Rev. 9/2025- Services

Request for Proposal No. SHR126-ADMSR-6067

Voice Logger Recording System

San Bernardino County Sheriff/Coroner/Public Administrator

655 East Third Street San Bernardino, CA 92415

January 15, 2026

Sheriff/Coroner/Public Administrator

Request for Proposal Voice Logger Recording

System

I. INTRODUCTION

A. Purpose

San Bernardino County (County), by and through its included Sheriff/Coroner/Public Administrator (Sheriff), is seeking Proposals from interested and qualified Proposers to provide Voice Logger Recording System. The number of awards will be determined by the quality of the proposals received.

B. RFP Contact All correspondence, including Proposals and questions, must be submitted to the person (RFP Contact) identified below:

San Bernardino County Sheriff/Coroner/Public Administrator Attn: Elizabeth Nieves, Staff Analyst II 655 East Third Street – Bureau of Administration San Bernardino, CA 92415 enieves@sbcsd.org_Email

E-mail address may only be used to submit questions (not bid questions). Proposals will not be accepted by email or facsimile. Proposals must be submitted electronically through the County Electronic Procurement Network (ePro). The completed and signed proposal must be received by the Deadline for Proposals specified in Section II – Proposal Timeline. All Proposers must register with the ePro system prior to the date and time to submit the proposal or they will be disqualified.

C. Reserved

D. Contract Term The Voice Logger Recording System to be provided under this Request for Proposal (RFP) are outlined under Section V, Scope of Work. The Contract will be for a period of three years, to include maintenance and support, tentatively beginning on March 29, 2026 and ending on April 30, 2029 with the option to extend the Contract for one (1) additional two-year period, or two (2) additional one-year periods, dependent on Sheriff needs for the Services and funding availability.

E. Location of Services Services are to be provided, completed, and managed at the following locations:

Desert Control Center – 15900 Smoke Tree St., Hesperia, CA 92345 Valley Control Center – 153 S. Lena Road, San Bernardino, CA 92415

Sheriff reserves the right to reduce or increase the number of locations that Services shall be provided.

The Proposer must include in Proposal, Attachment E - Cost, all transportation, lodging, and per diem costs sufficient to pay its personnel and travel to the aforementioned locations.

F. Assistance to Proposers with a Disability Proposers with a disability may request accommodation regarding the means of communicating this RFP or participating in the procurement process. For more information, contact the RFP Contact no later than ten (10) days prior to the Deadline for Proposals.

II. PROPOSAL TIMELINE

Release of RFP January 15, 2026 Deadline for Submission of Proposer Questions January 26, 2026; 2:00 PM PDT Proposer Questions/Answers Posted to County Website February 3, 2026 Deadline for Submission of Proposals February 10, 2026 Date for Tentative Contract Award March, 2026

Administrator

Request for Proposal Voice Logger Recording

System

III. DEFINITIONS

Capitalized terms used in this RFP shall have the meanings given to them in the RFP and as defined below:

Board: The San Bernardino County Board of Supervisors.

Contract: The Contract between the County and the Contractor, resulting from the award issued to the successful Proposer pursuant to this RFP, that specifies the terms and conditions in how the Contractor will provide services or products to the County.

Contractor: Any individual, company, firm, corporation, partnership, or other organization to whom a contract award is made by the County.

Facilitator: A County Purchasing Department Buyer or designated individual tasked with managing the processes of the RFP evaluation panel.

Proposal: The offer to provide specific goods or services at specified prices and/or other conditions specified in the RFP.

Proposer: Any individual, company, firm, corporation, partnership, or other organization that submits a Proposal in response to this RFP

Purchasing Agent: The Director of the County Purchasing Department, or their designee.

Request for Proposal (RFP): The request for an offer from Proposers interested in providing the identified services sought to be procured by the County. The RFP specifies the evaluation factors to be used and contains or incorporates by reference contractual terms and conditions applicable to the procurement.

Services: The requested services described in this RFP.

Subcontractor: An individual, company, firm, corporation, partnership, or other organization, not in the employment of or owned by Contractor who is performing services on behalf of Contractor under the Contract or under a separate contract with or on behalf of Contractor.

IV. PROPOSAL CONDITIONS

A. Authorized Signatures

All proposals must be signed by an individual authorized to bind the Proposer to the provisions of the

RFP.

B. Term of Offer

Proposals shall remain open, valid, and subject to acceptance anytime within nine (9) months after the Proposal submission.

C. Required Review Proposers should carefully review this RFP for defects and questionable or objectionable material.

Comments from Proposers concerning defects and objectionable material in this RFP must be made in writing and received by the RFP contact prior to the deadline for submission of questions identified in Section II or at least ten (10) calendar days before the Deadline for Proposals (whichever occurs last).

This will allow issuance of any necessary amendments or addenda to the RFP. It will also help prevent the opening of a defective RFP and exposure of Proposals upon which an award could not be made.

Protests based on any omission or error, or on the content of this RFP, may be disallowed if not submitted

Administrator

Request for Proposal Voice Logger Recording

System in writing to the attention of the RFP Contact, prior to the deadline for submission of questions identified in Section II or at least ten (10) calendar days before the Deadline for Proposals (whichever occurs last).

