{"text_format":"1","workbook":"xlsx","n_sheets":1,"sheets":["Support, Maint., & Enhancement"],"not_rendered":{"charts":0,"images":0,"macros":1,"external_links":0,"defined_names":5,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Support, Maint., & Enhancement","index":0,"n_rows":550,"n_cols":5,"rows_kept":550,"cut":false,"hidden":false,"merged":[[132,0,132,4],[156,0,156,4],[164,0,164,4],[25,0,25,4],[62,0,62,4],[8,0,8,4],[0,0,0,4],[7,0,7,4],[6,0,6,4],[1,0,1,4],[2,0,2,4],[3,0,3,4],[272,0,272,4],[294,0,294,4],[331,0,331,4],[377,0,377,4],[405,0,405,4]]}
["Attachment B-1 - Technical Specifications Requirements Matrix – Vendor Response Form - Technical Specifications – Requirements Matrix - VENDOR RESPONSE FORM           \nA response in the form of an Availability Code (A, E, or X) is required for each item. Vendors should respond according to the “ITS RFP Response Checklist” at page 2 of the RFP.                                          Vendor must indicate what additional costs, if any, will be incurred and those costs must be included on the Cost Information Submission, Attachment C-1, as a separate line item. A response of A, E, or X is MANDATORY in this document. For any items with a response of \"E\" or \"X\" is your response, then also include that response on the Proposal Exception Summary Form."]
["A = Vendor will comply with the requirement."]
["E = Vendor is not able to meet the requirement, but is able to provide an alternative solution.                                                                                                                                                                         Vendor must list their alternative solution in Section V Proposal Exception Summary Form of their proposal response.                                                                                                                                          Vendor must also include details explaining the alternative solution in the Vendor Comments column."]
["X = Vendor is not capable of providing the requirement or the service is not available.                                                                                                                                                                            Vendor must list these requirements in Section V Proposal Exception Summary Form of their proposal response."]
[]
["Ref #","Description","Mandatory Requirement \"M\"","Vendor Response:  A, E, or X","Vendor Comments \n(if response is \"A\" or \"E\", please provide page / paragraph references to the location of the details in your proposal)"]
["REEMPLOYUSA APPLICATION SUPPORT, MAINTENANCE, AND ENHANCEMENT SERVICES--ATTACHMENT G"]
["Responding Vendors must provide services to support and maintain the ReEmployUSA Unemployment Insurance system for Mississippi and its Consortium partner(s) including the Maine Department of Labor."]
["1. VENDOR QUALIFICATIONS"]
[34,"The Vendor must demonstrate past (within the last ten (10) years) and current proficiency and experience using either or both of the technology stacks employed by the individual Consortium States"]
[35,"The Vendor must demonstrate a recent track record of maintenance and support of a system the size and scope of the systems of each Consortium State as described in this RFP packet (namely, the existing technology state).  "]
[36,"The Vendor must substantiate experience with two (2) prior projects (within the last ten (10) years) relevant to these criteria."]
[37,"The Vendor must have demonstrated proficiency and experience in the design, development, and support of microservices and transforming monolithic apps into modular microservices using container technology."]
[38,"The Vendor must have five (5) years of demonstrated proficiency and experience in developing applications for the cloud."]
[39,"The Vendor and each Subcontractor must demonstrate financial capacity to accommodate and support all the tools and sufficiently large workforce to independently handle the scope of the contract by submitting a letter of financial capability or letter of comfort regarding the Vendor’s and Subcontactor's working capital and workforce details in Section E. Staffing Plan"]
[40,"The Vendor must have demonstrated proficiency and experience of at least one (1) year in developing applications using AI, ML, U/X, C/X to enhance user experience."]
[41,"The Vendor must demonstrate proficiency and experience of at least five (5) years’ working with a state or federal government system."]
[42,"The Vendor must specifically demonstrate its proficiency and experience, including the number of years and the scope of such experience, supporting, maintaining and/or developing a state UI system."]
[43,"The Vendor must identify all executive and professional personnel to be assigned to the project, provide a summary of their qualifications, and a copy of their resume. Resumes must reflect qualifications and recent experience relevant to the scope of the work indicated in this RFP and the area of the project that the proposed individual will be assigned."]
[44,"Background Checks:  The Vendor must conduct criminal background checks and not utilize any staff, including sub-contractors, who have been convicted of any crime of dishonesty, including but not limited to criminal fraud, or otherwise convicted of any felony or any misdemeanor offense for which incarceration for a minimum of one (1) year is an authorized penalty. The Vendor must promote and maintain an awareness of the importance of securing the State's information among Contractor's, employees, and agents.  The Vendor must agree to allow their staff, including any subcontractors, to be subject to additional background checks performed by the State. The Vendor must describe the background verification process used in the hiring of its management staff and its individual consultants."]
[45,"The Vendor must demonstrate proficiency in Agile development (preferably Scrum)."]
[46,"The Vendor must demonstrate proficiency and experience working with projects that involve collaboration with multiple customers, joint ventures, and/or infrastructure services companies."]
[47,"The Vendor must demonstrate proficiency and experience managing applications in the AWS Cloud."]
[48,"The Vendor must demonstrate proficiency and experience with Kubernetes, containerization, and data streaming."]
[49,"The Vendor must demonstrate successful deployment of two (2) significant microservices projects within an enterprise application."]
["2. VENDOR CAPABILITIES"]
[50,"Project Management and Planning"]
["50.a","Develop a comprehensive project work plan and Project Management Plan, including recommendations for staff, skills, equipment, training, and responsibilities."]
["50.b","Analyze and evaluate project progress, resources, budget, schedules, workflow, and reporting."]
["50.c","Review and analyze project management planning and software development documents."]
[51,"Stakeholder Consultation and Requirements"]
["51.a","Oversee product management and strategic planning to align with project goals and stakeholder needs."]
["51.b","Consult with stakeholders to assess user involvement and system functionality"]
["51.c","Sketching, wireframing, prototyping, and user task flow development."]
["51.d","Review and ensure traceability of business and technical requirements throughout the development and implementation phases."]
[52,"Performance and Risk Management"]
["52.a","Develop performance metrics to track project completion against milestones."]
["52.b","Provide risk management assessments and capacity planning services."]
["52.c","Conduct analysis of past project performance (schedule, budget) to identify and recommend improvements."]
[53,"Development Processes and Configuration Management"]
["53.a","Review and monitor development processes to ensure they are documented and analyzed for improvement."]
["53.b","Assess and recommend improvements for Configuration Management (CM) practices and tools."]
["53.c","Oversee open-source software development and manage authentication services."]
["53.d","Implement and manage industry standard CI/CD processes to streamline development and deployment."]
["53.e","Refactor code to reduce technical debt and improve system maintainability."]
["53.f","Manage API development and documentation as part of configuration management."]
[54,"Deliverables and Documentation Review"]
["54.a","Perform detailed reviews of project deliverables, system documentation, software architecture, and application software for accuracy, completeness, and adherence to standards.  "]
["54.b","Analyze application, network, hardware, and software performance relative to expectations and industry standards."]
[55,"Testing"]
["55.a","Assess and recommend improvements for software testing adequacy, including review of test cases and direct observation of testing."]
["55.b","Automated testing (unit, integration, end-to-end)."]
["55.c","Ensure that public-facing sites and tools are thoroughly tested to meet quality standards."]
["55.d","Assist with all facets of User Acceptance Testing (“UAT”) assistance. i.e., test case identification, demonstration, data setup, defect and retest planning, and other necessary services to complete UAT."]
[56,"Documentation and Training"]
["56.a","Ensure appropriate end-user, administrator, and developer training is planned and executed."]
["56.b","Provide and/or update user manuals, help guides, and FAQ documents for users."]
["56.c","Provide and/or update operational runbooks and administrative guides."]
[57,"Capacity and Usability Analysis"]
["57.a","Review and analyze system capacity studies."]
["57.b","Conduct usability research, including contextual inquiry and stakeholder interviews."]
["57.c","Oversee content design and copywriting as part of usability research and ensuring effective user experience."]
["3. Staffing"]
[58,"Company Profile and Key Resources"]
["58.a","The Vendor must provide a company profile detailing the current number of employees available for the contract and key resources."]
[59,"Employee Location and Reporting"]
["59.a","MANDATORY: Onshore Resources: MDES allows only onshore resources to be utilized.  Each Consortium state may elect to allow work to state specific code to be completed offshore; however, at no time may CORE work be performed offshore. CORE work support staff must be onshore. This is a mandatory requirement.","M"]
["59.b","Monthly Status Reports: Provide monthly status reports to the PMO detailing employee location, skills, pending visa issues (if any), time-off requests that exceed one week, and position. The PMO may adjust reporting specifications as needed. Failure to timely deliver reports to the PMO may result in a penalty assessment. See Table 6 Maximum Penalties, SLA-012."]
["59.c","MANDATORY: Visa Issues: Describe if and how many employees the Vendor proposes to be assigned to this contract that are subject to visa requirements. For each of those employees, report the loss of any visa that impacts an employee’s ability to continue CORE work immediately. The Vendor’s employees may only continue to work if assigned to a state that allows offshore work and if the work is specific to that state. Otherwise, the Vendor must present its plan to provide a replacement for any of its employees who must leave the USA because of visa issues. This is a mandatory requirement.","M"]
["59.d","Work site Approval: The Consortium State must approve work site locations other than the Consortium State’s facilities.   Remote Work and Hybrid work must meet all security requirements and be cost-effective and add value to Consortium State’s. For MDES, the following Vendor key staff must be assigned to work on-site: Project Management Lead, Senior Architect, Business Analyst Leads, Test Lead, Quality Analyst, Database Administrator, Lead Developers."]
["59.d.A","Consortium State Facility Access"]
["59.d.A.a","The Consortium States will provide facility access at their discretion and maintain virtual desktop infrastructure (VDI).  "]
["59.d.A.b","Each individual Consortium State shall establish the secure access protocols for its respective state system."]
["59.d.A.c","Each individual Consortium State will assist the Vendor’s employees with secure access to the CORE and appropriate individual system, for both on-premise and remote workers."]
["59.d.A.d","MANDATORY: It is imperative that individual state confidential UI data shall never leave the United States under any circumstances.  This is a mandatory requirement.","M"]
["59.d.A.e","MANDATORY: Vendor-provided equipment must meet each Consortium State’s IT requirements including, but not limited to, security requirements. This is a mandatory requirement.","M"]
["59.d.A.f","At the discretion of the individual Consortium States, each state may provide facility access to the Vendor’s employees."]
["59.d.A.g","It is the individual Consortium State’s decision to extend or to rescind privileges to each of the Vendor’s staff members as it deems necessary."]
["59.d.A.h","If the privilege of working in state facilities is revoked, that Consortium State must provide reasonable notice."]
["59.d.A.i","If a Consortium State revokes facility privileges for a Vendor’s staff member, the Vendor will retain only the necessary access to that state’s system to fulfill the Vendor’s obligations. However, in the case of imminent or immediate risk to MDES’s system or the systems of the Consortium, the applicable state reserves the right to terminate the appropriate Vendor access forthwith."]
["59.d.B","Remote Work Requirements"]
["59.d.B.a","The Consortium States will set specific restrictions and security requirements for remote work, with the Vendor responsible for related costs.  For MDES, remote work schedules will only be approved under exceptional circumstances."]
["59.d.C","Hybrid Work Requriements"]
["59.d.C.a","A hybrid work schedule will only be available under the following conditions: (1) written approval by the applicable Consortium State, and (2) shall be immediately revocable at the Consortium State’s discretion. The Vendor’s employees and subcontractors must report to the Consortium State(s)’ state facility upon request.  For MDES, hybrid work schedules will only be approved under exceptional circumstances."]
["59.d.D","Each Consortium State reserves the right to revoke the Vendor’s employee’s facility access and adjust access as needed at any time and with no notice for violations of facility, security, or other state policies. The Vendor’s employees and subcontractors must report to the Consortium State(s)’ state facility upon request.  "]
["59.d.E","Any exemptions from the worksite requirements must be approved by the Project Management Officer (PMO). If the Vendor disagrees with the PMO’s decision, the Consortium Executive Committee (CEC) will receive and consider any requests for reconsideration and issue a final decision on the matter. "]
[60,"Staff Size and Workforce Management"]
["60.a","Staffing Specifications: The Vendor must specify the number of staff to be assigned post-award and provide a list of skills and credentials for the proposed staffing model."]
["60.b","Workforce Payment: Each individual Consortium State will only pay for completed authorized work, not headcount. Estimates for the proposed scope of work should correspond to projected, completed authorized work."]
["60.c","Scaling: The Vendor must describe how it plans to scale up or down to meet demand but bill only for approved hours used."]
["60.d","Sprint Velocity: Baseline sprint velocity after 180 days; Each individual Consortium States will notify the Vendor of adjustments needed for demand fluctuations."]
["60.e","The Vendor will maintain capacity for all defect remediation work related to the CORE and state specific code, queries, and analyses. See paragraph 110 below for details on historical defect volume."]
[61,"Employee/Vendor Removal"]
[61,"Resource Removal: Each individual Consortium State may also request the removal of any Vendor resource without notice. The Vendor must replace the resource promptly without undue delay."]
[62,"Employment Mix"]
["62.a","Employee vs. Staff Augmentation Ratio: The Vendor must maintain at least 70% of its own employees with a maximum of 30% contract employees."]
["62.b","Modification Requests: The Vendor must submit plans for changes in the employee/subcontractor ratio no later than thirty (30) days prior to any alteration. The PMO will review and approve such changes."]
[63,"Security and Confidentiality"]
["63.a","MANDATORY: Compliance: The Vendor must adhere to all security, confidentiality, and other contract requirements of each individual Consortium State.  This is a mandatory requirement.","M"]
[64,"Capacity Plan"]
["64.a","The Vendor must illustrate how it will start at 50% capacity."]
["64.b","The Vendor must reach 80% capacity within ninety (90) days of the contract start date and 100% within one hundred and eighty (180) days."]
