Executed P-57795-17- R-333676- BOA-Active Cyber Okta Services FY27- vendor w SOW LS.pdf

State of Illinois Chief Procurement Office General Services 1 BOA for Orders Against Master Contracts V.18.1 DoIT Legal – March 2023

ORDERING INFORMATION

Item Description

(manufacturer, model, serial number, feature, etc.) Qty One Time Charge Periodic Charge

Unit Extension Unit Extension 1 IAM Practice Lead/Architect 1170 $282.40 $330,408.00 2 IAM Project Manager/Managing Consultant 5850 $260.00 $1,521,000.00 3 IAM Technical Consultant/Engineer 20963 $251.20 $5,265,905.60

BOA Total (NTE): $7,177,313.60

STATE OF ILLINOIS BASIC ORDERING AGREEMENT (BOA) for Orders Against Master Contracts The terms and conditions of this BOA, including those terms and conditions set forth in the additional documents referenced below, and any continuation sheets, constitute the entire agreement between the parties with respect to the subject matter of this BOA. State documents will prevail in the event of a conflict between State and Vendor documents. The State shall not be bound by terms and conditions contained in any other document except as attached herein.

CONTACT INFORMATION

Vendor Name: Matrix Systems Group Inc.

Address: 519 S. Grand Ave. West, Springfield, IL 62704 Contact: Nathan Boyd Phone #: 217-522-4940 Email: nboyd@matrixsysinc.com

State Agency Name: Department of Innovation and Technology Address: 120 W. Jefferson Street, Springfield, IL 62702 Contact: Chris Werth Phone #: 217-785-6814 Email: Christopher.werth@illinois.gov

Bill To:

Dept of Innovation & Technology Attn: Accounts Payable 120 W. Jefferson Street Springfield, IL 62702 DoIT.AccountsPayable@illinois.gov

Ship To:

Dept of Innovation and Technology 120 W. Jefferson Street Springfield, IL 62702 Phone: 217-557-1122 DoIT.ITPO.Communications@illinois.gov

CONTRACT INFORMATION

Contract #: P-57795:17 Action: New Acquisition Type: Purchase Payment Cycle: Periodic Terms and Conditions: BOA Terms and Conditions Master Contract # for Terms and Conditions:

P-57795 / CMT3037112

Term:

Begin Date:

11/1/2026

End Date:

10/31/2027

In processing this BOA, Vendor affirms that the Certifications and Financial Disclosures and Conflicts of Interest, if any, as attached to the Master Contract referenced above are true and accurate as of the date of Vendor’s processing of this BOA.

mailto:DoIT.AccountsPayable@illinois.gov mailto:DoIT.ITPO.Communications@illinois.gov

State of Illinois Chief Procurement Office General Services 2

V.18.1 DoIT Legal – March 2023

ADDITIONAL INFORMATION / REFERENCES / ATTACHMENTS

Master Contract # P-57795/ CMT3037112 (To the extent that the Master Contract, including any additional licensing/product specific terms or other attachments thereto, expires or terminates, the terms and conditions of the Master Contract shall survive and continue to apply to the products and services being provided under this BOA. Further, the terms and conditions of the Master Contract shall continue to govern beyond the Term of this BOA and throughout the life and duration of the products/licenses and any related services being provided hereunder.)

See the attached SOW for Matrix Systems Group Inc.

SIGNATURES: The undersigned parties agree to these terms and conditions.

