RFP_C5612999_-_Exhibits_A__A-1__B__C___D.pdf

Incarcerated Persons Mail Scanning Solution RFP C5612999 California Department of Corrections and Rehabilitation (CDCR) Exhibit A

STATEMENT OF WORK

A. PURPOSE

The terms “shall” and “must” are considered by the California Department of Corrections and Rehabilitation (CDCR) to mean mandatory or required. The terms “may” or “can” are considered to be optional, and are at the discretion of the CDCR.

The purpose of this Statement of Work (SOW) is to define the requirements, responsibilities, tasks, performance expectations, implementation, operation, and management of the CDCR Incarcerated Persons (IPs) Mail Scanning Solution (“Solution”). The Solution shall replace existing physical incoming First-Class Mail processing with a secure, technology driven scanning and digital delivery service that improves safety, enhances operational efficiency, ensures Americans with Disabilities Act (ADA) accessibility, supports investigative needs, and preserves the legal rights of IPs to receive First-Class Mail.

The Solution shall operate using a contractor owned and contractor managed offsite mail processing facility, where all incoming First-Class Mail addressed to IPs will be received, handled, scanned, secured, digitized, retained, and routed according to CDCR requirements. No mail scanning, sorting, digitization, storage, or related processing shall occur on CDCR property.

B. BACKGROUND

The CDCR continues to experience a significant rise in illicit drugs and controlled substances entering institutions through incoming First-Class Mail addressed to IPs.

CDCR mailrooms Statewide have repeatedly discovered narcotics and synthetic drugs concealed within envelopes, greeting cards, paper stock, and other mail formats. These substances may be soaked, sprayed, or chemically bonded into paper materials, making detection extremely difficult for personnel using traditional mailroom screening practices.

Illicit substances introduced through the mail system have contributed to increased incidents of violence, IP overdoses, hospitalizations, assaults on staff, and destabilization of institutional operations. These trends present a serious threat to the safety, security, health, and rehabilitative environment of CDCR’s correctional institutions.

Following extensive analysis, CDCR determined that routing all incoming First-Class Mail to a contractor operated offsite facility for screening, scanning, digitization, and secure electronic delivery is the most effective method to reduce contraband-related risks Statewide.

C. OBJECTIVES

The objective of this Statement of Work is to establish a secure, consistent, and efficient Statewide operating model for handling incoming First-Class Mail addressed to IPs by implementing a centralized, offsite mail scanning and digitization service.

This model is designed to eliminate contraband introduction through physical mail, enhance institutional safety, reduce operational burdens on CDCR mailrooms, and ensure timely, accessible digital delivery of correspondence.

D. PERIOD OF PERFORMANCE

The period of performance for this Agreement shall be from October 19, 2026, or upon final execution of this Agreement by the CDCR, whichever is later, through January 1, 2030, with two (2) optional one (1) year extensions, consistent with the original Scope of Services and at the contracted rates as referenced in Exhibit B-1, Cost Workbook. The Agreement is structured to include an Implementation Preparation period (75 days), a Proof of Concept (POC) / Pilot Operations period at Richard J Donovan Correctional Facility (RJDCF) (24 months), and Statewide Operations and Maturation period (12 months).

E. SUBCONTRACTING

For any services, including Consulting services awarded by the CDCR, the maximum amount of Subcontracting shall not exceed 40 percent. If the amount of Subcontracting exceeds 40 percent, the responding Contractor must include a letter of explanation which clearly defines the need for further Subcontracting. Any offer or quote submission that is received by the CDCR that indicates more than 40 percent Subcontracting, as noted on the Bidder Declaration GSPD-05-105, and does not include a letter of explanation, will be deemed non-responsive by the CDCR Administrative Evaluation Team, and subsequently disqualified from further evaluation of this offer or quote. In addition, the CDCR Evaluation Team will be the final determining body that approves any Subcontracting of more than 40 percent as indicated on the Bidder Declaration form GSPD-05-105, and that is also accompanied by the Contractor’s letter of explanation.

F. TIME AND MATERIALS

The Contractor must follow Payment Provisions guidelines regarding invoicing instructions and requirements as spelled out specifically in Exhibit B.

This Agreement shall be based on Time and Materials and shall be task oriented.

Tasks shall be clearly defined in the Scope of Work Section H, and/or Tasks Section L. Time and Material is defined as rates for services that supports the overall effort of this Agreement, noted in Exhibit B-1, in exchange for payment, billed monthly in arrears. Time and Materials/Services are billed in the Fiscal Year the Services are rendered and cannot cross Fiscal Years.

G. CONTRACTOR ONBOARDING

This Agreement excludes standard Contractor onboarding procedures.

1. All Contractor Staff

The following will be required for all contractor staff: Form 2189 (INCARCERATED/PAROLED RELATIVE OR ASSOCIATE NOTIFICATION), and Form 2301 (PREA POLICY INFORMATION FOR VOLUNTEERS AND CONTRACTORS) including Key Staff and Contractor’s Staff employed at the offsite mail processing facility. If Contractor Staff disclose relationships to IPs in CDCR custody on Form 2189, the CDCR may at its discretion request the Contractor Staff not be employed in Mail Scanning duties for CDCR.

2. Gate Clearance

Gate clearance for the Contractor’s Service Technicians shall be the sole responsibility of the institution and be facilitated and processed by the Institution/Institution CDCR Project Manager for each service request or site visit.

In addition, this Section applies to any staff replacements or substitutions.