[65,"Key Positions"]
["65.a","The Vendor must include key positions in the staffing plan, ensuring they are Vendor employees unless otherwise permitted in writing by an individual Consortium State. “Key personnel” also means executive and professional personnel in addition to the positions identified in paragraph 65(a)(H) below. The State/Consortium will consider worksite requirements for Vendor’s staff residence during this project as long as key personnel and staff reside in one of the lower 48 states and report to the appropriate state upon two (2) weeks’ notice once per quarter or as deemed necessary by the State/Consortium. Key positions should be dedicated and not shared with any other duties, though one person may hold multiple key positions if approved, in writing, by the individual Consortium State. The Vendor’s plan must include the following:"]
["65.a.A","Notice for Key Positions: Provide two (2) weeks' notice before replacing a key resource and supply credentials of replacements for Consortium State and PMO approval. The Vendor shall not reorganize key positions, including, but not limited to, moving to the same position with another state’s UI agency without the written consent of MDES/Consortium."]
["65.a.B","The Vendor must advise the appropriate Consortium member state(s) of any key position that is vacated within five (5) business days.  "]
["65.a.C","The Vendor must replace any key position that is vacated for any reason within 60 days and advise the Consortium member state(s) of any replacement for a key position within thirty (30) business days of the planned start date."]
["65.a.D","The appropriate Consortium Member state(s) shall have the right to review the credentials and experience of any replacement employee proposed to fill a vacant Vendor key personnel position and the right to refuse any candidate presented by the Vendor as a replacement.  The appropriate Consortium member state(s) and the PMO shall have fifteen (15) days to review the candidate and provide the Vendor with a response."]
["65.a.E","The Vendor must designate or assign within five (5) business days, an individual to serve as an interim for key positions that are vacated and notify the appropriate Consortium member State(s) within that same timeframe.   "]
["65.a.F","Key Positions will be required to attend various offsite meetings and conferences as directed by MDES/the Consortium.  "]
["65.a.G","The vendor will provide resumes for all proposed key positions for each Consortium Member State(s)."]
["65.a.H","Minimum Key Positions: Included roles are:"]
["65.a.H.a","Product/Program Manager – Responsible for oversight of the products being developed and maintained by the Consortium State(s)."]
["65.a.H.b","Project Manager Lead – Responsible for leading the Vendor project team and coordinating with stakeholders to organize, track, and execute work."]
["65.a.H.c","Senior Architect – Responsible for designing, overseeing, and guiding the architecture of the application."]
["65.a.H.d","Business Analyst Leads – Responsible for overseeing the business analyst process for the application development process. Business Analyst Leads are required for both the tax and benefits side of the application in each Consortium Member state."]
["65.a.H.e","Quality Analyst – Responsible for overseeing the Quality Assurance process for the application."]
["65.a.H.f","Test Lead – Responsible for overseeing the System Testing process for the application and assisting Consortium Member States with User Acceptance Testing needs."]
["65.a.H.g","Lead Developers – Responsible for leading a team to design develop and maintain the application.  They are responsible for serving as the technical leader within the development team.  Lead developers are required for both the tax and benefits side of the application in each Consortium Member state."]
["65.a.H.h","Database Administrator – Responsible for ensuring that the database effectively supports the functionality and data needs of the application.  Their focus is primarily on the design, maintenance, and performance optimization of the databases specifically used by application development teams."]
["65.a.H.i","Backup/Disaster Recovery Administrator – Responsible for designing, implementing, and managing the disaster recovery strategies of the application system.  These responsibilities may include but are not limited to: assessing application vulnerabilities, developing application Disaster Recovery Plans, Designing recovery architectures, Testing and Validation of application Disaster Recovery plans, monitoring application performance for potential issues that could impact recovery capabilities, leading incident response teams, overseeing data backups, management of data replication, ensuring data consistency for timely recovery, and collaborating with application developers to integrate disaster recovery considerations into new application development projects.  "]
["65.a.H.j","Security and Compliance – Responsible for overseeing the security practices within the application.  These responsibilities may include but are not limited to: Conducting regular security reviews of applications to identify potential vulnerabilities and risks including code reviews, penetration testing, and threat modeling, ensuring applications comply with relevant data privacy regulations and industry standards, collaborating with developers to embed security practices into the development process, including secure coding standards, input validation, and access control mechanisms, and working with the appropriate Consortium State(s) regarding all security and compliance requirements."]
["65.a.H.k","Analytics/ Reporting – Responsible for overseeing the development and implementation of data analytics and reporting systems within an application development team.  These responsibilities may include but are not limited to defining data collection and storage strategies, designing and building dashboards, reports, and visualizations to present key application development metrics, conducting in-depth analysis of application data to generate actionable insights for Consortium Member State(s), and collaborating with Consortium Member State(s) to identify their data needs."]
[66,"Holidays - The Vendor must advise MDES / Consortium State(s) of any holidays (e.g., religious, cultural, etc.) other than Consortium State holidays that may result in the absence of three (3) or more employees, subcontractors or any key position. The Vendor must send notice of the applicable holidays fourteen (14) days in advance of any such holidays and must include the names of affected employees, subcontractors, or any key position. Failure to timely notify MDES / Consortium State(s) may result in a penalty assessment. See Table 6 Maximum Penalties, SLA-011."]
[67,"Vacations - The Vendor shall notify MDES / Consortium State(s) at least fourteen (14) business days prior to any employee’s or subcontractor’s scheduled vacation with a duration of more than five (5) business days and provide the name of the individual who is serving in this role during the interim. Failure to timely notify the appropriate Consortium State(s) may result in a penalty assessment. See Table 6 Maximum Penalties, SLA-011."]
[68,"Subcontracting Plan"]
["68.a","Subcontractor Integration: Provide a subcontracting plan detailing how subcontractors will integrate with the prime staff as well as meet the following requirements."]
["68.a.A","MANDATORY: Offshore Subcontractors: Offshore subcontractors are not permitted by the existing Consortium States. MDES allows only onshore resources to be utilized.  Each Consortium state may elect to allow work to state specific code to be completed offshore; however, at no time may CORE work be performed offshore. CORE work support or subcontractor staff must be onshore. This is a mandatory requirement. ","M"]
["68.a.A.a","A future Consortium state may approve offshore subcontractors for non-CORE work. "]
["68.a.B","Key Personnel: Key personnel must be employees from the Vendor’s of Subcontractor(s)' staff unless otherwise permitted in writing by an individual Consortium State."]
["68.a.C","Subcontractor Ratio: Maintain the same employee to subcontractor ratio as stated in the Vendor’s proposal unless otherwise permitted in writing by an individual Consortium State."]
["68.a.D","Subcontractor Approval: MDES/Consortium must approve all subcontractors unless identified in the initial proposal. All subcontractors must conform to contract requirements."]
["4. DEVELOPMENT PRACTICES"]
[null,"Agile Development Practices"]
[69,"The Consortium and Vendor will participate in Agile ceremonies (sprint planning, daily stand-up, sprint review, retrospective, etc.) and will reach an agreement on the definition of the following: story points, sprint cycles, release schedules, definition of done, and sizing of epics, stories, and tasks. The Vendor shall discuss its plan for this process."]
[null,"Required Product Release Processes"]
[70,"Definitions"]
["70.a","Release - the delivery of a product or service increment into a production-quality environment, such that it is available for immediate use by stakeholders."]
["70.b","Change Impact Analysis - process for defining, evaluating, and measuring how changes in an application can affect other parts of the system.  Change impact analysis shall be interchangeable with impact assessment for this project."]
["70.c","System Use Case (SUC) - sequence of actions a system performs that yields an observable result of value to a particular user."]
["70.d","System testing - process that verifies that the software performs as designed and meets the requirements that guided its development.  System testing identifies discrepancies between the actual system and its intended functionality including bugs, errors, or missing requirements. System testing is performed by the Vendor prior to user acceptance testing."]
["70.e","Product or Sprint Demonstration - is presentation of a product by the development team to show stakeholders the developed product and to allow feedback for any missed requirements or unexpected performance items."]
["70.f","User acceptance testing - is a phase of software development that ensures the developed product meets the users’ needs, satisfies all requirements, and performs as expected."]
[71,"Product Release Requirements – These requirements shall be performed before each product is moved to a production release."]
["71.a","Any of the following requirements to move a product to release may be waived by an individual Consortium state at their sole discretion.  Any waiver by a single state shall not apply to other participating states for multiple state deployments."]
["71.b","The Vendor will perform a Change Impact Analysis."]
["71.c","The Vendor will provide SUCs to the Consortium State(s)."]
["71.d","The Vendor will perform System Testing and provide the Consortium State(s) with detailed results, including screen shots, of said testing.  The Vendor will also provide a report at the conclusion of system testing showing the automated test coverage percentage, number of automated test cases performed, and total number of test cases performed during system testing for that product.  Failure to provide the required report for any product may result in a penalty assessment. See Table 6 Maximum Penalties, SLA-012."]
["71.e","The Vendor will conduct a product demonstration of all new products prior to releasing the product to user acceptance testing."]
["71.f","The Vendor will release the product into User Acceptance Testing a minimum of fourteen (14) days before a production release to ensure time for Consortium State(s) to adequately perform user acceptance testing."]
["71.g","The Vendor shall not release a product to production without the Consortium State(s) official approval.  This approval requires completion of a product demonstration and completed user acceptance testing. "]
["71.h","The Vendor will create or update user manuals for changes made to the system including but not limited to screen changes, functionality changes, or role/access changes."]
["71.i","The Vendor, as a part of the product release requirements, will at the completion of each product, provide a final product report showing the following items and attach it to the final invoice for that project.  \nA.\tDate Change Impact Analysis was completed.\nB.\tDate system testing was completed.\nC.\tDate system testing results were shared with the Consortium State(s).\nD.\tDate of product demonstration and list of attendees of the product demonstration.\nE.\tDate that the product was released to user acceptance testing.\nF.\tDate of the completion of user acceptance testing and approval documentation.\nG.\tDate of the release to production."]
["71.j","Failure to provide the final product report for any product may result in a penalty assessment. See Table 6 Maximum Penalties, SLA-012."]
[72,"The Vendor must follow the product release requirements for any product change or addition to the ReEmployUSA system regardless of whether this is a single or multiple state deployment."]
[73,"Failure to follow the product release requirements for any product may result in a penalty assessment. See Table 6 Maximum Penalties, SLA-016."]
["5. SOCII AUDITS"]
[74,"SOCII audits are a requirement for this award. The Vendor is responsible for completing a yearly SOCII audit. As part of its plan for this audit, the Vendor must, at a minimum, include the following:"]
["74.a","The Vendor is responsible for providing each Consortium State with a copy of its most recently completed SOC Audit (no older than 12 months) within the first ninety (90) days post award."]
["74.b","The Vendor is required to complete an annual audit for every calendar year thereafter so long as an effective Agreement exists and may take no more than 180 days for this audit."]
["74.c","At the request of each Consortium State, the Vendor shall be prepared to evaluate and propose a firm to complete the audit for the appropriate Consortium State’s approval. "]
["74.d","Consortium States will dictate the type of audit to be conducted."]
["74.e","Consortium States will own all the information from the audit and can participate in the audit to whatever level deemed necessary or appropriate."]
["74.f","Failure to compete a timely annual SOCII audit may result in a penalty assessment. See Table 6 Maximum Penalties, SLA-012."]
["6. PLANNING"]
[75,"The following three (3) plans, Enterprise Architecture Plan, Development and Quality Management Plan, and Information Data Security Plan are expected to be delivered to Consortium States within 180 days post award for approval. The Vendor must provide a baseline framework of the required three (3) plans within forty-five (45) business days of the award. The Vendor must provide a draft Transition Plan as part of its Narrative Response to this RFP.  This baseline framework will include a Deliverable Expectation Document, outlining by section a proposed plan with details for all major deliverables (documents).  The Disaster Recovery Plan is expected to be delivered to the Consortium States within thirty (30) business days post award for approval.  In response to the RFP, the Vendor must demonstrate readiness to provide the following plans within the 180-day/45-day/30-day timelines and at the intervals noted.  The Vendor agrees to alter the plan as required by the Consortium States to arrive at a product conducive to development needs of the Consortium States Failure to complete the post award plans timely result in a penalty assessment. See Table 10 Post-Award Maximum Penalties."]
[null,"Enterprise Architecture"]
[76,"Enterprise Architecture - The Vendor will baseline the current Enterprise Architecture (EA) of each of the Consortium States framework and work with the Consortium States to create a roadmap to enhance EA. The roadmap will be based on a three (3) to five (5) year period (three (3) year period preferred) applying industry trends where appropriate to deliver best-in-class performance."]
["76.a","The Vendor will document, build, and deliver transition architectures from the current state to the proposed state. (“Technical Roadmap”)."]
["76.b","The Vendor will work with each state’s Technical/Business Team to capture, document, and deliver the Technical and Business Roadmaps. The Technical Roadmap must complement the Business Roadmap."]
["76.c","The Vendor will work with MDES and the Consortium States to outline progress towards goals and re-baseline the roadmap based on completions and industry trends. "]
["76.d","The Framework can be based on any of the industry standard frameworks, for example, TOGAF, Zachman, ITIL, Gartner, or Microservice. The Consortium States must authorize the framework prior to finalizing the plan."]
["76.e","The architecture will include the use of automation functions to the greatest extent possible to drive business outcomes on the roadmap. "]
["76.f","The document should highlight how each provision adds value to the Consortium States. "]
["76.g","The Vendor will review, update, and deliver both the “technical roadmap” and the “business roadmap” every 180 days to ensure consistency with current technologies. The Vendor will communicate all changes as they occur. "]
["76.h","Failure to timely deliver updated technical and business roadmaps may result in a penalty assessment. See Table 6 Maximum Penalties, SLA-012."]
