Exhibit_A_-_Technical_Requirements.pdf

Exhibit A — Technical Requirements Page 1 of 50

MIAMI-DADE AVIATION DEPARTMENT

Miami International Airport (MIA)

PARKING ACCESS AND REVENUE CONTROL SYSTEM

(PARCS)

Exhibit A

Technical Requirements

Exhibit A — Technical Requirements Page 2 of 50

Table of Contents Acronyms and Abbreviations 1 Project Requirements

1.1 Introduction

1.2 General Scope

1.3 Lifecycle Management Plan

1.4 Contractor Qualifications and Requirements

1.5 Project Management

1.5.1 Project Management Requirements

1.5.2 Project Coordination

1.5.3 Schedule

1.5.4 Reporting

1.5.5 Meetings

1.5.6 Use of Premises

1.5.7 Safety and Security

1.5.8 Cleaning

1.6 Submittal Process

1.7 Quality Control

1.7.1 General

1.7.2 Description of Program

1.7.3 Personnel

1.7.4 Inspections

1.7.5 Quality Control Plan

1.7.6 Procedures

1.7.7 Quality Assurance (MDAD Surveillance)

1.7.8 Noncompliance

1.8 Project Closeout

1.8.1 Closeout Procedures

1.8.2 Final Cleaning and Adjusting

1.8.3 Project Record Documents

2 Technical Requirements

2.1 Technical Overview

2.1.1 PARCS System Description

2.1.2 Statement of Work

2.1.3 Design Approach

2.1.4 Integration Requirements

2.2 General Requirements

2.2.1 References and Standards

2.2.2 Contractor Submittals

2.2.3 System Documentation

2.2.4 Warranty and Licenses

2.2.5 Additional Warranty Services

2.2.6 Maintenance and Support

2.2.7 Delivery and Storage

2.3 Core PARCS Platform and Central Data Management

2.3.1 General

2.3.2 Functional Requirements

2.3.3 Database Requirements

2.3.4 System Performance

2.3.5 Data Redundancy, Backup, and Disaster Recovery

2.4 Entry Lane Equipment and Processing

2.4.1 General

2.4.2 Performance Requirements

2.4.3 Entry Methods and Fallbacks

2.5 Exit Lane Equipment and Processing

2.5.1 General

2.5.2 Performance Requirements

2.5.3 Unmatched Credential / Temporary Session Exit Handling

2.6 Rate Engine and Dynamic Pricing

Exhibit A — Technical Requirements Page 3 of 50

2.6.1 General

2.6.2 Rate Structure Requirements

2.6.3 Dynamic Pricing Requirements

2.6.4 Rate Testing

2.6.5 Validation Program Management

2.7 License Plate Recognition (LPR)

2.8 Payment Processing

2.8.1 General

2.8.2 Payment Methods

2.8.3 Reversals and Refunds

2.8.4 Funds Settlement and Reconciliation

2.8.5 Communications

2.8.6 Chargeback and Dispute Workflow

2.9 SunPass Integration

2.10 Reservation Integration (Propel and successor)

2.11 Park Assist (or Successor) Integration

2.12 Ground Transportation and Employee Parking Integration (GateKeeper and successor)

2.13 Customer Channels — App, Web, Kiosk, and Lane

2.13.1 Mobile App and Web (Optional Ticketless Channel)

2.13.2 Pay-on-Foot Kiosks

2.13.3 Intercoms and Customer Assistance

2.13.4 Accessibility

2.14 Cybersecurity, Privacy, and Network Requirements

2.15 Hardware Requirements

2.15.1 General

2.15.2 Equipment Categories

2.15.3 Spares and Inventory

2.15.4 Asset Inventory

2.15.5 Service Levels

2.15.6 Service Credit Procedure — General

2.15.7 Measurement

2.15.8 Service Credit Schedule

2.15.9 Monthly Credit Cap

2.15.10 Credit Claim Procedure

2.15.11 Repeated Failures

2.15.12 Exclusions

2.16 System and Software Requirements

2.16.1 General Requirements

2.16.2 User Interface

2.16.3 Architecture Requirements

2.16.4 Security, Performance, and Management

2.17 Reporting and Analytics

2.17.1 General

2.17.2 Standard Reports

2.17.3 Ad-Hoc and BI

3 Implementation

3.1 Phases of Implementation

3.2 Installation Requirements

3.2.1 General

3.2.2 Software Installation

3.2.3 Hardware Installation

3.2.4 System Startup

3.2.5 Commissioning Plan

3.3 Testing Requirements

3.3.1 General

3.3.2 Factory Acceptance Testing (FAT)

3.3.3 Site Acceptance Testing (SAT)

3.3.4 Performance Verification Testing

3.3.5 Endurance Testing

3.3.6 Cutover Rehearsal

3.3.7 Migration and Reconciliation

3.3.8 Final System Acceptance

3.4 Training

3.4.1 General

3.4.2 Types of Training

3.5 Project Closeout Requirements

Exhibit A — Technical Requirements Page 4 of 50

3.5.1 Final System Acceptance

3.5.2 Transition to Steady-State Operations

3.5.3 Airport Data Ownership and Portability

Exhibit A — Technical Requirements Page 5 of 50

Acronyms and Abbreviations

Acronym / Abbreviation Definition / Meaning Use in Exhibit A

5G Fifth-Generation Mobile Network Referenced as a possible fallback communications medium for remote parking locations.

802.1X IEEE 802.1X Port-Based Network Access Control Used for managed switch port authentication and network device access control.

ACL Access Control List Used in the network security requirements for MAC address-based access controls and related network restrictions.