Vendor State of Illinois

Signature: N/A State Agency: Department of Innovation and Technology

Printed Name: Signature agency representative:

Title: Printed Name: Brandon Ragle

Date: Title: Secretary, State CIO

Date:

State of Illinois

ALL NOTICES TO:

Email: DoIT.ITPO.Communications@illinois.gov and DoIT.GeneralCounsel@Illinois.gov State of Illinois

Signature agency representative: Signature agency representative:

Printed Name: Radhiki Lakhani Printed Name: Mary Feagans

Title: General Counsel Title: Chief Fiscal Officer

Date: Date:

STATE USE ONLY

Reference Number: R- 333676/ P-57795:17 Source Selection Method: Order Against Master Is Financing Needed? No Using Agency Funding Source:

• Fiscal Year: 2027

• Type: State

Approp. Account Code: 304-448-01-1900-000-3100 Detailed Expenditure Object Code:

IPB Reference Number: B-37112 IPB Publication Date:7/24/2024 Award Code: A Original Procurement Method: IFB Subcontractors Utilized? No Subcontractors Disclosed? No

Reviewed for Legal Clause Sufficiency-B.R.W 8/14/26

08/31/2026

09/01/2026

08/31/2026 mailto:DoIT.ITPO.Communications@illinois.gov mailto:DoIT.GeneralCounsel@Illinois.gov

State of Illinois Chief Procurement Office General Services 3

V.18.1 DoIT Legal – March 2023

Okta Services for State of Illinois-

Department of Innovation and

Technology For Identity and Access Management Professional Services

1 EXECUTIVE SUMMARY

This Statement of Work (“SOW”) details the professional services that Active Cyber LLC (“Active Cyber”) will perform on behalf of Matrix Systems Group Inc ("Matrix", and collectively with Active Cyber, the “Provider”) for State of Illinois, Department of Innovation and Technology (“Illinois Department of Innovation &

Technology”, “DoIT”, “State”, “Client” or “Customer”, and together with Active Cyber, the “Parties”), including the deliverables, pricing, and payment schedules (the “Professional Services”) and the responsibilities of

Customer. This SOW is entered into in connection with and pursuant to the terms of that certain Basic

Ordering Agreement entered into between the Parties (the “BOA”). The Parties acknowledge that additional

SOWs may be entered into between the Parties at such time as additional efforts are initiated, however any subsequent SOWs agreed to by the parties shall be subject to prior internal State of Illinois written approvals and the requirements and limitations of applicable laws and regulations, including but not limited to the

Illinois Procurement Code (30 ILCS 500) and the Illinois Criminal Code (720 ILCS 5/33E-9). If Customer wishes to secure additional services to implement additional functionality not included in their current software license, or not included in the scope of this SOW, Provider will provide a proposal for such services and may develop a separate Statement of Work. The Professional Services shall be performed either at

Customer location or within a Provider office. Provider anticipates that the majority of the work set forth under this SOW will occur on Provider premises or remotely, unless otherwise mutually agreed upon by

Customer and Provider. In no instance shall professional services, or any services requiring the storage and transmission of Customer data occur outside of the Continental United States.

1.1 Provider Understanding

This Statement of Work (SOW) outlines the services to be provided by Provider to the State of Illinois

Department of Innovation and Technology (DoIT) for the operational management, support, and integration of various systems including Okta IL Workforce, ILogin and ILPartner. The services encompass preparation for successful operations, integration activities, documentation, training, and ongoing support to ensure the effective functioning of these systems. Section 2.1(d) of this SOW includes several initiatives which the

State anticipates performing over the duration of the term of this SOW. They are not fixed deliverables or commitments to complete every feature. The specific work, timing, staffing mix, and sequence will be jointly prioritized throughout the term.

2 APPROACH

2.1 Project Activities and Deliverables

Scope:

Provider will assist DOIT with the regular production operation and maintenance of Customer's Okta Identity platform and the integrations with related applications. This SOW reflects several initiatives which the State may wish to perform over the course of the next year.

Description of Roles and Responsibilities for the roles to be staffed on the project:

1. Principal / Practice Lead / Architect –

a. Solution architects.

b. Lead worker for the professional services team.

c. Develops roadmap and deployment plans for achieving state goals.

d. Provides subject matter expertise on IAM goals for the state.

