PS-3._Exhibit_C_C5-CMCS-G1_531_IRR_Tech_SOW_012826.docx

Bidder’s Name

INVITATION FOR BID

IFB C5-CMCS-G1-26

CALNET Managed Cybersecurity Services

CATEGORY 531 – MANAGED INCIDENT RESPONSE RETAINER SERVICE

<Enter Bidder Name Here> Statement of Work

TECHNICAL REQUIREMENTS

PRE-SOLICITATION

JANUARY 28, 2026

Issued by:

STATE OF CALIFORNIA

Office of Statewide Technology Procurement PO Box 1810 Rancho Cordova, CA 95741 Disclaimer: The original PDF version and any subsequent addenda to this IFB remain the official version. In the event of any inconsistency between the Bidder’s versions, articles, attachments, exhibits, specifications, or provisions, which constitute the Contract, the official State version of the IFB in its entirety shall take precedence.

ADDENDUM LOG

Table of Contents

Statement of work TECHNICAL REQUIREMENTS Category 531 MANGED Incident Response Retainer Service

531.1 OVERVIEW

The California Department of Technology (CDT), Office of Statewide Technology Procurement (OSTP) is requesting proposals from responsive Bidders to provide Managed Incident Response Retainer (IRR) Services and Features.

This Invitation for Bid (IFB) CMCSC5-CMCS-G1-26 Category 531 provides the State’s solicitation for best value solutions for Managed IRR Service. This IFB also describes the technical Requirements necessary to support the CALNET Program Requirements.

This IFB will be awarded to Bidders that meet the award criteria as described in IFB C5-CMCS-G1-26 Part 1, Bid Evaluation. The CALNET 5 CALNET Managed Cybersecurity Services (CMCS) Contract(s) that result from the award of this IFB will be managed on a day-to-day basis by CALNET Management and Oversight (CMO).

531.1.1 Bidder Response Requirements

Throughout this IFB, the Bidder is required to confirm their understanding and acceptance of the Requirements by selecting a response in the provided drop-down field.

Example:

“The Bidder understands and shall meet or exceed the Requirements identified in Section 531.X Section Name? Choose an item.”

531.1.2 Designation of Requirements

All technical Requirements specified in this IFB are mandatory and must be responded to as identified in IFB Part 1, SOW mandatory technical Requirements by the Bidder. Additionally, some mandatory Requirements are “Mandatory-Scorable” and are designated as “(M-S).”

531.1.3 Statewide Policies and Standards

The Contractor’s Managed IRR Service shall be aligned with policies and standards set forth in the Statewide Information Management Manual (SIMM) Section 5300, Information Security (SIMM 5340-A Incident Reporting and Response Instructions, and SIMM 5340-C Requirements to Respond to Incidents Involving a Breach of Personal Information).

531.1.4 Pacific Time Zone

Unless specified otherwise, all Requirements are stated in the Pacific Time Zone and the Contractor shall use the Pacific Time Zone.

The Bidder understands and shall meet or exceed the Requirements identified in Section 531.1 Overview? Choose an item.

531.2 MANAGED INCIDENT RESPONSE RETAINER SERVICE

The Contractor’s Managed IRR Service provides Customers with on-demand access to expert incident response capabilities to prepare for, investigate, contain, and recover from cybersecurity incidents.

531.2.1 Managed IRR Service and Features

The Contractor shall provide an active incident response retainer Service that ensures 24x7x365 availability of qualified responders; rapid activation and triage; and the ability to mobilize technical, forensic, and investigative resources as needed.

The Contractor’s IRR Service shall ensure that response personnel performing incident response, digital forensics, malware analysis, threat intelligence, and incident coordination functions possess demonstrated knowledge, skills, and abilities consistent with the applicable work roles defined in NIST-NICE Workforce Framework.

Incident response activities shall operate under a shared responsibility model, under which specific response functions may be delegated to the Contractor while overall governance and decision authority remain with the Customer, except where explicitly authorized. The Contractor shall not take unilateral actions that materially impact Customer systems, services, or data, nor disclose incident-related information outside of authorized coordination channels, except as approved by the Customer or required by law. The Contractor shall protect Customer information accessed during incident response activities, including information accessed through privileged system access.

The Contractor’s IRR Service includes response readiness, activation, initial remote triage, containment guidance, and incident coordination activities necessary to support the Customer during an active cybersecurity event.

