HOUSING AUTHORITY OF THE CITY OF LOS ANGELES 2600 …...available online in excel format) appendix 4 applications inventory . appendix 5 data center . appendix 6 hacla network . appendix

HOUSING AUTHORITY OF THE CITY OF LOS ANGELES RFP HA-2015-98 IT Sourcing

HOUSING AUTHORITY OF

THE CITY OF LOS ANGELES

2600 Wilshire Blvd. Los Angeles, CA 90057

INFORMATION TECHNOLOGY (“IT”) SOURCING

IMPORTANT DATES

Issue Date: 10/28/2015 Pre-proposal Conference: 11/10/2015 2:00 p.m. Deadline for Written Questions: 11/13/2015 2:00 p.m. Deadline for Submission: 12/21/2015 2:00 p.m.


HOUSING AUTHORITY OF THE CITY OF LOS ANGELES

REQUEST FOR PROPOSALS

Table of Contents I. INTRODUCTION ................................................................................................................ 1

A. Purpose .......................................................................................................................... 1

B. Profile ............................................................................................................................. 1

C. Information About Other Procurement Opportunities ...................................................... 1

D. Procurement Policy ........................................................................................................ 1

II. SUMMARY ......................................................................................................................... 2

A. Contract Administrator .................................................................................................... 2

B. General Instructions ....................................................................................................... 2

1. Supplemental Instructions ........................................................................................... 2

2. Minimum Acceptance Period ....................................................................................... 2

3. Pre-proposal Conference ............................................................................................. 2

4. Questions from Proposers ........................................................................................... 2

5. Submittal Instructions .................................................................................................. 3

6. RFP Addenda/Clarifications ......................................................................................... 3

7. Pre-contractual Expenses ............................................................................................ 3

8. No Commitment to Award ............................................................................................ 4

9. Joint Offers .................................................................................................................. 4

10. Proposed Contract ....................................................................................................... 4

11. Protests ....................................................................................................................... 4

12. Notice Regarding Disclosure of Proposal Contents ..................................................... 4

13. Insurance Requirements .............................................................................................. 5

14. Vendor Application Packet ........................................................................................... 5

III. PROPOSAL FORMAT AND CONTENT .......................................................................... 6

A. Presentation ................................................................................................................... 6

B. Proposal Content ............................................................................................................ 6

1. Transmittal Letter/Introduction ..................................................................................... 6

2. Table of Contents ........................................................................................................ 6

3. Qualifications ............................................................................................................... 6

4. Proposed Staffing and Project Organization ................................................................ 7

5. Work Plan/Technical Approach/ Methodology ............................................................. 8

6. Cost and Price ............................................................................................................. 8

7. Exceptions and Deviations .......................................................................................... 9

8. Appendices .................................................................................................................. 9


IV. PROPOSAL EVALUATION AND CONTRACT AWARD .................................................10

A. Evaluation Panel ...........................................................................................................10

B. Evaluation Criteria .........................................................................................................10

C. Negotiations ..................................................................................................................11

D. Contract Award ..............................................................................................................12

V. MBE/WBE REQUIREMENTS ............................................................................................13

A. Policy Statement ...........................................................................................................13

B. DEFINITIONS ................................................................................................................13

C. MBE/WBE Utilization .....................................................................................................13

D. Good-Faith Efforts .........................................................................................................13

VI. HUD ACT OF 1968 (SECTION 3) COMPLIANCE ..........................................................13

A. Section 3 Compliance ....................................................................................................13

B. Section 3 Documentation...............................................................................................14

1. Declaration of Understanding and Intent to Comply ....................................................14

2. Section 3 Business Concern Certification ...................................................................14

3. Section 3 Resident Certification ..................................................................................14 4. Section 3 Economic Opportunity Plan (EOP) ….……………………………………….14 5. Additional Section 3 Requirements .............................................................................15

C. Youth Protection Policy...……………………………………………………………………..15 VI. EXHIBITS LIST ..............................................................................................................17

The exhibits listed below are attached, and are incorporated herein by this reference. Exhibits marked in bold with a bracket ([ ]) must be submitted with the proposal, if applicable.

A SCOPE OF SERVICES/WORK APPENDIX 1 FORMAT FOR RFP QUESTIONS (available online in Word format) APPENDIX 2 TECHNICAL PROPOSAL TEMPLATE (available online in Word format) APPENDIX 3 PRICING PROPOSAL TEMPLATE (available online in Excel format) APPENDIX 4 APPLICATIONS INVENTORY APPENDIX 5 DATA CENTER APPENDIX 6 HACLA NETWORK APPENDIX 6.1 HACLA NETWORK DIAGRAM (available online) APPENDIX 7 CROSS-FUNCTIONAL (SERVICES MANAGEMENT) ROLES AND

RESPONSIBILITIES APPENDIX 8 END-USER SERVICES ROLES AND RESPONSIBILITIES APPENDIX 9 DATA CENTER SERVICES ROLES AND RESPONSIBILITIES APPENDIX 10 NETWORK SERVICES ROLES AND RESPONSIBILITIES

[B] Proposal Price/Cost Form C Contractual Requirements for Insurance [D] Declaration of Compliance with MBE/WBE Outreach Program Requirements [E] Equal Employment Opportunity Certification [F] Affirmative Action Program Certification [G] List of Subcontractors (submit only if subcontractors will be utilized)


[H] 3-page Vendor Application [I] Workforce Profile [J] Section 3 Documents

Form 1: Declaration of Understanding and Intent to Comply with Section 3 Requirements Form 2: Section 3 Business Concern Certification Form 3: Section 3 Resident Certification (Form 3) (submit only if applicable) Form 4: Section 3 Economic Opportunity Plan (EOP)

[K] Small, Minority, Women-Owned Business Concern Representation Certification L Instructions to Offerors (Non-Construction) (HUD Form 5369-B) M Proposed Contract (in Draft form) Exhibit 1: Scope of Services (to be attached) Exhibit 2: Service Provider’s Quote Form (to be attached) Exhibit 3: Contract General Conditions Exhibit 4: Service Provider’s Insurance Certificates (to be attached)


____________________________________________________________________________________ RFP for Services (Fed) September 2015 (V1) 1

HOUSING AUTHORITY OF THE CITY OF LOS ANGELES REQUEST FOR PROPOSALS

I. INTRODUCTION A. Purpose The Housing Authority of the City of Los Angeles (the “Authority” and sometimes “HACLA”) issues this Request for Proposals (“RFP”) to procure IT sourcing (“Services”). The Authority is procuring these Services using the procedures for competitive proposals authorized by the Authority’s Procurement Policy and Procedures. B. Profile The Authority was established in 1938 by City of Los Angeles Resolution No. 1241, and has since grown to become one of the nation’s largest and leading public housing authorities, providing the largest supply of quality affordable housing to residents of the City of Los Angeles. The Authority currently owns and manages a citywide portfolio of 9,405 housing units, administers monthly housing assistance payments for more than 56,000 families, and provides a wide range of programs and services. The Authority’s funds are derived from five main sources: HUD’s annual operating subsidy, HUD’s annual public housing Capital Fund, Section 8 rental subsidies, rents from the Authority’s public housing units, and other public (federal and non-federal) and private sources. The Authority’s annual budget exceeds $1 billion. C. Information About Other Procurement Opportunities Information about other procurement opportunities currently open for response at the Authority can be obtained by visiting the Authority’s website at www.hacla.org/opensolicitations and by accessing the Los Angeles Business Assistance Virtual Network (LABAVN), a service provided by the City of Los Angeles and the Mayor's Office of Economic Development, at www.labavn.org. Access requires registration, which is free. D. Procurement Policy All procurement activities of the Authority are conducted in accordance with the Authority’s Procurement Policy, applicable state and local laws and U.S. Department of Housing and Urban Development rules and regulations, including without limitation, the U.S. Department of Housing and Urban Development Handbook 7460.8 REV 2 and Title 24 Code of Federal Regulations Part 85.36, all as may be amended from time to time. The Authority’s Procurement Policy may be viewed at the Authority’s Doing Business page at http://www.hacla.org/business or by following this link: hacla.org/DoingBusiness/ProcurementPolicy

http://www.hacla.org/opensolicitations

http://www.labavn.org/

http://www.hacla.org/businesso

http://www.hacla.org/Portals/0/Attachments/Doing%20Business/PROCUREMENT%20POLICY%20(revised%206.25.15)Final.pdf



II. SUMMARY A. Contract Administrator The Contract Administrator for this RFP is Swan Lam whose contact information is provided below:

Housing Authority of the City of Los Angeles General Services Department Attn: Swan Lam, Contract Administrator 2600 Wilshire Boulevard, 4th floor Los Angeles, California, 90057 Phone: (213) 252-1895 Fax: (213) 252-5463 Email: [email protected]

B. General Instructions 1. Supplemental Instructions

The instructions set forth herein are in addition to and supplement the instructions set forth at Instructions to Offerors (Non-Construction) (HUD Form 5369-B), attached hereto as Exhibit L. In the event of a conflict between the Instructions set forth herein and the requirements of HUD Form 5369-B, the requirements of HUD Form 5369-B shall control. 2. Minimum Acceptance Period “Acceptance period” as used in this provision means the number of calendar days available to the Authority to award a contract, which is calculated commencing upon the day the Proposal is due. The Authority requires a minimum acceptance period of a period of 120 days. Any Proposal allowing less than the Authority’s minimum acceptance period will be rejected. 3. Pre-proposal Conference A conference to discuss this RFP and answer questions from proposers prior to the proposal submittal deadline will be held in open forum 11/10/2015, in Board of Commissioners Room, 1st Floor, at 2600 Wilshire Boulevard, Los Angeles, 90057 (“Central Office”) at 2pm, Pacific Standard Time1. While attendance at the meeting is not a prerequisite for submitting a proposal, all proposers are strongly encouraged to attend. Records of the conference, if any, will not be disseminated, except where material changes to this RFP are made by Authority representatives or answers to questions are deferred and later communicated as part of an addendum to this RFP. 4. Questions from Proposers

Questions or comments regarding this RFP (except to inquire about the number of addenda issued) must be put in writing and must be received by the Authority no later than 2 1 All times refer to Pacific Standard Time.



p.m. 11/13/2015. Deliver written questions to the Contract Administrator identified above. The Authority is not obligated to answer any questions received after the above-specified deadline or any questions submitted in a manner other than as instructed above. 5. Submittal Instructions Proposals are due no later than 2 p.m. (Pacific Time), 12/21/2015 In order to be considered "on time," a proposal must either be date-stamped or bear a handwritten inscription by an authorized representative of the Authority confirming receipt by the above-specified deadline. The date stamp is located in the General Services Department, located at the Fourth Floor of the Central Office. Proposals submitted after the Submittal Due Date may, at the sole discretion of the Authority, be rejected as non-responsive and returned without review. It is the practice of the Authority not to consider late offers unless it is determined that a selection cannot be made from among the proposals received on time. The Authority will not be responsible for, nor accept as a valid excuse for late proposal delivery, any delay in mail service or other method of delivery used by proposers. All proposals shall be enclosed in a sealed package(s) plainly marked with the words "Proposal Responding to RFP No. HA-2015-98; Do Not Open Until 2 p.m., 12/21/2015" One original and three copies of the Proposal must be submitted, as well as one readable CD-ROM disk of the Proposal. 6. RFP Addenda/Clarifications If it becomes necessary for the Authority to revise any part of this RFP, or to provide clarification or additional information after the proposal documents are released, a written addendum will be posted to LABAVN at www.labavn.org. As previously indicated, access to LABAVN requires registration, which is free. Answers to questions that cannot be answered by Authority staff at the pre-proposal conference and responses to written questions received by the deadline specified above at Questions from Proposers will also be communicated in writing as part of an addendum. All addenda issued become part of this RFP. Proposers may ascertain whether any addenda have issued by emailing the Contract Administrator prior to the proposal-submittal deadline. (This is the sole exception to the requirement that questions after the pre-proposal conference be submitted in writing.) It is the responsibility of proposers to inquire of the Authority as to whether any addenda have been issued. 7. Pre-contractual Expenses Pre-contractual expenses are defined as any expenses incurred by proposers in: (i) preparing its proposal in response to this RFP; (ii) submitting that proposal to the Authority; (iii) negotiating with the Authority any matter related to this RFP, including a possible contract; or (iv) engaging in any other activity prior to the effective date of award, if any, of a contract resulting from this RFP. The Authority will not, under any circumstance, be liable for any pre-contractual expenses incurred by proposers, and proposers shall not include any such expenses as part of their proposals.



8. No Commitment to Award Issuance of this RFP and receipt of proposals does not commit the Authority to award a contract. The Authority expressly reserves the right to postpone proposal opening for its own convenience, to accept or reject any or all proposals received in response to this RFP, to waive any irregularities or informalities in the offers received, and to negotiate with more than one proposer concurrently, or to cancel all or part of this RFP. 9. Joint Offers Where two or more proposers desire to submit a single proposal in response to this RFP, they should do so on a prime-subcontractor basis rather than as a joint venture or informal team. The Authority intends to contract with a single firm and not with multiple firms doing business as a joint venture. 10. Proposed Contract The Service Provider selected for contract award through this RFP will be required to enter into a written agreement with the Authority. The proposed Contract attached hereto as Exhibit K is the agreement proposed for execution. It will be modified to incorporate the necessary elements of the successful contractor’s proposal, and to incorporate other pertinent terms and conditions set forth in this RFP, including those added by addendum, and to reflect the proposer's offer or the outcome of contract negotiations, if any, conducted with the proposer, and/or necessary to comply with any pertinent HUD or other Federal, State, or local regulations. Any exceptions or deviations from the requirements set forth in the Proposed Contract must be declared in the proposal at the time of submittal. Such exceptions or deviations must be segregated as a separate element of the proposal under the heading "Exceptions and Deviations.” 11. Protests Protests must be in writing and delivered electronically (i.e., via email) or by mail to the attention of the Contract Administrator in accordance with the Authority’s Procedures for Competitive Solicitation Protests (“Protest Procedures”). The Protest Procedures may be reviewed at the Authority’s Doing Business page at http://www.hacla.org/business or by following this link: http://www.hacla.org/forms 12. Notice Regarding Disclosure of Proposal Contents All proposals received by the Authority will become the property of the Authority and be considered "public records" as defined by Government Code section 6252 of the California Public Records Act (Government Code section 6250 et. seq.). After contract award, all proposals are subject to public inspection and/or copying except as provided herein. Exception is made for proposers’ financial information, which is expressly excluded from disclosure under Government Code section 6254.15 and proposers’ private information (i.e., social security and tax identification numbers), which are protected under Government Code section 6254(c). Exception is also made for any portion of a proposal that contains Trade Secret Records, as defined under the Uniform Trade

http://www.hacla.org/business

http://www.hacla.org/forms



Secrets Act (Civil Code sections 3426 et. seq.), provided such information is clearly identified as a trade secret and is submitted in a separate binder marked "Trade Secret" which must be accompanied by an Acknowledgement of Trade Secrets Form, which will be provided by the Authority upon request. The Authority will not be liable or in any way responsible for the determination of or disclosure of Trade Secret Records that are not so identified and segregated, or if submitted without the Acknowledgement of Trade Secrets Form, or if disclosure is required under the Public Records Act. Proposer agrees that by submitting a proposal containing trade secrets, proposer agrees to indemnify and hold harmless the Authority, its officers, employees and agents from any judgment, fines, penalties, and attorneys fees awarded against the Authority in favor of the party requesting the Trade Secret Records, and any and all costs connected with the Authority’s defense of said action. Further, in submitting a proposal containing trade secrets, proposer agrees this obligation survives until proposer provides a written statement or similar notice to the Authority stating that it no longer wishes to exempt the Trade Secret Records from public disclosure, or the Trade Secret Records are destroyed and disposed of in accordance with the Authority’s Record Retention and Disposition Schedule. 13. Insurance Requirements The insurance coverages and amounts required for the Services are:

x Workers’ Compensation (statutory)/Employer’s Liability $1,000,000 x Comprehensive General Liability (with endorsement) $2,000,000 Automobile Liability $500,000 x Errors and Omissions (Professional Liability) $1,000,000 Incidences involving minors, under either a General Liability policy

or a separate Abuse and Molestation policy $1,000,000

Additional requirements concerning insurance coverages are set forth in the Contractual Requirements for Insurance, which is attached hereto as Exhibit C. Proposers submitting Proposals are required to submit proof of insurance with their Proposals. The Service Provider awarded the Contract will be required to provide Certificates of Insurance and endorsements naming the Authority as an additional insured party prior to commencing the Services or within 10 days of the Authority’s request, whichever is sooner. 14. Vendor Application Packet Any proposer submitting a proposal must complete and submit with their proposal the 3-page Vendor Application attached hereto as Exhibit H. Any proposer who does not already have on file the Authority’s Automatic Direct Deposit Authorization (ADDH) and Vendor Commodity Codes (VCC) and IRS W-9 forms must also complete and submit those forms with their proposal. The Authority’s Vendor Application packet is available for downloading (in PDF fillable format) at the Authority’s Doing Business page at http://www.hacla.org/business or by following this link: hacla.org/DoingBusiness/VendorApplicationPackage


http://www.hacla.org/Portals/0/Attachments/Doing%20Business/HACLAVendorApplicationPackagefillable2012.pdf



III. PROPOSAL FORMAT AND CONTENT A. Presentation Proposals should be type-written and submitted in 8-1/2" x 11" size, using a simple method of fastening. Proposals should not include any unnecessarily elaborate or promotional material. B. Proposal Content 1. Transmittal Letter/Introduction A letter of transmittal or introduction addressed to the Contract Administrator and signed by a person authorized to bind the business to the terms of the proposal must accompany the proposal. The letter must, at a minimum, contain the following: (a) Identify the business, including the company name, mailing address, email address and telephone number; and (b) Identify the name, title and contact information (email address and telephone number) for the proposer’s primary contact person. (c) A statement to the effect that the proposal will remain valid for a period of not less than 120 days from the due date for proposals (see Minimum Acceptance Period, above); (d) A statement that the business is not debarred, suspended or otherwise declared ineligible to contract by any federal, state or local public agency; (e) If applicable, a statement that identifies the proposal contains confidential information/trade secrets (see Notice Regarding Disclosure of Proposal Contents, above); and (f) If applicable, a statement acknowledging receipt of RFP addenda. 2. Table of Contents Proposals must include a complete table of contents for material included in the proposal. The Table of Contents should appear immediately following the Transmittal Letter/Introduction. 3. Qualifications Overview: This section establishes the ability of the proposer (and its subcontractors, if any) to satisfactorily perform the required work by reasons of: (i) legal eligibility and demonstrated competence in the services to be provided as well as demonstrated strength and stability as a business concern; (ii) previous experience performing work that is similar in



nature and scope to the subject Services, including previous or ongoing work performed for the Authority or other public agencies; (iii) established record of meeting client schedules; (iv) demonstrated competitive advantages over other businesses in the same industry; and (v) supportive client references. Furnish (as part of the Appendices) financial information concerning the business, such as the business’ most recently completed Income Statement and Balance Sheet that accurately describes the financial stability of the business. Financial information is treated as confidential information, which is not subject to public disclosure. Disclosure of the business’ financial information is limited to individuals who are materially involved in the evaluation of proposals submitted in response to this RFP. Furnish the following information for both the proposer and any subcontractors included in the offer: (a) Furnish background information about the business, including date of founding, legal form (sole proprietorship, partnership, corporation/state of incorporation), number and location of offices, principal lines of business, number of employees, days/hours of operation and other pertinent data. Disclose any conditions (e.g., bankruptcy, pending litigation, planned office closures, impending merger) that may affect the proposer's ability to perform contractually. (b) Disclose any organizational conflicts of interest, which is defined as a situation in which the nature of the Services and Service Provider’s organizational, financial, contractual or other interests are such that: (1) award of the Contract may result in an unfair competitive advantage; or (2) the Service Provider’s objectivity in performing the Contract Work may be impaired. (c) Describe the business's most noteworthy qualifications for providing the required services to the Authority. Describe previous experience performing work that is similar in nature and scope to the subject Services, including previous or ongoing work performed for the Authority or other public agencies. Describe previous successes in meeting client schedules. Specifically highlight qualifications that distinguish the business. (d) Provide references from at least 3 relevant business clients (especially other public housing authorities and other public agencies) to which proposer is currently providing services. Include agency and/or company names, beginning/ending dates of contracts, and names, titles and telephone numbers of individuals that the Authority can contact as references. 4. Proposed Staffing/Project Organization/&Transition Overview: This section informs the Authority of the proposer’s staffing (i.e., employees who would be assigned to work on the subject Services) and the transition thereof. (a) Identify the key personnel from the business who would be assigned to the Authority's project. Include a brief description of their qualifications, job functions and office locations.



