RFI_25NS0170_-_CAB_Integrated_Telephony.pdf

CPUC RFI# RFI 25NS0170

CAB Integrated Telephony

California Public Utilities Commission

Consumer Affairs Branch’s (CAB) Integrated Telephony (CIT)

Request for Information (RFI)

October 27, 2025

Contents

1. Introduction

2. Disclaimer

3. Key Action Dates

4. Reasonable Accommodation

5. RFI Format and Instructions

6. Respondent Costs

7. RFI Questions

8. CPUC Contact Information

9. Attachments and Exhibits

10. Solution Demonstrations

11. Business Background

12. Requirements

EXHIBIT A – LETTER OF INTEREST

EXHIBIT B – CPUC INFORMATION SECURITY PROVISIONS

List of Tables

Table 1- Abbreviations and Acronyms Table 2 – RFI Key Action Dates Table 3 – CPUC contact Table 4 - Attachments Table 5 – Functional requirement categories

List of Abbreviations and Acronyms

Table 1- Abbreviations and Acronyms

Abbreviations/ Acronyms

Meaning

ADA Americans with Disabilities Act

BRM Business Rules Manager

CAB Consumer Affairs Branch

CAR Consumer Affairs Representative

CIMS Consumer Information Management System

CIT CAB Integrated Telephony

CPUC or State California Public Utilities Commission

CSCR California State Contract Register

CSS Consumer Service Supervisor

DGS Department of General Services

GIS Geographic Information System

IT Information Technology

PII Personally Identifiable Information

PRA Public Records Act

PST Pacific Standard Time

RFI Request for Information

SAM State Administrative Manual

SFTP Secure File Transfer Protocol

SIC Supplemental Informal Complaint

WPA Web Portal Administrator

1. Introduction

Background The Consumer Affairs Branch’s (CAB) Consumer Information Management System (CIMS), deployed in 2009, is built on unsupported Oracle technology, with all vendor support ending in 2017. The system is obsolete, unstable, and increasingly difficult to maintain, with most programming work dependent on a single staff member due to the loss of Oracle expertise.

CIMS does not integrate with CAB’s call center software, forcing staff to manually enter and reconcile phone contact data with complaint records. This leads to incorrect entries, missing data, and a lack of real-time visibility into consumer interactions. Reports must be manually generated across multiple databases, creating inefficiencies, delaying response times, and compromising data integrity. As a result, over one-fifth (1/5) of consumer calls are status-check inquiries that could be resolved through better self-service tools.

Upgrading or replacing CIMS with an integrated, modern platform provides a critical opportunity to address these issues while transforming CAB’s operations. A holistic solution would:

• Automatically capture consumer case data at the point of phone contact, eliminating gaps and errors.

• Modernize the portal to allow consumers to track cases, receive updates, and communicate securely online.

• Enable seamless data sharing with utilities and partner divisions for faster, coordinated responses.

• Provide reliable, user-friendly reporting tools that improve transparency and stakeholder access to accurate information.

Without this modernization effort, CAB faces mounting risks to consumer data, diminished public trust, escalating maintenance costs, and continued service inefficiencies. If left unaddressed, outages and manual workarounds will continue to consume hundreds of staff hours annually, increase operational costs, and erode confidence among consumers, utilities, and policymakers.

2. Disclaimer

This Request for Information (RFI) is issued for informational and planning purposes only and does not constitute a solicitation. A response to this RFI does not create an offer and cannot be accepted by the CPUC to form a binding contract. Interested suppliers are solely and fully responsible for all expenses associated with responding to this RFI.

All materials submitted in response to this RFI will become the property of CPUC and, as such, are subject to the California Public Records Act (PRA) (Government Code Section 6250, et seq.). CPUC will disregard any language purporting to render all or portions of any Response confidential. If material marked “confidential,” “proprietary,” or “trade secret” is requested pursuant to the PRA, CPUC will make an independent assessment whether it is exempt from disclosure.