The Contractor's Managed IRR Services shall include the following Services and Features at a minimum.

531.2.1.1 Provisioning and Onboarding

The Contractor shall establish and maintain an active Incident Response Retainer that includes Customer onboarding, environment familiarization, and the development, review, or integration of incident response governance, escalation paths, communication protocols, and incident coordination procedures.

As part of onboarding, the Contractor shall collaborate with the Customer to review, integrate with, or assist in the development of the Customer’s Incident Response Plan, including defined roles, responsibilities, escalation criteria, communication procedures, and the Contractor’s authority to act during cybersecurity incidents. The Contractor’s services shall align with the Customer’s documented incident response procedures and applicable statewide coordination Requirements.

The Contractor shall work with the Customer to identify and document incident notification and coordination Requirements, including circumstances under which coordination with statewide or external entities may be required, and to define communication pathways and responsibilities to ensure appropriate entities are notified and engaged in a timely manner during cybersecurity incidents.

Environment familiarization shall be substantive and shall include, at a minimum, review of relevant network and system architecture, identity and access management constructs, endpoint management and logging coverage, and communication paths required to support rapid and effective incident response.

As part of onboarding process or effort, the Contractor shall provide initial baseline orientation or training to the Customer to ensure familiarity with incident response processes, procedures, roles, escalation mechanisms, and expectations associated with the Contractor’s Managed Incident Response Retainer Service.

At a minimum, this orientation shall address:

Incident identification, declaration, and activation criteria;

Roles and responsibilities of the Customer and the Contractor during incident response;

Escalation procedures and decision authority;

Communication and reporting mechanisms; and Coordination expectations during active incidents.

The Contractor shall support or facilitate tabletop exercises, scenario walkthroughs, or readiness reviews to validate understanding of incident response procedures and confirm that roles, escalation paths, and communication processes are operational prior to an actual incident.

The Contractor shall validate Customer points of contact, establish secure communication channels, and confirm access methods required to support rapid response activities.

531.2.1.1.1 IRR Readiness Completion Notice

The Contractor shall provide the Customer with an IRR Readiness Completion Notice documenting Incident Response Retainer onboarding and readiness activities have been completed. The Contractor’s Completion Notice shall include the following items at a minimum:

Documentation of Customer incident response points of contact;

Identification of secure communication and activation methods for initiating IRR Services;

Documentation of incident response escalation paths, coordination procedures, and Contractor roles and responsibilities; and, Confirmation that the Contractor is operationally prepared to activate and deliver IRR Services in accordance with the Contract.

The Contractor must obtain Customer acceptance and approval of the IRR Completion Notice in writing, within 30 calendar days of confirmation that the Contractor has completed onboarding activities and is operationally prepared to render IRR activities.

531.2.1.2 Monitoring, Response Availability, and Mobilization The Contractor shall maintain continuous 24x7 availability of qualified incident responders who can be activated on-demand. The Contractor’s IRR Service shall include activation, initial triage, scoping, containment guidance, and incident coordination activities. When required, additional hands-on technical, forensic, investigative, or on-site support shall be provided under the hourly Consulting Services defined in Section 531.2.3.1.

531.2.1.3 Incident Analysis, Containment, and Remediation Support The Contractor shall perform initial incident triage, conduct scoping analysis, provide containment recommendations, and coordinate response activities with the Customer.

Technical labor such as evidence collection, deep forensic analysis, malware examination, extended containment engineering, and eradication efforts shall be performed under the hourly Consulting Services defined in Section 531.2.3.1.

531.2.1.4 Forensics, Threat Intelligence, and Reporting

The Contractor shall collect relevant evidence and correlate observed artifacts with known malicious activity and attacker behaviors to provide actionable context supporting detection, containment, eradication, and recovery activities.

Threat intelligence provided as part of the Managed IRR Service shall be narrowly scoped to information directly applicable to the incident and the Customer’s network defense operations, including, as applicable, observed or suspected tactics, techniques, and procedures (TTPs), indicators of compromise (IOCs), and recommended mitigations such as patches, configuration changes, or workarounds. Strategic or generalized threat actor profiling shall not be required unless specifically requested by the Customer.

Initial incident reports, executive summaries, and lessons-learned materials incorporating such incident-relevant threat intelligence are included in the monthly Managed IRR recurring price.

