Executed P-56202.45- R-333529- BOA Google Gemini Enterprise MVP- ROM MAR stamp 9 04 2026.pdf

State of Illinois Chief Procurement Office General Services 1 BOA for Orders Against Master Contracts V.18.1 DoIT Legal – March 2023

ORDERING INFORMATION

Item

Description (manufacturer, model, serial number, feature, etc.) Qty

One Time Charge Periodic Charge

Unit Extension Unit Extension 1 Gemini Enterprise MVP 1 $45,000

2 Deal Acceleration Funds (DAF) 1 Minus $45,000

Total (NTE): $.00

STATE OF ILLINOIS BASIC ORDERING AGREEMENT (BOA) for Orders Against Master Contracts The terms and conditions of this BOA, including those terms and conditions set forth in the additional documents referenced below, and any continuation sheets, constitute the entire agreement between the parties with respect to the subject matter of this BOA. State documents will prevail in the event of a conflict between State and Vendor documents. The State shall not be bound by terms and conditions contained in any other document except as attached herein.

CONTACT INFORMATION

Vendor Name: Zion Cloud Solutions LLC Address: 2700 Patriot Boulevard, Suite 250, Glenview, IL 60026 Contact: Arun Reddy Phone #: (224) 904-4905 Email: Arun.reddy@zionclouds.com Fax #:

State Agency Name: Department of Innovation and Technology Address: 120 W. Jefferson Street, Springfield, IL 62702 Contact: Christopher Werth Phone #: 217-785-6814 Email: Christopher.werth@illinois.gov

Bill To:

Dept of Innovation & Technology Attn: Accounts Payable 120 W. Jefferson Street Springfield, IL 62702 DoIT.AccountsPayable@illinois.gov

Ship To:

Dept of Innovation and Technology 120 W. Jefferson Street Springfield, IL 60702 DoIT. ITPO.Communications@illinois.gov

CONTRACT INFORMATION

Contract #: P: 56202:45 Action: New Acquisition Type: Purchase Payment Cycle: Monthly Terms and Conditions: Master Contract Number Master Contract # for Terms and Conditions:

P-56202/ CMT456202

Term:

Begin Date:

8/17/2026

End Date:

5/31/2027

STATE USE ONLY

Reference Number: R-333529/ P-56202:45 Source Selection Method: Order Against Master Is Financing Needed? No Using Agency Funding Source:

• Fiscal Year: 2027

• Type: State

Approp. Account Code: 304-448-01-1900-00-00-3900 Detailed Expenditure Object Code: N/A IPB Reference Number: B-31821 Award Code: B Original Procurement Method: RFP IPB Publication Date: 9/20/2022 Subcontractors Utilized? Yes Subcontractors Disclosed? Yes

In processing this BOA, Vendor affirms that the Certifications and Financial Disclosures and Conflicts of Interest, if any, as attached to the Master Contract referenced above are true and accurate as of the date of Vendor’s processing of this BOA.

mailto:Arun.reddy@zionclouds.com mailto:DoIT.AccountsPayable@illinois.gov mailto:DoIT.%20ITPO.Communications@illinois.gov

State of Illinois Chief Procurement Office General Services 2 BOA for Orders Against Master Contracts V.18.1 DoIT Legal – March 2023

ADDITIONAL INFORMATION / REFERENCES / ATTACHMENTS

Master Contract # P-56202/ CMT456202 (To the extent that the Master Contract, including any additional licensing/product specific terms or other attachments thereto, expires or terminates, the terms and conditions of the Master Contract shall survive and continue to apply to the products and services being provided under this BOA. Further, the terms and conditions of the Master Contract shall continue to govern beyond the Term of this BOA and throughout the life and duration of the products/licenses and any related services being provided hereunder.)

See attached SOW – Gemini Enterprise MVP for DoIT Operational Workflows executed 9/4/2026

SIGNATURES: The undersigned parties agree to these terms and conditions.

Vendor State of Illinois

Signature: N/A State Agency: Department of Innovation and Technology

Printed Name: Signature agency representative:

Title: Printed Name: Brandon Ragle by Chris Brinkmeyer

Date: Title: Secretary, State CIO by Agency Procurement Officer

Date:

State of Illinois

ALL NOTICES TO:

Email: DoIT.ITPO.Communications@Illinois.gov and DoIT.GeneralCounsel@Illinois.gov State of Illinois

Signature agency representative: Signature agency representative:

Printed Name: Printed Name:

Title: Title:

Date: Date:

Reviewed for legal clause sufficiency MAR 09/04/2026 mailto:DoIT.ITPO.Communications@Illinois.gov mailto:DoIT.GeneralCounsel@Illinois.gov

DoIT — Gemini Enterprise MVP

ZCS – DoIT Page 1

Gemini Enterprise MVP for DoIT Operational Workflows

Statement of Work (SoW) March 2026

SUBMITTED BY:

Zion Cloud Solutions 2640 Patriot Blvd. Suite 130 Glenview IL 60026

POINT OF CONTACT

Arun Reddy, Head of Delivery

224.904.4902 (O)

217.898.7843 (C) arun.reddy@zionclouds.com

Statement of Work

This Statement of Work (“SOW”) is agreed upon and entered into by and between Zion Cloud Solutions on behalf of itself and its affiliates (hereinafter referred to as “ZCS”) and the State of Illinois by the Illinois Department of Innovation & Technology (“DoIT” or “Customer”) effective as of the date last signed below. (The “Effective Date”).

