Exhibit 2.1.1 - Cross-Functional Services Statement of Work.docx

State of South Carolina State Fiscal Accountability Authority (SFAA)

Request for Proposal Exhibit 2.1.1 Cross-Functional Services Statement of Work

RFP Solicitation No. 5400021069

Table of Contents

Exhibit 2.1.1 (Cross-Functional Services Statement of Work)

RFP Solicitation No. 5400021069 Page i of i General As of the Commencement Date, Service Provider will be responsible for providing Cross-Functional Services as described in this Exhibit 2.1.1 (Cross-Functional Services Statement of Work). Further, Exhibit 2.1.1 (Cross-Functional Services Statement of Work), Exhibit 2.1.2 (Payment Services Statement of Work), and Exhibit 2.1.3 (SC.gov Services Statement of Work) sets forth the Service Provider's obligations to deliver integrated end-to-end Services to Customers.

Overview The Service Provider shall deliver the Services in the best interests of Customers. Service Provider will be responsive to the current and future requirements of South Carolina Department of Administration’s Office of Technology and Information Services (OTIS) and Customers by proactively anticipating needs and adjusting Services accordingly. Requirements for New Services will be handled in accordance with Exhibit4.0 (Business Model) and the Service Provider shall work with OTIS to assess the impact of these requirements on Customers’ operating environments and supported applications in accordance with the terms of the Contract.

This Exhibit 2.1.1 (Cross-Functional Services Statement of Work) sets forth the Services that the Service Provider shall provide, as of the Commencement Date, unless otherwise specified.

The Service Provider shall provide Charges inclusive of all activities required to provide the Services set forth in this Exhibit 2.1.1 (Cross-Functional Services Statement of Work), including project-related support activities. The Service Provider confirms that unless otherwise specifically stated, it will provide a solution that supports all of the requirements described in this Exhibit 2.1.1 (Cross-Functional Services Statement of Work) and its Exhibits, and that all Services, unless otherwise specifically stated, are included within the Charges described in Exhibit 4.0 (Business Model). Accordingly, the Service Provider also confirms that Customers will not incur any other charges in relation to the services described in this Exhibit 2.1.1 (Cross-Functional Services Statement of Work).

This scope of work defines requirements the Service Provider must meet to achieve the objectives of this procurement.

Document Overview This document contains Service Management categories of responsibilities that apply to the delivery of Services. These categories are considered cross-functional as they are functions that cross all service towers, SC.gov Services tower and Payment Services tower.

SYSTEMS AND PROCESSES

OTIS bases its service management practices on the Information Technology Infrastructure Library (ITIL), which focuses on the service management lifecycle and the linkages between service management components. The Service Provider shall be responsible for using management practices complying with the ITIL framework.

Processes The Service Provider shall, at a minimum:

Deliver a set of processes based on ITIL guidance to enable consistent management of Service Provider’s Services.

Ensure that processes effectively integrate with the processes, functions, and roles deployed within and used by OTIS, STO, and Customers.

Design processes and procedures to enable the effective monitoring and reporting of Service Provider’s Services.

Document Service Provider-level processes and procedures in the Service Management Manual (SMM).

Deploy any necessary processes, procedures, and controls to provide effective end-to-end management, monitoring, and reporting of the Services.

Deploy and integrate any tools and systems necessary to enable such processes, procedures, and controls.

Documentation All documentation maintained by the Service Provider shall be subject to approval by OTIS and will conform to the documentation standards and format agreed upon between OTIS and the Service Provider. The Service Provider shall develop documentation in accordance with the requirements in Exhibit 1.3 (Service Management Manual).

The Service Provider shall, at a minimum:

Provide Service Provider’s operations documentation related to the Services that is up to date, accurate, and posted in the DGS Portal.

Identify owners (business, operational, quality assurance, and engineering) of documentation.

Link Systems documentation to architectural standards.

Identify OTIS Data to the associated System(s) and the associated security risk classification.

Provide access to architecture and design documentation for Systems and services managed by Service Provider.

Create and maintain current documentation as required (e.g., support documentation).

Develop and maintain documentation on all operations procedures, Services, Equipment, and Software for which Service Provider is responsible, according to the standard SMM format.

Make all documentation available electronically and in a format electronically searchable.

Validate documentation annually for completeness and accuracy, and verify that all documentation is present, organized, readable, and updated in accordance with agreed upon schedule.

Formalize the reporting and resolution of validation findings to OTIS and Customers on a regular basis, and where it is determined that documentation is inaccurate (e.g., erroneous or out of date), correct and replace such documentation.

Update the SMM according to schedule described for the Critical Deliverables in Exhibit 3.1 (Service Level Matrix).

Training and Education The Service Provider shall, at a minimum:

Properly train Service Provider personnel on Service Provider’s Service Management Systems and other tools, including the supporting processes.

Develop applicable training content, load to the Digital Government Services Portal, and communicate course catalog to OTIS, Customers, and STO.

