Exhibit 1_Statement of Work.pdf

RFP# 24-04

Managed Information Technology Services

Exhibit 2: Statement of Work 1 of 17

Exhibit 1: Statement of Work

This Statement of Work (“SOW”) outlines the Managed Services to be provided by [Vendor Name] (“Contractor”) to the Florida Department of Citrus (“Department”) pursuant to the terms and conditions of the Contract executed between the Parties. Under this Contract, the Parties acknowledge and agree to a Co-Managed Services model in which the responsibilities for the delivery, performance, and administration of IT services are shared between the Department and the Contractor. This model establishes clear boundaries of accountability to ensure operational clarity and service continuity.

1. COLLABORATION AND BOUNDARIES

Both Parties agree to collaborate and coordinate efforts where responsibilities intersect, particularly in areas such as:

• Identity and access controls

• Endpoint compliance reporting

• Incident response and root cause analysis

• Policy enforcement across cloud and endpoint environments

Each Party shall notify the other of any known dependencies or issues that may impact services within the other’s area of responsibility, and shall provide reasonable support to resolve such issues in a timely manner.

The Responsible Parry shall conduct all operational activities within their scope and shall manage the complete lifecycle of related Service Requests, Incidents, Changes, and Problems, including planning, execution, issue resolution, documentation, and compliance in the ISTM Tool.

In all circumstances, the Supporting Party will provide reasonable cooperation and support as required for effective service delivery for the Responsible Party. This may include, but is not limited to, access to systems, timely responses to information requests, business or technical context for service decisions, and participation in change or incident review processes.

2. DEPARTMENT RESPONSIBILITIES

The Department will retain sole responsibility for the management and support of all endpoint devices and related user-facing hardware and software components. Endpoint management is expressly excluded from the scope of the Contractor’s Managed Services obligations. The Department will perform the following functions in accordance with its own internal standards, policies, and procedures, and shall coordinate with the Contractor where dependencies or integrations exist.

2.1 Endpoint Management

The Department Managed Services encompass standard IT operational responsibilities and shall include fulfillment of all related Service Requests, Incidents, Changes, Problems, and routine administrative

Exhibit 2: Statement of Work 2 of 17 tasks associated with the following functional areas below. The Department retains responsibility for the performance and availability of the underlying services, while the Contractor provides operational support as directed.

2.1.1 Endpoint Device Provisioning and Maintenance

The Department will be responsible for the procurement, configuration, deployment, and lifecycle management of all endpoint devices used by its personnel. This includes:

• Laptops, desktops, tablets, mobile phones, and peripherals (e.g., monitors, printers, docking stations).

• Installation and maintenance of local operating systems, drivers, and user-level software.

• Hardware repairs, upgrades, and replacements in accordance with organizational standards.

2.1.2 Endpoint Support and Helpdesk Services

The Department will operate its own helpdesk or service desk to address all endpoint-related support issues using Contractor’s ITSM tool. This includes:

• On-site end-user support

• Troubleshooting and resolving hardware, operating system, and application issues on endpoint devices.

• Providing end-user assistance for login issues, software errors, printing, and device connectivity.

• Supporting remote access tools and VPN Departments installed on endpoint devices.

2.1.3 Endpoint Security and Compliance

The Department will be responsible for enforcing endpoint-level security policies and compliance controls. This includes:

• Deployment and management of endpoint protection software (e.g., antivirus, anti-malware, host firewalls).

• Enforcement of device encryption, screen lock policies, and local password policies.

• Management of mobile device policies (e.g., via MDM) where applicable.

• Ensuring compliance with organizational, legal, and regulatory requirements as they pertain to endpoint devices.

2.1.4 Endpoint Patch and Software Management

The Department will manage patching and software updates for all endpoint devices. This includes:

• Application of operating system and third-party application updates in a timely manner.

• Deployment and version control of productivity software (e.g., Microsoft Office, Teams, browsers).

• Maintenance of standardized software images and deployment processes.

Exhibit 2: Statement of Work 3 of 17

2.1.5 Endpoint User Access and Authentication

The Department will manage local user accounts and settings on endpoint devices, including:

• Assignment and revocation of administrative rights at the device level.