The parties will adhere to will adhere to the terms of Joint Purchase Master Contract (JPMC)

- Technology Operations Professional Services (TOPS) No. CMT456202 (The “Contract”).

The Contract and the State’s Basic Ordering Agreement (BOA) shall govern the SOW. In the event of any conflict or ambiguity in terms or conditions, the order of precedence shall be as follows with lower numbers governing higher numbers: 1) the Contract, 2) the BOA, and 3) the SOW.

ZCS – DoIT Page 2

1 Executive Summary This Statement of Work (SOW) outlines the engagement between ZCS)and theDoIT to implement a Gemini Enterprise MVP instance tailored to DoIT’s operational workflows.

This engagement focuses on deploying the Gemini Enterprise platform, creating a Google Cloud Landing Zone, configuring enterprise connectors, and delivering five pilot use case agents — all built using the Google Agent Development Kit (ADK) for workflow orchestration requiring custom logic and multi-step processing. Rollout will be phased based on organizational readiness and adoption.

User onboarding will follow a phased approach, with an initial pilot group onboarded during the engagement and broader rollout planned following knowledge transfer. DoIT will determine pilot user selection and phasing.

1.1 Key Outcomes

• Production-grade Google Cloud Landing Zone for Gemini Enterprise deployed with enterprise security baseline, IAM structure, and networking configuration

• Gemini Enterprise MVP environment operational across configured data sources

• Native connectors configured for Microsoft SharePoint Online, OneDrive, ServiceNow, Outlook/Exchange, and SQL Server

• Workforce Identity Federation (WIF) with DoIT’s Okta tenant as the identity provider for single sign-on, inheriting Okta MFA policy, with group-based role-based access control (RBAC)

• Microsoft Entra ID application registration configured to authorize the Microsoft 365 connectors, with identity attribute mapping validated so that document-level permissions are correctly enforced for Okta-authenticated users

• Agent governance layer established using Agent Registry, Agent Identity, Agent Gateway, and Model Armor, providing a central catalog of approved agents and tools, per-agent identities, deny-by-default egress control, and runtime screening for prompt injection and sensitive-data leakage

• Five pilot AI agent use cases deployed via Google Agent Development Kit (ADK), leveraging native connectors as data sources where available and custom connectors where orchestration is required

ZCS – DoIT Page 3

• NotebookLM Enterprise implementation for purpose-built internal knowledge notebooks with conversational Q&A, including the Legal Rulemaking and Compliance Analysis use case

• Comprehensive audit trails with full logging and auditability of all Gemini interactions for compliance and governance

• Phased user onboarding framework with RBAC policies supporting DoIT’s initial pilot deployment and future agency-wide adoption

• Adoption and enablement program including a self-service adoption hub, role-based training video library, recurring office hours, and facilitated hackathons in Springfield and Chicago

• Operational guidance, documentation, and expansion roadmap for scaling beyond the initial pilot

Start date: August 10, 2026 End date: September 18, 2026

1 Scope of Services

ZCS will provide architecture, configuration, and delivery services to enable Gemini Enterprise MVP within DoIT’s Google Cloud environment. This engagement is structured across five phases: Assessment, Google Cloud Landing Zone Deployment, Gemini Enterprise Enablement, ADK Agent Use Case Deployment, and Knowledge Transfer & Handoff.

This engagement includes creation of a Google Cloud Landing Zone as DoIT does not have an existing environment configured for Gemini Enterprise services. All work will be performed within the Customer’s Google Cloud tenant.

ZCS – DoIT Page 4

1.1 Reference Architecture

The following diagram illustrates the Gemini Enterprise MVP reference architecture deployed within DoIT’s Google Cloud environment.

1.2 Data and Service Assessment Phase

This phase focuses on confirming DoIT’s operational environment, identifying pilot user personas, defining ADK agent requirements, and establishing the security and compliance framework for the deployment.

Activities

• Conduct discovery sessions with DoIT project management, IT security, operations, and compliance stakeholders to confirm objectives and data-governance expectations

• Review existing systems landscape, including SharePoint, OneDrive, ServiceNow, Outlook/Exchange, and any additional document repositories or knowledge bases

• Identify and define phased pilot user groups across project management, security, operations, and leadership teams

ZCS – DoIT Page 5

• Identify data sources, document repositories, and knowledge bases for Gemini Enterprise indexing

• Define connector requirements for Microsoft SharePoint, OneDrive, ServiceNow, and Outlook/Exchange

• Determine data-sensitivity classification, encryption, and access-control requirements

• Define security and compliance requirements including audit trail configuration and Workforce Identity Federation (WIF) with Microsoft Entra ID

• Confirm Generative AI-specific compliance expectations, including audit logging, model governance, and human-in-the-loop controls

• Document pain points and high-value automation opportunities across project management and operational workflows

• Develop initial system requirements including agent personas, boundaries, and environment configuration