Customize such applicable Service Provider training to be specific to the Authorized Users for the Services within the OTIS environment.

Ensure that all Service Provider staff interacting with OTIS or Customers have reviewed the minimum set of documentation as defined by the Service Provider in the Exhibit 3.1 (Service Level Matrix) for Transition Readiness and Transition Plan.

Upon request, Service Provider will provide such documentation and proof of training to OTIS and Customers as specified by OTIS.

MARKETPLACE

Digital Government Services Portal The Service Provider will deploy a Digital Government Services Portal (DGS Portal) to provide an integrated solution for OTIS, Customers, and STO to access program communications, process artifacts, operational reporting, and service performance reporting.

The Service Provider shall, at a minimum:

Provide a secure Services Portal accessible to OTIS, Customers, and STO.

Provide and post operational reports and dashboards to the DGS Portal, including reports described in Section 5.1 Operational Intelligence, below and specified in Exhibit 3.3 (Description of Reports) and Exhibit 3.3-A (Reports).

Provide and post service performance reports and dashboards to the DGS Portal, including reports specified in Exhibit 3.0 (Performance Model).

Provide and post information on broad service communications and messages to the DGS Portal.

Provide links to other Service Provider systems as appropriate.

Post all Service Provider SMM documents to the DGS Portal.

Define and adhere to the DGS Portal processes as documented in the SMM.

Service Catalog Management The Service Provider will provide a Service Catalog tool for Customers, OTIS, and STO to request Services from the Service Provider.

The Service Provider shall, at a minimum:

Integrate Service Provider Services into the Service Catalog to enable efficient request workflow.

Categorize, normalize, and document Service Catalog content to ensure navigation is intuitive for the users.

Determine the approval authority required to obtain services within the Service Catalog.

Provide updates to the catalog and inform OTIS and Customers of changes through regular communications.

Respond to Service Catalog requests in accordance with defined processes and service level agreements (SLAs).

SERVICE MANAGEMENT

Incident Management Service Provider shall, at a minimum:

Provide Incident Management Services in the form of Level 2 support and Level 3 support. Incident Management is separate and distinct from Security Incident Management.

Incident Management Services are to include, at a minimum, Incidents related to all aspects of Service Provider’s Services such as systems, applications, interfaces, data, processing, and compliance of requirements including but not limited to merchant card, NACHA and PCI-DSS processing.

Comply with SMM policies and procedures for Incident Management.

Provide an Incident Management System to record and manage all information related to Services Incidents.

Provide training on processes and tools for Incidents and escalations to Service Provider Incident Management staff and other relevant resources involved with responding to Incidents.

Resolve Incidents in accordance with the SMM, Knowledge Database documents, and configuration database(s).

Identify and classify Incident severity, handle according to SMM defined Incident response procedures and assume end-to-end responsibility.

Provide Level 2 support and Level 3 support for Incidents.

Verify that all records (e.g., inventory, asset, configuration management) are updated to reflect completed and resolved Incidents.

Determine if an Incident should initiate a Problem investigation (e.g., whether preventive action is necessary to avoid Incident recurrence) and, in conjunction with the appropriate support Level, raise a Problem record to initiate action.

Conduct follow-up with representative who reported the Incident to verify the Incident was resolved to their satisfaction.

Integrate the Service Provider’s Incident Management process with the other service management processes, especially Problem Management, Configuration Management, Service Level Management, and Change Management.

Problem Management The Service Provider shall, at a minimum:

Provide Problem Management Services to minimize the adverse impact of Incidents on Customer’s business operations.

Provide a Problem Management System to record and manage all information related to Service Problems.

Provide reactive Problem Management Services by diagnosing and solving Problems in response to one or more Incidents that have been reported through Incident Management.

Provide proactive Problem Management to identify and solve Problems and known errors before Incidents occur, including:

performing predictive analysis activities, where practical, to identify potential future Problems, develop recommended mitigation plans, and implement approved corrective mitigation actions and processes.

Maintain, update, and disseminate information about Problems and the appropriate workarounds and resolutions to reduce the number and impact of Incidents.

Provide Problem Management Services for all Problems that are determined to be related to the in-scope Services.

Implement resolutions to Problems through the appropriate control procedures, especially Change management, as well as coordinating Problem Management activities with the various teams within Service Provider, Customer, OTIS, or STO.

Perform Problem Management activities as set forth in the SMM.

Coordinate and take responsibility of Problem Management activities of all Problems that reside in Service Provider’s area of responsibility (e.g., detection, logging, RCA).

Conduct proactive trend analysis of Incidents and Problems to identify recurring situations that are or may be indicative of future Problems and points of failure.

Develop and recommend corrective actions or solutions to address recurring Incidents and Problems or failures, as well as mitigation strategies and actions to avert potential Problems identified through trend analysis.