H. SCOPE OF WORK

The Contractor shall supply all labor, equipment, software, infrastructure, facilities, tools, hosting, security controls, training, maintenance, and operational services necessary to implement, operate, and maintain the Solution for the duration of the Agreement. No scanning, sorting, or mail processing activities shall occur on CDCR property.

The Contractor shall ensure full compliance with CDCR policies, Title 15 regulations, ADA standards, CDCR-Information Technology Contract Management Unit (ITCMU) guidance, Statewide Information Management Manual (SIMM) / Statewide Administrative Manual (SAM) security protocols, and all other applicable Federal and CDCR regulations.

Sections H.1 – H.14 below are high level requirements overviews, the Contractor shall review and respond to the Exhibit A – Attachment 2 Business Requirements and Exhibit A – Attachment 3 Technical Requirements for detailed requirements and the Contractor’s approach.

1. Functional Overview

The Solution shall transform physical First-Class Mail into secure digital mail records through:

a. Offsite mail intake, screening, imaging, and digitization

b. High resolution scanning of envelopes, content, photos, illustrations, and attachments

c. Automated routing driven by configurable rulesets

d. Optical Character Recognition (OCR) and searchable text extraction

e. Digital delivery to tablets, kiosks, and CDCR administrative systems

f. Integrated review and investigative workflows

g. Full audit logging, reporting, and data retention

h. Secure hosting, backup, encryption, and access control

i. Statewide operational scalability following proof-of-concept completion

The Contractor shall maintain all infrastructure and operations necessary to support these functions.

2. Offsite Physical Mail Processing Facility Requirements

The Contractor shall maintain and operate a secure offsite facility within the United CDCRs for receiving, handling, storing, scanning, routing, and disposing of all incoming First-Class Mail. The offsite facility shall:

a. Maintain restricted access, surveillance, alarm systems, and chain-of-custody controls

b. Protect staff from exposure to harmful substances during intake and screening

c. Support controlled substance identification workflows

d. Retain physical mail for no fewer than ninety (90) calendar days

e. Provide secure destruction according to CDCR requirements

f. Maintain environmental and operational security aligned with CDCR’s Data

Sharing Agreement

g. Ensure all Contractor staff have completed CDCR Form 2189 and Form 2301

3. Mail Intake, Screening, Scanning, OCR, and Classification

a. Mail Intake & Screening

The Contractor shall:

i. Receive, timestamp, and log all incoming mail

ii. Open and screen for contraband, and exception handling criteria

iii. Sort mail for routing to appropriate workflows

b. Scanning Requirements

The Contractor shall:

i. Scan all envelopes and internal contents at not less than 300 DPI

ii. Produce clear, ADA compliant digital images

iii. Ensure complete capture of all sides and attachments

iv. Perform OCR processing to screen for prohibited content, contraband, coded messages, cash, and sensitive documents

c. Classification Categories

All mail shall be classified as:

i. Allowed Mail

ii. Flagged for Review

iii. Exception Handling

iv. Potential Controlled Substance Detected

All First-Class Mail shall be fully scanned, OCR’d, classified, and routed within three (3) calendar days of receipt at the Contractor’s facility.

4. Controlled Substance / Contraband Workflow

The Contractor shall implement and maintain a complete contraband workflow including:

a. Automatic designation as “Potential Controlled Substance Detected”

b. Mandatory secure isolation of physical mail

c. Chemical testing steps (where used) logged and tracked

d. Required notifications issued within one (1) hour to:

i. CDCR Staff

ii. Central Operations Captain

iii. Investigative Services Unit (ISU)

iv. Office of Correctional Safety (OCS)

v. Local law enforcement (when pickup is required)

e. Full chain-of-custody logging

f. Physical mail transfer to law enforcement

g. Digital record retention for at least two (2) years

h. Monthly contraband reporting integrated with CDCR investigative systems

5. Flagged for Review Workflows

a. Mail shall be flagged when containing:

i. Non-English text

ii. Images or photos requiring review

iii. Encoded or coded content

iv. Threats, violence, or gang references

v. Specific investigative keywords or monitored senders

vi. Signs of tampering or contamination

vii. Labelled Return to Sender

b. Flagged mail shall be routed in the following order:

i. CDCR Mailroom Staff

ii. Central Operations Captain or Investigative Services Unit

c. The Contractor shall support CDCR’s Title 15 mandate to disposition flagged mail within seven (7) calendar days, including:

i. Queue aging reporting

ii. Escalation support

iii. Service Level Agreement (SLA) compliance tracking

iv. Breach notification if the seven (7) day threshold is at risk

6. Digital Delivery to IPs

The Contractor shall:

a. Deliver Allowed Mail digitally to tablets/kiosks

b. Provide envelope images, content images, OCR text, and metadata

c. Support print request workflows

d. Send delivery notifications

e. Maintain ADA compliant digital presentation

f. Support real time synchronization across devices

7. Exception Handling

a. Exception Handling includes:

i. Legal documents

ii. Government documents

iii. Benefits mail

iv. Incorrect address routing

v. Out-to-court or Out-to-hospital handling

vi. Parole/release forwarding

vii. Currency and checks

b. The Contractor shall:

i. Route all exceptions correctly

ii. Log workflows and timestamps

iii. Support forwarding and RTS workflows

iv. Maintain complete audit trails

8. Retention and Export

a. Physical Mail Retention

i. Retain physical mail not less than ninety (90) days.

b. Digital Retention

i. Retain all digital records for not less than two (2) years, including:

images, OCR text, metadata, audit logs, notifications, staff actions.

c. Retention Compliance

The Contractor shall:

i. Maintain retention anomaly rate under 0.05% monthly

ii. Deliver a retention audit plan within 120 days

iii. Deliver monthly retention audit reports within 180 days

iv. Support CDCR’s seven (7) year Disallowed Mail retention via full export packages

9. Proposed Process Flow Chart

The contractor shall refer to Table 1, the Proposed Process Flow Chart illustration below.