D. Incurred Costs

The County is not obligated to pay any costs incurred by Proposer in the preparation of a Proposal in response to this RFP. Proposers agree that all costs incurred in developing a Proposal are the Proposer’s responsibility.

E. Amendments/Addendums to RFP The County reserves the right to issue amendments or addenda to this RFP if the County considers that changes are necessary or additional information is needed.

Changes to a Proposal or withdrawal of a Proposal will only be allowed if a request is received prior to the Deadline for Proposals. No amendments or withdrawals will be accepted after the Deadline for Proposals.

F. Best Value Evaluation As established in this RFP, the County realizes that criteria other than price are important and will award contract(s) based on the Proposal that best meets the needs of the County. The County seeks the optimal combination of quality, price, and various qualitative elements of the required Services that will provide the County with the greatest or best value for its money.

G. Right of Rejection Offers must comply with all of the terms of the RFP and all applicable local, state, and federal laws, codes, and regulations. The County may reject as non-responsive any Proposal that does not comply with all of the material and substantial terms, conditions, and performance requirements of the RFP.

Further, the County may reject a proposal from any entity that is a parent, affiliate, or subsidiary, or that is under common ownership, control, or management with any other entity submitting a Proposal in response to this RFP.

A Proposer may not qualify the Proposal nor restrict the rights of the County. If Proposer does so, the Proposal may be determined to be a non-responsive counteroffer and the Proposal may be rejected.

No Proposal shall be rejected, however, if it contains a minor irregularity, defect, or variation. If the irregularity, defect, or variation is considered by the County to be immaterial or inconsequential, the County may choose to accept the Proposal.

Minor irregularities may be waived by the Purchasing Agent when they are any of the following:

1. Do not affect responsiveness.

2. It is merely a matter of form or format.

3. Do not change the relative standing or otherwise prejudice other offers.

4. Do not change the meaning or scope of the RFP.

5. Are trivial, negligible, or immaterial in nature.

6. Do not reflect a material change in the work; or

7. Do not constitute a substantial reservation against a requirement or provision.

In such cases, the Proposer will be notified of the deficiency in the Proposal and given an opportunity to correct the irregularity, defect, or variation. The County may elect to waive the deficiency and accept the Proposal. The decision to provide a waiver shall in no way modify or compromise the overall purpose of the submittal, nor excuse the Proposer from compliance with all requirements if awarded a Contract.

This RFP does not commit the County to award a contract. The County reserves the right to reject any or all Proposals if it is in the best interest of the County to do so. The County also reserves the right to terminate this RFP process at any time.

Administrator

Request for Proposal Voice Logger Recording

System

H. Local Preference

San Bernardino County has adopted a Local Preference Policy. A local preference of five percent (5%) shall be applied in the cost evaluation of proposals or bids for goods, services, equipment, or a minor public work project, unless an exemption applies. In a price-based bid, five percent (5%) will be deducted from the local vendor’s proposed cost for the purpose of comparison when the local vendor’s proposed cost is not the lowest. If the local vendor’s bid is equal to or lower than the price of an otherwise successful non-local vendor after the 5% preference is applied, the local vendor will be given the opportunity to match the lowest quoted price. In a best value evaluation, five percent (5%) of the awardable points for cost will be added to the local vendor’s score. If the local vendor’s overall score is equal to or lower than that of an otherwise successful nonlocal vendor, the local vendor will be recommended for award.

“Due to the evaluation of qualitative elements along with cost in a best value evaluation, application of local preference for cost proposals may not result in award to a local vendor with the lowest cost after applying local preference.”

Local Vendor - A local vendor is any vendor, contractor, or consultant (hereafter, “Vendor”) that meets all of the following requirements:

1. Vendor’s main office (headquarters) or a major regional office is located within the County;

2. Vendor employs a minimum of 25% of the vendor’s full-time management employees and 25% of its full-time regular employees working from the San Bernardino County location(s).

3. Vendor employs one full-time or two part-time employees with primary residence in the County.

4. Vendor’s “point of sale” for purposes of reporting sales tax to the State Board of Equalization is within the boundaries of the County. The payment of any local share of sales tax must go to the County or a city within the County. If the local business has more than one sales office in the State of California, the office located in the County shall be the point of sale for sales tax calculation.

5. Vendor is not delinquent in any taxes or other payments to the County.

6. Vendor possesses a valid and verifiable business license (if required).

7. Vendor has been open and established for at least six months prior to the issuance of the solicitation.

8. Vendor can demonstrate ongoing business activity in the field of endeavor for which they are proposing from that office during the preceding six months.

9. Vendor has not, within five years prior to the solicitation, admitted guilt or been found guilty by any court or state or federal regulatory enforcement agency of violation of any criminal law or any law or regulation regarding fraud.

10. Vendor is not federally debarred; and

11. Vendor is not suspended or debarred from participation in doing business with the County, in the scope of work that is the subject of the solicitation.

12. Local Vendor Self-certification – Documentation provided.

The Local Vendor self-certification form is required for any bid or proposal when a local preference is claimed, affirming that it meets each of the above-stated criteria, and signed by a vendor representative with the authority to obligate the company under penalty of perjury. (See Attachment M.)