Information Security Management Service Provider’s delivery of Information Security Management will be an integral part of the Services and will ensure that all security risks associated with the delivery of Services are identified, evaluated, assessed, and controls are implemented and maintained.

Information Security Management General Requirements The Service Provider shall, at a minimum:

Provide and deploy Information Security systems as required to support Information Security requirements.

Provide a Problem Management System to record and manage all information related to Service Problems.

Support the overall OTIS cybersecurity risk management program.

Develop and maintain security procedures and service responsibility matrices, physical and logical access strategies, and standards.

Adhere to the Information Security Management processes as defined in the SMM.

Establish and maintain information security program that integrates with and facilitates effective tracking, reporting and audibility in accordance with State and Customer Governance, Risk, and Compliance (GRC) program requirements.

Implement security capabilities as required to achieve compliance with applicable security requirements, controls, laws, rules, and regulations.

Establish and maintain a Master Security Baseline Configuration (MSBC) defining the Service Providers cybersecurity reference architecture specifying critical cybersecurity solution blueprints, code, and system components (e.g., user identity and access security, client device security, on-premise and cloud security, preventative and active incident management through event management, Security Operations Center (SOC), and security incident response).

Provide assistance with and support to security evaluations, as directed by OTIS, which include conducting internal audits, supporting external audits, conducting self-assessments, and evaluating security Incidents.

Provide assistance with and support to all OTIS authorized assessments, develop action plans, and resolve deficiencies, vulnerabilities, concerns, and recommendations identified within six (6) months of the conclusion of the assessment, as defined in Exhibit 3.1 (Service Level Matrix).

Meet all security-related Deliverables and performance analytics as defined in Exhibit 3.1 (Service Level Matrix), which are to be agreed to by OTIS and Service Provider.

As requested, attend and contribute to Security Management and Risk Management meetings.

Resolve agreed actions and activities resulting from Security Management meetings.

Create and maintain Security Plan across the Service Provider’s Services.

Execute Service Provider’s Security Plan agreed to by OTIS and/or Customer specific requirements.

Keep certificates for Service Provider’s staff current and report the status to OTIS on a quarterly basis.

In support of good information security practices, and as required for PCI DSS requirements, provide for vulnerability scans for all Service Provider network assets, which should include scans for all network addresses, at least once per quarter and report directly to the State and/or Customer Governance, Risk, and Compliance (GRC) program.

As required for PCI-DSS compliance, provide results of external vulnerability scans performed outside of the Service Provider’s network(s) including items remediated and forward schedule of remediation plans.

As required for PCI-DSS compliance, provide results of internal vulnerability scan performed from inside the Service Provider’s network firewall or security devices.

Provide a forward-looking schedule for the planned Service Provider security testing, assessments, and analysis.

Service Provider Staff The Service Provider shall, at a minimum:

Limit access to data to authorized Service Provider personnel only.

Receive security clearance and successfully complete a background and criminal history investigation for all Service Provider personnel prior to performing contract functions or accessing OTIS and/or Customer Facilities, Systems, Applications, Networks, or Data.

Perform all work within the continental US.

Security Incident Event Management (SIEM) The Service Provider shall, at a minimum:

Using the Service Providers SIEM, provide full, 24x7x365 active security monitoring of all Service Providers systems by collecting and analyzing security relevant events and alerts to catch abnormal behavior or potential cyberattacks.

Integrate and direct logs and alerts of in-scope devices to Service Provider SIEM and security operations.

Security Incident Management The Service Provider shall, at a minimum:

Create and maintain a Security Incident Management Plan across the Service Provider’s Services.

Provide security Incident severity matrix, notification rosters, communications plans, and procedures for managing security Incidents.

Implement the Service Provider’s portion of the Security Incident Management Plan in concert with participation from Customers and OTIS as required.

Adhere to the security incident handling and notification processes that follow current NIST guidelines and as defined in the SMM.

Implement and maintain monitoring and alerting services, including automated alert notification.

Promptly investigate, document, and report security incidents in accordance with OTIS Security Policies and the SMM.

Promptly communicate and escalate security Incidents to the Customer and OTIS according to the defined process.

Conduct Root Cause Analysis, and, if necessary, develop and implement formal corrective actions or remediation plans once approved by OTIS and the appropriate Customer. Evaluate the analysis and proposed corrective actions to ensure future risks are adequately mitigated.

Lead Security Incident investigations for affected Services and initiate corrective actions to minimize and prevent security breaches.

Physical Security Administration The Service Provider shall, at a minimum:

Communicate the physical and logical security management processes and procedures to Service Provider’s staff.

Comply with Service Provider physical and logical security responsibilities.

Inform OTIS and Customer immediately if Service Provider becomes aware of any vulnerability or weakness in the Services and recommend a solution or mitigation.

Provide near real-time information to OTIS and Customers to identify those physical access rights that should be removed from OTIS and Customer Facilities, and, where action is required within the Service Provider’s scope of responsibilities, initiate the access rights revocation request.