3. Key Action Dates

Respondents are requested to provide a written response to this RFI and, if requested, demonstrate their products and services. The Key Action Dates and times by which actions must be taken or completed are listed below. If CPUC finds it necessary to change any of these dates, an Addendum to this RFI will be posted on the State’s California State Contract Register (CSCR) at www.caleprocure.ca.gov.

Table 2 – RFI Key Action Dates

Key Action Date

Release of RFI 10/27/2025

Last Day to submit written questions regarding RFI

11/03/2025, 12:00 PM (PST)

CPUC’s Response to written Questions 11/07/2025

Last Day to Submit RFI responses 12/19/2025,12:00 PM (PST)

4. Reasonable Accommodation

To comply with the non-discrimination requirements of the Americans with Disability Act (ADA), it is the policy of the State to make every effort to ensure that its programs, activities, and services are available to all persons, including persons with disabilities. For persons with a disability needing a reasonable modification to participate in the RFI process, or for persons having questions regarding reasonable modifications for the RFI process, you may notify ITSolicitations@cpuc.ca.gov. To ensure we can meet your needs, submit your request for reasonable modification at least five (5) business days before the scheduled event or the due date of RFI documents.

5. RFI Format and Instructions

This RFI and the Respondent’s response to this document will be made part of the CPUC’s procurement file.

Responses must contain all requested information and data and conform to the format described in this section. It is the Respondent’s responsibility to provide all necessary information for the State to evaluate the response.

Respondents are welcome to submit multiple solutions for this RFI.

1. Before submitting a response, seek timely clarification of any requirements or instructions that are believed to be vague, unclear, or not fully understood by following the process outlined in Section 7, RFI Questions.

http://www.caleprocure.ca.gov/

2. Information submitted in the Respondent’s response should be straightforward, detailed, and precise. CPUC will measure the value of a response by its quality, not its volume, packaging, or colored displays.

3. Format requirements

a. Format the narrative portion of the response as follows:

i. Use one-inch margins at the top, bottom, and both sides.

ii. Use a font size of not less than 11 points.

4. Respondents are requested to respond to all applicable information in this RFI and attachments.

a. Respondents should respond to all applicable information in Attachments A, B, and C:

i. Attachment A – Letter of Interest

ii. Attachment B – Solution Cost Estimate

1. If submitting multiple solutions, complete a separate Attachment B for each.

iii. Attachment C – Respondent Questionnaire

5. Responses must include the applicable required attachments and be sent via email to the CPUC Information Technology (IT) Contract Administrator listed in Section 8, CPUC Contact Information.

6. Responses must be submitted by the specified dates and time stated in Table 2 –

RFI Key Action Dates. Responses received after these dates will not be reviewed.

6. Respondent Costs

The cost of preparing and submitting a response to this RFI is the responsibility of each respondent and will not be the responsibility of the State of California.

7. RFI Questions

Respondents must submit questions regarding this RFI via email by the specified date and time stated in the Key Action Dates to the email contact indicated in Section 8, CPUC Contact Information.

What to include in an inquiry:

1. Include in the subject line of the email: “CPUC RFI# 25NS0170 Question(s)”

2. Respondent name and contact, telephone number, email address.

3. A description of the subject, or issue in question, or discrepancy found.

4. RFI Section, page number, or other useful information in identifying the specific problem or issue stated in the question.

5. All questions and answers will be posted on the CSCR at www.caleprocure.ca.gov by the Table 2 – RFI Key Action Dates in Section 3.

http://www.caleprocure.ca.gov/

8. CPUC Contact Information

If interested in participating in the RFI, submit your response to the IT Contract Administrator listed below:

Table 3 – CPUC contact

CPUC IT Contract Administrator

Name: Russell Lee

Address: 505 Van Ness Avenue San Francisco, CA 94102

Phone: (415) 703-1804

Email: ITSolicitations@cpuc.ca.gov

9. Attachments and Exhibits

Table 4 - Attachments

Attachment Description

A Letter of Interest

B Solution Cost Estimate

C Respondent Questionnaire

D Process Flows – As Is

E Process Flows – To Be

F CIT Requirements

10. Solution Demonstrations

The CPUC may invite respondents to present a demonstration of the solution(s) outlined in the RFI responses.

