Pennsylvania Department of Transportation (PennDOT)

Mainframe Services

Exhibit 2.1

Statement of Work

RFP 3525R03

Exhibit 2.1 (Mainframe Services Statement of Work) RFP 3525R03

PennDOT Page 1

Table of Contents 1 Introduction

1.1 Overview

1.2 Operating Model

2 Common Services

2.1 Key Personnel Positions

2.2 Location of Services

2.3 Operating with Other Service Components and PennDOT

2.4 User Support

2.5 Personnel/Clearance Management

2.6 Network Management and Support

2.6.1 Secure Connectivity to COPANET

2.6.2 Secure Connectivity to Public Cloud Hyperscalers (Azure)

2.6.3 Network Performance and Latency Requirements

2.6.4 Security, Compliance, and Governance

2.7 IP Address Management

2.7.1 Governance and Controls

2.7.2 IP Address Lifecycle Management

2.7.3 Mainframe Support Requirements

2.7.4 Server and Distributed Systems Support

2.7.5 DNS and DHCP Integration

2.7.6 Tooling and Automation

2.7.7 Security, Compliance, and Audit

2.8 Software Procurement

2.8.1 Software Purchases on Behalf of PennDOT

2.8.2 Purchases under PennDOT Master Contracts

2.8.3 Service Provider Contracts

2.8.4 PennDOT Direct Software Vendor Access

3 Security Services

3.1 Security Administration

3.2 Proper Disposal of Data and Confidential Information

3.3 PennDOT Security Incident Reporting Instructions

3.3.1 IRS Publication 1075 and Social Security Requirements

3.3.2 Security References

PennDOT Page 2

4 Managed Mainframe Services

4.1 Mainframe Operations

4.2 Mainframe Production Control and Scheduling

4.3 RACF Services For Software

4.3.1 RACF Security Administration Requirements

4.3.2 System Programming and Installation Coordination Requirements

4.3.3 Started Task and Subsystem Security Requirements

4.3.4 Application and End-User Access Security Requirements

4.3.5 Compliance, Audit, and Security Oversight Requirements

4.4 Mainframe Technical Support

4.4.1 General Technical Support

4.4.2 Capacity and Performance Management

4.4.3 Configuration Planning

4.5 Mainframe Database Services

4.6 Mainframe Online Storage and Backup Management

4.6.1 Storage and Backup Architecture

4.6.2 Storage and Backup Engineering

4.6.3 Storage and Backup Operations and Processing

4.6.4 Storage and Backup Administration

4.7 Mainframe Middleware Administrative Services

4.8 Mainframe IBM MQ Physical Support

4.8.1 MQ Software Installation and Maintenance

4.8.2 Queue Manager Infrastructure Management

4.8.3 MQ Storage and Dataset Management

4.8.4 MQ Network and Connectivity

4.8.5 MQ Operations, Monitoring, and Recovery

4.8.6 MQ Performance and Capacity Management

4.8.7 MQ Security Infrastructure (RACF-Level)

4.9 Mainframe Systems Network Architecture (SNA) and TCP/IP Technical Support 33 5 Managed Server Services

5.1 Server Service Requirements Matrix

5.2 Server Monitoring and Management

5.3 Storage Monitoring and Management

5.4 Patch Management and Patching

PennDOT Page 3

5.5 Backup and Recovery

5.6 Physical Middleware and Database Management Support Services

5.7 Software Installation

5.8 Technology Planning

5.8.1 Capacity Planning and Proactive Management

5.8.2 Refresh Planning

6 Service Management

6.1 Service Management Systems

6.2 Process Documentation and Execution

6.3 Training and Education

6.4 PennDOT Portal

6.5 Service Catalog Management

6.6 IT Service Desk

6.7 Incident Management

6.8 Problem Management

6.9 Request Management and Fulfillment

6.9.1 Request Management Processes and Systems

6.9.2 Service Request Operations

6.10 Change Management

6.11 Service Asset and Configuration Management

6.12 Software License Management

6.13 IT Service Continuity Management

6.14 Operational Reporting

6.15 Service Level Performance

6.16 Invoice Reporting

7 Request for Solution (RFS)

7.1 Approval of Projects

7.2 Reprioritization, Termination, and Suspension

7.3 Additional Work or Reprioritization

8 Information Security Management for Service Provider Services

8.1 Information Security Management General Requirements

8.2 Service Provider Staff

8.3 Integration with PennDOT SIEM

8.4 Security Event Identification and Alerting Services

PennDOT Page 4

8.5 Security Incident Management

8.6 Physical Security Administration

8.7 PennDOT Facilities

8.8 Security Assessments

9 Transition Services

9.1 Service Commencement

9.2 Transition Overview

9.3 Knowledge Transfer

9.4 Transition Management Requirements

9.5 Transition Project Plan

9.5.1 Transition Project Plan Critical Deliverable

9.5.2 Kickoff

9.5.3 Meeting Attendance and Reporting Requirements

9.5.4 Transition Documentation and Collaboration

9.5.5 Organizational Change Management (OCM)

9.5.6 Operational Readiness

9.5.7 Staffing Plan and Requirements

9.5.8 Determination of Responsibility (Service Provider and Other State

Vendors)