• Define connector requirements for Microsoft SharePoint Online, OneDrive, ServiceNow, Outlook/Exchange, and SQL Server

• Confirm SQL Server topology for each in-scope use case, including version, hosting model (on-premises, Cloud SQL for SQL Server, or other cloud), available network path, and whether the use case requires live query or indexed search

• Identify the specific databases, tables, or curated views to be exposed, and agree the security boundary and read-only access model for each

Deliverables / Outcomes

• Requirements Matrix capturing security, access, network, and integration needs

• Pilot User Definition identifying the initial user group, roles, and access requirements

• Use Case Definition Document identifying prioritized agent personas, business scenarios, and ADK agent architecture with connector requirements

• Gemini Enterprise Deployment Readiness Document defining MVP boundaries, expected integrations, and business logic alignment

• Identity and Access Mapping Design, documenting the Okta workforce federation configuration, attribute and group mappings, the Entra ID application registration and consented Graph permissions, and the identity correspondence between Okta principals and Microsoft 365 access control identifiers.

1.3 Google Cloud Landing Zone Deployment

ZCS – DoIT Page 6

This phase establishes the foundational Google Cloud environment required for Gemini Enterprise and ADK services, including organizational structure, identity management, networking, and security baseline.

Activities

• Deploy Google Cloud organizational structure with appropriate project hierarchy for DoIT

• Configure IAM policies, service accounts, and role-based access controls aligned with State of Illinois security requirements

• Configure networking, VPC, and firewall rules as required for enterprise connectivity

• Establish billing configuration, cost controls, and resource quotas

• Implement security baseline including audit logging, Cloud Audit Logs, and organizational policies

• Validate Landing Zone readiness for Gemini Enterprise deployment

• Establish Workforce Identity Federation with DoIT’s Okta tenant as the identity provider, using a single workforce identity pool and a single provider shared by the Google Cloud console and Gemini Enterprise. OIDC with the authorization code flow is the preferred configuration.

• Inherit DoIT’s existing Okta multi-factor authentication and session policies; no parallel MFA mechanism is introduced on the Google Cloud side.

• Configure attribute mapping from Okta assertions, including subject, display name, and group membership, and scope the group claim to a filtered set of Gemini Enterprise access groups rather than all group memberships, to avoid group-overage token limits that can cause sign-in failures.

• Configure attribute conditions restricting federated access to DoIT-owned identity domains.

• Where DoIT supports it, configure SCIM provisioning from Okta so that group membership and user lifecycle changes propagate without manual maintenance.

• Grant IAM roles to Okta groups rather than individual users, so that pilot expansion and future agency onboarding are managed entirely in Okta.

• Register Gemini Enterprise as an OAuth 2.0 application in DoIT’s Microsoft Entra ID tenant and obtain administrator consent for the Microsoft Graph permissions required by the SharePoint Online, OneDrive, and Outlook/Exchange connectors.

• Map and validate the identity correspondence between Okta-authenticated principals and the Entra identifiers used in Microsoft 365 access control lists, ZCS – DoIT Page 7 using additional unique-identifier attribute mappings where DoIT’s identifiers differ between systems.

Deliverables / Outcomes

• Production-ready Gemini Enterprise Google Cloud Landing Zone with organizational structure, IAM, and networking configured

• Workforce Identity Federation operational with Microsoft Entra ID

• Security baseline documented and validated

• Landing Zone Readiness Confirmation for Gemini Enterprise enablement

1.4 Gemini Enterprise MVP Enablement Phase

This phase involves deploying and configuring Gemini Enterprise within DoIT’s Google Cloud environment, establishing the platform foundation for ADK agent deployment, and configuring identity integration via the Landing Zone.

Activities

• Deploy Gemini Enterprise control plane within the DoIT GCP environment

• Configure Gemini Enterprise platform, enabling ad-hoc natural language search across internal agency knowledge bases and documents as a baseline capability

• Provision and onboard the initial pilot user group with appropriate RBAC policies via Microsoft Entra ID

• Integrate Gemini Enterprise with DoIT’s core enterprise systems via native connectors:

◦ Microsoft SharePoint — document libraries, policy repositories, compliance archives, and templates

◦ Microsoft OneDrive — individual and shared document storage, project files, and working documents

◦ ServiceNow — risk registers, issue logs, IT service management, and project tracking

◦ Microsoft Outlook/Exchange — communications, calendar, meeting notes, and action item sources

◦ SQL Server – structured data access

• Configure comprehensive audit trails with full logging and auditability of all Gemini interactions, queries, and outputs for compliance and governance purposes

• Configure security controls for responsible AI usage, including content filtering and output controls

ZCS – DoIT Page 8

Deliverables / Outcomes

• Live Gemini Enterprise MVP deployment with platform operational and ad-hoc search available across configured data sources

• Configured and validated native connectors for SharePoint, OneDrive, ServiceNow, Outlook/Exchange, and SQL Server

• Pilot users onboarded with Workforce Identity Federation and validated RBAC policies

• Audit trail configuration documented and operational

1.4.1 — Agent Governance and Runtime Security This phase establishes the agent governance layer that all ADK agents deployed under this SOW will operate within. The objective is that every agent has a distinct identity, is catalogued, can only reach approved destinations, and has its prompts and responses screened against DoIT’s content and data-protection policy — without that logic being reimplemented inside each agent.

