Exhibit A Scope of Work [Actual scope of work to be negotiated upon contract award.]

1 Functional Requirements

ID Requirement

F.001 The solution must migrate all historical data from the current system(s) to the new system without data loss or corruption and include mapping, validation and reconciliation. Migration must be validated for completeness and accuracy prior to go-live.

F.002 The vendor must provide role-based access controls configurable by the County to manage user permissions at different levels of hierarchy.

F.003 The system must allow users to create new document codes and update or maintain existing document codes, including the ability to associate applicable recording fees with each code.

F.004 The system must automatically calculate total recording fees based on document title, number of pages, additional applicable fees, and any regulatory exemptions or "No Fee" designations.

F.005 The system must support assigning multiple document codes and fee codes to a single document and allow administrators to configure those relationships through the user interface.

F.006 The system must validate all transfer tax calculations and flag any discrepancies when computed fees do not match the expected formula or threshold.

F.007 The system must allow users to review and update the codes, fees, and page counts of individual documents within a batch before cashiering the entire batch.

F.008 The system must support automated indexing of documents that are recorded manually, in batches, or via third-party interface, using a standardized document naming convention defined by the County.

F.009 The system must capture and store detailed metadata for each recorded document, including document number, record date and time, document type, and any additional required attributes.

F.010 The system must allow administrators to define and manage a list of government-issued reject codes, which can be referenced by staff during document review or rejection processes.

F.011 The system must allow users to generate rejection letters by selecting one or more predefined rejection reasons and shall track the grantor, grantee, document type, and rejection status.

ID Requirement

F.012 The system must allow electronic document submissions to be rejected without incurring charges or assigning a document number, in accordance with predefined reject reasons.

F.013 The system must include an integrated module that allows users to create document orders, process recordings, generate invoices, accept payments, send rejection notices, and track document status.

F.014 The system must allow users to search and retrieve a specific batch of documents using the SECURE(Tool) batch ID number.

F.015 The system must support payment collection via multiple payment types, including cash, check, credit/debit card, and mobile payment, and support mixed payments within a single transaction (e.g., part cash and part card).

F.016 The system must allow each user to reconcile their daily monetary transactions, including all forms of payment (cash, check, card, etc.), and submit a daily reconciliation report.

F.017 The system shall allow exporting of daily revenue and accounts receivable information into a format that can be consumed by financial systems or used for audit reporting.

F.018 The system must allow users to accept payments for outstanding charges previously incurred by internal County departments or external entities.

F.019 The system must allow authorized users to modify previously recorded transactions by applying corrected charges or issuing refunds and shall maintain a history of all changes made.

F.020 The system must allow overpayment amounts to be applied either to the original receipt and recorded under the responsible user's profile, based on defined rules.

F.021 The system must allow users to manually enter document numbers and define page separations when reviewing a batch of scanned documents.

F.022 The system must support batch scanning workflows where users can input a certificate type and a corresponding certificate number range before initiating the scan.

F.023 The system must support high-speed scanning that can read barcodes and automatically assign document numbers and page counts for both recording and cashiering processes.

F.024 The system must provide an indexing module that allows users to:

• Tag documents by type

• Link related documents

• View and manage indexing queues

• Verify and update index values as needed

F.025 The system must allow indexing of birth, death, and marriage certificates. Users must be able to:

• Correct errors in the index

• Track changes made

• Seal certificates by removing their image and metadata from public view

F.026 The system must provide configurable redaction tools that:

• Allow users to define custom redaction rules (e.g., SSNs, legal names)

• Save redacted documents separately without deleting originals

• Route redactions for approval before finalization

F.027 The system must allow submission of old document batches for redaction and support integration with tools that flag sensitive data for manual review and approval.

F.028 The system must be fully compatible with the SECURE Interface (Orange County’s Multi- County Electronic Recording Delivery System) to enable continued electronic recording delivery.

