NYS OASAS Salesforce SOW 7.22.26.docx

Salesforce/NYS OASAS Services FY27 - Discussion Document

For discussion purposes only. Contractual SOW will be provided separately and may vary from language within this discussion document. Final costs/rates to be furnished in final SOW 1 Overview To be provided in full contractual SOW 2 Scope

2.1 Background/Objective

Customer is looking to secure expert advisory services from Salesforce Professional Services in a continuation of their modernization efforts on the Salesforce platform. The anticipated resources needed from Salesforce Professional Services to support these modernization efforts include a Salesforce CTO focused on overall platform architecture, A Salesforce CTO focused on data, ,a Solution Architect, and an Engagement Manager The Customer’s high-level business objectives for these Professional Services are summarized below. These objectives are for informational purposes only (not a Customer or SFDC obligation).

· Decrease operating costs or costs of ownership

· Decrease systems integrator and implementation costs

· Decrease technical debt

· Increase data visibility and accuracy

· Increase productivity

· Increase scalability and performance

· Increase security and decrease risk

· Increase technology development speed, frequency, and quality

· Increase time to value/ market

· Increase ability for Customer internal resources to make application changes

2.2 Salesforce CTO

Subject to the terms of this SOW and the Agreement, SFDC will provide the Professional Services set forth below. The scope described in this section comprises the “Salesforce CTO Offerings” and consists of non-configuration, consultation-based services from SFDC personnel with expertise in specific subject areas. The Salesforce CTO Offerings are deemed accepted upon delivery as they do not provide Deliverables.

SFDC will provide advice relating to the subject areas detailed below. Customer and SFDC will jointly determine the specific outcomes resulting from the Salesforce CTO Offerings, and such outcomes may change upon mutual agreement of Customer and SFDC. Customer understands that it is purchasing advice and that SFDC is not committing to complete any particular outcome or task within any specific time frame.

2.2.1 Security and Architecture Authority. This subject area includes guidance and oversight relating to architectural design authority and alignment to well-architected frameworks. Outcomes may include:

· Discovery & Alignment Conduct stakeholder interviews to understand business objectives and pain points.

Assess current governance structures, policies, and processes.

Align on framework goals, success criteria, and scope.

· Policy Definition Assist Customer in establishing guiding principles for governance and decision-making.

Provide guidance on the development of in core policies to address roles, responsibilities, and intake processes.

Review policies to help Customer align with compliance, regulatory, and organizational objectives.

· Roles & Responsibilities Assist Customer in identifying key roles required for governance and execution (e.g., Steering Committee, intake reviewers).

Conduct assessment of role-specific responsibilities and accountability measures.

Create a RACI (Responsible, Accountable, Consulted, Informed) matrix for clarity.

· Intake Process Design Review Customer’s intake objectives, criteria, and workflows.

Provide guidance on the development of standardized templates and scoring models for request submissions.

Outline prioritization and approval pathways for intake requests.

· Framework Implementation Plan Collaborate on a phased roadmap for rollout, including milestones and deliverables.

Provide guidance on Customer-led communication and training materials for stakeholder enablement.

Pilot the framework through a Sandbox proof of concept with a small group to refine processes.

· Pilot & Refine Assist Customer in selecting a representative pilot project and applying design principles to such project to test feasibility and impact.

Collect input and gather feedback from stakeholders and project teams to identify areas for improvement.

Refine framework and update design principles and supporting materials based on pilot learnings.

· Rollout & Continuous Improvement Assist Customer in launch readiness for framework with aligned tools and systems. Customer responsible for production launch.

Monitor performance and provide feedback.

Set up a feedback loop and periodic reviews for framework updates and enhancements.

