Turnover). The Exit Turnover Plan must be submitted within 15 calendar days of notification to the Contractor by HHSC.

Table 12: Deliverable Traceability (ET) Exhibit F, Requirements Traceability Matrix- Tab 9. Deliverables

Deliverable Name Associated Requirement

Associated Due Date if applicable

Associated

SLR

Exit Turnover Plan ET-9

Initial Draft due within 365 calendar days after Contract Execution.

Final Approval due 90 calendar days prior to Contract termination.

N/A

Version 2.0 (12/13/2022) RFO No. HHS0013505 Page 20 of 56

2.3 SOLUTION REQUIREMENTS

The Contractor must provide a managed cloud-hosted and scalable, secure, SaaS Cloud Fax Solution that provides all functional and technical requirements across nine (9) business capabilities as defined in Exhibit F, Requirements Traceability Matrix-Tab 3, Capability Definitions. For all additional information and Cloud Fax Solution requirements, refer to Exhibit F, Requirements Traceability Matrix-Tab 4, Solution (RTM).

2.3.1 Functional Requirements

The Contractor shall provide a Cloud Fax Solution that meets HHSC’s functional requirements including configurable business rules, ability to receive faxes via multiple methods, ability to port both local and toll-free numbers while supporting 60,000 packages and 800,000 inbound pages per week. The Cloud Fax Solution must be able to expand to support additional phone numbers and increased page volume up to 160 million pages annually and comply with all data security regulations. All functional requirements are detailed in Exhibit F, Requirements Traceability Matrix-Tab 4, Solution (RTM), requirement ID 1-31. These requirements are categorized by the level 0 and level 1 capabilities shown in figure 1 below.

Figure 1: Functional Requirements

2.3.2 Technical Requirements

The Contractor shall meet all technical requirements, which have been categorized into six (6) Level 0 and twenty-four (24) Level 1 requirement categories as identified in Table 13: Technical Requirements Categories below, by providing a cloud-hosted SaaS Cloud Fax Solution hosted in a secure environment that allows for the ability to sort, search, and store data as specified by HHSC. All technical requirements are defined in Exhibit F, Requirements Traceability Matrix- Tab 4, Solution (RTM), requirement ID 32 – 116.

The Cloud Fax Solution must enable data encryption that complies with all regulation and allows for configuration of access by user role. The Cloud Fax Solution must require verification and authentication of front-end applications and user identity before connecting and ensure 95% of faxes are successfully completed on the first try. The Contractor must provide a Cloud Fax Solution that works with custom Application Programing Interfaces (APIs) for integration and be compatible with Xerox Multifunctional Printers and Azure Active Directory for Single Sign On.

Version 2.0 (12/13/2022) RFO No. HHS0013505 Page 21 of 56

The Cloud Fax Solution must provide real time reporting as well as full analytic and audit capabilities of all sent and received faxes.

Table 13: Technical Requirement Categories

Level 0 Requirement Level 1 Requirement

Machine Learning & Artificial Intelligence Process Automation

Data, Analytics, Security

Data Analytics

Data Security

Fax Configuration

Identify & Authenticate

Reporting

Search

Storage

System Administration

Add Fax Numbers

Hosting

Manage Documents

Manage System Alerts & Notifications

Manage System Auditing Data

Manage Users

Manage Workflows & Business Rules

Notification

Solution Capability

Usability

Network General Requirements

Architecture

Business Continuity

Fax Architecture

Flexibility

Scalability

Integration Custom Integrations

2.3.3 Security Requirements

The Contractor, at a minimum, shall comply with the security requirements set forth in Exhibit M, HHS Information Security and Privacy Requirements.

Version 2.0 (12/13/2022) RFO No. HHS0013505 Page 22 of 56

2.3.4 Texas Risk and Authorization Management Program (TX-RAMP) The Contractor shall comply with the program requirements of TX-RAMP as they currently exist and as amended throughout the Contract Term. Commencing on the Effective Date, the Contractor shall have achieved TX-RAMP Level 2 Certification, and the Contractor must maintain such certification for the duration of the Contract Term.

At the sole discretion of HHSC, the Contractor’s attainment of TX-RAMP Provisional Certification may satisfy the TX-RAMP Certification Level 2 requirement for the length of active TX-RAMP Provisional Certification.