I. Clarification of Offers In order to determine if a Proposal is reasonably susceptible for award, communications by the Facilitator for the evaluation panel are permitted with a Proposer to clarify uncertainties or eliminate confusion concerning the contents of a Proposal. Clarifications may not result in a material or substantive change to the Proposal. The evaluation by the panel may be adjusted as a result of a clarification under this section.

J. Public Records Act All Proposals and other material submitted become the property of the County and are subject to release according to the California Public Records Act (Gov. Code, § 7920.000 et seq.). All Proposal information, Administrator

Request for Proposal Voice Logger Recording

System including cost information, will be held in confidence during the evaluation and negotiation process.

Thereafter, Proposals are subject to becoming a non-exempt public record.

If a Proposer believes that any portion of its Proposal is exempt from public disclosure, it must indicate the specific portions believed to be confidential and not subject to disclosure on Attachment I - Public Records Act Exemptions. The Proposer also must include a brief description that sets out the reasons for exemption from disclosure. Each stated exemption must include a citation to supporting legal authority, including statutory authority or case law, to support the exemption from the Public Records Act. Requested exemptions that do not meet the requirements of this section will not be considered.

The County will use reasonable means to ensure that such information is safeguarded, but will not be held liable for inadvertent disclosure of the information. Proposals marked “Confidential” in their entirety will not be honored, and the County might not deny public disclosure of any portion of Proposals so marked.

By submitting a Proposal with portions identified in Attachment I as “Confidential,” Proposer represents that it has a good faith belief that such portions are exempt from disclosure under the California Public Records Act. Proposer may be requested to obtain legal protection from disclosure should a Public Records Act request be received. In the event the County does not disclose the information marked “Confidential,” Proposer agrees to reimburse the County for, and to indemnify, defend (with counsel approved by County), and hold harmless the County, its officers, employees, agents, and volunteers from and against any and all claims, damages, losses, liabilities, suits, judgments, fines, penalties, costs, and expenses including, without limitation, attorneys’ fees, expenses, and court costs of any nature arising from or relating to the County’s non-disclosure of any such designated portions of a Proposal.

K. Employment of Former County Officials Information must be provided in Attachment G regarding former County Administrative Officials (as defined below) who are employed by or represent Proposer. The information provided must include a list of former County Administrative Officials who terminated County employment within the last five years and who are now officers, principals, partners, associates, or members of Proposer and should also include the employment and/or representative capacity and the dates these individuals began employment with or representation of Proposer. For purposes of this section, “County Administrative Official” is defined as a member of the Board of Supervisors or such member’s staff, Chief Executive Officer or member of such officer’s staff, County department or group head, assistant department or group head, or any employee in the Exempt Group, Management Unit or Safety Management Unit.

Failure to provide this information may result in the Proposal being deemed non-responsive.

L. Reserved

M. Disclosure of Criminal and Civil Proceedings The County reserves the right to request the information described herein from the Proposer selected for Contract award (Attachment K – Disclosure of Criminal and Civil Proceedings). Failure to provide the information may result in a disqualification from the selection process and no award of Contract to the Proposer. The County also reserves the right to obtain the requested information by way of a background check performed by an investigative firm. The selected Proposer may also be asked to provide information to clarify initial responses. Negative information provided or discovered may result in disqualification from the selection process and no award of Contract.

The selected Proposer may be asked whether the firm, or any of its partners, principals, members, associates, or key employees (as that term is defined herein), within the last ten years, has been indicted on or had charges brought against it or them (if still pending), or convicted of any crime or offense arising directly or indirectly from the conduct of the firm’s business, or whether the firm, or any of it partners, principals, members, associates, or key employees, within the last ten years, has been indicted on or

Administrator

Request for Proposal Voice Logger Recording

System had charges brought against it or them (if still pending), or convicted of any crime or offense involving financial misconduct or fraud. If the response is affirmative, the Proposer will be asked to describe any such indictments or charges (and the status thereof) and convictions, and the surrounding circumstances in detail.

In addition, the selected Proposer may also be asked to disclose whether the firm, or any of its partners, principals, members, associates, or key employees, within the last ten years, has been the subject of legal proceedings as defined herein arising directly from the provision of services by the firm or those individuals. “Legal proceedings” means any civil actions filed in a court of competent jurisdiction, or any matters filed by an administrative or regulatory body with jurisdiction over the firm or the individuals. If the response is affirmative, the Proposer will be asked to describe any such legal proceedings (and the status and disposition thereof) and the surrounding circumstances in detail.

For purposes of this provision, “key employees” include any individuals providing direct service to the County. “Key employees” do not include clerical personnel providing service at the firm’s offices or locations.

N. Debarment and Suspension; California Secretary of State Business Entity Registration.

Proposer certifies in Attachment D that neither it nor its principals or Subcontractors are presently debarred, suspended, proposed for debarment, declared ineligible, or voluntarily excluded from participation in this transaction by any federal department or agency. (See Attachment D and the following United States General Services Administration’s System for Award Management website https://www.sam.gov). Proposer also certifies in Attachment D that if it or any of the Subcontractors listed in the Proposal are business entities that must be registered with the California Secretary of State, they are registered and in good standing with the Secretary of State.

