Ex. 3.1.xlsx

Title Page

SCEIS Modernization

Introduction

INTRODUCTION

This Exhibit 3.1 (Service Level and Deliverable Matrix) sets forth the following:

Exhibit 3.1 (Service Level Matrix)

Solicitation No. 5400026039 Page &P of &N

1. Critical SLAs Services Critical SLAs

Exhibit 3.2 Section Reference Service Level Categories Comm + mos(1) Expected (ESL) (2)

Solicitation No. 5400026039 Page &P of &N

2. Key SLAs Key SLAs

Exhibit 3.2 Section Reference Service Level Categories Comm + mos(1) Expected (ESL) (2)

Solicitation No. 5400026039 Page &P of &N

3. One Time Delivery

(mm/dd/yy)

- Detailed task/Work Breakdown Structure for transition, inclusive of all activities, deliverables, dependencies;

- Risk Register;

- Project Integration – among Admin, reliant or dependent SCPs;

- Stakeholder goals and expectations;

- Project Scope, Project Time, Project Schedule Management Plan, Project Change Management;

- Project Quality Measures and Management Plan, Project/Transition Staffing Plan, Project Communications;

- Documentation of required 2 reviews conducted with Admin prior to final submission.

- Plan for validating inventory, and implementing automated discovery tools for tracking and reporting on all operational hardware, software, appliances, etc. on supported Service elements and devices;

- Plan and associated timelines for developing APIs and other system integrations to support automated reporting, data feeds, etc. into the Admin tools, including any known interdependencies or resource requirements Admin or other SCPs.

- A description of the documentation, methods and procedures, personnel and organization the Service Provider will use to perform the Transition;

- Validation of successful Transition inclusive of user acceptance and assessment of acceptable performance with respect to comparison to baseline operational and performance attributes collected during preceding phases (i.e., design, build, test) outlined herein;

- Project Communications, Action Items, Decisions and Risks/Issue Management; and Project Procurement

- Completed Transition Milestone Document capturing transition milestone objectives, Acceptance Criteria, dates, dependencies, owners, and review teams.

- Confirmation of integration with Admin and other SCPs as required;

- Documentation of required 4 reviews conducted with Admin prior to final submission;

- Documented participation in Admin required operational readiness workshops;

- Confirmation of required SMM document status and completion;

- Confirmation of alignment with Admin processes/procedures in the SMMs and identification of any critical gaps in documentation or processes;

- Updated Key Personnel and service management escalation contact information and staff employment status;

- Documented operational processes/procedures needed to deliver Services and status of publication to the portal;

- Status of Software license ownership and/or transfers;

- Status of hardware and infrastructure ownership and/or transfers;

- Status of lease transfers;

- IT Service Management process and capabilities deployment;

- Billing process deployment including detail for invoices;

- Service level process deployment including drill down to details;

- Knowledge transfer completion within Service Provider;

- Knowledge transfer completion to Admin;

This documentation requires 1 review conducted with Admin prior to final submission.

This documentation requires 2 reviews conducted with Admin prior to final submission.

The documentation includes .doc documents that detail the processes support the SMM requirements, including:

- Publication of required Phase 2 SMM documents;

- SMM content is aligned with the SMM contents and structure (e.g., Process, Procedure, Work Instruction);

- Processes reflect the requirements of the Contract;

- Detailed descriptions of policies, processes, and procedures are documented in the manual;

- Roles and responsibilities are defined for Service Provider, Admin, and/or other Service Component or SCP as appropriate;

- Dependencies and relationships are documented;

- Risks associated with procedures are identified and mitigation strategies documented for each risk;

- The policies and procedures are consistent with the proposed transition and solution.

This documentation requires 2 reviews conducted with Admin prior to final submission.

The documentation includes .doc documents that detail the processes support the SMM requirements, including:

- Publication of required Phase 3 SMM documents;

- SMM content is aligned with the SMM contents and structure (e.g., Process, Procedure, Work Instruction);

- Processes reflect the requirements of the Contract;

- Detailed descriptions of policies, processes, and procedures are documented in the manual;

- Roles and responsibilities are defined for Service Provider, Admin, and/or other Service Component or SCP as appropriate;

- Dependencies and relationships are documented;

- Risks associated with procedures are identified and mitigation strategies documented for each risk;

- The policies and procedures are consistent with the proposed transition and solution.

- Create Disaster Recovery Plans to reflect Service Provider, Admin and Service Components as needed to implement and maintain a viable Disaster Recovery Plan for all SCEIS services.