• Configuration of device-specific login policies (e.g., biometric authentication, smart card use).

• Management of cached credentials, local policies, and profiles.

2.2 Coordination with Contractor for Integrated Services

Where endpoint devices interact with systems and platforms managed by the Contractor, the Department will:

• Ensure that devices meet minimum technical requirements to support access to managed services (e.g., compatible browsers, authentication Departments).

• Provide timely communication regarding device-related issues that may impact the performance or integration of Contractor-managed services.

• Cooperate with the Contractor in joint troubleshooting efforts where endpoint and system-level issues intersect.

3. CONTRACTOR RESPONSIBILITIES

The Contractor shall be responsible for the delivery, operation, and support of all IT services described in this section (collectively, the “Managed Services”), consistent with established IT Service Management (ITSM) practices. These services exclude Endpoint Management, which remains within the Department’s scope of responsibility. All Managed Services shall be included in the Contractor’s standard Monthly fee structure under Contract.

3.1 Managed Services - Standard

The Managed Services encompass standard IT operational responsibilities and shall include the Contractor’s fulfillment of all related Service Requests, Incidents, Changes, Problems, and routine administrative tasks associated with the following functional areas below. The Contractor shall be responsible for the performance, availability, and ongoing management of these services in accordance with established Service Level Agreements.

3.1.1 Infrastructure Management

The Contractor shall operate, administer, and maintain the Department’s IT infrastructure, including all cloud-based, virtual, and networked systems, excluding endpoint devices. This includes, but is not limited to:

• Operate and maintain all cloud-based, virtual, and networked infrastructure systems, excluding endpoint devices.

• Administer directory services including Active Directory, Azure Active Directory, and Entra ID.

• Manage virtual machines, server operating systems, middleware, and storage/backup systems across Microsoft Azure and hybrid/on-prem environments.

Exhibit 2: Statement of Work 4 of 17

• Configure and maintain network components including LAN/WAN, VPNs, firewalls, switches, routers, DNS, DHCP, and IP address management.

• Support wireless infrastructure including Wi-Fi access points and controllers.

• Provide database and data warehouse support, including Azure SQL and Synapse environments.

3.1.2 Cloud Services Management

The Contractor shall provide full administrative support for the Department’s enterprise cloud environments and platform services, including:

• Administer Microsoft Azure infrastructure, including virtual machines, storage, networking, and resource groups.

• Manage Microsoft 365 tenant-level services, excluding endpoint configuration and local application support.

• Oversee Power Platform environments, including administration of Power Apps, Power BI Workspaces, and Dataverse schema.

• Configure and maintain Azure Synapse Workspaces, including setup, security, linked services, datasets, and pipelines.

• Perform cross-platform integration and configuration across Azure, Microsoft 365, Power Platform, and Synapse services.

• Monitor and optimize resource usage and costs across all managed environments.

3.1.3 Security Operations

The Contractor shall implement and maintain comprehensive security controls across all managed systems and environments. The Contractor shall:

• Configure, monitor, and maintain perimeter and internal security systems, including firewalls, IDS/IPS, and threat protection tools.

• Administer identity and access controls, including MFA, conditional access, SSO, and role-based access management.

• Perform patch management across servers, network devices, and core systems.

• Conduct vulnerability scanning regularly and implement timely remediation actions.

• Monitor security and compliance configurations for Microsoft 365, Power Platform, Azure, and

Synapse environments.

• Operate Security Information and Event Management (SIEM) tools and respond to incidents per established procedures.

3.1.4 Monitoring and Incident Response

The Contractor shall monitor all managed systems and services on a 24x7 basis and respond to all service disruptions or degradations. The Contractor shall:

• Provide 24/7 monitoring of infrastructure, cloud services, Power Platform environments, BI gateways, and Synapse pipelines.

• Implement monitoring tools and service-specific thresholds to ensure effective detection of performance and availability issues.

Exhibit 2: Statement of Work 5 of 17

• Detect, classify, and investigate incidents, initiating resolution and escalation according to predefined protocols.

• Maintain active communication with the Department throughout the incident lifecycle, following agreed-upon procedures.

