Exhibit A - Scope of Work.docx

Agreement [number] Page 3 of 4 Covered California/[Contractor Name]

Exhibit A (Standard Agreement)

SCOPE OF WORK

A. Purpose

1. Covered California requires a qualified Contractor to provide Microsoft 365 Platform development, architectural, configuration, migration, integration, administration, security, and support services to support Covered California’s collaboration, productivity, identity, security, and business process needs across its Microsoft 365 tenant(s) and related Microsoft cloud services.

2. These services will include day-to-day support, configuration, enhancement, and ongoing optimization of Microsoft 365 Platform services and related Microsoft cloud platforms, including Azure and Entra ID, for Covered California’s internal and external users.

3. The Contractor will support existing and future Microsoft 365 Platform applications, services, and capabilities, including new or rebranded Microsoft cloud services made available during the term of the Agreement.

4. For purposes of this Agreement, the term “Microsoft 365 Platform” means Covered California’s Microsoft 365 tenant(s) and related Microsoft cloud services used to support collaboration, productivity, identity and access management, integration, automation, analytics, and security/compliance, including, but not limited to, services currently branded as Microsoft 365 (Office 365), Azure, Entra ID, Exchange Online, SharePoint Online, Microsoft Teams, OneDrive, Microsoft Copilot and related Copilot capabilities, Power Platform, and Microsoft security and compliance offerings such as Microsoft Defender and Microsoft Purview, together with any successor or rebranded services.

5. These services will enable Covered California to accomplish the following objectives:

a. Support and enhance Covered California’s Microsoft 365 Platform and related Microsoft cloud services in a stable, secure, and well-governed manner.

b. Provide development, administration, integration, and operational support for collaboration, productivity, workflow, identity, security, and business process solutions.

c. Build internal State capacity through documentation, training, and knowledge transfer.

d. Maintain flexibility to support future Microsoft cloud services, roadmap changes, and evolving business needs during the term of the Agreement.

B. Background Clearance

If the Contractor must access any confidential information, this provision must be completed prior to implementing any portion of this scope of work.

Prior to accessing any confidential information, personal identifying information, personal health information, federal tax information, or financial information contained in the information systems and devices of Covered California, or any other information as required by federal and State law or guidance, all staff, including employees, contract or subcontract personnel, vendors or volunteers who perform services under this Agreement must comply with the criminal background check requirements set forth in Government Code section 1043, and its implementing regulations set forth in California Code of Regulations, Title 10, section 6456. Contractor shall bear all costs associated with obtaining clearance for each said employee.

C. Amendment

Covered California may, at its sole discretion, extend the term of the Agreement for up to two (2) additional years beyond the initial term, in accordance with the solicitation. The total number of contract years shall not exceed five (5) years. Additional funding for any time extension will be at the same rates provided in Contractor’s proposal. All amendments for time or funds cannot exceed the limitations set forth in the solicitation that resulted in this Agreement. Amendments must also comply with Covered California’s rules and procedures governing contracts and procurements.

The parties may increase or decrease funding through an amendment, but cannot exceed the amount set by Contractor’s proposal. Funding for option years may not be used in advance and may not exceed the funding amount set in the base Agreement unless authorized by the solicitation.

This Agreement may be amended by mutual consent of the parties. No alteration or variation of the terms of this Agreement shall be valid unless made in writing and signed by the parties. No oral understanding or agreement not incorporated in the Agreement is binding on any of the parties.

D. General Scope or Tasks

Covered California uses the Microsoft 365 Platform and related technologies to support internal collaboration, content management, workflow automation, identity and access management, security and compliance, and other business processes.

Covered California requires an experienced Contractor to provide ongoing development, administration, architectural, governance, and support services across this environment.

The Contractor shall provide services in the following general categories and shall perform all tasks and work authorizations assigned by Covered California that are consistent with this scope.