O. Unsatisfactory Performance Proposer affirms that it has no record of unsatisfactory performance with the County in the twenty-four

(24) month period immediately preceding the date of issuance of this RFP.

P. Final Authority The final authority to award a contract(s) as a result of this RFP rests solely with the County Board of Supervisors, or as delegated by the Board of Supervisors.

Q. Reserved

V. SCOPE OF WORK

The following Scope of Work (SOW) defines the work that the successful Proposer shall perform in the provision of Voice Logger Recording System (System). All proposals for the requested System shall either meet or exceed the requirements herein:

A. BACKGROUND INFORMATION

The County of San Bernardino is a diverse public service organization serving America’s largest county, geographically spanning more than 20,000 miles, and dedicated to the nearly 2.2 million residents. The San Bernardino County Sheriff’s Department (Sheriff’s Department) consists of 2007 sworn personnel, 2073 professional employees and 1552 volunteers.

The Sheriff’s Department oversees the unincorporated county areas, operates the county jail system, provides marshal services in the county courts, and contracts law enforcement services to 14 of the 24 incorporated cities within the county.

Administrator

Request for Proposal Voice Logger Recording

System

The Sheriff’s Communications Division is comprised of two dispatch centers, the Desert Control Center (DCC) and the Valley Control Center (VCC). Each center serves as the primary Public Safety Answering Point (PSAP) for its respective geographic location.

1. Calls for Service: In 2024, the Communications Division received 411,375 9-1-1 emergency calls 592,599 10-digit emergency calls 468,201 Administrative calls 1,597 Text-to-911 sessions 1,473,772 total combined line calls.

2. Network Architecture: Redundant network solutions with Valley (Site A) and Desert (Site B).

Additional consideration for a newly constructed location to move Valley Control (Site A), tentatively 1st quarter 2026.

3. Computer-Aided Dispatch: Central Square’s CommandCAD is the current computer-aided dispatch (CAD) software system.

4. Call Handling: Motorola VESTA is the current telephone answering system. The Valley has 28 call handling consoles; the Desert has 42 call handling consoles. Additional consideration for the newly constructed VCC location, to increase to 58 call handling consoles.

5. Radio System: Motorola CentraComm (dispatch radio console) on the County’s 800Mhz digital radio system is the current radio infrastructure, hardware, and software system. Additional consideration to new hardware, Motorola Command Central AXS, that will replace legacy equipment and is tentatively planned for operations in the 1st quarter 2026.

B. TECHNOLOGY AND FUNCTIONALITY

The Sheriff’s Communications Division is seeking a “Turnkey” Voice Logger Recording solution. The project shall include full procurement, installation/replacement, configuration, migration, training of a voice logger recording system, and disposal of any/all legacy systems. The Proposer will be responsible for the provisioning of equipment, system design/performance to specifications, installation, and testing, through final acceptance of the system. All costs associated with the project shall be included in the proposal submission.

B.1 STANDARDS AND SUMMARY REFERENCE

B.1.1 References: The Proposer will be required to demonstrate that it has designed, delivered, and successfully installed one or more Voice Logger Recording System(s) supporting similar specifications as listed below, for an organization comparable in size and scope to the Sheriff’s Department. The Proposer shall also provide references for current customers for customer verification.

B.1.2 General Requirements: The proposed solution shall be designed for redundancy and deployed in a configuration with the following general requirements:

B.1.2.1 Shall provide minimum hardware and channel capacity for each site:

B.1.2.1.A VCC – 27 analog channels; 29 VESTA IP consoles; rack-mounted server(s) for recording and/or database storage. Consideration for near future growth to 58 VESTA IP consoles.

B.1.2.1.B DCC – 22 analog channels; 52 VESTA IP consoles; rack mounted server(s) for recording and/or database storage.

B.1.2.1.C Motorola P25 Archive Interface Server (AIS) integration; rack-mounted server(s).

B.1.3 Shall support recording radio traffic, encrypted/unencrypted, through Internet Protocol (IP) connections to the system.

B.1.4 Shall support master time synchronization.

Administrator

Request for Proposal Voice Logger Recording

System

B.1.5 Shall support recording NexGen 9-1-1 telephony through IP connections.

B.1.6 Shall have NextGen 9-1-1 readiness, with respect to the system architecture and features.

B.1.7 Shall support recording Cisco office telephone traffic through IP connections as an option.

B.1.8 Shall support recording for analog Centralized Automatic Message Accounting (CAMA)

Trunks and Plain Old Telephone Service (POTS) lines.

B.1.9 Shall support recording analog position audio.

B.1.10 Shall support access to recording based on multiple tiers of user permissions associated with talk groups, lines, and console positions.

B.1.11 Shall support future growth, analog and digital.

B.1.12 Shall provide a comprehensive reporting analysis of data analytics.

B.1.13 Shall provide Automated Quality Assurance/Real Time Monitoring.