F.029 The system must allow scheduled export of selected documents (by type or date range) to third parties, and allow limiting access based on user role or organization.

F.030 The system must support exporting all documents into a film backup system with tracking features that identify successful or failed export jobs to prevent duplication or loss.

F.031 The system must allow staff to create cover pages for maps, attach them to individual map documents, and export the complete version to external recipients.

F.032 The system must allow authorized users to search, view, and print all document types, including public and restricted official records, vital records, and PCORs.

F.033 The system must include a public search feature that complies with AB1785 by limiting visibility to approved data fields.

F.034 The system must support lobby document search at county workstations, where visitors can view and request documents for printing by staff.

F.035 The system must allow authorized users to update system menus, user groups, receipt formats, label templates, reporting settings, and data display limits.

F.036 The system must allow administrators to define and manage numbering schemes, storage locations, city codes, and book types used in document processing.

F.037 The system must provide tools for tracking inventory levels and order history of official bank note paper used in vital records.

F.038 The system must allow users to define and manage fee formulas, individual fee codes, groupings of fees, and associated reporting categories.

F.039 The system must support the setup and management of document classifications, filing codes, and filing code groups for consistent record keeping.

F.040 The system must allow users to define shortcut codes for indexing (e.g., “010” auto-tags as “Solano County of”) and build an auto-indexing knowledge base.

F.041 The system must support assigning printers and workstations to users, and allow limiting certain printer functions (e.g., printing banknote certificates) to specific roles.

F.042 The system must allow setting redaction rules for past (backfile) and future (day forward) records, including priority levels and daily limits, configurable by authorized staff.

F.043 The system must provide a role-based access control module where admins can create roles, assign them to users, and restrict access at tab level and optionally at field level.

F.044 The system must autocalculate transfer tax calculation based on predefined criteria and allow users to override values, then automatically compute/recompute amounts, and validate inputs with error-checking rules configured by administrators.

F.045 The system must allow creation of user roles for other county departments, with restricted access to only the data necessary for their operations. Each role must be configurable to limit access based on department function.

F.046 The system must integrate with the SECURE interface to:

• Accept and process valid electronic submissions

• Reject invalid documents with reason codes

• Calculate fees and create invoices based on document type and page count

• Send confirmations back to the SECURE system

F.047 The system must support uploading of documents individually or in batch mode to improve processing efficiency and meet high-volume requirements.

F.048 The system must allow authorized staff to:

• Reassign existing orders

• Lock orders to specific user groups to control access

• Take over orders for resolution or correction if needed

F.049 System allows reports to be exported in PDF, XLS, and CSV formats without merged cells or fields.

F.050 System must provide date range selection, column filtering, dynamic sorting, row counts/totals/grand totals, and report metadata (name, filters, date/time) in headers or footers for all reports.

F.051 System must generate an activity report with selectable parameters including date range, activity type, payment type, customer, user ID, and general ledger account.

F.052 System must generate revenue reports by revenue account and trust fund account, sortable by accounting period and account number.

F.053 System must generate receipts reports with deposits, payment types, transaction descriptions, and associated fees, grouped and sortable by user, department, and accounting period.

F.054 System must generate reports comparing recorded transactions to payment totals, receivable balances, and cashier records, indicating differences or “reconciled” status.

F.055 System must generate a daily report with totals by payment type.

F.056 System must generate general ledger trial balance reports with opening balance, total debits, total credits, and ending balance, and a posting recap showing transactions to revenue accounts.

F.057 System must generate report for shortages and overages by date range, user ID, reason code, transaction description, amount, and customer name.

F.058 System must generate report for all adjustments and voided receipts with date, user ID, invoice number, reason code, and customer name, with access controlled by role.

F.059 System must generate report with number and total amount of vital records issued, reconciled to certificates printed and voided, including cash and non-cash transactions.

F.060 System must generate transfer tax reports with liability details by jurisdiction, parcel/document number, amounts, and filtering by customer, date range, and tax type.