• Conduct root cause analysis for major or recurring incidents and deliver summary reports.

• Ensure incident response and resolution meet defined Service Level Agreements (SLAs).

3.1.5 Backup and Disaster Recovery

The Contractor shall implement, maintain, and test backup and disaster recovery (DR) solutions for all systems and data within scope. This includes:

• Configure and manage scheduled backups for virtual machines, storage, databases, Dataverse (as supported), and Synapse services.

• Define and enforce retention policies and ensure secure storage of backup data.

• Perform periodic recovery and restore tests to validate backup integrity and disaster recovery readiness.

• Develop, maintain, and update disaster recovery (DR) plans and procedures, providing documentation to the Department.

• Create and maintain recovery playbooks for key cloud services.

• Support ongoing DR testing and readiness activities in coordination with the Department.

3.1.6 Non-Endpoint Technical Support

The Contractor shall provide responsive technical support for all managed infrastructure and platforms.

The Contractor shall:

• Operate a service desk to intake and resolve service requests, incidents, and changes related to infrastructure, platforms, and cloud services (excluding endpoint devices).

• Provide issue triage and support for Microsoft 365 tenant services, Power Platform, and Azure Synapse.

• Escalate unresolved issues to Microsoft or other third-party vendors on behalf of the Department.

• Ensure availability of qualified personnel during business hours, with after-hours support for critical incidents.

• Deliver infrastructure and platform-level support, including for tenant-level Power BI and related services.

• Maintain clear boundaries excluding end-user device and local application support.

3.1.7 Change and Configuration Management

The Contractor shall perform all system changes in a controlled, documented, and approved manner, including:

• Submit and manage Change Requests through a defined Change Management process, including required approvals.

Exhibit 2: Statement of Work 6 of 17

• Conduct impact assessments, risk evaluations, and implementation planning for proposed changes to Azure, Power Platform, and Synapse environments.

• Maintain accurate configuration data in the Configuration Management Database (CMDB).

• Participate in Change Advisory Board (CAB) reviews as required by the Department.

• Implement change control and version management for infrastructure and platform configuration artifacts.

• Ensure traceability and documentation for all changes across supported systems.

3.1.8 Governance and Compliance

The Contractor shall support the Department’s compliance obligations and enforce IT governance policies by:

• Implementing and enforcing security and governance policies such as Data Loss Prevention (DLP), role-based access control (RBAC), audit logging, and resource tagging.

• Ensuring Power Platform, Power BI, and Azure services comply with organizational policies and regulatory requirements (e.g., SOC 2, HIPAA, GDPR).

• Maintaining records of compliance activities and support internal or external audits as requested by the Department.

• Managing access controls and sharing settings across Power Platform and Power BI environments.

• Providing regular compliance and governance reporting, including relevant metrics for service reviews.

• Aligning cloud service configurations with established governance frameworks and Departmental policies.

3.1.9 Vendor and Licensing Management

The Contractor shall assist in the ongoing management of third-party vendors and software licensing relevant to the Managed Services, including:

• Tracking license usage and renewals for Microsoft 365, Azure, Power Platform, and related services.

• Providing recommendations for cost optimization and license tier alignment.

• Coordinating with external vendors to resolve service issues or escalate support cases as needed.

3.1.10 Provisioning of Resources

The Contractor shall manage the provisioning and deprovisioning of system access and infrastructure resources as requested by the Department, including:

• Creation and assignment of roles, groups, and permissions within managed platforms.

• Disabling or removing access for departing personnel or retired services.

• Maintaining records of access assignments and change logs for audit purposes.

Exhibit 2: Statement of Work 7 of 17

• Provisioning/deprovisioning for Power BI, Power Apps, Synapse

• Azure AD role and group management

• Resource lifecycle management

3.2 Managed Services - Annual

The Contractor shall perform a set of annual services as part of its Managed Services obligations. These services are intended to ensure the long-term security, integrity, and performance of the Department’s IT environment and shall be included in the standard service fees. Annual services shall be conducted on a mutually agreed schedule, with written notice to the Department.