11. Business Background

CAB’s current phone system is at least ten (10) years old and has aged out. The phone system is not connected to our CIMS, which prevents an individual phone call from relating to or linking to a case in CIMS. This inhibits the ability to perform call monitoring and call data validation and creates a database integrity risk.

Between August 2021 to August 2024, CAB received a total of ninety-three thousand, four hundred ninety-six (93,496) calls. Of those, ninety-one thousand, seven hundred twenty-eight (91,728) calls were answered, and sixty-nine thousand, seven hundred sixty-seven

(69,767) were entered into CIMS. CAB’s Consumer Affairs Representatives (CAR) entered an average of seventy-six percent (76%) of the phone calls they answered into the CIMS database. This translates into sixteen thousand, seven hundred forty-four (16,744) answered phone calls that were responded to but not recorded. Getting CARs to record all call data into CIMS has been a problem for years – a metric CAB tracks regularly. Training and counseling temporarily improved this metric's value, but the rate of call data entry decreases over time as CARs revert to their former practices. Integrating CIMS with mailto:ITSolicitations@cpuc.ca.gov telephony software will allow CAB to tie an individual call to a CIMS case number and auto-populate call data elements into the CIMS case record. An integration between systems would also enable CAB managers and supervisors to better audit phone calls to improve data quality and improve call handling and case processing.

There are three (3) main components to the current CAB solution:

1. CAB Complaint System

2. Business Rules Manager (BRM)

3. Utility Portal

CAB Complaint System

CAB’s complaint system deployed in 2009, is built on unsupported Oracle technology with vendor support ending in 2017. Furthermore, no official Microsoft support exists beyond a temporary Chrome workaround, creating serious risks to consumer Personally Identifiable

Information (PII) and system stability. In 2024, CAB’s critical systems experienced over one hundred (100) days of downtime: CIMS (thirty-two [32] days), Oracle Discoverer database

(thirty-two [32] days), and the Utility Portal (thirty-six [36] days). These disruptions diverted

Information Technology (IT) resources from innovation, delayed complaint processing, weakened data integrity, and created significant risks to consumer service and public trust.

The telephony system does not integrate with CIMS, forcing manual re-entry of call data and preventing complete case auditing. Manual date entry vulnerabilities allow records manipulation, compromising data integrity and skewing performance metrics. Reporting is equally inadequate, as supervisors must export and manually manipulate raw .csv files with over two hundred fifty (250) fields, while case comments remain unsearchable and unusable.

CIMS manual date entry enables gaming, which is manually backdating entries into CIMS by individual CARs. The date is deleted, and the new date is entered. This form of gaming results in poor data quality and compromises CAB’s performance statistics. While some dates (Sent to Utility, Closed Date, Entered Date) have been locked down (i.e., manual entry is disallowed except for Consumer Service Supervisor (CSS) override) in CIMS, other critical dates remain vulnerable to manual entry. The system should auto-generate every logged date, except for the Receipt Date, and prohibit manual entry except for CSS override.

Business Rule Manager (BRM)

BRM is an Oracle application implemented for CIMS in 2013 to ensure that case coding relationships between fields such as source type, case type, utility type, case disposition, subcategory, and other fields (a total of forty [40] fields) conform with each other. BRM is a type of data dictionary for pick lists and other data fields. Any new system must include BRM functionality.