9.6 Remedies for Transition Failure

9.7 Optional Transition Services – Platform Migration

9.7.1 Platform Migration Project Overview

9.7.2 Optional Platform Migration Project Objectives, Scope, and Deliverables

10 Optional Services:

10.1 Application Modernization Support

10.1.1 Assessment and Planning

10.1.2 Architecture and Design

10.1.3 Modernization and Migration Execution

10.1.4 Cloud/Hosting Setup

10.1.5 Transition and Knowledge Transfer

10.1.6 Project Management

10.2 USER ID and Dataset RACF

10.2.1 RACF Security Administration Requirements

10.2.2 Application and End-User Access Security Requirements

PennDOT Page 5

11 Steady State Evolution and Optimization of Services

11.1 Industry Standards, Certifications, and Compliance

11.1.1 SOC 2 Reports

11.2 Technology Plan and Roadmap

11.3 Software Currency

Figures Figure 1 - PennDOT Mainframe Operating Model

Tables Table 2 - Service Management Capabilities

1 Introduction

1.1 Overview

This Exhibit 2.1 (Mainframe Services SOW) sets forth the Services that Service Provider shall provide as of the Commencement Date unless otherwise specified to support the Pennsylvania Department of Transportation (PennDOT). Further, this Exhibit 2.1 (Mainframe Services SOW) sets forth the processes and Systems that the Service Provider shall provide, including the Service Provider's obligations to work with other PennDOT Service Providers to deliver integrated end-to-end Services. The Service Provider shall coordinate with PennDOT, PennDOT Service Components, and PennDOT Contractors to effectively provide the Services.

The Service Provider shall provide a solution that supports all the business processes described in this Exhibit 2.1 (Mainframe Services SOW) and its Exhibits in accordance with Exhibit 4.2 (Financial Responsibility Matrix). All Services are included within the Charges described in Exhibit 4.0 (Business Model). Accordingly, the Service Provider also confirms that PennDOT will not incur any other Charges for the requirements described in this Exhibit 2.1 (Mainframe Services SOW).

The Service Provider shall deliver the Services in the best interests of PennDOT. The Service Provider shall be responsive to PennDOT’s current and future requirements by proactively anticipating needs and adjusting Services accordingly within the Charges. Requirements for New Services shall be handled in accordance with Exhibit 4.0 (Business Model), and the Service Provider shall assess the impact of these requirements on PennDOT’s operating environments and supported Applications in accordance with the terms of this contract.

The Service Provider shall be responsible for all activities necessary to ensure PennDOT’s Services are performed in accordance with all standards and processes contained in this contract, the Service Levels in Exhibit 3.1 (Service Level & Deliverables Matrix), and the Service Management Manual (SMM).

PennDOT Page 6

Service Provider shall integrate and fully cooperate with PennDOT and all other Service Components as required for smooth and efficient operation during the development, implementation, and execution of its IT Service Management processes to ensure consistency and integration across all Service Components. Service Provider shall work with PennDOT and other Service Components to deliver integrated Services.

1.2 Operating Model

Exhibit 2.1 (Mainframe Services SOW) contains specific cross-functional requirements that all Service Components must meet to perform the requested Services and responsibilities defined in Exhibit 2.0 (Service Model).

Figure 1 - PennDOT Mainframe Operating Model below depicts Users, Service Components, and PennDOT relationships.

Figure 1 - PennDOT Mainframe Operating Model

As the overall service owner, PennDOT operates governance functions that provide customer relationship leadership, Service Catalog, and Level 1 Service Desk, the primary IT Service Management System. The PennDOT operational governance function works closely with the Service Components to ensure that the services provided individually meet the Service Provider's requirements and collectively meet PennDOT's desired outcomes. The Service Provider delivers managed Mainframe Services, managed Server Services, IT Business Management, and managed Information Security services.

PennDOT Page 7

2 Common Services

Common Services apply to all sections of this Statement of Work. The Service Provider shall, at a minimum:

1. Adhere to and perform the service management requirements contained in this Exhibit

2.1 (Mainframe Services SOW) and as documented and defined in the SMM.

2. Implement Services to ensure confidentiality, integrity, privacy, and authenticity of PennDOT Data and PennDOT Personal Data in accordance with this contract.

3. Provide all required operations 24x7x365 in accordance with agreed procedures, including staffing Service Provider Personnel to provide 24x7x365 monitoring.

2.1 Key Personnel Positions

To foster a mutually supportive and collaborative environment where the Services are provided effectively and drive value to PennDOT, the Parties shall jointly review Key Personnel, including the Service Provider Account Director. Key Personnel are listed and maintained in Exhibit 2.3 (Key Personnel) and include the following roles:

1. Account Director with overall contract, financial, and service delivery accountability for this contract. This position shall have decision-making authority for all aspects of this contract. The Account Director shall be dedicated 50% of the time to the PennDOT account.

2. Service Delivery Director with overall accountability for delivery of the Service Provider’s requirements. The Account Director shall be dedicated 50% of the time to the PennDOT account.

3. Financial Director with overall accountability for all invoicing, billing disputes, pricing, and financial reporting under this contract.

4. Transition Director with overall accountability for delivering the Service Provider’s Transition from the Incumbent Service Provider(s) beginning upon the Effective Date through successful Transition milestone completion and PennDOT Acceptance of all Transition Deliverables.

5. Security Director with overall accountability for security policies, procedures, planning, evaluation, and technology under this contract.