Activities

• Enable the Gemini Enterprise Agent Platform governance components within the

DoIT Google Cloud organization and confirm regional placement consistent with the Landing Zone design.

• Configure Agent Registry as the authoritative catalog of approved agents, tools, and any Model Context Protocol (MCP) servers used by the deployment, including ownership, version, and environment metadata for each entry.

• Provision a distinct Agent Identity for each ADK agent deployed under this SOW so that authorization decisions and audit records are attributable to a specific agent rather than a shared service account.

• Deploy Agent Gateway as the central policy enforcement point for agent interactions, configured in egress mode to govern agent calls out to Microsoft Graph, ServiceNow, SQL Server, and any other approved tool endpoint.

• Configure authorization delegation to Identity-Aware Proxy so that access control policies are defined centrally in IAM and evaluated per call, granting each agent identity egress rights only to the specific registered resources it requires.

• Establish deny-by-default egress: destination hosts not present in Agent Registry are blocked at the gateway before any authorization evaluation occurs.

• Configure Model Armor templates and attach them to the gateway to screen prompts and responses for prompt injection, jailbreak attempts, sensitive data disclosure, malicious URLs, and harmful content.

• Tune Model Armor Sensitive Data Protection settings to DoIT’s data classification, including review of default detector behavior that may block

ZCS – DoIT Page 9 legitimate State content, and align detected information types with the classification output of the Assessment Phase.

• Configure observability for the governance layer using Cloud Logging and Cloud Trace, including the authorization debugging view and blocked-egress reporting, and confirm these feed the audit trail described in §2.4.

• Conduct a governance validation test pass: confirm an unregistered destination is blocked, confirm an agent cannot reach a resource it has not been granted, and confirm a representative prompt-injection and a representative sensitive-data payload are both detected.

Deliverables / Outcomes

• Agent Registry populated with all agents, tools, and MCP endpoints in scope, with ownership and version metadata

• Per-agent Agent Identities provisioned and mapped to least-privilege IAM egress grants

• Agent Gateway operational as the enforcement point for agent-to-tool traffic, with deny-by-default egress verified

• Model Armor templates configured, attached, and validated against representative adversarial and sensitive-data test cases

• Agent Governance Design and Validation Record, documenting policy configuration, test results, and the operating procedure for registering future agents

1.4.2 — Data Protection and Personal Data Controls The following controls govern the handling of personal data throughout the engagement.

• Scoped ingestion. Outlook/Exchange and OneDrive connectors are scoped to the nominated pilot user group only, not the DoIT tenant at large. Where DoIT prefers, the initial synchronisation is performed against a dedicated set of pilot mailboxes and sites before any broader scope is enabled.

• Data residency and non-egress. All indexing, retrieval, and inference occurs within DoIT’s Google Cloud tenant in DoIT-designated regions. No DoIT content is copied to ZCS infrastructure, and no DoIT content is used to train, tune or improve any AI model.

• Permission-preserving retrieval. Connectors synchronize identity and access-control data alongside content so that every query result is trimmed to the requesting user’s existing entitlements in the source system. ZCS validates this by negative test before pilot users are onboarded.

ZCS – DoIT Page 10

• Least-privilege, time-bound ZCS access. ZCS personnel operate under named individual accounts with least-privilege roles scoped to the configuration tasks required, for the duration of the engagement only. ZCS holds no standing access to DoIT content. All ZCS access is recorded in Cloud Audit Logs and is reviewable by DoIT at any time.

• Sensitive data screening. Model Armor and Sensitive Data Protection templates are configured to detect and act on the information types identified in the Assessment Phase data-sensitivity classification, applied to both prompts and model responses. Query autocomplete is configured to suppress suggestions that could disclose personal information.

• Encryption. Data is encrypted in transit and at rest by default. Where DoIT requires customer-managed encryption keys, CMEK is configured for the data stores in scope, subject to the key-region requirements of the third-party connectors.

• Auditability. Every query, the source documents retrieved, the response returned, and the identity of the requesting user are logged and retained per DoIT policy, providing a complete record for compliance review.

• Deletion and re-synchronisation. ZCS documents the procedure for purging a data store index and re-synchronising from source, so that DoIT can remove indexed personal data on request or in response to a records action.

• Human-in-the-loop boundaries. Agents in scope are read-and-draft only. No agent writes to, modifies, or deletes content in a DoIT source system without an explicit human approval step.

1.5 Use Case Deployment Phase

This phase focuses on deploying five AI agent pilot use cases and implementing NotebookLM for internal agency knowledge management. All five agents will be built using the Google Agent Development Kit (ADK) for workflow orchestration, leveraging native connectors as data access tools where available and custom connectors where multi-system orchestration is required.

Note: The specific use cases, integrated applications, and agent configurations described below are indicative and subject to refinement during the Assessment Phase.

DoIT may substitute alternative use cases of comparable complexity based on evolving priorities.

Legal Rulemaking and Compliance Analysis Agent - NotebookLM Enterprise Platform: NotebookLM Enterprise. Corpus curated and maintained by DoIT;

sources staged from SharePoint and OneDrive.