1. Microsoft 365 Platform Development and Configuration

a. The Contractor shall:

i. Design, configure, and develop solutions leveraging Microsoft 365 Platform services, including but not limited to collaboration, content management, workflow, automation, analytics, and identity/security capabilities.

ii. This may include SharePoint Online and, if applicable, SharePoint Hybrid, OneDrive, Microsoft Teams, Planner, Exchange Online, and Microsoft Copilot capabilities.

iii. Design and implement solutions using Microsoft Power Platform, including model-driven applications, Power Apps, Power Automate, Power BI, Power Pages, and other Power Platform components as directed by Covered California.

iv. Design, configure, and support Azure services used in conjunction with the Microsoft 365 Platform, which may include Azure Functions, Azure Logic Apps, Azure SQL, Azure Storage, Azure API Management, and other Azure components that support integration, automation, reporting, or application hosting for Microsoft 365 solutions, within the Contractor’s capabilities and as directed by Covered California.

v. Configure and support identity and access management for the Microsoft 365 Platform, including Entra ID (Azure Active Directory), conditional access, role-based access control, application registrations, and related security configurations, in alignment with Covered California policies.

vi. Configure features, site structures, lists, libraries, content types, navigation, and related components to support Covered California’s business needs and user experience expectations.

vii. Implement configuration and solution changes in alignment with Covered California’s architecture, security, privacy, accessibility, and governance standards.

2. Application and Platform Support

a. The Contractor shall:

i. Provide ongoing application and platform maintenance and operational support for Microsoft 365 Platform-based solutions and related model-driven applications.

ii. Investigate, triage, and remediate incidents and defects related to supported applications, platform services, and configurations, including functional issues, access issues, workflow failures, configuration errors, and performance or reliability issues within the Contractor’s area of responsibility.

iii. Perform configuration changes, enhancements, and optimizations to existing solutions, as requested by Covered California, to address evolving business needs and user feedback.

iv. Support routine operational tasks such as configuration updates and tuning, content or structure adjustments, and coordination of changes and deployments.

v. Provide tenant-level administration and monitoring of the Microsoft 365 Platform within the Contractor’s area of responsibility, including configuration of admin centers, monitoring alerts, and proactive identification of issues and optimization opportunities.

vi. Support feature rollouts and deprecations within the Microsoft 365 Platform by assessing impacts, recommending mitigation steps, and implementing agreed changes.

vii. Support both project-based efforts, such as new solutions, major enhancements, and migrations, and ongoing operational support, such as incident resolution, minor enhancements, routine administration, monitoring, and optimization, for the Microsoft 365 Platform and related Azure services.

3. Integration and Data Support

a. The Contractor shall:

i. Support integrations between Microsoft 365 Platform and Azure-based solutions and other Covered California systems, as directed, including line-of-business applications, CRM or case management systems, and data repositories or related APIs and connectors.

ii. Assist with data-related activities, including data mapping and transformation design, data migration planning and support, and configuration of relevant connectors and integration components available within the Microsoft 365 Platform and Azure.

iii. Collaborate with other technical teams and vendors responsible for external systems to coordinate integration changes and resolve integration issues.

4. Advisory Services, Planning, and Best Practices

a. The Contractor shall:

i. Provide advisory services regarding Microsoft 365 Platform and Azure capabilities and roadmap, including Exchange Online, SharePoint Online, Microsoft Teams, OneDrive, Microsoft Copilot, Power Platform, Entra ID, and Microsoft security and compliance offerings.

ii. Provide advisory services regarding Power Platform and model-driven application capabilities and roadmap.

iii. Recommend solution and integration patterns and practices aligned with Covered California’s environment.

iv. Provide advisory input on tenant and subscription architecture, environment strategy, license optimization, and governance and administration frameworks for Microsoft 365, Azure, and Power Platform.

v. Assist Covered California with estimating level of effort for upcoming initiatives or enhancements, planning releases and solution changes, and evaluating the impacts of Microsoft 365 Platform and Azure roadmap changes, including new features, deprecations, and licensing changes.

5. Knowledge Transfer and Documentation

a. The Contractor shall:

i. Develop and maintain technical and administrative documentation for supported Microsoft 365 Platform solutions and related Azure components, including solution overviews, reference architectures, configuration details, operational procedures, runbooks, and known issues or workarounds.

ii. Provide knowledge transfer to Covered California staff through demonstrations, walkthroughs, training sessions, and written guidance and reference materials.

iii. Support Covered California in building internal capacity to administer, support, secure, and evolve the Microsoft 365 Platform and related Azure services over time.