[null,"Development and Quality Management Plan"]
[77,"The Vendor shall design, code, and test according to development standards approved by the Consortium States while keeping quality at the forefront of all development and support of the ReEmployUSA system.  Development standards shall follow the requisite style guide (Java or Angular) and be a comprehensive roadmap throughout the software development lifecycle. The Development and Quality Management Plan will detail how the Vendor plans to deliver architectural documents, wireframes, schemas, and other design documents in the process of supporting or enhancing the system as well as serving as the guide for the Vendor to meet quality requirements. The plan will detail triggers for modifying and upgrading documents as well as the level of detail required to achieve traceability.  "]
[78,"The Vendor will, as a required component of project and support management, keep documentation up to date as required in the EA plan. The Vendor will update any documentation that is found either internally or by any Consortium State to be outdated due to changes created by the Vendor to begin no later than one (1) month after such discovery. Further, the Consortium States may penalize the Vendor for omitting document creation/updates as required."]
["78.a","Code Modularity – The Vendor will understand and employ code modularity to reduce complexity and make code more efficient, reliable, and maintainable. The Vendor will recommend a baseline for each standard based on experience and industry standards."]
["78.b","Compliance - The Vendor’s plan will guide development services in a manner that ensures that all applicable state, federal, legislative, and regulatory requirements are met in the design, development, and implementation of any ReEmployUSA functions. Likewise, the designs must comply with any non-federal or state audits and controls."]
["78.c","Batch Processing Alternatives - New designs will limit the use of batch processing to the greatest extent possible. The Vendor’s designs should favor alternative methods such as streaming to reduce the workload of maintaining batch operations. The Vendor should also recommend a plan for removing/modernizing existing batch programs."]
["78.d","Security - The Vendor will propose the use of standards aligned with industry best practices. Reliance on third party security tools shall be discouraged, and the Vendor will develop these items with native tools to enhance security posture for each state’s system."]
["78.e","Software Architecture Plan- The Vendor will develop a Software Architecture plan that will align with the Enterprise Architecture Strategy to guide development efforts to evolve towards microservices and industry best practices with reference to those specific practices that will be updated as appropriate. The proposed strategy will focus on how to scope functions, trade-offs to the approach, security solutions, Application Programming Interface (API) implementation, along with management, and growth of the plan. "]
[79,"The Development and Quality Management Plan will at a minimum address the following:  \na.\tRoles and responsibilities of all parties involved\nb.\tDesign, development, and testing of the ReEmployUSA system.\nc.\tTesting plan detailing each level of testing, the criteria, personnel required, and necessary remediations.\nd.\tMetrics on monitoring and controlling quality.\ne.\tA description of quality services and tools.\nf.\tList and description of all deliverables and products.\ng.\tDevelopment Standards and methodologies.\nh.\tEvaluation and reports to MDES/Consortium States.\ni.\tQuality Standards: Define the criteria for data quality (accuracy, completeness, consistency). Validation and Cleansing Procedures: \ni.\tDetail methods for data validation, error detection, and data cleansing. \nj.\tMonitoring and Reporting: Explain how data quality will be monitored and how issues will be reported and addressed."]
[null,"Information Data Security Plan"]
[80,"The Vendor will develop, deliver, and maintain an Information Data Security Plan that ensures compliance with current industry standard requirements, such as NIST 800-53 Rev 5, IRS Publication 1075, SSA requirements, and 20 CFR 603.  This plan will include the process to protect and maintain data confidentiality and integrity and implement security controls. The controls must focus upon the prevention, detection, and correction of security events. "]
["80.a","The Vendor will develop the Information Data Security plan that the Consortium States shall review and approve before adoption. The plan will include all tools, software, and security mechanisms currently utilized by the Consortium States."]
["80.b","The plan will be created using industry standard best practices to employ security controls that protect the MDES/Consortium States against threats to the ReEmployUSA system. "]
["80.c","The plan will illustrate how the Vendor will incorporate security into every facet of the requisite Software Development Lifecycle. "]
["80.d","Information Data Security procedures employed will protect MDES/Consortium States when the Vendor access to the state system is required for contracted functions. "]
["80.e","Information Data Security procedures employed will comply with the requirements specific to each individual consortium state’s Information Technology Agencies as required.  For MDES these procedures are:"]
["80.e.A","Information Technology Service’s Enterprise Security Policy\n(https://www.its.ms.gov/sites/default/files/ServicesPDFs/10-1-2013%20ESP.pdf),"]
["80.e.B","Information Technology Service’s Enterprise Cybersecurity Incident Reporting Guidelines\n(https://www.its.ms.gov/sites/default/files/ServicesPDFs/Enterprise%20_Cybersecurity_Incident_Reporting_23-24.pdf ), and"]
["80.e.C","Miss. Code Ann. § 25-53-201. "]
["80.f","The Vendor’s plan will detail how services will maintain compliance with all current audit requirements to include the SOC2 Type2 audit."]
["80.g","Maintenance of the Information Data Security Plan requires that this plan be updated within 30 days of any change, alert, or release of guidance by the IRS, SSA, NIST, or an individual state(s) Information Technology Agency."]
["80.h","Failure to deliver an updated Information Data Security Plan time may result in a penalty assessment. See Table 6 Maximum Penalties, SLA-012."]
[81,"The component requirements of the information data security controls shall present a solution for:"]
["81.i","Access Controls - role-based security, physical security, and remote access"]
["81.ii","Procedural Controls - training, contingency planning, and incident response planning"]
["81.iii","Technical Controls - hardware and software components that aid in the prevention, detection, and protection of systems against a cyber-attack"]
["81.iv","Administrative controls - Vendor’s plan to lead and govern its team"]
["81.v","Baseline Confidentiality Controls:"]
["81.v.A","Gap analysis on existing systems and tools used for data protection and fraud prevention"]
["81.v.B","Audit security roles and Personally Identifiable Information (PII)/ Federal Tax Information (FTI) access"]
["81.v.C","Controls to prevent the Vendor from any access to FTI data"]
["81.v.D","Description of PII usage in various environments detailing where PII is prohibited and procedure to accomplish development tasks without the use of PII."]
["81.v.E","Description of FTI usage in various environments detailing where FTI is located.  "]
["81.v.F","The Vendor should present an approach within the monitoring plan that identifies patterns inconsistent with normal practices which may uncover illicit service, both internal and external."]
[82,"The following outline may serve as a guide or reference for the Vendor response."]
["82.i","Introduction "]
["82.i.A","Purpose and Scope: Describe the objectives of the Information Data Security Plan and its relevance to the agency's mission. "]
["82.i.B","Project Overview: The Consortium State will provide background on its project, including goals and expected outcomes to assist the Vendor with the creation of this plan."]
["82.ii","Data Governance Framework"]
["81.ii.A","Roles and Responsibilities: Define roles such as data owners, stewards, and custodians, along with their responsibilities."]
["81.ii.B","Policies and Standards: Document the data governance policies, procedures, and standards that will be followed."]
["81.iii","Data Architecture and Infrastructure"]
["81.iii.A","Data Sources and Types: List all data sources, types (structured, unstructured), and formats."]
["81.iii.B","Data Storage Solutions: Describe where and how data will be stored (e.g. cloud storage)."]
["81.iii.C","Integration with Existing Systems: Explain how the data management system will integrate with current agency systems."]
["81.iv","Data Collection and Ingestion Processes"]
["81.iv.A","Data Acquisition Methods: Detail how data is collected, including any tools or technologies used."]
["81.iv.B","Ingestion Pipelines: Describe processes for importing data into systems, including ETL (Extract, Transform, Load) procedures."]
["81.v","Data Security and Privacy"]
["81.v.A","Security Measures: Outline the strategies for protecting data, including encryption, firewalls, and access controls."]
["81.v.B","Compliance with Regulations: Explain how the plan ensures compliance with laws and regulations including IRS Publication 1075, FTI requirements and state-specific regulations."]
["81.v.C","User Authentication and Authorization: Describe how users will be authenticated, what authorization levels will be in place and how authorization levels are defined."]
["81.vi","Data Lifecycle Management"]
["81.vi.A","Lifecycle Phases: Describe each phase of the data lifecycle from creation to deletion."]
["81.vi.B","Retention Policies: Specify data retention periods based on data types and regulatory requirements."]
["81.vi.C","Archiving and Disposal: Outline processes for data archiving and secure disposal."]
["81.vii","Metadata Management"]
["81.vii.A","Metadata Standards: Identify standards for metadata to ensure consistency and usability."]
["81.vii.B","Cataloging and Indexing: Explain how metadata will be cataloged and indexed for easy retrieval."]
["81.vii.C","Metadata Utilization: Describe how Metadata will support data discovery and governance."]
["81.viii","Data Access Sharing"]
["81.viii.A","Access Controls: Define who has access to what data and under what conditions."]
["81.viii.B","Data Sharing Protocols: Outline procedures for sharing data internally and externally."]
["81.viii.C","User Interface (UI) Design Considerations: Document how the User Interface will facilitate data access while ensuring security and compliance."]
["81.ix","Backup and Recovery Plans"]
["81.ix.A","Backup Procedures: Detail the backup schedule, methods, and storage locations."]
["81.ix.B","Disaster Recovery Strategy: Provide a plan for data recovery in case of system failure or other disasters."]
["81.ix.C","Testing and Maintenance: Describe how backup and recovery processes will be tested and maintained."]
["81.x","Compliance and Audit"]
["81.x.A","Regulatory Compliance Mapping: Map data management practices to specific regulatory requirements."]
["81.x.B","Audit Trails and Logging: Explain how services will be logged for auditing purposes."]
["81.x.C","Reporting Mechanisms: Detail how compliance reports will be generated and disseminated."]
["81.xi","Risk Management including Cyber Risk Management"]
["81.xi.A","Risk Identification: List potential risks."]
["81.xi.B","Mitigation Strategies: Propose measures to mitigate identified risks."]
["81.xi.C","Incident Response Plan: Outline procedures for responding to data breaches or other security incidents."]
["81.xii","User Training and Support"]
["81.xii.A","Training Programs: Describe training initiatives for staff on data management policies and tools."]
["81.xii.B","Documentation and Resources: Provide user manuals, guidelines, and other support materials."]
["81.xii.C","Helpdesk and Support Services: Explain how users can get help with data management issues."]
["81.xiii","Implementation Roadmap"]
["81.xiii.A","Timeline and Milestones: Present a schedule for implementing the Information Data Security Plan components."]
["81.xiii.B","Resource Allocation: Detail the human, technical, and financial resources required."]
["81.xiii.C","Change Management Plan: Outline strategies for managing changes during implementation."]
["81.xiv","Monitoring and Continuous Improvement"]
["81.xiv.A","Performance Metrics: Define key performance indicators (KPIs) for data management."]
["81.xiv.B","Monitoring Processes: Describe how data management services will be monitored."]
["81.xiv.C","Feedback Mechanisms: Explain how feedback will be collected and used to improve the Information Data Security Plan."]
[null,"Transition Plan"]
[83,"The successful Vendor shall have a Transition Plan to assist the Consortium States in their shift to the new contract. A seamless transfer to the new contract with the successful Vendor, whether new or existing, is in the best interest of the public."]
[84,"The plan shall specify the timeline for the transition, tasks to be performed by the parties, the schedule for the performance of such tasks and the respective responsibilities of the parties associated with the identified tasks. The plan should include at a minimum: data migration, communication, operational continuity, training and support, risk management, evaluation and feedback, and documentation.  The plan should enumerate potential risks with the transition.  This plan must demonstrate that the Vendor has the capacity and demonstrated competency to assume ownership of the Maintenance and Support of ReEmployUSA without any reliance on the incumbent Vendor. "]
[null,"Disaster Recovery Plan"]
[85,"As part of the overall Disaster Recovery Plan (DRP), the Vendor shall:"]
["85.a","Develop a Baseline Update Form for the ReEmployUSA Disaster Recovery Plan. See Appendix B - Disaster Recovery Response Plan.  The content of the baseline update shall be developed in collaboration with the MDES/Consortium States and its Cloud Services Provider."]
["85.b","Use the Consortium States template for the updated Plan. Appendix B - Disaster Recovery Response Plan– Consortium Disaster Recovery Plan provides the current template. The updated form/report is due within 30 business days of the start of the contract and must meet the documentation standards of the Consortium States (also referred to as, “the Consortium”). Elements of the Disaster Recovery Plan:"]
["85.b.i","Elements of the Disaster Recovery Plan:\ni.\tDisaster Recovery Training\nii.\tPerformance & Reporting for Failover Testing\niii.\t Performance & Reporting for Fallback Testing\niv.\tEnvironments Work Plan\nv.\tPerformance of Disaster Recovery Plan"]
["7. DEFINITIONS"]
[86,"Scope of Services for this RFP is defined as all Corrective Maintenance Services, Adaptive Maintenance Services, Preventive Maintenance Services, Perfective Maintenance Services, and Support Services for all of these types of maintenance services."]
[87,"Maintenance and Support is defined as the comprehensive management of the ReEmployUSA application which includes all work that is NOT a Perfective Maintenance Service.  Maintenance and Support will include all Adaptive Maintenance Services, Corrective Maintenance Services, Preventive Maintenance Services, and support services for all of these types of maintenance services. The Vendor will provide a Maintenance and Support Services fixed cost price per Consortium State in Attachment C - Cost Information Submission Form of this RFP."]
[88,"Support Services or Production Support Services are defined as maintaining and ensuring the smooth operation of a live software application.  Support/Production Support services include but are not limited to, writing and executing queries, troubleshooting issues, analysis, resolving problems, monitoring system performance and security, disaster recovery, database recovery, optimizing database performance, running and re-running reports, running and re-running batches, system administration, support ticketing, interfaces with other systems, training, entering, removing, or changing data stored in existing database tables, and generating reports on incident trends, potential risks, or system performance. \n\nSupport Services or Production Support Services will include working with other Vendors and state support staff.  All support services are included as a part of the scope of service of this RFP.  The Vendor will include ALL support Services in the Annual Maintenance and Support Services fixed cost price per Consortium State provided in Attachment C - Cost Information Submission Form of this RFP."]