(b) Designate a Project Manager/Account Manager who would provide day-to-day direction of the required work and become the Authority's primary contact person. (c) Furnish (as part of the Appendices) brief resumes (not more than two pages long) for all key personnel. (d) If more than two people will be assigned to the Authority's project, include an organization chart that clearly delineates communication/reporting relationships among the project staff. (e) Follow guidelines and instructions in Exhibit A: Section 9 to describe staff resources to satisfy HACLA’s objectives described in this RFP. 5. Work Plan/Technical Approach/ Methodology Overview: This section establishes the proposer's understanding of the Authority's objectives and requirements, demonstrates the proposer's ability to meet those requirements, and outlines, clearly and concisely, proposer’s plan for accomplishing the specified work. (a) Describe, as succinctly as possible, how the business would accomplish the subject Services and satisfy the Authority's objectives described in this RFP. If appropriate, divide the project into segments or tasks to represent milestones for measuring progress. (b) Describe the information, documents, staff assistance, facilities or other resources the business would require from the Authority to complete the project, and declare any other critical assumptions upon which the Proposal is based. (c) Furnish a schedule projecting the completion of the required work. Express elapsed time in terms of weeks. Cover the entire project period (from the start of the Services through project completion) and include the attainment of each milestone or completion of each task. (d) Follow guidelines and instructions in Exhibit A: Section 9 and Exhibit A- Appendix 2: Technical Proposal Template to describe how your firm would accomplish the work and satisfy HACLA’s objectives describe in this RFP 6. Cost and Price Overview: This section discloses proposer’s price(s) to perform the Services as well as its price(s) for additional Services, and conditions that may result in an increase in prices during the contract term. All prices quoted must be fully-burdened (i.e., direct labor + overhead + profit) and all-inclusive of all items, services and costs that the proposer needs to complete the Services, including but not limited to tools, equipment, materials, insurance, licensing, bonding, etc. Follow guidelines and instructions in Exhibit A: Section 9 and Exhibit A – Appendix 3: Pricing Proposal Template to provide cost information for all services described in this RFP



(a) Using the Proposal Cost/Price form attached, provide a detailed fee schedule for completing the tasks described in the Work Plan/Technical Approach/Methodology section of the proposal. (b) Using the Proposal Cost/Price form, furnish a schedule of rates for services that would be in addition to those described in the Scope of Services. (c) Declare any conditions that may result in an increase in prices during the contract term. 7. Exceptions and Deviations Proposers must declare and thoroughly explain any proposed exceptions to or deviations from the requirements set forth in this RFP, including an exceptions or deviations from the terms and conditions contained in the proposed Contract. 8. Appendices The Appendices portion of the proposal should contain all of the following: (a) Provide financial information concerning the business, such as the business’ most recently completed Income Statement and Balance Sheet that accurately describes the financial stability of the business. (Financial information is treated as confidential information, which is not subject to public disclosure. Disclosure is limited to individuals who are materially involved in the evaluation of the proposals.) (b) Resumes for all key personnel. (c) Proof of Insurance. See Insurance Requirements section above for coverage details. (c) Any additional information the proposer deems essential to a proper evaluation of the proposal, which is not included in any of the foregoing sections. Proposers are cautioned, however, that this does not constitute an invitation to submit large amounts of extraneous material. Appendices should be relevant and brief.



IV. PROPOSAL EVALUATION AND CONTRACT AWARD A. Evaluation Panel

An Evaluation Panel with expertise on the subject matter will be responsible for reviewing, analyzing and evaluating the proposals received. The Panel may include Agency staff and one or more individuals from other public agencies. Panelists serve without compensation. In addition to evaluating proposals, the Panel may also conduct contract negotiations with the highest rated proposer(s) or such task may be assigned to the staff of the General Services Department. Depending on the dollar amount of the contract award(s), the Evaluation Panel may also select the successful proposer(s) or make recommendations to the President and CEO and Board of Commissioners regarding Service Provider selection. B. Evaluation Criteria By use of numerical and narrative scoring techniques, proposals will be evaluated by the Evaluation Panel against the evaluation criterion listed in the foregoing "Proposal Format and Content" section of this RFP.

(1) Initial Screening of Proposals All proposals will be reviewed and evaluated in the initial screening process for responsiveness and minimum qualifications. A list of finalists will be identified based on their overall scores derived from the evaluation criteria listed as followed: 1. Qualifications (20 pts) 2. Proposed Staffing/Organization & Transition (20 pts) 3. Work Plan/Technical Approach/Methodology (25 pts) 4. Cost and Price (25 pts) 5. Section 3 (7 pts) 6. MBE/WBE Outreach (3 pts)

(2) Evaluation of Finalists

Finalists will be required to participate in an in-depth interviews according to the following criteria:

1. Technical Interview – Implementation & Support Services; (45 pts) 2. Final Cost; (25 pts)

Finalists may be required to participate in scheduled site visit(s) and are permitted interview the Authority’s contractor and/or employee for any questions. The site visits may include but is not limited to the Authority’s network system, helpdesk information, ticket counts, and/or other relevant functions which may assist the Service Providers with the proposal. All activities shall be conducted and arranged by General Services Department with the Contract Administrator.



Proposed costs will be evaluated to determine whether they are necessary and reasonable for the conduct of the proposed contract, reflect a clear understanding of the requirements, and are consistent with the methods of performance described in the offeror’s proposal. Upon selection of the most qualified proposers, the Authority may require the finalists to make an oral presentation to the Evaluation Panel and/or the Board of Commissioners to further explain their proposals. If such interviews are conducted, the Authority's appraisals of the presentations will also be factored into the final scores assigned the proposals. However, proposers are advised that award may be made without interviews or further discussion. C. Negotiations Negotiations will be conducted with all responsible proposers whose proposals have a reasonable chance of being selected for award, unless it is determined by the Evaluation Panel that negotiations are not needed because there is/are a clear winner(s) based upon the RFP criteria. This determination is based on the relative score of the proposals as they are evaluated, rated and ranked in accordance with the technical and price factors specified in this RFP. Negotiations are exchanges between the Authority and proposers that are undertaken with the intent of allowing the proposer to revise and/or clarify its proposal. The scope and extent of negotiations are a matter of the Authority’s judgment but are generally conducted as panel interviews with proposer. Proposers will be treated fairly and equally with respect to any opportunity for negotiation and revision of their proposals. No proposer will be given any information about any other proposer’s proposal, and no proposer will be assisted in bringing its proposal up to the level of any other proposal. After initial negotiations are complete, the Evaluation Panel will re-determine the competitive range based upon the RFP criteria. The Authority will then invite all proposers in the competitive range to submit their best and final offers (“BAFOs”), making any changes they wish in their technical proposal and the price. BAFOs will be evaluated in essentially the same manner as the initial offers. At his/her discretion, the Contracting Officer may have the entire Evaluation Panel or only a subset of the Panel evaluate the BAFOs. In either case, the Contracting Officer will ensure that a full evaluation is conducted sufficient to support the award decision that is most advantageous to the Authority based upon the cost or price and other factors specified in this RFP. A common deadline will be established for the receipt of BAFOs. BAFOs are usually requested only once in a procurement. However, in exceptional circumstances, the Contracting Officer may determine that it is in the Authority’s best interest to conduct another round of negotiations and request a second BAFO. In such cases, the Evaluation Panel may also re-determine the competitive range based upon the BAFOs. In that case, only those proposers still in the competitive range are asked to submit another revised BAFO. Notwithstanding all the above, if, after the initial evaluation of proposals, the Evaluation Panel determines that there is a clear winner, and there is no need to negotiate or obtain further clarification or information from that proposer, the Authority may proceed directly to award without the use of a BAFO.



D. Contract Award 1. Responsibility (a) The Authority awards contracts only to responsible businesses that are qualified to perform the services in question and are in good standing with the Authority. A responsible business is one that meets the following standards: (i) has a satisfactory record of business integrity and has demonstrated the attribute of trustworthiness; (ii) has adequate financial resources, or the ability to obtain such resources as required during performance of the contract; (iii) is able to comply with the required or proposed delivery or performance schedule, taking into consideration all existing business commitments; (iv) has a satisfactory record of performance; (v) is otherwise qualified and eligible to receive an award under applicable laws and regulations; (vi) has the necessary organization, experience, operational controls, and technical skills, or the ability to obtain them; and (vii) has the necessary production, construction, and technical equipment and facilities, or the ability to obtain them. (b) Responsibility is evaluated by examination of a variety of resources, including but not limited to the business’s Vendor Application, state and federal lists of debarred, suspended or ineligible businesses or individuals, commercial credit rating reports, references, and documented past performance on contracts with the Authority. 2. Limitations The Authority may award either a single contract as the result of this RFP, or may apportion the requirements of this RFP among multiple contractors if this is determined to be in the Authority's best interests. Contracts valued in excess of $150,000 are required to be approved by the Authority's Board of Commissioners at a noticed, public meeting.



V. MBE/WBE REQUIREMENTS A. Policy Statement

It is the policy of the Authority to utilize Minority Business Enterprises (MBEs) and Women's Business Enterprises (WBEs) to the extent possible. This action is consistent with the mandates of Title VI of the 1964 Civil Rights Act, Executive Order 11625, Attachment 'O' of the Office of Management and Budget (OMB) Circular A-102, and in support of Executive Directive 2001-26, issued by the Office of the Mayor. B. DEFINITIONS “Minority Business Enterprise” means a certified business of which is at least 51% of which is owned and controlled by one or more minority group members, or, in the case of a publicly-owned business, one in which at least 51% of its voting stock is owned by one or more minority group members, and whose management and daily business operations are controlled by one or more such individuals. Minority group members include, but are not limited to, African/Black Americans, Hispanic/Latino Americans, Native Americans, Asian Pacific Americans, Asian Indian Americans and Hasidic Jewish Americans. “Women Business Enterprise" (WBE) means a certified business of which at least 51% of which is owned and controlled by one or more women, or, in the case of publicly held corporation, 51% of the stock is owned by one or more women and whose management and daily business operations are controlled by one or more such individuals. C. MBE/WBE Utilization

Proposers are required to support the Authority's efforts by conducting outreach to MBEs and WBEs for subcontract or supply opportunities related to the prime contracts for which the proposers are competing. D. Good-Faith Efforts Proposers are required to certify their compliance with the Authority's MBE/WBE policy by making sufficient "good-faith" efforts to help the Authority achieve its anticipated levels of participation. All proposers are required to complete and submit with their proposals the Declaration of Compliance with MBE/WBE Outreach Program Requirements, attached hereto as Exhibit D, which documents outreach efforts. VI. HUD ACT OF 1968 (SECTION 3) COMPLIANCE A. Section 3 Compliance The Work performed hereunder is subject to the requirements of Section 3 of the Housing and Urban Development (HUD) Act of 1968 (“Section 3”). The purpose of Section 3 to ensure that employment and other economic opportunities generated by certain HUD financial assistance shall, to the greatest extent feasible, and consistent with existing Federal, State and local laws and regulations, be directed to low- and very low- income persons, particularly those who are recipients of government assistance for housing, and to business concerns that provide economic opportunities to low- and very low-income persons. The Authority is committed to implementing and ensuring compliance with Section 3.



In order to realize the goals of and ensure compliance with Section 3, the Authority has adopted a Section 3 Guide and Compliance Plan (the “Section 3 Plan”) to assist Vendors in understanding their Section 3 obligations so that they can be successful in meeting these responsibilities. The Section 3 Plan is available for viewing at www.hacla.org/forms. B. Section 3 Documentation Any Vendor submitting a proposal must complete, date, execute and submit with its proposal the applicable Section 3 forms, which are attached hereto as Exhibit J-1 through Exhibit J-4. Fillable versions of these forms are also available for downloading at www.hacla.org/forms. 1. Declaration of Understanding and Intent to Comply with Section 3 Requirements (Form 1) Any proposer submitting a proposal must complete and return this form. If the proposer awarded a Contract hereunder is going to employ a subcontractor, that subcontractor must also complete and the proposer must submit the subcontractor’s Declaration of Understanding and Intent to Comply with Section 3 Requirements within 72 hours of the Authority’s request for the same or prior to commencement of the Work, whichever is sooner. 2. Section 3 Business Concern Certification

(Form 2) Any proposer submitting a proposal must complete and return this form. This form requires the proposer to check the box that matches the eligibility criteria and, if claiming Section 3 Business Concern status by ownership or workforce composition, provide supporting documentation. If the proposer awarded a Contract hereunder is claiming Section 3 Business Concern status because of a commitment to subcontract to a Section 3 Business Concern, that subcontractor must also complete and the proposer must submit the subcontractor’s Section 3 Business Concern Certification within 72 hours of the Authority’s request for the same or prior to commencement of the Work, whichever is sooner. 3. Section 3 Resident Certification (Form 3) Only proposers claiming Section 3 Business Concern status by ownership or workforce composition must complete and return this form. Proposers claiming as Type 1 Section 3 Business Concern should complete the Section 3 Resident Certification form as owner(s). Proposers claiming as Type 2 Section 3 Business Concern will need to have each Section 3 Resident employee fill out a Section 3 Resident Certification form, which must be submitted with the proposer’s proposal. The proposer awarded a Contract hereunder must also submit subcontractor’s certifications, if applicable, within 72 hours of the Authority’s request for the same or prior to commencement of the Work, whichever is sooner. 4. Section 3 Economic Opportunity Plan (EOP) (Form 4) Any proposer submitting a proposal must complete and return this form. The EOP





shall clearly identify the new hire and subcontracting commitments. Should hiring and subcontracting not be feasible, the proposer must commit to providing other economic opportunities. Failure to submit an EOP will render the proposal non-responsive and ineligible for Contract award. The winning proposer’s EOP is incorporated into the Contract. If the proposer is going to employ a subcontractor, that subcontractor must also complete and submit an EOP. 5. Additional Section 3 Requirements The proposer awarded the Contract will also be required to consult with the Authority’s Section 3 Compliance Administrator concerning ongoing compliance responsibilities, including completion and submittal of a Section 3 Compliance Summary Report (Form 5) and the Section 3 Job Order Form (Form 6), which are also available for downloading in fillable format at www.hacla.org/forms. C. YOUTH PROTECTION POLICY ☐ Applicable ☒ Not Applicable2 Where the Authority has determined that the Services will likely result in employees, volunteers and agents of the Service Provider awarded the contract having more than limited contract with or supervision of minors within the meaning of the Authority’s Youth Protection Policy for Service Providers, the requirements of said Policy will apply to this Contract. 1. The Authority’s Youth Protection Policy for Service Providers was adopted by the Authority in an effort to help ensure the safety of minors served by the Authority’s programs, and requires, to the greatest extent permitted by law, criminal background checks for all employees, volunteers and agents of Service Providers (and their subcontractors) who, in the scope of providing services to the Authority, may have more than limited contact with or supervision of minors. A copy of the policy may be downloaded from the Authority’s Doing Business page at http://www.hacla.org/business (see Forms, Documents and Policies) or by following this link: www.hacla.org/DoingBusiness/FormsDocumentsPolicies. 1. As part of its contractual obligations, the Service Provider awarded the contract will be responsible for satisfying all Service Provider requirements set forth in the Policy, including the following: (a) Completing Background Check on all “Covered Persons,” a term defined in the Policy; (b) Prohibiting all Covered Persons from coming into contact with or supervising minors until cleared by the Background Checks required under the Policy; (c) Certifying to the completion of requisite Background Checks by providing to the Authority, in writing, a list of all Covered Persons who have cleared Background Checks (“Cleared Background Check List”) and ensuring ensure its Cleared Background Check List is current, accurate, and available to the Authority upon demand; (d) If eligible, applying for subsequent arrest notification with the

2 This determination is reflected in the Procurement Request Form prepared for this project.



http://www.hacla.org/Portals/0/Attachments/Doing%20Business/Policy%20for%20Service%20Providers%20Youth%20Protection%20(V.2).pdf



Department of Justice in order to receive subsequent arrest notice for Covered Persons; (e) Immediately notifying the Authority, in writing, in the event any Covered Person is arrested for a crime that, if convicted, would cause the person not to pass the Background Check required by the Policy and ensuing arrested persons do not come into contact with or supervise Minors until cleared of all charges; (f) Immediately notifying the Authority, in writing, in the event any Covered Person is investigated for material violations of the Policy and ensuring such person does not come into contact with or supervise Minors until the investigation is complete; and (g) Requiring Covered Persons to sign an affidavit, under penalty of perjury, that contains the provisions described in the Policy. 2. Additionally, as set forth in the Contract’s insurance requirements, the Service Provider awarded the Contract will be required to submit proof of insurance coverage protecting against incidences involving minors, under either a General Liability policy or a separate Abuse and Molestation policy.



VI. EXHIBITS LIST The exhibits listed below are attached, and are incorporated herein by this reference. Exhibits marked in bold with a bracket ([ ]) must be submitted with the proposal, if applicable.