B.1.14 Shall provide a solution for support and/or a backup option to minimize unexpected downtimes/failures.

B.1.15 Shall provide system architecture aligned with the Federal Criminal Justice Information

Services (CJIS) and the National Institute of Standards and Technology (NIST) cyber threat Frameworks. It shall provide attestation or equivalent Service Organization Report Security Operations Center (SOC) 2 type II upon initial agreement, and annually afterwards.

B.1.16 Shall provide Network impact performance analysis (both LAN and WAN) for local and cloud-based file transmission to identify network degradation or performance issues with the new voice recording logging system.

B.1.17 Proposer shall ensure that the installation of any equipment cabinets, enclosures, racks, and cable trays must be properly identified in the proposal and installed so that wires/cables do not cross over within cable bundles. Cables must also be properly labeled, routed, and secured. The installation of any network cabling within or outside the equipment cabinets, enclosures, and/or cable trays will be routed in accordance with industry-standard cable management practices and approved by Sheriff’s personnel.

B.1.18 Proposer shall provide final system acceptance testing in conjunction with Sheriff’s Department Communication personnel and Technical Services representatives.

B.1.19 Additional Features:

B.1.19.A Automated association of recorded phone calls and/or radio transmissions with incident numbers automatically identified from the CAD system.

B.1.19.B Redaction B.1.19.C Screen Recording B.1.19.D Dashboard(s) allowing for insights into call handling and radio transmission.

B.1.19.E File Size optimization and compression.

B.1.19.F Proposer must be a corporate member of industry associations, with timely and comprehensive knowledge of PSAP requirements and future trends.

B.1.20 Federal Criminal Justice Information Services (CJIS) Compliance: The proposed solution must comply with CJIS requirements. Key elements include: data encryption, multi-factor authentication, authorized personnel access controls, network security monitoring, audit logging, Cloud security (if applicable), and data custody.

B.1.21 Industry Standard Compliance: The proposed solution must comply with the latest National Emergency Number Association (NENA) standards for recording and next-generation technology; all hardware parts, assemblies, and components contained in the recorder should be available commercially off the shelf (COTS) from major manufacturers.

Administrator

Request for Proposal Voice Logger Recording

System

B.1.22 Concurrent Systems: The proposed Voice Logger Recording system will be required to operate concurrently with the existing recording solution for a period of time during the respective system cutover. The current solution is the only system in use and must operate 24 hours per day; 7 days per week; 365 days per year (24/7/365). Therefore, duplicated solutions will coexist for some period of time as various systems are cutover.

B.1.23 Work Quality: All workmanship shall be of the highest quality, in accordance with industry standards, practices, specifications, and applicable codes. Work areas shall be maintained neatly and orderly.

B.1.24 Service Manuals: All installation, service, and user documentation for each component of the solution delivered shall be provided to the Sheriff’s Department.

C. SYSTEM DELIVERY

System delivery and overall project management are vital to the success of any project. The Sheriff’s Department requires a structured project management framework for managing the Voice Logger Recording Project. The awarded Proposer (Contractor) shall provide sufficient qualified personnel trained to perform Contractor’s obligations hereunder. Contractor shall assign full-time project managers to both the new voice logger application implementation and the legacy voice logger application, and the data conversion project.

C.1 The Scope of the proposed system delivery shall include:

C.1.2 Project Methodology: Outlining a project overview and project approach, inclusive of an initial project timeline and preliminary project schedule, and go-live date. This schedule will be reviewed and refined by the parties during the project’s initiation and planning phase.

C.1.3 Project Planning: Define the project roadmap and a preliminary list of project milestones and associated deliverables, with associated costs. The project timeline should include anticipated phases, time in days for each phase, and milestone(s) within, i.e., project initiation and planning, system implementation, user acceptance testing, conclusion, and final delivery.

C.1.4 Roles and responsibilities: Identify roles and responsibilities for both the County and Contractor project team members.

C.1.5 Communication and Relationship Plan: Describes how communications will be planned, structured, monitored, and controlled.

C.1.6 Risk Management Plan: Describes how risk management activities will be structured and performed.

C.1.7 Issue/Defect Management Plan: The tools and techniques used to document, track, and resolve product and project issues and defects.

C.1.8 System Design Architecture: Describe and present the proposed system architecture and design, including all local on-premise, Cloud, Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) offerings.

C.1.9 Data Conversion: Contractor shall work with Sheriff’s staff to identify and migrate any and all legal and regulatory data from the legacy system into the new voice logger system with associated metadata, call history, call mappings, and identifiers. Contractor will provide reports on the percentage of recordings successfully converted and migrated, giving the County insight into the data conversion effort.

Administrator

Request for Proposal Voice Logger Recording

System

C.1.10 Customization/Integration: Explanation of the coordination of any customization, interface designs, and integration needs, including a list of application and/or data conversion project deliverables.

C.1.11 Installation and Testing: Provide documentation for user acceptance testing and preparing for go-live testing methodology.

C.1.12 Go-live plan: documents activities explicitly undertaken to prepare for and successfully execute the voice logger recording system go-live

C.1.13 Acceptance and Sign-Off: Provide documentation of the system acceptance checklist.

