Information Technology (IT) Supplemental R00B7600009 – Child Care Scholarship Customer Service and Administration

This supplemental contains additional requirements under Section 2 of the solicitation.

1.1 Deliverables

1.1.1 Deliverable Submission

A. For every deliverable, the Contractor shall request the Contract Monitor confirm receipt of that deliverable by sending an e-mail identifying the deliverable name and date of receipt.

B. For every deliverable, the Contractor shall submit to the Contract Monitor, by email, an Agency Deliverable Product Acceptance Form (DPAF), an example of which is attached as Exhibit 3.

C. Unless specified otherwise, written deliverables shall be compatible with Microsoft Office, Microsoft Project or Microsoft Visio within two (2) versions of the current version. At the Contract Monitor’s discretion, the Contract Monitor may request one hard copy of a written deliverable.

D. A standard deliverable review cycle will be elaborated and agreed upon between the State and the Contractor. This review process is entered into when the Contractor completes a deliverable.

E. For any written deliverable, the Contract Monitor may request a draft version of the deliverable, to comply with the minimum deliverable quality criteria listed in Section 1.1.3 Minimum Deliverable Quality. Drafts of each final deliverable, except status reports, are required at least two weeks in advance of when the final deliverables are due (with the exception of deliverables due at the beginning of the project where this lead time is not possible, or where draft delivery date is explicitly specified). Draft versions of a deliverable shall comply with the minimum deliverable quality criteria listed in Section 1.1.3 Minimum Deliverable Quality.

1.1.2 Deliverable Acceptance

A. A final deliverable shall satisfy the scope and requirements of this RFP for that deliverable, including the quality and acceptance criteria for a final deliverable as defined in Section 1.1.4 Deliverable Descriptions/Acceptance Criteria.

B. The Contract Monitor shall review a final deliverable to determine compliance with the acceptance criteria as defined for that deliverable. The Contract Monitor is responsible for coordinating comments and input from various team members and stakeholders. The Contract Monitor is responsible for providing clear guidance and direction to the Contractor in the event of divergent feedback from various team members.

C. The Contract Monitor will issue to the Contractor a notice of acceptance or rejection of the deliverable in the DPAF (see online sample). Following the return of the DPAF indicating “Accepted” and signed by the Contract Monitor, the Contractor shall submit a proper invoice in accordance with the procedures in Section 3.3. The invoice must be accompanied by a copy of the executed DPAF or payment may be withheld.

D. In the event of rejection, the Contract Monitor will formally communicate in writing any deliverable deficiencies or non-conformities to the Contractor, describing in those deficiencies what shall be corrected prior to acceptance of the deliverable in sufficient detail for the Contractor to address the deficiencies.

The Contractor shall correct deficiencies and resubmit the corrected deliverable for acceptance within the agreed-upon time period for correction.

1.1.3 Minimum Deliverable Quality

The Contractor shall subject each deliverable to its internal quality-control process prior to submitting the deliverable to the State.

Each deliverable shall meet the following minimum acceptance criteria:

A. Be presented in a format appropriate for the subject matter and depth of discussion.

B. Be organized in a manner that presents a logical flow of the deliverable’s content.

C. Represent factual information reasonably expected to have been known at the time of submittal.

D. In each section of the deliverable, include only information relevant to that section of the deliverable.

E. Contain content and presentation consistent with industry best practices in terms of deliverable completeness, clarity, and quality.

F. Meets the acceptance criteria applicable to that deliverable, including any State policies, functional or non-functional requirements, or industry standards.

G. Contains no structural errors such as poor grammar, misspellings or incorrect punctuation.

H. Must contain the date, author, and page numbers. When applicable for a deliverable, a revision table must be included.

I. A draft written deliverable may contain limited structural errors such as incorrect punctuation and shall represent a significant level of completeness toward the associated final written deliverable. The draft written deliverable shall otherwise comply with minimum deliverable quality criteria above.

1.1.4 Deliverable Descriptions/Acceptance Criteria

In addition to the items identified in the table below, the Contractor may suggest other subtasks, artifacts, or deliverables to improve the quality and success of the assigned tasks.

Deliverables Summary Table*

ID Deliverable Acceptance Criteria Due Date / Frequency 1 Integrated Project

Schedule Microsoft Project or equivalent schedule demonstrating tasks, estimates, resource assignments, and dependencies for both MSDE and Contractor personnel, with tasks no less than 8 hours and no greater than 80 hours.

Updated for kick-off:

NTP + 10 Business Days Updates: Weekly

2 Transition-In Plan Comprehensive plan addressing: transition from existing contractor's document and case management architecture; knowledge-sharing and discovery approach; data migration plan including security in transit; integration approach; image transfer strategy;

and pending work handoff procedures.

Must demonstrate clear understanding of continuity requirements.

Draft: with Proposal Final: NTP + 30 Calendar Days MSDE approval required

3 Emergency Preparedness and Business Continuity Plan

Plan addressing continuity of case management, provider payment administration, IVR, and customer service during State/county emergencies and CCATS outages. Includes disaster recovery for Contractor systems, CCDF fund tracking mechanisms for off- CCATS processing, and alternative application submission methods. MSDE approval is a condition of beginning full operations.