ADA Americans with Disabilities Act The document requires compliance with the 2010 ADA Standards for

Accessible Design for physical and digital customer interfaces.

ADLS Azure Data Lake Storage Microsoft Azure Data Lake Storage; identified as MDAD's data lake platform for publishing PARCS events and entity changes.

AES / AES-256 Advanced Encryption Standard / 256-bit AES Required for encrypting sensitive data at rest, including databases, backups, and log archives.

AOA Airport Operations Area Airport-controlled operational area requiring additional security/access requirements for personnel.

API Application Programming Interface Used for documented, versioned system integrations and data exchanges between PARCS and external/MDAD systems.

AR Airport Representative

The MDAD-designated representative responsible for reviewing and approving contractor submittals and coordinating installation activities. The

AR helps ensure that project work complies with MDAD requirements and is properly coordinated with existing airport operations.

AVI Automatic Vehicle Identification Technology/readers used to identify vehicles or transponders, including

SunPass and employee/VIP parking use cases.

BI Business Intelligence Used in the context of MDAD's analytics/reporting environment, including

Microsoft Power BI and ad-hoc reporting.

CBP U.S. Customs and Border Protection Referenced in connection with additional security training that may be required for certain airport access.

CCI Credit Card In Ticketless parking flow in which a customer presents a payment card at entry.

CCMP Counter Mode with Cipher Block Chaining Message

Authentication Code Protocol Appears in the wireless security requirement as AES-CCMP for WPA2

Enterprise where WPA3 is not supported.

CCO Credit Card Out Ticketless parking flow in which the same card or tokenized digital wallet is presented at exit for fee settlement.

CPM Critical Path Method Scheduling method required for the project master schedule.

CRM Customer Relationship Management Used for Salesforce integration involving customer/account events, complaints, service, and disputes.

CSF Cybersecurity Framework Refers to the NIST Cybersecurity Framework 2.0 used to align cybersecurity controls.

Exhibit A — Technical Requirements Page 6 of 50

CSV Comma-Separated Values Non-proprietary data/file format used for imports, exports, reconciliation files, and data portability.

DBO Design-Build-Operate Delivery model under which the Contractor designs, supplies, installs, commissions, operates, maintains, and supports PARCS.

DHCP Dynamic Host Configuration Protocol Network addressing method referenced in the required IP addressing strategy and reservation policy.

DR Disaster Recovery Required recovery capability, including a documented DR plan, annual exercises, backup, and restore validation.

E5 Encompass 5 TransCore Encompass 5 reader baseline referenced for AVI/SunPass compatibility.

EAP Extensible Authentication Protocol Referenced for certificate-based 802.1X network device authentication.

EMV Europay, Mastercard, and Visa Payment-card technology/specification used for chip, contactless, and mobile-wallet payment terminals.

EV Electric Vehicle Referenced for configurable EV charging fees and PARCS-integrated charging infrastructure.

FAA Federal Aviation Administration Referenced for Part 139 airport operational requirements.

FAT Factory Acceptance Testing Testing performed before shipment of major field equipment; scripts/results require MDAD approval.

FDLE Florida Department of Law Enforcement External law-enforcement integration for license-plate reads and stolen/wanted vehicle matching.

FDOT Florida Department of Transportation Agency associated with SunPass and the SunPass M-Commerce parking interface/program.

GTMS Ground Transportation Management System GateKeeper is identified as the current GTMS used for employee and VIP parking integration.

HUD Heads-Up Display Customer-facing display or equivalent installed at parking lanes.

HVHZ High-Velocity Hurricane Zone Referenced for hurricane/high-wind installation requirements applicable in

Miami-Dade County.

IAM Identity and Access Management Function associated with MDAD's identity provider, including SSO, provisioning, and privileged/remote access controls.

ID Identification / Identifier Used generically in the document for identity/identifier references; not presented as a separately defined acronym.

INFORMS Integrated Financial Resource Management System MDAD financial management system referenced for analytics and reconciliation compatibility.

IP Internet Protocol Used for IP cameras, IP address planning, network addressing, and network communications.

IP66 Ingress Protection Rating 66 Minimum environmental protection rating referenced for exposed outdoor devices.

IRW Image Review Workstation Back-office workstation used by authorized personnel to review and correct

LPR image/plate data.

Exhibit A — Technical Requirements Page 7 of 50

IT Information Technology MDAD stakeholder/functional area involved in design, integration, operations, and oversight.

ITSM IT Service Management Used for the Ivanti (or successor designated by MDAD) integration supporting production incident tickets.

JCB Japan Credit Bureau Payment card brand listed among supported bankcards, subject to the

MDAD merchant account.

JSON JavaScript Object Notation Structured, non-proprietary data format accepted for APIs, reconciliation data, and data extracts.

LPI License Plate Inventory Vehicle-mounted camera systems referenced for mobile license plate inventory where retained.

LPR License Plate Recognition Recognition, transaction-matching, exception-resolution, temporary-session, audit, and revenue-assurance technology used at entry and exit.

LTE Long-Term Evolution Cellular communications technology listed as a possible fallback path for remote locations.

MAC Media Access Control Used for MAC address filtering and MAC-based access control in network security requirements.

MCBF Mean Cycles Between Failure Durability metric for barrier gates; the document specifies a minimum 10 million cycles or OEM-rated equivalent.

MDAD Miami-Dade Aviation Department Department operating Miami International Airport and procuring/owning the

PARCS solution.

MFA Multifactor Authentication Required for privileged and remote administrative access, including vendor support access.