Table 1 : Proposed Process Flow Chart

10. Training

The contractor shall, during normal business hours, as requested by the CDCR Program/Operations Manager, and or the CDCR Selected Representative:

a. Deliver a minimum of three (3) training sessions, to CDCR Staff Units including but not limited to Custody, Mailroom Operations, Investigative Services Unit, and Office of Correctional Safety

b. Deliver a minimum of one (1) training session, to CDCR IPs receiving accommodations under the ADA

11. ADA Accessibility Requirements

The Contractor shall:

c. Maintain WCAG 2.2 AA compliance across all Solution components

d. Provide ADA training, accommodations, and device accessibility

e. Support ADA expert assessments

f. Complete ADA corrections within sixty (60) days

g. Bear all ADA compliance costs

12. GenAI and Machine Learning Requirements

The Contractor shall:

a. Disclose all GenAI/Machine Learning (ML) usage

b. Submit STD1000 GenAI Reporting Factsheet for any GenAI use

c. Require IP consent to share information for GenAI or ML training

d. Cease GenAI usage upon CDCR direction

e. Accept contract amendments adding GenAI provisions

f. Accept termination for nondisclosure or noncompliance

13. Security Requirements

The Contractor shall comply with:

a. CDCR Data Sharing Agreement

b. SIMM 5300 and SAM 5300

c. NIST 80053 controls

d. FIPS 140 validated encryption modules

e. Breach notification within one (1) hour

f. On demand audit logging and reporting

14. Integration Requirements

The Solution shall support integration with:

a. CDCR tablets and kiosks

b. Strategic Oversight Management System (SOMS) (as required)

c. CDCR administrative systems

d. Reporting and audit platforms

APIs and standard export formats (CSV, XML, JSON, PDF, Excel) shall be provided.

15. System Availability, Monitoring, and Support

The Contractor shall maintain:

a. 99.5% system availability

b. Remote Monitoring and Remote Management capabilities

c. Realtime event and incident management

d. Change, configuration, problem, and request management

e. Knowledge management resources

f. SLA compliance reporting

16. Reporting

Reporting requirements support transparency, operational oversight, performance accountability, and risk management between the Contractor and CDCR. The Contractor shall provide all required reports in a secure, searchable, filterable, exportable reporting portal accessible to authorized CDCR Staff. Each report must provide CDCR management with actionable insights enabling timely operational decisions, identification of performance deficiencies, assessment of SLA compliance, and determination of required corrective or escalation actions. All reports shall be available in downloadable formats such as .xlsx and .pdf and generated with timestamps using Pacific Standard Time.

Contractor shall refer to Exhibit A-Attachment 2-Business Requirement Matrix and Exhibit A-Attachment 3 Technical Requirements Matrix for additional reporting requirements.

Reporting shall be grouped into the following categories:

a. SLA Reports The Contractor shall make all SLA reports available in the reporting portal no later than the fifth (5th) business day of each month. SLA reports must present timely performance indicators, compliance metrics, and any SLA breaches or remediation actions.

i. Executive Monthly SLA Summary Report

Provides monthly SLA performance for all contractual SLAs, including summary of SLA compliance, remediation actions applied, and total financial impacts. Shall include filters allowing fiscal-year SLA performance summaries.

Expected outcome: Enables CDCR executive leadership to quickly identify SLA deficiencies, evaluate financial remedies applied or owed, and determine where vendor escalation or corrective actions are required.

ii. System Availability SLA Report

Reports system uptime and adherence to the System Availability SLA.

Must use telemetry from network devices, servers, OS logs, RMM tools, and synthetic transaction monitoring. Impact calculations shall consider outage duration and number of affected facility users to accurately reflect institution scale events.

Expected outcome: Allows CDCR management to verify uptime performance, understand outage scale and impact, prioritize infrastructure improvements, and initiate appropriate escalations or remediation events with the Contractor.

iii. Catastrophic Outage SLA Report

Reports compliance with Catastrophic Outage SLA requirements. A catastrophic outage includes any event causing loss of service at the Contractor’s Mail Processing Facility, five or more CDCR facilities, total loss of a Solution component across all facilities, or impacting 20% of all users. Report shall include outage analysis and a link to the required Root Cause Analysis (RCA).

Expected outcome: Supports CDCR leadership decision making by clearly showing outage severity, service impact, and trends, enabling CDCR to review RCA findings, validate corrective actions, and determine if contractual remedies or operational safeguards are necessary.

iv. Notifications SLA Report

Reports timeliness and accuracy of notifications sent to CDCR Staff, IPs, and law enforcement for all events and mail categorizations. Report shall include counts by notification type, timeliness, and recipient group.

Expected outcome: Provides CDCR management insight into notification timeliness and coverage so they can ensure safety-critical alerts are functioning, detect workflow gaps, and require vendor remediation when notification SLAs are not met.

v. First-Class Mail Information Loss SLA Report

Reports all incidents involving loss or damage to First-Class Mail, metadata, photos, or associated audit records. Must detail the number of affected records, type of record, and recovery status.