Draft: with Proposal (evaluated) Final: NTP + 30 Calendar Days MSDE approval required Updated: Annually and upon material change

4 Problem Escalation Procedure (PEP)

Complete PEP as defined in RFP Section 3.5, including contact information, escalation hierarchy, response timeframes, after-hours contacts, and update process.

Initial with proposal Final: NTP + 10 Business Days Updated: Annually and upon change

5 Security Plan Written security policy no less rigorous than the State of Maryland Cybersecurity and Privacy Policy Suite (currently available at doit.maryland.gov/policies/ci/Pages/default.aspx).

Covers all hardware, software, and network components. Addresses PII protection, access controls, encryption, vulnerability management, and incident response. Must include workstation maintenance and protection standards.

Draft: NTP + 15 calendar days

Updated: Annually or upon change

6 Monthly SLA Performance Report

Report evidencing attained level for each SLA metric.

Highlights any metric not meeting compliance requirement with explanation and remediation plan.

Includes IVR call counts, application processing volumes, QA results summary, and call center help system ticket statistics.

Monthly by the 15th of the following month

7 Monthly Quality Assurance / CPRS Report

Completed CPRS Form or MSDE-designated form.

Excel summary of cases reviewed, number correct, number with errors, error type, and whether case was overpayment/underpayment/correct payment. Overpayment/underpayment tracking (date of discovery, date letters mailed, date finalized and reason for over or under payment). Referral to Investigative Unit (Yes/No). Covers both 1st and 2nd Level Reviews.

Monthly

8 Monthly Fraud and Investigative Unit Report

Cases reviewed and findings reported to MSDE CCS Investigator or designee. Includes list of all program violations and potential fraud cases with name, type (provider or customer), and date of discovery.

Monthly

9 Monthly Call Center and Data Collection Report

Data on services provided, processed, completed, and reviewed. Includes: number of calls received; calls handled by IVR vs. CSR; abandoned, transferred, and hang-up counts; applications processed; and other metrics directed by MSDE. Includes customer satisfaction survey metrics: number of surveys deployed, response rate, average satisfaction score, and a summary of verbatim comments covering surveys deployed through both the call center telephony/IVR platform and the case management solution.

Monthly

10 Quarterly Enrollment Verification Report

Results of random sample enrollment verification of up to 10% additional of all providers. Includes provider notification records, documentation review outcomes, findings, and next steps communicated to providers.

Quarterly

11 Continuous Improvement Report

Documented opportunities to improve customer experience, reduce costs, increase efficiency, or enhance program outcomes identified through ongoing operational monitoring. Includes proposed actions and estimated impact.

Schedule as directed by Contract Monitor

12 IVR Scripts Complete IVR call flow scripts for all customer-facing interactions. Must comply with Communications Standard (RFP Section 2.3.14). Submitted for MSDE review and approval.

Upon approval by MSDE and upon material revision

13 Training Materials Comprehensive training program materials including course outlines, instructor materials, background materials, training aids, and online materials/videos.

Must comply with Communications Standard (RFP Section 2.3.14). Submitted for MSDE review and approval.

Initial: NTP + 30 calendar days Updated: as required or directed by MSDE

14 Disaster Recovery Plan

DR plan for Contractor systems ensuring no break in services in the event of a Contractor system failure.

Includes RTO/RPO metrics, backup procedures, and

Initial: NTP + 30 Calendar Days failover/fallback operations. Annual test results documented and provided to Contract Monitor.

Updated: Annually and upon material change

15 SOC 2 Type II Audit Report or other approved rigorous framework as detailed in Section 1.10 of this Supplemental

Annual SOC 2 Type II audit or other approved rigorous framework covering Security, Availability, Confidentiality, and Privacy trust services criteria.

Performed by qualified independent auditor. Includes corrective action plan for all findings. Scope includes subcontractors handling State data.

Initial with Proposal.

Annually, within 30 calendar days of issuance First audit:

covering period from Contract Effective Date

16 Emergency CCDF Fund Tracking Report

Complete tracking and reporting of all CCDF funds authorized and processed outside of CCATS during declared emergencies or as authorized by MSDE or Federal Government. Includes authorization records, amounts, dates, and disposition.

As directed during declared emergencies

17 Data Deletion Certification

Submit to MSDE a written certification signed by an authorized Contractor representative attesting that all State data — including data held by subcontractors and third-party platforms — has been completely deleted following the conclusion of the transition out period or as required by State policy, whichever is more stringent.

Within 30 calendar days of transition out period end date

*The deliverables summary table may not list every contractually-required deliverable. Offerors and Contractors should read the RFP thoroughly for all Contract requirements and deliverables.

1.3 Contractor-Supplied Hardware, Software, and Materials

A. The Contractor is responsible for the acquisition and operation of all hardware, software and network support related to the services being provided. However, the State has the right to purchase hardware, software, and hosting services from a source other than the Contractor if it is determined to be in the best interest of the State based on value and price.

B. Workstations. The Contractor shall provide workstations or laptops running Windows 11 for all Contractor personnel performing work under this Contract. Workstations shall have a minimum of 16 gigabytes of RAM and a 300 gigabyte hard drive. The Contractor is responsible for ensuring all workstations are kept current with operating system updates, security patches, and antivirus/anti-malware software in accordance with the State of Maryland Cybersecurity and Privacy Policy Suite (available at https://doit.maryland.gov/policies/ci/Pages/default.aspx). Workstation maintenance and protection standards must be addressed in the Contractor's Security Plan and SOC 2 Type II or other rigorous framework audit scope.