D. MAINTENANCE AND SUPPORT

Proposer shall outline the maintenance support services provided to ensure the ongoing functionality, reliability, and performance of the voice logger recording system after initial implementation and system acceptance. The objective of a maintenance support agreement is to provide proactive and reactive maintenance support services, address potential issues, upgrade systems, and ensure continuous system health.

D.1 The Scope of maintenance and support should include:

D.1.2 Maintenance Support Team: Specify team composition; customer service representative, roles, and responsibilities.

D.1.3 Support Contact Methods: Proposer shall describe its methods for contacting support, including, but not limited to:

D.1.3.1 24/7 Helpdesk availability D.1.3.2 Telephone support with direct access to qualified technicians D.1.3.3 Remote diagnostic and troubleshooting capabilities D.1.3.4 Defined escalation procedures for complex issues, i.e., tier 1 or tier 2 D.1.3.5 On-site response protocols and timeframes when remote resolution is not feasible

D.1.4 Service Levels: The Proposer shall describe the support levels offered, including critical, standard, and limited levels, as well as the activities supported by the support team.

D.1.4.1 Initial response to all support requests within four (4) hours of notification D.1.4.2 Expected resolution timeframes

D.1.5 System Monitoring: The Proposer shall describe their performance monitoring, hardware and/or software vulnerability programs, security and defect fixes, and outage detection notifications to the customer.

D.1.6 Technical Support: Should include access to all new releases, updates, bug fixes, security patches, and other corrective performance software, at no additional cost to the customer.

D.1.7 Maintenance Schedule: The Proposer shall describe its methodology for system maintenance and notification, including operating system updates, patching for fixes, and vulnerabilities, testing and releasing software updates; frequency of updates (quarterly, annually, etc.), method of communication and delivery to the customer; and outages or performance degradation issues, including incident response procedures, expected response and resolution times based on severity levels, communication methods during service disruptions, and post-incident reporting requirements

D.1.8 Warranty: The Proposer will define the warranty for all hardware and software of the voice logger recording solution. The warranty will commence at the time of final acceptance approval.

Administrator

Request for Proposal Voice Logger Recording

System

E. SECURITY AND CLOUD SERVICE AVAILABILITY

When selecting an application to handle Criminal Justice Information (CJI), compliance with the current FBI’s CJIS Security Policy, version 6.0 is critical to ensure the protection of sensitive data. The application must incorporate robust security measures, including access controls to restrict CJI access to authorized personnel, encryption of data both at rest and in transit (using at least 256-bit encryption), and multi-factor authentication (MFA) as mandated by CJIS Security.

If the proposer is offering a cloud-based application, the Cloud Service shall be available twenty-four (24) hours per day, 365/366 days per year. If Cloud Service monthly availability averages less than 99.5% (excluding agreed-upon maintenance downtime), County shall be entitled to recover damages, apply credits, or use other contractual remedies as set forth in the Service Level Agreement (SLA). If Cloud Service monthly availability averages less than 99.5% (excluding agreed-upon maintenance downtime), for three (3) or more months in a rolling twelve-month period, County may terminate the contract for material breach. Service Provider shall provide advance written notice to County of any major upgrades or changes that will affect the Cloud Service availability.

E.1 Data Availability: County Data shall be available twenty-four (24) hours per day, 365/366 days per year. If County Data monthly availability averages less than 99.5% (excluding agreed-upon maintenance downtime), County shall be entitled to recover damages, apply credits or use other contractual remedies as set forth in the SLA if County is unable to access County Data as a result of: (i) acts or omission of Service Provider; (ii) acts or omissions of third parties working on behalf of Service Provider; (iii) network compromise, network intrusion, hacks, introduction of viruses, disabling devices, malware and other forms of attack that can disrupt access to Service Provider’s server, to the extent such attack would have been prevented by Service Provider taking reasonable industry standard precautions; (iv) power outages or other telecommunications or Internet failures, to the extent such outages were within Service Provider’s direct or express control. If County Data monthly availability averages less than 99.5% (excluding agreed-upon maintenance downtime), for three (3) or more months in a rolling twelve-month period, County may terminate the contract for material breach in accordance with the Termination for Default provision in the General Provisions

– Information Technology.

E.1.1 Data Retention: County records covered by this system include all voice, data, and records maintained by the San Bernardino County Sheriff. These records will be stored in a system that meets the requirements of all applicable Government Code sections governing the standards for storing public records in electronic media or a cloud computing storage service. The system will comply with the security and protection requirements established by the National Institute of Standards and Technology (NIST), including NIST SP 800-53 and related controls for data integrity, availability, and confidentiality, as well as the Federal Criminal Justice Information Services (CJIS) Security Policy requirements for the retention, safeguarding, controlled access, and disposition of Criminal Justice Information (CJI).

The records will be retained for a minimum of two years, or longer as required, and in accordance with the San Bernardino County Sheriff’s records retention schedule.

Retention periods will further adhere to applicable NIST and CJIS guidelines, ensuring that data is preserved for operational, legal, and regulatory purposes while maintaining

Administrator

Request for Proposal Voice Logger Recording

System compliance with mandated security controls, auditing requirements, and approved disposition procedures.