[89,"Corrective Maintenance Services are defined as identifying and resolving defects. These defects include but are not limited to coding errors, design flaws, software dependency issues, security vulnerabilities, performance issues, usability issues, or integration issues. Proper documentation of changes done is a part of corrective software maintenance, and all corrective maintenance services are included as a part of the scope of service of this RFP.  The Vendor will include ALL Corrective Maintenance Services in the Annual Maintenance and Support Services fixed cost price per Consortium State provided in Attachment C - Cost Information Submission Form of this RFP."]
["89.a","A defect is a failure, flaw or error that results or functions in unexpected, incorrect, or unintended ways in system testing (ST), user testing (UAT) or production environments."]
[90,"Preventive Maintenance Services are defined as identifying and resolving potential problems before they become major issues.  This includes but is not limited to performance management, optimizing data, cleaning up unnecessary files, tables, etc., backing up data, reviewing system logs for potential issues, software updates (regardless of type), addressing known security vulnerabilities and bugs, code refactoring, cleaning of codes, documentation updates, updating libraries and frameworks, reviewing code quality, and updating system configurations for optimization. All preventive maintenance services are included as a part of the scope of service of this RFP.  The Vendor will include ALL Preventive Maintenance Services in the Annual Maintenance and Support Services fixed cost price per Consortium State provided in Attachment C - Cost Information Submission Form of this RFP."]
[91,"Adaptive Maintenance Services are defined as the modification, revision, and / or updating of application software, interfaces, APIs, etc. (non-exclusive list) to remain current with changing environments or changes to infrastructure.  Environmental changes include, but are not limited to, patches, minor upgrades, or major upgrades of operating systems, software dependencies, network changes, security upgrades, changes in external systems, and system configurations.  Additional adaptive maintenance services include planning, coordinating, troubleshooting, remediation of issues or build deployments necessary to maintain current functionality that are due to changing environments or infrastructure.  All adaptive maintenance services are included as a part of the scope of service of this RFP.  The Vendor will include ALL Adaptive Maintenance Services in the Annual Maintenance and Support Services fixed cost price per Consortium State provided in Attachment C - Cost Information Submission Form of this RFP.  "]
[92,"Perfective Maintenance Services are defined as development, installation, or integration of additional features or requirements needed to enhance the system.  This includes but is not limited to adding new features, improving existing features, and updating user interfaces for enhanced usability.  Perfective Maintenance shall also be known as enhancements in this RFP.  All Perfective Maintenance Services are included as part of the required scope of service of this RFP.  However, Perfective Maintenance Services are NOT included as a part of monthly maintenance and support, but must be costed and bid separately from the monthly Maintenance and Support cost through either a Fixed Cost SOW using the Fully-loaded Hourly Perfective Maintenance Service Statement of Work Rate, or Time and Materials estimate using the Fully-loaded Hourly Time and Materials Rate.  In both cases the Vendor must provide the estimated number of professional service hours that will be necessary to implement the work contemplated therein."]
[93,"Fixed Cost is defined as an agreed upon cost for the scope of work defined using the corresponding fully-loaded rate.  "]
["93.A","Fixed cost pricing will be used for the Annual Lifecycle Maintenance and Support fee that will be broken into monthly payments.  "]
["93.B","For MDES, all SOWs will be fixed cost projects using the Fully-loaded Hourly Perfective Maintenance Service Statement of Work Rate unless approval for the specific project has been given to perform using T&M or the project will be forty (40) hours or less.  "]
["93.C","For MDES, all Change Order SOWs will be fixed cost using the Fully-loaded Hourly Change Order SOW Rate."]
[94,"Time and Materials (T&M) is defined as a predetermined, agreed upon Fully-loaded Hourly Time and Materials Rate which will be used to calculate the payment for services provided by the Vendor plus any materials used under a project charged as T&M.  Subject to the definitions and provisions herein. "]
[95,"Shared Services are defined as the CORE services delivered by individual Vendor staff to either multiple Consortium states and/or on shared Consortium projects."]
[96,"Statement of Work (SOW) is defined as a document outlining the scope, requirements, assumptions, timeline, deliverables, milestones, estimated number of professional service hours that will be necessary to implement the work contemplated therein and cost of a project required by one or more Consortium State(s)."]
[97,"A Change Order is defined as a statement of work (“CO-SOW”) setting forth in reasonable detail, the range and extent of services requested, requirements, assumptions, timeline, deliverables, milestones, estimated number of professional service hours that will be necessary to implement the work contemplated therein, and cost of a project requested by one or more Consortium State(s) that would expand the scope of services of this project.  A Change Order would require approval from ITS.  "]
[98,"Sensitive Data is defined as any information that is protected against unwarranted disclosure by state and/or federal laws or regulations.  Sensitive Data includes but is not limited to personal information (PI), personally identifiable information (PII), Federal Tax Information (FTI), sensitive personal information (SPI), nonpublic personal information (NPI), and Material Nonpublic Information (MNPI), financial data, and business-specific sensitive data."]
[99,"Cyber Attack is defined as a successful attempt to compromise the security, integrity, or availability of ReEmployUSA or the data within as per Miss. Code § 25-53-201(5)(a), as amended."]
[100,"Cyber Security Incident is defined as any service that could potentially harm system security, including attempted and unauthorized access, malware detection, suspicious service, or configuration errors. See Miss. Code § 25-53-201, as amended."]
[101,"Breach is defined as the successful penetration of a system’s security where unauthorized access has occurred even if the underlying data has not been accessed."]
[102,"Data Breach is defined as the exposure, disclosure, alteration, destruction, or theft of sensitive data.  "]
["8. PERFECTIVE MAINTENANCE services / ENHANCEMENTS"]
[103,"Any Perfective Maintenance Services requested under this RFP and the contract with the successful Vendor shall include the preparation of a T&M estimate or of a Fixed Cost SOW (as specified by each individual Consortium State) using the proper fully-loaded hourly rates as presented in Attachment C - Cost Information Submission Form. The Consortium States shall not pay for estimates or SOWs regardless of whether the perfective maintenance service requested is ultimately accepted. Preparation of the T&M estimate or SOW does not bind the Consortium State to selection of this Vendor for this project.  The Vendor should view these documents as bids for this project."]
[104,"This RFP will not be the exclusive vehicle for the Consortium to engage a Vendor for perfective maintenance services. The Consortium may, at its discretion, perform any part of this work in-house or through another Vendor."]
[null,"Perfective Maintenance service Volume"]
[105,"The Consortium engages in projects to continually modernize the system. In addition to modernization and system optimization, a portion of perfective maintenance services result from public emergencies and new or updated state and federal requirements. The volume of perfective maintenance services relates directly to federal and state funding, state and/or federal law changes, external conditions, emergencies, upgraded system functions, and efficiency of Vendor performance."]
["105.a","It is anticipated that perfective maintenance services work will be between 80 and 120 user stories per month for the Consortium. A user story is an informal, general explanation of a software feature written from the perspective of the end user. Its purpose is to articulate how a software feature will provide value to the customer. These anticipated perfective maintenance services are evenly distributed. "]
["105.b","Implementation of new federal or state programs may occur at any time, are outside of the control of the Consortium, and are mandatory for the states to implement, usually by a specific deadline."]
["105.c","New federal or state funding opportunities may occur at any time, shall be sought out by the individual Consortium State(s) at their sole discretion, contain strict timelines, and if received by the Consortium State(s) are mandatory."]
[null,"Anticipated Perfective Maintenance services"]
[106,"The Vendor should present proposed solutions for perfective maintenance services either consistent with the current initiatives or with innovative alternatives.  The cost for these anticipated perfective maintenance services must NOT be included in the costs provided for this RFP.  A request for a fixed cost SOW or T&M estimate will be requested if any Consortium State wishes to proceed with these proposals at a later time.  Current initiatives underway and the goals of each include:"]
["106.a","Microservices & Modularity – Develop apps more rapidly and allow greater portability of the apps. "]
["106.b","Artificial Intelligence (AI)/BOTS – Utilize BOTS (RPA and others) and AI to reduce manual workloads and streamline processes without human intervention.  Appendix F - MDES Artificial Intelligence Governance Policy explains the permissible and prohibited requirements for use of AI for this agency."]
["106.c","Mobile Technology – Enhanced apps should deliver better responsiveness while accommodating customer’s expanding use of mobile devices."]
["106.d","Reporting – Increase self-service analytics, adapt fraud analytic tools, and move to more agile analytic tools."]
["106.e","Interactive Voice Response (IVR) – Utilize customer data known by the system to integrate with call center functions using artificial intelligence or other tools to provide an enhanced user experience, focusing on interoperability of the systems."]
[null,"Perfective Maintenance service Approval Process"]
[107,"The State will determine if the perfective maintenance service is a part of the Scope of Services of this RFP.  If it is not, the State will initiate a Change Order with ITS.  If it is, the State will utilize the following processes."]
[108,"The Consortium will utilize a process where any member state may initiate a perfective maintenance service.  "]
[109,"Perfective Maintenance service Consortium Voting Process"]
["109.a","The member states will hold a first vote on the proposal.  "]
["109.b","Each state may elect to Approve or Abstain. If the state abstains, the state indicates that it is uninterested in that project.  "]
["109.c","The Vendor will then gather the requirements of the project and present a timeline and cost for the perfective maintenance service in both of the following formats.  \ni.\tT&M or \nii.\tFixed Cost SOW"]
["109.d","Each member state will then vote again to Approve, Disapprove, or Abstain.  "]
["109.e","States that previously abstained or disapproved with the first vote may decide to approve for the second vote, and states who previously approved may decide to abstain for the second vote. "]
["109.f","If an additional state approves the perfective maintenance service upon the second vote, the Vendor will need to gather any additional state specific requirements."]
["109.g","Approval of a perfective maintenance service does not indicate participation in the project.  At its sole discretion, a state may approve a project but may not be able or willing to go forward with that project at that time.  In those circumstances, the other state(s) will proceed with the cost split among those states approving and agreeing to participate in the perfective maintenance service."]
[110,"Perfective Maintenance service Cost and service Approval Process "]
["110.a","Each individual Consortium State may elect to approve the service using either the T&M cost method or a Fixed Cost SOW method. The Consortium members are not required to utilize the same costing method for any perfective maintenance service.  "]
["110.a.i","For MDES, all perfective maintenance services with an estimated timeline of more than forty (40) hours must have a SOW, while perfective maintenance services with an estimated timeline of forty (40) hours or less may be presented using T&M.  This requirement shall be followed unless expressly waived by this state.  "]
["110.a.ii","For MDES on CORE projects, the Vendor must present a complete SOW or T&M estimate with the costs split by state and for state specific customized items charged to the state requesting those items per the same forty (40) hours rule."]
["110.a.iii","Other Consortium Members may, at their sole discretion, establish their own Service cost and approval policies.  These thresholds may include but are not limited to SOW costing versus T&M costing, or that any or all work will be performed solely under T&M costing or SOW costing.    "]
[null,"CORE Perfective Maintenance service Requirements Processes"]
[111,"The Vendor should expect one of two processes for work that has been determined to be CORE for requirements gathering."]
["111.a","Initial requirements may be gathered by one member state. If the second state approves the project, each state has the option to add additional state specific requirements.  The Vendor shall split the initial cost of the project over the participating Consortium states and cost any state specific items directly to the state requesting non-CORE items.    "]
["111.b","Requirements are gathered collaboratively.  In these cases, the states work together to develop CORE and state specific items that are relayed to the Vendor after completion of the requirements. The Vendor then has an opportunity to ask questions and make suggestions with all the participating states at one time. The Vendor shall split the cost of the project over the participating Consortium states and cost any state specific items directly to the state requesting non-CORE items.  "]
["111.c","For CORE projects, the Vendor will communicate with assigned staff, typically a Business Analyst (BA), from the initiating state who will coordinate any meetings, questions, reviews, and needed decisions.  Any necessary signatures will be from the Executive Level Signatory of each state or his/her designee.  "]
["111.d","Each Consortium member shall set the parameters for any custom projects. "]
["9. MAINTENANCE AND SUPPORT"]
[null,"Maintenance and Support Activites"]
[112,"As noted the Standard Contract described in Exhibit A to this RFP, the State owns the code that the Vendor shall maintain, support, and provide adaptive maintenance for said code. As such, the Vendor shall support all of the code of any type that comprises the ReEmployUSA system without regard to the vendor that created it."]
[113,"Management of the work to maintain capacity employing the support levels described to prioritize the work:"]
["113.a","High Priority work will consist of 20% of the workload."]
["113.b","Medium Priority work will consist of 50% of the workload."]
["113.c","Low Priority work will consist of 30% of the workload."]
[114,"Historical volume of work is presented below to assist in the preparation of RFP responses. Current work, whether production support services or corrective maintenance services, include the following monthly volume that is anticipated to be between 100 and 200 items for MDES and between 200 and 300 for the MDOL. "]
[null,"Production Support services Disaster Recovery"]
[null,"Security Monitoring"]
[115,"Provide Emergency support services 24x7 for the duration of a declared emergency or disaster as determined by the State(s). "]
[116,"May require immediate dispatch of Vendor’s Help Desk staff during some emergencies or disasters. Shifts are typically 8:00 a.m. to 8:00 p.m. and during an emergency, 8:00 p.m. to 8:00 a.m.  Failure to have appropriate response times from the Vendor’s Help Desk may result in a penalty assessment. See Table 6 Disaster Recovery Maximum Penalties, SLA-003."]
[117,"As part of these requirements under this RFP, if the Vendor is not in complete control of software license, subscription, or infrastructure, the Vendor will assist with the disaster recovery plan to the maximum extent of the resources it controls. "]
[118,"Baseline Update for the ReEmployUSA Disaster Recovery Plan, including the following: \na.\tSupporting information including Business Impact Analysis, Point of Contact Lists, and Roles and Responsibilities.\nb.\tActivation, notification, and outage assessment.\nc.\tRecovery, sequence of services, and escalation.\nd.\tReconstitution, concurrent processing, data and functionality validation, notifications, cleanup, backup, and event documentation.\ne.\tAppendices with any needed details.\nf.\tSemi-annual Updated Disaster Recovery Plan.  Failure to provide an updated disaster recovery plan may result in a penalty assessment. See Table 6 Disaster Recovery Maximum Penalties, SLA-012."]