A Scope of Services/Work

APPENDIX 1 FORMAT FOR RFP QUESTIONS (available online in Word format) APPENDIX 2 TECHNICAL PROPOSAL TEMPLATE (available online in Word format) APPENDIX 3 PRICING PROPOSAL TEMPLATE (available online in Excel format) APPENDIX 4 APPLICATIONS INVENTORY APPENDIX 5 DATA CENTER APPENDIX 6 HACLA NETWORK APPENDIX 6.1 HACLA NETWORK DIAGRAM (available online) APPENDIX 7 CROSS-FUNCTIONAL (SERVICES MANAGEMENT) ROLES AND

RESPONSIBILITIES APPENDIX 8 END-USER SERVICES ROLES AND RESPONSIBILITIES APPENDIX 9 DATA CENTER SERVICES ROLES AND RESPONSIBILITIES APPENDIX 10 NETWORK SERVICES ROLES AND RESPONSIBILITIES

[B] Proposal Price/Cost Form C Contractual Requirements for Insurance [D] Declaration of Compliance with MBE/WBE Outreach Program Requirements [E] Equal Employment Opportunity Certification [F] Affirmative Action Program Certification [G] List of Subcontractors (submit only if subcontractors will be utilized) [H] 3-page Vendor Application [I] Workforce Profile [J] Section 3 Documents

Form 1: Declaration of Understanding and Intent to Comply with Section 3 Requirements Form 2: Section 3 Business Concern Certification Form 3: Section 3 Resident Certification (Form 3) (submit only if applicable) Form 4: Section 3 Economic Opportunity Plan (EOP)

[K] Small, Minority, Women-Owned Business Concern Representation

Certification L Instructions to Offerors (Non-Construction) (HUD Form 5369-B) M Proposed Contract (in Draft form) Exhibit 1: Scope of Services (to be attached) Exhibit 2: Service Provider’s Quote Form (to be attached) Exhibit 3: Contract General Conditions Exhibit 4: Service Provider’s Insurance Certificates (to be attached)


RFP for Services (Fed) Exhibit A– Scope of Services September 2015 (V1)

Exhibit A

Scope of Services/Work

insert or attach

Housing Authority of the City of Los Angeles RFP HA-2015-98 IT Sourcing

1

Exhibit A

Scope of Work

Table of Contents

1. INTRODUCTION ......................................................................................................................................... 5

1.1 Current State and Budget ................................................................................................................... 5

1.2 Current Operating Model and Alternate Models ............................................................................... 5

1.3 Multiple Service Providers or Multisourcing ...................................................................................... 5

1.4 On‐Shoring and Background Checks ................................................................................................... 5

1.5 Assumptions ........................................................................................................................................ 5

2. HACLA DEPARTMENTS .............................................................................................................................. 6

3. INFORMATION TECHNOLOGY DEPARTMENT ........................................................................................... 7

3.1. Overview ............................................................................................................................................ 7

3.2. IT Goals ............................................................................................................................................... 7

3.3. IT Organization Guiding Principles ..................................................................................................... 7

3.4. Internal IT organization ...................................................................................................................... 8

4. IT OUTSOURCING OBJECTIVES AND SERVICE PROVIDER GUIDING PRINCIPLES ...................................... 9

4.1 IT Outsourcing Objectives ................................................................................................................... 9

4.2 Service Provider Guiding Principles .................................................................................................. 10

4.2.1 Enhance IT Capabilities and Provide Consistent and Stable Infrastructure Support ................. 10

4.2.2 Reduce and Control IT Costs ...................................................................................................... 10

4.2.3 Maintain and Improve Technology ............................................................................................ 10

4.2.4 Improve Business Processes and Standardize Processes........................................................... 10

5. TECHNICAL ENVIRONMENT AND BASELINE ............................................................................................ 10


2

5.1. Helpdesk and Desktop Environment................................................................................................ 11

5.1.1. Standard desktop applications.................................................................................................. 11

5.2. Data Center Environment ................................................................................................................ 12

5.2.1. Data Center Inventory ............................................................................................................... 12

5.2.2. Data Center Tools: .................................................................................................................... 12

5.2.3. Disk and Tape Information ........................................................................................................ 13

5.3. Network Environment ...................................................................................................................... 14

5.3.1. Network Connectivity Diagram ................................................................................................. 14

5.3.2. Network Inventory .................................................................................................................... 14

5.3.3. HACLA Locations ....................................................................................................................... 14

5.4 Applications Environment ................................................................................................................. 14

6. SCOPE OF SERVICES – Service Towers: ................................................................................................... 14

6.1. CROSS – FUNCTIONAL SERVICES (Services Management) Service Tower ....................................... 15

6.1.1. Operational Standards and Leading Practices .......................................................................... 16

6.1.2. Project Management Services .................................................................................................. 16

6.1.3. Architecture, Engineering and Design Services: ....................................................................... 17

6.1.4. Project Services ......................................................................................................................... 17

6.1.5. Security and Disaster Recovery ................................................................................................. 17

6.1.6. Change Management ................................................................................................................ 18

6.1.7. Third Party Coordination ........................................................................................................... 18

6.1.8. Documentation ......................................................................................................................... 18

6.1.9 Cross‐Functional (Services Management) Roles and Responsibilities ....................................... 18

6.2. END USER SERVICES Service Tower ................................................................................................. 18

6.2.1. Helpdesk Services...................................................................................................................... 18

6.2.2. Desktop Services ....................................................................................................................... 20


3

6.2.3. End‐User Services Roles and Responsibilities ........................................................................... 22

6.3. INFRASTRUCTURE SERVICES Service Tower ..................................................................................... 22

6.3.1. Data Center Services ................................................................................................................. 22

6.3.1.1 Data Center Services Roles and Responsibilities .................................................................... 23

6.3.2. Network Services ...................................................................................................................... 23

6.3.2.1 Network Services Roles and Responsibilities .......................................................................... 25

6.4. APPLICATIONS and WEB SERVICES Service Tower ........................................................................... 25

6.4.1. Application Maintenance Services ............................................................................................ 25

6.4.2. Web Services ............................................................................................................................. 26

6.5. ACCOUNT MANAGEMENT SERVICES Service Tower ........................................................................ 26

6.5.1. Departmental Coordination ...................................................................................................... 27

6.5.2. Service Delivery Management .................................................................................................. 27

6.5.3. Governance ............................................................................................................................... 27

6.5.4. Performance Management ....................................................................................................... 27

6.5.5. Time and Utilization Management ........................................................................................... 27

6.5.6. Relationship Management ........................................................................................................ 28

6.5.7 Account Management Roles and Responsibilities ..................................................................... 28

6.6 Service Level Requirements (SLRs) ................................................................................................... 28

6.6.1 Commitment to Comply With All SLRs ....................................................................................... 28

6.6.2 Measurement and Reporting ..................................................................................................... 28

6.6.3 Root‐Cause Analysis and Resolution. ......................................................................................... 29

6.6.4 Improvement and Review of SLRs. ............................................................................................ 29

6.6.5 Penalties and Earn‐Back ............................................................................................................. 29

7. SCOPE OF SERVICES: IN‐FLIGHT PROJECTS ............................................................................................. 29

In‐Flight Project ‐ 1 .................................................................................................................................. 30


4

8. SCOPE OF SERVICE: ADDITIONAL OR OPTIONAL SERVICES ..................................................................... 30

8.1. Telecom and Voice Support Services ............................................................................................... 30

8.2. Surveillance Cameras Support ......................................................................................................... 31

8.3. Application Management Services – Emphasys Elite ...................................................................... 31

8.4. Application Management Services – ORACLE e‐Business Suite (EBS) ............................................. 32

9. OPERATING MODEL AND PRICING GUIDELINES ..................................................................................... 34

9.1. Operating Model .............................................................................................................................. 34

9.2. Pricing Guidelines ............................................................................................................................. 34

9.2.1. Operational Services and Strategic Services ............................................................................. 35

9.2.2. In‐flight Projects ........................................................................................................................ 35

9.2.3. Additional or Optional Services ................................................................................................ 36

9.2.4. Short Term or Specialized Resources ........................................................................................ 36

10. TRANSITION AND CRITICAL MILESTONES ............................................................................................. 37

10.1. Transition Plan ............................................................................................................................... 37

10.2. Transition Milestones .................................................................................................................... 37

10.2.1. Policies and Procedures manual ............................................................................................. 37

10.2.2. IT Service Catalog .................................................................................................................... 38

10.2.3. ITIL Continuation Plan ............................................................................................................. 38

10.2.4. Application and Infrastructure Optimization/Rationalization ................................................ 38

11. Appendices ............................................................................................................................................ 38


5

1.INTRODUCTION

1.1CurrentStateandBudgetThe Housing Authority of the City of Los Angeles (HACLA) currently outsources the maintenance and support of its technology infrastructure as well as other information technology services. The current annual outsourcing budget is $2,200,000 and the term of the current contract is set to expire on June 15, 2016. Keeping this annual budget in mind, HACLA is initiating a competitive selection process to identify the best suited Service Provider(s) for continuing support of IT operational and transformational objectives through 2021.

1.2CurrentOperatingModelandAlternateModelsTo ensure that HACLA maximize its return on investment (ROI) from the outsourcing initiative, the process of architecting the best-fit solution and selecting the right Service Provider(s) shall be developed in a highly collaborative manner. Specifically, while HACLA may have provided details about a suggested operating model and pricing approach (managed services on-premise), HACLA seeks creative solutions from the Service Provider(s). If an alternate operating model and pricing approach is proposed, the Service Provider(s) should clearly indicate all details about the proposed solution and highlight the added benefits that HACLA will receive compared to HACLA suggested approach (e.g. remote managed services, remote managed services & hosting, Infrastructure as a Service, Monitoring as a Service, etc.).

1.3MultipleServiceProvidersorMultisourcingIt is HACLA’s preference to partner with a single Service Provider that can cover the entire Scope of Work of this RFP. However, given that different components of this RFP will require a variety of areas of expertise, HACLA will consider proposals from multiple Service Providers for different areas of the Scope of Work. HACLA reserves the right to select multiple Service Providers and to operate a multisourcing model where one Service Provider is the integrator of all IT Services.

1.4On‐ShoringandBackgroundChecksService Providers are prohibited from performing any work associated with this RFP or using subcontractors for any service associated with this RFP offshore (outside the United States). Service Providers will be required to conduct appropriate background checks of all staff.

1.5AssumptionsThis scope of work contains minimal service levels and other requirements that the Service Provider(s) must meet or exceed and it should be noted that HACLA has made every effort to provide comprehensive details of the requirements, technology environment and the sourcing process. However, it is likely that certain information provided might not be accurate and HACLA is cognizant of the fact that the Service


6

Provider(s) may have to make certain assumptions to build the solution and pricing for HACLA. Service Provider(s) should ensure that all such assumptions are listed in their proposals.

2.HACLADEPARTMENTS The following table provides a functional overview of all HACLA Departments.

Department Function

Finance

Responsible for general budget, grants, Section 8 payment processing & mixed financing, general ledger, fixed assets, property management accounting, payroll, accounts receivable, cash management, and accounts payable functions.

Housing Services

Responsible for providing affordable, decent, safe and sanitary housing for eligible low and very low income families and for those single individuals who are eligible under HUD regulations.

Asset/Grant Management Responsible for property management and Capital Fund Grant administration for HACLA.

Department: Human Resources

Responsible for employee relations, recruiting, benefits, insurance, and risk management.

General Services Responsible for contracts, purchasing, mailroom, motor pool, transportation, and facilities for HACLA.

Information Technology See Section 3

Section 8

Responsible for providing affordable, decent, safe and sanitary housing for eligible low and very low income families and for those single individuals who are eligible under HUD regulations and to provide those eligible persons greater housing choices and the opportunity to locate housing outside of areas of poverty or racial concentration.

Development Services Responsible for the development of new housing units and/or acquisition of existing properties for HACLA Public and Market Rate housing portfolios.

Legislative and Intergovernmental Affairs

Oversees internal and external communications of the agency including handling media inquiries, responsible for communication between City Hall, Washington D.C. and Sacramento. The department's goal is to enhance transparency of the agency through the use of effective communication tools and methods to share information within the agency as well nationally.


7

3.INFORMATIONTECHNOLOGYDEPARTMENT 3.1.Overview The IT Department drives HACLA’s IT vision, defines IT architecture and manages development, implementation and optimization projects for applications, infrastructure and business processes. The department installs and maintains computers, workstations and servers, administers data network and servers, provides Helpdesk support and administration for internal systems, provides training for desktop applications and manages central data services. The IT Department supports the business operations of HACLA departments through a series of services that include the integration of computer systems, strategizing and maximizing technology assets, negotiating and managing technology related contracts, office automation and telecommunication, etc.

Software support is provided to evaluate, procure, develop or modify software programs to the specified needs of various operating units;

Hardware support is provided for remote and local area operating platforms including servers and storage devices;

Networked automation support is available to employees including a trouble call helpdesk;

Centralized computer processing services are provided on all major systems including administration, report development, and system backups.

3.2.ITGoals Key goals

Improve service delivery while reducing costs through innovation Transformation via technology IT alignment to business needs while promoting HACLA-wide view and

standards Maximize ROI of information technology investments

3.3.ITOrganizationGuidingPrinciples The following are concepts that HACLA IT management believes are required for an effective organization.

Roles and responsibilities are well-defined and understood. The right skills and teams in place to meet current and future needs. Work to be performed effectively in cross-functional groups, not in silos. Sound relationships and teamwork exists between teams. A strong customer focus can be found among all team members. Strong and trusted relationships exist with customer groups. Service levels are in place with the business that transcends functional groups.


8

The business understands the value we deliver. A consistent and effective project methodology is in use. A clear set of IT principles underlie decision making. We have clarity about who makes decisions. Work priorities are consistent across all IT teams. Resources are well-managed. The organizational structure is the most appropriate to deliver our services

3.4.InternalITorganization The IT Department maintains a lean and highly efficient organization structure with primary responsibility to provide leadership for information technology initiatives. The internal team also manages the relationship with an existing Service Provider along with defining priorities and driving optimization of support services provided by the IT Service Provider.

IT Officer

ERP Support(2)

Xerox Program Director

Administration (3)

Help DeskManager

Network ServicesManager

Help Desk Staff(6)

Network Staff(5)

Application Support(3)

Telecommunication Support (1)

The IT Department has been using the outsourcing services of XEROX State and Local Solutions, Inc. (Xerox) since June 2011. Xerox currently provides IT support to HACLA through a staff of seventeen (17) onsite Full Time Equivalents (FTE) that consists of an Account Manager, Helpdesk manager, Network services manager, seven (6) helpdesk staff, five (5) network staff, and three (3) applications support staff. In maintaining a lean organization, the IT Department relies on the competence and experience of the Service Provider to take ownership of all IT support and development


9

services, provide best-of-breed solutions, introduce best practices and maintain a highly optimized IT environment.

4.ITOUTSOURCINGOBJECTIVESANDSERVICEPROVIDERGUIDINGPRINCIPLES HACLA intends to partner with a competent Service Provider that can help the IT department to lead IT innovation, to revamp the service delivery model, to optimize operations and to improve quality of service. HACLA desires to establish minimum services levels and reserves the right to add, change or delete any service level requirements during the agreement development phase with the selected Service Provider.

4.1ITOutsourcingObjectivesThe key outsourcing objectives and requirements from Service Provider(s) are provided below. Strategic

Support the IT department to enhance departmental coordination and service provisioning to users

Establish robust governance mechanism Implement best of breed project management office Provide technology thought leadership and solution architecting to HACLA Leverage best practices & competencies to drive improvements

Operations

Reduce time, effort and cost on operational activities by utilizing industry standards, deploying tools and standardization

Measure, track, report and improve quality of service to users Leverage best-practices in managing operations optimization

Optimization

Proactively seek and provide recommendations to optimize technology environment, improve quality of service and reduce cost

Provide options and recommendations to establish enhanced delivery model (i.e. shared services, remote capabilities)

Progressively dedicate more resources to development/innovations/optimization


10

4.2ServiceProviderGuidingPrinciples

4.2.1EnhanceITCapabilitiesandProvideConsistentandStableInfrastructureSupport

The Service Provider shall provide Services in a manner that enhances the IT Department’s ability to deliver consistent, stable, high-quality, cost-effective services to HACLA end users with minimal interruptions and few, if any, disruptions to HACLA's business. Technology and processes used by the Service Provider shall provide the IT Department with industry-prevailing levels of functionality and performance.

4.2.2ReduceandControlITCosts

The Service Provider will continuously propose new and cost-effective processes and technologies in order to, at minimum, control and with all due expectations further reduce the overall cost of IT Services to HACLA.

4.2.3MaintainandImproveTechnology

The Service Provider will implement industry best practices and new technologies to deliver IT Services to HACLA that allows HACLA to take advantage of improvements in cost-efficiencies and service functionalities, and with that objective will continually update the processes, procedures and methodologies as well as the underpinning technologies.

4.2.4ImproveBusinessProcessesandStandardizeProcesses

The Service Provider shall deliver IT Services that are aligned with Information Technology Infrastructure Library (ITIL) as the nomenclature basis, IT Service Management (ITSM) as the service management basis, COBIT 5 as the basis for governance and management, Project Management Body of Knowledge (PMBOK) as the basis for project and program management, and Six Sigma as the continuous improvement basis, or any industry accepted substitute. These standards shall be used to assist the IT Department in standardizing and improving its business processes. The Service Provider will document such processes as part of its Service delivery.

5.TECHNICALENVIRONMENTANDBASELINE HACLA is on an aggressive path to optimize, standardize and refresh the core technology foundation and systems with an objective to ensure that base services are extremely robust, reliable, and easy to maintain and update. HACLA expects that by ensuring operational excellence, it can continue to progress from an operational support provider to becoming the technology partner and thought leader for all HACLA departments. Some of the progress that has been made in past years includes, but is not limited to:


11

Desktop standardization: Standardized desktop environment on Windows 7 and Office 2010 and implemented management tools to reduce manual effort and improve productivity and reliability

ORACLE e-Business Suite Upgrade to Release 12: major upgrade requiring multiple upgrade tracks covering the upgrade of the HW, OS, expanding to multi-node architecture in the DMZ, integration of Weblogic technology and Business Process Improvements

5.1.HelpdeskandDesktopEnvironment

Helpdesk Tool: HelpStar Call volume: 700 month (+/- 10%) Windows 7 is the primary operating system Desktop/Laptop Model(s):

Hewlett Packard 8000Ees and 6300 Pro Wyze, Acer and 10Zig Thin Clients Dell Latitude and HP ProBook

Tools deployed for remote troubleshooting Process documentation is available for all key support processes No local administration rights is provided to users Users are located in multiple facilities. There are a few users that have

VPN capabilities to access remotely if needed

5.1.1.Standarddesktopapplications

Type Vendor Name Version OS Microsoft Windows 7 SP1 Application Microsoft Outlook 2010, 2013 Application Microsoft Office Suite 2010, 2013 Application Microsoft Internet Explorer 10 Application Microsoft Media Player 12

Application McAfee VirusScan Enterprise

8.8

Application Adobe Acrobat Reader 10, DC

Volume information: About 800 users (About 50 VIP users) About 680 desktops About 268 thin clients About 60 laptops About 183 network and desktop printers and 31 MFDs/Copiers About 240 Smart phones and 10 tablets VoIP (at HQ) and Centrex (at remote offices) phone systems


12

5.2.DataCenterEnvironment HACLA servers are managed by Xerox. The servers occupy three racks in space leased by XEROX in the Orange County Data Center, 1400 S. Grand Ave., Santa Ana, California. There are a few servers locally at the main office building in 2600 Wilshire Blvd., Los Angeles, CA. i.e. file servers for local shares and the primary VoIP system.