C. Software Currency. The Contractor shall keep all software current. The Contractor shall maintain a valid support contract with the manufacturer. All upgrades, security fixes, accessibility fixes, and https://doit.maryland.gov/policies/ci/Pages/default.aspx updates required to maintain functionality of the software shall be provided at no additional cost to

MSDE.

D. COTS Support. All COTS hardware and software shall be supported by the manufacturer throughout the Contract term. Software that reaches end-of-life status shall be replaced at the Contractor's expense. All upgrades shall be approved by the Contract Monitor prior to implementation.

E. Licenses. The Contractor shall be responsible for all licenses and license costs required to meet the scope of work. The State shall receive fully functional, generally available software and multi-user licenses as needed throughout the life of the Contract.

F. Warranty. The Contractor shall provide the manufacturer or provider’s standard warranty for hardware and software provided under the Contract, the details for which must be described in the Offeror’s Technical Proposal. Any warranty period for goods and services will not commence until acceptance of the products or services by the State of Maryland. Notwithstanding anything to the contrary, all defective items must be replaced at no additional cost to the State.

G. Documentation. The Contractor shall install and provide all documentation for software furnished under this Contract and shall keep documentation updated at all times.

H. Accessible Technology. All technology components provided to or developed for MSDE use shall be accessible via current and recent common web browsers and current mobile form factors and shall comply with the Maryland Digital Accessibility Policy (available at https://doit.maryland.gov/initiatives/digital-accessibility-initiative/Pages/default.aspx) and at a minimum WCAG 2.1 Level AA standards.

1.4 Product Requirements

A. Open source software may be proposed; however, operational support for the proposed software must also be proposed. Operational support shall include maintenance and updating of code to address software dependencies, software updates and security vulnerabilities.

B. Offerors proposing to resell services of another entity must be authorized by such other entity.

C. No international storage or processing for State Data: As described in Section 1.9.2 Data Protection and Controls, Bidders/Offerors are advised that any processing or storage of data outside of the continental U.S. is strictly prohibited.

D. Consistent expiration dates: Licenses/services purchased under the Contract shall expire coterminously with the earliest licenses/services delivered. As appropriate, charges shall be prorated.

E. Any terms of use or other agreement applicable to the Offeror's proposed services must be contained in the Offeror’s Technical Proposal. The State is not subject to any terms of use or other https://doit.maryland.gov/initiatives/digital-accessibility-initiative/Pages/default.aspx agreement applicable to the Offeror’s proposed services unless the same are explicitly agreed to by the State during the Proposal evaluation process.

F. The State does not recognize and is not subject to any autorenewal of services provision that may be contained or provided for in any Contractor agreements.

1.5 Maintenance

1.5.1 Maintenance and support, and Contractor’s ongoing maintenance and support obligations, are defined as follows:

A. Maintenance commences at the State acceptance of the system and completion of the transition-in period. Billing for such maintenance and support shall commence after the first month of operation upon MSDE’s acceptance of the system and successful completion of the transition-in period.

B. Software maintenance includes all software changes, modifications, updates, patching, bug fixes, vulnerability fixes, and enhancements applicable to all system modules licensed without further charge to all licensed users maintaining a renewable software support contract.

C. Maintenance shall be provided for superseded releases and back releases still in use by the State.

D. For the first year and all subsequent Contract years, the following services shall be provided for the current version and one previous version of any Software provided with the Deliverables, commencing upon State acceptance of the deliverable.

1) Error Correction. Upon notice by the State of a problem with the system (which problem can be verified), reasonable efforts to correct or provide a working solution for the problem.

2) Material Defects. Contractor shall notify the State of any material errors or defects in the Deliverables known or made known to Contractor from any source during the life of the Contract that could cause the production of inaccurate or otherwise materially incorrect results. The Contractor shall initiate actions as may be commercially necessary or proper to effect corrections of any such errors or defects.

3) Vulnerabilities. Contractor shall notify the State of any vulnerabilities of which it is or becomes aware, that could allow unauthorized access, disclosure, or modification of data, applications, or systems. The Contractor shall fix all vulnerabilities in accordance with the State’s IT Security Manual and/or the State of Maryland Cybersecurity and Privacy Policy Suite.

4) Updates. Contractor will provide to the State at no additional charge all new releases and bug fixes (collectively referred to as “Updates”) for any software Deliverable developed or published by the Contractor and made available to its other customers.

1.5.2 Technical Support

A. “Technical Support” means Contractor-provided assistance for the services or Solution furnished under the Contract, after initial end-user support confirms a technical issue that requires additional troubleshooting capabilities; sometimes referenced as Tier II – IV support.

B. Technical Support shall be available during Normal State Business Hours.

C. The State shall be able to contact a Technical Support team member 24 hours per day, 7 days per week, 365 days per year, based on the Tier defined in the Service Level Agreement.

D. Contractor Personnel providing technical support shall be familiar with the State’s account (i.e., calls shall not be sent to a general queue).