[119,"The Vendor will provide proof of disaster recovery readiness immediately upon request by a Consortium Member State(s) or the PMO."]
[120,"The Vendor will provide After Action Reports following any disaster recovery exercises, tests, or actual incidents Failure to timely provide After Action Reports may result in a penalty assessment. See Table 8 Disaster Recovery Maximum Penalties, SLA-DR04e Monitoring:"]
[null,"Performance Monitoring"]
[121,"The Vendor will set up logs, metrics, and auditing for a monitoring and alerting strategy."]
[122,"The Vendor will provide regular performance tuning on a monthly basis.  Failure to timely perform monthly performance tuning may result in a penalty assessment. See Table 6 Maximum Penalties, SLA-002."]
[123,"The Vendor will implement a system for collecting and addressing user feedback."]
[124,"The Vendor will ensure that AI/BOT/System failures are reported to the Consortium members immediately."]
[null,"Security Monitoring"]
[125,"The Vendor will work with MDES/Consortium States internal teams to ensure that security is considered at all phases. The Vendor will proactively analyze, detect, and prevent threats to the system utilizing MDES/Consortium States approved tools, processes, and procedures and testing procedures including penetration testing. When threats are uncovered, the Vendor will contain, mitigate, and resolve threats or security issues."]
["125.a","The Vendor will retain and use in-house expertise to ensure the Information Data Security Plan aligns with industry standards."]
["125.b","The Vendor will execute security procedures in accordance with the approved Information Data Security Plan. "]
[null,"Corrective Maintenance services"]
[126,"The Vendor’s responsibility is to limit the threshold for Vendor defects to less than five percent (5%) of overall monthly work items. Remediation under the Vendor’s maintenance and support responsibilities shall include all Vendor-generated defects including those above five percent (5%) of the overall monthly work items. Each Consortium State, at its discretion, may negotiate a different level for either or both Vendor defects and Vendor responsibility as it deems appropriate. "]
[127,"Corrective Maintenance Services related to new perfective maintenance services will be covered under the standard corrective maintenance services of this RFP no matter if the perfective maintenance Service was developed under T&M, a SOW, a CO-SOW, or by a different vendor."]
[null,"Adaptive Maintenance services"]
[128,"While the Vendor may not be the lead on all upgrades, the Vendor is required to assist as required in any upgrade."]
[129,"The Vendor will identify each vulnerability as Critical, High, Medium, or Low.  Based on the level of each vulnerability the patching requirements are: \n\nFailure to identify each vulnerability and meet the remediation requirements under SLA-015 may result in a penalty assessment. See Table 6 Maximum Penalties, SLA-015."]
["129.a","Critical Vulnerabilities – remediated within 14 days"]
["129.b","High Vulnerabilities – remediated within 30 days"]
["129.c","Medium Vulnerabilities – remediated within 60 days"]
["129.d","Low Vulnerabilities - remediated within 90 days"]
[130,"The Vendor will provide a monthly report showing all identified vulnerabilities, all patched vulnerabilities, and the vulnerability patching rate.  Each identified vulnerability will show the level of vulnerability as Critical, High, Medium, or Low. Failure to timely deliver the report may result in a penalty assessment. See Table 6 Maximum Penalties, SLA-012.    "]
[131,"In the event that the update to CORE is required because of a failure of the Vendor to appropriately and promptly perform patches or minor upgrades, either critical or routine, or any previous updates to the CORE, then the Vendor will bear responsibility for any costs related to its failure including but not limited to major upgrades. "]
[132,"The Consortium States anticipate that the Vendor will perform patching per SLA-014, or for critical security vulnerability patches immediately after notification to the appropriate Consortium States so as to always maintain a stable and secure system.  Failure to perform timely patching may result in a penalty assessment. See Table 6 Maximum Penalties, SLA-014. "]
[133,"The Vendor shall not fall behind or impede the timely implementation of system patches and minor upgrades, both routine and critical, or otherwise jeopardize the security of the system. "]
[null,"Preventative Maintenance & Performance Management services"]
[134,"The Vendor shall perform performance management for development services included in the list below. System performance will be monitored through the metrics outlined in Appendix D - Software Development Performance Monitoring. Performance metrics will be compiled by the PMO and provided to the Vendor.  Failure to meet performance management requirements may result in a penalty assessment. See Table 6 Maximum Penalties, SLA-002."]
["134.a","Surveys - Surveys will help the Consortium States focus on end-user support and satisfaction to address reliability, usability, and Vendor performance and satisfaction."]
["134.b","Time to Production - A measure that displays how fast the Vendor delivers on the required items and user stories. This metric will determine if each Consortium State gained the appropriate value proposition and receives the right product at the right cost."]
["134.c","Cost - In an effort to encourage the Vendor to optimize the size of each team, each Consortium States will measure the ratio of the cost of the sprint over the number to story points completed in a sprint. "]
["134.d","Code Quality - Each Consortium State will monitor code quality through in-house processes and software tools such as SonarQube. Each Consortium State and the Vendor will collaborate on the acceptable metrics for code quality during the first ninety (90) days after the contract start date."]
[135,"Additional performance management requirements for development services will be included in SLAs and KPIs, to be defined by the Consortium States."]
["10. ADMINISTRATION"]
[null,"Billing Practicies"]
[136,"The Vendor will provide the following types of invoices plus any other invoices deemed necessary and as agreed upon by the Consortium state(s) or a billing plan that demonstrates alternative billing practices that provides this same information in an alternative manner.  The Consortium States, at their sole discretion, have the right to refuse this billing plan and require the billing practices as laid out below."]
["136.a","Monthly Maintenance and Support – The Vendor will include the following, on, or as an attachment to, all monthly fixed cost Maintenance and Support invoices:  \ni.\tThe identification number used in the Consortium States’ ticketing system.\nii.\tA summary of the item being billed.\niii.\tCompletion percentage of the item."]
["136.b","Individual State T&M – The Vendor will include the following on or as an attachment to all T&M invoices:   i.\tThe identification number used in the Consortium States’ ticketing system of each item.\nii.\tA summary of the item being billed.\niii.\tThe Vendor staff who worked on the item.\niv.\tThe number of hours the Vendor staff worked on the item by staff member.\nv.\tCompletion percentage of this item.  If the completion percentage is 100%, the Vendor must attach the report outlined above in the Product Release Process. Failure to provide the required documentation with invoices may result in a penalty assessment. See Table 6 Maximum Penalties, SLA-012. \nvi.\tIn states where T&M projects require pre-approval, the Vendor will also provide the estimated costs that were approved and the approver.\nvii.\tFor any invoice that has the completion of a product, the Vendor shall include the final project report.  See SLA-012 and Section IV(B) for further information."]
["136.c","Shared Projects (includes T&Ms and SOWs), and Shared Services (T&Ms) – The Vendor will send a copy of this invoice to all participating Consortium States showing the total and individual costs for all shared projects or projects using shared services and will include the following information: \ni.\tThe identification number used in the Consortium States’ ticketing system of each item.\nii.\tA summary of the item being billed.\niii.\tThe Vendor staff who worked on the item by Consortium State.\niv.\tThe number of hours the Vendor staff worked on the item by staff member and by Consortium State.\nv.\tCompletion percentage of this item by Consortium State.  If the completion percentage is 100%, the Vendor must attach the report outlined above in the Product Release Process. Failure to provide the required documentation with invoices may result in a penalty assessment. See Table 6 Maximum Penalties, SLA-012. \nvi.\tIn states where T&M services require preapproval, the Vendor will also provide the estimated costs that were approved and the approver.\nvii.\tFor any invoice that has the completion of a product, the Vendor shall include the final project report.  See SLA-012 and Section IV(B) for further information."]
["136.d","SOW Milestone and CO-SOW Milestone – The Vendor will include the following as an attachment to all SOW Milestone invoices or CO-SOW Milestone invoices:\ni.\tCompletion percentage of this project by Consortium State & a brief Progress Report for any corrective, adaptive, or perfective maintenance services listing status of the Service, the number of professional service hours expended, and the percentage of the work completed.  \nii.\tDocumentation showing completion of the milestone.\niii.\tFor the final milestone, the Vendor shall include the final product report.  See SLA-012 and Section IV(B) for further information."]
[137,"The Vendor is encouraged to present alternative pricing models that may yield greater cost savings for this RFP.  For Attachment C - Cost Information Submission Form, the Vendor will provide a fixed cost price for maintenance and support work including but not limited to Sections IX below."]
[138,"The Vendor agrees to alter billing practices as required by the Consortium State(s) to arrive at a billing process conducive to the verification of the work performed for the Consortium States."]
[139,"The Consortium States understand that the fixed price for maintenance and support will be presented per year in this RFP and on Attachment C - Cost Information Submission Form."]
[140,"All T&M items will be billed using the Fully-loaded Hourly Time and Materials Rate provided in Attachment C - Cost Information Submission Form."]
[141,"All SOWs will be prepared using the Fully-loaded Hourly Perfective Maintenance Service Statement of Work Rate provided in Attachment C - Cost Information Submission Form."]
[142,"All CO-SOWs will be prepared using the Fully-loaded Hourly Change Order Rate provided in Attachment C - Cost Information Submission Form."]
[null,"Vendor Capacity"]
[143,"Vendor Capacity"]
["143.a","The Vendor must manage their capacity in order to maintain the workloads described in paragraph 110 above."]
["143.b","The Vendor must provide a human resources allocation report monthly to each individual Consortium State for their assigned staff, and "]
["143.c","The Vendor must provide a human resources allocation report for shared resources to all Consortium states.  "]
["143.d","These reports should, for the prior month, list all assigned employees or subcontractors, their assigned projects, employee location, pending Visa issues (if any), time-off requests that exceed one week, position, and the number of hours actually worked by each employee or subcontractor on each project.  "]
["143.e","This report should be presented to the individual Consortium states by the 15th day of the following month.  Failure to timely deliver monthly human resource allocation reports may result in a penalty assessment. See Table 6 Maximum Penalties, SLA-012."]
[144,"Audit Assistance"]
["144.a","The Vendor will be required to assist Consortium States with federal and state audits, vendor certifications, and other audits as the Consortium States deem necessary."]
["144.b","Required Audits\ni.\tState Auditor \nii.\tDepartment of Labor (DOL) and any departments therein  \niii.\tInternal Revenue Service \niv.\tSocial Security Administration"]
["144.c","The Vendor is required to comply with all audits as specified by Consortium States."]
["144.d","The Vendor will provide full support of audits of the ReEmployUSA system along with any related systems, software, services, and tools. "]
["144.e","The Vendor will utilize Time & Materials costing for tasks related to completion of the Audit outside of those tasks listed as Production Support Services."]
["144.f","Costs of Remediation of problems/issues found during the audit(s) are the responsibility of the Vendor unless one of the following three (3) items is true as determined by the individual Consortium State or States. \ni.\tThe Consortium State(s) independently procured tools, services, hardware, or software failed to meet specifications required for the audit\nii.\tThe issues identified in the audit are already planned for remediation as part of an existing or planned perfective maintenance service.\niii.\tThe audit finding resulted from the Consortium State(s) interpretation and/or direction that can be shown through documentation."]
["144.g","The Vendor will timely resolve findings related to audits after working with the State(s) to determine appropriate response."]
["11. PRODUCTION SERVICE LEVEL AGREEMENTS (SLAS) AND KEY PERFORMANCE INDICATORS (KPIS)"]
[null,"KPI/SLA'S"]
[145,"The Consortium States have identified specific KPIs to be key indicators of the UI System’s operational performance and of the Vendor’s support. The Vendor shall bear responsibility for the management of the system. Penalties described in this RFP for failure to meet an SLA or KPI may be assessed after documentation by any affected Consortium State independently."]
[146,"KPIs/SLAs will be agreed upon by the Vendor and the Consortium. Additional KPIs/SLAs may be added by the Consortium. Table 5 provides the KPIs and SLA’s."]
["SLA-001","SLA-001 - System Uptime: System availability is defined as the percentage of possible uptime in a month that the production environments supporting the Consortium Unemployment Systems (including all associated components implemented and controlled by the Vendor) are available to users, to perform back-end processing, or to perform in a back-up capacity. Negotiated downtime for system maintenance during off-peak hours (7:00pm to 7:00am), where the time zone is relative to the Consortium State, is not included in the calculation of system availability."]
["SLA-001","SLA-001 - System Uptime Continued: \nDowntime Defined\nDowntime is defined as the time during which any component(s) of the system is not functioning or available for any reason. Production downtime is the time during which the system is not available for its intended use in production. There are two types of downtime, as defined below:\n1.\tScheduled Downtime: Any period of time that the system, or any component(s) of the system, is unavailable for its intended use that has been reviewed and approved by Consortium in advance of the service interruption. Scheduled downtime, that has received approval from a Consortium member, does not count towards downtime performance standards.  \n2.\tUnscheduled Downtime: Any period of time that the system, or any component(s) of the system, is unavailable for its intended use that has not been approved by Consortium in advance of the service interruption."]
["SLA-001","SLA-001 - System Uptime Continued: \nUnscheduled downtime may occur as a result of various issues, outside of the Vendor’s control and not pertaining directly and solely to problems associated with the baseline Unemployment Systems. The Vendor must email the group identified by the affected Consortium State(s) with the downtime reason within fifteen (15) minutes of discovery.  For any downtime, the Consortium UI System must automatically re-connect to all interfaces and external integration points and deplete all externally queued or backlogged files and transactions within twenty-four (24) hours of System operational resumption\n\nThe Vendor must ensure that all Robotic Processing Automation (RPA) BOTS, AI, or other automated features in the system are operating as expected.  The Vendor must email the group identified by the affected Consortium State(s) with the downtime reason within fifteen (15) minutes of discovery."]