OTIS and Customer Facilities When Service Provider uses or visits locations and sites at OTIS or Customer Facilities, Service Provider will be responsible for the provision of Services related to Customer’s security requirements, set in place by Customer to govern the security of the Customer environment.

Service Provider shall, at a minimum:

Comply with all OTIS and Customer security policies, standards and procedures, and all applicable laws and regulations, as they may be revised or updated.

Comply with OTIS and Customers’ policies, including security, data and records management, and electronic records and data archiving.

Implement the security-related Services required to protect the confidentiality, integrity, and authenticity of the information stored in or transmitted to or from the Customer environment, in accordance with Customer’s security requirements.

Comply with OTIS’s, Customers’, and Service Providers’ physical security administration processes, where the processes interact.

Assist in the development of action plans following any Security Incidents within the Customer environment and implement new controls approved by Customer and in the timeline defined by Customer.

Maintain all security documentation related to Customer’s enterprise security architecture for Equipment, Software, and networks and ensure documentation is available online to Customer 24x7x365.

Maintain OTIS Data in accordance with Customer’s security policies.

Establish and maintain safeguards against the unauthorized access, destruction, loss, or alteration of OTIS Data in the possession of Service Provider in accordance with Customer’s security policies.

Participate in service delivery to review any Changes to the Equipment, Software, and networks that potentially have security or operational ramifications and modify the Change to remove or reduce the security or operational ramifications.

Security Assessments OTIS, Customers, and other entities authorized by OTIS may conduct security reviews, assessments, forensic analysis and/or audits (e.g., SSAE 18, State Audit Office, IRS audits) where service is being provided by the Service Provider. These assessments may include (but are not limited to) physical security, logical security, policies and procedures, network analysis, vulnerability scans, and Controlled Penetration Tests.

Assessments of the Security Program may be conducted by OTIS or, at OTIS’s sole discretion, a third-party security assessment vendor (the “Security Assessment Company”).

Service Provider shall, at a minimum:

Cooperate fully with OTIS and/or the Security Assessment Company and provide reasonable access to any premises, equipment, personnel, or documents, and provide any assistance required by OTIS and/or the Security Assessment Company to conduct the Assessment; however, OTIS and the Security Assessment Company will not have access to Service Provider proprietary information where it is not relevant to the Assessment, and will further not have access to confidential or proprietary information of other customers of Service Provider than Customers.

Under no circumstances, attempt to persuade, control, or otherwise influence the Security Assessment Company in the determination of its findings. The Assessment will be conducted to not unreasonably disrupt Service Provider’s operations under this Contract.

Within fifteen (15) days of an Assessment Notice Date, OTIS and Service Provider will meet to jointly review the relevant Assessment report, and, if such report concludes that the Security Program does not meet or exceed the Standard of Due Care, then within thirty (30) days after the applicable Assessment Notice Date, the Service Provider will develop and agree upon an action plan to promptly address and resolve any deficiencies, vulnerabilities, concerns and/or recommendations identified in such report, consistent with the Service Provider’s obligations as set forth in the Contract.

Request Management and Fulfillment Service Provider will be responsible for the fulfillment of Service Requests in compliance with processes in the SMM.

The Service Provider shall, at a minimum:

Request Management processes and systems Develop and maintain processes in the SMM.

Implement and maintain Request Management and fulfillment processes and systems that are flexible and facilitate effective communication and coordination across all functional areas.

Facilitate the transparency of Request Management through appropriate processes and systems to provide a complete audit trail to meet OTIS and Customer legislative and policy requirements.

Communicate and coordinate the Request Management processes and policies within Service Provider’s organization.

Service Request Operations Properly exercise Request Management activities across all functions and organizations that provide Services to Customers.

Track Service Request activities and provide and maintain regular communications between all parties and Authorized Users through request fulfillment.

Manage the effective execution of Request Management to fulfill service requests within the agreed Service Levels and SMM and promote Customer and Authorized User satisfaction.

Ensure that detailed audit trail information is recorded of all activity that creates, changes, or deletes data and user access to systems that contain OTIS and Customer Data.

Engage in effective Request Management governance process, including:

Clearly define and document the type of Service Requests that will be handled within the Request Management process so that all parties are clear on the scope of Service Requests and the Request Management process.

Establish and continually maintain definitions of all Services, including descriptions, Services that will be standardized, Services that require custom solutions, and Services that can be requested through each medium (e.g., Service Desk, Digital Government Services Portal, Service Catalog, Request for Service).

Establish and continually maintain Authorized User lists on who is authorized to make Service Requests and type of requests they are entitled to make.

Communicate to Authorized Users the definition of Services, the Request Management processes, and changes thereto.

Support regular training for Authorized Users on Request Management processes, Service definitions, and request mediums.

Perform regular collection of feedback from Authorized Users on the effectiveness of Request Management and engage in activities to improve process and service.