5.2.1.DataCenterInventory

Details of data center inventory are provided in Appendix 5: Data Center.

5.2.2.DataCenterTools:


13

App Function Backup Exec Data backups Banyan FTP Software

Blackberry Blackberry email server Cute FTP Automated FTP Software Directory Manager Allows for update of phone, title, Dept, and other AD

fields without being an administrator. DreamWeaver Web Development

File System Auditor Tracks who deletes files on shared network drives. GHOST PC/Server Imaging

Go-to-Meeting On-line technical collaboration HelpStar HelpDesk Work Orders

HP WebJet Admin HP Printer Support/Maintenance tool Kroll On Track Search/recover Exchange database for emails

Lefthand SAN Storage Management

Linux (Oracle version) Oracle App Hosting McAfee ePO Antivirus/anti-malware PGP Encryption File encryption for FTP

RSA SecurID Remote Access SCCM HW/SW tracking-management

Sharepoint Web Portal-New Intranet

Solar Winds Network and System monitoring Spotlight on AD, Exchange, SQL

Monitors these apps

SSL VPN Remote Access Systems Insight Manager Monitors servers

Toad SQL maintenance Wasp Inventory

WSUS Patch management

5.2.3.DiskandTapeInformation

Quantity Vendor Description Capacity

3 HP Lefthand DL320s storage array* 3.6 TB each 3 HP Lefthand P4500 storage array* 3.6 TB each

*Managed using SAN/IQ and the Lefthand management console.


14

5.3.NetworkEnvironment

5.3.1.NetworkConnectivityDiagram A diagram of the HACLA network is provided in Appendix 6: HACLA Network. 5.3.2.NetworkInventory Details of network inventory are provided in Appendix 6: HACLA Network. 5.3.3.HACLALocations

HACLA HQ 2600 Wilshire Bl, Los Angeles, CA 90057 OC Data Center 1400 So. Grand, Santa Ana, CA 92705 S8 South 19600 S Hamilton, Torrance, CA 90502 S8 Valley 6946 Van Nuys Bl, Van Nuys, CA 91405 Avalon Gardens 701 E. 88th Pl, Los Angeles, CA 90002 Estrada Courts 3232 Estrada, Los Angeles, CA 90032 Gonzaque Village 1515 E. 105th, Los Angeles, CA 90002

Imperial Courts 11541 Croesus Av, Los Angeles, CA 90059 Independence Sq 2455 S. Saint Andrews Pl, Los Angeles, CA 90018 Jordan Downs 9800 Grape St., Los Angeles, CA 90002 Mar Vista Gardens 11965 Allin, Culver City, CA 90230 Nickerson Gardens 1590 E 114th, Los Angeles, CA 90059 Pico Gardens 1526 E. 4th, Los Angeles, CA 90033 Pueblo Del Rio 1801 E. 53d, Los Angeles, CA 90058 Ramona Gardens 2830 Lancaster, Los Angeles, CA 90033 Rancho San Pedro 275 W. 1st, San Pedro, CA 90731 Rose Hills (T1, not MPLS) 4470 Florizel, Los Angeles, CA 90032 San Fernando Gardens 10995 Lehigh Ave, Pacoima, CA 91331 William Mead 1300 Cardinal, Los Angeles, CA 90012

5.4ApplicationsEnvironment The list of applications and detailed description is provided in Appendix 4: Applications Inventory.

6.SCOPEOFSERVICES–ServiceTowers:


15

HACLA is planning to enter into an IT outsourcing agreement with a Service Provider that takes complete ownership of all operational activities and project services required for the support, maintenance and upgrade of all in-scope IT systems. Note: if multiple Service Providers are selected, the primary Service Provider shall be responsible for coordination and integration of the items below not included in their proposal, thus, the primary Service Provider would function as the IT Services Integrator.

Cross–Functional Services (Services Management): Cross–Functional Services are those services and activities that apply to the provision, delivery, and management of all service areas above including the role of providing technology thought leadership to the IT Department.

End User Services: End User Services are those services and activities that apply to the provision, support and management of Helpdesk Services and Desktop Services.

Infrastructure Services: Infrastructure Services are those services and activities that apply to the provision, support and management of Data Center Services and Network Services.

Applications and Web Services: Application Services are those services and activities that apply to the maintenance, support and management of HACLA IT applications and websites.

Account Management Services: Account Management Services are those services and activities that apply to the overall management of all Services provided by the Service Provider.

The scope of service for each service area is provided below. Please note that the activities listed below may not be comprehensive and HACLA expects the Service Provider to take responsibility of all activities to support, maintain and upgrade all IT systems related to the service area. In addition, HACLA reserves the right to add, change or delete any service level requirements during the agreement development phase with the selected Service Provider. 6.1.CROSS–FUNCTIONALSERVICES(ServicesManagement)ServiceTower Cross-functional Services are those services and activities that apply to the provision, delivery, and management of all service areas above including the role of providing technology thought leadership to the IT Department. HACLA plans to work with the Service Provider during the agreement development phase to finalize performance measures for all Cross-Functional Services. HACLA seeks proposals from the Service Providers that discuss the performance measures that may apply for Cross-Functional Services based on industry best practices.


16

6.1.1.OperationalStandardsandLeadingPractices HACLA requires the Service Provider to deliver IT Services that are aligned with Information Technology Infrastructure Library (ITIL) as the nomenclature basis, IT Service Management (ITSM) as the service management basis, COBIT 5 as the basis for governance and management, Project Management Body of Knowledge (PMBOK) as the basis for project and program management, and Six Sigma as the continuous improvement basis, or any industry accepted substitute. Further, the Service Provider shall endeavor to leverage leading practices for service management, reporting, technology infrastructure optimization and staff management to establish a highly efficient and cost-effective IT support model for HACLA. 6.1.2.ProjectManagementServices The role of the HACLA-wide Enterprise Project Management Office (PMO) is to: improve capabilities to deliver projects; establish a governance structure for Portfolio and Project management that provides the proper mechanisms to define and execute on project priorities; promote a closer collaboration between all departments to advance HACLA-wide and Departmental objectives in a cohesive and transparent manner that leverages the interdependencies between departments, technologies, and strategic directions to promote a more integrated approach to our technology related investments. Specific services the PMO provides in order to meet objectives include:

Develop and implement a “Best Practices” Project Management Methodology / Framework that is “right sized” for the HACLA

Provide and implement a central repository & project management applications/tool-set

Develop a consistent approach to planning and managing projects across all of HACLA

Establish and maintain a central PMO web site for use by all stakeholders Develop and maintain an Executive Dashboard Administer the repository & tools application system Provide training to appropriate staff (e.g. Portfolio Management, Project

Management) Coach and mentor individuals Foster an environment of collaboration and education to bring about a Project

Management Behavioral change management to promote Project Management as a core

competency Continually build project management maturity at the organizational level Establish and implement project performance metrics Maintain the portfolio & projects repository Monitor project portfolios and programs Provide reports to HACLA Management (e.g. status, budget, schedule, ROI,

training results)


17

Be the resident advocate for a formal Project Management discipline. Manage projects on an “as-needed” basis Research latest developments in Project Management and convey to

stakeholders A suitable database repository, application software, and automated tools shall

be implemented to support governance. System functionalities to be deployed will include:

o Demand Management – project demand tracking and approval process automation,

o Portfolio Management – project initiation, prioritization, and selection, o Project Management – individual (approved) project execution and

delivery, o Resource Management – allocation of resources across projects, time

management and o Financial Management – optimization of the utilization of funds across

projects. 6.1.3.Architecture,EngineeringandDesignServices: Where applicable, the Service Provider shall perform architecture, engineering and design services related to technical infrastructure, tools and utilities, security etc. to support new and enhanced applications, architectures and standards at HACLA. Such services should be aimed at optimizing HACLA IT environment, cost effective utilization of existing infrastructure and enabling a highly efficient IT infrastructure and applications environment. HACLA expects the Service Provider to recommend best-fit solutions for HACLA’s needs and provide technology thought-leadership to HACLA IT Department. 6.1.4.ProjectServices As mentioned in previous sections, a key objective of HACLA is to ensure that the Service Provider progressively dedicate more effort and time of its resources towards project services by optimizing effort and time spent on operational activities. HACLA will initiate several short term or long term projects related to IT infrastructure and applications from time to time. The Service Provider shall utilize its resources providing Services to HACLA and shall own, manage and perform such project services. 6.1.5.SecurityandDisasterRecovery Security services are the activities associated with maintaining physical and logical security of all IT Infrastructure and applications components and data, virus protection, access protection and other Security Services in compliance with HACLA security requirements and all applicable regulatory requirements. Disaster recovery includes creating a plan to ensure that continuity is established for critical systems and applications and restore times are minimized and implementing the plan for critical systems and applications.


18

6.1.6.ChangeManagement Change management is associated with the use of standardized methods and procedures for efficient and prompt handling of all changes to controlled IT systems, in order to minimize the number and impact of any related incidents upon service. The Service Provider shall ensure that industry standard change management procedures and processes are implemented at HACLA. 6.1.7.ThirdPartyCoordination The Service Provider shall coordinate with third party providers, vendors and other agencies to manage any support or warranty requirements for supported systems and applications. The Service Provider shall negotiate with third party providers, vendors and other agencies on HACLA’s behalf for select services and products or support HACLA in such procurement related activities. All support or warranty agreements shall be properly logged and tracked to ensure proper coverage at all times. 6.1.8.Documentation Maintaining up-to-date documentation of systems, policies and procedures is a critical requirement for HACLA. The Service Provider shall develop such documentation including service catalog and Policies and Procedures Manual. The Service Provider shall ensure that the documentation is updated on a regular basis and provide such updated documentation to HACLA. 6.1.9Cross‐Functional(ServicesManagement)RolesandResponsibilities Please see Appendix 7 “Cross-Functional (Services Management) Roles and Responsibilities” (Section 1.1 – 1.5) 6.2.ENDUSERSERVICESServiceTower End User Services are those services and activities that apply to the provision, delivery and management of Helpdesk Services and Desktop Services 6.2.1.HelpdeskServices Helpdesk Services are the services and activities required to coordinate and respond to incidents and service requests made by HACLA end-users and technical staff. The Service Provider shall setup a Helpdesk that acts as the single point of contact for resolution and escalation of all incidents and service requests related to IT infrastructure, system software and office productivity software, application software, password resets, etc.


19

More clearly, the Service Provider is required to provide the following services as part of Helpdesk Services:

Level 1 support: The Helpdesk provided by the Service Provider shall function as the first point of contact for all incidents, queries and service requests for HACLA’s technical staff and end-users. As the primary interface for HACLA’s users, the Helpdesk shall attempt to resolve user issues and increase first call resolution.

Implement multiple support models: In addition to user interaction through telephone, other support mediums including web, self-help, and email should be provided by the Helpdesk.

Incident and service request management: The Service Provider shall establish a Helpdesk that seamlessly integrates with other support functions and groups. This end-to-end process includes escalation to Level 2 and Level 3 specialists through a defined process, including Service Provider’s primary resources, third parties, such as hardware and software suppliers, other third party service providers as well as HACLA’s technical staff. Helpdesk will have the responsibility to track, update status and close all queries, incidents, problems and service requests by coordinating with other support groups and the respective HACLA end-user, as needed.

Account administration: Helpdesk shall coordinate end-user account administration, activation, changes and terminations, including password/account setup, e-mail accounts, voicemails etc.

Trending and reporting: Helpdesk shall function as the central resource to create reporting format and generate reports for monitoring performance and provide trend analysis of incidents and problems to proactively recommend solutions.

Root-cause analysis: Helpdesk should research Priority 1 and Priority 2 tickets and perform root cause analysis in coordination with other support groups and recommend solutions.

User satisfaction survey management: Helpdesk will have responsibility to administer, analyze and report user satisfaction survey results based on HACLA’s requirements.

HACLA seeks proposals that may improve current support model and additional service levels that may apply for this service area based on industry best practices.

Minimum Service Levels:

Helpdesk hours: 7.30 am to 5.30 pm, Monday-Friday, excluding holidays On-call support after business hours, weekends and holidays for critical tickets. Priority levels:

o Urgent – Problem affecting entire HACLA or single department Response time - within 1 hour Completion time – within 4 hours

o High – Problem with no known workaround that affects a single user Response time - within 2 hours Completion time – within 1 business day


20

o Medium – General request or problem with a workaround solution Response time - within 8 hours Completion time – within 2 business days

o Low – Request that does not require immediate attention or involves planning or coordination Response time - within 1 business day Completion time – as scheduled with customer

The service request measures that apply for Helpdesk services shall include: o First call resolution – 90% o Call abandonment rate – less than 5% o Call answer time – 95% within 60 seconds o Email response time – within 1 hour o Password reset time – 90% within one hour

Annual user satisfaction survey HACLA will work with the Service Provider during the agreement development

phase to finalize target service levels for Helpdesk services.

6.2.2.DesktopServices Desktop Services are the services and activities required to provide and support HACLA’s desktop computing infrastructure and personal productivity devices (e.g. Laptops, smart phones, etc.). The Service Provider should provide and support HACLA’s desktop environment that includes:

Desktop devices and associated system software Laptops/notebooks and associated system software Mobile devices and associates system software (e.g. OS, apps, etc.) HACLA owned personal productivity devices and associated system software Software that are part of standard desktop image business productivity software

and HACLA applications The Service Provider shall provide the following services as part of Desktop Services.

Level 2 and Level 3 support including break-fix: On-Site technical support services are the activities associated with the provision, dispatch, and management of Level 2 and Level 3 incident resolution services. The services include onsite troubleshooting, diagnosis, and resolution of incidents for Desktop devices and components. Onsite technical support resources are required to co-ordinate with Help desk and all other necessary third party and internal support organizations to manage all onsite technical support requests to resolution and closure.

Installs, Moves, Adds and Changes (IMAC): Perform IMAC services that include providing routine installations, relocations and upgrades of Desktop devices and components and associated software. Scheduling, configuring, testing and image backup, data migration and associated activities shall be performed as part of IMAC responsibilities.


21

Hardware refresh, replacement and warranty management services: Service Provider responsibilities include the following:

o Provide implementation services to support HACLA’s desktop devices refresh plan

o Coordinate with third-party suppliers to resolve hardware problems o Obtain, provide, and install parts for hardware and confirm functionality o Conduct performance and functional testing on replacement hardware o Manage spare parts inventory

VIP support: All Desktop support requirements directly or indirectly impacting the named VIPs of HACLA should be performed by the Service Provider on high priority per the VIP service levels required by HACLA.

Remote control: To establish a highly efficient support model for Desktop devices, the Service Provider shall provide support using remote control wherever possible.

Desktop engineering: The Service Provider shall perform desktop engineering services including desktop image build and support. Such services include development, testing, deployment and support of standard HACLA-specified images complying with policies and specifications. The activities include development, deployment, testing and support of operating system software, security software, office productivity software and messaging/email software among others.

Application software and operating system installation and upgrades: Service Providers shall notify availability, test and install new releases, upgrades and patches to application software and operating systems used on Desktop devices.

Software support: Service provider shall conduct performance and functional testing of supported software, troubleshoot and resolve all supported software problems in accordance with industry standard incident management procedures.

Hardware and software procurement and installation: Service Provider shall schedule, configure, test, install, de-install and provide initial orientation for HACLA end users of procured hardware and software.

Desktop security administration: Service Provider shall have complete responsibility to manage a secure desktop environment at HACLA. Proactive monitoring of security issues, implementing security plans and standards, implement security requests, recommending security solutions and providing virus protection to desktop environment are some of the responsibilities.

Output device support: Provide Level 1 support for printers, copiers, scanners, multi-function devices, etc., and coordinate with third party support providers.



Helpdesk hours: 7.30 am to 5.30 pm, Monday-Friday, excluding holidays. On-call support after business hours, weekends and holidays for critical tickets.


22

The service level measures that apply for Desktop support services include: o IMAC Response and resolution time – based on priority o VIP support – Response Time within 1 hour, resolution based on priority o Break/fix efficiency – 90% within 2 business days for those that do not

require equipment purchases Annual user satisfaction survey HACLA will work with the Service Provider during the agreement development

phase to finalize target service levels for Desktop services. 6.2.3.End‐UserServicesRolesandResponsibilities Please see Appendix 8 “End-User Services Roles and Responsibilities” 6.3.INFRASTRUCTURESERVICESServiceTower Infrastructure Services are those services and activities that apply to the provision, support and management of Data Center Services and Network Services to HACLA. 6.3.1.DataCenterServices Data Center Services are the services and activities required to provide and support HACLA’s centralized production, quality assurance, and development computing environments. In detail, the Service Provider should provide and support HACLA’s Data Center environment that includes UNIX and Wintel servers, virtual servers and disk and tape storage hardware. The Service Provider shall provide the following services as part of Data Center Services:

System monitoring and administration: The Service Provider shall perform proactive monitoring, administration, maintenance and troubleshooting support for systems in the Data Center environment to limit outages, identify and report application problems, resolve system or application problems to meet required service levels, perform server and peripheral IMAC services and recommend and implement server management automation improvements

System software and database support: The Service Provider shall perform system software updates and management of the system software updates on all servers, perform operating system and application level accounting, troubleshoot by performing specific system tuning tasks for system software and database performance issues

Storage and backup: The Service Provider shall monitor and control storage performance, maintain and improve storage resource efficiency and space requirements, maintain data set placement and manage data catalogs, perform data backups and restores, manage file transfers, and provide recommendations for improvements in data backup processes. The Service Provider should


23

manage the disk and tape storage environment through proactive monitoring, maintenance activities, performance tuning, planning, and optimization activities.

System procurement and installation: Service Provider shall schedule, configure, test, install and de-install systems as required in HACLA Data Center

Virtualization: Provide engineering and implementation services for server virtualization and consolidation efforts.

Job scheduling and management: The Service Provider shall perform production control and batch job schedule management, provide scheduling tools for managing/automating job execution, maintain database of job scheduling, contact, rerun and interdependencies, monitor and validate progress of scheduled jobs and resolve issues in scheduling process.

Hardware and software warranty management: The Service Provider shall coordinate on behalf of HACLA for warranty or maintenance management for supported systems.

Data Center security administration: Service Provider shall have complete responsibility to manage a secure Data Center environment at HACLA. Proactive monitoring of security issues, implementing security plans and standards, administer security database, implement security requests, recommending security solutions and providing virus protection to systems in the Data Center environment are some of the responsibilities.