F.061 System must generate reports showing missing instrument numbers, missing images, missing index entries, and permanent verified documents.

F.062 System must generate user activities report with filtering by user/group, date range, time range, and activity type.

F.063 System must generate reports and dashboards showing document processing, indexing, verification, and work statistics by user and date range.

F.064 System must generate financial reports including daily summaries by payment type, deposit permits, ACH payments, and fund distribution.

F.065 System must generate monthly and periodic reports for recorded documents, copies, vital records revenue, miscellaneous statistics, and deposit summaries, with filtering by multiple selection criteria.

F.066 System must generate annual indexes for birth, death, and marriage records sortable by identifiers.

F.067 System must generate invoices for an individual customer on demand.

F.068 System must generate daily reports of redaction activities with counts by type.

F.069 System must generate a report with document counts, page counts, missing items, and paper vs. electronic breakdowns, filterable by user, date, and document type.

F.070 System must generate a daily report of unscanned documents.

F.071 System must generate reports of end-of-shift drawer contents, receipts by workstation, and payment summaries by type.

F.072 System must generate Daily Statistics Reports for Official Records and Vital Records, providing daily workload and productivity statistics compiled from Solano Reports

F.073 System must generate a Monthly Statistic Report for Official Records and Vital Records, to compile workload and performance statistics.

F.074 System must generate a Monthly Document Recording Report aggregating document volumes by type, used for trend analysis and market monitoring.

F.075 System must generate a Department of Insurance Report by extracting insurance-related document counts from the Monthly Document Recording Report.

F.076 System must generate a Vital Records Improvement Project (VRIP) Report aggregating Vital Records revenue for annual state reporting, detailing funds collected and utilized by Recorder Vital Records.

F.077 System must generate a Documentary Transfer Tax (DTT) Report summarizing and remitting DTT revenue to the state, allocated by city and county.

F.078 System must generate a Real Estate Fraud Fund Report aggregating applicable document types from the Monthly Document Recording Report for monthly DA reporting.

F.079 System must generate a DTT Cities Report consolidating monthly Documentary Transfer Tax amounts into a single dataset for reference and reconciliation.

F.080 System must generate a Recorder Statistics Report (RECSTATS) aggregating monthly totals for recorded documents, maps, transfer tax, copies, and vital records sales for budgeting and analysis.

F.081 System must generate a Vital Records State Remittance Report aggregating monthly Vital Records funds for submission to the state.

F.082 System must generate an SB2 Quarterly Remittance Report to calculate and remit SB2 funds to the state, reporting total collected, administrative fees, and net remittance.

F.083 System must generate a Government Charges Billing Report aggregating quarterly charges across funding sources for invoicing (EDD, FT, SB, etc.).

F.084 System must support full data migration, including cashiering history, document interaction history, document indexes and associated images, and employee statistics.

F.085 System must have a ability to ingest data/files/images in batch/bulk processing from external sources.

F.086 System must generate indexed list based on document code criteria. System must be able to ingest data from CSV file to be merged with letters including Records Notification Letters.

F.087 The system must allow seamless integration with current third-party software, including Vrisa, NemoQ, ScanPro, and Kodak (arcWriter and Kofax). Integration must be fully functional post-deployment and maintain vendor-supported compatibility.

F.088 The system must include or integrate with a payment or POS system as required.

F.089 System must ensure that electronic documents are delivered without alteration and returned when applicable, consistent with ERDS standards.

F.090 The solution must automate Restrictive Covenant Modification document language redaction to meet AB 1466 compliance. The process must be repeatable, auditable, and allow exception handling.

F.091 The solution must provide comprehensive, automated redaction capabilities compliant with AB 1466, including a workflow approval process involving County Counsel for quality assurance prior to public release.

F.135 The system must allow user to file documents with the Recorder.

F.136 The system must allow filed documents to be associated with a document code.