2. Identity Program / Project Manager / Managing Consultant -

a. Develop training requirements.

b. Deliver end-user training.

c. Deploy support infrastructure.

d. Facilitate meetings,

e. manage and track resource hours and assignments.

f. Manage and track IAM configuration and system integrations.

g. Monitor and report progress on configuration and system integrations.

3. Technical Consultant / IAM Engineer –

a. System design for IAM products.

b. Will develop configuration and applications integrations to onboard state applications into IAM products.

c. Develop any needed custom coding and unit testing for configuration and integrations.

d. System integration testing

e. Support Use Acceptance testing

f. System documentation

g. Knowledge transfer

h. Analyzes current IAM processes and workflows.

i. Develops process maps and documentation for state staff transition.

j. Gathers requirements and defines business needs.

k. Assists in creating transition plans for IAM operations.

l. Documents IAM processes, best practices, and lessons learned.

m. Facilitates workshops and training for state staff.

n. Provides support during the transition to state staff.

Provider will assist DOIT with the regular production operation and maintenance of Customer's Okta Identity platform and the integrations with related applications and will be responsible for the following:

Epic # Epic Practice Lead Hours

Program Manager Hours

Technical Consultant Hours

Total Hours

Partner Identity & Access Management (PIAM) Enablement & Operational Support

292.50

1,218.75

3,656.25

5,167.50

Epic Description:

This Epic encompasses both the strategic transformation and ongoing operational management of the PIAM solution within the SailPoint NERM/ISC environments.

Transformation work is gated by an initial viability assessment; if viable, effort covers implementing the updated

Partner Identity Strategy, building required customizations, and decommissioning legacy infrastructure. If non-viable, focus pivots to an in-house custom path and legacy decommissioning.

Concurrently, this Epic provides steady-state support, including lifecycle workflow configuration, system health monitoring, audit compliance, and incident response to maintain continuous operational readiness.

Feature # Feature Description

1.01 Production PIAM Solution Viability Configuring PIAM and demonstrating a viable SailPoint ISC & SailPoint NERM capability to meet leadership requirements

1.02 PIAM Solution Enablement If viable, move forward with the implementation of a new Partner Identity Strategy using SailPoint ISC & SailPoint NERM capabilities, or work with the State on an in-house customized solution followed by the decommissioning of the existing SailPoint NERM and ISC.

1.03 Ad Hoc Documentation Requests This feature supports the creation of on-demand documentation for new or updated configurations, application integrations, or operational changes within the SailPoint NERM/ISC environment.

These documents may be requested by stakeholders, auditors, or internal teams and are essential for maintaining transparency, traceability, and operational readiness.

1.04 Configuration & Workflow

Management

Manages the configuration of SailPoint NERM/ISC, including, Partner identity lifecycle workflows, and provisioning logic within SailPoint NERM/ISC. Ensures that identity profiles, attribute mappings, workflows and similar features are aligned with business and compliance requirements across environments.

1.05 Monitoring, Reporting & Operational

Support

Provides continuous oversight and performance of system monitoring, SailPoint NERM/ISC operations, including workflow execution (e.g., provisioning), Platform & system health, and error tracking, and Backup & Recovery. Supports the resolution of application, and operational issues through ticket triage, root cause analysis, and reporting.

1.06 Security & Incident Management Supports proactive detection and response to identity-related security incidents within SailPoint NERM/ISC. Includes log analysis, alerting, and coordination with security teams to investigate and remediate incidents.

Hours

Program Manager Hours

Technical Consultant Hours

Total Hours

2 Okta Tenant Management & Operational Support 390.00 2,388.75 6,093.75 8,872.50

Epic Description:

This Epic focuses on the ongoing operational support and tenant (platform) management of the six Okta tenants— three production and three preview—used across IL-Workforce, IL-Partner, and ILogin environments. It ensures the Okta tenants remain stable, secure and aligned with evolving business requirements, enhancements according to best practices, and compliance requirements, The Scope includes tenant health monitoring, service & incident management, access review support, tenant & application configuration and/or enhancements complying with the State's change management processes.