Where appropriate, the Contractor shall support timely sharing of incident-related threat information in commonly accepted, structured formats to enable coordination with authorized partners or other defenders, consistent with Customer direction and information-sharing restrictions.

The Contractor shall not disclose or share incident related information, including indicators, findings, or derived analysis, with any third-party without the Customer’s explicit authorization, except where disclosure is required by law.

Detailed forensic reporting, malware analysis documentation, and large-scale compromise assessments shall be billed under the hourly Consulting Services defined in Section 531.2.3.1.

531.2.1.5 Post-Incident Support and Continuous Improvement

The Contractor shall support the Customer in post-incident review activities, including recovery validation, response procedure refinement, and security control tuning. Participation in lessons-learned sessions is included in the IRR Service. Additional technical remediation work shall be billed under Consulting Services.

Activities requiring hands-on technical execution, forensic acquisition, deep malware analysis, reverse engineering, extended containment engineering, or multi-day investigative work shall not be considered part of the subscription IRR Service and shall instead be billed under the Managed IRR Consulting Services defined in Section 531.2.3.1.

The Contractor shall provide the Managed IRR Services and Features listed in Table 531.2.1.a.

Table 531.2.1.a – Managed IRR Services and Features

Service

531.2.2 Contractor’s Initial Contact Response Time

The Contractor shall ensure rapid response times when a cybersecurity event is suspected or identified.

Initial Contact Response Time is defined as the amount of time the Contractor guarantees initial Contact with the Customer’s Authorized End-User(s) after an incident has been detected, or notification has been made by the Customer.

The Contractor shall provide a commitment level for Initial Contact Time in Table 531.2.2.a below.

Table 531.2.2.a – Contractor’s Initial Contact Response Commitment Timeframe (M-S)

(B, S or P)

531.2.3 Additional Managed IRR Services and Features

531.2.3.1 Managed IRR Consulting Services

The Contractor’s Managed IRR Consulting Services shall only be utilized in conjunction with the Contractor’s CALNET Managed IRR Service.

The Contractor’s Managed IRR Consulting Services shall provide billable technical labor for incident response activities that exceed Requirements in Section 531.2.1.

The Contractor’s Managed IRR Consulting Services are only to be used for those Consulting Services described below (Section 531.2.3.1, Section 531.2.3.1.2, and Section 531.2.1.3) and are considered outside the instance of a working Service as defined by the General Provisions – Telecommunications, Section 15.12, Goods and Services Costs.

Consulting Services shall be billed hourly at the rates established in Table 531.2.3.1.a. below.

531.2.3.1.1 Technical Incident Response Support

The Contractor shall provide technical incident response consulting Services to assist Customers with:

Detailed incident triage and extended scoping;

Host- and network-based forensic acquisition and analysis;

Malware analysis and reverse engineering;

Deep log analysis, artifact review, and threat hunting;

Advanced containment engineering and eradication activities; and, Specialized analysis required for major or multi-agency incidents.

531.2.3.1.2 Incident Management and Coordination

The Contractor shall provide incident management and command-level consulting Services to assist Customers with Senior incident coordination and Incident Commander leadership;

Stakeholder communication and escalation management;

Regulatory, reporting, and compliance coordination;

Multi-agency or enterprise-wide incident response management; and, Documentation and support of recovery and eradication planning.

531.2.3.1.3 On-Site Incident Response Services

The Contractor shall provide on-site incident response consulting Services to assist Customers with:

Physical forensic collection, interviews, and asset handling;

On-site containment or eradication assistance;

On-site response support where remote analysis is insufficient; and, Support for incidents involving disconnected, air-gapped, or restricted systems.

531.2.3.2 Minimum Personnel Qualifications for IRR Consulting Service Personnel assigned to provide Managed IRR Consulting Services shall be aligned to applicable work roles defined in the NIST-NICE Workforce Framework. NIST-NICE work role titles and identifiers referenced in this Section are provided for workforce alignment purposes. Contractors may map personnel to successor or equivalent NIST-NICE work roles where the framework is updated, provided the underlying work functions and competencies remain equivalent.

The Contractor shall ensure that all personnel assigned to provide Managed IRR Consulting Services possess the experience, skills, and documented capabilities necessary to perform the required activities.

The Contractor shall provide personnel who meet or exceed the minimum qualifications listed below.

Upon request by the CALNET Program or the Customer, the Contractor shall provide resumes, certifications, or documentation demonstrating compliance with these Requirements.

