Exhibit A - SSE Scope of Work (SSE) Solution Scope of Work_S-10700-00017534.docx

S-10700-00017534 Secure Service Edge (SSE) Solution and Services

EXHIBIT A

SECURE SERVICE EDGE (SSE)

SCOPE OF WORK

State of Oregon

1. Purpose and Scope The purpose of this solicitation is to establish a statewide Price Agreement for a comprehensive, cloud-delivered Secure Service Edge (SSE) solution and related professional services. The Price Agreement shall provide Authorized Purchasers with the ability to acquire SSE subscriptions, licensing, support, implementation, integration, migration, testing, training, and other related services on an as-needed basis throughout the term of the Agreement.

Award of the Price Agreement does not constitute an order for implementation services, does not require the State or any Authorized Purchaser to purchase any minimum quantity of products or services, and does not obligate the State to deploy any particular SSE capability. Products and services will be acquired through subsequent ordering documents or Work Orders, as applicable.

When implementation or professional services are ordered, the Contractor shall perform those services in accordance with the applicable requirements of this Scope of Work and the requirements established in the applicable ordering document or Work Order.

The Price Agreement is intended to support a modular adoption model for Secure Service Edge (SSE) capabilities, including Zero Trust Network Access (ZTNA), Secure Web Gateway (SWG), Cloud Access Security Broker (CASB), and Data Loss Prevention (DLP). Capabilities may be acquired individually or in combination based on agency need, readiness, risk, and available funding. Contract award does not obligate the State or any Authorized Purchaser to acquire every SSE component.

Detailed security, privacy, compliance, and technical security requirements are contained in Exhibit B – Security Requirements and the applicable Requirements Matrix. The Contractor shall comply with all requirements applicable to the services ordered under the Contract.

2. Enterprise Scope and Adoption Model The resulting Price Agreement is intended to support agencies governed under Enterprise Information Services (EIS), representing approximately 80 executive branch agencies, boards, and commissions and a statewide workforce of more than 40,000 employees, in addition to contractors and other authorized users. EIS-governed agencies will coordinate with EIS regarding enterprise baseline configurations, shared or centrally administered tenant architecture, integrations, policies, and operational standards.

Authorized cooperative procurement participants (e.g., cities, counties, ports, and other non-EIS entities), may procure and deploy services independently and may require separate tenants, connectors, infrastructure, policies, or management arrangements. The Contractor shall support both centrally governed enterprise deployments and independently managed deployments where authorized.

Support staggered agency onboarding based on readiness and funding;

Support heterogeneous agency environments, including cloud, on-premises, hybrid, legacy, managed, and unmanaged access scenarios;

Permit modular, menu-based adoption without requiring purchase of unrelated SSE components;

Support expansion to additional users, agencies, applications, locations, traffic, features, modules, and services without wholesale replacement of the solution;

Avoid unnecessary technical, contractual, or financial lock-in and provide documented migration/export capabilities.

The following services shall be available for purchase under the Price Agreement. Requirements within this section apply only to the extent the applicable products or services are ordered by an Authorized Purchaser.

3. Services Available Under the Price Agreement The following represents the minimum deliverables that may be required when implementation or other professional services are ordered under the Price Agreement. The specific deliverables, applicability, schedule, quantities, acceptance criteria, and responsibilities for each engagement will be established in the applicable Work Order or ordering document. Award of the Price Agreement alone does not initiate these deliverables.

3.1 Discovery, Architecture, and Detailed Design

When discovery services are ordered, conduct discovery and validate business, technical, operational, integration, security, compliance, user, and agency onboarding requirements.

Provide current-state findings and a detailed target-state architecture showing components, data flows, trust boundaries, connectors, service dependencies, integrations, management planes, tenant design, and deployment patterns.

Identify all software, subscriptions, licenses, agents, connectors, gateways, APIs, certificates, third-party components, and State dependencies.

Document capacity, scalability, availability, redundancy, failover, disaster recovery, business continuity, and resilience design.

Identify whether capabilities are native, separately licensed, dependent on third parties, or roadmap-based. Roadmap functionality shall not be represented as currently available.

3.2 Implementation and Project Management

When implementation services are ordered, develop and maintain an integrated implementation plan covering initiation, discovery, design, configuration, integration, migration, testing, pilot/PoC, deployment, validation, stabilization, transition to operations, and final acceptance.

Provide a detailed schedule with tasks, dependencies, milestones, measurable success criteria, State review periods, decision points, and acceptance activities.

Provide a resource plan identifying role classifications, estimated effort by role and phase, duration of engagement, and State versus Contractor resource commitments.

Maintain risk, issue, action, decision, dependency, and change logs and provide regular status reporting.

Provide phased onboarding, coexistence, cutover, contingency, rollback, and downtime-minimization procedures.

3.3 Configuration, Integration, Migration, and Onboarding

When configuration services are ordered, configure the solution in accordance with the State-approved design and enterprise baseline standards.

Integrate with State-approved identity providers, IAM, networking, cloud, endpoint, SIEM/logging, monitoring, incident-response, and other required services.

Support repeatable onboarding patterns for agencies of varying size and technical maturity.