MIA Miami International Airport Airport where the PARCS will be deployed and operated.

MTTR Mean Time to Repair Maintenance reporting metric used for device/service performance.

NEC National Electrical Code NFPA 70 electrical code referenced for cabling, conduit, grounding, and hardware installation.

NEMA National Electrical Manufacturers Association Referenced for enclosure ratings such as NEMA 4 and 4X.

NFPA National Fire Protection Association Referenced through NFPA 70, the National Electrical Code.

NIST National Institute of Standards and Technology Referenced for the Cybersecurity Framework and SP 800-53 security controls.

NOA Notice of Acceptance Miami-Dade County approval/testing designation referenced for hurricane/HVHZ installations where applicable.

NOC Network Operations Center Required 24x7 operations/support function for monitoring, alerting, and incident response.

NTP Network Time Protocol Required for time synchronization of cameras, lane controllers, servers, and network devices.

OCR Optical Character Recognition Used to convert captured license-plate images into plate text in real time.

OEM Original Equipment Manufacturer Referenced for manufacturer certifications, ratings, and equipment support.

Exhibit A — Technical Requirements Page 8 of 50

OIDC OpenID Connect Identity/authentication protocol referenced for SSO and API access.

ONVIF Open Network Video Interface Forum Referenced for IP camera interoperability profiles, including Profiles S and

T.

P1 Priority 1 Highest incident priority in the service-level table; described as a production outage or revenue-loss incident.

P2 Priority 2 Critical field-failure incident category with a specified on-site response target.

PAN Primary Account Number Payment-card account number; plaintext PAN must not be visible to airport users or stored outside approved payment scope.

PARCS Parking Access and Revenue Control System The integrated parking system being procured for vehicle access, payment, revenue control, reservations, validations, credentials, reporting, and related functions.

PCI DSS Payment Card Industry Data Security Standard Payment-card security standard; Exhibit A requires PCI DSS v4.0.1 (or successor) compliance for the cardholder data environment.

PDF Portable Document Format Required or accepted document delivery format for submittals, project records, reports, and evidence packages.

PM Preventive Maintenance Used in maintenance reporting for preventive-maintenance compliance.

PMP Project Management Plan Comprehensive plan required from the Contractor for managing and executing implementation and operations.

QA Quality Assurance MDAD surveillance/oversight of the Contractor's quality-control program.

QC Quality Control Contractor program for verifying compliance with specifications, drawings, inspections, and testing requirements.

QCP Quality Control Plan Document describing QC personnel, procedures, inspection points, test methods, and documentation.

QoS Quality of Service Network traffic-prioritization policies required to prioritize voice/intercom/help-point traffic over background data.

QR Quick Response Used for reservations, validation-code workflows, and mobile web-based access to temporary or active parking sessions.

RESTCONF REST Configuration Protocol Secure network monitoring/configuration protocol listed as an alternative/equivalent telemetry method.

RFC Request for Comments Standards-document designation; RFC 8446 is cited for TLS 1.3.

RFID Radio-Frequency Identification Credential technology used for employee/VIP parking access.

RPO Recovery Point Objective Recovery metric; the paid-transaction ledger is required to have RPO = 0.

RTO Recovery Time Objective Recovery metric; the document requires an RTO of 15 minutes or less for specified production capabilities.

SaaS Software as a Service Subscription software delivery model addressed in licensing, ownership, assignment, and transition requirements.

SAML Security Assertion Markup Language Federated identity protocol referenced for enterprise SSO.

Exhibit A — Technical Requirements Page 9 of 50

SAT Site Acceptance Testing Testing performed after installation at MIA, covering functional, failover, safety, payment, integration, and cybersecurity requirements.

SCIM System for Cross-domain Identity Management Identity-provisioning standard referenced for automated user provisioning where supported.

SIEM Security Information and Event Management Central security logging/monitoring platform; Trellix Helix, Microsoft Sentinel, or successor is referenced.

SLO Service Level Objective Performance objective required for critical software/services and monitored continuously.

SMS Short Message Service Customer notification channel required for specified events.

SNMP / SNMPv3 Simple Network Management Protocol / Version 3 Secure monitoring protocol required or supported on managed network devices, with authentication/privacy enabled for SNMPv3.

SOP Standard Operating Procedure Operational documentation/runbooks that the Contractor must develop and maintain.

SP Special Publication Used in the reference to NIST SP 800-53.

SSO Single Sign-On Enterprise identity capability for back-office users using SAML 2.0 and/or

OIDC.

TAS Testing Application Standard Miami-Dade testing standard referenced with NOA for hurricane/HVHZ installations where applicable.

TIA Time Impact Analysis Schedule analysis required when an event affects the critical path or an intermediate milestone.

TLS Transport Layer Security Encryption protocol; TLS 1.3 minimum is required for externally routed administrative/API communications and payment communications.

TSA Transportation Security Administration Referenced in connection with airport security training/access requirements.

TXT Text File Non-proprietary text format allowed for Department data extracts.

UAT User Acceptance Testing Acceptance testing performed from the user/business perspective; required in implementation/test plans.

UI User Interface Lane, kiosk, app, web, and back-office interfaces that must meet usability/accessibility requirements.

UL Underwriters Laboratories Referenced through UL 325 requirements for vehicular gate operators and entrapment protection.

UPS Uninterruptible Power Supply Backup power required for lane and network equipment for a specified ride-through period.

VIP Very Important Person Used for credentialed parking access and billing/account workflows. The document uses the term but does not separately expand it.

VLAN Virtual Local Area Network Logical network segmentation used for maintenance access, isolation, and unused switch-port controls.

