Exhibit A, Attachment 1 - Work Authorization.docx

Agreement [number] Page 3 of 4 Covered California/[Contractor Name]

Exhibit A, Attachment 1 (Standard Agreement)

WORK AUTHORIZATION

This Work Authorization incorporates by reference, as if fully set forth herein, Agreement [number] between Covered California and [Contractor Name], and all terms and conditions contained in or attached hereto.

A. Limited Scope or Tasks Covered California requires Contractor to perform an initial Microsoft 365 Platform work authorization focused on transition planning, current-state assessment, governance and architecture review, and prioritized support and enhancement planning for Covered California’s Microsoft 365 Platform and related Microsoft cloud services.

All tasks under this Work Authorization are related to and fall within the Scope of Work of the Agreement, including Microsoft 365 Platform development, administration, security, governance, operational support, and knowledge transfer.

1. Microsoft 365 Platform Current-State Assessment and Transition Planning Contractor shall perform an initial review and assessment of Covered California’s Microsoft 365 Platform environment and related Microsoft cloud services currently in use in support of Covered California’s business operations.

a. Environment and service review Contractor shall review Covered California’s existing Microsoft 365 Platform environment, including relevant Microsoft 365 services, Microsoft Copilot capabilities, Power Platform components, related Azure services, identity and access management configurations, and applicable security/compliance capabilities that are in scope under the Agreement.

1. Contractor shall review available documentation, system configurations, architecture artifacts, known issues, support processes, and current solution inventory provided by Covered California.

2. Contractor shall identify key platform components, current support dependencies, major risks, known issues, and any immediate gaps affecting supportability, governance, administration, or platform evolution.

b. Stakeholder and support transition coordination Contractor shall coordinate with Covered California technical staff and business stakeholders to understand current operational needs, ongoing support requirements, known priorities, and expected near-term work.

1. Contractor shall conduct meetings or working sessions with Covered California representatives, as directed, to gather operational context and understand existing support and enhancement needs.

2. Contractor shall document transition considerations, support assumptions, and recommended initial priorities for the commencement of services under the Agreement.

2. Governance, Architecture, and Operations Review Contractor shall perform an initial review of the Microsoft 365 Platform governance, architecture, administration, and operational model in order to support Covered California’s secure, stable, and well-governed use of the platform.

a. Governance and architecture review Contractor shall assess the current governance and architecture approach for Microsoft 365 Platform services and related Azure services used in conjunction with the platform.

1. Contractor shall review current environment strategy, administrative model, platform standards, and governance processes relevant to Microsoft 365, Azure, Entra ID, Power Platform, and related services in scope.

2. Contractor shall identify recommendations for improvements to governance, architectural patterns, administration practices, and platform support approach, consistent with Covered California priorities and policies.

b. Security and compliance review Contractor shall review relevant security and compliance configurations that support the Microsoft 365 Platform, as directed by Covered California and within the scope of the Agreement.

1. Contractor shall identify major considerations or recommendations related to identity and access management, conditional access, DLP, sensitivity labeling, logging, monitoring, and other applicable Microsoft security and compliance capabilities in scope.

2. Contractor shall document recommendations for prioritization, remediation, or further analysis by Covered California and Contractor during subsequent work authorizations or assigned tasks.

3. Initial Work Plan, Deliverables, and Knowledge Transfer Contractor shall prepare initial planning and documentation materials to support execution of services under the Agreement.

a. Initial work plan and prioritized roadmap Contractor shall prepare a written summary of recommended initial activities and priorities for platform support, administration, governance, enhancement, and knowledge transfer.

1. Contractor shall provide a prioritized initial work plan identifying recommended short-term support and enhancement priorities.

2. Contractor shall provide a high-level roadmap or sequencing recommendation for near-term Microsoft 365 Platform work, based on the assessment performed under this Work Authorization.

b. Documentation and knowledge transfer Contractor shall document findings and provide an initial knowledge transfer session to Covered California staff.

1. Contractor shall deliver documentation summarizing the current-state assessment, key findings, identified risks, and recommended next steps.

2. Contractor shall conduct at least one walkthrough or knowledge transfer session with Covered California staff covering findings, priorities, and recommended support approach.

Deliverables under this Work Authorization may include, but are not limited to:

i. Current-state assessment summary.

ii. Transition and support assumptions summary.

iii. Governance and architecture review summary.

iv. Initial prioritized work plan and roadmap.

v. Knowledge transfer session materials or summary.

B. Resources Required by Contractor

Covered California shall timely provide the following resources and materials to the Contractor pursuant to the performance of this Work Authorization:

i. Available existing documentation, architecture diagrams, process documents, and prior support materials relevant to the Microsoft 365 Platform environment in scope.

ii. Access to Covered California business and technical staff, subject matter experts, and existing support contacts, as necessary to perform the tasks identified in this Work Authorization.

iii. Appropriate system and environment access, as approved by Covered California and subject to applicable security, privacy, and background clearance requirements.

iv. Access to relevant Microsoft 365 Platform, Power Platform, Azure, Entra ID, and related configuration information needed to perform the assessment and planning tasks described in this Work Authorization.

v. A Covered California-issued laptop for any Contractor personnel performing work that requires access to Covered California systems, applications, data, or network resources. Contractor personnel shall use only Covered California-approved devices and access methods when performing such work, in accordance with Covered California security and information technology policies.

C. Work Schedule

Contractor shall complete all work and provide all deliverables specified in this Work Authorization by June 30, 2029, unless this Work Authorization is earlier completed, revised, terminated, or extended through an approved amendment consistent with the Agreement.

D. Contractor Personnel and Estimated Total Costs

Contractor agrees to provide the personnel listed in the table below for the performance of this Work Authorization. Contractor estimates that the performance of this Work Authorization will not exceed number (X) total labor hours and will not exceed number dollars ($00.00) in total costs, as specified in the table below.

Covered California may, in its sole discretion and with the approval of its Board of Directors, approve additional labor hours requested by the Contractor to complete the performance of this Work Authorization.

E. Certification of Approval

By signing below, Contractor and Covered California agree to the provisions set forth in this Attachment to Exhibit A of this Agreement. Only an authorized signatory from each Agreement party may sign this Attachment.

CONTRACTOR NAME

BY (Authorized Signature)

DATE SIGNED (Do not type)

PRINTED NAME AND TITLE OF PERSON SIGNING

Name, Title

COVERED CALIFORNIA

BY (Authorized Signature)

DATE SIGNED (Do not type)

PRINTED NAME AND TITLE OF PERSON SIGNING

Name, Title

(V.0720)