Facilities support: Coordinate with third party support providers for systems like HVAC, UPS, fire suppression, stand-by generator, security access control etc. for troubleshooting, break-fix, testing, maintenance and upgrades.



Helpdesk hours: 7.30 am to 5.30 pm, Monday-Friday, excluding holidays. On-call support after business hours, weekends and holidays for critical tickets. 24 x 7 system monitoring Service level measures that apply for Data Center Services include:

o Individual server availability – 99.5% o Data backup and restore efficiency – 100% o System administration efficiency – 100%

HACLA will work with the Service Provider during the agreement development phase to finalize target service levels for Data Center Services.

6.3.1.1DataCenterServicesRolesandResponsibilities Please see Appendix 9 “Data Center Services Roles and Responsibilities” 6.3.2.NetworkServices


24

Network Services are the services and activities required to provide and support HACLA’s Data network infrastructure. The Service Provider shall provide the following services as part of Network Services.

Network device monitoring and management: The Service Provider shall perform proactive monitoring of network and network devices, troubleshooting, network and network device Incident resolution and management. The Service Provider will have responsibility to coordinate with third party providers for provisioning and incident management as required.

Circuit and fiber network support: The Service Provider shall isolate problems to device level, coordinate with Third party providers to address issues, track progress, notify and escalate as required

Network management, engineering, and administration: The Service Provider shall perform network architecture and engineering tasks, configuration management and control, manage user account access, IP address management (DNS, DHCP, static) administration, patch management (testing, deployment and post-deployment testing), load balancing, packet/traffic analysis etc.

Network security: The Service Provider shall provision and support methods that provide security to physical and logical devices connected to the network. Security services include, but are not limited to firewall, intrusion detection, penetration/vulnerability testing, incident management and audit services.

Network monitoring and planning: The Service Provider shall analyze network utilization, recommend optimization opportunities and provide proactive inputs and alerts based on trend information

Network device procurement and installation: Service Provider shall specify, schedule, configure, test, install and de-install network devices as required

Cabling: Troubleshoot and manage the cabling infrastructure for current and new infrastructure, including cabling racks, cabling drops and distribution frames.

Manage HACLA’s wireless infrastructure and devices. This includes managing and installing access points at various HACLA locations.



Helpdesk hours: 7.30 am to 5.30 pm, Monday-Friday, excluding holidays On-call support after business hours, weekends and holidays for critical tickets. 24 x 7 system monitoring Service level measures that apply for Network Services include:

o Network availability – 99.9% o Network device availability – 99.9% o Network response time – 95% of transactions within 10 seconds o Network security (Response Efficiency, Firewall management etc) – 100%


25

o Network administration efficiency (Account creation and deletion, Patches, upgrades and new releases notification and implementation) – 100%

HACLA will work with the Service Provider during the agreement development phase to finalize target service levels for Network Services.

6.3.2.1NetworkServicesRolesandResponsibilities Please see Appendix 10 “Network Services Roles and Responsibilities”

6.4.APPLICATIONSandWEBSERVICESServiceTower Application Services are those services and activities that apply to the maintenance, support and management of HACLA IT applications and websites. 6.4.1.ApplicationMaintenanceServices Application Maintenance Services are the services and activities required to provide and support HACLA’s databases and business applications. The Service Provider shall provide the following services as part of Application Maintenance Services.

Application monitoring and maintenance: The Service Provider shall perform proactive monitoring and execute preventive, corrective, emergency and adaptive maintenance of all HACLA applications. The Service Provider shall perform incident, problem, change and release management responsibilities for all HACLA applications.

Application administration services: The Service Provider shall maintain and perform application administration procedures and execute processes for the proper maintenance and functioning such as load balancing, tuning and configuration management.

Database administration: The Service Provider shall provide activities associated with the management, maintenance and support of databases including:

o Database performance monitoring o Data recovery and integrity o Database creation, configuration, testing, upgrades, patches and refresh o Database system level changes and schema changes o Security administration o Problem resolution o Storage management

User profile management Applications Security Administration: Service Provider shall have complete

responsibility to manage a secure applications environment including: o Proactive monitoring of security issues o Implementing security plans and standards, access control o Recommending security solutions o Providing virus protection


26

Portfolio management and rationalization: The Service Provider shall maintain the applications portfolio with a view to identify opportunities to achieve ongoing applications rationalization

Service Provider shall provide third-party coordination and escalation services. HACLA seeks proposals that may improve current support model and additional

service levels that may apply for this service area based on industry best practices.


Application Maintenance Services hours: 7.30 am to 5.30 pm, Monday-Friday. On call support after business hours, weekends and holidays for critical tickets. Service level measures that apply for Application Management Services include:

o Application availability – 99.8% o Database administration efficiency – 100%

HACLA will work with the Service Provider during the agreement development phase to finalize target service levels for Applications Services.

6.4.2.WebServices The Web Services team is responsible for HACLA’s web presence and supports all web efforts for HACLA (internet and intranet). The team will integrate existing applications, streamline processes, and leverage the latest web technologies to benefit the organization. The team will be responsible for all web related operational, maintenance, and development functions within HACLA. The team will develop project requirements, analyses, and feasibility assessments; identify options, evaluate and propose technology solutions and cost/effort for web projects. Projects that require additional resources will be sourced on an as-needed basis. In addition the team will provide management and coordination of department specific web projects as well as coordinating the efforts multi department or enterprise web initiatives. The web team will need the following skill sets: PHP, ASP.NET/ASP, ADO.NET, SQL, XML, XSLT, AJAX, XHTML, IIS 6/7, JavaScript, CSS, Visual Studio, SharePoint Server 2007/2010, Dreamweaver, Photoshop/Fireworks, Flash, InDesign 6.5.ACCOUNTMANAGEMENTSERVICESServiceTower Account Management Services are those services and activities that apply to the overall management of all services provided by the Service Provider to HACLA. HACLA expects the Service Provider to actively analyze and manage their service delivery performance, utilization, governance, and relationships with HACLA IT and departments, to drive to higher accountability and continuous improvement of outcomes.


27

6.5.1.DepartmentalCoordination The Service Provider shall establish as a trusted source and subject matter expert for technology service related requirements of various HACLA departments. The Service Provider shall support the IT Department in working with other departments and proactively providing best solutions and recommendations. The Service Provider should establish a robust communication and coordination model with departments and report progress, priorities and initiatives on a regular basis. 6.5.2.ServiceDeliveryManagement The Service Provider shall manage all aspects of service delivery, manage the team providing services to HACLA, efficiently communicate with HACLA IT technical team, provide technical thought leadership to HACLA and work very closely with HACLA IT technical team to ensure that services are performed to the expected standards. Other responsibilities include providing timely and up-to-date reports, ensure highest level of user satisfaction, work with all key departmental stakeholders offering high quality service and technology thought leadership, and manage performance, availability and training for Service Provider staff. 6.5.3.Governance The Service Provider should ensure that proper governance mechanism that covers financial, contract, performance, human resources and relationship is instituted and governance roles and responsibilities are clearly identified. The Service Provider should involve the required stakeholders from HACLA and hold regular governance meetings to ensure seamless communication. 6.5.4.PerformanceManagement The Service Provider shall manage the performance of account personnel and services and continually seek opportunities to enhance and improve performance. The Service Provider shall implement measurement and monitoring procedures that provides detailed reports to HACLA regarding the performance of the Services relative to the Service Levels and other mutually agreed reporting requirements for each service area. The Service Provider shall provide HACLA with access to the data used to calculate its performance against the Service Levels and the measurement and monitoring tools and procedures utilized by the Service Provider to generate such data for purposes of audit and verification. HACLA expects the Service Provider to accommodate HACLA management’s decisions on reporting formats, content, and frequency. 6.5.5.TimeandUtilizationManagementThe Service Provider shall manage the time and utilization of account personnel and services and continually seek opportunities to enhance and improve performance. The Service Provider should implement measurement and monitoring procedures that


28

provides detailed reports to HACLA regarding the time spent by each of its staff in providing services to HACLA. Such time reporting should facilitate an accurate assessment of utilization of Service Provider’s staff dedicated to HACLA.

6.5.6.RelationshipManagement Relationship Management Services are an essential component for successful contract management and ongoing HACLA - Service Provider relationship satisfaction. HACLA looks forward to a mutually beneficial relationship with Service Provider based on mutual trust and respect and excellent communication policies. HACLA expects the Service Provider to facilitate access to top management executives of the Service Provider as and when required. 6.5.7AccountManagementRolesandResponsibilities Please see Appendix 7 “Cross-Functional (Services Management) Roles and Responsibilities” (Section 1.6)

6.6ServiceLevelRequirements(SLRs)

6.6.1CommitmenttoComplyWithAllSLRs

During the transition phase, the Service Provider shall use commercially reasonable best efforts to perform all Services in accordance with, and in such a manner as to meet or exceed, the SLRs; provided, however, that in any event, the Service Provider shall perform the Services during such period in a manner that is at least as good as such services were being performed as of the Effective Date. At the end of the transition phase, the Service Provider shall perform all Services in such a manner as to meet or exceed the SLRs. The Provider shall comply with all SLRs set forth herein.

6.6.2MeasurementandReporting

The Service Provider shall measure its performance against the SLRs in accordance with the requirements of the Scope of Work. A detailed, comprehensive report of its performance against the SLRs on a monthly basis by the tenth (10th) Business Day of the following month. For continuing failures that occur in consecutive months, the Service Provider shall recommend remedial actions to resolve any performance deficiencies. All reporting on SLRs shall cover the results of SLR performance during the applicable period. In the case where one or more SLRs are not able to be validated or provide reasonable insight into the Service Provider’s performance, the HACLA and the Service Provider will negotiate in good faith to establish meaningful SLR(s) to replace such SLR(s).


29

6.6.3Root‐CauseAnalysisandResolution.

Promptly, but in no event later than five (5) calendar days after the Service Provider's failure to provide any of the Services in accordance with the SLRs, or for the existence of an Issue, the Service Provider shall, as applicable under the circumstances:

(i) perform a Root-Cause Analysis to identify the cause of such failure/Issue; (ii) provide the Organization with a written report detailing the cause of, and

procedure for correcting those failures/Issues that are under the Provider's control; and

(iii) provide HACLA with satisfactory evidence that the Service Provider has taken or will take commercially reasonable remedial steps to ensure that such failure/Issue will not recur to the extent under the Service Provider's control.

(iv) the correction of any such failures/Issues shall be performed in accordance with mutually agreed time frames and entirely at the Service Provider's expense unless it has been mutually determined through the Issue-resolution process that the HACLA (or one of its subcontractors, agents or Third Parties provided by the HACLA) was a direct contributing cause of the failure/Issue and the Service Provider could not have worked around the failure/Issue without expending more than commercially reasonable efforts.

(v) To the extent the cause of failures/Issues are not under the Service Provider's control, then the Service Provider will suggest appropriate corrective measures to the extent commercially reasonable.

6.6.4ImprovementandReviewofSLRs.It is expected that the SLRs will change over time and that new SLRs may be added to reflect improvements in technology, HACLA's changing and/or new business requirements. An annual review of all SLRs shall be conducted and this may lead to the following: (i) adjustments to the SLRs to reflect such anticipated continuous improvements in the SLRs; and/or (ii) the addition of new SLRs.

6.6.5PenaltiesandEarn‐Back

In the event that SLRs are not fully met during a reporting period, the monthly at-risk amount shall be fifteen percent (15%) of the applicable month’s monthly invoice amount. The Service Provider will have the opportunity to earn-back the penalty imposed using a negotiated schedule that will allow almost complete recovery of fees during the following periods provided SLRs are fully met.

7.SCOPEOFSERVICES:IN‐FLIGHTPROJECTS HACLA has several in-flight capital projects that are in various stages of the project lifecycle. These infrastructure improvements are fundamental to our core IT foundation and are an important part of our continuous strategy to transform HACLA’s IT capabilities. HACLA desires to have the majority of the required effort for these projects completed by the Service Provider utilizing account team personnel. However, we also recognize that without more detailed sizing and scope information, the ability to


30

determine required effort will be more difficult. See Section 10: Operating Model and Pricing Guidelines. HACLA shall provide more information about the in-flight projects during the RFP process.

In‐FlightProject‐1

Name SAN Refresh

Description A new SAN solution is scheduled to be procured in 4Q 2015

Current Status Proposals have been received and are under review.

Planned Completion 2st Quarter 2016

8.SCOPEOFSERVICE:ADDITIONALOROPTIONALSERVICES The scope of services listed in this section is for additional or optional requirements that may be required for short or long term on-demand or future requirements of HACLA. The information provided in this section may not be comprehensive or accurate and HACLA is indicating these requirements to give the Service Provider details of additional services that may be provided.

8.1.TelecomandVoiceSupportServices The Service Provider shall manage all HACLA networks managing the voice network and telephony system. Service Provider will provide monitoring and management along with onsite desktop/field services support for voice network and telephony systems. The Service Provider shall:

Use automated tools and processes to proactively monitor, manage and report health of supported telephony equipment,

Manage (including installation, test, configuration, administration etc.) supported telephony equipment,

Plan, schedule and notify about software changes and upgrades. Test and install all the patches. Monitor, control and manage any failures arising due to patches. Monitor HACLA’s telecom performance and availability, and provide ongoing

recommendations for telecom performance optimization, Service Provider will work with telecom providers to resolve any performance or

operational issues. Schedule and perform telephony maintenance. Perform telecom Incident Management services through Level 2, Level 3 and

Level 4 support for HACLA’s telephony services. Review, recommend and execute requests for change in IP infrastructure.


31

Perform telecom capacity planning by providing various reports on telephony traffic and optimization requirements.

Perform configuration management and configuration control services. Provide telephony performance reports Perform backup and recovery and document test results. Manage telecom security. Develop, update and maintain telephony documentation for end users, and Develop, update and maintain telephony diagrams and configuration templates

for HACLA 8.2.SurveillanceCamerasSupport The Service Provider shall maintain all surveillance cameras and related equipment at HACLA office facilities:

Perform an assessment of the camera system(s) and equipment (within 30 days of contract execution) and report deficiencies that need to be addressed to make the system 100% operational before support begins.

Inventory and document existing camera system(s), equipment, design and specifications.

Perform four (4) onsite preventative maintenance checks per year. Coordinate with third party vendors, as needed to perform repairs and/or replace

equipment. Provide diagnostic and re-cabling services if necessary to maintain the

functionality of the cameras and related equipment. Provide onsite problem response time of 1 hour.

8.3.ApplicationManagementServices–EmphasysElite Elite is the business application used by HACLA’s Section 8 Department. The application is maintained by a combination of Xerox staff, HACLA staff, and Emphasys’ technical support. The Elite environment consists of several components including SQL Server 2008, VMWare, Citrix, etc. The Service Provider shall support, manage and enhance the Elite environment. The resource provided by the Service Provider should have significant experience in applications business analyst role. The resource should have experience in gathering user requirements, producing formal business requirements and functional specifications and have strong understanding of relational database concepts. The key functions of the resource include the following:

Function as the subject matter expert on Elite Coordinate and support analysis and resolution of processing problems. Provide consulting support on processes and systems.


32

Analyze business requirements for all software application fixes, bugs/issues, and enhancements

Provide business process support - definition, implementation and training Define and document processes, formal business requirements and functional

specifications as required for program modifications / process enhancements Provide project leadership for implementation of new modifications or

enhancements to existing products Create test plans, test scenarios, and test scripts; document test results Coordinate requirements with software vendors and follow through system

testing and user acceptance testing (UAT) as well as the plan, design, implement & evaluate testing

Measure the success of product/service deployment in terms of usage, revenue and profitability.

Provide research and analysis for product/service recommendations that include descriptions of the service, processing considerations, expense and potential revenue analysis, benefits and risks

Work with the Section 8 Department to determine approach that best meets their requirements; assist in problem definition, analysis and design approach for projects and on-going maintenance

Verify application security design and test application security implementation; ensure application security meet government / industry regulations

Research product specifications, responsible for cost/benefit analysis Responsible for minor enhancements such as interfaces, reports, validation

routines, etc.

8.4.ApplicationManagementServices–ORACLEe‐BusinessSuite(EBS) EBS is the Enterprise Resource Planning system used by HACLA. The application is maintained by a combination of Xerox staff, HACLA staff, ad-hoc resources from the Applications Software Technology Corporation, and ORACLE’s technical support. The EBS environments consists of several components including Linux Servers and ORACLE’s Weblogic Middleware, etc. The Service Provider shall support, manage and enhance the ORACLE environment. The resource provided by the Service Provider should have significant experience in applications business analyst role. The resource should have experience in gathering user requirements, producing formal business requirements and functional specifications and have strong understanding of relational database concepts. The key functions of the resource include the following:

Function as the subject matter expert on ORACLE Coordinate and support analysis and resolution of processing problems. Provide consulting support on processes and systems.


33

Analyze business requirements for all software application fixes, bugs/issues, and enhancements

Provide business process support - definition, implementation and training Define and document processes, formal business requirements and functional

specifications as required for program modifications / process enhancements Provide project leadership for implementation of new modifications or

enhancements to existing products Create test plans, test scenarios, and test scripts; document test results Coordinate requirements with software vendors and follow through system

testing and user acceptance testing (UAT) as well as the plan, design, implement & evaluate testing

Measure the success of product/service deployment in terms of usage, revenue and profitability.

Provide research and analysis for product/service recommendations that include descriptions of the service, processing considerations, expense and potential revenue analysis, benefits and risks

Work with the Finance, Human Resources and General Services Departments to determine approach that best meets their requirements; assist in problem definition, analysis and design approach for projects and on-going maintenance

Verify application security design and test application security implementation; ensure application security meet government / industry regulations

Research product specifications, responsible for cost/benefit analysis Responsible for minor enhancements such as interfaces, reports, validation

routines, etc.


34

9.OPERATINGMODELANDPRICINGGUIDELINES

9.1.OperatingModelHACLA believes that an FTE based pricing model with primarily onsite resources may be an appropriate option for HACLA as it provides opportunity to track and manage service quality while offering the required flexibility to HACLA to define work-priority of resources. This model also ensures that any potential risk associated with end-user change issues is mitigated. The representation of the operating model is provided below.