6. Other, as the Service Provider deems key to fulfilling its Contract obligations.

2.2 Location of Services

The Service Provider shall provide Services from Onshore locations only. Services shall be performed by Service Provider Personnel at PennDOT Facilities, Service Provider Facilities, or PennDOT-approved remote locations.

At no time will the Service Provider use Offshore resources to support the state’s environment or interact with the state’s data or system. The state’s data must never be transmitted, processed, or stored outside of the contiguous Continental United States.

PennDOT Page 8

Service Provider Personnel providing Services at all locations shall provide their own endpoint computing devices (e.g., laptops) and connect to the PennDOT Applications and resources using a Commonwealth-provided and approved managed virtual desktop solution, or other Commonwealth-approved methods. Service Provider endpoint computing devices shall conform to Service Provider’s information security standards, which are suitable for work performed hereunder and meet this contract's requirements. Prior to actual use and access to PennDOT Systems, Service Provider shall provide PennDOT with a written attestation from the Service Provider’s Chief Information Security Officer (CISO) that the Service Provider’s managed endpoint computing devices comply with PennDOT Rules and PennDOT Standards. Service Provider-managed endpoint computing devices must utilize the Commonwealth-provided and approved managed virtual desktop solutions when interacting with PennDOT Systems and ensure that PennDOT Data remains within the United States of America.

The Master Services Terms identifies access and protection for PennDOT Confidential Information, and all PennDOT Data must remain within the United States of America. PennDOT Data may not be received, stored, processed, or disposed of in any way via information technology systems located Offshore. PennDOT Confidential Information and PennDOT Data shall not be processed, stored, viewed, transmitted, or accessed outside the United States of America.

2.3 Operating with Other Service Components and

PennDOT

1. PennDOT holds other contracts for additional or related work for the PennDOT Service Components, platforms, and customer-specific projects and Services. The Service Provider must fully cooperate with PennDOT and all other PennDOT Service Components as may be required for the smooth and efficient operation of all related or additional work arising from this Exhibit. The Service Provider may not act in any way that may unreasonably interfere with the work of any other PennDOT participant or PennDOT employees. Additionally, the Service Provider must include the obligations of this provision in all its contracts with its Subcontractors that work on any Project or Service arising from this Exhibit.

2. Mutually supportive relationships among PennDOT Service Components and relationships with PennDOT are required to deliver seamless, well-managed services.

3. The Service Provider shall cooperate with PennDOT in its attempts to transfer, replace, or augment the services’ responsibilities to another provider without adversely affecting the provision of ongoing services and other projects being performed concurrently with this Service.

4. PennDOT expects that there may be occasions where a Service Component’s responsibility may need to be revised to support the program's overall success and ensure service continuity. PennDOT retains the sole right to remove and/or reassign a portion of a Service Component’s scope as necessary. There may also be an occasion where PennDOT may ask that a Service Component absorb work related to their scope of Services to provide continuity of service to the program, where a gap may be discovered, or a change for the betterment of the program may be needed. Should either of these actions be required, Service Provider shall work with PennDOT in good faith to execute

PennDOT Page 9 those changes through the appropriate Contract Change request process. PennDOT intends that the Service Provider shall perform Services within the Mainframe program such that all actions support the program's success and prevent adverse outcomes for PennDOT as may be anticipated and prevented by the Service Provider.

2.4 User Support

Service Provider shall, at a minimum:

1. Provide support, advice, and assistance to Authorized Users in accordance with agreed procedures.

2. Perform analysis to provide optimal use of Production resources.

3. Perform changes for programmers and Users as requested by an authorized PennDOT representative in accordance with the agreed procedures.

4. Provide technical support and administration for various products and Application rollouts to PennDOT in accordance with the agreed procedures.

5. Implement job control and parameter changes for Users.

2.5 Personnel/Clearance Management

Service Provider shall, at a minimum:

1. Grant PennDOT approval rights for Key Personnel interfacing with PennDOT, and the right to review the qualifications of any Service Provider Personnel.

2. Provide controls and ensure that advanced Security operations Functions and escalation roles are performed by senior staff cleared to conduct those functions and roles.

3. Provide controls and ensure that Service Provider Personnel complete all mandatory training in accordance with the PennDOT, State, and Federal requirements.

4. Ensure that all Service Provider Personnel pass the PennDOT-mandated security background check process.

5. Ensure Service Provider Personnel disclose any changes that may impact their background check results in accordance with PennDOT Rules.

2.6 Network Management and Support

2.6.1 Secure Connectivity to COPANET

Service Provider shall, at a minimum:

1. Provide secure, resilient Network connectivity between the Service Provider-hosted Mainframe and Server environments and the COPANET.

2. Implement industry-standard security controls for all Network connections to COPANET, including encryption in transit, Network segmentation, and access controls.

PennDOT Page 10

3. Ensure Network connections are logically and physically segregated from other tenants and environments.

4. Support secure routing, firewalling, and traffic inspection in accordance with PennDOT and Commonwealth security policies.

5. Maintain redundancy across Network paths, devices, and circuits to eliminate single points of failure.

6. Monitor Network connectivity continuously and proactively detect, alert, and remediate connectivity issues affecting COPANET.

2.6.2 Secure Connectivity to Public Cloud Hyperscalers (Azure)

Service Provider shall, at a minimum:

1. Provide secure, private, or encrypted connectivity between the Service Provider-hosted Mainframe and Servers and public cloud hyperscaler services, including Microsoft Azure.