3.2.1 Annual Penetration Testing

Once per calendar year, the Contractor shall coordinate and conduct a formal penetration test of the managed IT environment. The scope of the penetration test shall include, but not be limited to:

• Public-facing infrastructure components and externally exposed services;

• Internal infrastructure (e.g., virtual machines, databases, networking configurations) within the managed scope;

• Cloud-based services such as Microsoft Azure, Microsoft 365 tenant configurations, Power

Platform (Power BI, Power Apps, Dataverse), and Azure Synapse Workspaces;

• Identity and access management systems, including Azure Active Directory, SSO, and MFA configurations.

Penetration testing shall be performed by qualified personnel or an approved third-party provider using industry-recognized tools and methodologies (e.g., OWASP, NIST, or equivalent). The test shall be conducted in a manner that avoids unnecessary disruption to production services and with the Department’s prior written approval of timing and scope.

The Contractor shall:

• Provide a formal test plan and rules of engagement for Department review and approval;

• Deliver a comprehensive report of findings, including risk ratings, affected systems, evidence, and recommendations;

• Collaborate with the Department to remediate identified vulnerabilities based on agreed priorities and timelines;

• Provide written confirmation of remediation or mitigations for high- and critical-risk findings.

3.2.2 Additional Annual Services

In addition to penetration testing, the following annual services shall be performed by the Contractor:

• Review and update of configuration baselines and security policies;

• Full audit of the Configuration Management Database (CMDB) for accuracy and completeness;

• Review and update of backup and disaster recovery plans;

• Annual risk and compliance assessment against applicable regulatory or organizational requirements;

Exhibit 2: Statement of Work 8 of 17

• Validation of system documentation, access controls, and architectural diagrams;

• Strategic service review and roadmap planning session with the Department’s IT leadership.

3.2.3 Reporting and Documentation

All annual services shall be documented and reported to the Department, including summary reports, risk assessments, remediation plans, and supporting evidence. Reports shall be provided within thirty

(30) days of the completion of each annual service or as otherwise agreed.

4. SERVICE AND CONFIGURATION MANAGEMENT

The Contractor shall implement and maintain formal Service and Configuration Management processes in alignment with ITIL and other generally accepted IT Service Management (ITSM) best practices. These processes shall support the accurate identification, control, recording, reporting, auditing, and verification of all Services and their related Configuration Items (CIs) under the scope of the Managed Services as defined above.

4.1 Information Technology Service Management (ITSM) Tool

The Contractor shall provide, operate, and maintain an Information Technology Service Management (ITSM) tool for the duration of this contract, in accordance with ITIL-aligned service delivery standards.

The ITSM tool shall serve as the primary system of record for the management, tracking, and reporting of all service activities conducted under this Statement of Work.

The ITSM tool must support and record the full lifecycle of the following service categories as they pertain to the Managed Services:

• Service Requests

• Incidents

• Changes

• Problems

4.1.1 Definitions of Service Management Terms

For the purposes of this Statement of Work, the following definitions shall apply to core service management activities conducted by the Contractor:

4.1.1.1 Service Request

A Service Request is a formal request submitted by the Department, or initiated by the Contractor on behalf of the Department, seeking the provision of a standard, pre-approved service or operational activity within the scope of the Managed Services. Service Requests typically involve low-risk, routine, or repeatable actions, and do not require extensive planning or design.

Examples include, but are not limited to:

• User access provisioning or deprovisioning

• Configuration changes within supported environments

• Creation or modification of reporting dashboards

Exhibit 2: Statement of Work 9 of 17

• Environment setup for approved services (e.g., Power Platform, Azure Synapse)

All Service Requests within the scope of the Managed Services shall be fulfilled by the Contractor and are included within the Contractor’s Monthly Service Price.

4.1.1.2 Incident

An Incident is defined as an unplanned interruption to an IT service, or a reduction in the quality or performance of a service, which adversely affects normal business operations. Incidents may originate from infrastructure failures, misconfigurations, degraded services, or other unexpected conditions.

The Contractor shall be responsible for the timely identification, classification, escalation, and resolution of all Incidents arising within the scope of the Managed Services. Incident resolution may include temporary workarounds or permanent fixes and must be tracked through the ITSM tool.