E. Contractor shall return calls for service of emergency system issues within one (1) hour or per the Service Level Agreement.

F. Calls for non-emergency IT service requests will be returned within three (3) hours or immediately the following day if after Normal State Business Hours.

G. The State shall be provided with information on software problems and solutions encountered at other locations, along with the solution to those problems, when relevant to State software.

H. The Contractor shall maintain an up-to-date support escalation SOP and contact list, provided to the State PM quarterly and upon request.

I. User support (Help Desk)

1) Contractor shall furnish Help Desk services for case management, document management and call center telephony systems.

2) Help Desk services are available during Normal State Business Hours.

3) Contractor shall utilize a help desk ticketing system to record and track all help desk calls.

The ticketing system shall record with a date and timestamp when the ticket was opened and when the ticket was closed as well as which personnel at the organization handled and resolved the ticket with a full audit trail of activity as well as which personnel at the organization handled and resolved the ticket with a full audit trail of activity.

4) Help Desk services shall be furnished using resources familiar with the State’s account (i.e., calls shall not be sent to a general tier 1 call queue).

1.5.2 Backup and Recovery

The Contractor shall:

A. Recommend and following MSDE approval, implement a backup and recovery plan for the document and case management solution.

B. Perform backups for all application and configuration data on a regularly automated schedule that is necessary to restore the application to full operability on suitable hardware. The backup shall consist of at least:

1) Incremental daily backups, retained for one (1) month,

2) Full weekly backups, retained for two (2) years, and

3) One annual backup maintained for at least five (5) years.

C Manual backups shall be maintained at will.

D. Full system recovery shall be achieved within 24 hours.

E. Daily backups shall be stored off-site of the main service location, or as otherwise approved by MSDE for the proposed solution.

F. Backup and recovery procedures shall be tested annually. Results shall be documented and provided to the Contract Monitor.

G. Application logs shall be aggregated to the State's log aggregation solution.

1.5.3 Call Center Telephony and IVR Platform Requirements

A. Platform. The Contractor shall provide a cloud-based, carrier-grade contact center telephony platform integrated with an Interactive Voice Response (IVR) system, available 24 hours per day, 7 days per week, consistent with the IVR Availability service level in Section 1.6.7. The platform shall employ redundant architecture with no single point of failure.

B. Routing. The platform shall provide skills-based and priority-based call routing, including routing by language preference, referral category, and case status.

C. Caller Authentication. The IVR shall authenticate caller identity using personal identifying information consistent with MSDE-approved authentication methods prior to disclosing any case-specific information.

D. Call Recording. The Contractor shall record all inbound and outbound calls and retain recordings for a minimum of one (1) year. The Contractor shall maintain a process for promptly identifying and providing requested recordings to MSDE.

E. Reporting. The platform shall provide real-time and historical reporting accessible to MSDE, including call volume, abandonment rate, average handle time, average speed of answer, and IVR containment rate.

F. IVR Scripts. IVR call flow scripts are subject to MSDE review and approval prior to implementation and upon any material revision, consistent with the IVR Scripts deliverable in Section 1.1.4.

G. AI and Automation Features. Where the Contractor proposes AI-enabled or automation features for the IVR or contact center platform, including conversational AI, natural language understanding, speech-to-text transcription, sentiment analysis, or agent-assist tools, the following apply in addition to Section 1.7, Reference J:

1) Any AI-driven voice interaction shall clearly disclose to the caller, at the start of the interaction, that they are interacting with an automated system, and shall provide a clear method to reach a live Customer Service Representative during normal Business Hours.

2) The Contractor shall define and document escalation triggers for automatic transfer from an AI-driven interaction to a live representative, including at minimum: caller request, repeated failed recognition attempts, and any inquiry involving fraud, abuse, or safety concerns.

3) AI or automation features may support efficiency and routing but shall not autonomously approve, deny, or authorize benefits or payments. All such determinations remain subject to case manager review.

4) All AI-enabled IVR and contact center features are subject to MSDE's AI intake review process and written approval prior to deployment. DoIT approval of an underlying platform does not constitute MSDE authorization.

H. Accessibility. The IVR and telephony platform shall comply with Section 1.11 (Nonvisual Access) and shall provide translation and oral interpretation options at any point during a call.

I. Data Handling. Call recordings, transcripts, and any data derived from AI processing of caller interactions are State data subject to Section 1.8.3 (Data Ownership and Access) and shall not be used by the Contractor to train models for any purpose outside this Contract.

1.5.4 Case Management System Requirements

A. Platform. The Contractor shall provide a document and case management solution supporting continuation of current business operations without service disruption, consistent with the Case Management System Availability service level in Section 1.6.7.

B. Workflow and Queueing. The solution shall provide structured workflow and queue management for case assignment, review, and supervisory oversight, including the ability to route cases by type, priority, and case manager caseload.

C. Document Association. The solution shall associate uploaded and imaged documents with the correct customer or provider record and shall be retrievable by authorized Contractor staff, MSDE, and internal and external auditors.

D. Audit Trail. The solution shall maintain a complete audit trail of case actions, including user, timestamp, and action taken, sufficient to reconstruct case history without reliance on the underlying system of record.

E. Role-Based Access. The solution shall enforce role-based access controls limiting case data visibility to Contractor personnel whose job duties require such access, consistent with Section 1.9 (Security Requirements).