6. Collaboration and Coordination

a. The Contractor shall:

i. Collaborate with Covered California staff, including business owners, technical staff, and project managers, to understand business needs and priorities, refine requirements and acceptance criteria, and coordinate testing, validation, and deployment activities.

ii. Coordinate, as requested, with other State vendors and partners whose work intersects with the Microsoft 365 Platform and Azure services.

iii. Participate in recurring status meetings, planning sessions, ad hoc working sessions, and governance forums, as requested by Covered California’s designated representative, to review proposed solutions, evaluate impacts of Microsoft roadmap changes, and recommend prioritized improvements.

7. Compliance and Policy Adherence

a. The Contractor shall:

i. Comply with all applicable State and Covered California policies and standards, including but not limited to information security and privacy, accessibility and usability, records management and retention, and acceptable use and conduct.

ii. Complete and comply with any required forms, certifications, and addenda, including Privacy Addendum requirements, the Generative Artificial Intelligence Risk Assessment (HBEX 707), if applicable, and any additional security or compliance documentation required by Covered California.

8. Support for Additional Microsoft Cloud Services and Product Changes

a. The Contractor shall:

i. Provide development, configuration, and support services for additional Microsoft 365 and related Microsoft cloud services that Covered California procures during the contract term and uses in connection with its Microsoft 365 tenant(s), where such services are reasonably related to collaboration, content management, workflow, automation, identity, security/compliance, analytics, or application development and are within the Contractor’s stated capabilities.

ii. Collaborate with Covered California to assess how newly procured or rebranded Microsoft cloud services can be integrated with existing Microsoft 365 Platform and Azure solutions and recommend implementation approaches consistent with Covered California’s standards and priorities.

iii. Recognize that Microsoft may introduce new cloud services, retire services, or change product names, licensing models, and packaging during the term of this Agreement.

b. Such changes shall not, by themselves, be deemed a change in scope.

c. Any new or rebranded cloud services that are logically part of the Microsoft 365 Platform or Microsoft Azure ecosystem, are procured and used by Covered California in connection with its Microsoft 365 tenant(s), and fall within the Contractor’s stated capabilities, are considered within scope of this Agreement, subject to available funding and prioritization by Covered California.

9. Architecture, Security, and Governance Support

a. The Contractor shall:

i. Provide ongoing architectural, security, and governance support for the Microsoft 365 Platform and related Azure services.

ii. Evaluate and recommend tenant-level configurations and patterns for collaboration, content management, integration, automation, analytics, and identity and access management.

iii. Assess and recommend configurations for Microsoft security and compliance capabilities, including Microsoft Defender, Microsoft Purview, APIs and connectors, sensitivity labeling, audit and logging, and conditional access, in alignment with Covered California’s policies.

iv. Support Covered California governance processes for Microsoft 365 and Power Platform, including 365 environment strategy, connector policies, application lifecycle management.

v. Review and advise on impacts of Microsoft roadmap changes, including new features, deprecations, and licensing changes, and recommend appropriate actions.

E. Unanticipated Tasks

1. In the event that additional work must be performed which was unforeseen and wholly unanticipated and is not specified in this Exhibit A – Scope of Work, but which in the opinion of both parties to this Agreement is necessary to the successful accomplishment of the general scope of work outlined, the procedures outlined in this Section will be employed. Any additional tasks, services, or deliverables must be within the original Scope of Work as outlined in Exhibit A. Contractor may not perform unrelated services that do not fulfill the Scope of Work. The amount of funding for any additional tasks, services, or deliverables is subject to Covered California’s approval in accordance with its policies and procedures.

2. For each instance of necessary, unanticipated work not specified in this Exhibit A – Scope of Work, a Work Authorization shall be prepared in accordance with Covered California’s Exhibit A, Attachment 1 – Work Authorization template.