The goal is to maintain secure, reliable identity services while enabling continuous improvement and alignment with enterprise identity governance standards.

Feature

Feature Description

2.01 Access Review

Campaign Support

Manage access review campaigns ensuring approved identities retain access to the Okta tenant(s) and its application integrations.

2.02 Ad Hoc Documentation

Requests

This feature supports the creation of on-demand documentation for new or updated configurations, application integrations, or operational changes within the Okta environment. These documents may be requested by stakeholders, auditors, or internal teams and are essential for maintaining transparency, traceability, and operational readiness.

2.03 Configurations, Enhancements & Change Management

Manage configuration updates and enhancements across all six Okta tenants and their integrated applications. Ensure changes follow the State’s change management processes and align with Okta best practices to maintain platform stability, security, and compliance.

2.04 Health Monitoring &

Operational Support

Provides continuous oversight and performance of system monitoring, Okta operations, including application integrations (e.g., User & Group Management), Platform & system health, and error tracking and Backup & Recovery. Supports the resolution of application, and operational issues through ticket triage, root cause analysis, and reporting

2.05 Service, Security &

Incident Management

Manage and resolve incidents affecting Okta services and/or application related issues including after-hours support for production tenants. Supports the resolution of application, and operational issues through ticket triage, root cause analysis, and reporting.

Epic # Epic Practice Lead

Program Manager Hours

Technical Consultant Hours

Total Hours

3 Okta Application Integrations & Migrations 390.0 2,047.50 8,287.50 10,725.00

Epic Description:

This Epic covers the end-to-end lifecycle for integrating applications across the State of Illinois' Identity and Access Management (IAM) platforms—specifically Okta and SailPoint NERM/ISC. Scope spans intake, architecture assessment, configuration, testing, deployment, and post-go-live support for application integrations across the IL- Workforce, IL-Partner, and ILogin tenants. Additionally, it encompasses migrating existing integrations based on updated tenant categorizations and classifications.

While all tenants adhere to a standardized integration framework, SailPoint NERM policies and access workflows are tailored specifically to IL-Partner integrations to ensure robust governance for non-employee identities.

3.01 IL-Partner integrations with SailPoint

NERM/ISC Application Access Workflow Development

Manages the integration of Partner-facing applications into the IL-Partner Okta tenant and configuration of NERM application access workflows (if required). Ensures secure, compliant, and operationally ready deployments through planning, development, UAT, and access review. Involves IAM & NERM Teams, Partner Managers, and Application Team point of contact.

3.02 Application Integrations Manages the integration of employee-facing applications into the IL-Workforce & ILogin Okta tenants. Ensure secure, compliant, and operationally ready deployments through intake, planning, development, UAT, and go-live support. This process Involves the IAM Team and Application team point of contact.

Hours

Program Manager Hours

Technical Consultant Hours

Total Hours

4 Okta Support of SailPoint ISC Integration Program 97.50 195.00 1,950.00 2,242.50

Epic Description:

This epic defines the Okta Team’s responsibilities in supporting the State of Illinois’ SailPoint ISC implementation. It includes coordination across 80 agencies, integration readiness, data cleanup, provisioning alignment, and ongoing operational support. The goal is to ensure Okta is fully prepared and aligned for seamless identity lifecycle governance in collaboration with SailPoint, Azure AD, and Active Directory.

4.01 Agency Readiness & Data Cleanup Prepare each of the 80 state agencies for SailPoint ISC integration by ensuring identity data in Okta is clean, consistent, and aligned with governance standards. This includes validating identity sources (HCM, NSE), removing duplicates, and standardizing attributes.

4.02 Documentation & Enablement Provide comprehensive documentation and enablement resources for agency admins and stakeholders. This includes integration runbooks, onboarding guides, training materials, and centralized repositories.