Provide agency onboarding checklists, prerequisites, configuration templates, validation procedures, and rollback procedures.

Validate representative applications, legacy systems, web-based access, client-based access, and non-standard protocols, as applicable.

3.4 Government and Commercial Cloud Support

The Contractor shall support, where proposed and required, both Government (Gov) and Commercial (Com) cloud deployment or service-delivery models. The Contractor shall clearly document differences in service instances, logical or physical isolation, management planes, compliance posture, operational model, functionality, licensing, and dependencies. The solution shall support agencies with regulated workloads, including environments subject to CJIS, CMS, HIPAA, IRS Publication 1075, or similar requirements, as applicable to the ordered services and Exhibit B.

3.5 Proof of Concept / Pilot

When a PoC or pilot is included in an order, provide a structured, time-bound PoC or pilot when required by the State.

Before testing, document agreed use cases, success criteria, performance benchmarks, test procedures, responsibilities, and evaluation metrics.

Demonstrate applicable SSE capabilities under representative State scenarios.

Provide a findings report identifying results, gaps, risks, configuration considerations, remediation recommendations, and production-readiness conclusions.

3.6 Testing and Acceptance

Provide test plans and scripts for functional, integration, interoperability, performance, security, failover/recovery, usability, and user acceptance testing, as applicable.

Maintain requirements traceability and defect tracking through resolution and retesting.

Define measurable performance and success metrics, including applicable performance benchmarks, scalability thresholds, availability targets, and compliance-support outcomes.

Resolve critical and high-severity implementation defects before production acceptance unless expressly accepted by the State in writing.

3.7 Monitoring, Logging, and Reporting

Provide real-time or near-real-time dashboards for service health, security events, policy activity, user activity, threats, performance, and utilization.

Provide configurable and automated reports for availability, incidents, alerts, policy enforcement, performance, compliance, adoption, and agreed KPIs.

Integrate with State-approved SIEM and monitoring platforms for centralized logging, correlation, alerting, and investigation.

Document log generation, retention, integrity, search, access, export, and time synchronization capabilities.

3.8 Documentation

Provide State-specific administrative and user guides, configuration guides, integration/API documentation, troubleshooting guides, escalation procedures, operational runbooks, and knowledge-base content.

Provide API documentation with supported authentication methods and sufficient technical detail to support automation and interoperability.

Provide a documentation validation plan with task-based validation, State-relevant use cases, reviewer roles, acceptance criteria, version control, and update procedures.

Maintain documentation throughout the Contract term to reflect material platform, configuration, integration, or release changes.

3.9 Training and Knowledge Transfer

Provide role-based instructor-led training for administrators, security operations personnel, help desk/support personnel, and other designated State staff.

Provide documented training materials, configuration guides, operational runbooks, and recorded sessions where required.

Provide at least one hands-on administrative session covering policy configuration, troubleshooting, reporting, and system management.

Provide post-training knowledge validation through an assessment, practical lab, structured Q&A, or other State-approved method.

Identify available product or industry certification programs and recommended learning paths.

Measure training effectiveness and obtain State acceptance that agreed training objectives have been met.

3.10 Support, Maintenance, and Stabilization

Provide 24x7 technical support for critical production-impacting issues through documented support channels and escalation paths.

During implementation and stabilization, provide an initial response within one (1) hour for critical production-impacting issues and within one (1) business day for high and moderate issues, unless more stringent service levels are established in the Contract.

Provide preventive, corrective, adaptive, and routine maintenance, including security patches, bug fixes, updates, and supported upgrades.

Provide advance notice of scheduled maintenance and coordinate changes to minimize disruption.

Support stabilization until no open critical or high-severity implementation defects remain, agreed performance and availability benchmarks are met, and logging, monitoring, and administrative functions are validated.

Support transition to steady-state operations, including completed knowledge transfer, delivered support documentation and escalation procedures, and a State-approved stabilization period.

3.11 Lifecycle Management and Future Evolution

Continuously incorporate supported advancements in SSE and Zero Trust technologies without requiring wholesale replacement of the solution.

Support future SSE phases through modular feature expansion, additional services, or architectural enhancements.

Maintain alignment with evolving industry standards, threat conditions, and architectural practices through platform updates, lifecycle management, and roadmap transparency.

Enable the State to adopt newer or improved capabilities as available without unnecessary technical or commercial dependencies.

3.12 Transition and End-of-Contract Services

Maintain a transition/exit plan addressing continuity, knowledge transfer, data/configuration export, documentation handoff, access removal, and successor coordination.

Provide State data, logs, configurations, policies, and documentation in mutually agreed usable formats as required by the Contract.

Support an orderly transition and return or securely destroy State data in accordance with Contract and security requirements.

4. Contractor Resource Requirements Vendor Project Manager When included in an Order, serves as the primary coordination point; manages schedule, milestones, resources, risks, dependencies, reporting, and transition to steady-state operations. Must have demonstrated experience with comparable enterprise security/network implementations; multi-agency or multi-tenant and government/regulated experience is preferred.