Expected outcome: Enables CDCR to identify patterns in data loss, assess the severity of missing records, determine whether backup or data-handling processes require adjustment, and initiate contractual remedies or recovery actions.

vi. First-Class Mail Data Retention SLA Report

Reports adherence to retention SLAs, including all correspondence records (images, photos, metadata, audit logs) retained for minimum required periods. Must identify any files not retained, reasons for non-retention, and corrective actions.

Expected outcome: Allows CDCR to verify compliance with required retention periods, identify anomalies that may indicate systemic risks, and determine whether corrective workflow, storage, or audit improvements are needed.

vii. Data Backup and Recovery SLA Report

Reports adherence to data backup SLAs including backup success rate, Recovery Time Objective (RTO), frequency, duration, failed backups, and operational remediation actions.

Expected outcome: Supports CDCR decision-making regarding the Contractor’s backup reliability, timeliness of recovery, and overall resiliency. Enables management to trigger escalations, compliance actions, or disaster-recovery process changes.

b. Operational Reports

Operational reports provide oversight of Solution performance, incident resolution, mail processing efficiency, queue health, and continual improvement.

i. Executive Outage & RCA Reports

Generated upon CDCR request for any significant outage or critical system failure. An initial report shall be provided within 24 hours, followed by a comprehensive RCA within 30 calendar days. Must include outage description, timeline, ticket numbers, impacted facilities or users, Contractor actions, and mitigation plan.

Expected Outcome: Gives CDCR leadership a consolidated view of major outages, enabling them to evaluate response quality, approve or require corrective actions, and determine whether broader infrastructure or vendor changes are warranted.

ii. First-Class Mail Volume Report

Reports mail volume and processing timelines by facility. Must include counts of mail received, scanned, flagged, exception handled, contraband-designated, undeliverable, and returned. Must report timely delivery statistics, delivery-time distribution, and OCR based initial categorizations.

Expected outcome: Allows CDCR to assess workload distribution, forecast staffing or processing needs, identify anomalies in mail trends (e.g., contraband spikes, volume drops), and verify timely delivery compliance.

iii. Flagged for Review Queue Performance Report

Reports volume, throughput, queue depth, reviewer processing rates, time-in-queue, transition times between review levels, and full end-to-end cycle times. Must provide Title 15 compliance rates, backlog levels, aging reports, and real-time dashboard visualizations.

Expected outcome: Enables management to identify bottlenecks, evaluate reviewer performance, ensure Title 15 compliance, reduce aging backlogs, and determine where additional staffing, workflow changes, or escalations are required.

iv. Ad Hoc Reports

CDCR may request ad hoc reports at any time. Unless new data sources are required, requested reports must be delivered within ten (10) calendar days. CDCR may request that any ad hoc report be added to the reporting portal for on-demand access.

Expected outcome: Supports rapid CDCR management decision-making by providing issue-specific or analytical data on demand, allowing management to address emerging concerns or conduct targeted operational reviews without waiting for monthly cycles.

v. Investigative Reports

Authorized CDCR staff shall generate investigative reports on demand, with selectable filters and report fields. Reports shall include correspondence ID, flagged reason, links to associated digital records, notes, audit indicators, sender/receiver details, timestamps, and facility/station information. Reports must include cover pages, headers, footers, Pacific Time timestamps, and export options to .xlsx and .pdf.

Expected outcome: Allows authorized staff to conduct detailed investigations by providing complete record-level context, enabling timely operational, safety, or intelligence decisions.

vi. Change Management Report

Reports all Submitted, In-Cycle, Out-of-Cycle, and Emergency Change Requests including Change ID, requestor information, change type, scheduling, duration, Change Control Board actions, status, mitigation plan, rollback plan, and implementation notes.

Expected outcome: Enables CDCR to review system changes, assess risk, validate proper approval workflows, and determine whether scheduled or emergency changes require additional scrutiny or mitigation.

vii. Trouble Ticket Report

Tracks all issues encountered within the Solution, including tickets created by CDCR Staff, IPs, Contractor monitoring systems, or other inputs. Must include ticket number, taxonomy codes, priority, symptoms, resolution notes, facility, timestamps, outage duration, total duration, and stop clock information. Trouble ticket data shall refresh no less than every 24 hours.

Expected outcome: Supports CDCR management decisions related to system health, staffing needs, root cause analysis, and operational improvement by highlighting recurring issues, resolution patterns, and facility specific pain points.

viii. Custom Query Reports

Allows authorized CDCR Staff to build custom data queries using predefined fields and save them under user specific query names.

Expected outcome: Empowers CDCR Staff to answer targeted operational questions, perform detailed audits, or validate compliance trends, ensuring oversight is flexible and data-driven.

ix. Audit Log Report

Reports system-wide user activity including login timestamps, user actions, mail views, file access, flag creation/modification, watchlist updates, exception-handling actions, and any creation, modification, or deletion of records. Must include audit details for CDCR Staff, Contractor Staff, and subcontractors.

Expected outcome: Allows CDCR management to verify system integrity, identify misuse or unauthorized access, confirm chain-of-custody for correspondence, and initiate security or policy enforcement actions.

x. Data Backup Validation Reports

Reports validation of all file backups including confirmation of successful backups and identification of any problems or exceptions.