4.1.1.3 Change

A Change refers to any addition, modification, or removal of a configuration item, system setting, or service component that may impact the functionality, security, or performance of a managed IT environment. Changes may be standard, emergency, or require formal approval depending on their risk, complexity, and potential impact.

The Contractor shall manage all Changes through a documented Change Management process, including request submission, impact assessment, approval (where required), execution, and post-change review.

All Changes under the scope of Managed Services shall be recorded in the ITSM tool and coordinated with the Department as necessary.

4.1.1.4 Problem

A Problem is the underlying cause or potential cause of one or more related Incidents. Problems are often identified through repeated incidents, trend analysis, or post-incident reviews, and may not have an immediate resolution.

The Contractor shall be responsible for identifying, logging, analyzing, and managing Problems within the Managed Services environment. This includes conducting root cause analysis, implementing workaround solutions where appropriate, and proposing long-term remediation strategies. All Problem records shall be maintained in the ITSM tool and made available to the Department upon request or as part of regular reporting.

4.1.2 Functions

At a minimum, the ITSM tool shall:

• Allow for the submission and tracking of Service Requests by the Department or by the Contractor on behalf of the Department

• Capture and document the resolution of incidents and problems, including root cause analysis and remediation actions

• Record and manage change requests, including approvals, implementation plans, and outcomes

Exhibit 2: Statement of Work 10 of 17

• Maintain full audit trails of request status, timestamps, responsible parties, and related communications

• Support classification, prioritization, assignment, and escalation according to defined service levels

• Provide role-based access to enable the Department to view request statuses, dashboards, and reports

4.1.3 Access and Training

The Contractor shall ensure that the ITSM tool is accessible to designated Department personnel during normal business hours and, as appropriate, during off-hours for critical issue reporting. The Contractor shall also provide training or documentation sufficient to allow Department personnel to interact with the system effectively.

4.1.4 Service Catalog

The Contractor shall maintain a Department-facing Service Catalog within the ITSM tool. The Service Catalog shall provide a structured and user-friendly interface for the Department to view and initiate Service Requests related to the Managed Services.

At a minimum, the Service Catalog shall:

• Clearly list and describe all services included in the Managed Services scope;

• Group services logically by category (e.g., infrastructure, cloud platforms, user access, security, backup);

• Include request forms, templates, or workflows with predefined fields and routing rules;

• Reflect current service definitions and availability;

• Be accessible to designated Department personnel on a role-based access basis.

4.1.5 Reporting and Key Performance Indicators (KPIs)

The Contractor shall provide live reporting on the health, usage, and performance of managed services, including:

• Dashboards showing uptime, incident counts, response times, and SLA compliance.

• Service Request volumes and resolution metrics.

• Change and problem tracking summaries.

• Reports specific to Power Platform, Synapse, or Azure usage as applicable.

The Contractor shall deliver to the Department periodic reporting derived from the ITSM tool as part of regular service review meetings or upon request, including but not limited to:

• Open and closed service requests by category

• Incident response and resolution times

• Change request activity logs

• Problem trends and remediation status

Exhibit 2: Statement of Work 11 of 17

4.1.6 Service Review Meetings

The Contractor shall conduct recurring Service Review Meetings with the Department no less frequently than monthly, unless otherwise mutually agreed in writing by both Parties. These meetings are a critical component of the governance and oversight framework established under this Statement of Work and shall serve to ensure transparency, accountability, and continuous improvement in the delivery of services.

4.1.6.1 Purpose and Scope

The purpose of each Service Review Meeting shall include, but not be limited to:

• Reviewing service performance against contractual obligations, including service levels and key performance indicators (KPIs);

• Discussing open Service Requests, Incidents, Problems, and Change Requests;

• Identifying and addressing trends, recurring issues, or areas requiring attention;

• Reviewing status updates on active or upcoming projects;

• Discussing proposed changes to services, processes, or priorities;

• Documenting action items, decisions, and follow-ups.

4.1.6.2 Attendees

Each meeting shall include designated representatives from both the Contractor and the Department, including:

• The Contractor’s account manager or service delivery lead;

• Technical subject matter experts as appropriate;

• The Department’s IT leadership or appointed service manager;

• Additional personnel as mutually agreed for specific topics.