F. Integration. The solution shall maintain a real-time or near-real-time integration with CCATS sufficient to prevent case data from being maintained in two authoritative locations. Data used to determine the outcome of a case or that results in benefit authorization shall be entered into CCATS in accordance with the case narration standard defined in the RFP.

G. Data Retention and Portability. The solution shall retain case records for the duration of the Contract and shall support full export of case data in a non-proprietary format at Contract end, consistent with Section 1.8.2 (Data Export/Import).

H. Accessibility. The Contractor-facing and public-facing components of the solution shall comply with Section 1.11 (Nonvisual Access).

I. AI and Automation Features. Where the Contractor proposes AI-enabled features within the case management solution (e.g., automated case note drafting assistance, anomaly flagging for fraud review, document classification), such features are subject to Section 1.7, Reference J, and shall not autonomously approve, deny, or authorize benefits. All benefit determinations remain subject to case manager review and any pre-authorization review requirement set forth in the RFP.

1.5.5 Automated Customer Satisfaction Surveys

A. Scope. Both the call center telephony/IVR platform (Section 1.5.3) and the case management solution (Section 1.5.4) shall support automated deployment of customer satisfaction surveys to CCS customers and providers.

B. Trigger Events. Survey deployment shall be configurable by MSDE and shall, at minimum, support triggering upon completion of an IVR or live agent call; completion of a case determination, redetermination, or interim change; and resolution of a customer service inquiry or complaint. The Contractor shall recommend a default set of trigger events for MSDE review and approval.

C. Delivery Channels. Surveys shall be deliverable via the channel most appropriate to the completed interaction, including post-call IVR survey, SMS, email, and in-portal notification, consistent with the customer's contact preferences and consent on record.

D. Content Approval. Survey questions and content are subject to MSDE review and written approval prior to initial deployment and upon any material revision.

E. Frequency and Opt-Out. The Contractor shall implement reasonable frequency limits to avoid survey fatigue for the same customer or provider and shall provide a functioning opt-out mechanism.

The Contractor shall maintain and honor a do-not-contact list for survey purposes separate from other program communications.

F. Non-Manipulative Design. Survey design and timing shall not incentivize, prompt, or otherwise steer customers toward a particular response, and shall not condition access to services, benefits, or support on survey completion.

G. Reporting. Survey deployment volume, response rate, satisfaction scores, and a summary of verbatim comments shall be included in the Monthly Call Center and Data Collection Report (Section 1.1.4, Deliverable 9). Survey responses are State data subject to Section 1.8.3 (Data Ownership and Access).

H. Language and Accessibility. Surveys shall be available in the languages required for Translation Services under the RFP and shall comply with Section 1.11 (Nonvisual Access).

I. AI and Automation Features. Where the Contractor proposes AI-enabled features to analyze, summarize, or triage survey responses (e.g., sentiment analysis, automated theme tagging), such features are subject to Section 1.7, Reference J, and the Contractor shall disclose any automated analysis methodology to MSDE upon request.

1.6 Service Level Agreement (SLA)

1.6.1 Definitions

A. A “Problem” is defined as any situation or issue or breach or potential breach related to the system operation and is not an enhancement request that is reported to the Contractor. The Contractor shall utilize a tracking system, e.g. help desk ticket system, to track, update, and report the status of all reported problems. Refer to RFP Section 2.4.2 Technical Requirements for specifications.

B. “Problem resolution time” is defined as the period of time from when the issue was reported to the Contractor to when it is resolved to the satisfaction of the State.

C. Monthly Charges: for purposes of SLA credit calculation, Monthly Charges are defined as the charges set forth in Attachment B, Financial Proposal Form, invoiced during the month of the Problem for the monthly fixed services, or, in the event of annual billing, 1/12 of the annual invoice amount Financial Proposal Form.

1.6.2 SLA Requirements

The Contractor shall:

A. Be responsible for complying with all performance measurements and shall also ensure compliance by all subcontractors.

B. Meet the Problem Response Time and the Problem Resolution Time requirements as defined in Section 1.6.7.

C. Provide a monthly SLA Performance Report to the Contract Monitor by the 15th day of the following month and detail response times and resolution times. Refer to the Deliverable Table in Section 1.1.4, item 6 above.

D. Log all Problems into the Contractor-supplied tracking tool or other help desk software and assign an initial severity level (i.e., Emergency, High, Normal, or Low as defined in Section 1.6.8).

E. Respond to and update all Problems, including recording when a Problem is resolved and its resolution. Appropriate MSDE personnel shall be notified when a Problem is resolved.

F. The State of Maryland shall make the final determination regarding Problem severity as defined in Section 1.6.8.

G. Contractor shall review any Problem with MSDE to establish the remediation plan and relevant target dates.

1.6.3 SLA Effective Date (SLA Activation Date)

SLAs set forth herein shall be in effect beginning with the commencement of services after the completion of the four-month Transition-In Period and shall remain in effect through the life of the Contract.

1.6.4 Service Level Reporting

A. Contractor performance will be monitored by MSDE.

B. The Contractor shall provide summarized SLA performance and detailed monthly reports evidencing the attained level for each SLA. All monthly reports shall highlight any SLA performance criteria that did not meet the compliance requirement designated in the SLA provided in Section 1.6.7.