531.2.3.2.1 Senior Incident Responder

Minimum Qualifications (Aligned to NICE PD-WRL-003 – Incident Response) The Contractor’s personnel assigned to perform duties shall meet the following minimum qualifications:

A minimum of five (5) years of documented experience conducting cybersecurity incident response activities in enterprise environments.

Demonstrated experience performing incident triage, scoping, containment, eradication, and recovery, including at least three (3) incidents involving ransomware, credential compromise, lateral movement, cloud account compromise, or business email compromise.

Demonstrated proficiency with at least two (2) categories of investigative tools, including:

EDR platforms;

Network packet capture or traffic analysis tools; or, Memory analysis tools.

Demonstrated familiarity with adversary techniques based on MITRE ATT&CK or equivalent frameworks.

Preferred Certifications: GCIH, GCFA, GNFA, CISSP, CISM, OSCP.

531.2.3.2.2 Incident Commander

Minimum Qualifications (Aligned to NICE PD-WRL-003 – Incident Response) The Contractor’s Personnel assigned to perform Incident Commander duties shall meet the following minimum qualifications:

A minimum of seven (7) years of documented cybersecurity incident response experience, including acting as lead coordinator or commander for at least five (5) medium- or high-severity incidents.

Demonstrated experience producing executive-level communications, including situation reports, briefings, timelines, and incident summaries.

Demonstrated experience coordinating incident activities across multiple teams or agencies.

Demonstrated familiarity with incident response processes aligned to NIST SP 800-61.

Preferred Certifications: CISSP, CISM, GCIH, GCFE.

531.2.3.2.3 Digital Forensic Analyst

Minimum Qualifications (Aligned to NICE PD-WRL-002 – Digital Forensics) The Contractor’s Personnel assigned to perform Digital Forensics duties shall meet the following minimum qualifications:

A minimum of three (3) years of documented digital forensic analysis experience.

Demonstrated experience performing forensic imaging, evidence preservation, chain of custody documentation, and analysis of disk, memory, and log artifacts.

Demonstrated proficiency in at least one (1) industry-standard forensic tool, such as:

EnCase

FTK

X-Ways Cellebrite Magnet Axiom Preferred Certifications: EnCE, GCFA, CHFI.

(Note: Tool-specific certification may be required when necessary to support tool use.)

531.2.3.2.4 Malware Analyst / Reverse Engineer

Minimum Qualifications (Aligned to NICE IN-WRL-002 – Digital Evidence Analysis) The Contractor’s Personnel assigned to perform Malware Analysis duties shall meet the following minimum qualifications:

A minimum of three (3) years of documented malware analysis or reverse engineering experience.

Demonstrated proficiency using at least two (2) static or dynamic analysis tools, including:

IDA Pro Ghidra x64dbg or OllyDbg Cuckoo Sandbox Experience analyzing malware associated with at least three (3) categories, including ransomware, loaders, RATs, web shells, or credential harvesters.

Preferred Certification: GREM.

531.2.3.2.5 Threat Intelligence Analyst

Minimum Qualifications (Aligned to NICE PD-WRL-006 – Threat Analysis) The Contractor’s Personnel assigned to perform Threat Intelligence duties shall meet the following minimum qualifications:

A minimum of three (3) years of documented experience producing tactical or operational cyber threat intelligence.

Demonstrated experience using the MITRE ATT&CK framework for adversary mapping or threat correlation.

Demonstrated experience correlating threat intelligence with incident data to support scoping and containment.

Demonstrated experience producing written assessments or threat actor reports.

Preferred Certifications: CTIA, GCTI.

531.2.3.2.6 On-Site Incident Response Responder

Minimum Qualifications (Aligned to NICE PD-WRL-003 – Incident Response) The Contractor’s Personnel assigned to perform on-site incident response duties shall meet the following minimum qualifications:

A minimum of three (3) years of hands-on incident response or cybersecurity investigation experience.

Demonstrated experience conducting host triage, log collection, evidence gathering, and endpoint isolation.

Demonstrated familiarity with evidence handling and physical chain of custody procedures.

Ability to support on-site response activities in disconnected, restricted, or sensitive environments.

Demonstrated ability to communicate effectively with Customer technical staff, management, and other stakeholders during incident response activities, including the ability to clearly explain technical findings, response actions, and next steps in both verbal and written form.