If HHSC permits TX-RAMP Provisional Certification, the Contractor is solely responsible for obtaining and maintaining TX-RAMP Level 2 Certification prior to the expiration of TX-RAMP Provisional Certification. The Contractor acknowledges that HHSC shall not provide Agency-sponsored Interim Provisional Certification or otherwise assist the Contractor in Contractor’s compliance with TX-RAMP requirements.

In addition, the Contractor shall:

a. Upon HHSC’s request, provide Contractor’s submission(s) to DIR that supports DIR’s approval of certification status and respond to HHSC and DIR TX-RAMP staff inquiries promptly;

b. Provide written notification to HHSC of any lapse in TX-RAMP certification including, but not limited to, DIR revocation of TX-RAMP certification within two (2) business days of the Contractor’s discovery of non-compliance with TX-RAMP requirements;

c. Complete all TX-RAMP monitoring reports required by DIR and submit copies of reports to HHSC on or before the second (2nd) business day following the DIR submission deadline;

d. Routinely assess and monitor for compliance with required security controls and demonstrate that the security posture of the Cloud Computing services offered is acceptable to maintain TX-RAMP certification;

e. If the Contractor has TX-RAMP Provisional Certification, provide a progress update to HHSC on the Contractor’s application for TX-RAMP Level 2 Certification no later than the third (3rd) business day of each calendar month, unless HHSC requires more frequent reporting, until the expiration of the TX-RAMP Provisional Certification; and

f. If the Contractor has TX-RAMP Level 2 Certification, commencing six months prior to the expiration date of the TX-RAMP Level 2 Certification, provide a progress update to HHSC on Contractor’s application for renewal or extension of its TX-RAMP Level 2 Certification no later than the third (3rd) business day of each calendar month, unless HHSC requires more frequent reporting.

The Contractor’s failure to comply with any TX-RAMP requirements including, but not limited to, continuous maintenance of the minimum certification required by the Contract shall constitute

Version 2.0 (12/13/2022) RFO No. HHS0013505 Page 23 of 56 a material breach of Contract, and HHSC reserves the right to hold the Contractor accountable by taking any remedial or corrective actions available under the Contract, at law, or in equity.

If the Contractor is unable to achieve TX-RAMP Level 2 Certification or re-certification, as applicable, for any reason before the 15th calendar day prior to the expiration date of the TX- RAMP Provisional Certification or TX-RAMP Level 2 Certification, as applicable, the Contractor shall provide, at no cost to HHSC, turnover services in accordance with Section 2.9.9 (Exit Turnover).

2.4 PERFORMANCE REQUIREMENTS

The Contractor and the Cloud Fax Solution shall meet all performance requirements as identified in Exhibit F, Requirements Traceability Matrix-Tab 6, Performance Requirements.

Definitions for incident severity/priority and UAT defect resolution are provided in Exhibit F, Requirements Traceability Matrix-Tab 7, Performance Definitions.

Table 14: Performance Requirements

Performance Requirements ID

Key Milestone Deliverables PR-1

Critical and High Severity UAT Defect Resolution Timeframe PR-2

Critical and High Security Production Defect Resolution Timeframe PR-3

Critical and High Severity Incident Resolution Timeframe PR-4

Security Incidents Response Time PR-5

Disaster Recovery Restoration Timeline PR-6

Solution Availability PR-7

Solution Availability Notifications PR-8

Application Performance PR-9

Each Service Level Requirement (SLR) set forth in Exhibit F, Requirements Traceability Matrix-Tab 6, Performance Requirements identifies the measurement formula that will be used to evaluate the Contractor’s delivery of the required Services. HHSC will manage the Contractor’s Services by monitoring and measuring performance on critical business requirements. SLRs identified in Exhibit F, Requirements Traceability Matrix-Tab 6, Performance Requirements specify the following: targets, measurements, reporting periods, non-compliance, and liquidated damages in detail. These Performance Requirements and SLRs are intended to be reasonable estimates of projected financial loss and damages resulting from the Contractors non-performance, including financial loss due to delays.

The Contractor shall perform a root cause analysis for any failure to attain a performance target.