["SLA-001","SLA-001 - System Uptime: \nPerformance Standard 1:\nThe Vendor must ensure system availability of 99.99% during peak hours (7:00 am to 7:00 pm Monday-Friday) based on applicable time zone and of 99.9% during off-peak hours (7:00 pm to 7:00 am Monday-Friday and Saturday-Sunday), as it pertains directly and solely to availability of the baseline UI Systems.  "]
["SLA-001","SLA-001 - System Uptime: \nPerformance Standard 2:\nThe Vendor must report any BOT failure, delay in scheduled processing, AI failure, or any other item affecting the proper functioning of the RPA BOTS or AI within fifteen (15) minutes of discovery. See SLA-012 for reporting requirements. "]
["SLA-002","SLA-002 - System Performance and Performance Monitoring:\nSystem performance is defined as the time it takes for the system to complete actions initiated by a system user. "]
["SLA-002","SLA-002 - System Performance and Performance Monitoring:\nPerformance Standard 1\nThe Vendor must ensure a system performance response time of less than or equal to two (2) seconds for the following:\n•\tMenus within the Baseline Application\n•\tQuery to and from Database via Baseline Application\n•\tWeb-Enabled Programs\n•\tApplication pages are to be submitted, processed, and returned back to the user while the system is under peak loads.\n\nAn average time will be computed from five (5) consecutive system transactions at random times and with the transaction type(s) selected by the Consortium."]
["SLA-002","SLA-002 - System Performance and Performance Monitoring:\nPerformance Standard 2\nThe Vendor will establish logs, metrics, and auditing for a monitoring and alerting strategy for performance monitoring per the metrics outlined in Appendix D - Software Development Performance Monitoring."]
["SLA-002","SLA-002 - System Performance and Performance Monitoring:\nPerformance Standard 3\nThe Vendor will perform monthly performance tuning."]
["SLA-002","SLA-002 - System Performance and Performance Monitoring:\nPerformance Standard 4\nThe Vendor will implement a system for collecting and addressing user feedback."]
["SLA-002","SLA-002 - System Performance and Performance Monitoring:\nPerformance Standard 5\nAfter the Vendor has completed six (6) sprints, the Consortium in conjunction with the Vendor shall establish baselines and required reporting frequency for all of the following Performance Monitoring items. The Vendor will provide documentation to show that they are meeting or exceeding the agreed upon baselines at the reporting frequencies established. Appendix D - Software Development Performance Monitoring of this RFP provides additional technical information for this SLA.\n\n•\tDefect Density\n•\tDefect Detection Percentage\n•\tEscape Rate\n•\tCyclomatic Complexity\n•\tCORE Code Coverage\n•\tCode Quantity\n•\tCycle Time\n•\tLead Time\n•\tVelocity\n•\tCode Churn\n•\tSprint Burndown"]
["SLA-002","SLA-002 - System Performance and Performance Monitoring:\nPerformance Standard 6\nThe Vendor will conduct performance management for development services including surveys, time to production, cost and code quality per the metrics outlined in Appendix D - Software Development Performance Monitoring."]
["SLA-003","SLA-003 - Technical Support:\nThe Vendor must provide technical support for Consortium users who report technical problems, assist with problem analysis, and provide support to the Consortium for troubleshooting problems, where that support is consistent with the terms of this SLA and any future mutually agreed to support agreements.\n\nTracking of Support Inquiries\nThe Vendor shall maintain sufficient staff and systems to manage, track, and report on technical support services via multiple channels, including telephone, client portal, email, and mail. \n\nHours of Operation\nConsortium User Technical Support\nStandard Hours of Operation are 8 a.m. through the completion of all daily batches in addition to sprints and other specialized circumstances as defined by the state.\n\nStandard Disaster or Emergency Hours of Operation are 24 hours a day, 7 days per week. "]
["SLA-003","SLA-003 - Technical Support:\nPerformance Standard 1\nThe Vendor will ensure user support meets the following performance standards:\n\nAverage Speed of Answer. It is expected that the vendor’s staff will respond to inquiries during regular business hours. Response time for SLA-003 is 30 minutes and outside of these business hours, the response time is 45 minutes. \n\nFor disasters or Emergencies identified outside of the standard hours of operation, it is expected that the vendor’s staff will respond to inquiries within one hour."]
["SLA-004","SLA-004 - Data Recovery\nData Recovery is defined as retrieving inaccessible, lost, corrupted, damaged, or formatted data from the data repository(s).\n\nVendor Control\nNo data loss except for data collected after the last committed transaction"]
["SLA-004","SLA-004 - Data Recovery\nPerformance Standard 1\nExcluding disaster recovery scenarios, see DR SLAs for more information regarding DR data recovery requirements, there shall be no data loss experienced by the Consortium member State(s).  The Consortium State(s) will utilize queries of the data repository(s) to ensure compliance.   "]
["SLA-005","SLA-005 - Peak Expansion / Growth Factor\nPeak Expansion/Growth Factor is defined as the storage capacity and ability to expand system capabilities due to changes in business requirements, legislation changes and/or modernization."]
["SLA-005","SLA-005 - Peak Expansion / Growth Factor\nPerformance Standard 1\nThe Vendor will maintain sufficient resources to expand system capabilities as required because of business requirements, legislation changes, modernization, U.S. Department of Labor UIPLs and/or other Federal Legislative changes based on changing priorities."]
["SLA-006","SLA-006 - Support Service Issue Management\nThe Vendor is to provide support service issue management and resolve problems with the enterprise solution consistent with the terms of the RFP. Issues identified are to be categorized based upon severity, communicated to the Consortium State(s), documented, resolved, and tracked by the Vendor in a form and format accessible to, and approved by the Consortium. \n\nIssue Tracking\nA Consortium approved tool will be used for the tracking of defects from identification through resolution (during UAT as well), including all testing performed to ensure the correct fix is in place.  Currently this tool is Jazz, and we are migrating to Jira.  This tool may change according to the needs of the Consortium State(s)."]
["SLA-006","SLA-006 - Support Service Issue Management\nPerformance Standard 1\nThe Consortium State(s) and the Vendor shall categorize/set the priority for each issue, and the Vendor shall resolve all errors in accordance with the following: \n\nThe Vendor is expected to resolve issues based on the categorization/priority set by each state.\n\na.\tCritical Issue – Immediate remediation until deployed.  Patched if possible.\nb.\tHigh Priority Issue – Remediation within 1 week or other such time as agreed upon with each Consortium State.  \nc.\tMedium Priority Issue – Remediation by next build.\nd.\tLow Priority Issue – Remediation by next build."]
["SLA-006","SLA-006 - Support Service Issue Management\nPerformance Standard 2\nThe Vendor’s responsibility is to limit defects of its own work to less than five percent (5%) of overall monthly maintenance and support items. Regarding the limitation of defects, the Vendor will be measured solely for the defects coming from its own work and not legacy defects."]
["SLA-007","SLA-007 - Regular Operational Reporting\nPerformance Standard 1\nThe Vendor will ensure production operational reporting meets the following performance standards:\n\nNote that these performance standards and penalties apply to the extent the accepted production operational reports are unavailable due to an issue solely within the baseline Unemployment Systems application.\n\nReports Availability Schedule: Reports should be aggregated by process areas and functionalities.\n\n•\tDaily Reports: Beginning of the following business day.\n•\tMonthly Reports: Beginning of the following business day following the end of the month.\n•\tQuarterly Reports: Beginning of the following business day following the end of the quarter. \n•\tAnnual Reports: Beginning of the following business day following the end of the annual period (Calendar or fiscal)."]
["SLA-008","SLA-008 - System Security and Security Monitoring\nSee the following: Information Data Security Plan, IRS Publication 1075, OF-4 Requirements Traceability Matrix, System and Security tabs, NIST 800-53 Rev. 5, SSA requirements, 20 C.F.R. Section 603, CISA Cybersecurity best practices, SOCII Audit requirements, all Federal Tax Information (FTI) requirements, and individual Consortium State’s Information Technology Agency requirements."]
["SLA-008","SLA-008 - System Security and Security Monitoring\nPerformance Standard 1\nThe Vendor must maintain compliance with the above-listed security requirements, audits, matrices, publications, and best practices.  When the Vendor becomes aware that, or is notified by, a Consortium state of non-compliance in any of the above listed items, the Vendor must prepare a security remediation plan with the information listed below and present it to the Consortium Technology Committee within five (5) business days.  The Technology Committee, or the individual State’s representative to that Committee, will review the Vendor’s report as defined below to determine if acceptable or identify changes that must be made. The Vendor must present all of the following as part of the remediation plan:\n•\tAn explanation and documentation, if available, for security non-compliance\n•\tInterim mitigation actions to overcome the non-compliance.\n•\tExpected timeline to complete the remediation."]
["SLA-008","SLA-008 - System Security and Security Monitoring\nPerformance Standard 2\nThe Vendor will execute security procedures in accordance with the approved Information Data Security Plan."]
["SLA-009","SLA-009 - Sensitive Data, Cyber Attack, Cyber Security Incident, Breach, and Data Breach\nPerformance Standard 1\nThe Vendor will provide initial notice of any Cyber Attack, Cyber Security Incident, Breach, or Data Breach to the Consortium within Thirty (30) minutes of the Vendor’s identification of the potential issue.  The Vendor will then provide periodic updates as to the status of the incident, after action reports, etc.\n\nCyber Attacks, Breaches, and Data Breaches are considered Critical Issues with the associated resolution timelines."]
["SLA-010","SLA-010 - Vendor Cooperation with Infrastructure Services Vendor\nIn all cases including an incident or breach, that is determined to not be directly related to the application, the vendor will work with other teams, including the infrastructure team, to the maximum extent required to ensure that all KPIs are met."]
["SLA-010","SLA-010 - Vendor Cooperation with Infrastructure Services Vendor\nPerformance Standard 1\nThe Vendor will provide timely responses and staff availability as needed to the infrastructure services Vendor and be available as needed to complete Infrastructure Services projects. Delays in Infrastructure Services work where documentation exists showing the delay is due to the poor responsiveness or unavailability of this Vendor’s staff will result in penalties.  The Consortium member shall have the right to document State expenses due to these delays and the Vendor will be responsible for these costs. It is expected that the Applications Support Vendor and the Infrastructure Services Vendor will work collaboratively with the State Project Manager (SPM), State IT staff, and, as appropriate, the Consortium to accomplish the tasks that arise. Non-performance occurs when the SPM and the State's IT staff all agree and have documented that the Vendor' s poor responsiveness or unavailability of its staff outside of a 4-hour window is the reason for the delay in work"]
["SLA-011","SLA-011 - Staffing and Key Resources\nPerformance Standard 1\nThe Vendor will maintain staffing levels defined in the resulting Agreement.  Vacancies due to the departure of key positions must be communicated to the appropriate Consortium State within three (3) business days of the staff’s departure.  Replacements of key resources will be communicated to the Consortium State within five (5) business days of the hiring of a new key resource.  If there is a turnover of 3 or more key positions in in any three (3) month period, the affected  Consortium member shall have the right to secure its own contract staff at the Vendor’s expense."]
["SLA-011","SLA-011 - Staffing and Key Resources\nPerformance Standard 2\nHolidays - The Vendor must advise MDES / Consortium State(s) of any holidays (e.g., religious, cultural, etc.) other than State holidays that may result in the absence of three (3) or more employees, subcontractors or any key position. The Vendor must send notice fourteen (14) days in advance of any such holidays and must include the names of affected employees, subcontractors, or any key position.  "]
["SLA-011","SLA-011 - Staffing and Key Resources\nPerformance Standard 3\nVacations - The Vendor shall notify MDES / Consortium State(s) at least fourteen (14) business days prior to any employee’s or subcontractor’s scheduled vacation with a duration of more than five (5) business days."]
["SLA-012","SLA-012 - Required periodical testing and reporting\nPeriodical testing, updates, and reports must be reported as defined below. "]
["SLA-012","SLA-012 - Required periodical testing and reporting\nPerformance Standard 1\nMonthly:\nThe Vendor must provide a human resources allocation report monthly to the PMO and each individual Consortium State for their assigned staff and to the PMO and all Consortium States for their shared resources, for the prior month.  These reports must list all assigned employees or subcontractors, their assigned projects, employee location, pending Visa issues (if any), time-off requests that exceed one week, position, and the number of hours actually worked by each employee or subcontractor on each project.  This report will be provided to States by the 15th day of the month following the reported month. "]
["SLA-012","SLA-012 - Required periodical testing and reporting\nPerformance Standard 2\nMonthly:\nThe Vendor will provide, as a part of the product release requirements, a monthly report showing the manual and automated test coverage percentage, number of manual & automated test cases performed, and total number of test cases performed for each product in system testing during that month.  "]
["SLA-012","SLA-012 - Required periodical testing and reporting\nPerformance Standard 3\nMonthly:\nThe Vendor will provide a monthly report showing all identified vulnerabilities, all patched vulnerabilities, and the vulnerability patching rate.  Each identified vulnerability will show the level of vulnerability as Critical, High, Medium, or Low. "]
["SLA-012","SLA-012 - Required periodical testing and reporting\nPerformance Standard 4\nMonthly:\nThe Vendor will generate a monthly performance report card for each state on all KPIs, regarding the prior month’s performance. The Vendor shall ensure that all data and data elements necessary to support agreed upon SLAs and metrics will be collected and measured and can be monitored by the Consortium States.  The monthly performance report card for a completed month will be provided to each Consortium state within five (5) business days of the 1st of each month."]
["SLA-012","SLA-012 - Required periodical testing and reporting\nPerformance Standard 5\nQuarterly:\nSLA Review - The successful Vendor shall work with the Consortium to continually refine the data to be used, calculations, and monitoring approach for all aspects of all agreed upon SLAs and metrics for the first year of this contract."]
["SLA-012","SLA-012 - Required periodical testing and reporting\nPerformance Standard 6\nSemi-annually (180 days):\nThe Vendor will review, update, and deliver the “technical roadmap” every 180 days to ensure consistency with current technologies and notify each Consortium member state of all changes when implemented. "]
["SLA-012","SLA-012 - Required periodical testing and reporting\nPerformance Standard 7\nSemi-annually (180 days):\nThe Vendor will review, update, and deliver the “business roadmap” every 180 days to ensure consistency with current technologies and notify each Consortium member state of all changes when implemented."]