Demonstrated experience organizing, documenting, and presenting incident response activities and findings in a manner suitable for Customer review, coordination, and decision-making during active incidents.

Preferred Certifications: GCIH.

The Contractor shall offer all IRR Consulting Services in Table 531.2.3.1.a.

Table 531.2.3.1.a – Managed IRR Consulting Services

Service

Service

Service

Service

Service

Service

531.2.4 Managed IRR Geographic Service Area

The Contractor shall provide their Managed IRR Service statewide.

The Bidder understands and shall meet or exceed the Requirements identified in Section 531.2 Incident Response Retainer Service? Choose an item.

531.3 SERVICE LEVEL AGREEMENTS (SLA)

The Contractor shall provide Service Level Agreements (SLAs) as set forth below. The intent of this section is to provide Customers, the CALNET Program and the Contractor with Requirements that define and assist in the management of the SLAs. This section includes the SLA formats, general Requirements, Stop Clock Conditions, and the Technical SLAs for the Services identified in this solicitation.

531.3.1 Service Level Agreement Format

The Contractor shall adhere to the following format and include the content as described below for each Technical SLA added by the Contractor throughout the Contract Term:

SLA Name – Each SLA Name must be unique;

Definition - Describes what performance metric will be measured;

Measurements Process - Provides instructions on how the Contractor will continuously monitor and measure SLA performance to ensure compliance. The Contractor shall provide details describing how and what will be measured. Details should include source of data and define the points of measurement within the system, application, or network;

Service(s) - All applicable Services will be listed in each SLA;

Objective(s) – Defines the SLA performance goal/parameters; and, Rights and Remedies Per Occurrence: Rights and remedies are paid on a per event basis during the bill cycle; and, Monthly Aggregated Measurements: Rights and Remedies (as set forth below) are paid once during the bill cycle based on an aggregate of events over a defined period of time.

The Contractor shall apply a credit or refund when SLAs are missed as described in this section.

Missed Time-to-Activate SLA – Must be requested by the Customer:

Must be requested by the Customer when Time-to-Activate SLA Objective is not met. The Customer shall be responsible for providing specific details such as date(s), time(s), and documented requests or additional details that validate the Customer’s eligibility for the missed Time -to-Activate SLA. The Contractor shall accept SLA credit requests up to 60 calendar days after the missed Time-to-Activate SLA occurrence.

Missed Provisioning SLA – Proactively applied by Contractor:

The Contractor shall proactively apply a credit or refund when the Provisioning SLA Objective is not met. CALNET SLA Rights and Remedies for the Provisioning SLA do not require the Customer to submit a request for credit or refund.

531.3.2 Technical Requirements versus SLA Objectives

Sections 531.2 (Managed Incident Response Retainer Service), define the technical Requirements for each Service. These Requirements are the minimum parameters each Bidder must meet to qualify for Contract Award. Upon Contract award the committed technical Requirements will be maintained throughout the remainder of the Contract.

Committed SLA Objectives are minimum parameters which the Contractor shall be held accountable for all Rights and Remedies throughout the Contract Term.

531.3.3 Methods of Outage Reporting: Customer or Contractor

There are two methods in which CALNET Service failures or quality of Service issues may be reported and Contractor trouble tickets opened: Customer reported, or Contractor reported.

The first method of outage reporting results from a Customer reporting Service trouble to the Contractor’s Customer Service Center via phone call, opening of a trouble ticket, or through the Contractor’s portal.

The second method of outage reporting occurs when the Contractor opens a trouble ticket as a result of network/system alarm or other method of Service failure identification.

531.3.4 Response to Service Level Agreements

Many of the Service Level Agreements described below include multiple Objective levels – Basic, Standard and Premier. Bidders shall indicate one specific Objective level they are committing to for each Service in the space provided in the “Objective” section of each SLA description.

531.3.5 Contractor SLA Management Plan

Within 90 calendar days of Contract Award, the Contractor shall provide the CALNET Program with a detailed SLA Management Plan that describes how the Contractor will manage the Technical SLAs for Services in this IFB. The plan will be updated as needed by the Contractor and the State throughout the Contract Term. The SLA Management Plan shall define the following:

Contractor SLA manager and supporting staff responsibilities;

Contractor’s process for measuring Objectives for each SLA. The process shall explain how the Contractor will continuously monitor and measure SLA performance to ensure compliance. The Contractor shall provide details describing how and what will be measured. Details should include source of data and define the points of measurement;

Creation and delivery of SLA Reports;

SLA invoicing credit and refund process;

Contractor SLA problem resolution process for SLA management and SLA reporting. The Contractor shall provide a separate process for Customers and CALNET Program;

Contractor SLA Manager to manage all SLA compliance and reporting; and, The Contractor shall include SLA Manager contact information for SLA inquiries and issue resolution for Customer and CALNET Program.