2. Support cloud-native private connectivity services such as Azure ExpressRoute or equivalent secure dedicated connectivity services.

3. Ensure all data transmitted between the Service Provider environment and cloud hyperscalers is encrypted in transit using NIST approved cryptographic standards.

4. Implement Network segmentation and routing controls to restrict cloud connectivity to authorized systems, services, and workloads.

5. Coordinate Network configurations with cloud service providers to ensure consistent performance, security, and availability.

2.6.3 Network Performance and Latency Requirements

Service Provider shall, at a minimum:

1. Design, provision, and maintain Network connectivity to meet or exceed defined service level agreements (SLAs) for Availability, throughput, and latency.

2. Ensure measured round-trip Network latency between the Service Provider-hosted environment and COPANET is maintained within the range of 6 to 15 milliseconds (ms) under normal operating conditions.

3. Ensure measured round-trip Network latency between the Service Provider-hosted environment and public cloud hyperscalers is maintained within the range of 6 to 15 milliseconds (ms) under normal operating conditions.

4. Monitor Network latency and performance continuously using industry-standard measurement tools.

5. Provide performance metrics, reports, and evidence demonstrating compliance with latency and SLA requirements upon request.

PennDOT Page 11

6. Identify and remediate latency degradation or SLA breaches in accordance with agreed Incident response and escalation procedures.

7. Perform planned maintenance in a manner that minimizes service disruption and complies with Change Management requirements and PennDOT-approved Change windows.

8. Provide timely notification to PennDOT of planned and unplanned Network Outages impacting connectivity.

2.6.4 Security, Compliance, and Governance

Service Provider shall, at a minimum:

1. Ensure all Network connectivity complies with applicable PennDOT and Commonwealth security standards, regulatory requirements, and contractual obligations.

2. Maintain current, documented Network architecture, security controls, and connectivity designs.

3. Support Security Assessments, audits, and penetration testing related to Network connectivity.

4. In compliance with Article 8 Information Security Management for Service Provider Services, log, monitor, retain, report, and provide Network security events in accordance with audit and compliance requirements.

2.7 IP Address Management

The Service Provider shall provide comprehensive, enterprise-grade IP address management (IPAM) services supporting Mainframe (z/OS) and distributed Server environments. The IPAM service shall serve as the single authoritative system of record for all IP address allocations across Service Provider-supported on-premises, hybrid, and cloud environments.

2.7.1 Governance and Controls

Service Provider shall, at a minimum:

1. Comply with all Commonwealth-defined IP addressing standards, policies, and procedures.

2. Enforce approved allocation, naming, and segmentation rules, maintain complete and auditable IP address records, and adhere to formal change management requirements.

3. Final authority for IP addressing standards shall remain with PennDOT.

2.7.2 IP Address Lifecycle Management

Service Provider shall, at a minimum:

1. Allocate and assign IP addresses in accordance with approved policies.

2. Maintain accurate tracking of static, dynamic, and virtual IP addresses.

3. Identify and reclaim unused or decommissioned IP addresses.

PennDOT Page 12

4. Monitor utilization of IP address ranges and provide usage metrics, capacity and exhaustion forecasts.

2.7.3 Mainframe Support Requirements

The Service Provider shall demonstrate proven expertise in Mainframe networking and shall, at a minimum:

1. Manage and track static IP addresses, VIPA/DVIPA, and Sysplex-related addresses.

2. Ensure consistency between IPAM records and z/OS TCP/IP configurations.

3. Support Change windows, Availability requirements, and recovery models.

4. Monitor the connectivity, reachability and performance of TCP/IP connectivity to the configured interfaces and addresses, resolve any detected errors or anomalies and communicate of any resolutions made

5. Maintain auditable documentation for all Mainframe IP assignments.

2.7.4 Server and Distributed Systems Support

Service Provider shall, at a minimum:

1. Manage IP addressing for physical and virtual Servers.

2. Operate and maintain DHCP scopes and reservations, where applicable.

3. Prevent overlapping address space across environments.

4. Integrate IPAM with virtualization and cloud platforms.

5. Monitor the connectivity, reachability and performance of TCP/IP connectivity to the configured interfaces and addresses, resolve any detected errors or anomalies and communicate of any resolutions made

2.7.5 DNS and DHCP Integration

Service Provider shall, at a minimum:

1. Maintain alignment between IPAM, DNS, and DHCP systems.

2. Support forward and reverse DNS records.

3. Ensure traceability between IP address assignments and name resolution records.

4. Integrate any DNS Zones and the resolution of them with any needed Commonwealth-managed systems to ensure connectivity and reachability of systems

5. Regularly monitor the IPAM, DNS and DHCP system for any anomalies, resolve them, and communicate any actions taken

2.7.6 Tooling and Automation

Service Provider shall, at a minimum:

PennDOT Page 13

1. Utilize an enterprise-class IPAM solution that includes role-based access control, audit logging, and API-based integration capabilities.