4.03 Incident & Change Management Establish robust incident and change management processes to support the integration. This includes logging and resolving issues, managing configuration changes, and coordinating with SOC and SailPoint teams.

4.04 Integration Configuration & Support Configure Okta to support SailPoint ISC provisioning and deprovisioning workflows. This includes enabling SCIM or API-based connectors, ensuring secure communication, and validating integration flows.

4.05 Lifecycle Event Alignment Ensure Okta’s provisioning logic aligns with SailPoint’s lifecycle events (joiner, mover, leaver). This includes synchronizing attributes, managing group memberships, and enforcing role-based access controls.

Epic

Epic Practice Lead Hours

Program Manager Hours

Technical Consultant Hours

Total

ID Proofing Solution Enablement, Management & Operational Support

0.00

0.00

975.00

975.00

Epic Description:

This Epic encompasses evaluating, replacing, and supporting the State of Illinois ID Proofing solution. Scope includes assessing current state, evaluating Okta and homegrown alternatives, and driving implementation, go-live, migration, and retrofitting for existing users.

Additionally, it provides ongoing operational service management—including configuration, proactive health monitoring, incident response, documentation, stakeholder engagement, and continuous improvement.

5.01 Documentation Management Focuses on the creation of documentation required to support the implementation and operation of the ID Proofing service. This includes technical configurations, onboarding guides, operational procedures, troubleshooting playbooks, compliance artifacts, and stakeholder-facing materials. Ensures documentation is created accurately and stored in a centralized SharePoint repository.

5.02 Retrofitting Existing

Implementations

Ensure existing applications are compatible with the new ID Proofing service.

5.03 Service Offering Development Create a formal service offering for ID Proofing that agencies can adopt and rely on.

5.04 Implementation & Go-Live of

New ID Proofing Solution

Deploy the new ID Proofing solution into production and validate its readiness before migrating existing applications.

5.05 Existing User Enablement Design and implement a phased enablement strategy to apply the new ID Proofing solution to existing users across agencies and applications. This includes migrating verified user status & information, identifying impacted user populations, coordinating with application teams, resolving onboarding issues, and ensuring minimal disruption during rollout. The feature supports operational readiness, compliance, and user experience.

5.06 Migration Planning & Execution Transition agencies from Custom Experian integration to the new solution with minimal disruption.

5.07 Application of ID Proofing to

existing users (non-verified users)

Establish and manage a standardized process for enabling ID Proofing for all non-verified existing users. This includes designing onboarding workflows, automating identity verification steps, and ensuring consistent application across systems. The feature also supports the ongoing management of ID Proofed accounts, including monitoring, issue resolution, and compliance tracking.

5.08 Ad Hoc Documentation

Requests

This feature supports the creation of on-demand documentation for new or updated configurations, application integrations, or operational changes within the ID Proofing environment. These documents may be requested by stakeholders, auditors, or internal teams and are essential for maintaining transparency, traceability, and operational readiness.

5.09 Configurations, Enhancements &

Change Management

Manages configuration updates and enhancements for the ID Proofing solution. Ensures changes follow governance standards and maintain platform stability and compliance.

5.10 Health Monitoring & Operational

Support

Provides continuous monitoring of the ID Proofing platform to ensure system health, performance, and operational readiness.

Supports issue resolution and reporting.

5.11 Service, Security & Incident

Management

Supports proactive detection and response to service and security incidents. Includes coordination with support teams, incident documentation, and escalation procedures.