Utility Portal

The Utility Portal allows CIMS to send Informal Complaints, Supplemental Informal

Complaints, and Reopened Supplemental Informal Complaints to utilities participating in the

Utility Portal. CIMS and the Utility Portal are integrated with each other. The utilities send their responses to the three (3) types of Informal Complaints back to CIMS via the Utility

Portal. Transmissions are batch-processed and occur once per day. The utility correspondence that passes through the utility portal contains customer identifying information and sensitive utility information. The CPUC is required by law to protect this information.

The Utility Portal must be replaced for three (3) main reasons:

1. The Utility Portal’s security protocols are inadequate and potentially compromise customer identifying information and sensitive utility information.

2. The Utility Portal software is not supported. It cannot be upgraded or modified.

3. The Utility Portal is functionally inadequate and has additional issues detailed below that cannot be addressed.

Inadequate Security Protocols

The Utility Portal contains very minimal security protocols, allowing unauthorized users to access the information in the Utility Portal and thus resulting in unauthorized changes. While all the utilities with access to the Utility Portal have unique usernames, all accounts may potentially share the same password. CIMS stores usernames and passwords in an unencrypted table, making the Utility Portal potentially hackable by unauthorized users.

Password rules are minimal, with all passwords consisting of only digits and no letters or special characters. Lastly, users share passwords within each utility, allowing access to the

Utility Portal by users who may no longer belong to the utility. There are approximately four thousand, five hundred (4,500) utilities that have access to the portal. Of these utilities, approximately four hundred fifty (450) have accessed the Utility Portal within the last three

(3) years.

Functionally Inadequate

• No Historical Listing of Cases o The Utility Portal does not allow a utility to track or retrace its submitted responses to cases because the system removes the responses from the

Utility Portal once these responses are transferred back to CIMS.

• Follow-ups Are Difficult o The Utility Portal has no separate page where utilities can view cases with submitted responses. Once a utility submits a response, the portal status will show “Submitted” for up to 24 hours before the case is removed from the case list. Due to system limitations, the system will retain cases that a utility has responded to in the Portal for thirty (30) days. The utility can pull up a case to see what the complaint is about, but they can't provide additional follow-up responses unless the assigned CAR issues a Supplemental

Informal Complaint (SIC). The issuance of an SIC is often directed to WPAs who act as intermediaries. Depending on the issue’s nature, WPAs spend significant time, about thirty (30) to forty-five (45) minutes, researching and troubleshooting each reported incident. This occurs at least once a month.

o Smaller utility companies that do not check their Utility Portal regularly are unaware of reminder notices sent by CARs. Alerting these utilities by means of sending direct emails to their primary contact could be built into a new system.

Proposal

The CPUC seeks potential solutions from Contractors to implement a future CAB Integrated Telephony (CIT) system to efficiently implement and integrate telephony and customer relationship management (CRM) software to provide a complete call center solution.

Process Flows

For more details, we have included process flows in the following attachments.

Attachment D - Process Flows – As-is contains a set of eight (8) As-Is process flows.

Attachment E - Process Flows-To be contains eight (8) To-Be process flows. The process flows represent the following activities:

1. Receive Call

2. End Call

3. New Phone Contact

4. Return Phone Contact

5. New Written Complaint

6. Create Case

7. Supplements

8. Consumer Portal – Complaint Submission

9. Utility Portal – Complaint Management

10. Consumer Notified

12. Requirements

Functional Requirements The chart below lists the categories of functional requirements the CIT system must satisfy.

Please review the attached requirements and process flows to understand better the detailed types of data CIT will need to collect and analyze.

Table 5 – Functional requirement categories

Requirement Category

# of Requirements

Report Management 23 Computer- Telephony Integration (CTI) 22 Case Management 31

Utility Portal 14 Data Entry 13 Notifications 11 Dashboards 9 Integration 9 Workflow 7 Letters 7 Consumer Portal 6 Reports 6 Alerts 5 Help 4 Data 3 Audit Logging 3 File Management 3 Search 3 Login 2 Security 1

Total 182

Data Migration Requirements

Currently, CAB maintains data in an Oracle database. The CPUC will work with the Contractor to clean the data. However, the Contractor will be responsible for migrating the data into the CIT database. The cost sheet requests that the cost for this migration be estimated separately from implementing the CIT functionality.