2. Support automation of approved IP workflows to reduce manual effort and error.

2.7.7 Security, Compliance, and Audit

Service Provider shall, at a minimum:

1. Detect, report, and remediate IP conflicts and unauthorized usage.

2. Retain historical IP assignment data in accordance with enterprise retention requirements.

3. Provide audit-ready documentation and support internal and external audits.

2.8 Software Procurement

2.8.1 Software Purchases on Behalf of PennDOT

1. The Service Provider shall purchase certain Software identified in Exhibit 4.1 (Pricing Structure) as Software Service Charge (SSC). As part of purchasing products, the Service Provider shall also ensure that the most cost-effective decisions are made to provide business value for PennDOT. These purchases are invoiced to PennDOT as Software Service Charges (SSC) as defined in Exhibit 4 (Business Model). These Software purchases shall be invoiced to PennDOT at the Service Provider’s purchase price.

2. Renewals for Software licenses that are not the Service Provider’s financial responsibility are invoiced to PennDOT at the Service Provider’s purchase price as SSC.

Renewals include Software license and Software maintenance.

3. Service Provider shall adhere to the applicable product and services standards specified by PennDOT or set forth in the SMM and shall not deviate from such standards without PennDOT's prior approval. To the extent an authorized PennDOT representative specifies the Third-Party Vendor, pricing, and other terms and conditions for procuring products or services on behalf of PennDOT, Service Provider shall not deviate from such instructions without PennDOT's prior approval. Service Provider shall also engage PennDOT as required prior to and during any negotiations of terms and conditions.

2.8.2 Purchases under PennDOT Master Contracts

Service Provider shall use, with PennDOT's prior approval, master contracts between PennDOT and Third-Party Vendors to procure SSC products and services unless Service Provider can procure such products or services at a lower cost than such products or services can be procured through such master contracts. The Service Provider shall provide reasonable documentation regarding the foregoing as may be requested by PennDOT. Purchasing process details are maintained in the SMM.

PennDOT Page 14

2.8.3 Service Provider Contracts

Service Provider may use, with PennDOT's prior approval, contracts between Service Provider and Third-Party Vendors if permitted by such contracts to procure products and services on PennDOT's behalf. Service Provider's use of such contracts shall be conditioned on and subject to the following:

1. PennDOT approving in advance the terms, conditions, and pricing of such contracts and any financial or other commitments made therein by or on behalf of PennDOT.

2. Service Provider complying with the terms and conditions of such contracts and accepting responsibility for meeting any minimum volumes.

3. Where permitted by such contracts and consistent with PennDOT's approval, Service Provider shall pass through to PennDOT any refunds, credits, discounts, or other rebates to the extent such amounts are directly allocable to PennDOT.

4. Service Provider retaining responsibility for curing any breaches of such contracts and indemnifying, under and in accordance with this contract, PennDOT for any Losses in connection with such breaches.

5. Such contracts offering more favorable pricing and equivalent or better terms and conditions for the requested product or service than the master contracts between PennDOT and Third-Party Vendors.

6. Giving PennDOT price quotations and other benefits consistent with the Service Provider's favorable Third-Party Vendor arrangements, where permitted by such Third- Party Vendors.

7. To the extent reasonably practicable, using the aggregate volume of Service Provider's procurements on behalf of itself and PennDOT to obtain more favorable pricing and equivalent or better terms and conditions for the requested product or service.

8. After evaluating PennDOT and State cooperative contracts and verifying that such contracts do not offer greater business value to PennDOT.

2.8.4 PennDOT Direct Software Vendor Access

Service Provider shall, at a minimum:

1. As the owner of the software contracts, shall obtain and maintain all necessary approvals from software providers to allow PennDOT to directly contact such providers for functional “how-to” guidance, usage instructions, and clarification of standard features and workflows.

2. Ensure that PennDOT is recognized as an authorized party for functional inquiries and that no contractual restrictions prevent or unreasonably limit this access.

3. Direct vendor access shall not transfer responsibility for Service performance (e.g., incident resolution, Service Levels), or operational support away from the Service Provider.

PennDOT Page 15

4. Provide documentation evidencing vendor approvals upon request and ensure continuity of access for the duration of the services.

PennDOT Page 16

3 Security Services

3.1 Security Administration

Service Provider shall, at a minimum:

1. Adhere to the then-current safety and security policies, rules, procedures, and regulations established by COPA with respect to data and facilities.

2. Adhere to COPA then-current security policies and rules, as published in https://www.pa.gov/agencies/oa/policies/it-policies.

3. Comply with National Institute of Standards and Technology (NIST) Federal standards and related NIST 800 series Special Publications (SP) and Federal Information Processing Standards (FIPS) standards.

4. Comply with all Security Incident notification and response procedures as specified in the SMM.

5. Communicate the physical and logical Security management processes to Service Provider Personnel and each Service Component.

6. Implement the physical and logical Security functions in accordance with COPA Rules and the SMM.

7. Validate that proper segregation of duties exists in accordance with COPA Rules and the

SMM.

8. During the implementation of Changes or management of crises where it is not feasible to observe a proper segregation of duties, immediately inform PennDOT of this fact and keep a record of all actions performed.

9. Inform PennDOT immediately if Service Provider becomes aware of any vulnerability or weakness in the Services and recommend a solution or mitigation in adherence to then-current COPA policies, as published in https://www.pa.gov/agencies/oa/policies/it-policies.

10. Provide Reports, on at least a weekly basis, to PennDOT to identify the physical access rights that should be removed from PennDOT locations.

11. Adhere to the physical Security administration processes defined in the SMM processes.

12. Encrypt Mainframe data as required to adhere to COPA then-current Encryption Policy, as published in https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/encryption%20policy.pdf; at a minimum, all Mainframe data at rest shall be encrypted.