2.2.2 Configure & Test. This subject area includes guidance and oversight relating to planning, designing, and executing large-customer Salesforce implementations. Outcomes may include:

A. Architecture Lead

i. Strategy & Governance

1. Architecture Design Authority Stand Up: Advise regarding governance structure design and formation

2. Architecture Design Authority Repository: Provide guidance on developing operational playbooks on policies and procedures intended to review Salesforce platform best practices across functional design, technical design, and feedback processes within implementations.

ii. Architecture Design Principles: Advise on design principles and standards

iii. Release Increment Planning Technical Oversight: Provide guidance on ongoing Program Increment planning and prioritization

iv. Pre-Build & Build Processes: Co-create playbooks with Customer across requirements gathering, design, development and deployment

v. Executive Engagement & Visioning: Assist executives to provide visioning and strategic architectural guidance.

vi. Enterprise Architecture Alignment: Provide guidance to align SFDC solution with enterprise systems to support long term vision

vii. Overall IT Architecture Roadmap Planning: Review and provide advice on overall IT roadmap B. Platform & Security Strategy

i. Org Strategy: Co-define with Customer the approach to Customer’s Org strategy and provide guidance for reliability and scalability.

ii. Security and Compliance Reviews: Review Customer’s security model to help Customer meet its regulatory requirements and standards.

C. Technical & Solution Design

i. Solution Architecture: Review and provide guidance on the overall solution architecture

ii. Discuss SFDC Product Roadmap

iii. Design Reviews: Review of technical designs for adherence to Salesforce platform best practices, tailored to Customer’s needs

iv. Tooling Assessment: Review and, as appropriate, recommend tools used in the implementation

v. Integration Strategy: Advise on integration strategy with other enterprise systems D. Solution Implementation Oversight

i. Architecture Optimization: Provide guidance on architecture optimization and technical debt reduction

ii. Data Governance and Quality Strategy: Support the definition of processes to maintain high data quality

iii. Build Best Practices: Review and advise on build best practices

iv. Build Reviews: Support build reviews to support quality and compliance

v. Development Troubleshooting & Solutioning: Provide guidance on troubleshooting and solutioning of development issues E. DevOps & Release Management

i. DevOps Strategy Development

1. Review existing DevOps maturity

2. Assist in defining the overall DevOps strategy for the Salesforce platform, including goals, processes, and tools to be used

ii. Environment Planning: Review and provide recommendations for environment planning.

iii. Test Strategy: Provide guidance on testing approach and best practices F. Program Executive

i. Strategic Planning & Execution: Co-create and support Customer’s execution of comprehensive transformation strategy and roadmaps in alignment with the existing technology architecture

ii. Governance

1. Provide guidance on program governance structures and methodologies for optimal project and program steering, consistent delivery and performance monitoring

2. Provide support for effective program management practices to monitor and control progress, quality, costs, issues & risks and internal & external program resources

3. Provide guidance on program reporting processes and co-create program monitoring against the transformation program goals and roadmaps

iii. Stakeholder Engagement

1. Engage with Customer key stakeholders, including executives, department heads, and Customer’s external partners for buy-in and support

2. Advise on progress, challenges, and successes to stakeholders, providing periodic updates and reports

iv. Scope Management: Provide guidance on managing program scope

v. Dependencies Management: Support effective management of dependencies across the Salesforce implementation, for smooth, efficient, and predictable outcomes

vi. Cost Management: Review and support management the allocated budget to achieve the program goals

vii. Risk Management: Review potential risks and recommend mitigation strategies to minimize impact on program delivery

viii. Performance Measurement

1. Assess and identify, with Customer’s input, key performance indicators (KPIs) and metrics to track the success and impact of the program

2. Provide guidance on periodic performance reviews and recommend adjustment of strategies as needed to achieve desired outcomes

2.2.3 Data Governance. This subject area includes guidance to establish governance for data decisions on Salesforce, enabling clear ownership, defensible controls, and compliance-ready adoption. Focus areas may include:

· Data Ownership & Stewardship Model

a. Assist in identifying systems of record and authoritative data sources for priority use cases.

b. Recommend data stewardship roles and handoffs across domains.

c. Advise on data classification and sensitivity handling in accordance with Customer’s records retention requirements.

d. Define data migration approach and transformation activities to support approach.

e. Align data migration approach with Salesforce ecosystem framework (eg Informatica, MuleSoft, Tableau)

· Data Architecture Alignment (Conceptual)

a. Review conceptual data architecture that positions Data 360 as an activation layer.

b. Provide guidance on coexistence with enterprise data platforms (e.g., Snowflake, Databricks). Outline high-level data unification phases without prescribing implementation.

c. Review architectural alignment with governance controls.