This root cause analysis shall be provided to HHSC within ten (10) Business Days of the reported

Version 2.0 (12/13/2022) RFO No. HHS0013505 Page 24 of 56 failure and include corrective action (with completion dates) to prevent recurrence. The root cause analysis will highlight any failures to attain a performance target that cannot be attributed to the Contractor performance. Liquidated Damages would not apply to cases in which the failure to meet an SLR target is beyond the Contractor's control. The Liquidated Damages specified in Exhibit F, Requirements Traceability Matrix do not restrict the HHSC's ability to pursue other damages to which it may be entitled.

2.4.1 Key Milestone Deliverables

The Contractor shall deliver key project milestones according to the approved schedule and which must be of sufficient quality to be considered ready for review.

2.4.2 Critical and High Severity UAT Defect Resolution Timeframe The Contractor shall provide monthly reports validating compliance of critical and high UAT defects being identified and fixed within the specified resolution time 95% of the time.

2.4.3 Critical and High Security Production Defect Resolution Timeframe The Contractor shall provide monthly reports validating compliance of critical and high production defects being identified and fixed within the specified resolution time 95% of the time.

2.4.4 Critical and High Severity Incident Resolution Timeframe The Contractor shall provide monthly reports validating compliance of critical and high severity incidents being identified and fixed within the specified resolution time 95% of the time.

2.4.5 Security Incident Response Time

The Contractor must ensure HHSC’s security point-of-contact is notified within one (1) hour of any security incidents.

2.4.6 Disaster Recovery Restoration Timelines

Per disaster or crisis event, the Contractor shall report the Recovery Time Objective (RTO) and Recovery Point Objective (RPO) for evaluation of compliance with a one (1) hour target for each.

2.4.7 Solution Availability

The Cloud Fax Solution must be available to all users of the system, twenty-four (24) hours a day, seven (7) days a week, all days of the year (excluding scheduled maintenance). The Contractor shall communicate with HHSC regarding any service impacting planned event ten (10) Business Days prior, unplanned service or system outages within fifteen (15) minutes, and any unscheduled service event thirty (30) days prior.

2.4.8 Solution Availability Notifications

The Contractor shall provide HHSC ten (10) Business Days notification of any service impacting planned event, notification within fifteen (15) minutes of an unplanned service/system outage, and notification thirty (30) Business Days prior to an unscheduled service event. A monthly report will be required to validate the compliance with this service requirement.

Version 2.0 (12/13/2022) RFO No. HHS0013505 Page 25 of 56

2.4.9 Application Performance

The Cloud Fax Solution shall successfully complete transactions 98% of the time within each reporting period. A monthly validation report will be required.

2.4.10 Fax Volume

The below tables indicate existing and anticipated fax volumes based on a volume analysis for a full calendar year.

a. Five (5) Day Working Average:

1. Calculate per day average based on yearly volumes

2. ((Monday average + Tuesday average + Wednesday average + Thursday average + Friday average) / 5 days)

b. One (1) Week Average:

1. Calculate per day average based on yearly volumes

2. ((Sunday average + Monday average + Tuesday average + Wednesday average + Thursday average + Friday average + Saturday average) / 7 days)

c. Incoming Fax Peak: the timeframe when received volume is at its highest for HHSC is 3- 5pm CST on weekdays and 12-2pm CST on weekends.

d. Outgoing Fax Peak: the timeframe when sent volume is at its highest for HHSC is 3-5pm CST on weekdays and 12-2pm CST on weekends.

Table 15: HHSC Existing Incoming Fax Volume

Timeframe Packages Pages

5 Working Day Average 11,200 141,000

One Week Average 8,129 102,000

Table 16: HHSC Existing Outgoing Fax Volume

Timeframe Packages Pages

5 Working Day Average 2,320 9,200

One Week Average 1,670 6,617

Table 17: HHSC Existing Incoming Fax Peak

5 Working Day Average 980 15,333

One Week Average 717 11,124

Version 2.0 (12/13/2022) RFO No. HHS0013505 Page 26 of 56

Table 18: HHSC Existing Outgoing Fax Peak

5 Working Day Average 181 832

One Week Average 147 765

Table 19: HHSC’s Anticipated Future Year-Over-Year Cutover Page Volume

Timeframe Anticipated Volume of Cutover Pages

Year 1 5,720,000

Year 2 28,858,500

Year 3 97,828,500

Year 4 152,266,400

Year 5 167,493,040

2.5 PAYMENT STRUCTURE

2.5.1 General

HHSC's financial obligation for the Services performed will not commence before the first (1st) business…