F.137 The system must allow authorized users to view and print to redacted and unredacted documents and images based on their roles and/or permissions.

2 Non-Functional Requirements

N.001 The system must comply with ADA and WCAG 2.0 AA accessibility standards.

N.002 Vendor updates must be applied after business hours unless approved otherwise.

N.003 The system must handle current and anticipated future workloads without performance degradation.

N.004 System must protect the confidentiality and integrity of digital and digitized electronic records during transmission and storage through encryption, secure protocols, and tamper-detection mechanisms.

N.005 System must support digital signatures, hashing, or equivalent security controls to detect and prevent unauthorized modification of electronic records.

N.006 System must implement role-based access controls (RBAC) that enforce secure-access roles as defined by ERDS (Authorized Submitter, Agent, System Administrator, Account Administrator).

N.007 System must enforce separation of duties so that individuals cannot hold conflicting secure-access roles.

N.008 System must maintain immutable transaction logs that record all document deliveries, returns, and access activity for audit purposes.

N.009 System must include incident response capabilities that allow for rapid detection, reporting, and containment of unauthorized or fraudulent transactions.

N.010 All environments, services, and/or products must be free from advertisements or solicitations to ensure compliance with government standards and eliminate user distraction.

N.011 The solution must maintain documentation of all service accounts and their associated jobs, databases, scheduled tasks, and drive mappings. Where possible, this should be automatically generated or supplemented by audit logs to ensure accuracy.

3 Technical Requirements

T.001 The solution must be delivered as a Software-as-a-Service (SaaS) hosted in a secure cloud environment (e.g., AWS, Azure, Google Cloud) with high availability and redundancy.

T.002 The solution must support a multi-tenant architecture that logically separates agency data from other tenants while maintaining security and performance.

T.003 The solution must support Single Sign-On (SSO) using SAML 2.0, OpenID Connect, or equivalent secure authentication protocols.

T.004 The solution must encrypt all data at rest and in transit using industry-standard protocols (e.g., AES-256, TLS 1.2 or higher).

T.005 The solution must be accessible via the latest versions of major web browsers (Chrome, Edge, Firefox, Safari) without requiring client-side software installations beyond standard browser plugins.

T.006 The vendor must offer data export functionality that allows the county to retrieve all data in a non-proprietary format (e.g., CSV, JSON) without additional cost.

T.007 The vendor must implement automated scalability to handle peak loads without degradation of performance.

T.008 The vendor must maintain comprehensive logging and audit trails for all system activity, accessible by authorized agency personnel.

T.009 The solution must support backup and disaster recovery procedures with recovery point objectives (RPO) and recovery time objectives (RTO) not exceeding RPO of 15 minutes and RTO of 1 hour as defined by business.

T.010 The system must support secure, standards-based APIs for interoperability with other County systems, including the ability to specify available API types.

T.011 The hosting environment must have redundancy and have the ability to fail-over for database and application layers.

T.012 The system must support authentication using Microsoft Entra ID.

T.013 The system must enforce multi-factor authentication (MFA) for all users, especially for administrative or privileged accounts, to provide an additional layer of identity verification beyond passwords.

T.014 Solution must specify encryption algorithm and key management practices

T.015 Solution must ensure security of data within the application

T.016 Solution must define what happens to data upon contract termination or service discontinuation

T.017 Solution must have a breach notification policy and describe the process for customer notification

T.018 Solution must have a disaster recovery plan in place and must test disaster recovery plan regularly

T.019 Vendor must disclose locations of disaster recovery centers

T.020 Vendor must provide security training or awareness programs for staff

T.021 Vendor must implement measures to prevent insider threats

T.022 Solution must monitor and detect security threats or vulnerabilities

T.023 Solution must conduct regular security assessments such as penetration tests or vulnerability scans

T.024 Vendor must provide details on compliance with necessary standards for safeguarding sensitive data.