Support multiple mediums for accepting Service Requests, including the Service Desk, Digital Government Services Portal, and Service Catalog.

Support the use of online self-service to allow Authorized Users to enter Service Requests from a pre-defined list of options.

Provide real-time visibility of data records associated with Service Requests.

Ensure proper approval, including financial authority, prior to Service Request fulfillment.

Provide and maintain regular communications between all parties and Authorized Users as required until Service Request completion and document the communications in compliance with the Request Management processes.

The communications frequency will be determined by the severity of the request and in compliance with the SMM.

Keep Authorized User informed of any issues with the completion of Service Requests and status changes throughout the Service Request lifecycle and in accordance with the SMM.

Provide anticipated completion times for active Service Requests and update notification systems as required in the SMM to keep Authorized Users informed in compliance with established Service Levels per Exhibit 3.1 (Service Levels Matrix).

Close Service Requests, in compliance with the SMM, after receiving confirmation from the requesting Authorized User that the Service Request has been completed.

Request for Solution (RFS) Requests for Solution (RFS) are Customer or OTIS requests where requirements are captured in the Service Provider’s Request Management system and Service Provider develops solutions and cost estimates for Customer or OTIS review and approval. These solutions typically assume the Service Provider builds and implements the solution. For Customer Requests that require the Service Provider to propose a solution, the Service Providers shall, at a minimum:

Develop and provide RFS processes, supporting systems, and appropriate mechanisms for the fulfillment of complex requests requiring design, price, solution, and proposals, including appropriate communications to adequately set expectations and promote good customer service.

Develop and establish RFS processes and appropriate mechanisms to support rapid proposal development that provides a level of accuracy for budgetary information without requiring a full solution (e.g., rough order magnitude (ROM) pricing and high-level architecture).

For all RFSs delivered by the Service Provider:

Review RFS to validate for completeness.

Coordinate and lead meetings as required to review request, gather requirements, solution and develop the proposal.

Coordinate the attendance of all necessary subject matter experts in solution and requirement gathering sessions.

Provide a timeframe for delivering the solution proposal, including cost estimates, once requirements are complete.

Develop the solution which may include the technical solution, effort, acceptance criteria, solution design document, and pricing.

Develop the solution in conformance with the Customer or OTIS-approved architecture, standards, and pricing.

Develop the solution in conformance with the security policies, procedures, and guidelines of Customer and OTIS.

Develop the solution in conformance with the boundaries of Customer and OTIS technical guidelines.

Coordinate and facilitate solution reviews across the Service Provider as required to review and gain approval for the solution and pricing.

Track all Project Change requests in accordance with established procedures in the SMM.

Provide a single proposal to requesting Customer and OTIS as required.

Iterate and adjust the solution and cost estimating template as required to adhere to the requesting Customer’s feedback and requirements.

Document Customer or OTIS approvals in accordance with established processes as per the SMM.

Gather and validate that the proposal acceptance comes from an appropriately authorized user.

Provide status to OTIS and Customers for all outstanding requests.

Initiate Project Management as appropriate upon proposal acceptance by Customer to implement approved proposals.

Change Management The Service Provider shall, at a minimum:

Provide Change Management systems for Service Provider Services.

Perform Change Management Services utilizing standardized methods and procedures as defined in the Service Provider SMM to provide efficient and prompt handling of all Changes.

Assist Customer in creating the schedule for any Changes and implementing such Changes.

Comply with defined Change Management processes and training requirements.

Provide necessary information to Customer and to assist in documenting all Request for Changes (RFCs).

Coordinate with Customer to assist in the development of a schedule of planned approved Changes.

Perform maintenance during regular Maintenance Periods as defined in the SMM, or as scheduled in advance with the approval of Customer.

As requested, lead or participate in traditional or digital Change Advisory Board (CAB) meetings and workflow to review planned Changes and results of Changes made.

Utilize Service Provider, Change Management System, tools, and processes for the efficient and effective handling of all Changes, including the CAB, subject to approval from Customer, in a way that minimizes risk exposure and maximizes Availability of the Services.

Service Asset and Configuration Management The Service Provider shall provide an inventory of the Equipment, Software, and Applications managed by the Service Provider in a Configuration Management Database (CMDB). The Service Provider is responsible for maintaining the CMDB details of Equipment, Software, and similar IT service items (collectively referred to as Configuration Items or CIs) used in the provision, support, and management of the Services.

The Service Provider shall, at a minimum:

Provide Service Asset and Configuration Management system for Service Provider Services.

Develop and document Service Asset and Configuration Management processes, as approved by OTIS, that articulate the objectives, scope, and principles.

Establish categorization and classification structures to support the proper documentation and maintenance of CIs.

Communicate and coordinate the Service Asset and Configuration Management processes and policies within Service Provider’s organization.

Provide a complete Service Asset and Configuration Management audit trail to meet OTIS and Customer legislative and policy requirements.