Document the target Disaster Recovery design and implement the architectures, infrastructure and application modifications as required to acheive the Admin-approved Disaster Recovery strategy that will achieve the Admin-approved disaster recovery levels for Service Provider Services as defined in Exhibit 2.1 (SCEIS Modernization Services SOW), Section 4.16 IT Service Continuity Management.

- Services architecture diagrams as required to describe all service elements illustrating how the Admin-approved disaster recovery RTO and RPO levels will be achived.

- DRPs for Service Provider Services upon Commencement.

- TRGs for Service Provider Services upon Commencement

- Published IT Service Continuity Management SMM documents

- the security controls, in alignment with the SCDIS—200 Information Security and Privacy Standards controls,

- security control status including those that are in place or planned for deployment,

- plans of actions to achieve control compliance, and

- plans to correct deficiencies in the System Security Plan. Create or update a System Security Plan, in Admin agreed format(s), including:

- System description including its architecture, components, and data it handles.

- System boundaries specifying what is included and what is not.

- Security objectives including the security goals and objectives of the system.

- Security controls as required including SCDIS-200 controls.

- Risk assessment including the risks and threats that the system faces and how they will be mitigated.

- Incident response referring to the SMM processes and procedures for detecting, reporting, and responding to security incidents.

- Security training and awareness programs for personnel involved with the system.

- Security policies, procedures and standards relevant to system security.

- Security testing including how security testing, vulnerability assessments and penetration testing, will be conducted.

- Authorization including description or reference to the SMM describing the process for obtaining authorization to operate the system.

- System Monitoring and Audit including details how the system will be monitored and audited to ensure ongoing security.

- Contingency and Disaster Recovery including the architecture and plans for system recovery and continuity in the event of disruptions.

Solicitation No. 5400026039 Page &P of &N

4. Recurring Delivery

The Service Provider shall manage ongoing updates to the Technology Plan and the technology roadmap to include proposed updates to reference technical architecture and software currency designations. The roadmap will identify specific, short-term steps and schedules for initiatives or changes with estimated timing.

The Service Provider shall develop and implement a Technology Plan that is consistent with Admin’s strategic planning and shows how the Service Provider, Admin and Service Components will provide the services to achieve technology evolution, efficiencies, productivity improvements, cost savings, modernization, and enhanced security, etc.

Publication and agreement on the annual Technology Plan and Roadmap as captured in a .docx document and project plan that includes:

- Output from the annual technology summit

- Schedules, dependencies, and requirements for introduction of new technology changes into the environment including the acquisition, support, and retirement of software and hardware.

- Specification of the solutions, plans, cost estimates and schedules for achieving Technology Evolution goals

- CMDB extract of software and tools used in providing Services along with the targeted vision for each

As a part of the refresh plan, the Service Provider shall provide a recommendation to upgrade Software to supported levels and to refresh Infrastructure in accordance with the Technology Plan and technology roadmap. Provide Admin with the Service Provider's annual refresh plan in the required format, to be included in the complete annual refresh plan deliverable submission to Admin.

Publication and agreement on the annual refresh plan captured in a .docx document and project plan that includes:

- Refresh forecast eligibility, dependencies, and recommendations for refreshing technology (infrastructure and software) in the Services environment for the upcoming year.

- Preliminary business-level assessment of the solutions, plans, cost estimates, and schedules for achieving refresh goals (including software to n/n-1 levels) for Services or as required in Exhibit 4.2 (Financial Responsibility Matrix).

- Refresh progress, dependencies, and recommendations for accomplishing objectives set forth in the annual refresh plan.

- Identify delays caused by Change Management or other Service Provider dependencies..

Publication and agreement with Admin Information Security requirements as described in Exhibit 2.1 (SCEIS Modernization Services SOW), Section 5.1 Information Security Management General Requirements and captured in a Admin agreed format that includes:

- the security controls, in alignment with the SCDIS—200 Information Security and Privacy Standards controls,

- security control status including those that are in place or planned for deployment,

- plans of actions to achieve control compliance, and

- plans to correct deficiencies in the System Security Plan. Create or update a System Security Plan, in Admin agreed format(s), including:

- System description including its architecture, components, and data it handles.

- System boundaries specifying what is included and what is not.

- Security objectives including the security goals and objectives of the system.

- Security controls as required including SCDIS-200 controls.

- Risk assessment including the risks and threats that the system faces and how they will be mitigated.

- Incident response referring to the SMM processes and procedures for detecting, reporting, and responding to security incidents.

- Security training and awareness programs for personnel involved with the system.

- Security policies, procedures and standards relevant to system security.