Expected outcome: Enables CDCR to confirm all backups are functioning and identify systemic failures, allowing leadership to direct remediation or review disaster-recovery readiness.

xi. Customer Service Requests & Issues Report

Reports all Solution service requests, complaints, and nonsystem issues.

Must include request number, facility, requester details, category, assigned staff, priority, description, dates opened/closed, estimated completion time, stop-clock duration, and working duration. Categories shall be established jointly by CDCR and the Contractor.

Expected outcome: Supports evaluation of service responsiveness, issue trends, and facility specific performance, giving CDCR the data needed to assess contractor effectiveness and require process improvements.

17. Transition-Out

The Contractor shall:

a. Provide a comprehensive Transition-Out Plan

b. Support orderly migration of data, processes, documentation, and knowledge

c. Continue full operations until CDCR acceptance of transition tasks.

I. SERVICE LEVEL AGREEMENT

1. Service Level Agreements

The Contractor shall meet the SLAs as specified in this Section which consist of the following:

a. First-Class Mail Timely Delivery

b. First-Class Mail Retention (Physical & Digital)

c. Notifications to CDCR Staff

d. Notifications to IPs

e. Notifications to Local Law Enforcement

f. First-Class Mail Information Loss

g. First-Class Mail System Data Retention

h. Service Request Fulfillment

i. System Availability

j. Catastrophic Outage

k. Data Backups and Recovery

l. Implementation Timelines

m. Data Breach

n. Key Staff Replacement

2. Rights And Remedies

Detailed rights and remedies for each SLA are documented in the respective tables from I.5 through I.18 below.

If an outage or performance event fails to meet one (1) or more of the Solution SLA objectives, only the SLA with the largest Service Level Agreement Rights and Remedies (SLARR) will be applied.

To the extent that Contractor offers additional or more advantageous rights and/or remedies to customers for similar services offered, the CDCR shall be entitled to exercise the rights and/or remedies therein.

Rights and Remedies will apply to each SLA in which the SLA objective was missed. The SLARR will be applied via compensation for missed SLA objectives every month. CDCR shall have the right to offset the SLA assessment against monthly invoices in its sole discretion.

The Contractor will apply the SLARR for each service and application impacted by the Solution failure.

The Contractor will automatically calculate, report, and apply all SLARR.

SLARR shall be assessed monthly and applied toward the SLARR totals within 60 calendar days from the last day of the month in which the SLA objective was missed.

In addition, SLARR for all SLAs will allow the option for CDCR and the Contractor to invoke the escalation process according to the Escalation Plan.

3. Stop Clock Conditions (SCC)

The SCC will allow the Contractor to adjust the SLA durations based on the criteria described below. All SCC periods when applied to a Trouble Ticket or Service Request shall be clearly documented in the ticket diary along with the date and time the SCC started, the date and time the SCC ended, and a detailed description of the qualifying event. Failure to document a SCC in the ticketing diary may result in rights and remedies being applied to the Trouble Ticket or Service Request.

a. SCC include:

i. Periods when a restoration or testing effort is delayed at the specific request of CDCR. The SCC shall exist during the period the Contractor was delayed, provided that reasonable and documented efforts were made to contact the CDCR Staff during the applicable stop clock period.

ii. Time after a service has been restored, but CDCR Staff request that the Trouble Ticket or Service Request be kept open for observation. If CDCR Staff later determine the service was not restored, the stop clock shall continue until the time CDCR staff notifies the Contractor that the service has not been restored.

iii. Time after a service has been restored, but CDCR Staff is not available to verify that the service is working. If the service is later determined by CDCR staff to not have been restored, the stop clock shall apply only for the period of time between the Contractor's attempt to notify CDCR Staff and the time the CDCR Staff notifies the Contractor that the service has not been restored.

iv. Restoration cannot be achieved because the problem has been isolated to infrastructure that is not maintained by the Contractor.

v. Failures occurring as a direct result of a power outage, outside the control of the Contractor, which exceeds 30 minutes. Power outages resulting from a backup generator test will not be considered a stop clock condition if the generator test has been previously documented and approved within the change management system.

vi. The following contact/access problems, provided that the Contractor makes specific efforts to contact the appropriate CDCR Staff for facility access during the applicable stop clock period:

(1) The facility contact or CDCR Staff representative has not arranged the access necessary to correct the problem.

(2) The Contractor’s technician is not granted facility access after displaying proper identification.

(3) The facility’s limited hours of access directly impact the Contractor’s ability to resolve the problem.

(4) The CDCR Staff causes a problem or delay, documented on the trouble ticket, that prevents or delays the Contractor’s ability to resolve the problem. In such an event, the Contractor shall make a reasonable request to CDCR Staff to correct the problem or delay.

(5) Delays in the process of admittance to the CDCR facility.

vii. Failure of the Trouble Ticket or Service Request originator or responsible CDCR Staff to return a phone call or email from the Contractor’s technician for on-line close-out of trouble tickets after the service has been restored.

The Contractor shall provide documentation substantiating their staff left a message.

viii. An outage directly related to a scheduled and approved change management activity by the Contractor. Any such SCC shall not extend beyond the approved scheduled maintenance period of the change window. SLAs will apply for any maintenance caused outage beyond the scheduled maintenance period. Outages occurring during a scheduled maintenance period, and not caused by the scheduled maintenance shall not be subject to this stop clock criteria.

ix. Any problem or delay caused by a third party not affiliated with the Contractor, and not reasonably preventable by the Contractor. The Contractor’s affiliates, subsidiaries, or subcontractors shall be deemed to be affiliated with, and under the control of the Contractor with respect to the equipment, services, and facilities provided under the Contract.