VMS Variable Message Sign Roadway/facility signage that may receive real-time occupancy status from

PARCS.

VoIP Voice over Internet Protocol Technology required for lane and kiosk intercom communications.

Exhibit A — Technical Requirements Page 10 of 50

WAN Wide Area Network Network connectivity referenced in the PARCS requirement for autonomous lane operation during WAN loss.

WCAG Web Content Accessibility Guidelines WCAG 2.2 AA is required for customer-facing web/mobile accessibility.

WPA2 / WPA3 Wi-Fi Protected Access 2 / 3 Wireless security standards required for approved wireless backhaul, with enterprise authentication.

XML Extensible Markup Language Structured, non-proprietary data format allowed for reconciliation interfaces and data extracts.

1 Project Requirements

1.1 Introduction

The Miami-Dade Aviation Department (MDAD or ”Department”), operator of Miami International Airport (MIA or ”Airport”), is procuring a fully integrated Parking Access and Revenue Control System (PARCS) under a design-build-operate (DBO) delivery model in which MDAD shall hold title to all deployed hardware, perpetual software licenses, and configuration data, and the Contractor shall serve as the single third-party service provider responsible for ongoing operation, maintenance, customer-facing services, and lifecycle support of the system. The selected Proposer (the ”Contractor”) shall design, supply, install, commission, operate, maintain, and provide lifecycle support for the PARCS for the duration of the resulting Agreement, including any exercised renewal terms. This Exhibit A defines the technical and performance requirements applicable to the PARCS.

Only a general introduction is provided in this Section 1. Detailed technical requirements appear in Section 2. Implementation, testing, training, and closeout requirements appear in Section 3.

1.2 General Scope

The Contractor shall be responsible for delivering and operating a PARCS that meets or exceeds the technical and functional requirements set forth herein. The PARCS shall serve no fewer than 15,400 public and employee parking spaces across the Ibis Garage, Dolphin Garage, Flamingo Garage, Park 1, Park 6, Park 8, the High Vehicle Lot, and Employee Parking, with the ability to scale to at least 150% of the current deployed footprint (no fewer than approximately 23,100 spaces) to accommodate additional MIA facilities or expansion over the term.

Location Entry Lanes Exit Lanes

Central Collection Plaza 6 16

Dolphin Garage 2 0

Flamingo Garage 4 0

Ibis Garage 2 0

Employee Parking 2 2

Exhibit A — Technical Requirements Page 11 of 50

Taxi Lot 1 3

Park 1 (Upper & Lower) 4 0

Park 8 2 2

Park 6 2 0

Valet North 1 2

Valet South 0 1

High Vehicle Lot 1 0

Park 1 Transfer Gate 1 0

The Contractor's services shall include, but are not limited to:

1.2.1 Project management, program administration, and project controls

1.2.2 System engineering and detailed design

1.2.3 System supply, installation, configuration, integration, and commissioning

1.2.4 Integration with existing and replacement MDAD systems, including Propel (reservations), Park Assist or successor (parking guidance), SunPass (electronic toll/parking), the MDAD payment gateway, the MDAD identity provider, the MDAD enterprise data and Business Intelligence (BI) environment, the MDAD Customer Relationship Management (CRM) platform, the MDAD Security Information and Event Management (SIEM), the MDAD IT Service Management (ITSM) platform, the MDAD ground transportation management system (presently GateKeeper or successor), the Florida Department of Law Enforcement (FDLE) data interface, and all other systems identified in Section 2.1.4 Integration Requirements.

1.2.5 Factory and site acceptance testing

1.2.6 Operations and end-user training, including train-the-trainer programs

1.2.7 Continuous operation, monitoring, preventive and corrective maintenance, refresh, and lifecycle support of the deployed PARCS

1.2.8 Warranty and software lifecycle management, including patches, upgrades, and security updates

As the design-build-operate Contractor responsible for the PARCS, the Contractor shall prepare and maintain all documents required to install, test, operate, refresh, and continuously improve the system, including:

1.2.9 Project Management Plan (PMP)

1.2.10 Factory Acceptance Test (FAT), Site Acceptance Test (SAT), and User Acceptance Test (UAT) plans and reports

1.2.11 Component and system submittal documents and shop drawings

1.2.12 Detailed installation plans, method statements, and lane-by-lane phasing plans

1.2.13 Operations runbooks, Standard Operating Procedures (SOPs), and end-user documentation

1.2.14 As-built drawings, network diagrams, asset registers, and configuration baselines

Exhibit A — Technical Requirements Page 12 of 50

1.2.15 Service-level performance reports, incident reports, and root-cause analyses

The Contractor shall coordinate with the designated MDAD Project Manager and shall conduct design workshops with all relevant MDAD stakeholders (Parking Operations, Information Technology, Finance, Customer Service, Legal, Security, Cybersecurity, Facilities, and Maintenance) to finalize the following design components, at a minimum:

1.2.16 PARCS functional and operational requirements (configuration of rate engine, exception flows, validations, refunds, supervisor controls)

1.2.17 Customer-facing experience requirements (mobile app, web, kiosk, in-lane, signage, intercom)

1.2.18 Reporting requirements and canned report configurations

1.2.19 Integration scope and interface specifications for each in-scope system

1.2.20 Customer communications, on-screen language, accessibility content, and multilingual content

The Contractor shall furnish all software, hardware, peripherals, lane sensors, cameras, gate operators, Europay/Mastercard/Visa (EMV) terminals, intercoms, kiosks, and end-user connectivity cabling required for the system to function as specified. The Contractor's infrastructure responsibility extends to and includes conduit, horizontal cabling, backbone cabling, network switches, and power distribution to each device and equipment location, up to the handoff point at MDAD IDFs or other designated locations. Title to all deployed hardware, perpetual software licenses, and configuration baselines shall vest in MDAD at Final System Acceptance.