Operational Services

• End user services, Infrastructure services, Applications Services (as described in Sections 6.2, 6.3 and 6.4) • Service location • Evaluate option for onsite staffing model with remote services • Evaluate options for shared services, on‐demand resources • Minor enhancements and optimization part of operational services

Strategic Services

• Cross‐functional services and Account management services (as described in Sections 6.1 and 6.5) • Service location: Onsite

Short‐term or

Specialized Resources

• Short term or specialized services to support projects • Pricing: Rate card for FTE (known roles) • Service location: Onsite/remote

Please note that HACLA seeks recommendations from Service Providers on alternate operating model and pricing structure, if the Service Provider believes that a different approach can better address HACLA’s IT outsourcing objectives, while addressing potential change issues for end-users (e.g. remote managed services, remote managed services & hosting, Infrastructure as a Service, Monitoring as a Service, etc.). 9.2.PricingGuidelines


35

In this section, HACLA intends to provide basic guidelines for Service Providers to present a detailed Pricing Proposal. Pricing Proposal shall be provided in Appendix 3 – Pricing Proposal Template. 9.2.1.OperationalServicesandStrategicServices The Service Provider is required to provide pricing information for managing all services listed in Section 6: Scope of Services, using the following guidelines

- Use “Operational and Strategic Services” sheet in Appendix 3 – Pricing Proposal Template

- Provide pricing per FTE for service that require onsite or offsite staffing - The FTE pricing should include all overhead, management, training, travel, space

cost, buffer staff, software tools used and any other long-term cost associated with providing the FTE

- If any services are proposed to be provided remotely or on-demand basis, please mention clearly and provide pricing information

- Some of the services that may fall into this category include remote monitoring, remote troubleshooting, on-demand DBA support, patch management and tape backup

- Mention any cost components excluded from pricing - List all assumptions used for pricing - Mention applicable volume discounts, if any - Mention any one-time costs

9.2.2.In‐flightProjects HACLA does not want to have unnecessary risk, staff, and/or cost included in the proposal to cover the unknown. As such, HACLA would like to offer the following guidelines and information when responding to the RFP with regards to the in-flight projects.

- The Service Provider will be responsible for completing the scope, solution architecture, project artifacts (i.e. WBS, project plan, resource plan etc.), and for managing the projects.

- HACLA will help the Service Provider to determine project priorities and timelines based on HACLA objectives, availability of Service Provider account resources, etc. to ensure projects and operational responsibilities can be managed appropriately.

- Funding is available for these projects for Hardware, Software, specialty consulting, and in several instances for installation services as required.

- HACLA’s objective is to partner with our Service Provider to ensure effective and efficient management of projects along with our operational duties by leveraging the Service Provider’s account resources.

- HACLA will be flexible as needed in order achieve our goals of continuous improvements at a sustainable and relatively fixed cost basis. This flexibility will be available in a number of ways, such as: Adjusting project schedules to allow


36

for account resources to balance project and operational needs, relaxing Service Levels for a period of time and/or providing for “carve-out” for missed tickets based on project/operational conflicts, and/or bringing on limited resources on short-term basis when other alternatives are not available/desirable to HACLA.

- The structure to manage in-flight projects will be further optimized / developed during the RFP process.

Pricing guideline

- Use “In-flight Projects” sheet in Appendix 3 – Pricing Proposal Template - Provide estimate of number of additional resources with skill set and experience

information that may be required to complete the projects mentioned in Section 7: In-flight Projects

- Provide estimated duration for additional resources that may be required - List all of your assumptions, by project, that led to your optimal model to manage

the in-flight projects

9.2.3.AdditionalorOptionalServices HACLA would like to offer the following guidelines and information when responding to the RFP with regards to Additional or Optional Services

- Use “Additional or Optional Services” sheet in Appendix 3 – Pricing Proposal Template

- Provide pricing per FTE for service that require onsite staffing - The FTE pricing should include all overhead, management, training, travel, space

cost, buffer staff, software tools used and any other long-term cost associated with providing the FTE

- If any services are proposed to be provided remotely or on-demand basis, please mention clearly and provide pricing information

- Some of the services that may fall into this category include remote monitoring, remote troubleshooting, on-demand DBA support, patch management and tape backup

- Mention any cost components excluded from pricing - List all assumptions used for pricing - Mention applicable volume discounts, if any - Mention any one-time costs

9.2.4.ShortTermorSpecializedResources- Use “Rate Card” in Appendix 3 – Pricing Proposal Template - Mention hourly FTE rates for all skill sets and experience levels listed, for short

term (less than 3 months) requirement - Mention hourly FTE rates for all skill sets and experience levels listed, for long

term (more than 3 months) requirement


37

- The FTE pricing should include all overhead, management, training, travel, space cost, buffer staff, tools used and any other long-term cost associated with providing the FTE

- Mention all cost components included in pricing - Mention all cost components excluded from pricing - Mention one-time costs, recurring costs - Mention all cost components included in pricing - Mention all cost components excluded from pricing

10.TRANSITIONANDCRITICALMILESTONES10.1.TransitionPlan HACLA anticipates transition period to last two to three months from the Effective Date of the Agreement. During the transition period, the Service Provider shall fully understand the technology landscape of HACLA, establish systems, tools and processes necessary to provide Services, allocation staff resources and ensure that smooth and complete transition happens. The Service Provider shall prepare a detailed transition plan that lists

- All key activities and tasks required to transition each specific service area, Transition milestones,

- Plan to transition any Third Party agreements or service relationships of HACLA, and

- Transition governance model and plan. All information required to develop a detailed transition plan shall be collected by the Service Provider during the reverse due-diligence phase. 10.2.TransitionMilestones The key transition milestones are listed below. 10.2.1.PoliciesandProceduresmanual During the transition phase, the Service Provider shall develop a Policies and Procedures manual for in-scope services. The manual shall describe the manner in which Service Provider will provide the different services, including the equipment and software being used, the documentation (including, e.g., operations manuals, user guides and specifications) that provide further details of such activities and detailed problem, change management and request management procedures. The manual also shall describe the activities the Service Provider will undertake in order to provide the Services including, direction, supervision, monitoring, staffing, quality assurance, reporting, planning and oversight activities, as well as the specific measures taken to comply with all applicable laws and regulations.


38

The Policies and Procedures manual shall be developed during the transition phase and the Service Provider shall maintain an updated manual throughout the term of the agreement. 10.2.2.ITServiceCatalog As part of transition, the Service Provider shall develop a detailed IT service catalog which details services offered including all service options, installation timeframes, order process (new, change & remove service) and prerequisites 10.2.3.ITILContinuationPlan HACLA expects the Service Provider to perform services adhering to ITIL standards and best practices. The Service Provider shall create an outline of ITIL continuation plan during the transition period. Within six months from the Effective Date of the Agreement, the Service Provider shall develop a complete plan and approach for continuing and maturing ITIL standards and present it to HACLA IT Department for approval. Upon approval by HACLA IT Department, the Service Provider shall start ITIL continuation process and complete within six (6) months of the Effective Date. 10.2.4.ApplicationandInfrastructureOptimization/Rationalization HACLA expects the Service Provider to perform analysis on HACLA-wide applications and infrastructure portfolio leading to recommendations pertaining to cost reductions and improved support models. Although such recommendations should be provided throughout the term of the contract, HACLA expects a formalized report and recommendations within nine months of contract Effective Date.

11.Appendices

APPENDIX 1 – FORMAT FOR RFP QUESTIONS APPENDIX 2 – TECHNICAL PROPOSAL TEMPLATE APPENDIX 3 – PRICING PROPOSAL TEMPLATE APPENDIX 4 – APPLICATIONS INVENTORY APPENDIX 5 – DATA CENTER APPENDIX 6 – HACLA NETWORK APPENDIX 6.1 – HACLA NETWORK DIAGRAM APPENDIX 7 – CROSS-FUNCTIONAL (SERVICES MANAGEMENT) ROLES

AND RESPONSIBILITIES APPENDIX 8 – END-USER SERVICES ROLES AND RESPONSIBILITIES APPENDIX 9 – DATA CENTER SERVICES ROLES AND RESPONSIBILITIES APPENDIX 10 – NETWORK SERVICES ROLES AND RESPONSIBILITIES


39

Appendix 1

Format for RFP Questions

Appendix 1 - Format for RFP Questions - 10.20.2015 Page 2 of 2

Any queries that service providers have on the RFP are to be consolidated and forwarded by email to Swan Lam ([email protected]) in the format provided below:

Vendor Name:

# Document Section # Page # Question 1 2 3 4 5 6 7 8 9 n

1

Appendix 2

Technical Proposal Template

TABLE OF CONTENTS

1. INTRODUCTION .............................................................................................................................. 2

2. INFORMATION TECHNOLOGY DEPARTMENT ..................................................................... 2

3. IT OUTSOURCING OBJECTIVES ................................................................................................. 3

4. SCOPE OF SERVICES ..................................................................................................................... 3

5. SCOPE OF SERVICES – IN-FLIGHT PROJECTS ....................................................................... 7

6. SCOPE OF SERVICES – ADDITIONAL OR OPTIONAL SERVICES ...................................... 8

7. OPERATING MODEL AND PRICING GUIDELINES ................................................................ 8

8. TRANSITION AND MILESTONES ................................................................................................ 9

9. GENERAL QUESTIONS .................................................................................................................. 9

2

1. INTRODUCTION This document is the Technical Proposal Template that Provider must use to provide the technical solution to HACLA’ requirements. It organizes the requirements contained in the RFP Exhibit A - Scope of Work into a structured format to ensure that the Service Provider can easily identify all areas requiring responses.

The Service Provider should not modify general formatting, page headers or footers but may insert graphics or diagrams if they can better communicate responses in a section. Within a section, the Service Provider may add section headings or titles to organize the response.

Note that unless requested, it is not appropriate to provide generic presentations, references to content on websites, general marketing materials, or other similar items as your primary response. Questions must be answered fully and in the requested response format.

This document is a basic template for RFP response submittal. This document should not be treated as final and the Service Provider should ensure that it has submitted responses to the RFP questions and/or affirmations to the terms and conditions as laid down in the RFP Exhibit A - Scope of Work.

The Service Provider may also attach separate documents and reference the documents under the relevant sections.

References to sections in RFP Exhibit A - Scope of Work are provided to make it easier to respond to specific questions. However, the Provider should ensure that the response takes into consideration all requirements specified in the RFP Exhibit A - Scope of Work.

2. INFORMATION TECHNOLOGY DEPARTMENT Reference: Section 3 of RFP Exhibit A - Scope of Work “INFORMATION TECHNOLOGY DEPARTMENT”

2.1 Reference: Section 3.2 of RFP Exhibit A - Scope of Work “IT Goals” - State your capabilities in addressing each of the following goals. Please provide at least

one brief case study from the local government vertical which highlights this capability. o Improve service delivery while reducing costs through innovation o Transformation via technology o IT alignment to business needs while promoting HACLA-wide view and

standards o Maximize ROI of information technology investments

2.2 Reference: Section 3.4 of RFP Exhibit A - Scope of Work “Internal IT organization” - State your capabilities in providing outsourcing services to clients that have a limited

internal staff? - What are the challenges that you typically face in such situations? What are the key

strategies that you adopt in such a scenario that enables you to provide exceptional service with limited oversight?

- Please provide at least one brief case study from the local government vertical which highlights this capability.

3

3. IT OUTSOURCING OBJECTIVES 3.1 Reference: Section 4 of RFP Exhibit A - Scope of Work “IT OUTSOURCING

OBJECTIVES AND SERVICE PROVIDER GUIDING PRINCIPLES” 3.1.1 What solution would you recommend and implement to ensure that IT Department

extends its support spectrum to other HACLA departments? 3.1.2 What are your capabilities and experience in providing IT support services to HACLA

departments? What are the key challenges you foresee and what are the measures to mitigate any potential risks? Please provide other relevant information that you may believe important to share with HACLA in this regard.

3.1.3 How would you ensure that the transformation goals of the IT department are driven

through your partnership with HACLA? 3.1.4 Please provide one brief case study from the local government vertical where you helped

the IT organization transform to a “provider of choice” status. 3.1.5 How would you ensure that HACLA is able to progressively reduce effort and cost on

operational activities and re-invest the savings for high value solutions through projects? 3.1.6 What are the best practices, tools, initiatives and solutions that you would leverage and

deploy at HACLA to ensure that operational costs are reduced year over year?

3.1.7 Describe your capabilities and maturity level of industry frameworks and standards such as ITIL, ITSM, COBIT 5, PMBOK and Six Sigma. Include how this incorporated

4. SCOPE OF SERVICES 4.1 Reference: Section 6 of RFP Exhibit A - Scope of Work “SCOPE OF SERVICES –

Service Towers” 4.1.1 Provide an overview of your integrated solution to support the current scope of services

for HACLA. In this overview, please include the following details o Organization structure of the team providing services to HACLA o Location of service provision clearly specifying services that might be remotely

provided o Roles and responsibilities of key personnel o Tools that you would deploy o Best practices that you would leverage from your organization’s centers of

excellence o Provide reporting to HACLA about performance and utilization o Governance model o Operating model o Other key characteristics of the solution

4.1.2 In the solution that is proposed, how would you ensure that the required flexibility is

provided to HACLA to manage resources? What constraints do you anticipate in providing the required flexibility to HACLA? What is the best approach to address these constraints?

4.1.3 Please provide a detailed case study where your organization implemented such a

solution and successfully delivered the desired benefits to the client. Please ensure that

4

the case study is for a local government client with similar size, requirements and operating model.

4.1.4 Does the proposed solution involve use of sub-contractors? If yes,

- What percentage of total resources would be sub-contractors? - What is the primary reason for you to use sub-contractors?

4.1.5 Please describe your experience as the primary IT Services Integrator. 4.2 Reference: Section 6.1 of RFP Exhibit A - Scope of Work “CROSS – FUNCTIONAL

SERVICES (Services Management)” 4.2.1 Reference Section 6.1.1 of RFP Exhibit A - Scope of Work “Operational Standards and

Leading Practices” - Describe how your organization will meet this requirement. Such plan should describe the

major tasks to be accomplished along with their respective time frames. 4.2.2 Reference Section 6.1.2 of RFP Exhibit A - Scope of Work” Project Management

Services” - Describe how your organization will meet this requirement. Such plan should describe the

major tasks to be accomplished along with their respective time frames. 4.2.3 Reference Section 6.1.3 of RFP Exhibit A - Scope of Work ”Architecture, Engineering and

Design Services” - Describe how your organization will meet this requirement. Such plan should describe the

major tasks to be accomplished along with their respective time frames. 4.2.4 Reference Section 6.1.4 of RFP Exhibit A - Scope of Work “Project Services”

- Describe how your organization will meet this requirement. Such plan should describe the major tasks to be accomplished along with their respective time frames.

4.2.5 Reference Section 6.1.5 of RFP Exhibit A - Scope of Work “Security and Disaster

Recovery” - Describe how your organization will meet this requirement. Such plan should describe the

major tasks to be accomplished along with their respective time frames. 4.2.6 Reference Section 6.1.6 of RFP Exhibit A - Scope of Work “Change Management”


4.2.7 Reference Section 6.1.7 of RFP Exhibit A - Scope of Work “Third Party Coordination”


4.2.8 Reference Section 6.1.8 of RFP Exhibit A - Scope of Work “Documentation”


4.2.9 Reference Section 6.1.9 of RFP Exhibit A - Scope of Work “Cross-Functional (Services Management) Roles and Responsibilities”

- Please address the distribution of roles and responsibilities, and note any differences in your proposed approach or any critical items that need to be highlighted.

4.2.10 What should be the success metric for all the services mentioned under this Section 6.1?

How would they be measured and reported?

5

4.3 Reference: Section 6.2 of RFP Exhibit A - Scope of Work “END USER SERVICES” 4.3.1 Reference Section 6.2.1 of RFP Exhibit A - Scope of Work “Helpdesk Services”

- Describe a solution or approach that outlines how your organization will provide this service. Please mention how HACLA can benefit from the solution and enhance the quality of service and reduce cost of operations

- Please provide details about the tools that you would deploy or leverage in providing this service.

- What are the different service level measures and targets that you propose for this service? Identify any pre-requisites for establishing these service levels and how you propose to address them?

- Mention any constraints or limitations in providing the services described in this section 4.3.2 Reference Section 6.2.2 of RFP Exhibit A - Scope of Work “Desktop Services”




- Mention any constraints or limitations in providing the services described in this section 4.3.3 Reference Section 6.2.3 of RFP Exhibit A - Scope of Work “End-User Services Roles and

Responsibilities” - Please address the distribution of roles and responsibilities, and note any differences in

your proposed approach or any critical items that need to be highlighted. 4.4 Reference: Section 6.3 of RFP Exhibit A - Scope of Work “INFRASTRUCTURE

SERVICES” 4.4.1 Reference Section 6.3.1 of RFP Exhibit A - Scope of Work “Data Center Services”




- Mention any constraints or limitations in providing the services described in this section - Explain

4.4.2 Reference Section 6.3.1.1 of RFP Exhibit A - Scope of Work “Data Center Services Roles and Responsibilities”


4.4.3 Reference Section 6.3.2 of RFP Exhibit A - Scope of Work “Network Services”


6



- Mention any constraints or limitations in providing the services described in this section

4.4.4 Reference Section 6.3.2.1 of RFP Exhibit A - Scope of Work “Network Services Roles and Responsibilities”


4.5 Reference: Section 6.4 of RFP Exhibit A - Scope of Work “APPLICATIONS and WEB

SERVICES” 4.5.1 Reference Section 6.4.1 of RFP Exhibit A - Scope of Work “Application Maintenance

Services” - Describe a solution or approach that outlines how your organization will provide this

service. Please mention how HACLA can benefit from the solution and enhance the quality of service and reduce cost of operations



- Mention any constraints or limitations in providing the services described in this section

4.5.2 Reference Section 6.4.2 of RFP Exhibit A - Scope of Work - Describe a solution or approach that outlines how your organization will provide this

service. Please mention how HACLA can benefit from the solution and enhance the quality of service and reduce cost of operations


- Please describe how performance will be measured and reported to HACLA. - Mention any constraints or limitations in providing the services described in this section

4.6 Reference: Section 6.5 of RFP Exhibit A - Scope of Work “ACCOUNT MANAGEMENT

SERVICES” 4.6.1 Reference Section 6.5.1 of RFP Exhibit A - Scope of Work “Departmental Coordination’

- Describe how your organization will meet this requirement. Please mention how HACLA can benefit from your capabilities and past experience in this area.

- Please share any key learning that you may have from other similar clients to best manage this requirement

4.6.2 Reference Section 6.5.2 of RFP Exhibit A - Scope of Work “Service Delivery

Management” - Describe how your organization will meet this requirement. Please mention how HACLA

can benefit from the solution and enhance the quality of service and reduce cost of operations


7

4.6.3 Reference Section 6.5.3 of RFP Exhibit A - Scope of Work “Governance” - Please provide the governance model that you would establish to manage this

outsourcing relationship. Please include details about stakeholders, roles and responsibilities, escalation model and other characteristics of the governance organization

- What governance tools would you use to support ongoing management of this outsourcing relationship?

- How would you enable access for HACLA stakeholders to your organization’s higher management team, if required?

4.6.4 Reference Section 6.5.4 of RFP Exhibit A - Scope of Work “Performance Management’

- Describe how your organization will meet this requirement. Please mention how HACLA can benefit from your approach and enhance the quality of service and reduce cost of operations

- What process would you follow to ensure that the resources providing services to HACLA remain motivated to deliver high performance?

- What measures would you take to remedy non-performance? - How would you ensure that HACLA’s feedback is incorporated while measuring

performance of your resources providing services to HACLA?