(1) Force Majeure events, as defined in IT GSPD Section 20.3 (Force Majeure).

4. Acknowledgement Of Harm / Liquidated Damages

Acknowledgement of Harm/Liquidated Damages set forth in Section I, Service Level Agreements (SLAs), are intended to encourage timely delivery of critical start up project plans/deliverables, plan implementation, and the provision of reliable and responsive services. The purpose of the liquidated damages is to ensure adherence to the requirements of the service contract and to set an amount in advance of a breach to compensate the CDCR for damages that are impractical or extremely difficult to estimate but which would be sustained by the CDCR in the event the Contractor fails to perform services as agreed. The liquidated damages are intended to be a reasonable estimate of the damage and costs the CDCR would sustain as a result of a breach, or the proper and/or the timely delivery of services by the Contractor. They are not intended to be punitive. The CDCR and Contractor, therefore, presume that in the event the Contractor fails to perform certain agreed upon services in a timely manner, the CDCR shall assess the Contractor to pay such amounts as liquidated damages, and not as a penalty.

Liquidated damages will not be assessed if, as determined by the CDCR, Contractor's delay or failure to perform its obligations was caused by factors beyond the control of Contractor, including acts of the CDCR, and without any material error or negligence of Contractor.

5. First-Class Mail Timely Delivery

SLA Name: First-Class Mail Timely Delivery

Definition: The First-Class Mail files including digital copies of First-Class Mail, transcriptions, photos, which are sorted by OCR into the “Allowed Mail” or “Flagged for Review” categories must be digitally delivered to the IP’s Inbox (Allowed Mail) – or - Mailroom Staff Flagged for Review Queue (Flagged for Review) no later than three (3) days after receipt at the Contractor’s Mail Processing Facility.

Measurement Process: Each occurrence of missing the timely delivery deadline shall be documented on a per-record basis within the respective digital/scanned mail record and included in applicable reports.

Service(s): First-Class Mail

Objective (s):

Measure Monthly Objective

First-Class Mail Timely Delivery within three (3) days 100%

Rights and Remedies

Rights of CDCR:

1. CDCR has the right to expect the Contractor to meet specified Key Performance Indicators (KPIs) related to First-Class Mail Timely Delivery.

2. CDCR has the right to expect that the Contractor will implement appropriate staff and system workflows to ensure First-Class Mail Timely Delivery.

3. CDCR has the right to request evidence of First-Class Mail Timely Delivery.

4. CDCR has the right to be promptly notified by the Contractor in case of significant delays to First-Class Mail Timely Delivery.

5. CDCR has the right to access audit records associated with First- Class Mail Timely Delivery to verify timely delivery.

6. CDCR has the right to access regular reporting which details First- Class Mail Timely Delivery.

7. CDCR has the right to invoke remediations tied to the Contractor’s inability to meet agreed upon service level objectives.

Rights of the Contractor:

1. The Contractor has the right to establish clear procedures, workflows and system configurations for the handling of First- Class Mail to achieve Timely Delivery.

2. The Contractor has the right to document their liability limits in the event of loss or damage to First-Class Mail Timely Delivery associated audit records for situations and events beyond their control.

3. The Contractor has the right to dispute a case and disagreement between CDCR and the Contractor regarding the First-Class Mail Timely Delivery

Remedies:

The Contractor must notify the CDCR within twenty-four (24) hours with a report of significant delays to the First-Class Mail Timely Delivery.

The Contractor must immediately implement effective workflows to deliver those mail items which are beyond the three (3) day deadline, prevent further delays and report back to the CDCR on its efforts within twenty-four (24) hours.

The Contractor must send a notification to IPs when First-Class (Scanned) Mail, either “Allowed” or “Flagged for Review” has not been delivered by the seventh (7th) day after receipt at the Contractor’s Mail Processing Facility.

Up to 100% Credit per Average Daily Population (ADP) to CDCR invoices for any First-Class (Scanned) Mail which were not delivered within the three (3) day deadline to either the IPs (Allowed) or the Mailroom Staff Review Queue (Flagged for Review).

Ex: $3/ADP 100 IPs were impacted by delayed mail Credit $3 * 100 IPs = $300

Note: All remedies allowed by law are available to CDCR for any actual losses or expenses reasonably incurred by CDCR as a result of a breach of this Agreement, even if damages exceed 100% of the contract value.

6. First-Class Mail Retention

SLA Name: First-Class Mail Retention

Definition: The First-Class Mail shall be retained with regards to completeness and for the full retention periods as defined for both digital and physical copies.

Physical Physical First-Class Mail including but not limited to envelopes, hand/typewritten correspondence, photos, illustrations etc. shall be retained no less than ninety (90) days after receipt at the Contractor’s Mail Processing Facility

Digital Digital Copies of First-Class Mail including but not limited to scanned envelopes, hand/typewritten correspondence, photos, illustrations, meta data and auditable records etc. shall be retained no less than two (2) years after receipt at the Contractor’s Mail Processing Facility

Measurement Process: Each occurrence of First-Class Mail retention shall be documented on a per record basis as part of the correspondence meta data and shall be fully auditable.