· Governance Authority & Decision Rights

a. Recommend roles, responsibilities, and accountability for data ownership.

b. Advise on decision rights for:

i. Data access and stewardship

ii. Risk acceptance and escalation

c. Advise on governance structures (centralized council vs. federated model).

d. Advise on escalation paths and approval thresholds for high-risk scenarios.

· Risk Assessment & Approval Workflows

a. Advise on structured risk evaluation and approval processes.

b. Recommend Data risk assessment models covering:

i. Data quality and provenance

ii. Privacy and consent exposure

iii. Bias and unintended outcomes

c. Support consistent, repeatable decision-making across teams.

· Evidence Readiness & Documentation

a. Advise on documentation practices that are defensible and auditable.

b. Support Customer in creating evidence templates to support audits, certifications, and internal reviews.

c. Recommend storage strategies for governance artifacts.

d. Support documentation of:

i. Approval decisions

ii. Risk acceptance and mitigation strategies

iii. Data lineage and access rationale

e. Support reuse of evidence across audits and regulatory reviews.

· Data Governance Discovery

a. Interview stakeholders across Legal, Compliance, IT, Security, Data, and Business teams to understand current Data ambitions and constraints.

b. Identify applicable regulatory, privacy, and industry frameworks shaping data usage.

c. Review how data decisions are made today, including where decisions stall or lack ownership.

d. Identify common objections related to data quality, and data availability .

· Governance Toolkit Co-Creation

a. Assist Customer in building a reusable Data Governance toolkit.

b. Support Customer’s creation of templates such as:

i. Risk assessment questionnaires

ii. Approval scorecards

iii. Model cards and decision logs

c. Support development of operating guides for running governance reviews.

d. Review artifacts for alignment with customer context and decision scenarios.

e. Organize governance Package materials to support internal reuse by Customer.

· Enablement & Transition

a. Conduct working sessions to walk through governance workflows using real examples.

b. Coach leaders and practitioners on applying policies and tools.

c. Recommend updates to artifacts based on feedback from early use.

d. Advise on a transition plan for Customer-owned governance operations.

2.3 General Scope Assumptions

· Scope may be constrained by the complexity of the Customer’s technical requirements and data models, as well as the functionality and capabilities of the Application.

· Standard capabilities will be used where reasonably possible.

· Clicks-not-code configuration will be used where reasonably possible.

· Custom code will be used only if SFDC deems it necessary.

2.4 Scope Exclusions

Any work not specified in this SOW is considered out of scope, including but not limited to the following:

· Overall project management including project planning and resource planning;

· Primary responsibility for project outputs;

· Management of Customer or 3rd party resources;

· Custom APIs;

· Mobile app configuration and development;

· Data migration, transformation or cleansing (unless upon the written mutual agreement by both parties).

3 Schedule and Professional Services Fees

3.1 Schedule

SFDC estimates the project to be twelve (12) months. This estimation is based on SFDC's assumption that it will be able to perform the Professional Services without delays initiated by Customer or Client. The Professional Services will begin on a start date to be mutually agreed in writing (email acceptable) but no sooner than four (4) weeks after this SOW’s Effective Date. This SOW and the resources and rates included will expire twelve (12) months after SOW Effective Date. Extensions and any rate increases will require a fully executed Change Order.