E.2 Software as a Service (SaaS) and Security

E.2.1 Certification: upon request, Proposer shall certify:

E.2.1.2 The sufficiency of its security standards, tools, technologies and procedures in providing SaaS under this Contract, and, if requested by County, provide a copy of its Statement on Standards for Attestation Engagements (SSAE) 18 SOC 2 Type II audit results;

E.2.1.3 Its compliance with the California Information Practices Act (Civ. Code, § 1798 et seq.);

E.2.1.4 Its compliance with the privacy provisions of the Federal Privacy Act of 1974; and E.2.1.5 Its compliance with applicable industry standards and guidelines, including but not limited to relevant security provisions of the Payment Card Industry (PCI) Data Security Standard (PCI/DSS) including the PCI/DSS Cloud Computing Guidelines.

E.3 Safeguards Proposer shall implement and maintain all appropriate administrative, physical, technical and procedural safeguards in accordance with section E.3 above at all times during the term of the awarded Contract to secure County Data from Data Breach, protect County Data and the SaaS from hacks, introduction of viruses, disabling devices, malware and other forms of malicious or inadvertent acts that can disrupt and/or compromise County’s access to County Data.

E.4 High-Availability and Redundancy

Proposer shall have and provide a high-availability and a redundant environment, where the minimum requirements are:

E.4.1 Power and/or generators shall be 2N E.4.2 Uninterruptible Power Supply (UPS) power shall be 2N E.4.3 Redundant servers shall be N+1 E.4.4 Data center shall be Tier-2 E.4.5 Data center cooling shall be 2N E.4.6 All UPS’s and generators must be tested and inspected on a quarterly basis.

E.4.7 Data center cooling must have preventative maintenance performed quarterly.

E.4.8 Proposer shall provide the County Chief Information Security Officer (CISO) (including

Auditor-Controller/Treasurer/Tax Collector and Sheriff) annually, the ability to review, in a secure manner, facilitated by Proposer, the SOC II Type II reports from Contractor’s data centers.

E.5 Physical Proposer shall have a reasonable physical security environment, where the minimum requirements are:

E.5.1 Physical access to facility, data center(s), and/or server room(s) is restricted using an access control system that utilizes iCLASS SE or multiclass SE readers E.5.2 Access control system must be capable of restricting access by time of day and groups E.5.3 Access control system must be auditable E.5.4 Access control system components and batteries must be inspected annually E.5.5 Access control system batteries must be replaced every 3 years or when they fail E.5.6 Access control history must be retained for a minimum of 3 years or as required by law

Administrator

Request for Proposal Voice Logger Recording

System

E.5.7 Alerts are generated when physical security has been breached by the access control system or intrusion detection system

E.5.8 Intrusion detection systems must be monitored by a third-party UL central station E.5.9 Intrusion detection systems must be inspected and tested quarterly with signals sent to the central station. Testing reports must be retained for 3 years.

E.5.10 Intrusion detection batteries must be inspected annually and replaced every 3 years or when they fail E.5.11 Facility, data center(s), and server room(s) have an appropriate Video Surveillance

System in place for surveillance E.5.12 Video surveillance system must have the capability to interface with the access control system and intrusion detection system E.5.13 Video surveillance system must be inspected quarterly to make sure cameras are recording and video is being archived E.5.14 Video surveillance system must archive video as per California Government Code sections 26202.6, 34090.6, and 53160 E.5.15 All access control systems, intrusion detection systems, and video surveillance systems must be on the facility's emergency power system and protected by UPS E.5.16 Data centers have protections in place that minimize environmental issues such as temperature, fire, smoke, water, dust, electrical supply interference, and electromagnetic radiation

E.5.17 A chemical fire suppression system installed in the data center as per National Fire Protection Association (NFPA) 2001

E.5.18 The chemical fire suppression system must be inspected semiannually as per NFPA 2001 §8.3

E.5.19 Smoke detectors under the raised floors E.5.20 Water detection system under the raised floors and above the ceiling E.5.21 Facility must be protected 100% by an automatic fire sprinkler system, with the data center being protected with an automatic pre-action fire sprinkler system E.5.22 Facility automatic fire alarm system must be tested and inspected as per NFPA 25

E.6 Verification: Upon request, Proposer shall provide a Statement on Standards for Attestation

Engagements 18 (SSAE18) SOC 2 Type II Report (or equivalent, such as StateRAMP) on an annual basis. Based on the report(s), its findings and remediation planned or accomplished shall be provided to the County CISO in terms of an attestation letter. Service Provider shall also provide statistics specific to SaaS environment on a mutually agreed upon frequency with County that includes, without limitation to performance, information security, network, and other pertinent SaaS data related to the Contract, at no cost to County.

E.7 Security: Awarded Proposer shall assume responsibility for the security and confidentiality, integrity, and availability of County Data under its control. No County Data shall be copied, modified, destroyed, or deleted by Proposer other than for normal operation or maintenance of SaaS during the Contract period without prior written notice to and written approval by CISO. When data is destroyed or disposed of, it shall be in accordance with the National Institute of Standards of Technology (NIST) Special Publication 800-88, published by the U.S. Department of Commerce.