EXHIBIT A – LETTER OF INTEREST

CPUC Request for Information (RFI)# RFI 25NS0170 – CAB Integrated Telephony (CIT)

RFI Respondent Data:

Respondent Name:

Address:

Company Web page:

Main Products/Services:

Main Market/Customers:

Number of Years on the Market and/or years providing related services.

Respondent CEO

Identify any parent corporation and/or subsidiaries, if applicable.

Contact Information regarding this RFI:

Name:

Title:

Address:

Telephone:

E-Mail:

EXHIBIT B – CPUC INFORMATION SECURITY PROVISIONS

In the performance of this contract, the Contractor agrees to protect the confidentiality, integrity and availability of all information provided by the California Public Utilities Commission (CPUC). The Contractor further agrees to implement the following minimum administrative, physical, and technical information security safeguards to comply with the information security provisions specified in the California State Administrative Manual (SAM) 5305.8.

Reference:

1) State Administrative Manual Section 5300 https://www.dgs.ca.gov/Resources/SAM/TOC/5300

1. ADMINISTRATIVE SAFEGUARDS

A. DATA OWNERSHIP

1) The information being provided by CPUC under this Agreement remains the exclusive property of CPUC. This information is not open to the public and requires special precautions to protect from loss and unauthorized use, disclosure, modification, or destruction. This information must not be shared without written permission from CPUC.

2) The contractor shall have a non-exclusive right to use and process the information for the purposes stated in this Agreement. This right shall be revoked immediately upon termination of this Agreement. Disclosure of this data to Contractor in the performance of this Agreement does not transfer ownership of information to the Contractor or its employees or agents.

B. INCIDENT REPORTING

All unauthorized or suspected unauthorized access, uses, and/or disclosures of information obtained under this Agreement will be thoroughly reviewed by CPUC’s Information Security Office (ISO) and the Contractor’s ISO. The Contractor will comply with the incident reporting requirements in accordance with California Civil Code Section 1798.29, SAM Section 5340.4, and State Information Management Manual (SIMM) Section 5300 Information Security, 5340-A – Incident Reporting and Response Instructions and 5340-C – Requirements to Respond to Incidents Involving a Breach of Personal Information forms.

1) The Contractor will immediately notify the CPUC ISO of any information

2) security breach involving information accessed or obtained under this

Agreement. Immediately, for purposes of this Agreement, means not later than 24 hours after a security event is detected.

3) Each party will conduct oversight of its users with access to information provided under this Agreement and will immediately notify the other entity’s ISO of any unauthorized or suspected unauthorized accesses, uses, and/or disclosures / incidents.

Reference:

1) State Administrative Manual Section 5300 https://www.dgs.ca.gov/Resources/SAM/TOC/5300

2) Statewide Information Management Manual (SIMM) https://cdt.ca.gov/policy/simm/#SIMM

C. USE OF INFORMATION

The Contractor acknowledges and agrees that the information furnished or secured pursuant to this Agreement will be used solely for the purposes described in this Agreement and agrees to implement policies and procedures to ensure the confidentiality, integrity, and availability of said information. The Contractor further agrees that information obtained under this Agreement will not be reproduced, published, sold, or released in original or any other form for any purpose other than identified in this Agreement.

D. STATEMENT OF CONFIDENTIALITY

Each party will ensure that all employees who have access to confidential, sensitive, and/or personal information of the other party may be required to file a signed confidentiality statement attesting to the fact that he/she is aware of the confidential nature of the data and penalties for unauthorized disclosure under applicable state and federal law. When CPUC requests signed confidentiality statements, the request will come from the CPUC IT Contract Manager or CPUC ISO. Copies of signed confidentiality statements must be made available upon request to the CPUC ISO.