ZCS – DoIT Page 11

Problem: Problem: Legal teams need to analyse administrative rules, statutes, and pending legislation using a secure, state-controlled generative AI capability that operates only on a specific, user-controlled dataset, with every answer traceable to a source passage.

• Query a closed, DoIT-curated legal corpus — including the Illinois Administrative Code, Illinois Register, ILCS, designated state and federal caselaw sources, and agency policies — with no grounding in the public internet.

• Return answers with inline citations to the specific source passage, sufficient for manual verification by legal staff.

• State explicitly when an answer is not supported by the loaded sources, and identify which sources were consulted, rather than extrapolating.

• Maintain persistent, shareable notebooks scoped to particular subject areas, so that research is organised and reusable across sessions and staff.

• Generate structured draft outlines for new proposals, including section-by-section mapping to controlling authorities and compliance checklists.

• Apply notebook-level access control so that corpus visibility follows DoIT’s role definitions, with all access logged.

• Carry a non-legal-advice notice in the notebook description and in DoIT’s usage policy for the capability.

NotebookLM Implementation

• Provision and configure Google NotebookLM for DoIT internal use

• Create purpose-built notebooks specializing in specific document sets, starting with operational SOPs and onboarding materials that can be shared with staff, allowing them to ask questions conversationally

• Define document loading workflows and agency knowledge base architecture for shareable, conversational Q&A notebooks

• Train designated DoIT staff on NotebookLM usage, document management, and notebook creation best practices

Additional Use Cases Use Case Discovery and Selection

During the Discovery Phase of this engagement, Zion Cloud Solutions and the Client will collaboratively identify, evaluate, and prioritize potential use cases. Four (4) specific use cases will be finalized and mutually agreed upon for implementation under this Statement of Work.

ZCS – DoIT Page 12

Connector Scope and Limitations

To ensure successful delivery within the agreed timeline, the selected use cases are strictly constrained to integrations with the following approved systems. All data ingestion and automation must be supported by these specific connectors:

Microsoft SharePoint Microsoft OneDrive Microsoft Outlook / Exchange ServiceNow SQL Server

Out of Scope: Any use cases requiring data extraction, ingestion, or integration with systems, applications, or data sources not explicitly listed above are considered out of scope. Expanding the scope to include additional connectors will require a formal Change Request and may impact the project timeline and budget.

Deliverables / Outcomes

• Five ADK agents deployed and operational across configured enterprise systems, validated against pilot scenarios

• NotebookLM workspace configured with at least one purpose-built knowledge notebook

• Agent Configuration Repository including roles, intents, logic blocks, and connector configurations

• MVP Demonstration Guide for use by DoIT internal teams

1.6 Knowledge Transfer and Handoff

Upon completion of implementation, ZCS will provide knowledge transfer sessions and documentation to ensure DoIT teams can confidently manage and scale the deployed environment.

Activities

• Conduct final walkthroughs of Gemini Enterprise environment, Gemini Enterprise configuration, ADK agent architecture, and NotebookLM setup

• Provide best practices for operating and scaling Gemini Enterprise, including connector management, agent maintenance, and security governance

• Present recommendations for expanding from the initial pilot to broader agency adoption

• Deliver guidance on extending ADK agents with additional custom connectors and workflow capabilities

• Address questions and ensure stakeholder alignment on next steps

ZCS – DoIT Page 13

Deliverables / Outcomes

• Knowledge Transfer Session(s) with walkthroughs and Q&A

• Operational Best Practices Guide for Gemini Enterprise management and governance, ADK agent operations, and security administration

• Expansion Roadmap outlining recommended steps for scaling from pilot to phased Gemini Enterprise rollout across DoIT and agencies

• Project Closure Summary confirming completion and success criteria alignment

1.7 Adoption and Enablement

Platform capability alone does not produce adoption. This phase delivers the enablement assets, recurring support, and engagement events required for DoIT staff to use the deployed capabilities and to generate a pipeline of subsequent use cases.

Adoption Hub

• Stand up a single internal landing site as the entry point for all Gemini Enterprise resources at DoIT, hosted on a DoIT-controlled platform.

• Publish the training video library, quick-start guides, the catalog of deployed agents and notebooks with the questions each is good at, an FAQ maintained from office-hours questions, the office-hours schedule, and an intake form for new use case requests.

• Hand over editorial ownership and a maintenance procedure to a named DoIT owner at closure.

Training Video Library

• Produce a library of short role-based videos, each three to six minutes, screen-recorded against the deployed DoIT environment with voiceover and captions, hosted within DoIT’s tenant.

• Module coverage: getting started and Okta sign-in; effective search and prompting technique; a walkthrough per deployed agent; NotebookLM notebook authoring and sharing; responsible use, data handling, and what not to put into a prompt; and administrator modules for connector management, RBAC, and agent governance.

• Deliver source files and a documented production template so DoIT can extend the library after handoff.

Office Hours

• Facilitate a recurring sixty-minute open session each week for the duration of the engagement and for four weeks following handoff.

• Maintain a logged question and answer record, feeding recurring questions into the FAQ and the video backlog.