4.6.5 Reference Section 6.5.5 of RFP Exhibit A - Scope of Work “Time and Utilization Management”

- Describe how your organization will meet this requirement. - How would you ensure that resources are optimally utilized? - How would you ensure that time and efforts of resources are progressively increased for

project services? What productivity improvement measures do you propose to establish? - Describe how you would provide flexibility to HACLA to manage work priorities of

resources, as required. 4.6.6 Reference Section 6.5.6 of RFP Exhibit A - Scope of Work “’ Relationship Management

- Describe the relationship management model that you would establish and how HACLA can benefit?

4.6.7 Reference Section 6.5.7 of RFP Exhibit A - Scope of Work “Account Management Roles

and Responsibilities” - Please address the distribution of roles and responsibilities, and note any differences in

your proposed approach or any critical items that need to be highlighted. 4.6.8 What should be the success metric for all services mentioned under the Section 6.5?

How would they be measured and reported. 4.7 Reference: Section 6.6 of RFP Exhibit A - Scope of Work “Service Level Requirements

(SLRs)” - Provide how all areas under this section will be covered by the proposed solution - Outline any challenges typically encountered when meeting SLRs and how those are

addressed by your business philosophy, practices, procedures or protocols.

5. SCOPE OF SERVICES – IN-FLIGHT PROJECTS Reference: Section 7 of RFP Exhibit A - Scope of Work “IN-FLIGHT PROJECTS”

- Are you willing to take up ownership of these in-flight projects?

8

- If yes, please provide an estimate of the number of FTEs above and beyond your proposed account team that may be required to execute the in-flight projects mentioned in this section

- What are the assumptions that you took to arrive at the estimate? - How can HACLA ensure that most or all of the work for in-flight projects can be handled

by the resources providing related services to HACLA? - How would you ensure that HACLA receives the required flexibility to decide work

priorities of the resources?

6. SCOPE OF SERVICES – ADDITIONAL OR OPTIONAL SERVICES

Reference: Section 8.1 of RFP Exhibit A - Scope of Work “Telecom and Voice Support

Services”

- Are you willing to provide a solution for this requirement? - If yes, provide a proposal that outlines how your organization will provide this service to

meet requirements. Please mention how HACLA can benefit from the solution and enhance the quality of service and reduce cost of operations.

Reference: Section 8.2 of RFP Exhibit A - Scope of Work “Surveillance Cameras Support”



Reference: Section 8.3 of RFP Exhibit A - Scope of Work “Application Management

Services – Emphasys Elite”



Reference: Section 8.4 of RFP Exhibit A - Scope of Work “Application Management

Services – ORACLE e-Business Suite (EBS)”



7. OPERATING MODEL AND PRICING GUIDELINES Reference: Section 9.1 of RFP Exhibit A - Scope of Work “Operating Model”

- Please provide your comments/response to the operating model described in this section - If you propose a different model, please provide details of the operating model and

describe the benefits HACLA can derive by adopting the proposed model.

9

Reference: Section 9.2 of RFP Exhibit A - Scope of Work “Pricing Guidelines’

- Do you agree to provide pricing based on the provided guidelines?

8. TRANSITION AND MILESTONES Reference: Section 10.1 of RFP Exhibit A - Scope of Work “Transition Plan”

- Provide a detailed transition plan assuming that transition would start on January 16, 2016.

- Provide the structure of the team that would be involved in transition with detailed roles and responsibilities

- Describe end user communication plans, orientation and training that may be required. - How would you manage transition governance? Please provide detailed approach with

specific transition milestones and details of reports that will be provided to client during transition.

Reference: Section 10.2 of RFP Exhibit A - Scope of Work “Transition Milestones”

- Provide details of your approach to developing these deliverables and providing to HACLA during the transition period.

9. GENERAL QUESTIONS Reference: NONE

9.1 Human Resources information

- Describe your selection and replacement procedures for resources that will be providing the services as outlined in this RFP.

- State the annualized percent of turnover of personnel for the last fiscal year in the segment of your organization that shall be responsible for performing IT services for HACLA.

- How often is performance appraisals conducted in your company? How do you ensure that the feedback from the client is incorporated in the performance appraisal process?

- What is the average time that you would take to recruit and onboard a resource that provides non-specialized IT services (e.g. Desktop technician, Web developer, Network architect, Project manager)?

- What is the time that you would take to recruit and onboard a resource with specialized skill (e.g. GIS specialist/project manager, etc.)?

- How many weeks of vacation can your staff take per year? - How would you ensure that backfill is available for vacation time of a resource providing

services to HACLA? 9.2 Staff Transition

- In the case where the selected Service Provider(s) would take on IT Services currently covered by the current Service Provider, please explain your staff transition model and if there are procedures to keep key personnel.

ProjectONSITE or Remote FTE Type/Role Number of FTEs

ProjectONSITE or Remote FTE Type/Role Number of FTEs

Note:1. Please describe the volume discount you wish to offer2. This can be based on the run rate and/or cummulatve figure of bllings and/or FTEs

FTE Estimates for Additional or Optional Services:

Estimated FTE Requirement

Elite Support

Estimated FTE Requirement

ORACLE EBS Support

Assumptions (Please state in detail)

3. Please feel free to use any other basis or combinations

Appendix 3 - Pricing Proposal Template - 10.20.2015 Additional or Optional Services Page 1

1

APPLICATIONS INVENTORY

The table below provides general details about the applications environment at HACLA

S8=Section 8 FIN-Finance G S= General Services HR= Human Resources HS= Housing Services IT= Information Technology EX= Executive LOMOD= LOMOD

Type / Category

Application Name Summary Description Vendor

Platform (Operating System & Version)

Dept or Division Supported

Installed Version

Newest Release Version

Backup/Recovery Backup Exec Data backups Semantec Windows IT 14 15

Backup/Recovery

Exagrid Disk‐based backup system

Exagrid Windows

IT

Collaboration

Go‐to‐Meeting

On‐line technical collaboration Go To

Meeting Windows

IT

Collaboration

Skype Conferencing calls outside HACLA

Microsoft Windows

Various

Database SQL Database Management Microsoft Windows Various 2005, 2008, 2012, 2014

2014

Database Toad SQL maintenance Quest Windows IT 12 12.7

2

Type / Category




Installed Version


Desktop Adobe Pro Create PDF Documents Adobe Windows All 7 DC

Desktop MS Office Suite, Project, Publisher, Visio

Productivity Microsoft Windows All, Various

Document Management

OnBase Document imaging and workflow Hyland

Software Windows

S8, LOMOD

14 14

Document Management

Opus Hi density file storage tracking

Windows Various

Email Exchange Email Microsoft Windows All HACLA 2010 2013

ERP

ORACLE Enterprise Resource Planning (ERP) ‐ Finance, Human Resources and Procurement modules.

Oracle Linux

FIN, GS, HR

12.2.3

Financial

Spreadsheet Server

Oracle Adhoc reporting tool

Spreadsheet Server Windows

Finance

Financial

Union Bank Electronic Banking Interface

Union Bank

FIN, GS, HR

Forms Evergreen (Formscape)

Oracle Printing App Formscape Windows FIN, GS, HR RETIRED

3

Type / Category




Installed Version


Forms

Vivaform IT request forms for access authorization

Vivaform

All

FTP Cute FTP Automated FTP Software Windows Various 8 9

FTP Globalscape EFT

SecureFTP for DMZ GlobalScape Windows Various 6.2.7 7.1.3

GIS ArcGIS Desktop 10

GIS Mapping Application

Esri Windows

Planning

10

GIS

ArcGIS Web Address Mapping

Internet Location Mapping for LOMOD Properties

Esri Windows

LOMOD

Help Desk

Helpstar Ticket/Work Request Tracking Help Desk

Inc. Windows

IT

Housing AREA Rents Inspections – Rent Reasonableness

Area Windows S8 runs on Access 2003, no version #

runs on Access 2010

Housing

CCS Lib Tenant Management, Historical info

Emphasys Windows

FIN, HS, S8, IC

Housing

Elite Voucher/Owner/Client Management

Emphasys Windows

S8

193 MR5 193MR5

4

Type / Category




Installed Version


Housing

Elite Partner Portal

Elite Internet Portal

Emphasys Windows

S8

9 9

Housing Environmental Database

Track environmental/abatement issues

Windows HS No version #, custom

Housing Intergis Inspections Routing Telogis Windows S8 5.1 5.2

Housing

MFMS Multi‐Family Management System

MFMS Windows

LOMOD

14 14

Housing

Voyager (Yardi)

Property Management (public housing, affordable and market rate)

Yardi

HS, AGM

Human Resources

NEOGOV HR applicant management

NEOGOV Windows

HR

Human Resources

Vesting (online)

Property Ownership Vesting (online)

S8

Imaging

GHOST PC/Server Imaging

Semantec Windows

IT

Inventory Management

RFTrack RFID Inventory Application

Windows IT 5.1 6

Inventory Management

Wasp Inventory Wasp IT RETIRED

5

Type / Category




Installed Version


Office Automation

O365‐ MS Office 365

Document sharing with non‐HACLA

Microsoft Windows

Various

Office Automation

Priority Mailing Solutions (S8 Mailer)

Mail/Letter sorting application

S8 RETIRED

Remote Desktop

Citrix Xenapp Access to Elite and other apps Citrix Windows

S8

4.5, 6 7.6

Remote Desktop DPSS ‐ Leader Terminal

Remote Access to DPSS Information

Citrix Windows S8, HS Business partner owned

Reporting Crystal Reports

Report Writing SAP Windows

S8/HS 10 11

Reporting Milo Elite Reports Emphasys Windows S8 RETIRED

Security Alarmlock 1 or 2 locks at remote housing site

Windows HS 4.1.88 5.2.3

Security

Bosch security lock systems

Manage door lock systems for 2600 Wilshire

Bosch Windows

All

2.1.7.10c 2.1.9.0

Security

Bosch Video Management System

Manage Video Security System

Bosch Windows

General Services

4.5.5 5.5.5

Security Imperva WAF Web Application Firewall Imperva Windows All HACLA SecureSphere 10

SecureSphere 11.5

6

Type / Category




Installed Version


Security Juniper Firewalls

Firewalls for DMZ and OC Juniper Networks

Netscreen IT

6.2.0r5

6.3.0r19

Security LDC‐ Lumension Device Control

Manage removable devices for desktops

Lumension Windows IT 4.4 4.6

Security McAfee ePO Antivirus/anti‐malware McAfee Windows IT 4.6.2 5.5

Security OMNI LOCKS Office Physical Access Windows HR (Safety Dept.)

2.20 build 115

3.1

Security Palo Alto Proxy

Proxy Server for Internet Access

Palo Alto Networks

PAN OS IT 6 7

Security

PGP command line

Scripted automated encryption (DPSS, Oracle, etc.)

PGP command line

All

Security

PGP desktop encryption

Manual desktop encryption for certain staff

PGP desktop encryption

Various

10.3 10.3

Security RSA SecurID Remote Access RSA SecurID Appliance

All HACLA 7.1 8.1

Storage Scale SAN Storage Management for LA

Scale Scale All 2.4.2.8667 3.0.14.18639

7

Type / Category




Installed Version


System Active Directory

Manages all accounts and security access by group to apps and files

Microsoft Windows All 2008 2012 R2

System Directory Manager

Allows for update of phone, title, Dept, and other AD fields without being an administrator.

Windows IT, HR 5000 6320

System Lefthand SAN Storage Management Hewlett Packard

StoreVirtual IT 11.5 12.5

System Linux (Oracle version)

Oracle App Hosting Oracle Linux IT Oracle Linux 6 Oracle Linux 7

System LPM‐ Lumension Patch Management

Patch management for servers

Lumension Windows IT

8.2.0.88 8.3.0.263

System Network Advisor

Manage firmware and configs for network devices

Windows IT 12.4 12.4

8

Type / Category




Installed Version


System SCCM‐ System Center Configuration Manager

HW/SW tracking‐management, desktop patching

Microsoft Windows IT 2012 R2 2012 R2

System SCOM‐ System Center Operations Manager

Server health management


System SCORCH‐ System Center Orchestrator

Job scheduling and notifications‐ (DPSS, Oracle, etc.)


System SolarWinds Orion

Network and System monitoring

SolarWinds Orion IT 11 11.5.2

System Spotlight on AD, Exchange

Monitors these apps Microsoft Windows IT 6.8.2.417 6.8.5

System SSL VPN Remote Access Juniper JunOS IT (HACLA) 7.4R11.1 8.1R5.0

System Xerox Device Monitoring

Tracking for MFD's Xerox Windows GS 5.7

Virtualization HyperV Hosts many virtual servers for all HACLA

Microsoft Windows All 2012, 2012 R2

2012 R2

9

Type / Category




Installed Version


Virtualization VDI‐ virtual desktops

Systems to run virtual desktop infrastructure

Vmware Various

Horizon 6

6.2

Virtualization Vmware ESX server infrastructure

Hosts most virtual servers for all HACLA

Vmware Vmware All 5.0, 5.5 6

Web

DNN (Dotnet Nuke) for HACLA main website

Content management system for www.hacla.org website. DNN Windows All 7.3 7.4

Web

DreamWeaver Web Development

Adobe Windows

IT

Web Sharepoint Web Portal‐New Intranet Microsoft Windows All HACLA 2010 2013

Web website‐ lomod.org

Website for LOMOD department

Custom .net LOMOD

1

DATA CENTER INVENTORY

Server Name Make / Model

Application Location

2600print virtual New 2012 print server for 2600 LA 2600prntsrv virtual Print services for 2600 Wilshire LA ALARMLOCK virtual Lock system for Nickerson LA ALDER virtual New DMZ web server LA BKUPLA HP DL360 LA backup LA BUOC2 HP DL360 OC backup OC CCS PROD Sun V240 CCS OC Citrix 09 virtual Citrix Metaframe4.5, Environmental DB, HMIS OC CM12 virtual New SCCM LA CTX1 virtual Citrix XenApp 5.0, InterGIS VCR Application OC CTXLIC virtual Citrix XenApp 5.0 licensing, cert server OC Cypress virtual Remote virtual desktop access LA dc08la1 virtual AD Domain Controller LA dc08oc1 HP DL360 AD Domain Controller OC dc08oc2 virtual AD Domain Controller OC Douglas virtual iSupplier Dev server LA Elite3 HP DL360 Crystal Report and SQL 2005 testing for Elite LA ELITEPARTPORT virtual Elite Partner Portal LA ELITESQLDEV HP DL360 SQL 2005 testing for Elite LA ELITESQLPP virtual Elite Portal SQL Server LA ELITESQLPS virtual Elite Portal Staging SQL Server LA ELITERDS1 virtual RDS server for Elite OC ELITERDSDEV virtual RDS server for testing Elite OC EliteWeb virtual WebServices for ELITE App - IIS OC ELM virtual Public web server for non-Elite websites LA EX101 virtual Exchange 2010 front end OC EX102 virtual Exchange 2010 front end OC

2



EX10MB1 virtual Exchange 2010 mailbox server OC EX10MB2 virtual Exchange 2010 mailbox server OC ExArchive virtual Exchange 2010 mailbox server OC FSLA virtual New LA file server LA FSOC virtual New LA file server OC HACLAapps virtual RDS server for MFMS and Area OC HACLAintCA virtual Intermediate cert server OC HACLArootCA virtual Root cert server OC HACLAVDI virtual VDI connection broker for internal LA HACLAVDIEXT virtual VDI connection broker for remote LA HyperVla1 HP DL380 virtual host LA HyperVoc1 HP DL380 virtual host OC HyperVoc2 HP DL380 virtual host OC HyperVoc3 HP DL380 virtual host OC HyperVoc4 HP DL380 virtual host OC Intergiscom virtual GPS Client and Route Script OC LA firewall Juniper

appliance Primary DMZ inbound

LA LA1DC virtual AD 2012 domain controller LA LA2DC virtual AD 2012 domain controller LA LASQL08 virtual LA SQL 2008 databases LA LAUREL virtual Replacement for partner portal server LA LDC virtual Lumension device control OC LDC2 virtual Lumension device control- new OC Lmpatch virtual Lumension patch remediation server LA McAfeeAV virtual McAfee antivirus LA McAfeeAV2 virtual New McAfee server LA MoveAV virtual Antivirus for virtual desktops LA Netmon virtual Old Brocade Network App server OC Netmon2 virtual Brocade network mgmt app OC

3



NPS virtual DHCP only now, being retired LA OB14DEV Virtual onbase dev OC OBAPP2 Virtual onbase prod OC OBAPPTESTLOM Virtual onbase dev OC OBWEB2 Virtual onbase prod OC OBPRODAPP3 Virtual onbase prod OC OBPRODWEB3 Virtual onbase prod OC OC firewall Juniper

appliance OC outbound

OC OC1DC virtual AD 2012 domain controller OC OCSQL02 virtual Share Point database OC OCSQL08 virtual OC SQL 2008 databases OC OCSQL12a virtual SQL server for Orchester and VMM OC OCSQL14 virtual unknown SQL server OC OCSQL14a virtual New SQL 2014 cluster OC OCSQL14b virtual New SQL 2014 cluster OC OCSQL14DEV virtual SQL 2014 dev server LA OCSQL14SP13 virtual unknown SQL server OC Omnilock virtual Omnilock LA OPAC virtual OPAC app server LA ORA12DEV1APP virtual Oracle dev or test OC ORA12DEV1DB virtual Oracle dev or test OC ORA12DEV2APP virtual Oracle dev or test OC ORA12DEV2DB virtual Oracle dev or test OC ORA12PRODAPP HP DL380 Oracle production app OC ORA12PRODDB HP DL380 Oracle production database OC ORA12QATAPP HP DL380 Oracle dev or test OC ORA12QATDB HP DL380 Oracle dev or test OC ORA12TSTAPP virtual Oracle dev or test OC ORA12TSTDB virtual Oracle dev or test OC