["SLA-012","SLA-012 - Required periodical testing and reporting\nPerformance Standard 8\nSemi-annually (180 days):\nThe Vendor will update and provide recommendations to the Cyber Security Risk Mitigation plan and provide to the Consortium States for approval every 180 days.  The plan will include all tools software, and security mechanisms currently utilized by the Consortium States."]
["SLA-012","SLA-012 - Required periodical testing and reporting\nPerformance Standard 9\nSemi-annually (180 days):\nThe Vendor will provide an updated Disaster Recovery Plan."]
["SLA-012","SLA-012 - Required periodical testing and reporting\nPerformance Standard 10\nAnnually:\nThe Vendor will perform Failover testing and Failback testing no less than every 365 days with testing criteria that are pre-approved by each Consortium State or the Consortium PMO."]
["SLA-012","SLA-012 - Required periodical testing and reporting\nPerformance Standard 11\nAnnually:\nThe Vendor will provide compliance documentation annually or upon request by a Consortium State that the system is in compliance with IRS publication 1075, NIST 800-53 Rev 5, SSA requirements, OF-4 requirements, and 20 C.F.R Section 603 or any update, revision, or future security compliance as required by the Consortium State(s)."]
["SLA-012","SLA-012 - Required periodical testing and reporting\nPerformance Standard 12\nAnnually:\nThe successful Vendor shall work with the Consortium to continually refine the data to be used, calculations, and monitoring approach for all aspects of all agreed upon SLAs and metrics for years two (2) through five (5) of this contract and any extensions or amendments."]
["SLA-012","SLA-012 - Required periodical testing and reporting\nPerformance Standard 13\nWithin a Specified Timeframe of an event:\nThe Vendor will update the Information Data Security Plan within 30 days of a change, alert, or release of guidance by the IRS, SSA, NIST, or an individual state(s) Information Technology Agency."]
["SLA-012","SLA-012 - Required periodical testing and reporting\nPerformance Standard 14\nWithin a Specified Timeframe of an event:\nThe Vendor will submit a written CAP for approval by the requesting Consortium State(s) no later than ten (10) business days from the date of the CAP request."]
["SLA-012","SLA-012 - Required periodical testing and reporting\nPerformance Standard 15\nWithin a Specified Timeframe of an event:\nThe Vendor will provide After-Action Reports following any RPA BOT or AI incident within 10 days of the event."]
["SLA-012","SLA-012 - Required periodical testing and reporting\nPerformance Standard 16\nWithin a Specified Timeframe of an event:\nThe Vendor, as a part of the product release requirements, will provide a report for each product at the conclusion of system testing showing the manual and automated test coverage percentage, number of manual and automated test cases performed, and total number of test cases performed during system testing for that product."]
["SLA-012","SLA-012 - Required periodical testing and reporting\nPerformance Standard 17\nWithin a Specified Timeframe of an event:\nThe Vendor, as a part of the product release requirements, will provide a report as outlined in the Product Release Requirements section of this document."]
["SLA-013","SLA-013 Billing and Invoicing:\nThe Vendor is to provide separate Consortium state billing and invoicing in a way that allows the States to easily identify work that has been completed, which Vendor staff completed the work, the completion percentage of the items, and verify those to ensure that funds are utilized in the best interest of the individual state.  The Consortium states must also be able to easily identify shared services and projects and how these are being billed across all participating states."]
["SLA-013","SLA-013 Billing and Invoicing:\nPerformance Standard 1\nSee Section X(A) for details of what items are required to be included in each invoice type listed.\n\nThe Vendor will produce monthly Maintenance and Support invoices."]
["SLA-013","SLA-013 Billing and Invoicing:\nPerformance Standard 2\nSee Section X(A) for details of what items are required to be included in each invoice type listed.\n\nThe Vendor will produce monthly Individual State T&M invoices."]
["SLA-013","SLA-013 Billing and Invoicing:\nPerformance Standard 3\nSee Section X(A) for details of what items are required to be included in each invoice type listed.\n\nThe Vendor will produce monthly Shared Services invoices."]
["SLA-013","SLA-013 Billing and Invoicing:\nPerformance Standard 4\nSee Section X(A) for details of what items are required to be included in each invoice type listed.\n\nThe Vendor will produce monthly Share Projects invoices (Both T&M and SOWs)."]
["SLA-013","SLA-013 Billing and Invoicing:\nPerformance Standard 5\nSee Section X(A) for details of what items are required to be included in each invoice type listed.\n\nThe Vendor will produce SOW Milestone invoices."]
["SLA-013","SLA-013 Billing and Invoicing:\nPerformance Standard 6\nSee Section X(A) for details of what items are required to be included in each invoice type listed.\n\nThe Vendor will produce invoices that have all the required documentation and supporting documentation in one file with all documentation.  For MDES this shall be one single PDF per invoice.  Other Consortium states may establish their invoicing requirements."]
["SLA-014","SLA-014 - Maintenance and Support services\nPerformance Standard 1\nThe Vendor will perform all Maintenance and Support as defined in this RFP under the monthly fixed cost price established under the contract."]
["SLA-015","SLA-015 - Vulnerability Patching Rate\nPerformance Standard 1\nEach identified vulnerability will have an identified level of vulnerability as Critical, High, Medium, or Low. \n\nFor any vulnerability that cannot be remediated within the listed timeframes, the vendor must notify the Consortium Technology Committee as soon as the inability to timely remediate is known.  The Technology Committee, or the individual State’s representative to that Committee, will review the information presented below to determine if the failure to timely remediate is allowable or should result in penalties. The Vendor must present the following:\n•\tAn explanation and documentation if available for the inability to patch in a timely manner.\n•\tInterim mitigation actions to overcome the failure to patch in a timely manner.\n•\tExpected timeline to complete the remediation."]
["SLA-016","SLA-016 - Product Release Requirements\nPerformance Standard 1\nThe Vendor will perform a Change Impact Analysis."]
["SLA-016","SLA-016 - Product Release Requirements\nPerformance Standard 2\nThe Vendor will provide system use cases (SUCs) to the Consortium State(s)."]
["SLA-016","SLA-016 - Product Release Requirements\nPerformance Standard 3\nThe Vendor will perform System Testing and provide the Consortium State(s) with detailed results of said testing."]
["SLA-016","SLA-016 - Product Release Requirements\nPerformance Standard 4\nThe Vendor will conduct a product demonstration of all new products prior to releasing the product to user acceptance testing."]
["SLA-016","SLA-016 - Product Release Requirements\nPerformance Standard 5\nThe Vendor will release the product into User Acceptance Testing a minimum of fourteen (14) days before a production release to ensure time for Consortium State(s) to adequately perform user acceptance testing."]
["SLA-016","SLA-016 - Product Release Requirements\nPerformance Standard 6\nThe Vendor shall not release a product to production without the Consortium State(s) official approval.  This approval requires completion of a product demonstration and completed user acceptance testing."]
["SLA-016","SLA-016 - Product Release Requirements\nPerformance Standard 7\nThe Vendor will create or update user manuals for changes made to the system including but not limited to screen changes, functionality changes, or role/access changes."]
["SLA-017","SLA-017 - CAP Failure\nPerformance Standard 1\nThe Vendor has shown an inability or failure to correct or prevent the CAP item from occurring.  This is demonstrated by 3 failures of the same SLA within a 12-month period.  "]
["Table 6","KPI Failure and Maximum Penalties"]
[147,"KPI Failure - In the event specific KPIs are not met, the applicable Consortium State, after documenting such failure, will follow the below guidelines."]
["147.a","Right to Payment Reduction- If an individual state demonstrates a KPI failure and elects to impose a penalty, as listed in Table 6, the penalty amount will be deducted from the next monthly Maintenance and Support invoice for that individual state after the State has notified the Vendor of a KPI Failure, provided a deadline for the correction of the KPI Failure, and the State has documented that the Vendor has failed to complete the correction. \n\nSLA-001’s and SLA-003’s penalties may be assessed on a daily basis up to the maximum penalty of 20%.  SLA-002 and SLA-004 through SLA-017’s penalties may be assessed on a monthly basis up to the maximum penalty of 20%.  See Table 6 for the Maximum Penalties."]
["147.b","Maximum Payment Reduction Percentages - The maximum fees assessed by any Consortium State must not exceed 20% of that state’s monthly allocation of the annual UI Systems Maintenance and Support fees per Consortium State or the penalty amount noted in Table 6.or the penalty amount noted in Table 6."]
["147.c","In the event that the maximum payment reduction fees assessed equal or exceed 20% for any consecutive 2-month period, the Vendor may be deemed to be in breach of the Contract and may be subject to Termination at the discretion of the individual Consortium States.  Cybersecurity incident penalties may only be counted as 1 month per event for purposes of this subsection See 147(d)(i)(b) below."]
["147.d","MANDATORY: Sensitive Data, Cyber Attack(s), Cyber Security Incident(s), Breaches, or Data Breaches – All items under this paragraph are mandatory.","M"]
["147.d.i","Cyber Security Penalties"]
["147.d.i.a","MANDATORY: In the instance of a Cyber Attack, Breach, or Data Breach, that is caused in whole or in part by the Vendor’s actions or inactions, each affected Consortium State(s), shall reduce its monthly payment by up to 20%. The enforcement of this penalty may occur in addition to any other rights or insurance amounts available to each affected Consortium State. This is a mandatory requirement.","M"]
["147.d.i.b","MANDATORY: In the event of more than one (1) Cyber Attack, Breach, or Data Breach that is caused in whole or in part by the Vendor’s actions or inactions within a six (6) month period, the Consortium State(s) may  impose the up to a 20% penalty for each occurrence, or deem the Vendor to be in breach of the Contract and may subject the Vendor to Termination at the sole discretion of the affected Consortium State(s). The enforcement of this penalty or right to terminate for breach of contract may occur in addition to any other rights or insurance amounts available to each affected Consortium State. This is a mandatory requirement.","M"]
["147.d.ii","MANDATORY: Credit Monitoring - In the instance of a Cyber Attack, Breach, or Data Breach, that is caused in whole or in part by the Vendor’s actions or inactions, all affected Consortium States, shall have the right to require the Vendor to provide Free Credit Monitoring and identity theft protection for three (3) years in an amount equal to the Vendor’s percentage of fault, as determined by the affected Consortium State, to all affected customers from the date of the attack or breach. This right is in addition to any other rights available to each affected Consortium State.  Each Attack or Breach shall require a separate three (3) year Free Credit Monitoring and identity theft protection package contribution in an amount equal to the Vendor’s percentage of fault, as determined by the affected Consortium State. This is a mandatory requirement","M"]
["147.e","Monthly Reporting - A performance report card for each state will be generated monthly on all KPIs defined herein, regarding the prior month’s performance. The successful Vendor shall ensure that all data and data elements necessary to support agreed upon SLAs and metrics will be collected and measured and can be monitored by the Consortium States. All reports and data used in the determination of SLA compliance and calculation of KPI metrics shall be made available to the Vendor by the Consortium. Failure to provide the required monthly reporting may result in a penalty assessment. See Table 6 Maximum Penalties, SLA-012. "]
["147.f","SLA Review - The successful Vendor shall work with the Consortium to continually refine the data to be used, calculations, and monitoring approach for all aspects of all agreed upon SLAs and metrics. The Vendor and the Consortium will jointly review all KPIs and Performance Measures to determine if measures require revision. Thereafter, similar reviews shall occur upon all of the following events.  See SLA-012 for more information. \n\ni.\tQuarterly Review for the first year, annually thereafter.\nii.\tMaterial changes to the maintenance and support services that impact existing KPIs. and\niii.\tUpon the request of any Consortium member."]
[null,"Disaster Recovery SLAs and KPIs"]
[148,"Disaster Recovery KPI/SLA Overview - The Consortium States have identified specific disaster recovery KPIs to be key indicators of the Disaster Recovery performance of the Vendor. The Vendor shall bear responsibility for remaining ready for disaster recovery. "]
[149,"Disaster Recovery KPIs/SLAs will be agreed upon by the Vendor and the Consortium. Additional KPIs/SLAs may be added by the Consortium. Table 7 provides the Disaster Recovery KPIs and SLA’s."]
["SLA-DR01","SLA-DR01 - Recorvery Point Objective (RPO)\nPerformance Standard 1\nThe Maximum amount of data, measured by time, can be lost after a recovery from a disaster/failure. The maximum time allotted is fifteen (15) minutes."]
["SLA-DR02","SLA-DR02 - Recorvery Time Objective (RTO)\nPerformance Standard 1\nThe maximum time to recover a system after an outage or disruption. The maximum time allotted is four (4) hours."]
["SLA-DR03","SLA-DR03 - Disaster Recovery Readiness\nPerformance Standard 1\nThe Vendor will upon request immediately provide documentation of the Disaster Recovery Readiness to each Consortium State and will work with the infrastructure Vendor of each state to ensure Disaster Recovery Environment Readiness."]
["SLA-DR04","SLA-DR04 - After Action Reports\nPerformance Standard 1\nThe Vendor will provide After-Action Reports following any disaster recovery exercise, test, or actual incident."]
["SLA-DR05","SLA-DR05 - Disaster Recovery Support\nPerformance Standard 1\nThe Vendor will Provide Emergency support services 24x7 for the duration of a disaster or emergency identified by the state."]
["SLA-DR05","SLA-DR05 - Disaster Recovery Support\nPerformance Standard 2\nThe Vendor must be able to comply with the Consortium State’s or States’ requirement of immediate dispatch of Vendor’s Help Desk staff."]
["SLA-DR06","SLA-DR06 - Required Periodical Reporting\nPerformance Standard 1\nSemi-Annually:\nThe Vendor will generate a semi-annual performance report card for each state on all disaster recovery KPIs, regarding the prior six months’ performance. The Vendor shall ensure that all data and data elements necessary to support agreed upon disaster recovery SLAs and metrics will be collected and measured and can be monitored by the Consortium States. "]
["SLA-DR06","SLA-DR06 - Required Periodical Reporting\nPerformance Standard 2\nAnnually:\nThe successful Vendor shall work with the Consortium to continually refine the data to be used, calculations, and monitoring approach for all aspects of all agreed upon disaster recovery SLAs and metrics. The Vendor and the Consortium will jointly review all disaster recovery KPIs and Performance Measures to determine if measures require revision."]