531.3.6 Technical SLA General Requirements

The Contractor shall adhere to the following general Requirements which apply to all CALNET Technical SLAs (Section 531.3.8):

With the exception of the Provisioning SLA (Section 531.3.8.3), the total SLA rights and remedies for any given month shall not exceed the sum of 100% of the Total Monthly Recurring Charges (TMRC);

If a Service fails to meet one or more of the performance Objectives, only the SLA with the largest monthly Rights and Remedies will be credited to the Customer, per event;

The Contractor shall apply CALNET SLAs and Rights and Remedies for Services provided by Subcontractors and Affiliates;

The Definition, Measurement Process, Objectives, and Rights and Remedies shall apply to all Services identified in each SLA. Exceptions must be otherwise stated in the SLA;

TMRC Rights and Remedies shall include the Service, option(s), and Feature(s) charges.

The Contractor shall proactively and continuously monitor and measure all Technical SLA Objectives.

The Contractor shall proactively credit all Rights and Remedies to the Customer within 60 calendar days of the trouble resolution date on the trouble ticket or within 60 calendar days of the Due Date on the Service Request for the Provisioning SLA.

To the extent that the Contractor offers additional SLAs, or SLAs with more advantageous rights and/or remedies for the same or similar services offered through tariffs, online service guides, or other similarly situated government contracts (Federal, State, County, City), the State will be entitled to the same rights and/or remedies therein. The Contractor shall present the SLAs to CALNET Program for possible inclusion via amendment;

The Contractor shall apply CALNET 5 CMCS SLA Rights and Remedies to Services provided in all areas the Contractor provides Service;

The election by CALNET Program of any SLA Rights and Remedies covered by this Contract shall not exclude or limit CALNET Program or any Customer's Rights and Remedies otherwise available within the Contract or at law or equity;

The Contractor shall apply Rights and Remedies when a Service fails to meet the SLA Objective even when backup or protected Services provide the Customer with continuation of Services;

The Contractor shall act as the single point of contact in coordinating all entities to meet the State’s needs for provisioning, maintenance, restoration and resolution of Service issues or that of their Subcontractors and Affiliates under this Contract;

The Customer Escalation Process and/or the CMO Escalation Process shall be considered an additional Right and Remedy if the Contractor fails to resolve Service issues within the SLA Objective(s);

Trouble reporting and restoration shall be provided 24x7 for CALNET Services;

SLAs apply 24x7 unless the SLA specifies an exception;

The Contractor invoices shall clearly cross reference the SLA credit to the Service ID in accordance with SOW Business Requirements Section CMCS-G1.5 (Invoicing);

The Contractor shall provide a CALNET 5 CMCS SLA Manager responsible for CALNET 5 CMCS SLA compliance. The SLA Manager shall attend regular meetings and be available upon request to address CALNET Program SLA oversight, report issues, and problem resolution concerns. The CALNET 5 CMCS SLA Manager shall also coordinate SLA support for Customer SLA inquiries and issue resolution;

The Contractor shall provide Customer and CALNET Program support for SLA inquiries and issue resolution.

531.3.7 Trouble Ticket Stop Clock Conditions

Only the following conditions shall be allowed to stop the duration of the Service Level Agreements. The Contractor shall document durations using the Stop Clock Condition (SCC) listed in Table 531.3.7, which must include start and stop time stamps in the Contractor’s trouble ticket reporting tool or Contractor’s provisioning service request tool for each application of a SCC.

The Contractor shall not consider “cleared while testing” or “no trouble found” as a SCC.

The Contractor observation timeframes, not requested by End-User, after incident resolution shall not be included in Outage Duration reporting.