Service(s): First-Class Mail

Objective (s):

Measure Objective

Physical Retention (completeness) 100%

Physical Retention (duration) 90 days

Digital Retention (completeness) 100%

Digital Retention (duration) 2 years

Rights of CDCR:

1. CDCR has the right to expect the Contractor to meet specified KPIs related to First-Class Mail physical retention.

2. CDCR has the right to expect that the Contractor will implement robust workflows and system configurations to safeguard First- Class Mail retention.

3. CDCR has the right to request evidence of First-Class Mail retention including the request to receive/extract digital copies or have originals of physical mail forwarded.

4. CDCR has the right to expect prompt and effective workflow updates or system configuration efforts by the Contractor in the case First-Class Mail retention metrics are missed.

5. CDCR has the right to be promptly notified by the Contractor in case of missed metrics, or other compromise to First-Class Mail retention.

6. CDCR has the right to access audit records associated with First- Class Mail correspondence records to verify retention compliance and status.

7. CDCR has the right to access regular reporting which details First- Class Mail retention.

8. CDCR has the right to invoke remediations tied to the Contractor’s inability to meet agreed upon service level objectives.

Rights of the Contractor:

1. The Contractor has the right to establish clear procedures for the handling, storage, backup, and restoration of First-Class Mail retention subject to CDCR’s approval.

2. The Contractor has the right to document their liability limits in the event of loss or damage to retained First-Class Mail (physical and digital) and all associated audit records for situations and events beyond their control.

3. The Contractor has the right to request an adequate recovery time to address completeness and recovery of First-Class Mail to ensure proper retention.

4. The Contractor has the right to dispute a case and disagreement between CDCR and the Contractor regarding the handling First- Class Mail retention.

Remedies:

The Contractor must notify the CDCR within Seventy-Two (72) hours with a report of the details missed retention metrics.

The Contractor must immediately implement effective workflows and system configuration efforts to recover the information, prevent further missed retention service levels and report back to the CDCR on its efforts within 30 days of the loss or damage.

Mail Retention Failures (Physical or Digital):

• 0.01% – 0.10% retention failures in a month 5% invoice credit

• 0.11% – 0.50% 10% invoice credit

• >0.50% or any lost evidence records 25% invoice credit

Critical Failures:

• Any loss of mail implicated in an investigation automatic 25% credit plus accelerated corrective action plan (24 hours).

Note: All remedies allowed by law are available to CDCR for any actual

This space intentionally left blank

7. Notifications to CDCR Staff

SLA Name: Notifications to CDCR Staff

Definition: The timely notification to CDCR Staff when applicable events occur including incoming First-Class Mail categorizations and events outlined below.

Category Flagged for Review Subject to Exception Handling Potential Contraband / Controlled Substance Detected

Events Initial Categorization / Identification (all categories listed above) Flagged for Review - Routed to Central Operations Captain Flagged for Review - Routed to ISU Exception Handling – Forwarded to Institution Contraband – Physical Mail Secured & Awaiting Pick-up / Pending Drug Test Contraband – Physical Mail Picked Up by Local Law Enforcement

Measurement Process: Each occurrence of notifications shall be documented on a per-record basis within the respective correspondence record meta data and shall be fully auditable.

Service(s): First-Class Mail

Objective (s):

Measure Monthly Objective

First-Class Mail Notifications to Staff (Events) 100%

First-Class Mail Notifications to Staff (Timeliness) 1 hour

Rights of CDCR:

1. CDCR has the right to expect the Contractor to meet specified KPIs related to First-Class Mail notifications.

2. CDCR has the right to expect that the Contractor will implement robust workflows and system configurations / logic to ensure First- Class Mail notifications.

3. CDCR has the right to request evidence of notifications of First- Class Mail events and timeliness.

4. CDCR has the right to expect prompt and effective efforts by the Contractor in the case First-Class Mail notifications metrics for events or timeliness are not being met.

5. CDCR has the right to be promptly notified by the Contractor in case of any lapse in event coverage or delay in timeliness of First- Class Mail notifications.

6. CDCR has the right to access audit records associated with notifications to verify the appropriate coverage of events and timeliness.

7. CDCR has the right to access regular reporting which details First- Class Mail notifications.

8. CDCR has the right to invoke remediations tied to the Contractor’s inability to meet agreed upon service level objectives.

Rights of the Contractor:

1. The Contractor has the right to establish clear procedures for the workflows and system configurations for First-Class Mail notifications subject to CDCR’s approval.

2. The Contractor has the right to document their liability limits in the event of lapse in coverage or delays in timeliness to First-Class Mail notifications, for situations and events beyond their control.

3. The Contractor has the right to request an adequate recovery time to address root cause analysis and resolution of system configurations of First-Class Mail notifications which are not meeting event coverage or timeliness.

4. The Contractor has the right to dispute a case and disagreement between CDCR and the Contractor regarding First-Class Mail notifications.

The Contractor must notify the CDCR within Twenty-Four (24) hours with a report of missed Notifications service levels (events coverage or timeliness).

The Contractor must immediately implement effective workflows and system configurations to resolve inadequate coverage of notification events or delays in timeliness of notifications, prevent further gaps and delays, and report back to the CDCR on its efforts within Forty-Eight (48) hours.

Timeliness Failures ( 1 hr SLA):

• Timeliness 95–99.99% 5% credit

• Timeliness 90–94.99% 10% credit

• Timeliness <90% 20% credit

Event Coverage Failures (incorrect or missing notifications):

• 0.01–0.10% failures 5% credit

• 0.11–0.50% 10% credit

• >0.50% 25% credit

Note: All remedies allowed by law are available to CDCR for any actual

8. Notifications to IPs

SLA Name: Notifications to IPs

Definition: The timely notification to IPs when applicable events occur including incoming First-Class Mail categorizations and events outlined below.