13. In accordance with procedures documented in the SMM:

a. Maintain current listing of personnel who are authorized to access the Mainframe controlled areas within the Service Provider’s Mainframe data centers, including Service Provider Personnel and authorized Third Party Vendors.

https://www.pa.gov/agencies/oa/policies/it-policies https://www.pa.gov/agencies/oa/policies/it-policies https://www.pa.gov/agencies/oa/policies/it-policies https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/encryption%20policy.pdf https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/encryption%20policy.pdf

PennDOT Page 17

b. Comply with Service Provider Personnel access requirements as documented in the SMM.

c. Establish and/or maintain controls for access to keys used to open locked cages and other critical areas.

14. To enable PennDOT to drive higher levels of compliance and defense with respect to its security posture within the overall Service:

a. Evaluate program security and recommend improvements based on COPA policy, industry standards, and best practices. Evaluate tools and processes associated with all Services, including service integration and management, PennDOT inter-connection with managed Mainframe and managed Server Services.

b. Monitor all assets actively for security vulnerabilities, flaws, threats, and other factors that could undermine PennDOT's security posture.

c. Drive higher levels of data encryption across all service elements for data in flight and at rest – particularly for those service elements that are prone to attack and that handle large numbers of records containing sensitive data.

d. Seek and work with PennDOT to implement identity management, multi-factor authentication, and leverage PennDOT programmatic fraud/intrusion detection for all trusted user IDs (e.g., root, admin, dba) within the scope of Services.

e. Actively participate in regular third-party penetration testing of all PennDOT assets regardless of where they are implemented on/off premise. Remediate vulnerabilities for Service Provider Services and oblige the appropriate PennDOT Service Component to remediate issues within their scope of responsibility.

f. Actively participate in an annual Security Assessment and remediate all vulnerabilities.

3.2 Proper Disposal of Data and Confidential Information

Service Provider shall, at a minimum:

1. Comply with those federal and Commonwealth Laws that address the proper handling, securing, and disposing of data in both physical and electronic form.

2. Some examples include then-current COPA policies within this https://www.pa.gov/agencies/oa/policies/it-policies, the Internal Revenue Code (“IRC”), the Fair and Accurate Credit Transactions Act (“FACTA”), the Family Educational Rights and Privacy Act (“FERPA”), the Gramm-Leach-Bliley Act and the Federal Information Security Management Act ("FISMA").

3. Comply with the “Disposal Rule” section of FACTA, which states that any person who maintains or otherwise possesses consumer or employee information for a business purpose is required to properly dispose of the information.

4. Sanitize all types of electronic media and non-volatile memory prior to disposal or release for reuse.

https://www.pa.gov/agencies/oa/policies/it-policies

PennDOT Page 18

a. Provide secure erasure of data from products and/or services (e.g., computers, switches/routers, telephones, printers, fax machines, scanners, multifunction devices) prior to final disposition outside the secure data center environment.

b. Approved methods for media and memory sanitization are listed in then-current COPA policies within this https://www.pa.gov/agencies/oa/policies/it-policies and the NIST Special Publication 800-88, Guidelines for Media Sanitization.

5. Document and verify media sanitization and disposal actions.

6. Comply with and adhere to these and all other applicable federal and Commonwealth guidelines.

7. Ensure certain physical actions occur when “end of life” magnetic media requests are received directly from the Internal Revenue Service, the United States Social Security Administration, or other sources that contain additional information deemed protected by the above-mentioned Acts, including:

a. Magnetic media must not be released for destruction without first being subjected to electromagnetic erasing meeting the minimum most stringent standard set forth by applicable Laws.

b. Hard drives must be completely overwritten and/or physically destroyed according to applicable Laws prior to release from a secure environment.

c. Physical media that is in a CD format or paper format must be destroyed with an appropriate shredder that complies with applicable Laws.

3.3 PennDOT Security Incident Reporting Instructions

Service Provider shall promptly investigate, document, and report Security Incidents in accordance with then-current COPA Policy as published in https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/it%20security%20incident%20reporting%20policy.pdf and applicable COPA Standards (including NIST Special Publication 800-61 and COPA’s “Acceptable Use Policy Guidelines.”) as documented in the SMM.

3.3.1 IRS Publication 1075 and Social Security Requirements

PennDOT receives federal tax information that is subject to the safeguarding requirements of the United States Social Security Administration (SSA) regulations, IRS Publication 1075; therefore, Service Provider shall, at a minimum:

1. In addition to the requirements set forth in the MST, to the extent that federal tax information (as defined in IRS Publication 1075) is processed on Equipment, over Networks, or in a PennDOT Facility that is included in the Services, comply with all IRS Publication 1075 requirements with respect to its performance of the Services, including deploying hardware and Network Infrastructure as well as a cage to meet two barrier rules and prevent comingling.

2. Assist PennDOT with IRS Safeguard Reviews as requested by PennDOT, including providing all requested documentation, facilitating the physical inspection of the https://www.pa.gov/agencies/oa/policies/it-policies https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/it%20security%20incident%20reporting%20policy.pdf https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/it%20security%20incident%20reporting%20policy.pdf

PennDOT Page 19 applicable Equipment, Network or Service Provider Facility where Services are being performed, and assisting in the resolution of any review findings that result from such IRS Safeguard Review.