3. It is understood and agreed by both parties to this Agreement that all of the terms and conditions of this Agreement shall remain in force with the inclusion of any such Work Authorization. Such Work Authorization shall in no way constitute an agreement other than as provided pursuant to this Agreement nor in any way amend or supersede any of the other provisions of this Agreement.

4. Each Work Authorization shall consist of a detailed statement of the purpose, objective, or goals to be undertaken by Contractor, the job classification(s) or approximate skill level(s) of the personnel to be made available by Contractor, an identification of all significant materials to be developed by Contractor and delivered to Covered California, an identification of all significant materials to be delivered by Covered California to Contractor, an estimated time schedule for the provisions of these services by Contractor, completion criteria for the work to be performed, the name or identification of the Contractor personnel to be assigned, Contractor’s billing rates as identified in Exhibit B – Budget Detail and Payment Provisions per work hour, and Contractor’s estimated total cost of the Work Authorization.

5. All Work Authorizations must be signed by Contractor and Covered California. Covered California will amend the Agreement to include any tasks, resources, hours, and funding that it approves on the Work Authorization. The parties must execute the amendment before Contractor can perform the additional services and receive funding for said services.

6. Covered California may require Contractor to stop or suspend work on any Work Authorization approved by a contract amendment pursuant to Section YY of Exhibit C – Information Technology General Terms and Conditions.

7. In performing any additional tasks or services, Contractor shall not exceed the estimated number of work hours as outlined in the Agreement unless the following procedures are followed:

a. If Contractor determines that the tasks and services as outlined in a Work Authorization cannot be accomplished within the estimated work hours, Contractor shall immediately notify Covered California in writing of Contractor’s estimate of the work hours which will be required to complete the Work Authorization in full. Upon receipt of such notification, Covered California may:

i. Authorize Contractor to expend the estimated additional work hours in excess of the original estimate necessary to accomplish the services, tasks, and deliverables as outlined in the approved Work Authorization;

ii. Require the Contractor to complete the work and provide the affected deliverables at the cost originally bid and contracted for, regardless of any additional work hours required;

iii. Terminate the Work Authorization; or

iv. Alter the scope of the Work Authorization in order to define tasks that can be accomplished within the remaining estimated work hours.

8. Covered California shall notify Contractor in writing of its election within seven (7) calendar days after receipt of Contractor’s notification. If notice of the election is given to proceed, Contractor may expend the estimated additional work hours or services. Covered California agrees to reimburse Contractor for such additional work hours pursuant to Exhibit B, but may require an amendment to the Agreement before paying for such additional hours.

F. Reporting Headquarters Location

The Contractor is required to perform services under this Agreement at Covered California’s direction, either on site at Covered California facilities, remotely, or in a hybrid arrangement, depending on the nature of the task and Covered California’s operational needs.

Unless otherwise directed by the Covered California Representative, the primary Covered California office location is 1601 Exposition Boulevard, Sacramento, California 95815.

Travel and expenses for reporting to this headquarters location shall not be reimbursed.

G. Reassignment of Personnel

1. The Contractor shall not reassign nor substitute personnel assigned to the contract during the contract term without prior written approval of Covered California. If a Contractor employee is unable to perform duties due to illness, resignation, or other factors beyond the Contractor’s control, the Contractor shall make every reasonable effort to provide suitable substitute personnel.

2. Substitute personnel shall not automatically receive the hourly rate of the individual or position being replaced. Covered California and the Contractor shall negotiate the hourly rate of any substitute personnel to the contract. The hourly rate negotiated shall be dependent, in part, on the experience and individual skills of the proposed substitute personnel. The negotiated rate cannot exceed the hourly rate stated in the contract.

3. Covered California reserves the right to request a Contractor employee be removed from performing any work on the contract and, on written notice to the Contactor, the Contractor shall assign a substitute employee.

H. Contractor’s Roles and Responsibilities

The Contractor shall:

1. Designate a person to whom all project communications may be addressed and who has the authority to act on all aspects of the contract. This person will be responsible for the overall project and will be the contact for all invoicing and Contractor staffing issues.

2. Provide written reports for review and approval by Covered California and formally respond to Covered California review findings as necessary.