The incorporation of the Department of Defense (DoD) Standard 5220.2-M wipe method shall be used when using data destruction programs, file shredders, etc. To the extent Proposer’s staff or subcontractors access County Data in the System from outside the Continental United States

Administrator

Request for Proposal Voice Logger Recording

System

(CONUS), Contractor warrants that such staff or subcontractors' access will be done via secure remote access capability (e.g., VPN), on a cyber hygiene-protected workstation or laptop owned and managed by Contractor, and with the use of multi-factor authentication. Any other remote access to County Data from outside the CONUS is prohibited unless approved in advance by the

CISO.

E.8 Encryption: In order to provide reasonable security to County Data, cloud service data centers should encrypt all County Data while in route to and from the Service Provider (in motion) using secure transfer methods (e.g., Secure Sockets Layer, Transport Layer Security), and while stored in the datacenter (at rest).

E.8.1 Data in Motion - All transmitted County Data requires encryption in accordance with:

E.8.1.1 NIST Special Publication 800-52 Guidelines for the Selection and Use of Transport Layer Security Implementations; CJIS Security Policy (CJISSECPOL v6.0), and

E.8.1.2 NIST Special Publication 800-57 Recommendation for Key Management - Part 3: Application Specific

E.8.1.3 Key Management Guidance; and E.8.1.4 Secure Sockets Layer (SSL) is minimally required with a minimum cipher strength of 128-bit E.8.2 Data at Rest - All County Data at rest requires encryption in accordance with:

E.8.2.1 CJIS Security Policy (CJISSECPOL v6.0) and E.8.2.2 Federal Information Processing Standard Publication (FIPS) 140-2; and E.8.2.3 National Institute of Standards and Technology (NIST) Special Publication 800-

57 Recommendation for Key Management - Part 1: General (Revision 3); and E.8.2.4 NIST Special Publication 800-57 Recommendation for Key Management - Part

2: Best Practices for E.8.2.5 Key Management Organization; and E.8.2.6 NIST Special Publication 800-111 Guide to Storage Encryption Technologies for

End-User Devices E.8.2.7 Advanced Encryption Standard (AES) with a cipher strength of 256-bit is minimally required

E.9 Data Location: Unless otherwise stated in the Statement of Work (SOW) and approved in advance by the CISO, the physical location of the Service Provider’s data center where County Data is stored shall be within the CONUS, and County Data shall not be transmitted, processed, or stored outside of the CONUS.

E.10 Rights to Data: The parties agree that as between them, all rights, including all intellectual property rights, in and to County Data shall remain the exclusive property of County, and Provider will have a limited, non-exclusive license to access and use County Data as provided to Proposer solely for performing its obligations under the Contract. Nothing herein shall be construed to confer any license or right to County Data, including user tracking and exception County Data within the system, by implication, estoppel or otherwise, under copyright or other intellectual property rights, to any third party. Unauthorized use of County Data by Proposer or third parties is prohibited. For the purposes of this requirement, the phrase “unauthorized use” means the data mining or processing of data, stored or transmitted by the service, for unrelated commercial purposes, Administrator

Request for Proposal Voice Logger Recording

System advertising or advertising-related purposes, or for any other purpose other than security or service delivery analysis that is not explicitly authorized.

E.11 Transition Period: For ninety (90) days prior to the expiration date of a resulting Contract, or upon notice of termination of a Contract, the awarded Proposer shall assist County in extracting and/or transitioning all County Data in the format mutually determined by the parties (“Transition Period”).

The Transition Period may be modified in the SOW or as agreed upon in writing by the parties in a contract amendment. During the Transition Period, SaaS and County Data access shall continue to be made available to County without alteration. Proposer agrees to compensate County for damages or losses County incurs as a result of Proposer’s failure to comply with this section. Unless otherwise stated in the SOW, the Proposer shall permanently destroy or render inaccessible any portion of County Data in Proposer’s and/or subcontractor’s possession or control following the expiration of all obligations in this section. Within thirty (30) days, Proposer shall issue a written statement to County confirming the destruction or inaccessibility of County Data. County, at its option, may purchase additional transition services as agreed upon in the SOW.

E.12 Data Breach:

E.12.1 Notification - Upon discovery or reasonable belief of any Data Breach, Proposer shall notify the CISO by the fastest means available and in writing to the County Notices contact within twenty-four (24) hours after Proposer reasonably believes a Data Breach has occurred. At a minimum, the notification shall include:

E.12.1.1 The nature of the Data Breach;

E.12.1.2 County Data accessed, used, or disclosed;

E.12.1.3 Any evidence of County Data extricated;

E.12.1.4 The identity of the person(s) who accessed, used, disclosed, and/or received

County Data (if known);

E.12.1.5 The law enforcement agency(ies) contacted; and E.12.1.6 Actions taken or will be taken to quarantine and mitigate the Data Breach; and E.12.1.7 Corrective action taken or will be taken to prevent future Data Breaches

E.13 Investigation:

Proposer shall conduct an investigation of the Data Breach and shall share the report of the investigation with the CISO.