Use the Service Asset and Configuration Management process to identify, control, maintain, and verify the CIs comprising the Equipment, Software, and Applications to provide the Services.

Record the CI information for Equipment, Applications, Software and Services in Service Providers CMDB.

Record the OTIS and Customer agreed DR Level for each Applications, Systems, Software, and Equipment in Service Providers CMDB.

Verify that all CIs for the Applications, Systems, Software, and Equipment and Services are incorporated into the CMDB.

Utilize the Service Providers CMDB as the single source of information regarding all CIs within Service Provider scope.

IT Service Continuity Management Service Provider is responsible for maintaining an IT Service Continuity Management (ITSCM) plan for its own internal staff and systems to respond to an emergency and continue to provide Services to Customers and OTIS.

The Service Provider shall, at a minimum:

Develop, maintain, and test Disaster Recovery Plans (DRPs) and Technical Recovery Guides (TRGs) as required in Exhibit 2.3 (IT Service Continuity Management), and defined in the SMM for the Applications, Systems, Software, and Equipment used by Service Provider to provide the Services. Collectively these plans are referred to as the Service Provider’s ITSCM plan.

The DRPs and TRGs should comply with all applicable Federal and State requirements.

In the event of a disaster, recover and support affected Applications, Systems, Software, and Equipment at the designated recovery location according to the agreed Recovery Time Objective (RTO) and Recovery Point Objective (RPO) as defined by the assigned DR Level and required in Exhibit 2.3 (IT Service Continuity Management), and, in support of the Service Levels defined in Exhibit 3.0 (Performance Model).

Coordinate Service Provider’s ITSCM plan with Customer Business Continuity Plan (BCPs) to ensure Customers can resume regular business functions in the event of a Disaster or significant event affecting the Applications, Systems, Software, and Equipment used by Service Provider to provide the Services.

In the event of a service disruption, coordinate all ITSCM efforts to ensure smooth and efficient resumption of Services.

Crisis Management Crisis Management may be necessary, depending on the type of business or geographic location where Services are being performed, in the event of hurricanes, tornados, riots, terrorist threats, etc. The Service Provider shall, at a minimum:

Follow OTIS and Customer notification processes for any crisis event occurring in or relating to a Service Provider Facility, OTIS Facility, or other facilities managed by Service Provider in connection with the Services.

Alert Service Provider support as documented in the Service Provider’s Business Continuity Plan following notification by OTIS or Customer(s).

Coordinate with OTIS and Customer requirements for Services that are critical to designated Customer emergency management responsibilities.

Coordinate with OTIS and Customer regarding variances in Services as a result of Crisis Management in compliance with all SMM procedures.

Project Management Project Management provides a way to execute and manage projects with the goal of delivering projects from request through completion, meeting Customer requirements in terms of timing, quality, and cost.

The Service Provider shall, at a minimum:

Provide Project Management systems to support Service Provider requirements.

Execute and project manage projects related to the Service Provider’s Services.

Conform Service Provider operations to SMM-defined policies and procedures to ensure the success of the Project Management process.

Use the Service Provider-provided Project and Program Management (PPM) system as the single source of project management and information regarding all projects and programs.

Ensure that all Service Provider Project Management data resides in the PPM system.

Execute projects according to the approved Program Management and Project Management methodology as defined in the SMM.

BUSINESS MANAGEMENT

Operational Intelligence Service Provider will provide and post reports and data as required to the Service Provider-provided Digital Government Services Portal as described below and specified in Exhibit 3.3 (Description of Reports), Exhibit 3.3-A (Reports), and Service Level reports as defined in Exhibit 3.2.1 (Service Level Definitions - SC.gov Services) and Exhibit 3.2.2 (Service Level Definitions – Payment Services).

The Service Provider shall, at a minimum:

Provide near real-time operational reporting within the Service Provider-provided Digital Government Services Portal.

Provide on-time, monthly service-level performance reporting for each Service Level requirement.

Provide mutually agreed upon reports and data to OTIS and Customers.

Provide integrated performance dashboards within the Service Provider-provided Digital Government Services Portal containing:

Near real-time health dashboards for any systems or applications managed by Service Provider, highlighting status of health metrics as defined by Service Provider and agreed by OTIS.

IT and PCI security health of Service Provider services in a security dashboard on a monthly, quarterly, and annual basis.

Security reports to support OTIS’s security governance, risk, and compliance requirements relevant to Service Providers Services, including, but not limited to, risk assessments, Incident reporting, and Security Plan development.

As necessary and requested by OTIS, provide ad hoc and summary Security Incident Reports to OTIS CISO using security systems and data generated in accordance with the format and content of the then current version of OTIS Security Policies.

Service Level Management Service Level Management includes the activities associated with managing and reporting attainment of Service Level performance, deliverable commitments, and customer satisfaction. Service Provider will provide and post Service Level performance reports and data as required to the Service Provider-provided Digital Government Services Portal as described below.