Category Allowed Mail Flagged for Review (Rejected) Exceptions Handling (Forwarded)

Events Initial Categorization / Identification (Allowed Mail) Flagged for Review – Non-English Mail / Pending Review Flagged for Review – Rejected / Disallowed by Central Operations Captain Exception Handling – Forwarded to Institution

Measurement Process: Each occurrence of notifications shall be documented on a per-record basis within the respective correspondence record meta data and shall be fully auditable.

Service(s): First-Class Mail

Objective (s):

Measure Monthly Objective

First-Class Mail Notifications to IPs (Events) 100%

First-Class Mail Notifications to IPs (Timeliness) 1 hour

Rights of CDCR:

1. CDCR has the right to expect the Contractor to meet specified KPIs related to First-Class Mail notifications.

2. CDCR has the right to expect that the Contractor will implement robust workflows and system configurations / logic to ensure First- Class Mail notifications.

3. CDCR has the right to request evidence of notifications of First- Class Mail events and timeliness.

4. CDCR has the right to expect prompt and effective efforts by the Contractor in the case First-Class Mail notifications metrics for events or timeliness are not being met.

5. CDCR has the right to be promptly notified by the Contractor in case of any lapse in event coverage or delay in timeliness of First- Class Mail notifications.

6. CDCR has the right to access audit records associated with notifications to verify the appropriate coverage of events and timeliness.

7. CDCR has the right to access regular reporting which details First- Class Mail notifications.

8. CDCR has the right to invoke remediations tied to the Contractor’s inability to meet agreed upon service level objectives.

Rights of the Contractor:

1. The Contractor has the right to establish clear procedures for the workflows and system configurations for First-Class Mail notifications subject to CDCR’s approval.

2. The Contractor has the right to document their liability limits in the event of lapse in coverage or delays in timeliness to First-Class Mail notifications, for situations and events beyond their control.

3. The Contractor has the right to request an adequate recovery time to address root cause analysis and resolution of system configurations of First-Class Mail notifications which are not meeting event coverage or timeliness.

4. The Contractor has the right to dispute a case and disagreement between CDCR and the Contractor regarding First-Class Mail notifications.

a report of missed Notifications service levels (events coverage or timeliness).

The Contractor must immediately implement effective workflows and system configurations to resolve inadequate coverage of notification events or delays in timeliness of notifications, prevent further gaps and delays, and report back to the CDCR on its efforts within Forty-Eight (48) hours.

Timeliness Failures ( 1 hr SLA):

• 95–99.99% 5% credit

• 90–94.99% 10% credit

• <90% 20% credit

Event Coverage Failures:

• 0.01–0.10% 5% credit

• 0.11–0.50% 10% credit

• >0.50% 25% credit

Note: All remedies allowed by law are available to CDCR for any actual

9. Notifications to Local Law Enforcement

SLA Name: Notifications to Local Law Enforcement

Definition: The timely notification to Local Law Enforcement when applicable events occur including incoming First-Class Mail categorizations and events outlined below.

Category Potential Contraband / Controlled Substance Detected

Events Initial Categorization / Identification (Potential Contraband) Contraband – Physical Mail Secured & Awaiting Pick-up / Pending Drug Test

Measurement Process: Each occurrence of notifications shall be documented on a per-record basis within the respective correspondence record meta data and shall be fully auditable.

Service(s): First-Class Mail

Objective (s):

Measure Monthly Objective

First-Class Mail Notifications to Local Law Enforcement (Events) 100%

First-Class Mail Notifications to Local Law Enforcement (Timeliness) 1 hour

Rights of CDCR:

1. CDCR has the right to expect the Contractor to meet specified KPIs related to First-Class Mail notifications.

2. CDCR has the right to expect that the Contractor will implement robust workflows and system configurations / logic to ensure First- Class Mail notifications.

3. CDCR has the right to request evidence of notifications of First- Class Mail events and timeliness.

4. CDCR has the right to expect prompt and effective efforts by the Contractor in the case First-Class Mail notifications metrics for events or timeliness are not being met.

5. CDCR has the right to be promptly notified by the Contractor in case of any lapse in event coverage or delay in timeliness of First- Class Mail notifications.

6. CDCR has the right to access audit records associated with notifications to verify the appropriate coverage of events and timeliness.

7. CDCR has the right to access regular reporting which details First- Class Mail notifications.

8. CDCR has the right to invoke remediations tied to the Contractor’s inability to meet agreed upon service level objectives.

Rights of the Contractor:

1. The Contractor has the right to establish clear procedures for the workflows and system configurations for First-Class Mail notifications subject to CDCR’s approval.

2. The Contractor has the right to document their liability limits in the event of lapse in coverage or delays in timeliness to First-Class Mail notifications, for situations and events beyond their control.

3. The Contractor has the right to request an adequate recovery time to address root cause analysis and resolution of system configurations of First-Class Mail notifications which are not meeting event coverage or timeliness.

4. The Contractor has the right to dispute a case and disagreement between CDCR and the Contractor regarding First-Class Mail notifications.

Remedies:

The Contractor must notify the CDCR within Twenty-Four (24) hours with a report of missed Notifications service levels (events coverage or timeliness).

The Contractor must immediately implement effective workflows and system configurations to resolve inadequate…