E. EMPLOYEE ACCESS TO INFORMATION

The Contractor agrees that information will be kept in the strictest confidence and only made available to authorized personnel on a "need-to-know” business basis, and only for the purposes authorized under this Agreement. The term "need-to-know’’ refers to those authorized persons who need information to perform their official duties in connection with the purpose described in the Agreement. The parties recognize their mutual responsibilities to protect the confidentiality of information in their custody as provided by law and ensure such information is disclosed only to those individuals, and of such purpose as authorized by the respective laws.

• Remote access must be approved by the CPUC Chief Information Officer (CIO) and ISO. Any authorized remote access connections are https://cdt.ca.gov/policy/simm/#SIMM to be within the Continental United States (CONUS) only (prohibiting remote access to data from outside CONUS) and require multi-factor authentication.

• All privileged accounts require multi-factor authentication.

F. SECURITY AWARENESS TRAINING

The Contractor and all their users authorized to access all information furnished or obtained under this Agreement must receive security awareness training prior to accessing such information, and annually thereafter. The security awareness training will be provided to the Contractor and all their authorized users by the

CPUC.

2. PHYSICAL SAFEGUARDS

A. ACCESS AUTHORIZATION RECORDS

The Contractor will maintain records of all authorized users and the authorization level of access granted to the information obtained under this Agreement.

B. ACCESS CONTROL

The Contractor will maintain and secure its entire computer system (network, hardware, software, and applications) used in the performance of this Agreement in accordance with state policies, standards and procedures held in the SAM Chapters 4800 through 5300.

Reference:

1) State Administrative Manual https://www.dgs.ca.gov/Resources/SAM/TOC

C. SECURE AREAS

Computer monitors, printers, hard copy printouts, or any other forms of information accessed or obtained under the performance of this Agreement must not be viewed by the public or other unauthorized persons as described in the Agreement.

D. SECURE STORAGE

Information in all forms must be stored in areas physically secure and protected from access by unauthorized persons. All confidential and personal data requires end-to-end encryption. Call center and Interactive Voice Response (IVR) system recordings are designed and configured to protect personal information (e.g., use masking for Social Security Number (SSN) and other personal data protections that limit/restrict recording, copying and excess storage of persona data).

https://www.dgs.ca.gov/Resources/SAM/TOC

E. MEDIA PROTECTION

The Contractor will employ the use of validated encryption for all confidential information stored on electronic media and obtained in the performance of this Agreement. Confidential information obtained by either party in this Agreement must be secured in accordance with the SAM Section 5365.2.

Reference:

1) State Administrative Manual Section 5300

2) NIST Special Publication (SP) 800s http://csrc.nist.gov/publications/PubsSPs.html

F. DESTRUCTION O F RECORDS

All records received under this Agreement and any database(s) created, copies made, or files attributed to the records received will be destroyed when they are no longer needed for the business purpose for which they were obtained, or within thirty (30) calendar days of termination of the contract, using confidential destruction methods. This information includes information stored on all media both digital and physical. The records shall be securely destroyed in accordance with National Institute of Standards and Technology (NIST) 800-88.

Reference:

1) NIST Special Publication (SP) 800s

3. INFORMATION SECURITY

Information security is defined as the preservation of the confidentiality, integrity, availability, authenticity, and utility of information. A secure environment is required to protect the confidential information obtained pursuant to this Agreement. Confidential information obtained by either party in this Agreement must be secured in accordance with the SAM Chapter 5300.