The Service Provider shall, at a minimum:

Provide accurate and timely SLA reports to OTIS, as defined in Exhibit 3.2.1 (Service Level Definitions-SC.gov Services) and Exhibit 3.2.2 (Service Level Definitions – Payment Services) and the SMM.

Implement Service Level Improvement Plans (SLIP), as described in the SMM, when SLAs fail to meet minimum or expected service level targets.

Analyze Customer scorecard feedback to understand Customer and OTIS issues and develop and execute issue resolutions.

Collate information provided to Service Provider from Service Desk Users (e.g., captured in Service Desk surveys, feedback through emails) regarding suggested improvements to the Services.

Develop an action plan to address suggested improvements to the Services identified by Service Provider and Customer, including the following:

1. Provide the action plan to OTIS for review.

2. Implement OTIS-approved action plans.

3. Report on progress and improvements made on approved action plans.

Summarize and report on plans and activities that affect the overall Services to OTIS.

IT Financial Management Service Provider must provide IT Financial Management Services in support of the Exhibit 4 series.

The Service Provider shall, at a minimum:

Actively work with OTIS to develop and document IT Financial Management processes.

Actively cooperate in information exchange between and among the OTIS, and Customer to improve end-to-end IT Financial Management.

Facilitate the transparency of IT Financial Management through appropriate processes to provide a complete audit trail to meet legislative and policy requirements.

If required, integrate Service Provider IT Financial Management process and system with the OTIS’s IT Financial Management process and system, where the processes interact, and as agreed to with OTIS.

Provide sufficient data and detail to support OTIS and Customers state and federal funding accounting, grant, and audit requirements.

Collect, aggregate, and provide billing, service provisioning, and service metric information to OTIS as required.

Identify unique Customer account identifiers to identify Applications, Application Instances, and other services information as required.

Provide the OTIS and Customers with monthly invoice summary and detailed information as required for Service Provider to invoice for Services.

Support all charges with detailed invoice data as required in Exhibit 4.3 (Financial Reporting), and supporting utilization data at the Customer, Resource Unit, Charge category (e.g., Programs, Divisions, Organization Units) as required by OTIS.

Actively participate in developing and maintaining the processes for the resolution of invoice disputes within designated timeframes.

Provide effective and agreed mechanisms for crediting OTIS and Customers as appropriate.

Effectively execute the processes to record, track, and manage incidents of Service Provider invoice disputes.

Research and review invoice disputes for completeness and supporting data accuracy, and, when necessary, request clarifying data from Customer or OTIS.

Support and initiate additional treatment of invoice disputes to facilitate resolution within designated timeframes.

Ensure that incidents of invoice disputes are continually updated, at a minimum on a weekly basis.

Keep the OTIS informed of activity and anticipated resolution times for active incidents of invoice disputes.

Allow OTIS to monitor and validate invoice dispute process on an ongoing basis.

Provide data reports on all SC.gov transactions and revenue, including, at a minimum:

Provide application transaction and financial transaction reports in an OTIS agreed format to allow for near real-time reporting of the SC.gov transaction and payment details including reports as required to fully reconcile all attempted and failed transactions.

Provide customer, application, and transaction reports to OTIS and Customers as required on transactions and payment data by type of transaction, application, customer, etc.

Provide reports with the appropriate level of detail to show all application and payment engine generated revenue to each individual transaction.

Deliverables Management Deliverables. A Service Provider-provided tangible item or outcome that OTIS reviews and approves at a specified date/frequency during the term of the contract, excluding reports that are managed/monitored through other defined processes. Deliverables may have certain attributes that impact the review and acceptance. The attributes for each of the Deliverables are detailed in Exhibit 3.1 (Service Level Matrix) and summarized below.

Critical (C) (flagged within the Contract and referenced in Exhibit 3.1 (Service Level Matrix). Deliverables that are Critical have associated Deliverable Credits payable to OTIS in the event Service Provider fails to successfully complete and submit such Deliverables to OTIS on or before the due dates identified in Exhibit 3.1 (Service Level Matrix). For further clarity, successfulness is measured by whether the Deliverables meet the associated Acceptance Criteria.

Payment (P) - Deliverables that have associated payments due to the Service Provider after OTIS approval of such Deliverables. Payment will be provided in accordance with Exhibit 4.0 (Business Model).

Time-critical (T) – Deliverables that are designated as time-critical will have an expedited review period of five (5) Business Days.