Vendor Technical Team When included in an Order, responsible for detailed design, configuration, integration, connectivity validation, migration, testing, and readiness for agency onboarding. Technical staff must have hands-on experience implementing the proposed SSE platform and relevant cloud, identity, and secure network integrations.

Vendor Security Specialist When included in an Order, validates security configuration and supports compliance assessments and documentation for regulated environments, as applicable. Must have experience with compliance-driven security implementations and regulated data environments.

Vendor Training Team When included in an Order, develops and delivers role-based training, hands-on administration instruction, learning materials, and knowledge validation. Trainers must have direct experience with the proposed platform.

Vendor Support Team When included in an Order, provides implementation, onboarding, stabilization, troubleshooting, incident tracking, and escalation support, with increased availability during critical milestones and onboarding events.

5. State Responsibilities State and Authorized Purchaser responsibilities apply only to the extent necessary for the products or services included in an applicable Order. Responsibilities for each engagement may be further defined or allocated in the Order.

For each applicable Order, identify project leadership, technical contacts, security contacts, business stakeholders, and decision-makers as needed.

Identify State project leadership, technical contacts, security contacts, business stakeholders, and decision-makers.

Provide reasonable access to designated State personnel, information, systems, facilities, environments, and State-controlled configuration information necessary for authorized work.

Coordinate EIS-governed agencies and participating stakeholders as reasonably necessary.

Participate in discovery, design reviews, testing, training, onboarding, implementation, and acceptance activities.

Review deliverables and provide approvals, decisions, or consolidated feedback within agreed review periods.

Initiate agency purchasing and onboarding activities under the Price Agreement as applicable.

6. Deliverables and Milestones The following are minimum deliverable categories that may be required when implementation or other professional services are ordered under the Price Agreement. The applicable Order will identify which deliverables are required and will establish final scope, quantities, due dates, milestones, acceptance criteria, and review periods. Award of the Price Agreement alone does not trigger these deliverables or establish an implementation schedule. All deliverables required by an Order are subject to Authorized Purchaser review and written acceptance based on completeness, accuracy, usability, consistency with approved requirements, and satisfaction of the applicable acceptance criteria.

7. Completion and Acceptance Criteria Acceptance is evaluated at the Order or deliverable level, as applicable. Award of the Price Agreement is not implementation acceptance and does not indicate that any deployment has occurred. The following criteria apply only to the products, services, and deliverables included in the applicable Order.

All applicable mandatory requirements applicable to the Order have been demonstrated and satisfied.

Required solution components, configurations, integrations, and agency onboarding capabilities specified in the Order have been implemented and validated.

Required testing specified in the Order has been completed and material defects resolved or formally accepted by the State.

Required security, privacy, accessibility, performance, and compliance validation applicable to the Order has been completed.

Documentation, training, and knowledge transfer required by the Order have been completed and accepted.

Monitoring, logging, reporting, support, escalation, maintenance, and operational processes included in the Order are functioning as required.

Open risks, issues, exceptions, and corrective actions associated with the Order have been resolved or formally accepted.

The State has provided written acceptance of the applicable deliverables and implementation.

Acceptance of an individual deliverable or Order does not waive the Contractor's obligation to correct latent defects, comply with warranties, meet service levels, or satisfy other Contract requirements.

8. Pricing and Licensing Requirements Pricing shall be provided in accordance with the RFP pricing instructions and shall support a transparent, menu-based model for the SSE suite. The Proposer shall separately identify pricing for ZTNA, SWG, CASB, DLP, or other SSE module implementation, professional services, training, support, maintenance, optional services, and other applicable charges. Professional services shall be itemized by role classification, estimated hours, rates, and phase where requested.

The Proposer shall separately identify pricing and licensing implications for Government and Commercial cloud service models, including differences associated with isolation, management planes, compliance posture, operational overhead, or licensing. The Proposer shall identify per-component and bundled pricing, volume- or term-based discounts, licensing metrics, minimum commitments, thresholds, overage charges, renewal assumptions, price escalators, and cost implications for future users, agencies, capacity, modules, features, integrations, and upgrades.

9. Period and Place of Performance The Price Agreement is anticipated to have an initial five-year term with extension options for up to fifteen years total as stated in the RFP and Contract. Agency onboarding and acquisition schedules will vary over the Contract term. Award of the Price Agreement does not establish an implementation commencement date. Each Order will establish its own period of performance, schedule, and applicable place of performance. Services may be performed remotely, onsite at State or Authorized Purchaser facilities, at Contractor facilities, or through a hybrid delivery model as approved in the applicable Order.

10. Future Capabilities The State may, at its sole discretion and only through a mutually executed amendment to the Price Agreement, evaluate additional modules, features, integrations, or services offered by the Contractor that directly relate to and remain within the scope of the proposed Secure Service Edge solution. Consideration of such additions will be limited to capabilities that:

· enhance or extend existing functionality without materially altering the core architecture or purpose of the solution; and

· address documented changes in the State’s security requirements arising from advances in technology, emerging threats, or updates to relevant security standards.

Any potential additions must be explicitly scoped, priced, and approved in writing by the State prior to implementation.

11. Key Terms and Acronyms

Exhibit A – Scope of Work | Version 2