- Security testing including how security testing, vulnerability assessments and penetration testing, will be conducted.

- Authorization including description or reference to the SMM describing the process for obtaining authorization to operate the system.

- System Monitoring and Audit including details how the system will be monitored and audited to ensure ongoing security.

- Contingency and Disaster Recovery including the architecture and plans for system recovery and continuity in the event of disruptions.

At the beginning of each calendar year, the Service Provider will provide a schedule for the year that outlines the Systems that will be reviewed each quarter. This schedule may be modified throughout the year. The Service Provider shall provide content and updates according to the timeline to ensure Security Plan validity and currency. Provide Admin the Service Provider's completed System Security Plan in the required format, including:

- System description including its architecture, components, and data it handles.

- System boundaries specifying what is included and what is not.

- Security objectives including the security goals and objectives of the system.

- Security controls as required including SCDIS-200 controls.

- Risk assessment including the risks and threats that the system faces and how they will be mitigated.

- Incident response referring to the SMM processes and procedures for detecting, reporting, and responding to security incidents.

- Security training and awareness programs for personnel involved with the system.

- Security policies, procedures and standards relevant to system security.

- Security testing including how security testing, vulnerability assessments and penetration testing, will be conducted.

- Authorization including description or reference to the SMM describing the process for obtaining authorization to operate the system.

- System Monitoring and Audit including details how the system will be monitored and audited to ensure ongoing security.

- Contingency and Disaster Recovery including the architecture and plans for system recovery and continuity in the event of disruptions.

- SMM review plan, agreed by Admin, by topics (e.g., sections, processes or functional area) with timeline and participants. Plan is to include a listing of all documents or content included in the review (e.g., policies, processes, procedures, work instructions, templates).

- Report of the review findings and updates made over the previous quarter.

- Action plans addressing issues identified in the previous survey across all Services and survey groups .

- Definitions of the issue being addressed, targeted improvement, timeline, owners, and solution approaches.

- Previously agreed actions and activities.

- Confirmation that plans were approved by Admin

Service Provider is responsible for planning and leading Admin and Service Components in SCEIS disaster recovery exercises and providing any needed information for the disaster recovery test plan and schedule. Publish .doc/.xls document(s) that describes the annual Disaster Recovery test plan and schedule including:

- Improvements from Previous year - A narrative evaluation of the previous years' testing against the DR program objectives to determine areas of risk, indicating any DR program or process changes to be incorporated in the next years' test plan schedule.

- Scope changes - List of major changes in requirements and new applications implemented since the previous year's test, and a list of eligible applications not scheduled for testing

- Proposed new schedule developed for the upcoming year inclusive of RTO/RPO for each system/application

- Proposed test objectives and criteria for demonstrating RTO/RPO achievement

- Proposed test roles and responsibilities for Service Provider, Admin, Service Components, and Consumers (as required)

After Admin approval, publish DR test plan and schedule.

report including but not limited to:

- Release Notes showing specific application upgrade details

- Training design, schedule, logistics, and post-training feedback plan;

- List of training attendees;

- Documentation resulting from training, including handbooks, self-service materials, and evidence of sharing on Admin learning management platform;

- Materials to support training, e.g., posters; video, communication plan, training plan

- Recommendations for next steps for the Service Provider and for Admin;

- Lessons learned to be implemented into following trainings.

- Service Desk support process

- Schedules, dependencies, and requirements for introduction of new technology changes into the environment including the acquisition, support, and retirement of software and hardware.

- Specification of the solutions, plans, cost estimates and schedules for achieving Technology Evolution goals

- CMDB extract of software and tools used in providing Services along with the targeted vision for each

Publication and agreement on the Service Provider Annual Information Security Plan as described in the SCDIS—200 Information Security and Privacy Standards, Controls Matrix worksheet, and captured in a Admin agreed format(s) that may include:

- Define security requirements, security management controls, and common controls for meeting those requirements.

-Identify and assign security program roles, responsibilities and Service Provider management commitment, and ensure coordination among Admin and Service Components

- Approval of the plan by Service Provider senoir management and Admin

- Updates to the security plan to address changes and problems identified during plan implementation or security control assessment

- Initiation of a plan is developed and executed to address identified security and privacy deficiencies

- Assessment of risks and strategy and priorities for risk response actions.

- Develop, monitor, and report on the results of information security and privacy measures of performance, as directed by Admin

- Provide status on implementation and adherence to Information Security Controls

- Provide results from previous years security monitoring and measuring

Solicitation No. 5400026039 Page &P of &N image1.png