Hours consolidated for the planned work:

Epic Practice Lead

Hours

Program Manager

Hours

Technical Consultant

Hours Total Hours

Partner Identity & Access Management (PIAM) Enablement & Operational Support 292.50 1,218.75 3,656.25 5,167.50

Okta Tenant Management & Operational Support 390.00 2,388.75 6,093.75 8,872.50

Okta Application Integrations & Migrations 390.00 2,047.50 8,287.50 10,725.00

Okta Support of SailPoint ISC Integration Program 97.50 195.00 1,950.00 2,242.50

ID Proofing Solution Enablement, Management & Operational Support 0.00 0.00 975.00 975.00

TOTAL 1,170.00 5,850.00 20,963.00 27,983.00

2.2 Out of Scope

General Out of Scope Items

● Any activity not specifically included in the scope of this SOW

3 PROJECT EFFORT & COSTS

3.1 Level of Effort

Provider will provide Professional Services on a time and materials basis in accordance with the BOA. The Provider resources will be utilized at varying levels throughout the project duration.

Within the overall scope and not-to-exceed amount, Provider and Customer may reallocate hours among epics, features, roles, and qualified resources to respond to changing priorities, workload, or skill requirements. Such reallocation will not by itself require a change order unless it changes the overall scope, not-to-exceed amount, or other material terms.

Any changes to the not-to-exceed amount below shall be subject to a change order, but any such change order shall be subject to a new procurement or mutually agreed upon change order as well as prior Customer approvals and the requirements and limitations of applicable laws and regulations, including but not limited to the Illinois Procurement

Code (30 ILCS 500) and the Illinois Criminal Code (720 ILCS 5/33E-9).

A potential increase in hours may occur for, but is not limited to, any of the following reasons:

● Extended discovery sessions required to understand Customer’s requirements and determine scope.

● Customer’s project team struggles to meet deadlines and cooperate, as defined below. Examples include:

o failing to complete ''to do'' items in a timely fashion, o Failing to regularly participate in status meetings, o recurring, significant modifications of the scope; or o recurring challenges related to data sourcing and/or data quality.

Table – Estimate of hours consolidated for the planned work:

Provider Resource Hourly Rate Estimated Hours Total

IAM Practice Lead/Architect

$282.40 1,170.00 $330,408.00

IAM Program Manager/Managing Consultant

$260.00 5,850.00

$1,521,000.00

IAM Technical Consultant/Engineer

$251.20 20,963.00

$5,265,905.60

Total

27,983.00 $7,117,313.60

If more hours are needed or there is a change in Scope, Provider and Customer will work together in good faith to assess the need. Any additional costs or fees shall be subject to prior State of Illinois internal written approvals and the requirements and limitations of applicable laws and regulations, including but not limited to the Illinois Procurement Code (30 ILCS 500) and the Illinois Criminal Code (720 ILCS 5/33E-9).

Start Date : November 1st, 2026

End Date : October 31st, 2027

4 ASSUMPTIONS

Customer Assumptions:

● Actively participating, providing requested information, and otherwise completing its obligations as set forth in this SOW.

● Assigning a resource that is empowered to make decisions related to this SOW on behalf of Customer.

● Establishing a communication and escalation plan, jointly in collaboration with Provider.

● Providing access to any third-party services or software, as required and agreed upon by parties. Customer is responsible for the following:

General Project Assumptions

● Any service or activity not specifically included in this SOW is not included in the scope of this engagement.

● Provider and Customer shall work together in good faith to resolve any project issues quickly.

● The Professional Services will be conducted remotely and offsite

4.2 Expenses

All services will be performed remotely under this project; hence no expenses are allowed under this project.

5 SOW Agreement and Notice

This SOW and the BOA contain the entire understanding of the parties as it pertains to the purchase described in the BOA. Any notice given under this SOW shall be sufficient if it is sent in accordance with the notice provisions in the BOA.

IN WITNESS WHEREOF, the parties have caused this SOW to be executed and represent that the persons whose signatures appear below are duly authorized to execute this SOW.

Matrix Systems Group Inc

Illinois Department of Innovation and Technology

By: By:

Sign: Sign:

Title: Title:

Date: Date:

Mahdi Elmokashfi

President

8/11/26

Reviewed for Legal Clause Sufficiency-B.R.W 8/14/26

CONTACT INFORMATION