Table 531.3.7 – Stop Clock Conditions

· The Contractor cannot proceed with remote or on-site response activities because the Customer has not arranged required system access, credentials, VPN permissions, or endpoint/network visibility needed to perform IRR functions;

· A designated Customer representative refuses or denies access (remote or physical) necessary for the Contractor to conduct investigation, containment, or forensic acquisition, despite the Contractor presenting proper identification or access justification;

· The Customer provides incorrect or outdated contact information, system access details, or authorization points, which prevents the Contractor from obtaining the access required to perform IRR activities, provided that the Contractor takes reasonable steps to notify the Customer and obtain updated information; or,

· The Customer environment has limited operational hours, security restrictions, or physical access requirements that directly impact the Contractor’s ability to perform on-site incident response tasks.

If it is later determined that the incident cause was not dependent on the system, site, or access in question, the Access Stop Clock Condition shall not apply.

531.3.8 Technical Service Level Agreements (SLAs)

The Contractor shall provide and manage the following Technical SLAs.

531.3.8.1 Time to Activate (TTACT) (M-S)

SLA Name: Time to Activate (TTACT) Definition:

The elapsed time from when the Customer reports a cybersecurity incident or the Contractor independently detects a qualifying event, to the moment the Contractor formally activates and documents the Incident Response Retainer (IRR) engagement and initiates response actions.

Response actions may include activities such as establishing an incident response case, initiating an incident coordination channel, or commencing initial triage activities; however, completion of such activities is not required for SLA measurement purposes unless otherwise specified.

Customer Responsibilities:

The Customer must notify the Contractor within 60 calendar days where the TTACT SLA metric was not met.

The Customer shall be responsible for providing specific details such as date(s), time(s), and documented requests or additional details that validate the Customer’s eligibility for the missed TTACT SLA. The Contractor shall accept SLA credit requests up to 60 calendar days after the missed TTACT SLA occurrence.

Measurement Process:

The Contractor shall measure TTACT using timestamped logs from the Contractor’s ticketing, activation, or communication systems. Measurement shall begin at the earliest of:

Customer notification of an IRR activation request; or Contractor detection of an event requiring IRR activation.

Measurement ends when the Contractor has initiated IRR activation in accordance with documented procedures and notified the Customer’s designated Incident Manager of mitigation activities.

Services:

Managed Incident Response Retainer Service Objectives:

The Objective Time-to-Activate time will be:

(B) Standard (S) Premier (P) Bidder’s Objective Commitment (B, S or P)

Rights and Remedies:

Per Occurrence:

50% credit or refund of the TMRC for each End-User Service not meeting the committed Objective.

Monthly Aggregated Measurements:

N/A

531.3.8.2 Provisioning (M-S)

SLA Name: IRR Provisioning and Readiness Completion Definition:

The IRR Provisioning and Readiness Completion SLA measures the time required for the Contractor to complete all onboarding and readiness activities necessary for the Customer to begin receiving the Managed Incident Response Retainer (IRR) Service.

Provisioning includes establishing secure communication channels, validating points of contact, confirming access methods, conducting environment familiarization, and documenting escalation and incident coordination procedures.

Provisioning does not include any technical labor related to incident response, forensics, remediation, or integration with Customer systems. Features must be installed in conjunction with the Service except when listed below.

Measurement Process:

Measurement begins when the Customer submits a valid IRR Service Request (SR) and the Contractor acknowledges receipt.

Measurement ends when the Contractor delivers the IRR Readiness Completion Notice to the Customer, confirming that all required onboarding and readiness activities have been completed.

Services:

Managed Incident Response Retainer Service Objectives:

Objective 1: Individual Service installation: Service provisioned on or before the due date per installation Service Request.

Per Occurrence:

If the Contractor does not meet the committed IRR Provisioning and Readiness interval, the Customer shall receive a credit equal to 50% of the Monthly Recurring Charge (MRC) for the IRR Service.

531.3.8.3 Service Enhancement SLAs

All Service enhancements shall be considered a Feature of the Service, and therefore shall be included as such under the SLAs.

531.5.8.4 Non-Mandatory Service Offerings

The Contractor shall provide SLAs as defined in SLA Section 531.5.8 for each Service added after Contract Award via Contract amendment that is determined by the CALNET Program not to be a Feature of a Service or a component of an unbundled Service. SLA tables shall be amended at time of Contract amendment to include all new Services.

531.3.8.5 Contract Amendment Service Enhancement SLAs

All Contract amendments for Service enhancements shall be considered a Feature of the Service, therefore included as such under the SLAs as defined in Section 531.3.

The Bidder understands and shall meet or exceed the Requirements identified in Section 531.3 Service Level Agreements (SLA)? Choose an item.