3. Meet as required with Covered California staff to discuss progress.

4. Make its best efforts to maintain staff continuity throughout the life of the project. If, however, a substitution becomes necessary, the Contractor must submit resumes for review, in advance, for all proposed personnel substitutions. All Contractor personnel substitutions must be approved in writing by Covered California Representative. Failure to receive the required approvals may result in termination of the contract.

5. The Contractor shall make available qualified senior personnel to provide advisory architecture services for the Microsoft 365 Platform and related Azure services. Such personnel shall advise Covered California on platform architecture, governance, security/compliance, integration patterns, roadmap impacts, and implementation options. The advisory role is consultative in nature and shall support, but not replace, Covered California’s internal decision-making authority, architectural governance, or platform ownership.

I. Covered California’s Roles and Responsibilities

Covered California shall:

1. Designate the Covered California Representative to whom all Contractor communications may be addressed and who has the authority to act on all aspects of the contract.

2. Provide access to business and technical documents, systems, and environments as necessary for the Contractor to complete the tasks identified in this Agreement.

3. Ensure appropriate resources are available to perform assigned tasks, attend meetings, and answer questions.

4. Ensure that decisions are made in a timely manner.

5. Provide work areas and meeting rooms as needed.

6. Identify and provide access to Subject Matter Experts to assist in the development of technical requirements.

J. Contract Deliverables

1. The Contractor understands that all recommendations and contract deliverables must comply with the Patient Protection and Affordable Care Act of 2010, as well as sections 15438, 15439, and 100501 through 100521 of the Government Code; 1346.2 and 1366.6 of the Health and Safety Code; 10112.3 and 10112.4 of the Insurance Code.

2. The Contractor shall provide all deliverables within the timeframe specified and required by Covered California.

3. The Contractor understands and acknowledges that all deliverables must be reviewed, approved and accepted by Covered California.

4. The Contractor understands that any Covered California requested revisions to any deliverable shall be incorporated by the Contractor within seven (7) calendar days from the date in which Covered California provided its feedback, unless a different timeframe is required and specified by Covered California.

5. In the event Covered California requires additional refinements and modifications for any deliverable which occurs after that deliverable has been previously accepted by Covered California, the Contractor shall be required to make the additional revisions until the revised deliverable is accepted and approved by Covered California.

6. The Contractor shall be paid for services rendered under this Agreement in accordance with Exhibit B – Budget Detail and Payment Provisions.

K. Deliverable Acceptance Criteria

1. All concluded work must be submitted to Covered California for review and approval or rejection. It will be Covered California’s sole determination as to whether any tasks have been successfully completed and are acceptable.

2. Throughout the term of the contract, Covered California will review and validate services performed. In addition, the Covered California Representative will verify and approve the Contractor’s invoices. Signed acceptance is required from the Covered California Representative to approve each invoice for payment.

3. Contractor’s recommendations and contract deliverables must comply with the Patient Protection and Affordable Care Act of 2010, as well as sections 15438, 15439, and 100501 through 100521 of the Government Code; 1346.2 and 1366.6 of the Health and Safety Code; 10112.3 and 10112.4 of the Insurance Code.

4. Deliverable acceptance criteria shall include, but not be limited to, the following:

a. Deliverable-specific work was completed as specified and the final deliverable product or service was rendered to the satisfaction of Covered California;

b. Plans, schedules, designs, documentation, digital files, photographs and reports (deliverables) were completed as specified and approved;

c. All goods/equipment delivered conform to specifications and quantities, including requirements for special handling and packaging; and operability and functionality;

d. All deliverable documentation and artifact gathering have been completed and delivered; and

e. All deliverables are in a format useful to Covered California.

5. Covered California reserves the right to review and inspect all deliverables following Contractor’s delivery of each deliverable to Covered California, and to determine whether the deliverables are satisfactory and conform to Covered California’s specifications. Covered California may, in its sole discretion, either: a) reject a deliverable if it fails to conform to the specifications and meet Covered California’s satisfaction or has defects (collectively, “errors”); or b) may accept each deliverable if it has no such errors (“acceptance”). Covered California shall have not less than ten (10) business days from the receipt of the deliverable to either accept or reject the deliverable, unless the parties mutually agree to an alternative deadline.