A. ELECTRONIC TRANSMISSION

All confidential information transmitted over a public network must be encrypted end-to-end. The Contractor will use FIPS 140-3 encryption standards and FIPS 140-3 validated methods, and NIST special publication 800-53 control requirements such as, but not limited to, utilizing minimum encryption strength of 256-bit Advances Encryption Standard (AES) and Secure File Transfer Protocol (SFTP) when transferring or encrypting electronic files or information. The https://www.dgs.ca.gov/Resources/SAM/TOC/5300 https://www.dgs.ca.gov/Resources/SAM/TOC/5300

Contractor will coordinate with CPUC ISO to implement the above referenced encryption standards to send and receive all information as required.

Reference:

1) NIST Special Publication (SP) 800-53, Rev 5, System and Communications Protection Family, Control SC-8 Transmission Confidentiality and Integrity https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final

2) NIST Special Publication (SP) 800s http://csrc.nist.gov/publications/PubsSPs.html

3) NIST Federal Information Processing Standards (FIPS) http://csrc.nist.gov/publications/PubsFIPS.html

B. CHANGE CONTROL

All changes to computer systems, hardware, software, file structure, data or record layout, applications, storage media, and network components used for storing and/or accessing information in the performance of this Agreement must be approved by the CPUC ISO in writing in advance prior to implementation.

C. SCREEN-LOCKING

Computers capable of accessing information for the performance of this Agreement must not be left unattended and logged on unless secured by a screen-locking process or mechanism to prevent unauthorized access or secured in a locked room not accessible to unauthorized personnel.

D. AUDITING

The Contractor will maintain an audit trail and record data access of authorized users and the authorization level of access granted to information based on job function. Logs must be made available to the CPUC ISO upon request. The Contractor will allow audits or inspections by individuals authorized by the CPUC ISO at the Contractor’s premises during regular business hours, prior notice for purposes of determining compliance with the terms of this Agreement.

E. CLOUD COMPUTING

If the Contractor will be using a cloud computing solution, the solution must follow and meet, or exceed, the special provisions for cloud computing services set by the Department of General Services (DGS) and California Department of Technology (CDT) and published on the DGS website via the Cloud Computing policy SAM 4983-4983.1 and additional Cloud Computing Special Provisions document.

Reference:

https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final http://csrc.nist.gov/publications/PubsFIPS.html

1) State Administrative Manual Section 4900 https://www.dgs.ca.gov/Resources/SAM/TOC/4900

F. DISASTER RECOVERY

The Contractor must meet the following disaster recovery objectives:

1) Upon the executed Agreement and the installation of the data transfer method, the Contractor shall provide a copy of disaster recovery plan and procedures that address all essential recovery program elements outlined in SAM sections 5325 through 5325.6.

In the event of a disaster, as defined in the disaster recovery plan, the Contractor shall notify CPUC as soon as practical, but not later than 24 hours after declaring a disaster; and shall provide a report to CPUC within two (2) business days, or as soon as practical. In the event of a disaster, the Contractor will notify CPUC for their approval when the need to use an outside vendor occurs ensuring all security measures will be maintained.

2) The Contractor, in collaboration with CPUC, will identify a Disaster Recovery

Vendor. The Contractor, CPUC, and the Disaster Recovery Vendor shall test the contractor’s ability to meet the requirements of this Agreement annually in accordance with State requirements and provide CPUC a report regarding the execution of the test and its outcome.

a) The testing must meet the recovery objectives of this Contract and should assess whether the Contractor’s disaster recovery provisions are capable of meeting the recovery objectives. The Contractor and CPUC will be responsible for establishing and conducting periodic Disaster Recovery tests, which will provide a means for Disaster Recovery Plan documentation maintenance as well as early identification and mitigation of any problems that occur as a result of the test.

b) At the minimum, the Contractor, in conjunction with CPUC must conduct one simulation or parallel test of Disaster Recovery plan annually. This test must exhibit end-to-end recovery capability to meet requirements as described in this contract.

Reference: https://www.dgs.ca.gov/Resources/SAM/TOC/5300

Information Security Provisions – (Revised 08/13/2025) https://www.dgs.ca.gov/Resources/SAM/TOC/4900