3. Assist PennDOT with Social Security Administration (SSA) audits as requested by PennDOT, including providing all requested documentation, facilitating the physical inspection of the applicable Equipment, Network or Service Provider Facility where Services are being performed, and assisting in the resolution of any review findings that result from such SSA Audit.

4. Communicate and coordinate with the other Service Components as required (and as directed by PennDOT) to accomplish the foregoing obligations.

3.3.2 Security References

The Service Provider shall perform the Services in compliance with all federal and Commonwealth laws and industry standards as they may be updated from time-to-time, including but not limited to the following:

1. FIPS 140-3, and future releases, Federal Information Processing Standards Publication, Security Requirements for Cryptographic Modules;

2. FISMA – Federal Information Security Management Act;

3. FERPA – Family Educational Rights and Privacy Act;

4. IRS Pub 1075 – Tax Information Security Guidelines for Federal, State and Local Agencies;

5. PCI – Payment Card Industry Security Standards;

6. ISO/IEC 27001:2005 - Information technology – Security techniques – Information security management;

7. ISO/IEC 27002 – code of practice for information security management;

8. NIST 800 – National Institute of Standards and Technology standards and related publications;

PennDOT Page 20

4 Managed Mainframe Services

4.1 Mainframe Operations

Service Provider shall, at a minimum:

1. Assume responsibility for providing Services for the Mainframe environment.

2. Assume responsibility for all master and subordinate console functions.

3. Lead and perform System, Equipment, and Software Upgrades with PennDOT.

4. Issue commands to control all In-Scope computer platforms throughout the organization.

5. Provide automated monitoring and alerting for all In-Scope platforms.

6. Assume the responsibility for and perform all console functions, including:

a. Monitor all processing of all transactions (e.g., batch jobs, Applications, utilities).

b. Monitor the environment, alarm systems, environmental controls, and the transmission and reception of polling information from outside organizations.

c. Take appropriate action to Resolve online-system-related Incidents, including escalating (as applicable) the Incidents and/or Problems to the proper Level 2 Support group.

7. Manage, maintain, monitor, and control the performance of online interactive traffic and take appropriate action to Resolve online-system-related Incidents, including escalating (as applicable) the Incidents and/or Problems to the proper Level 2 Support group.

8. As needed, manage, maintain, monitor, and control the transmission of files to and from the Mainframe Services and between any other Parties as designated by PennDOT.

9. Provide operational support for data transmission (send/receive) consistent with commercial and PennDOT Standards.

10. Manage, maintain, monitor, and control online and batch processes, both scheduled and unscheduled (including on-request processing).

11. Complete PennDOT-defined batch processing and backups in the correct sequence and within the periods designated by PennDOT.

12. Where practicable, provide for automated batch and asynchronous task scheduling, including backups.

13. On an ongoing basis, enhance processing capabilities and efficiencies through System tuning and other run-time improvements.

14. Regularly monitor utilization needs and efficiencies, and report periodically on tuning initiatives.

15. Produce trend reports to highlight Production issues and establish predetermined action and escalation procedures when encountering batch window issues.

PennDOT Page 21

16. Monitor, verify, and make appropriate adjustments to support proper and timely Application executions.

17. If Applications do not execute properly, notify PennDOT in accordance with the notification procedures.

18. Perform periodic and emergency Systems maintenance in accordance with procedures documented in the SMM, established to minimize the Impact on PennDOT business.

19. Perform computer shutdowns and restarts, as required, and execute customary utility functions.

20. Maintain, administer, and provide the necessary automated tools and processes for Systems management, to the extent possible, within the tool suite jointly agreed by the Parties.

21. Maintain tables, calendars, parameters, and definitions for tools used to automate manual procedures or to improve the quality of operations.

22. Maintain and update documentation for all operational procedures and services, including accurate information for all Configuration Items (CIs) in the Configuration Management Database (CMDB).

23. Provide feedback to PennDOT regarding the impact of potential architecture and design Changes through existing PennDOT processes.

24. Identify opportunities for PennDOT to reduce Equipment and Software costs and/or improve System performance.

25. Run or terminate jobs or utilities that impact Users with PennDOT approval, in accordance with the agreed-upon Incident and Request processes.

26. Proactively monitor and report to PennDOT on resource shortages whenever less than 20% of a resource remains free. Additionally, report utilization statistics and trends to PennDOT monthly.

27. Support PennDOT to develop, maintain, and use an emergency contact list and escalation procedures to resolve jobs that end abnormally.

28. In accordance with the Incident Management and Service Level requirements, resolve abnormally ended jobs caused by conditions external to production programs.

29. Repair abnormally ended jobs when possible and perform job restarts in accordance with the SMM.

30. Check job outputs, print queues, and manage job priorities with PennDOT.

31. Take printers in and out of service, start the spool, and drain printers.

32. Define, create, and control all automated operation functions.

33. Work closely with the PennDOT Application Development and Maintenance (ADM) groups from the initial design through the Production processing cycles.