The Contractor shall provide an explanation of why any SLA was not met. For any problems not resolved the Contractor shall provide an explanation of how and when it will be met in the future.

C. Monthly reports shall be delivered via e-mail to the Contract Monitor by the 15th day of the following month.

1.6.5 SLA Service Credits

Beginning on the SLA Activation Date, for any performance measurement not met during the monthly reporting period, the SLA credit for that individual measurement shall be applied to the monthly charges.

Service credits will be cumulative for each missed service requirement. The State, at its option for amounts due to the State as service credits, may deduct such from any money payable to the Contractor or may bill the Contractor as a separate item. In the event of a catastrophic failure affecting all services, in addition to all other rights and remedies available to the State, all affected SLAs shall be credited to the State.

(Example: If the Monthly Charges were $100,000 and one SLA was missed, with an applicable 4% credit, the credit to the monthly invoice would be $4,000, and the State would pay a net Monthly Charge of $96,000).

If the same SLA is missed two or more consecutive times, the monthly credit to MSDE shall increase per the SLA chart below.

Other than a catastrophic failure, in no event shall the aggregate of all SLA credits paid to the State in any calendar month exceed 25% of the Monthly Charges.

The parties agree that any assessment of service credits shall be construed and treated by the parties not as imposing a penalty upon the Contractor, but as compensation to the State for the Contractor’s failure to satisfy its service level obligations.

1.6.6 Root Cause Analysis

The State has the right, at its sole discretion, to direct the Contractor to perform and deliver a root cause analysis in connection with any SLA measurement that yields an SLA credit. Such root cause analysis shall be provided within 30 days of the request.

In addition, for each ‘Emergency’ or ‘High’ priority Problem, the affected parties will perform a root cause analysis and institute a process of problem management to prevent recurrence of the issue.

1.6.7 Service Level Measurements Table (System performance)

The Contractor shall comply with the service level measurements in the following table:

No. Service Requirement Measurement Service Level Agreement

SLA Credit

1 Application Entry into

CCATS

Percentage of customer applications date-stamped and entered into CCATS within 1 Business Day of receipt.

For 2 or more consecutive misses, the credit shall increase.

98% within 1 Business Day

1% of Monthly Charges per percentage point below the 98% standard 1 Business Day.

2% of Monthly Charges per percentage point below the 98% standard 1 Business Day for 2 or more consecutive misses.

2 Standard Application Processing

Percentage of completed standard applications processed within 5 Business Days following receipt of the last document required for eligibility determination, not to exceed 25 days where additional information is required.

98% within 5 Business Days of receipt of the last required document

1% of Monthly Charges per percentage point below the 98% standard 5 Business Days.

No. Service Requirement Measurement Service Level Agreement

SLA Credit

For 2 or more consecutive misses, the credit shall increase.

3% of Monthly Charges per percentage point below the 98% standard 5 Business Days for 2 or more consecutive misses.

3 Priority Application Processing

Percentage of completed priority applications processed within 3 Business Days following receipt of the last document required for eligibility determination, not to exceed 25 days where additional information is required.

95% within 3 Business Days

1% of Monthly Charges per percentage point below the 95% standard 3

4 Redeterminations Percentage of completed redeterminations within 5 Business Days following receipt of the last document required for continuation of care, providing the redetermination is received within the first 30 days of the established notification window.

98% within 5 Business Days

1% of Monthly Charges per percentage point below the 98% standard 5

SLA Credit

5 Redeterminations Percentage of completed redeterminations processed within 15 days of the eligibility end date where the redetermination was received within the 31st - 45th day of the notification window.

98% within 15 Business Days of the eligibility end date

1% of monthly charges for each percentage point below the 98% standard 15 Business Day eligibility end date.

6 Interim Changes Percentage of completed interim change requests processed within 5 Business Days.

95% within 5 Business Days

1% of Monthly Charges per percentage point below the 95%, standard 5 Business Days.

7 Missing Information Letters

Percentage of Missing Information letters issued within 5 Business Days of application, redetermination or interim change receipt.

the credit shall increase

98% within 5 Business Days of application receipt date

1% of Monthly Charges per percentage point below the 98% standard 5 Business Days.

2% of Monthly Charges per

SLA Credit percentage point below the 98% standard 5 Business Days for 2 or more consecutive misses.

8 Frozen Status Applications

Frozen status application processing will follow the standard application or missing documentation timelines within 5 Business Day of the lift from frozen status.

98% within 5 Business Days of the Frozen Status change

1% of Monthly Charges per percentage point below the 98% standard 5 Business Days from Frozen Status Change.

9 Pre-Authorization Review

Percentage of complete pre-authorization review on applications, redeterminations and interim changes at the time of eligibility determination.

credit shall increase.

100% of Applications must have the pre-authorization reviewed by the eligibility determination date

2% of Monthly Charges per percentage point below the 100% standard.

3% of Monthly Charges per point below

SLA Credit the 100% standard.

10 QA Review Completion

Percentage of 1st-level Quality Assurance / Comprehensive Program Reviews completed within 30 days of case authorization.

25% of reviewed cases within 30 calendar days.