4.1.6.3 Meeting Format and Documentation

Service Review Meetings may be conducted via video conference, teleconference, or in person, as agreed by the Parties. The Contractor shall:

• Prepare and distribute an agenda in advance of each meeting;

• Provide relevant service performance reports, dashboards, and analysis;

• Maintain minutes of each meeting, including a record of action items, responsible parties, and due dates;

• Submit meeting minutes to the Department within five (5) business days following each session.

4.1.6.4 Scheduling and Rescheduling

Meetings shall be scheduled on a recurring basis by mutual agreement. Either Party may request a change to the frequency or timing of meetings with reasonable advance notice. Ad hoc meetings may also be requested by either Party to address urgent matters outside of the regular review cycle.

Exhibit 2: Statement of Work 12 of 17

4.1.7 Security and Data Integrity

The Contractor shall be responsible for ensuring the availability, integrity, and confidentiality of the data contained within the ITSM tool and CMDB and for maintaining the tool in a secure and operational state throughout the term of this contract.

4.1.8 Department Access to ITSM Tool for Endpoint Services

The Contractor shall grant the Department access to and use of the Information Technology Service Management (ITSM) tool maintained by the Contractor, as described above, for the purpose of managing the Department’s internal endpoint-related services.

This access shall include, but is not limited to:

• Creation, tracking, and resolution of Service Requests, Incidents, and Changes related to endpoint devices and associated user support activities;

• Assignment of endpoint-related tickets to Department personnel or designated third parties;

• Use of dashboards, reports, and notification features relevant to endpoint service operations;

• Maintenance of a unified service management record for Department-wide IT operations, including both Managed Services and Department-managed endpoint services.

The Contractor shall:

• Provide administrative or configuration support necessary to enable this functionality without disruption to the integrity or performance of the ITSM platform;

• Ensure appropriate role-based access controls are in place to permit Department-initiated workflows and visibility into endpoint-specific queues, without exposing sensitive or restricted data managed exclusively by the Contractor;

• Collaborate with the Department to develop or maintain appropriate workflows, categories, and reporting views that distinguish endpoint services from Managed Services.

The Department will be responsible for managing and resolving all endpoint-related tickets entered into the ITSM tool, and for maintaining accurate and timely updates to those records. The use of the ITSM tool for endpoint services does not transfer responsibility for endpoint management to the Contractor and does not modify the division of duties established under this Statement of Work.

4.1.9 Endpoint Services Request Framework

Although endpoint management remains the sole responsibility of the Department under this Contract, the Contractor shall configure and support the use of the ITSM tool and Service Catalog to facilitate Department-managed Service Requests related to endpoint services.

Specifically, the Contractor shall:

• Permit the Department to define and manage a section of the Service Catalog dedicated to endpoint-related services (e.g., device provisioning, software installation, local troubleshooting);

Exhibit 2: Statement of Work 13 of 17

• Provide configuration and administrative support to enable these service entries and workflows within the ITSM tool;

• Ensure that endpoint-related Service Requests submitted through the Service Catalog are appropriately routed to designated Department personnel or third-party support teams;

• Collaborate with the Department to maintain the usability and accuracy of endpoint-related catalog entries, without assuming operational responsibility for their fulfillment.

4.1.10 Request for Catalog Updates

The Department will have the right to request the addition, modification, or removal of catalog items— particularly those related to endpoint management—subject to the technical capabilities and constraints of the ITSM platform. The Contractor shall:

• Respond to catalog update requests within a commercially reasonable timeframe;

• Implement approved updates following documented change control procedures;

• Advise the Department on best practices for catalog structure, form design, and workflow logic.

The use of the Service Catalog for endpoint-related requests does not alter the division of responsibilities defined elsewhere in this Statement of Work, and the Contractor shall not be obligated to fulfill any endpoint-specific services unless separately agreed in writing.