6. If Covered California rejects a deliverable, Covered California will notify the Contractor in writing via email or otherwise to Contractor’s representative with the reason for the rejection and a list of deficiencies. The Contractor shall promptly correct the stated deficiencies and resubmit the corrected deliverable within five (5) business days of receipt of the written notice and list of deficiencies, unless an extension is requested in writing by the Contractor and approved by Covered California. Contractor shall respond to all of Covered California’s comments, and as appropriate and necessary, incorporate such responses into its resubmission of the deliverable.

7. After receipt of a corrected deliverable, Covered California shall again have the opportunity to review the resubmitted deliverable and will provide Contractor with an acceptance of that deliverable or give a notice of continuing deficiency within ten (10) business days. If notice of a continuing deficiency is given, Covered California will provide the Contractor a description of the deficiencies that continue. If Contractor fails to meet all criteria within the specified timeframes, Covered California reserves the right to; a) modify timeframes as necessary (in Covered California’s sole discretion) until Covered California is satisfied that all deliverables comply with Covered California’s specifications as required by the Agreement; or b) terminate this Agreement for cause.

8. In the event Covered California fails to review and accept or reject a deliverable within ten (10) business days of receipt or such additional time as the parties may agree, the Contractor shall notify Covered California of the late response and proceed with performance as if acceptance had been received from Covered California. However, such failure by Covered California to respond shall not constitute a formal acceptance of the deliverable by Covered California. If, in such circumstances, Covered California subsequently requires material changes to the deliverable, the parties shall fairly consider and mutually agree as to the effect of the untimely rejection or acceptance on the delivery or implementation schedules. In no event shall the Contractor be entitled to any price increase due to the need to correct deficient deliverables as identified by Covered California.

Such reviews and resubmissions shall not be construed as a waiver of any deliverable or obligation to be performed under this Agreement, nor of any scheduled deliverable due date, nor any rights or remedies provided by law or through this Agreement. Additionally, Covered California’s waiver of, or lack of objection to, a deficiency with respect to a particular deliverable or obligation shall not be construed to be a waiver of the same or a similar deficiency or obligation with respect to any other deliverable.

9. As used in this section, the term “continuing deficiency” shall be limited to:

a. Inadequate resolution, in the reasonable judgment of Covered California, of the items raised during the previous Covered California review;

b. Related issues which were tied to or created by the method of resolving the previous Covered California comments;

c. Items which could not be thoroughly tested or reviewed by Covered California because of an inadequate, incorrect or incomplete deliverable, previously submitted, which was identified as inadequate, incorrect or incomplete by Covered California’s previous written comments; and

d. Omissions of parts of a deliverable.

10. Unless otherwise agreed upon by Covered California, Contractor shall not delay the resubmission of a previously rejected deliverable to include the introduction of new items identified by the Contractor during subsequent reviews. Any such new items, including those items which could have been identified by a thorough review of a previously submitted deliverable, shall be considered separately under the following review process. In such circumstances, Contractor shall introduce new items to Covered California for review, and if the parties mutually agree upon the material revision of a deliverable, the parties shall fairly consider and mutually agree as to the effect of the new items on the deliverable(s) or implementation schedules.

11. If deliverables are not submitted to the satisfaction of Covered California and Covered California terminates the contract, the Contractor may be held liable for any additional costs, including, but not limited to, the costs of administration and rebidding of the work to be completed. Unless otherwise agreed upon by Covered California, in no event shall the Contractor be entitled to any price increase due to any rejections, delays, resubmissions, or agreed-upon modifications of deliverables pursuant to this Section.

L. Project Representatives

The representatives for this project, during the term of this Agreement, shall be:

Covered California Representative Covered California 1601 Exposition Blvd.

Sacramento, CA 95815

(XXX) XXX-XXXX

(Email Address) (Representative’s Name) (Contractor’s Name) (Address) (City, State and Zip)

(916) XXX-XXXX T

(Email Address)

(V.0622)