3.2 Fees

3.2.1 Time and Material Fees

Professional Services are provided on a time and materials (“T&M”) basis. The estimated total Fees are provided in the table below. This T&M estimate is based upon initial discovery performed prior to signature of the SOW and the actual Fees may be more or less than the estimate below. A Change Order will be required if the Fees exceed the estimated total below. Any change in resources or moving of hours between resources requires a Change Order before such change occurs, unless Customer obtains written notice from the Client’s authorized representative confirming a Change Order is not required for such change.

All Fees for actual hours worked and taxes (if applicable) associated with the Professional Services will be invoiced monthly and payable in accordance with the terms of the Agreement.

The table below defines the annual rate structure for this SOW and the associated estimated Fees by resource type to perform the Professional Services described in this SOW during the SOW Term.

Engagement Manager

Salesforce CTO (Expertise Hours)

Solution Architect

Customer will provide SFDC with reasonable advance notice for any resource and role intended to be consumed. The parties will work together reasonably and in good faith to ensure that sufficient notice is provided to enable SFDC to staff any projects appropriately.

3.3 SFDC Investment - Salesforce CTO Courtesy Hours

The Salesforce CTO hours listed above for $0 (“Courtesy Hours”) are subject to the following Courtesy Hours Conditions and Exclusions.

Courtesy Hours Conditions SFDC’s Courtesy Hours are subject to the following conditions (“Courtesy Conditions”) :

· Courtesy Hours will be provided throughout the term of the SOW

· Unused Courtesy Hours will expire upon conclusion or termination of the SOW

· Courtesy Hours will be forfeited if the SOW is terminated pursuant to Section 5.3 Courtesy Hours Exclusions:

· Courtesy Hours may not exceed the quantity of hours provided above.

· Courtesy Hours may not be used to perform Professional Services other than the Salesforce CTO scope above.

· Courtesy Hours may not be used on any other SOW or Change Order.

3.4 Travel and Related Expenses

“T&E” means all travel-related and other expenses, including but not limited to transportation, mileage, and reasonable out-of-pocket expenses, incurred by SFDC in connection with the Professional Services. T&E is currently estimated at $25,000. SFDC will receive written approval (email acceptable) prior to traveling in connection with Professional Services.

4 Customer Responsibilities SFDC expects to execute the activities outlined in this SOW as an uninterrupted stream of work. Timely and successful performance of the Professional Services pursuant to this SOW requires ongoing collaboration between SFDC and Customer. Customer is responsible for certain key tasks, contributions and timely reviews to enable SFDC to perform its obligations under this SOW. Any delays in the performance of the Professional Services caused by Customer may result in additional applicable charges for resource time. SFDC shall have no liability for any delays or other damages caused by Customer’s failure to meet its obligations. Customer will ensure that its Client is contractually bound by the Customer requirements, assumptions, and acknowledgements in this Section 4.

4.1 Customer Resource Requirements

Customer Team Customer will make available appropriately skilled and knowledgeable Customer resources to provide active and continuous participation, including but not limited to timely review, feedback, approvals and decision making. Customer will assign a project manager responsible for directing the activities of the SFDC personnel delivering the Professional Services.

Technology and Application Access

· Customer will procure, install, host, test, deploy, monitor and maintain equipment, infrastructure, hardware, software, technical infrastructure, stable internet with sufficient bandwidth, and other technology, including patches and upgrades of each of the foregoing, required to enable provisioning of the Professional Services.

· Customer will identify and enable permissions for SFDC personnel as system administrators or users of Customer's Application instances as reasonably necessary for the provision of the Professional Services. SFDC may download log file data and upload data files to perform its duties.

· SFDC will have access only to the Customer’s Application and not to Customer’s non-SFDC systems including but not limited to: internal enterprise platform, buying platforms, ad servers, third-party applications, time logging systems, project management systems, and defect management tools.