1% of Monthly Charges per percentage point below the 25% standard 30 calendar days of authorization.

11 Second-Level Review

Percentage of second-level review of the 1st level QA Reviewer’s completed work. Completion within 30 days of the 1st level review date.

25% of reviewed cases monthly

1% of Monthly Charges per percentage point below 25%

12 Fraud / Violation Reporting

Percentage of identified intentional program violations or potential fraud reported to CCS Investigator within 3 Business Days of discovery.

For 2 or more consecutive misses credit shall increase

100% within 3 Business Days

2% of Monthly Charges per percentage point exceeding the 3 Business Day standard

3% of Monthly Charges per percentage point exceeding 3

SLA Credit

Business Day standard

13 Provider Invoice Processing

Provider invoices shall be authorized within 5 Business Days of the receipt of a complete, correct and properly submitted invoice. A missing or incorrect invoice shall be documented in the provider’s record and the provider notified within 5 Business Days.

98% of complete, correct, and properly submitted invoices are authorized within 5 Business Days.

2% of Monthly Charges per percentage point below the 98% standard 5 Business Days.

3% of Monthly Charges per percentage point below the 98% standard 5 Business Days.

14 IVR Availability Percentage uptime of IVR system on a monthly basis.

99.5% uptime (24/7/365) except for planned outages

1% of Monthly Charges per percentage point below the 99.5% uptime standard

15 Emergency IT Issue Response

Percentage of emergency system issue calls returned within 1 hour.

98% within 1 hour 1% of Monthly

SLA Credit point below the 98% standard 1 hour.

16 Non-Emergency IT Response

Percentage of non-emergency IT service requests returned within 3 hours during Normal State Business Hours.

95% within 3 hours 1% of Monthly Charges per percentage point below the 95% standard 3 hours.

17 Case Management System Availability

Monthly uptime of Contractor-provided case management solution during Normal State Business Hours.

99.5% during Normal State Business Hours

2% of Monthly Charges per percentage point below the 99.5% standard uptime.

18 Disaster Recovery Recovery of Contractor systems within 24 hours of system failure notification.

24 hours .5% of Monthly Charges per hour beyond 24 hours.

19 Security Incident Notification

Notification to MSDE within 24 hours of discovery of a security incident.

100% within 24 hours

5% of Monthly Charges per hour beyond 24 hours

SLA Credit

20 Data Breach Notification

Notification to MSDE within 72 hours of a threat to the solution as it pertains to State data.

100% within 72 hours

5% of Monthly Charges per day beyond 3 days.

21 Monthly SLA Report Delivery

Monthly SLA Performance Report delivered to Contract Monitor by the 10th of the following month.

100% delivery by 10th of the following month

2% of Monthly Charges per percentage point below the 100% standard

3% of Monthly Charges per percentage point below the 100% standard.

22 Call Center Customer Service

Respond to inquiries made after Normal State Business Hours within 1 Business Day of inquiry

98% within 1 Business Day

1% of Monthly Charges per percentage point below the 98% standard 1 Business Day.

23 Customer Service

CSAT

Number of Customer Satisfaction (CSAT) surveys offered for each active call interaction daily.

80% CSAT survey offered daily

1% of Monthly

SLA Credit point below the 80% offered standard Business Day

24 Customer Service – Average Call/Inquiry Handle Time

Percentage of average call/inquiry handle time exceeding 10 minutes, where Average Handle Time (AHT) = (Total Talk Time + Hold Time + After-Call Work Time) / Total Number of All Calls

98% of call interactions are completed within 10 minutes

1% of Monthly Charges per percentage point below the 98% standard 10 minute response.

25 Customer Service – Complaints

Percentage of complaints, verbal or written, whether received directly by the Contractor or forwarded to the Contractor by MSDE, receive an accurate, detailed response within 1 Business Day credit shall increase.

98% of complaints are addressed within 1 Business Day

1% of Monthly Charges per percentage point below the 98% standard 1 Business Day

2% of Monthly Charges per percentage point below the 98% standard 1 Business Day

SLA Credit

26 Customer Service – First Call Resolution

Percentage of issues solved during the first contact, as captured and measured on the CSAT survey

75% of calls are resolved within the first contact

1% of Monthly Charges per percentage point below the 75% standard

27 Customer Service – Abandoned Calls

Percentage of calls returned once abandoned in the IVR or during an active interaction

100% of abandoned calls receive a call back within 1 Business Day

1% of Monthly Charges per percentage point below the 100% standard

28 Customer Service – Call Quality

Percentage of calls receiving a call quality review monthly

25% of all inbound and outbound calls are reviewed monthly

1% of Monthly Charges per percentage point below 25% reviewed monthly

The State shall have the unilateral right to reallocate percentages among the various SLAs annually on the anniversary of the Contract, provided that such reallocation will not exceed the cap identified in Section 1.6.5.