4.2 Configuration Management Database (CMDB)

The Contractor shall establish and maintain a comprehensive Configuration Management Database (CMDB) as the system of record for all Configuration Items (CI)(s) related to the Managed Services provided under this Contract. The CMDB shall:

• Accurately reflect the current state of all managed IT assets, systems, services, environments, and relationships;

• Include data on servers, network devices, cloud services, databases, security appliances, virtual environments, and related software configurations;

• Document relevant attributes for each CI, including but not limited to: unique identifier, version, owner, dependencies, status, and location;

• Maintain records of historical changes, updates, and decommissions associated with each CI;

• Integrate with or be accessible from the ITSM tool provided by the Contractor.

The CMDB shall be kept up to date at all times, with new CIs added, existing CIs modified, and obsolete CIs retired in a timely and controlled manner. The Contractor shall ensure the accuracy and completeness of the CMDB through regular audits, reconciliation processes, and automated discovery tools where feasible.

4.2.1 Definition of Configuration Management Term(s)

For the purposes of this Contract, a Configuration Item (CI) is defined as any component of the IT environment that is subject to configuration control and is recorded within the Configuration Management Database (CMDB) as part of the Contractor’s defined scope.

Exhibit 2: Statement of Work 14 of 17

A CI may represent a physical, virtual, logical, or cloud-based asset and may consist of hardware, software, documentation, or a composite IT service. Each CI shall be uniquely identifiable and documented with key attributes, including but not limited to:

• CI name and type

• Version or configuration details

• Logical or physical location

• Operational status

• Ownership or responsible party

• Relationships to other CIs

• Change and update history

4.2.2 Scope of Configuration Items (CIs)

The scope of CIs maintained by the Contractor in the CMDB shall include, but not be limited to, all non-endpoint components of the Department’s managed IT environment, including:

• Physical infrastructure components, including all network hardware, switches, firewalls, load balancers, and domain controllers

• Cloud infrastructure components, including virtual machines, virtual networks, storage accounts, firewalls, and load balancers

• Microsoft 365 tenant-level configurations, including Exchange Online, SharePoint Online, Teams, compliance settings, and security configurations

• Power Platform resources, including Power Apps and Dataverse environments, Power BI Workspaces, Dataverse schema and tables, connectors, and Data Loss Prevention (DLP) policies

• Azure Synapse Workspaces, including pipelines, datasets, SQL and Spark pools, linked services, and integration runtimes

• System integrations and service interdependencies, including third-party services and internal data flows

• Security systems, including identity configurations, MFA policies, and monitoring tools

• Backup and disaster recovery configurations, including backup policies, schedules, and restore points

• Automation artifacts, including scripts, templates, and infrastructure-as-code components used in service delivery

4.2.3 Department Access and Visibility

The Contractor shall provide the Department with read-only access to the CMDB or produce reports upon request that reflect the current state of all managed CIs and their relationships. This access shall enable the Department to understand system dependencies, evaluate risks, and support change management, capacity planning, and incident/problem resolution.

Exhibit 2: Statement of Work 15 of 17

4.3 Compliance and Verification

The Contractor shall be responsible for the governance and quality of the Service Configuration Management processes. The ITSM tool and CMDB and related practices shall be subject to periodic review and validation by the Department or its designated auditors, no more than once per quarter unless otherwise required for cause. The Contractor shall address any discrepancies or deficiencies identified during such reviews within a mutually agreed-upon timeframe.

5. SERVICE LEVEL AGREEMENTS (SLAS)

The Service Provider shall adhere to the following Service Level Agreements (SLAs) for all Service Requests, Incidents, and Problems covered under the scope of the Managed Services. SLAs shall be determined based on a combination of Severity and Urgency, using a matrix-based prioritization model to establish target response and resolution times.

5.1.1 Definitions

The following definitions apply to each prioritization category.