Deliverable Acceptance Criteria. In order to eliminate the potential for frequent submission and rejection of Deliverables, the Service Provider shall meet with OTIS and reach agreement on the construct and content for Deliverables prior to creation. The Service Provider shall coordinate fully and appropriately with OTIS and its partners throughout the development of Deliverables and reviews of Deliverables prior to formal submission as requested. At a minimum, Deliverables shall meet the acceptance criteria defined in Exhibit 3.1 (Service Level Matrix). Unless otherwise agreed, and as applicable, Service Provider shall perform comprehensive testing (e.g., unit, string, integration, stress, volume, system testing) on each such Deliverable prior to submitting such item to OTIS for Acceptance. OTIS considers the Deliverable due date to be the day by which the Deliverable is ready for acceptance and formally submitted. The Service Provider shall use the SMM process to formally submit final versions of Deliverables in accordance with OTIS-approved Deliverable schedule and ensuring the Deliverable meets requirements and Acceptance Criteria outlined in the Contract and referenced in Exhibit 3.1 (Service Level Matrix).

For avoidance of doubt, a specific Deliverable’s attributes may be changed upon mutual agreement and through the appropriate Contract Change request process as determined by the material nature of changes.

Project Milestones. Project milestones are those produced and delivered as part of a Request for Service process and are specific to a project being delivered. OTIS shall have the right to review and accept or reject the milestones in accordance with the SMM.

The State and or Customer shall have the right to review and accept or reject all Materials, Equipment, Systems and other deliverables and milestones (each a "Deliverable") to be provided by Service Provider to OTIS pursuant to the methodology set forth in this Section 5.4 Deliverable Management. OTIS will determine, in their reasonable discretion, when a Deliverable will be deemed "Accepted" following the implementation, installation, testing and execution in the production environment (as applicable) and confirmation that such Deliverables are in Compliance with defined Deliverable Acceptance Criteria. Unless otherwise requested by OTIS, each Deliverable shall be provided by Service Provider and subject to OTIS "Acceptance" as described below in Section 5.4.5.1 through 5.4.5.5.

Acceptance Review Period. For each Deliverable, OTIS shall have either (1) the period of time set forth in the applicable plan, if any, or (2) if no such period is set forth in a OTIS-approved plan, ten (10) Business Days following Service Provider’s notification to OTIS that Service Provider has completed any Deliverable, which shall include Service Provider’s internal testing as required under this Contract, to determine whether it Complies with its Acceptance Criteria (such period of time, the "Acceptance Review Period"). The Acceptance Review Period shall begin on the date that Service Provider provides written notification to OTIS that the Deliverable is ready to be reviewed by OTIS.

Acceptance Review. During the Acceptance Review Period, OTIS shall review and may further test each Deliverable, individually and/or collectively, to determine whether such item(s) contain any type of Noncompliance. Service Provider shall cooperate with such review and testing efforts, provide a technical environment to facilitate such review, and provide all applicable documentation that may assist in such review and testing.

Acceptance. If OTIS does not identify any Noncompliance relating to a Deliverable during its Acceptance Review Period, OTIS shall inform Service Provider in writing that the Deliverable is Accepted, subject to the other provisions of this Contract. If OTIS does not Accept a Deliverable, OTIS shall provide Service Provider a notice of Noncompliance as described below. If OTIS does not Accept or deliver a notice of Noncompliance to Service Provider by the end of the Acceptance Review Period, Service Provider shall so inform the OTIS Contract Manager and the Designated OTIS Representative in writing and provide OTIS an additional Acceptance Review Period of at least five (5) Business Days. If OTIS does not Accept or deliver a notice of Noncompliance by the end of such additional Acceptance Review Period, Service Provider may escalate such issue for resolution through governance in accordance with Exhibit 1.2 (Governance Model). OTIS's use in a live production environment shall not constitute Acceptance, affect any rights and remedies that may be available to OTIS, and/or constitute or result in "acceptance" under general contract Laws, the State's Uniform Commercial Code or any other Laws.

Noncompliance. If OTIS delivers to the Service Provider a written notice of non-compliance, the Service Provider shall correct all deficiencies identified in OTIS’s notice and within five (5) Business Days for written Deliverables, or such other time as mutually agreed to, at no additional charge to OTIS. Beginning upon receipt of notice from Service Provider that the Deliverable resubmission is ready to be Accepted, an Acceptance Review Period of ten (10) Business Days shall begin again and the Parties shall perform their obligations as described above in Acceptance Review Period and Acceptance Review. For Deliverables that are Time-Critical as designated in Exhibit 3.1 (Service Level Matrix), within two (2) Business Days or as otherwise mutually agreed, after receiving such notice from OTIS, and at no charge to OTIS, Service Provider shall correct such Noncompliance, satisfy the Acceptance Criteria as outlined in the Noncompliance notification. Beginning upon receipt of notice from Service Provider that a Deliverable resubmission is ready to be Accepted, an Acceptance Review Period of two (2) Business Days or as otherwise mutually agreed, shall begin and the Parties shall perform their obligations as described above in Acceptance Review Period and Acceptance Review.

Failure to Cure a Noncompliance. If Service Provider (1) requires more than two (2) attempts to cure a particular Noncompliance, (2) does not correct a Noncompliance within the timeframes defined in Section 5.4.5.1 Acceptance Review Period or as…