Subscription and Software-as-a-Service (SaaS) components shall be held by the Contractor on MDAD's behalf during the term and shall be fully assignable to MDAD or to MDAD's designee at no cost upon expiration or termination of the Agreement. Refresh of the PARCS shall be planned and executed by the Contractor under a Lifecycle Management Plan, in accordance with the Agreement.

1.3 Lifecycle Management Plan

The Contractor shall develop, maintain, and execute a comprehensive Lifecycle Management Plan for the PARCS throughout the term of the resultant agreement. The Lifecycle Management Plan shall establish the Contractor's approach for maintaining the System in a current, supported, secure, reliable, and operational condition and shall address, at a minimum, hardware, software, firmware, operating systems, third-party components, interfaces, peripherals, payment-processing devices, and other technology necessary for continued operation of the PARCS.

The Lifecycle Management Plan shall:

• Identify System Components and Lifecycle Status. Maintain an inventory of major System components, including manufacturer, model/version, installation date, warranty status, anticipated useful life, and applicable manufacturer end-of-sale, end-of-life, and end-of-support dates.

• Establish Planned Refresh Cycles. Identify the anticipated replacement or upgrade cycle for major hardware and technology components, including lane equipment, servers, workstations, cameras, LPR equipment, gate operators, EMV/payment terminals, intercoms, kiosks, networking components, and other System peripherals.

• Address Software and Platform Currency. Identify required software, firmware, operating system, database, browser, middleware, API, security, and other

Exhibit A — Technical Requirements Page 13 of 50 technology updates necessary to maintain manufacturer support, interoperability, cybersecurity, and compatibility with the overall System.

• Prevent Unsupported or Obsolete Technology. Proactively identify components approaching end-of-life or end-of-support and recommend replacement, upgrade, migration, or other corrective action sufficiently in advance to avoid operation of unsupported technology or interruption of services.

• Maintain Compatibility and Integration. Ensure that refreshed or upgraded components remain compatible with the PARCS and its interfaces, including payment processing, LPR, AVI/RFID, reservations, SunPass or other applicable integrations, County networks, reporting systems, APIs, and MDAD's data environment.

• Maintain Cybersecurity and Payment Compliance. Ensure that lifecycle refresh activities maintain compliance with applicable cybersecurity requirements, PCI DSS requirements, EMV standards, County security requirements, and other standards identified in the Agreement.

• Minimize Operational Disruption. Describe the methodology for implementing refresh activities, including testing, staging, migration, rollback procedures, installation sequencing, and coordination with MDAD so that parking operations remain continuously available to the greatest extent practicable.

• Provide Advance Notice. Notify MDAD of any known or announced end-of-life, end-of-sale, end-of-support, material compatibility issue, or other lifecycle event affecting a System component within thirty (30) calendar days after the Contractor becomes aware of such event and provide a recommended mitigation or replacement strategy.

• Annual Review and Update. Review the Lifecycle Management Plan with MDAD at least annually and update the Plan to reflect changes in technology, manufacturer support, System configuration, cybersecurity requirements, operational requirements, and anticipated refresh activities for the succeeding twenty-four (24) months.

• Maintain Configuration Documentation. Following each approved refresh, upgrade, or replacement, update the System inventory, configuration baseline, diagrams, technical documentation, licenses, warranties, and other applicable System records and provide the updated documentation to MDAD.

1.4 Contractor Qualifications and Requirements

1.4.1 In addition to all requirements set forth in the RFP, the Contractor shall be experienced in designing, supplying, installing, and operating PARCS solutions at U.S. or international airports of comparable size and operational complexity.

1.4.2 Hold all manufacturer certifications applicable to the equipment proposed (lane controllers, gate operators, EMV terminals, license plate recognition (LPR) cameras, automatic vehicle identification (AVI) readers)

1.4.3 Maintain a local or regional field service location capable of meeting the on-site response times required in Section 2.15.5 Service Levels.

Exhibit A — Technical Requirements Page 14 of 50

1.4.4 Maintain Payment Card Industry Data Security Standard (PCI DSS) v4.0.1 (or successor) attestation of compliance for the components of the solution that handle cardholder data

1.4.5 Maintain a cybersecurity program that demonstrably aligns to National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0 outcomes

1.5 Project Management

1.5.1 Project Management Requirements

Within thirty (30) calendar days after issuance of the notice to proceed, the Contractor shall develop and submit to MDAD a detailed draft project management plan (PMP) addressing all aspects of implementing and operating the PARCS, including the transition from the existing PARCS environment to the new MDAD-owned, Contractor-operated PARCS. The PMP shall be a comprehensive plan for assisting MDAD to control, direct, coordinate, and evaluate the Work performed during each project phase, and shall remain current through final system acceptance.

Following MDAD's review, the Contractor shall incorporate MDAD's comments and issue a final PMP within ten (10) calendar days of receipt of the comments.