1.7 Required Project Policies, Guidelines and Methodologies

The Contractor must comply with all applicable laws, regulations, policies, standards and guidelines affecting Information Technology projects, which may be created or changed periodically in the rapidly evolving technology industry. Contractors are strongly advised to check these policies frequently. These include, but are not limited to:

Reference Regulations, Policies, Guidelines and Methodologies

A The State of Maryland Information Technology Security Policy and Standards at:

https://doit.maryland.gov/policies/ci/Pages/IT-Security-Policy.aspx

B The State of Maryland Information Technology Non-Visual Standards at:

https://doit.maryland.gov/policies/Pages/nva.asp

C

Maryland Digital Accessibility Policy (revised December 2, 2025) https://doit.maryland.gov/policies/Accessibility/Pages/default.aspx

Requires WCAG 2.1 Level AA compliance for all State websites, applications, and systems including those maintained by third-party vendors.

D The State of Maryland Information Technology Project Oversight at:

https://doit.maryland.gov/MITDP-Oversight/Pages/MITDP-oversight.aspx

E The Contractor shall follow project management methodologies consistent with the most recent edition of the Project Management Institute’s Project Management Body of Knowledge Guide.

F Hardware and Software hardening procedures by Center for Internet Security (CIS) guides https://www.cisecurity.org/ or Security Requirements Guides (SRG) http://www.nist.gov

G

Federal Information Processing Standards (FIPS), “Security Requirements for Cryptographic Modules”, FIPS PUB 140-3:

https://csrc.nist.gov/publications/detail/fips/140/3/final https://csrc.nist.gov/Projects/cryptographic-module-validation-program/fips-140- 3-standards

H Purchasing and Recycling Electronic Products https://dgs.maryland.gov/Pages/GreenPurchasing/Resources/Electronics.aspx

I

Maryland Executive Order 01.01.2024.25 — Maryland Plain Language Initiative; and the Maryland Digital Service Plain Language Standards (available at https://digital.maryland.gov/principles/plain-language-standards); and the federal Plain Writing Act of 2010.

J

Maryland Executive Order 01.01.2024.02 — Catalyzing the Responsible and Productive Use of Artificial Intelligence in Maryland State Government; Maryland AI Governance Act of 2024 (SB 818); and DoIT AI Policies :

https://doit.maryland.gov/policies/ai/Pages/default.aspx

All AI tools must undergo MSDE's AI intake review process prior to deployment unless directed otherwise in writing. DoIT approval does not constitute MSDE authorization.

https://doit.maryland.gov/policies/ci/Pages/IT-Security-Policy.aspx https://doit.maryland.gov/policies/Pages/nva.asp https://doit.maryland.gov/policies/Accessibility/Pages/default.aspx https://doit.maryland.gov/MITDP-Oversight/Pages/MITDP-oversight.aspx https://www.cisecurity.org/ http://www.nist.gov/ https://csrc.nist.gov/publications/detail/fips/140/3/final https://csrc.nist.gov/Projects/cryptographic-module-validation-program/fips-140-3-standards https://csrc.nist.gov/Projects/cryptographic-module-validation-program/fips-140-3-standards https://dgs.maryland.gov/Pages/GreenPurchasing/Resources/Electronics.aspx https://digital.maryland.gov/principles/plain-language-standards https://doit.maryland.gov/policies/ai/Pages/default.aspx

1.8 Disaster Recovery and Data

1.8.1 Redundancy, Data Backup and Disaster Recovery

a) Unless specified otherwise, throughout the Contract term, the Contractor shall maintain or cause to be maintained disaster avoidance procedures designed to safeguard State data and other confidential information, Contractor’s processing capability and the availability of hosted services. Any force majeure provisions of the Contract do not limit the Contractor’s obligations under this provision.

b) The Contractor shall have robust contingency and disaster recovery (DR) plans in place to ensure that the services provided under the Contract will be maintained in the event of disruption to the Contractor/subcontractor’s operations (including, but not limited to, disruption to information technology systems), however caused.

1) The Contractor shall furnish a DR site.

2) The DR site shall be at least 100 miles from the primary operations site and have the capacity to take over complete production volume in case the primary site becomes unresponsive.

c) The contingency and DR plans must be designed to ensure that services under the Contract are restored after a disruption within 24 hours from notification, with a recovery point objective of one hour or less prior to the outage in order to avoid unacceptable consequences due to the unavailability of services.

d) The Contractor shall test the contingency/DR plans at least twice annually to identify any changes that need to be made to the plan(s) to ensure a minimum interruption of service.

Coordination shall be made with the State to ensure limited system downtime when testing is conducted. At least one annual test shall include backup media restoration and failover/fallback operations at the DR location. The Contractor shall send the Contract Monitor a notice of completion following completion of DR testing.

e) Such contingency and DR plans shall be available for the State to inspect and practically test at any reasonable time, and subject to regular updating, revising, and testing throughout the term of the Contract.

1.8.2 Data Export/Import

a) The Contractor shall, at no additional cost or charge to the State, in an industry standard/non-proprietary format:

1) perform a full or partial import/export of State data within 24 hours of a request; or

2) provide to the State the ability to import/export data at will and provide the State with any access and instructions which are needed for the State to import or export data.

b) Any import or export shall be in a secure format per the Security Requirements.

1.8.3 Data Ownership and Access

As set forth in the Contract, data, databases and derived data products created, collected, manipulated, or directly purchased as part of the solicitation are the property of the State. The purchasing State agency is considered the custodian of all State data. The use, access, and distribution of all data shall comply with the requirements of the Data Use Agreement (Attachment Y).

The Contractor may not access State data other than as necessary to perform the services under…