ZCS – DoIT Page 14

Hackathons — Springfield and Chicago

• Facilitate one one-day event in Springfield and one in Chicago, run against a prepared sandbox environment with starter templates, sample data, and a judging rubric.

• ZCS provides facilitation, technical mentorship, environment preparation, and the post-event writeup. DoIT provides venue, participant recruitment, internal communications, and any catering or travel for DoIT staff.

• Deliverable: a prioritised backlog of candidate use cases with an effort and value assessment for each, feeding the expansion roadmap.

Adoption Measurement

• Configure an adoption dashboard covering active users, query volume per user, usage by agent and notebook, and office-hours and training engagement.

• Establish a baseline at pilot launch and report against it at closure, with a recommended ongoing reporting cadence for DoIT.

1.8 Out of Scope

• Terraform Infrastructure-as-Code development or deployment

• Create new step-by-step documentation to set up and operate Customer’s

Google Cloud environment beyond this engagement

• Provision of third-party training licenses. Instructor-led training is limited to the sessions, office hours, and hackathons specified in §2.7; formal curriculum development, certification programs, and train-the-trainer delivery beyond those sessions are not included.

• Research or provide leading practice advice on deployment configurations for unsupported product functionality, custom software or tools, third-party applications, or integrations

• Develop data processing pipelines to bring data in the format ready for consumption

• Custom UI/UX development or front-end application development

• ServiceNow workflow customization or reengineering

• Any development or support activities not explicitly stated in the Scope of

Services

• Onboarding users beyond the agreed initial pilot group during this engagement

2 Deliverables and Assumptions This section defines the concrete outputs ZCS will produce during this engagement, as well as the assumptions and prerequisites required for successful project execution.

ZCS – DoIT Page 15

2.1 Deliverables

Deliverables for this engagement include:

# Deliverable Description Format / Location

Technical Design Document

(TDD)

Architecture diagrams, IAM/WIF design, Enterprise Search configuration, connector mapping, ADK agent architecture, and security controls

PDF / Google Docs

Gemini Enterprise MVP Deployment

Configured Gemini Enterprise environment with Gemini Enterprise, Enterprise Search, native connectors, and ADK agents operational within DoIT’s GCP tenant

Google Cloud Platform Console

NotebookLM Implementation

Configured NotebookLM workspace with at least one purpose-built knowledge notebook (SOPs/onboarding) and staff trained on usage

NotebookLM / Google Docs

Operational Best Practices Guide

Playbook for scaling, managing, and securing the deployed environment including connector governance, ADK agent maintenance, and expansion planning

Knowledge Transfer & Closure

Live working session + closure summary including pilot validation results and expansion roadmap for broader rollout

Slides / Live Walkthrough

Agent Governance Design and Validation Record

Agent Registry contents, agent identity and IAM egress model, gateway policy configuration, Model Armor template settings, and validation test results

Identity and Access Mapping Design

Okta workforce federation configuration, attribute and group mappings, Entra ID application registration and consented Graph permissions, and Okta-to-Microsoft 365 identity correspondence

8 Data Protection

Controls Record Ingestion scope, permission-trimming validation results, sensitive data screening configuration, encryption and

ZCS – DoIT Page 16

CMEK settings, and index deletion and re-synchronisation procedures

Adoption Hub

Internal landing site with video library, quick-start guides, agent catalog, FAQ, and use case intake, transferred to a named DoIT owner

Website

Training Video Library

Role-based short-form videos with captions, source files, and a production template for DoIT extension. Final count subject to the scope decision in Part C

Hackathon Outcomes Report

Prioritised use case backlog from the Springfield and Chicago events with effort and value assessment

Adoption Dashboard and Baseline Report

Usage and engagement metrics with pilot-launch baseline, closure report, and recommended ongoing cadence

2.2 Assumptions

ZCS will align employees on objectives and will provide appropriate staffing levels to ensure the success of the engagement.

Delivery of the Services requires Gemini Enterprise to index content from DoIT systems that contains personal data, including but not limited to mailbox content, calendar entries, contacts, meeting notes, individual document stores, and ServiceNow records.

Both parties acknowledge this. Personal data is processed only within DoIT’s own Google Cloud tenant, under the controls set out in §2.4.2. ZCS does not receive, store, or process DoIT personal data on ZCS-controlled systems.

Connector configuration reads from DoIT production source systems on a read-only basis. Gemini Enterprise data stores, agents, and the Landing Zone are deployed in a non-production Google Cloud project for the duration of the MVP unless DoIT directs otherwise in writing.

Customer will meet all the following project prerequisites BEFORE ZCS will start the Services:

• Customer will provision a Google Cloud organization with administrative access for ZCS to deploy the Landing Zone

• Acquire the necessary Gemini Enterprise access for the initial pilot group prior to or during the Enablement Phase

ZCS – DoIT Page 17

• Provide access to Microsoft SharePoint Online, OneDrive, ServiceNow, Outlook/Exchange, and SQL Server environments with appropriate API permissions, service accounts, and — for SQL Server — network connectivity and a read-only database account scoped to the agreed databases or views.