1.5.1.1 Contents

The PMP shall be detailed and shall describe the program and requirements for executing the Work planned for each project phase. At a minimum, the PMP shall include the following sections:

1.5.1.1.1 Project Description and Goals — known characteristics of the project described in general terms that reflect the requirements of MDAD, including security clearance and badging requirements

1.5.1.1.2 Project Objectives — the basic schedule, budget, physical, technical, operational, and customer-experience objectives, with quality standards and controls affecting access to and use of proprietary information

1.5.1.1.3 Work Statements — task-performance breakouts showing coordination among disciplines and narrative descriptions of the Work to be performed during each phase

1.5.1.1.4 Work Flow Chart — a diagram showing the flow of Work during each stage of the project

1.5.1.1.5 Organization Chart — a summary chart showing the interrelationships among the Contractor (and any subcontractors), MDAD, and supporting organizational elements

1.5.1.1.6 Duties — Contractor staff personnel shown on an organizational chart with individual duties, lines of authority and communication, and avoidance/control of nonconforming work

1.5.1.1.7 Master Schedule — a computer-generated Critical Path Method (CPM) schedule for all project activities and milestones, in Microsoft Project format

1.5.1.1.8 Budget / Financial Control — narrative description of budget controls during each phase, cost reporting, and methods for cost containment, including treatment of design-build capital milestones, recurring operations and lifecycle-support fees, and refresh task orders under the design-build-operate model

1.5.1.1.9 Risk Register — top project risks, severity, owner, mitigation, and contingency, refreshed monthly

Exhibit A — Technical Requirements Page 15 of 50

1.5.1.1.10 Communications Plan — meeting cadence, status reporting cadence, and stakeholder engagement plan

1.5.2 Project Coordination

The Contractor shall coordinate with the MDAD Project Manager (or designated representative) at all times. The Contractor shall maintain a Project Directory listing each team member by company, name, title, address, telephone number, and email address. The Contractor's project tools, including scheduling, document management, and electronic project management systems, shall be compatible with the MDAD environment (current Microsoft 365 suite, Microsoft Project, and any other tools designated by MDAD). The Contractor shall:

For purposes of this Exhibit, the MDAD Project Manager and the Airport Representative (AR) are distinct roles unless MDAD designates the same individual to perform both functions. The MDAD Project Manager is responsible for overall project administration, coordination, schedule, and stakeholder management. The AR is the MDAD-designated technical/field representative authorized to review submittals, provide written approvals where required by this Exhibit, and coordinate installation activities. Any delegation or change in either role shall be communicated by MDAD in writing.

1.5.2.1 Coordinate implementation activities under the various sections of these specifications to ensure efficient and orderly installation of each portion of the Work. The Contractor shall submit, for review and evaluation by the AR, product data sheets for each major product or component. No item shall be purchased or installed prior to receipt of written approval from the AR.

1.5.2.2 Coordinate installation of different components to ensure maximum performance and serviceability for required maintenance, service, and repair

1.5.2.3 Identify and notify MDAD of any conflicts that cannot be accommodated through proper coordination of the installations, prior to commencement of the affected Work

1.5.2.4 Coordinate with other MDAD contractors at the Airport, including the Park Assist installer, the SunPass operator, the parking operator, terminal construction contractors, IT/network operators, and security badging staff

1.5.2.5 Coordinate with the existing PARCS operator and the existing GTMS (GateKeeper) operator to support a controlled transition and avoid disruption to public and employee parking

1.5.2.6 Coordinate all access and lane outages to minimize impact on the traveling public and Airport operations

1.5.3 Schedule

Within thirty (30) calendar days after notice to proceed, the Contractor shall submit to MDAD a schedule for effectively planning and reporting on the status of the project to ensure completion within the approved schedule. The schedule shall include computer-generated reports and a master CPM schedule covering all project activities. The schedule shall identify activities and dependencies, and shall show relationships between activities such as 'develop concepts,' 'approve initial and final concepts,' 'design document completion,' 'design completion,' and similar milestone activities. The level of detail shall be sufficient to identify, at a minimum:

1.5.3.1 The work components of the project

1.5.3.2 The types of work and services involved

1.5.3.3 Design and program development phases

Exhibit A — Technical Requirements Page 16 of 50

1.5.3.4 Procurement, fabrication, delivery, installation, and testing of major materials and equipment

1.5.3.5 Access to and availability of work areas, including coordination with terminal landside operations

1.5.3.6 Interfaces and dependencies with other MDAD contractors and tenants

1.5.3.7 Manpower, material, and equipment restraints

1.5.3.8 Startup, testing, training, and cutover activities

1.5.3.9 Format

1.5.3.9.1 Prepare the schedule as a horizontal bar chart with a separate bar for each major portion of Work or operation, identifying the first workday of each week

1.5.3.9.2 List individual tasks in chronological order of the start of each item of Work

1.5.3.9.3 Provide space for notations and revisions

1.5.3.9.4 Sheet size shall be a minimum 8 ½ × 11 inches.

1.5.3.9.5 The primary delivery format shall be MS Project (native), with Adobe Acrobat (PDF) copies provided on request.

1.5.3.10 Three-Week Rolling Schedule

The Contractor shall submit a three-week rolling schedule each week, in bar-chart format, reflecting the previous week's progress and projecting the upcoming two-week period in detail beyond that of the progress schedule.

1.5.3.11 Time Impact Analysis

Within fifteen (15) calendar days of any event that impacts the critical path or an intermediate milestone, the Contractor shall submit to MDAD a time impact analysis (TIA) describing the initiating event, its critical-path effect, and supporting documentation. Float or slack within the schedule is jointly owned and may be consumed by either party as needed to meet contract milestones.

1.5.4 Reporting

The Contractor shall keep accurate and detailed records of project progress during all stages.