• Severity refers to the extent of disruption caused by the issue, ranging from enterprise-wide outages to isolated, minor impacts. All Service Requests, Incidents, and Problems shall be categorized in the ITSM tool according to the following Severity levels:

o Severity 1 – Critical – Extensive or total service outage o Severity 2 – High – Significant degradation of service o Severity 3 – Normal – Minor impact or inconvenience o Severity 4 – Low – Informational or non-service-affecting

• Urgency refers to the required speed of response or resolution, based on how quickly the issue must be addressed to mitigate risk or restore operations. All Service Requests, Incidents, and Problems shall be categorized in the ITSM tool according to the following Urgency levels:

o Urgency 1 – Critical – Immediate action required o Urgency 2 – High – Rapid response needed o Urgency 3 – Normal – Standard handling acceptable o Urgency 4 – Low – Planned or deferred activity

5.1.2 Priority Matrix

The following priority matrix shall be used to determine the prioritization of all Service Requests, Incidents, and Problems in the ITSM tool.

Severity / Urgency Critical High Normal Low

Critical Priority 1 (P1) Priority 2 (P2) Priority 3 (P3) Priority 4 (P4)

High Priority 2 (P2) Priority 3 (P3) Priority 4 (P4) Priority 4 (P4)

Normal Priority 3 (P3) Priority 4 (P4) Priority 4 (P4) Priority 4 (P4)

Low Priority 4 (P4) Priority 4 (P4) Priority 4 (P4) Priority 4 (P4)

Exhibit 2: Statement of Work 16 of 17

5.1.3 SLA Targets and Performance

The following target response and resolution times shall apply to all tickets logged under the scope of the Managed Services, based on the assigned priority level determined by the Priority matrix above.

Priority Initial Response Time Target Resolution Time Priority 1 (P1) – Critical 15 minutes (24x7) 4 hours or less Priority 2 (P2) – High 1 business hour 1 business day Priority 3 (P3) – Medium 4 business hours 3 business days Priority 4 (P4) – Low 1 business day 5 business days or as scheduled

These SLAs constitute the primary contractual mechanism for evaluating the Service Provider’s performance and compliance with its operational obligations under this Statement of Work. SLA adherence shall be used to measure timeliness, reliability, and quality of service delivery. Consistent failure to meet SLA targets may trigger formal review, corrective action, and other contractual remedies.

5.1.4 Exceptions and Exclusions

The following exceptions and exclusions apply to SLAs:

• SLA timelines exclude delays caused by factors outside the Service Provider’s control, including but not limited to Client dependencies, force majeure events, and third-party vendor delays.

• SLAs shall not apply to project-based work, Non-Standard Service Requests, or services outside the scope of this Statement of Work.

• SLA clocks may be paused with Client approval during scheduled maintenance or Change Request implementation windows.

6. PROJECT-BASED SERVICES

The Contractor may provide project-based services beyond the scope of routine Managed Services as requested by the Department. Such services may include, but are not limited to, physical infrastructure enhancements, system migrations, cloud architecture design changes, custom platform configurations, and implementation of new services or features. All project-based services work shall be performed on a time and materials basis at the Contractor’s hourly rate as set forth in the Price Sheet.

6.1.1 Estimates and Scope

Prior to the commencement of any project or discretionary work, the Contractor shall:

• Provide the Department with a written scope of work describing the objectives, tasks, deliverables, and assumptions associated with the requested work.

• Submit a detailed estimate of hours and cost based on the agreed hourly rate, including a breakdown of resource types and anticipated timeframes.

• Identify any potential risks, dependencies, or system impacts related to the proposed work.

Exhibit 2: Statement of Work 17 of 17

The Contractor shall not commence any project support activity until written approval of the scope and estimate has been received from the Department.

6.1.2 Approvals and Change Management

All project support work must be explicitly authorized in writing by the Department prior to execution.

This authorization may be provided via email, service request, or formal change request, as mutually agreed.

Any changes to the approved scope, estimated hours, or budget shall require prior written approval from the Department before the Contractor may proceed. The Contractor shall maintain transparency regarding time and costs incurred, and shall notify the Department promptly if work is projected to exceed the original estimate.

6.1.3 Coordination with Managed Services

Where project work interfaces with or impacts services under the Contractor’s Managed Services obligations, the Contractor shall:

• Ensure that project execution does not disrupt the stability, performance, or security of the managed environment(s).

• Follow all applicable Change Management procedures.

Coordinate with the Department on scheduling, communications, and testing plans.

This Space Intentionally Blank

2.2 Coordination with Contractor for Integrated Services

4.3 Compliance and Verification