["SLA-DR06","SLA-DR06 - Required Periodical Reporting\nPerformance Standard 3\nWithin a specified timeframe of an event:\nThe Vendor will submit a written CAP for approval by the requesting Consortium State(s) no later than ten (10) business days from the date of the CAP request."]
["SLA-DR07","SLA-DR07 - CAP Failure\nPerformance Standard 1\nThe Vendor has shown an inability or failure to correct or prevent the CAP item from occurring.  This is demonstrated by 3 failures of the same SLA-DR within a 12-month period.  "]
["Table 8","Disaster Recovery KPI Failure and Maximum Penalties"]
[150,"Disaster Recovery KPI Failure - In the event specific disaster recovery KPIs are not met, the applicable Consortium State, after documenting such failure, will follow the below guidelines."]
["150.a","a. Right to Payment Reduction- If an individual state demonstrates a Disaster Recovery KPI failure and elects to impose a penalty, as listed in Table 8, the penalty amount will be deducted from the next monthly Maintenance and Support invoice for that individual state after the State has notified the Vendor of a KPI Failure, provided a deadline for the correction of the KPI Failure, and the State has documented that the Vendor has failed to complete the correction.   \n\nSLA-DR01’s penalties may be assessed for every 15 minutes that the failure continues up to the maximum penalty.  SLA-DR02’s penalties may be assessed for every 4 hours that the failure continues up to the maximum penalty.  SLA-DR03’s – SLA-DR07’s penalties may be assessed on a monthly basis up to the maximum penalty of 20%.  See Table 8 for the Disaster Recovery Maximum Penalties."]
["150.b","Maximum Payment Reduction Percentages - The maximum fees assessed by any Consortium State must not exceed 20% of that state’s monthly allocation of the annual UI Systems Maintenance and Support fees per Consortium State or the penalty amount noted in Table 8."]
["150.c","In the event that the maximum payment reduction fees assessed equal or exceed 20% for any consecutive 2-month period, the Vendor may be deemed to be in breach of the Contract and may subject to Termination at the discretion of the individual Consortium States .  "]
["150.d","Semi-annual Reporting - A performance report card for each state will be generated semi-annually on all disaster recovery KPIs defined herein, regarding the prior six months’ performance. The successful Vendor shall ensure that all data and data elements necessary to support agreed upon disaster recovery SLAs and metrics will be collected and measured and can be monitored by the Consortium States. All reports and data used in the determination of disaster recovery SLA compliance and calculation of disaster recovery KPI metrics shall be made available to the Vendor by the Consortium. Failure to provide the required semi-annual reporting may result in a penalty assessment. See Table 8 Disaster Recovery Maximum Penalties, SLA-DR06. "]
["150.e","The successful Vendor shall work with the Consortium to continually refine the data to be used, calculations, and monitoring approach for all aspects of all agreed upon Disaster Recovery SLAs and metrics. The Vendor and the Consortium will jointly review all Disaster Recovery KPIs and Performance Measures to determine if measures require revision. Thereafter, similar reviews shall occur as listed below.  See Table 8 Disaster Recovery Maximum Penalties, SLA-DR06. \n\ni.\tAnnually\nii.\tMaterial changes to the maintenance and support services that impact existing KPIs. and\niii.\tUpon the request of any Consortium state."]
[null,"Post-Award SLAs and KPIs"]
[151,"Post-Award KPI/SLA Overview - The Consortium States have identified specific post-award KPIs related to specific plans required as a part of the award of this RFP. The Vendor shall bear responsibility for the development of these plans. See Table 9 for the Post-Award SLAs/KPIs."]
["SLA-PA01","SLA-PA01 - Sprint Velocity Establishment\nPerformance Standard 1\nThe Vendor will establish a baseline sprint velocity within 180 days of the execution of the contract."]
["SLA-PA02","SLA-PA02 - Staffing Capacity\nPerformance Standard 1\nThe Vendor must illustrate how it will reach full capacity within ninety (90) days of the contract start date."]
["SLA-PA03","SLA-PA03 - Baseline framework of plans\nPerformance Standard 1\nThe Vendor will provide a baseline framework of the required plans (Enterprise Architecture Plan, Development and Quality Management Plan, Information Data Security Plan, Transition Plan, and Disaster Recovery Plan) within forty-five (45) days of the execution of the contract."]
["SLA-PA04","SLA-PA04 - Expectation Document\nPerformance Standard 1\nThe Vendor will provide an expectation document, outlining by section a proposed plan with detail for all major documents within forty-five (45) days of the execution of the contract."]
["SLA-PA05","SLA-PA05 - Enterprise Architecture Plan\nPerformance Standard 1\nThe Vendor will deliver an Enterprise Architecture Plan to the Consortium states within 180 days of the execution of the contract.  The initial transition architecture “Technical Roadmap” must be included in the Enterprise Architecture Plan. The Vendor will work with each state’s business users to capture and document the high-level “Business Roadmap” as part of the Enterprise Architecture Plan. See SLA-012 for all future “Technical Roadmap” and “Business Roadmap” requirements.  "]
["SLA-PA06","SLA-PA06 - Development and Quality Management Plan\nPerformance Standard 1\nThe Vendor will deliver a development and quality management plan to the appropriate Consortium members within 180 days of the execution of the contract."]
["SLA-PA06","SLA-PA06 - Development and Quality Management Plan\nPerformance Standard 2\nThe Vendor will develop a Software Architecture plan that will align with the Enterprise Architecture Strategy to guide development efforts to evolve towards microservices and industry best practices with reference to those specific practices as part of the Development and Quality Management Plan."]
["SLA-PA07","SLA-PA07 - Information and Data Security Plan\nPerformance Standard 1\nThe Vendor will deliver a security plan to the appropriate Consortium members within 180 days of the execution of the contract.  See SLA-012 for all future Information Data Security Plan requirements.  "]
["SLA-PA08","SLA-PA08 - Transistion Plan\nPerformance Standard 1\nThe Vendor will deliver a transition plan at the schedule defined above."]
["SLA-PA09","SLA-PA09 - Disaster Recovery Plan\nPerformance Standard 1\nThe Vendor shall produce and deliver a baseline update form for ReEmployUSA Disaster Recovery Plan to the appropriate Consortium State within thirty (30) business days of the execution of the contract.  "]
["SLA-PA10","SLA-PA10 - Code Quality Metrics\nPerformance Standard 1\nThe Vendor will collaborate with each Consortium State on the acceptable metrics for code quality.  These metrics must be established within ninety (90) days of the contract start date."]
["SLA-PA11","SLA-PA11 - CAP Creation\nPerformance Standard 1\nThe Vendor shall be required to prepare a CAP for any post Award SLA that exceeds the number of days for the requirements by more than sixty (60) days."]
["SLA-PA12","SLA-PA12 - CAP Failure\nPerformance Standard 1\nThe Vendor has shown an inability or failure to correct the CAP item from occurring.  This is demonstrated by any SPA-PA’s being on a CAP for more than two (2) months.  "]
["Table 10","Post-Award KPI Failure and Maximum Penalties"]
[152,"Post-Award KPI Failure - In the event specific Post-Award KPIs are not met, the applicable Consortium State, after documenting such failure, providing notice to the Vendor of such KPI Failure along with a deadline for the correction of such KPI failure will follow the below guidelines. If the Vendor fails to make the correction by the deadline, the State has the discretion to assess the percentages listed in Table 10 for each 30 days period thereafter that the Post-Award SLA/KPI exceeds the number of days for the requirements listed in each SLA-PA KPI.  The Vendor shall be required to provide a CAP once the SLA-PA01 through SLA-PA10 exceeds sixty (60) days past the requirement.  "]
["152.a","a. Right to Payment Reduction- If an individual state demonstrates a post-award KPI failure notice to the Vendor of such KPI Failure and a deadline for the correction of such KPI failure as well as the Vendor’s failure to complete the correction by the deadline, the State may and elects to impose a penalty, as listed in Table 10, the penalty amount will be deducted from the next monthly Maintenance and Support invoice for that individual state and not exceed a maximum of 20%. \n                                                                                                               \nSLA-PA01’s – SLA-PA12’s penalties may be assessed on a monthly basis up to the maximum penalty of 20%.  See Table 10 for the Post-Award Maximum Penalties.\n"]
["152.b","Maximum Payment Reduction Percentages - The maximum fees assessed must not exceed 20% of the applicable state’s monthly allocation of the annual UI Systems Maintenance and Support fees."]
["152.c","In the event that the maximum payment reduction fees assessed equal or exceed 20% for any consecutive 2-month period, the Vendor may be deemed to be in breach of the Contract and may subject to Termination at the discretion of the individual Consortium States.  "]
[null,"Audit and Compliance SLAs and KPIs"]
[153,"Audit and Compliance KPI/SLA Overview - In the event specific Audit and Compliance KPIs are not met, the applicable Consortium State, after documenting such failure, will follow the below guidelines."]
[154,"Audit and Compliance KPIs/SLAs will be agreed upon by the Vendor and the Consortium. Additional KPIs/SLAs may be added by the Consortium. Table 11 provides the Audit and Compliance KPIs and SLA’s."]
["SLA-AC01","SLA-AC01 - Annual SOCII Audit\nPerformance Standard 1\nThe Vendor is required to complete an annual audit for every calendar year thereafter so long as an effective Agreement exists and may take no more than 180 days for this audit.  "]
["SLA-AC02","SLA-AC02 - Post-Award SOCII Audit\nPerformance Standard 1\nThe Vendor is responsible for providing each Consortium State with a copy of its most recently completed SOC Audit (no older than 12 months) within the first ninety (90) days post award."]
["SLA-AC03","SLA-AC03 -  Vendor Participation in Audits\nThe Vendor must assist Consortium State(s) with federal and state audits, vendor certifications, and other audits as the Consortium States deem necessary."]
["SLA-AC03","SLA-AC03 -  Vendor Participation in Audits Continued:\nThe Vendor is required to comply with all audits as specified by Consortium States."]
["SLA-AC03","SLA-AC03 -  Vendor Participation in Audits Continued:\nThe Vendor will provide full support of audits of the ReEmployUSA system along with any related systems, software, services, and tools. "]
["SLA-AC03","SLA-AC03 -  Vendor Participation in Audits:\nPerformance Standard 1:\nActions or inactions of the Vendor that result in a delay, finding, or failure of any audit that is documented by the Consortium State(s) may result in a penalty as described above."]
["SLA-AC04","SLA-AC04 - CAP Failure:\nPerformance Standard 1: \nThe Vendor has shown an inability or failure to correct or prevent the CAP item from occurring.  This is demonstrated by 3 failures of the same SLA-DR within a 12-month period.  "]
["Table 12","Audit and Compliance KPI Failure and Maximum Penalties"]
[155,"In the event specific Audit and Compliance KPIs are not met, the applicable Consortium State, after documenting such failure, sending notice to the Vendor with a deadline for correction, and the Vendor fails to complete the correction, the Consortium State may follow the below guidelines. The percentages listed in Table 12 shall be applied for each 30 days that the Audit and Compliance SLA/KPI exceeds the number of days for the requirements listed in each SLA-AC KPI.  The Vendor shall be required to provide a CAP once the SLA-AC01 or SLA-AC02 exceeds sixty (60) days past the requirement."]
["155.a","Right to Payment Reduction- If an individual state demonstrates a post-award KPI failure and elects to impose a penalty as described above, in an amount as listed in Table 12, the penalty amount will be deducted from the next monthly Maintenance and Support invoice for that individual state.\n \nSLA-AC01’s – SLA-AC04’s penalties may be assessed on a monthly basis up to the maximum penalty of 20%.  See Table 12 for the Audit and Compliance Maximum Penalties.\n"]
["155.b","Maximum Payment Reduction Percentages - The maximum fees assessed must not exceed 20% of the applicable state’s monthly allocation of the annual UI Systems Maintenance and Support fees."]
[156,"In the event that the maximum payment reduction fees assessed equal or exceed 20% for any consecutive 2-month period, the Vendor may be deemed to be in breach of the Contract and may subject to Termination at the discretion of the individual Consortium States."]
[null,"Corrective Action Plan"]
[157,"The Consortium States may request a Corrective Action Plan (CAP) when the Vendor fails to meet a required SLA. The Vendor shall provide the requesting Consortium State with a written CAP, submitted for approval by the appropriate Consortium State(s) no later than ten (10) business days from the date of the Consortium State’s request for a CAP or other triggering event. Failure to provide a timely CAP upon request may result in a penalty assessment. See Tables 6, 8, 10, and 12 for Maximum Penalties, Disaster Recovery Maximum Penalties, Post-Award Maximum Penalties, and Audit and Compliance Maximum Penalties, SLA-017, SLA-DR07, SLA-PA12, and SPA-AC04."]
[158,"CAP Failure - In the event of a CAP failure, the applicable Consortium State has the right to payment reduction based on predefined penalties."]
["158.a","CAP Failure is defined as:"]
["158.a.i","For KPI/SLAs: The Vendor has shown an inability or failure to correct or prevent the CAP item from occurring.  This is demonstrated by 3 failures of the same SLA within a 12-month period.  "]
["158.a.ii","For Disaster Recover KPI/SLAs: The Vendor has shown an inability or failure to correct or prevent the CAP item from occurring.  This is demonstrated by 3 failures of the same SLA-DR within a 12-month period.  "]
["158.a.iii","For Post-Award KPI/SLAs: The Vendor has shown an inability or failure to correct the CAP item from occurring.  This is demonstrated by any SPA-PA’s being on a CAP for more than two (2) months.  "]
["158.a.iv","For Audit and Compliance KPI/SLAs: The Vendor has shown an inability or failure to correct or prevent the CAP item from occurring.  This is demonstrated by 2 failures of the same SLA-AC within a 12-month period."]