The Contractor shall maintain frequent contact (telephone, site visits, meetings, etc.) with all parties involved in the project. The Contractor shall submit weekly written progress reports to MDAD including, at a minimum: initiatives taken to preclude delays; percentage completion by activity; number and amount of modifications and claims; analyses of the schedule; and comparison of actual versus planned performance. The Contractor shall use MDAD-prescribed forms where applicable.

1.5.4.1 Monthly Report

The Contractor shall submit a monthly report by a cutoff date established by MDAD. The first monthly report shall be submitted before the first invoice and shall be a prerequisite for payment of all subsequent invoices. Each monthly report shall consist of:

1.5.4.1.1 Narrative report stating percentage of Work completed, physical progress achieved, plans for the next period, problem areas and proposed solutions, delaying factors and impacts, and corrective actions

1.5.4.1.2 Progress schedule updated to show actual progress against scheduled activities

Exhibit A — Technical Requirements Page 17 of 50

1.5.4.1.3 Risk register update

1.5.4.1.4 Service-readiness assessment as the project approaches go-live

1.5.4.2 Special Reports

The Contractor shall submit special reports within one (1) business day of any occurrence requiring a special report, including unusual events, accidents, security incidents, and any incident that may affect operations of the existing or new PARCS. Where events are known or predictable in advance, the Contractor shall advise MDAD at the earliest feasible date.

1.5.5 Meetings

1.5.5.1 Pre-Implementation Conference

MDAD shall schedule a pre-implementation conference before site work begins. The conference shall be chaired by MDAD's representative. Authorized representatives of MDAD, the Contractor, the Contractor's Program Manager, the Contractor's Site Superintendent, the existing PARCS operator, and other concerned parties shall attend.

The words “Site Superintendent” shall mean Contractor's designated on-site representative responsible for the day-to-day supervision, coordination, and execution of all field installation and site activities associated with implementation of the PARCS. The Site Superintendent shall coordinate Contractor and subcontractor personnel; manage site access and work sequencing;

coordinate lane closures and other impacts to parking operations; oversee equipment removal, installation, cabling, testing, commissioning, and restoration activities; ensure compliance with applicable site safety, security, and operational requirements; and serve as the Contractor's primary on-site point of contact for MDAD during implementation activities. The Site Superintendent shall coordinate with the Contractor's Program Manager and other key personnel to ensure that field activities are performed in accordance with the approved implementation schedule and requirements of the Agreement.

At the Pre-Implementation Conference, the Contractor shall submit the following to MDAD: (i) an emergency and contingency plan; (ii) emergency contact information for the Contractor's key personnel; (iii) a communication and notification plan identifying the parties to be notified and the procedures and timeframes for providing notice of planned or emergency activities that may affect parking operations, traffic flow, lane availability, system availability, safety, security, or other operations at the work site; (iv) the proposed implementation schedule, including construction activities, implementation events, and key milestones; (v) the schedule of required submittals;

and (vi) the designation and contact information of the Contractor's competent person responsible for site safety and security.

1.5.5.2 Pre-Installation Conference

The Contractor shall call a pre-installation conference at least five (5) business days in advance of site work, chaired by MDAD, to ensure final coordination.

1.5.5.3 Weekly Progress Meetings

MDAD shall set and conduct weekly progress meetings at a location designated by MDAD. The Contractor shall attend with the Site Superintendent, plus representatives of subcontractors, suppliers, and other entities concerned with current progress or planning. The Contractor shall distribute minutes within three (3) business days of each meeting.

1.5.5.4 Coordination Meetings

Coordination meetings may be called by either party as needed. The Contractor shall designate, in writing, qualified attendees for each topic.

Exhibit A — Technical Requirements Page 18 of 50

1.5.6 Use of Premises

The Contractor's use of premises is subject to MDAD's policies and the operational constraints of an active large-hub airport. The Contractor shall confine operations to areas approved by MDAD, shall not unreasonably encumber the site, shall keep work areas clean and orderly, and shall coordinate any required lane closures or capacity reductions with MDAD at least seventy-two (72) hours in advance, except in case of emergency. Work that affects public lanes during peak operational windows shall be performed only with MDAD's prior written approval.

1.5.7 Safety and Security

All Contractor personnel performing on-site work shall obtain MIA security clearance and badging in accordance with MDAD's badging procedures. Personnel requiring access to airside or Airport Operations Area (AOA) areas shall complete any additional U.S. Customs and Border Protection (CBP), Transportation Security Administration (TSA), or MDAD security training required for that access. The Contractor shall comply with all MDAD safety and security policies, including but not limited to Federal Aviation Administration (FAA) Part 139 operations, applicable AOA rules, and Miami-Dade County safety codes. Background checks meeting MDAD criteria are required prior to badging.

1.5.8 Cleaning

The Contractor shall keep work and storage areas clean and free of debris on a continuous basis throughout the Work. At completion of each portion of the Work, the Contractor shall remove all packaging, surplus material, and waste from the site, in accordance with applicable Miami-Dade County environmental and waste-handling requirements.

1.6 Submittal Process

All submittals shall be submitted in PDF (and native source where applicable) through MDAD's designated document management platform. Each submittal shall include a transmittal cover sheet, revision history, and reviewer's response form. Substitutions shall require prior written approval from MDAD and shall demonstrate equivalent or superior function, quality, durability, and lifecycle cost. Substitution requests received after the deadline established in the project schedule may be rejected in MDAD's sole discretion.

1.7 Quality Control

1.7.1 General

The Contractor shall establish, document, and execute a quality control (QC) program for the Work. The Contractor's QC program shall ensure compliance with the drawings, specifications, and contract provisions. QC documentation shall be maintained throughout the duration of the Contract and shall be available for inspection by MDAD.