• Share labeled data and sample documents for testing purposes

• Provide any business logic needed to develop the identified use cases

• Customer uses Microsoft Entra ID as its primary identity provider for Workforce

Identity Federation

• Identify and nominate pilot users prior to the Enablement Phase

• Provide ZCS with access to subject matter experts for technical and business discussions to support decision making

• Provide a single point of contact to facilitate communication between ZCS and the Customer project team

• Assign a project sponsor who will serve as an escalation point for timely completion of tasks

• Align stakeholders to attend the kickoff meeting and regular calls as part of the engagement

• Confirm the lawful basis and internal policy approval for indexing mailbox, calendar, and contact content, and complete any staff notification required under State of Illinois or DoIT policy, prior to connector enablement

• Confirm whether a data processing agreement, privacy impact assessment, or State security review is required, and identify the DoIT owner and target date for each

• Confirm the data-sensitivity classifications and information types that must be blocked or redacted in prompts and responses

Customer will perform the following ONGOING activities during the engagement:

• Respond to decisions designated as critical path within three (3) business days, and to all other decision requests within five (5) business days. Critical-path decisions are limited to the following and are identified as such when raised: pilot user nomination; connector credential and permission provisioning; use case selection and sign-off at the end of Assessment; legal corpus scope and curation for NotebookLM; and SQL Server topology and access approval.

• Collaborate on requirements analysis, documentation review, and validation testing.

• Provide a single Technical Lead as the day-to-day technical counterpart to the ZCS team, with sufficient authority or access to escalate for technical decisions.

ZCS – DoIT Page 18

• Provide a Project Sponsor as the escalation point for decisions, deliverable review, and sign-off.

• Provide, and keep current, a contact list of stakeholders and participants — names, roles, and email addresses — for sessions, office hours, and hackathons.

• Make subject matter experts available on request for technical and business discussions, for scheduled sessions rather than continuous allocation.

3 Success Criteria

• ZCS will provide documentation outlining deliverables completed as outlined in

Section 2.1

• Operational Google Cloud Landing Zone with IAM, WIF, networking, and security baseline validated

• Operational Gemini Enterprise MVP environment and validated across configured data sources

• Pilot users successfully onboarded with validated SSO/RBAC access via

Microsoft Entra ID

• Validated connectors for SharePoint, OneDrive, ServiceNow, Outlook/Exchange, SQL Server

• Security logging and audit trails implemented and verified

• Demonstrated functionality of the following pilot use cases:

◦ Security Policy & Compliance Documentation Agent (ADK)

◦ Risk & Issue Analysis Summarization Agent (ADK)

◦ Knowledge Base & SOP Creation Agent (ADK + NotebookLM)

◦ Automated Project Documentation Agent (ADK)

◦ Automated Meeting & Action Item Tracking Agent (ADK)

• Validation that ADK agents enable DoIT staff to:

◦ Search across internal knowledge bases and documents using natural language

◦ Retrieve and cross-reference compliance documentation instantly

◦ Summarize risk registers and issue logs into executive-ready formats

◦ Auto-generate project documents from templates and project data

◦ Extract, assign, and track action items from meetings automatically

ZCS – DoIT Page 19

• NotebookLM workspace operational with at least one purpose-built knowledge notebook and staff trained on usage

• Delivery of all agreed documentation and handoff materials, including TDD, Operational Best Practices Guide, and Knowledge Transfer completion

• Pilot users successfully authenticate to Gemini Enterprise through Okta with existing MFA policy enforced, and IAM entitlements resolve from Okta group membership

• Permission-trimmed retrieval validated by negative test: a pilot user cannot retrieve SharePoint, OneDrive, or Outlook content to which their Microsoft 365 permissions do not entitle them

(Each of the above listed events a “Success Criterion”).

As Zion completes each deliverable listed in section 2.1 (Deliverables) and each Success Criterion listed in this section 3 (Success Criteria), (each a “Deliverable”), Zion will notify DoIT and provide DoIT with documentation of completion of each Deliverable. DoIT will then then have three days (3) days to evaluate the Deliverable and to either notify Zion that it accepts the Deliverable, or to advise Zion in writing identifying any deficiency with specificity. Zion will then have two (2) days to correct the deficiency and advise DoIT of that correction. This review process will then repeat until the deficiency has been corrected and DoIT has accepted the Deliverable.

4 Financials ZCS will provide the services outlined in this Statement of Work on a fixed-fee basis.

The pricing structure is based on the delivery of the Gemini Enterprise MVP engagement.

4.1 Services Cost Summary

# Item Frequency Rate (USD) 1 Gemini Enterprise MVP One-time 45,000

Deal Acceleration Funds (DAF)* (45,000) Invoice amount to DoIT $0

*Pending approval by Google Cloud This pricing includes all inclusive of effort and taxes to complete the deliverables and activities listed in Sections 2 and 3 of this SOW. Any expenses (if incurred) will be billed as incurred, with prior written approval from DoIT.

ZCS – DoIT Page 20

5 Roles and Responsibilities This section outlines the responsibilities of both ZCS and DoIT during the execution of the Gemini Enterprise MVP. It ensures clear alignment on accountability, technical ownership, and stakeholder engagement throughout the project lifecycle.