T.025 Vendor must provide documentation for - Security Policy, Data Security Policy, Privacy Policy, Terms of Service and necessary certifications.

T.026 Vendor must provide architecture diagrams (e.g., network) and data flow diagrams (including data transfer protocols)

4 Support and Maintenance Requirements

S.001 The vendor must provide SLAs with defined resolution times that meet County standards.

S.002 The vendor must provide advance notification of any planned changes, updates, or downtime that could impact service availability.

S.003 The solution must provide 99.99% or greater uptime SLA, excluding scheduled maintenance windows agreed upon in advance.

S.004 The vendor must provide Tier 1–3 technical support during defined business hours and after-hours emergency support.

S.005 The vendor must meet agreed-upon SLA response and resolution times for incidents based on severity level.

S.006 The vendor must provide regular system updates, patches, and security fixes at no additional cost during the maintenance term.

S.007 The vendor must provide an online knowledge base and updated system documentation.

S.008 The vendor must offer periodic system health checks and performance reviews.

5 Compliance and Legal Requirements

C.001 The system must comply with business-defined compliance requirements for Records Management System operations including Government Code 27201 and related codes, Assembly Bill 1466, and Assembly Bill 1785.

C.002 The solution must comply with applicable data residency requirements, ensuring that all County data is stored and processed within the United States (or other approved jurisdiction), unless otherwise approved in writing.

C.003 The vendor must guarantee that all data is owned by the county and cannot be used, accessed, or shared without written permission.

C.004 The vendor must comply with data retention and destruction policies as defined by the County.

C.005 The vendor must adhere to all applicable federal, state, and local laws.

C.006 Vendor must provide proof of fingerprint clearance and criminal record background checks for staff assigned to ERDS development, administration, and support.

C.007 System must support independent audits by DOJ-approved computer security auditors, including full access to system logs, records, and documentation necessary for review.

C.008 Vendor must provide evidence that the system is capable of suspension or shutdown in the event of suspected fraudulent transactions, as required under ERDS emergency procedures.

C.009 The system must comply with California Government Code § 12168.7 by operating as a Trusted System, ensuring stored and retrieved documents cannot differ from the originals and adhering to applicable ANSI/AIIM standards.

6 Implementation and Project Requirements

I.001 The vendor must provide a detailed project plan outlining major milestones, deliverables, and timelines.

I.002 The vendor must configure the solution to meet all documented functional and non-functional requirements.

I.003 The vendor must deliver role-based training for system administrators, end users, and other identified stakeholders.

I.004 The vendor must participate in all phases of testing, including unit testing, system testing, and user acceptance testing (UAT).

I.005 The vendor must provide weekly project status reports, including progress against milestones, risks, and issues.

I.006 The vendor must establish and configure development, testing, and production environments in accordance with County standards.

7 Vendor Qualification Requirements

V.001 The vendor must maintain all required security certifications for the hosting environment, including but not limited to SOC 2 Type II, ISO 27001, and FedRAMP (if applicable).

V.002 The vendor must maintain all required licenses, certifications, and registrations for the duration of the contract.

V.003 The vendor must maintain appropriate insurance coverage, including professional liability, cybersecurity, and general liability.

V.004 Vendor must ensure that all individuals in secure-access roles undergo fingerprinting and DOJ background checks, and only cleared personnel may access the system.

V.005 Vendor must be an Attorney General–certified ERDS software provider, and proof of certification must be supplied with the proposal.

V.006 The vendor must provide a company profile, including years in business, number of employees, and organizational structure.

V.007 The vendor must demonstrate successful completion of at least 2 projects of similar size, scope, and complexity.

V.008 The vendor must provide at least two (2) client references for comparable implementations within the last five years.

V.009 The vendor must identify all key personnel assigned to the project, along with their roles, qualifications, and certifications.

V.010 The vendor must provide evidence of financial stability, such as audited financial statements for the last three years.

V.011 Vendor must complete and submit SaaS Questionnaire.