1.7.2 Description of Program

The QC program shall include a quality control plan (QCP) describing the personnel, procedures, inspection points, test methods, and documentation used to verify compliance. The QCP shall be submitted within forty-five (45) calendar days of notice to proceed and shall be updated as required throughout the Contract.

1.7.3 Personnel

Exhibit A — Technical Requirements Page 19 of 50

The Contractor shall designate a Quality Control Supervisor responsible for the QC program. The QC Supervisor shall have at least five (5) years of relevant experience and shall not be assigned production duties that would conflict with QC responsibilities.

1.7.4 Inspections

The Contractor shall conduct preparatory, initial, and follow-up inspections of each definable feature of work in accordance with the QCP. Each inspection shall be documented on the Contractor's QC forms, signed by the QC Supervisor, and made available to MDAD.

1.7.5 Quality Control Plan

The QCP shall describe, at a minimum, the documentation, inspection, and testing requirements for each major component, including lane controllers, gate operators, LPR cameras, EMV terminals, kiosks, intercoms, AVI readers, the core PARCS platform, integrations, and cable/power infrastructure.

1.7.6 Procedures

The Contractor shall maintain records of inspections and tests, including the precise location and type of inspection or test, the number performed, results, nature of any defects, causes for rejection, proposed remedial action, and corrective actions taken.

1.7.7 Quality Assurance (MDAD Surveillance)

MDAD shall perform quality assurance (QA) surveillance of the Contractor's QC program and may inspect any portion of the Work at any time. MDAD's QA activities and inspections shall not relieve the Contractor of its QC obligations and shall not transfer responsibility for any defect or deficiency to MDAD.

1.7.8 Noncompliance

Where Work is found to be non-compliant, MDAD may issue a written notice of noncompliance.

The Contractor shall propose and execute corrective action within the timeframe stated in the notice. Failure to correct may result in withholding of payment, replacement of the affected Work, or other remedies allowed by the Contract.

1.8 Project Closeout

1.8.1 Closeout Procedures

Prior to final system acceptance, the Contractor shall complete all punch-list items, deliver all required documentation, and demonstrate full operational readiness of the PARCS, including SLA monitoring, escalation, and service-credit tracking processes.

1.8.2 Final Cleaning and Adjusting

The Contractor shall perform final cleaning and adjustment of all installed equipment, including calibration of LPR cameras, gate operators, sensors, EMV terminals, kiosks, and intercoms. The Contractor shall remove all temporary protection, tools, and surplus materials from the site.

1.8.3 Project Record Documents

The Contractor shall deliver as-built drawings, network diagrams, asset inventories, configuration baselines, integration specifications, operations runbooks, SOPs, and end-user documentation.

All project record documents shall be delivered in native source format and in PDF, in a structure approved by MDAD.

Exhibit A — Technical Requirements Page 20 of 50

2 Technical Requirements

2.1 Technical Overview

2.1.1 PARCS System Description

The PARCS shall provide a state-of-the-art, recognition-capable, ticketless-capable, fully gated parking access and revenue control solution serving Miami International Airport (MIA). The system shall consolidate vehicle entry and exit processing, payment workflows, exception handling, reservations, validations, employee and VIP credentialed parking, and revenue assurance into a unified, MDAD-owned, Contractor-operated platform with auditable open data interfaces.

The PARCS shall utilize a hybrid cloud and edge computing architecture. Lane equipment shall remain operational with autonomous decision-making capabilities for a minimum of twenty-four

(24) hours during any wide-area network (WAN) outage, with deferred synchronization and reconciliation upon restoration of connectivity. The core platform shall achieve measured system availability of at least 99.9% over any rolling twelve-month period, with a recovery time objective (RTO) of fifteen (15) minutes or less and a recovery point objective (RPO) of zero (0) for the paid-transaction ledger. The Contractor shall meet these availability commitments without reliance on planned downtime windows for routine maintenance.

The PARCS shall support multiple entry and exit methods, including traditional paper-ticket processing, credit-card-in / credit-card-out (CCI/CCO), SunPass, RFID employee/VIP credentials, and advance-reservation digital credentials, so that MDAD may determine the appropriate mix of methods for its customer base. App-driven ticketless entry/exit and LPR-driven ticketless entry/exit shall be available as optional, MDAD-activatable capabilities that MDAD may enable, expand, or restrict over the term as customer demographics, technology adoption, and operational needs evolve. License Plate Recognition (LPR) shall not serve as the primary authorization method for entry or exit; where used, LPR shall support and enhance vehicle identification, transaction matching, exception resolution, and revenue assurance.

2.1.1.1 App-driven ticketless: (optional feature) Under the app-driven ticketless workflow, the customer shall pre-enroll their vehicle and payment method through the designated mobile or web-based application. At entry and exit, the vehicle's license plate shall be matched to the enrolled account and associated parking session, with LPR providing supplemental identification to ensure frictionless access. Gate operation shall be authorized upon successful validation of the customer account, parking session, and payment status. This workflow is an optional, MDAD-activatable feature; MDAD may enable, expand, disable, or restrict its availability at its discretion, and it is not a required or primary entry method.

2.1.1.2 Credit-Card-In / Credit-Card-Out (CCI/CCO) ticketless: Under the CCI/CCO workflow, the customer shall present a contact or contactless EMV-enabled bankcard or supported digital wallet at entry. The same credential shall be presented at exit, allowing the PARCS to calculate and process the applicable parking fee.

2.1.1.3 SunPass: For SunPass credentialed customers, the SunPass transponder shall be read at entry and exit.