Coordination and Location of Services The Professional Services described in this SOW will be delivered virtually, unless otherwise mutually agreed by the parties in writing (email sufficient). If work is performed on-site at a facility of Customer or any of its Affiliates, then Customer will provide, at no charge to SFDC, office workspace, suitably configured computer equipment, stable internet with sufficient bandwidth, and access to appropriate and knowledgeable employees and agents of Customer. Work performed on-site is subject to T&E in accordance with Section 3.

4.2 Customer Obligations

Data Source Availability

· Customer will have one or more of its data sources ready for import prior to the start of the Professional Services.

· External data imported as part of automation must be in the SFDC defined format.

· Customer will provide SFDC with access to the data sources to be integrated and required end-points.

· Non-API data sources will be provided in the SFDC defined format.

Data Quality Customer is responsible for data quality, including but not limited to:

· Data transformation, cleansing, aggregation, merging, and de-duplication of Customer’s import or exports;

· Data configuration, extract processing, and quality assurance testing of data prior to submitting to SFDC;

· Deletion or overwriting of data records; and

· Data integration tasks after the files reach their defined end points.

Creative Assets Customer will identify, procure, and provide SFDC with creative content, including but not limited to:

· Copywriting and language translations;

· Design, development, content, branding guidelines; and

· Graphic assets including but not limited to: fonts, logos, links, stock photography, graphics, HTML code and .PSD files.

Use of Services Customer is responsible for its use and distribution of the Application including any configuration work associated with the Professional Services.

Third Parties Customer is responsible for the acquisition, contracting, licensing, and associated costs of third-party applications. Customer is responsible for the integration with third-party applications, unless otherwise defined as in scope in Section 2. Customer is responsible for coordination and management of third-party providers or vendors that may be involved in the project. SFDC is not responsible for and does not warrant third-party products or services.

Customer acknowledges and agrees that third-party applications, including but not limited to third-party applications available on the AppExchange, and anything related to the performance or functionality of any such application, is not the responsibility of SFDC. Customer is responsible for installation, implementation, configuration, and maintenance to support third-party applications. Customer will ensure that third-party integration tools and related infrastructure are in place within reasonable time frames for the performance of the Professional Services. SFDC will not have a direct line to providers of APIs or any of Customer’s third-party vendors.

If necessary, Customer will provide sufficient access to third-party contacts to SFDC as required for SFDC to perform its obligations hereunder. SFDC will take direction or assignment of the Professional Services only from Customer and not from Customer’s third-party provider.

4.3 Customer Acknowledgements

SFDC Resources

· Customer’s execution of this SOW constitutes its express consent for SFDC to use subcontractors to perform Professional Services. SFDC will be responsible for the performance of the Professional Services by its personnel (including employees and contractors) and their compliance with SFDC’s obligations under this SOW, except as otherwise specified herein.

· All work conducted by resources under this SOW are considered billable Professional Services and are not related to entitlement services provided by SFDC programs (e.g. Product Support, Customer Success, etc.). Customer will submit and oversee general technical support cases to the Salesforce support team. SFDC will not perform general technical support duties under this SOW.

· SFDC will provide proficiency on the Application exclusively and makes no guarantee that resources are proficient in other programming languages or platforms.

· Unless otherwise mutually agreed during the Define stage, the Professional Services will be performed during normal business hours (Monday – Friday, 8:30 a.m. - 5:30 p.m. in the time zone of the location where the Professional Services resource is located, unless otherwise agreed in writing by the parties (email sufficient)), excluding holidays. Scheduling work outside of such normal business hours (“After-Hours Work”) requires staffing considerations and needs to be planned at least twenty (20) business days in advance of need.

5 General Terms To be provided in full contractual SOW

Notice of Confidentiality. This document is Salesforce inc. Proprietary and Confidential Information. Neither this document nor its contents may be revealed or disclosed to unauthorized persons or sent outside the aforementioned institution without prior permission from Salesforce, Inc. © 2015-2022 Salesforce Salesforce Inc., All rights reserved