ZCS – DoIT Page 21

5.1 ZCS Roles and Responsibilities

Role Responsibilities

Engagement Lead

Oversee project delivery and status tracking. Manage scope, priorities, and timeline. Serve as the primary point of contact for DoIT stakeholders. Own scheduling and coordination of all working sessions, knowledge transfer, office hours, and hackathons, using the contact list provided by DoIT, so that scheduling effort does not fall to DoIT staff.

Cloud Infrastructure Architect

Design Landing Zone organization structure, IAM, networking, and security controls. Define Workforce Identity Federation with Okta and the Entra ID application registration required for Microsoft 365 connector authorization, including identity attribute mapping and validation.

Gemini Enterprise Technical Lead

Lead deployment and integration of Gemini Enterprise framework. Configure Gemini Enterprise, Enterprise Search, native connectors, and audit trails.

ADK Developer / AI Engineer

Build and deploy ADK-based agents with custom workflow orchestration. Develop custom connectors for project documentation and meeting tracking use cases.

DevOps / Automation Engineer

Deploy Landing Zone infrastructure. Configure networking, IAM, and monitoring. Manage environment setup and connector validation.

The following roles will be required from the Customer’s team for this engagement.

These will not need to be dedicated full time to the project, though they will need to attend relevant portions of the project.

5.2 Customer Roles and Responsibilities

Customer Role Responsibilities

Project Sponsor

Provide direction throughout the engagement. Review and sign off deliverables. Escalation point for decisions and for timely completion of DoIT-owned tasks. Not required full time.

Technical Lead

Single day-to-day technical counterpart to the ZCS team.

Provide insight into the existing enterprise environment, Okta configuration, Entra ID tenant, SharePoint Online and OneDrive architecture, ServiceNow instance, and SQL Server topology. Coordinate access provisioning and support integration validation. Not required full time.

ZCS – DoIT Page 22

Subject Matter Experts (as needed)

Attend scheduled sessions relevant to their area — legal, security, project management, operations — to provide business logic and validate agent behaviour. Scheduled by the ZCS Engagement Lead; no standing allocation required.

6 Project Timeline The duration for the Gemini Enterprise MVP is seven (7) weeks, beginning approximately two weeks after the effective date of this Statement of Work. The start date is contingent on the availability of both ZCS and DoIT resources.

The project will be executed in structured phases to ensure continuity, stakeholder validation, and successful handoff.

The schedule assumes the decision turnaround commitments in §2.2 are met. Because the engagement is seven weeks in duration, decision latency consumes schedule directly rather than being absorbed by float. A single critical-path decision returned in five business days rather than three moves dependent milestones by the same amount.

Delays attributable to decision turnaround, access provisioning, or credential availability will shift the affected milestones accordingly and will be tracked in the weekly status report.

6.1 Key Milestones

• Kickoff & Discovery — Week 1

• Landing Zone Deployed & Validated — End of Week 2

• Gemini Enterprise Platform & Ad-Hoc Search Operational — End of Week 4

• All 5 Use Case Agents & NotebookLM Demonstrated — End of Week 5

• Testing & Validation Complete — End of Week 6

• Project Closure & Handoff Complete — End of Week 7

Deliverable / Activity Wk 1 Wk 2 Wk 3 Wk 4 Wk 5 Wk 6 Wk 7 Discovery & Assessment

Landing Zone Deployment

GE Enablement & Enterprise Search

ZCS – DoIT Page 23

Use Case Development

Testing & Validation

Knowledge Transfer & Closure

7 Change Requests

Either party may request a material modification to this SOW by submitting a change request to the other party (“Change Request”). Upon receipt of a Change Request, the parties will have ten (10) business days after the Change Request is submitted to agree to amend this SOW, or execute a new BOA, with a change order executed by the parties; otherwise, the Change Request will be considered withdrawn. Any project changes that are outside the scope of this SOW, including additional costs or fees, may be subject, as determined by DoIT, to an additional procurement and internal DoIT approvals, subject to the requirements and limitations of, and governed by, the Illinois Procurement Code (30 ILCS 500), the State Prompt Payment Act (30 ILCS 540) and the Illinois Criminal Code (720 ILCS 5/33E-9).

7.1 Change Request Process

A Change Request will include the following:

Change Request Element Description

Reference Information Original SOW Title, Effective Date, and associated Agreement

Description of Change A clear summary of the proposed change to scope, deliverables, or timeline

Reason for Change Rationale or business driver for the requested change

Impact on Deliverables

Any updates to artifacts, documentation, or solution configurations

Impact on Resources Additional staffing needs, skill sets, or stakeholder requirements

Impact on Timeline Revised milestone schedule or final delivery date

ZCS – DoIT Page 24

Financial Implications Adjustments to the fixed fee or additional effort required.

Approval Date The effective date when the Change Request is mutually signed

7.2 Execution

ZCS – DoIT Page 25

Change Requests must be reviewed and approved in writing by both parties before any new work begins.

Work outside the scope of this SOW will not be performed unless a Change Request has been executed.

8 Signatures

[Illinois Department of Innovation & Technology] Name:

Title:

Signature: …………………………………………………………………

Date:

[Zion Cloud Solutions] Name: Arun Reddy

Title: Head of Delivery

Signature: …………………………………………………………………

Date: 09/04/2026

Reviewed for legal clause sufficiency MAR 09/04/2026