PennDOT Page 22

4.2 Mainframe Production Control and Scheduling

Service Provider shall, at a minimum:

1. Assume responsibility for all production control and scheduling functions as applicable.

2. Provide production control and operations staff 24x7x365.

3. Integrate all production control and schedule functions in conformity with PennDOT requirements.

4. Establish, document, and maintain standards for production jobs.

5. Develop, distribute, and obtain PennDOT approval of schedules prior to implementation.

6. Provide schedule status updates in accordance with the SMM.

7. Proactively prepare for User deadlines per customized User requirements.

8. Respond expeditiously to requests from PennDOT for Priority job execution.

9. Promptly notify PennDOT if special requests will affect the timely completion of other tasks.

10. Prioritize and monitor batch jobs in accordance with PennDOT schedule parameters, and report distribution to optimize the use of processing windows and the scheduled Availability of online Applications dependent on batch processing, while verifying that batch completion times are met.

11. As directed by PennDOT enter program control specifications (parameters) into Application job streams as directed by Authorized Users.

12. Maintain System job streams and scripts, including indicating file usage, job dependencies/priorities, and available program options.

13. Monitor all jobs, including scheduled and ad hoc requested jobs.

14. Promptly notify PennDOT of scheduling impacts due to scheduled or unscheduled Outages and processing delays.

15. As directed by PennDOT start jobs manually when automated processes do not exist or are unavailable.

16. Investigate and report, in accordance with PennDOT-approved documentation, on all jobs that end or perform abnormally.

17. Resolve interruptions caused by conditions external to production programs, including, but not limited to, disk or tape issues.

18. Execute re-runs as requested by PennDOT, and restart jobs, tasks, and scripts according to Service Provider-developed operational procedures (e.g., procedures for successful back-outs).

19. During off-hours, contact ADM staff, other technical staff, and Third Parties as necessary and work with them on Level 2 and Level 3 Support issues.

PennDOT Page 23

20. Create Incident reports for job abnormalities using the Incident Management System, as described in Section 6.1 Service Management Systems.

4.3 RACF Services For Software

Service Provider to provide Resource Access Control Facility (RACF) access administration services for Software upgrades and installations.

4.3.1 RACF Security Administration Requirements

For clarification purposes PennDOT will perform the following activities:

1. Create, update, and maintain PennDOT and Service Provider RACF user IDs.

2. Create, update, and maintain PennDOT specific RACF groups.

3. Create, update, and maintain PennDOT specific RACF dataset profiles.

Service Provider shall, at a minimum:

1. Provide an experienced RACF administrator who shall create RACF batch jobs required to upgrade or install software, that then will be submitted by PennDOT staff.

2. Resolve RACF batch job issues as identified by PennDOT staff.

3. Review vendor-provided documentation (including program directories and security guides) for all Mainframe software installations and upgrades.

4. Create and provide RACF batch jobs to PennDOT to execute:

a. define, modify, or remove RACF profiles required to support installed or upgraded software, including software datasets and general resource profiles.

b. create, update, and maintain RACF user IDs and groups required for software operation, ensuring adherence to least-privilege principles.

c. grant and revoke RACF permissions (PERMITs) in accordance with documented business and technical requirements related to software installation.

d. configure appropriate access levels (READ, UPDATE, CONTROL, ALTER) and UACC values for all RACF profiles requirements related to software installation.

e. enable auditing and logging for security-relevant resources where required by policy or compliance standards.

5. Provide justification to PennDOT when RACF privileges such as SPECIAL, OPERATIONS, and PROTECTED are to be granted. If approved, PennDOT will grant the requested access.

4.3.2 System Programming and Installation Coordination Requirements

Service Provider shall, at a minimum:

1. Identify RACF-related security requirements arising from Mainframe software installations or upgrades.

PennDOT Page 24

2. Coordinate with PennDOT RACF Security Administration to ensure all required security definitions are implemented before software activation.

3. Validate that RACF permissions are sufficient for software components execute successfully without unauthorized access.

4. Support testing activities to identify and remediate RACF access violations during installation, upgrade, and validation phases.

5. Document RACF dependencies and security considerations associated with the installed or upgraded software.

4.3.3 Started Task and Subsystem Security Requirements

Service Provider shall, at a minimum:

1. Create and provide to PennDOT to execute a RACF batch job to define and maintain RACF STARTED class profiles for all product-related started tasks.

2. Create and provide to PennDOT to execute a RACF batch job to assign appropriate user IDs and groups to started tasks based on function and security requirements.

3. Ensure that started task user IDs operate with the minimum privileges necessary for correct execution.

4. Configure PROTECTED attributes only when explicitly required and approved through a formal security review.

5. Validate that started tasks have access only to the software datasets, commands, and resources required for operation.

4.3.4 Application and End-User Access Security Requirements

For clarification purposes PennDOT will perform the following activities:

1. Support Application testing by provisioning and removing temporary access as required.

2. Control end-user and group access to Applications in accordance with approved access models.

Service Provider shall, at a minimum:

1. Create and provide PennDOT to execute a RACF batch job to define and manage RACF APPL and application-specific resource profiles for installed or upgraded software products.

2. Implement role-based or group-based access controls where supported.

3. Ensure that end-user access permissions are reviewed and properly adjusted following software upgrades or functional changes.

4.3.5 Compliance, Audit, and Security Oversight Requirements

PennDOT Page 25

1. Maintain documentation of all RACF changes implemented during software installation or upgrade activities.

2. Support security and compliance reviews by providing evidence of RACF configurations and access controls.

3. Validate that temporary or elevated access granted during installation or testing is removed post-implementation.

4. Ensure RACF audit records and logs are available for review in accordance with regulatory and organizational requirements.

5. Lead post-installation security reviews to confirm alignment with internal security standards and…