4



ORA12YEPATCHAPP virtual Oracle dev or test OC ORA12YEPATCHDB virtual Oracle dev or test OC ORA6GRID virtual Oracle mgmt app OC OracleTS virtual Terminal server for Oracle developers OC Orion virtual SolarWinds LA Palo Alto firewall Palo Alto

appliance Outbound Internet

OC PINE virtual New FTP Server LA PORTALS (dev) virtual Elite portal dev OC RDSTest virtual Testing apps on RDS LA Redwood virtual iSupplier related LA SCOM01 virtual SC ops manager OC SCOM02 virtual SC ops manager OC SCOMSQL virtual Database for ops manager OC SOUTH2 HP DL360 Print services and DHCP for S8 south TORRANCESP13DEV2 virtual Sharepoint- Has IT data OC SP13prod virtual New Intranet running sharepoint OC SP13PROJ virtual MS project server OC SPWEB virtual Intranet OC SQL12DWH virtual Old SQL datawarehouse OC SQL12SP virtual SQL for sharepoint OC SQL14DWH virtual New SQL datawarehouse OC SQL05A HP DL380 Old SQL 2005 cluster OC SQL05B HP DL380 Old SQL 2005 cluster OC SQLDEV virtual Primary SQL development server OC SQLDEV12 virtual Old SQL dev server OC SQLonbase virtual SQL 2005 for Onbase OC SQLonbase2012 virtual New SQL server for Onbase OC SSL VPN- Birch Juniper

appliance VPN device for OC

OC

5



SSL VPN- Cedar Juniper appliance

VPN device for LA LA

SupportTS virtual Remote access for CCS and Oracle developers OC syslogsvr virtual Syslog server OC SYSCTROC1 virtual Sys Center Orchestrator OC Trackit2 virtual Trackit app server OC UBOC2 virtual New Union Bank FTP LA UBOCFTP virtual Union Bank FTP LA VALLEY HP DL360 Print services and DHCP for Valley VANNUYS vcenter60vdi virtual vCenter for VDI LA vCenterOC virtual vCenter for ESX hosts OC VDIhost62 HP DL380 VDI host LA VDIhost63 HP DL380 VDI host LA VDIhost64 HP DL380 VDI host LA VDIhost65 HP DL380 VDI host LA VDIhost66 HP DL380 VDI host LA VDIhost67 HP DL380 VDI host LA VIVAFORM virtual WEB FORM LA VMESX05OC HP DL380 virtual host OC VMESX06OC HP DL380 virtual host OC VMESXi55LADMZ HP DL380 virtual host LA VMESXi55LADMZ2 HP DL380 virtual host LA VMESXi55LA1 HP DL380 virtual host OC VMESXi55LA2 HP DL380 virtual host OC VMESXi55oc1 HP DL380 virtual host OC VoIPBCMR HP DL360 VoIP monitoring LA WAF Imperva

appliance Web app firewall for protecting portal

LA WALNUT virtual Proxy server for iSupplier LA WEBAPP1 virtual Web Apps - File storage app OC

6



WEBAPP2 virtual Spreadsheet server OC WEBDEV virtual Primary web development server OC WEBDEV2012 virtual Primary web development server OC WebElite12 virtual New web server for Elite OC

XenApp61 Half height blade

ELITE OC


ELITE OC


ELITE and ELITE Test OC

xeroxxda virtual Xerox copier monitoring LA

1

NETWORK INVENTORY

Qty Site

Location Device Model Type

14 HACLA Brocade AP7131 Access Point

1 HACLA Brocade Fast‐Iron SuperX 800 PREM

Router Router

18 HACLA Brocade FCX IronStack Switch L2 Switch

3 HACLA Brocade FCX624S‐HPOE Switch L2 Switch

7 HACLA Brocade FCX648S‐HPOE Switch L2 Switch

14 HACLA Brocade FES 2402 POE Router Router

10 HACLA Brocade FES 2402 POE Switch L2 Switch

1 HACLA Brocade FES 2402 Switch L2 Switch

1 HACLA Brocade FES 4802 POE Router Router

11 HACLA Brocade FES 4802 POE Switch L2 Switch

1 HACLA Brocade FES 4802 Router Router

2 HACLA Brocade FES X424+2XG Switch L2 Switch

2 HACLA Brocade NetIron MLX‐8 Router Router

1 HACLA Brocade TurboIron 24X Switch L2 Switch

1 HACLA Cisco Cisco 1601 Router




1 HACLA Cisco Cisco Catalyst 2924R Router

2 HACLA Brocade RFS6000 Wireless Controllers

1 HACLA Brocade TurboIron TIS07400 L2 Switch

1 HACLA Juniper Networks SSG‐520 Firewall

1 HACLA Juniper Networks SSG‐520 Firewall

1 HACLA Palo Alto PA‐2020 Firewall

6 HACLA Airaya Wireless‐Grid Point to Point (Wireless Ant)

2 HACLA EnGenious ENH202 Point to Point (Wireless Ant)

1 HACLA SonicWall TZ 205 Firewall

10 HACLA SonicWall TZ 200 Domestic Firewall

Appendix 7

Cross-Functional (Services Management) Roles and Responsibilities

Appendix 7 - Cross-Functional (Services Management) Roles and Responsibilities - 10.21.2015 Page 2 of 41

Code Role Role Detail Description

R Responsible

Individual operationally responsible for performing a sourcing activity. Responsible individuals report to the Accountable individual.

Only one individual is accountable for any given activity. Responsible is a proactive role.

A Accountable

Individual with final accountability for the results of a sourcing activity. Accountability includes a mandate to dismiss or accept the results by activity as realized by the Responsible individual. This individual also holds the budget to back the mandate.

Only one individual is accountable for any given activity. Accountable is a reactive role.

S Supporting

Individuals who support the Responsible individual in realizing the sourcing activity. They actively participate in realizing/executing/performing the activity. Supportive individuals report to the Responsible individual.

Multiple individuals can participate in support of the Responsible individual for any given activity. Supporting is a proactive role.

C Consulted

Individuals who should be consulted in realizing/executing/performing the activity, on the scope, budget, time and value of the activity.

Multiple individuals can be required to be heard for any given activity. Consulted is a reactive role.

I Informed

Individuals who need to be informed, but have no role in the realization/execution/performance of an activity, other than being informed of the result of the activity.

Multiple individuals can be informed of the results of any given activity. Informed is a passive role.

1.1 General Responsibilities The following table identifies general roles and responsibilities associated with Section of 6.1 Cross-Functional (Services Management) Roles and Responsibilities.

Table 1. General Services Roles and Responsibilities

General Services Roles and Responsibilities Provider HACLA

1. Provide Services and the supporting processes that support HACLA business needs, technical requirements and End-User requirements

R, A C

2. Approve Services and the supporting processes that support HACLA business needs, technical requirements and End-User requirements I R

3. Comply with HACLA policies, guiding principles, standards and regulatory requirements applicable to the HACLA for information, information systems, personnel, physical and technical security

R, A C

4. Develop and maintain an approved comprehensive Standards and Procedures Manual that contains the standards, processes and procedures that will be used in the delivery of all Scope of Services - Service Towers. The manual will include clearly delineated roles and responsibilities, touch points and measurements between HACLA and the vendor.

R, A C


General Services Roles and Responsibilities Provider HACLA

5. Approve the comprehensive Standards and Procedures Manual that contains the standards, processes and procedures that will be used in the delivery of all Scope of Services - Service Towers. The manual will include clearly delineated roles and responsibilities, touch points and measurements between HACLA and the vendor.

I R

6. Conform to changes in laws, regulations and policies. Major Service Changes shall be proposed on a project-by-project effort basis to alter the environment to conform to the new requirements.

R C, A

7. Report performance against Service-Level Requirements (SLRs) R, A I

8. Coordinate all Changes to the IT systems that may affect the SLRs of any other Service Tower

R, A C, I

9. Provide timely creation, updating, maintenance and provision of all appropriate project plans, project time and cost estimates, technical specifications, management documentation and management reporting in a form/format that is acceptable to the HACLA for all Service Tower projects and major Service activities

R, A C

10. Adhere to IT service management (ITSM) best practices and Key Performance Indicators (KPIs)

R, A I

11. Approve the use of the ITSM best practices and KPIs C, I R

1.2 IT Services Life Cycle and Operations

1.2.1 Planning and Analysis

Planning and Analysis Services are activities associated with researching new technical trends, products and services, such as hardware components, system software and networks that offer opportunities to improve the efficiency and effectiveness of the Service Towers. Planning and Analysis Services can also help support competitive business advantage and mitigate risks by reducing defects and improving the quality of IT Services. The following table identifies the Planning and Analysis roles and responsibilities that Provider and HACLA will perform.

Table 2. Planning and Analysis Roles and Responsibilities

Planning and Analysis Roles and Responsibilities Provider HACLA

1. Define Services, processes, standards and time frames for Planning and Analysis activities

R, A C

2. Participate in defining Services, processes and standards for Planning and Analysis activities

R, A C, I

3. Review and approve Services, processes and standards for Planning and Analysis activities

C, I R, A

4. Define HACLA requirements (e.g., business, technology strategy, functional, availability, capacity, performance, backup and IT service continuity) at the enterprise level for all Service Towers (End User, Infrastructure, Applications, Account Management)

C, I R, A

5. Perform technical and Service Planning and Analysis based on HACLA requirements (e.g., availability, capacity, performance, backup and IT Service Continuity and Disaster Recovery Services)

R, A C, I

6. Provide recommendations for new or changes to applications, infrastructure, processes and Services based on Planning and Analysis results in a management report

R C, I


Planning and Analysis Roles and Responsibilities Provider HACLA

7. Approve Planning and Analysis and recommendations for new or changes to applications, infrastructure, processes and Services

I R, A

8. Recommend Data Backup and Retention policies for all Service Towers

R C, I

9. Define HACLA Data Backup and Retention requirements and policies for all Service Towers

C, I R, A

10. Continuously monitor technical trends through independent research; document and report on products, processes and services with potential use for HACLA as they align with HACLA's business and technology strategy

R, A I

11. Recommend new technologies that best meet HACLA business needs and meet cost, performance and quality objectives

R C, I

12. Approve the implementation of new technologies that best meet HACLA business needs and meet cost, performance and quality objectives

I R

13. Perform feasibility studies for the implementation of new technologies that best meet HACLA business needs and meet cost, performance and quality objectives

R, A C, I

14. Define enterprise-level project management policies, procedures and requirements (e.g., project feasibility analysis, cost-benefit analysis, scheduling, costing, resource planning, communication planning, procurement, risk management and quality management)

C, I R, A

15. Perform project management function for Provider-managed projects and provide project management deliverables in accordance with HACLA project management policies and Project Management Institute (PMI) best practices

R, A I

16. Perform project management oversight and liaison function to the business and customers (i.e., stakeholder management) and approve project management deliverables

I R, A

17. Conduct annual technical and business planning sessions to establish standards, architecture and project initiatives per the Planning and Analysis results

C, I R, A

18. Participate in technical and business planning sessions (at least annually) to establish standards, architecture and project initiatives

R C, I

19. Develop and present documented standards and architecture R I

20. Approve documented standards and architecture I R

21. Develop and present project IT charters I R

22. Conduct regular planning for technology refreshes and upgrades R, A I

23. Participate in regular planning for technology refreshes and upgrades

C, I R

24. Develop technology refresh and upgrade plan R C, I

25. Approve technology refresh and upgrade plan I R

26. Conduct technical reviews and provide recommendations for improvements that increase efficiency and effectiveness and reduce costs per the Planning and Analysis results

R, A I


1.2.2 Requirements Definition

Requirements Definition Services are the activities associated with the assessment and definition of functional, performance, IT Continuity and Disaster Recovery, and Security requirements that also comply with regulatory and HACLA policies. These requirements drive the technical design for the environment. The following table identifies the Requirements Definition roles and responsibilities that Provider and HACLA will perform.

Table 3. Requirements Definition Roles and Responsibilities

Requirements Definition Roles and Responsibilities Provider HACLA

1. Define IT/business process (BP) Service requirements and standards S R, A

2. Participate in defining requirements and standards C, S

3. Conduct interviews, group workshops and surveys to determine user functional, performance, availability, maintainability and IT continuity and other IT/BP Service requirements

R, A A

4. Participate in appropriate requirements-gathering activities (e.g., focus groups, interviews)

R, A C, I

5. Provide additional information in sufficient detail pertaining to the requirements definition to enable development of appropriate requirements documentation (e.g., business requirements documentation)

C R, A

6. Document requirements to deliver IT/BP Services in agreed-to formats (e.g., system specifications, data models, upgrade requirements, conversion requirements, network design schematics)

R, A I

7. Ensure requirements meet security policies R, A I

8. Approve all requirements documents C, I R, A

1.2.3 Environment and Facilities Support

Environment and Facilities Support Services are the activities associated with maintaining environmental requirements at Provider and HACLA facilities. The following table identifies Environment and Facilities Support roles and responsibilities that Provider and HACLA will perform.

Table 4. Environmental and Facilities Support Roles and Responsibilities

Environmental and Facilities Support Roles and Responsibilities Provider HACLA

1. Recommend Environment and Facilities Support requirements and policies

R, A C

2. Review and approve Environment and Facilities Support requirements I R, A

3. Identify requirements for HACLA Environment for Provider-supported components

R, A C

4. Develop, document and maintain in the Standards and Procedures Manual Environment and Facilities Support procedures that meet requirements and adhere to defined policies

R, A I

5. Review and approve Environment and Facilities Support procedures and policies

I R, A

6. Remotely monitor environmental systems (e.g., uninterruptable power supply [UPS]) required to support Service Tower components housed in HACLA facilities (e.g., computer rooms)

R, A C

7. Develop and recommend improvement plans for HACLA-monitored facilities as needed to maintain an effective and secure computing environment

R, A I


Environmental and Facilities Support Roles and Responsibilities Provider HACLA

8. Approve improvement plans for HACLA-monitored facilities as needed to maintain an effective and secure computing environment

I R, A

9. Implement or coordinate the implementation of all approved upgrades and installations

R, A I

10. Coordinate HACLA site activities of all personnel (i.e., Provider employees and others) working in equipment locations (e.g., equipment rooms, network equipment closets)

R, A I

11. Ensure that facilities supporting activities conform to the requirements of defined Change Management processes

R, A I

1.3 Service Design

1.3.1 Design Specification

Design Specification services are the activities and deliverables associated with translating user and information system requirements into detailed technical specifications. The following table identifies the Design Specification roles and responsibilities that Provider and HACLA will perform.

Table 5. Design Specification Roles and Responsibilities

Design Specification Roles and Responsibilities Provider HACLA

1. Define Design Specification standards and requirements for IT/BP services

R, A C

2. Recommend improvements to Design Specification standards and requirements

R, A C

3. Develop, document and maintain technical design plans and environment configuration based on HACLA Design Specification standards and requirements including IT architecture, functional, performance, availability, maintainability, security and IT Continuity and Disaster Recovery requirements

R, A I

4. Determine and document required Service Tower component upgrade, replacement and/or conversion specifications (e.g., hardware, software, networks)

R, A I

5. Review and approve design plans C, I R, A

6. Conduct site surveys for design efforts as required R, A I

7. Provide Provider with additional information in sufficient detail pertaining to the Design Specification to enable creation of the appropriate design documents

I R, A

8. Document Design Specification R, A I

9. Review and approve Design Specification I R, A

1.3.2 Service-Level Monitoring and Reporting

Service-Level Monitoring and Reporting Services are the activities associated with the monitoring and reporting Service Levels with respect to Service-Level Requirements (SLRs). In addition, Provider shall report system management information (e.g., performance metrics and system accounting information) to the designated HACLA representatives in a format agreed to by HACLA. The following table identifies the Service-Level Monitoring and Reporting roles and responsibilities that Provider and HACLA will perform.


Table 6. Service-Level Monitoring and Reporting Responsibilities

Service-Level Monitoring Roles and Responsibilities Provider HACLA

1. Define Service-Level requirements I R, A

2. Define Service-Level Monitoring and Reporting requirements and policies

I R, A

3. Develop, document and maintain in the Standards Process and Procedures Manual Service-Level Monitoring and Reporting procedures that meet requirements and adhere to defined policies

R, A I

4. Review and approve Service-Level Monitoring and Reporting procedures and policies

C R, A

5. Report on SLR performance and improvement results R, A I

6. Coordinate SLR monitoring and reporting with designated HACLA representative and Third Parties

R, A I

7. Measure, analyze and provide management reports on performance relative to SLRs

R, A I

8. Conduct SLR Improvement Meetings to review SLRs and recommendations for improvements

R, A I

9. Review and approve SLR improvement plans I R, A

10. Implement SLR improvement plans R, A I

11. Review and approve SLR metrics and performance reports C, I R, A

12. Provide HACLA access to performance and SLR reporting and monitoring system and data

R, A I

1.3.3 Performance Management

Performance Management Services are the activities associated with managing and tuning Service Tower components for optimal performance. The process encompasses the following: Monitoring of performance and throughput of IT Services and supporting IT components

Assessing the results of the reports

Conducting trending analysis

Providing recommendations to tune

Performing tuning activities

Updating on a periodic basis (at least annually)

The following table identifies the Performance Management roles and responsibilities that Provider and HACLA will perform.

Table 7. Performance Management Roles and Responsibilities

Performance Management Roles and Responsibilities Provider HACLA

1. Define Performance Management requirements and policies R, A C

2. Develop, document and maintain in the Standards, Process and Procedures Manual Performance Management procedures that meet requirements and adhere to defined policies

R, A I

3. Review and approve Performance Management procedures and policies

I R, A

4. Perform Service Tower component tuning to maintain optimum performance in accordance with Change Management procedures

R, A I


Performance Management Roles and Responsibilities Provider HACLA

5. Manage Service Tower component resources (e.g., devices and traffic) to meet defined Availability and performance SLRs

R, A I

6. Provide monitoring and reporting of Service Tower component performance, utilization and efficiency based on specified time frame and sequence (e.g., monthly)

R, A I

7. Proactively evaluate, identify and recommend configurations or changes to configurations that will enhance performance

R, A I

8. Conduct trending analysis to recommend changes to improve the performance based on specified time frame and sequence (e.g., monthly)

R, A I

9. Develop and deliver improvement plans as required to meet SLRs based on specified time frame and sequence (e.g., monthly)

R, A I

10. Review and approve improvement plans R, A

11. Implement improvement plans and coordinate with Third Parties as required

R, A I

12. Provide technical advice and support to the application maintenance and development staffs as required

R, A I

1.3.4 Availability Management

The goal of Availability Management is to understand the overall availability requirements of HACLA business needs and to plan, measure, monitor and continuously strive to improve the availability of the IT Infrastructure, services and supporting IT organization to ensure these requirements are met consistently, with a focus on providing cost-effective availability improvements that deliver measurable HACLA business benefits. Availability Management covers the evaluation, design, implementation, measurement and management of the IT Infrastructure Availability from a component and an end-to-end perspective (i.e., Services), including new or modified IT Service Management methodologies and tools, as well as technology modifications or upgrades of IT Infrastructure systems and components. The goal of the Availability Management process is to optimize the capability of the IT Infrastructure, services and supporting organization to deliver a cost-effective and sustained level of Availability that enables the business to satisfy its business objectives. Key activities of the Availability Management process are as follows:

Determining business unit availability requirements (usually as part of the SLRs development) for a new or enhanced IT Service and formulating the availability and recovery design criteria for the IT Infrastructure to ensure IT Services are designed to deliver the appropriate levels of a

Determining the critical business functions and impact arising from IT component failure. Where appropriate, reviewing the availability design criteria to provide additional resilience to prevent or minimize impact to the business.

Identifying opportunities to optimize the availability of the IT Infrastructure to deliver cost-effective improvements that deliver tangible business benefits

Supporting the targets for availability, reliability and maintainability for the IT Infrastructure components that underpin the IT Service, to enable these to be documented and agreed within SLRs and contracts

Establishing measures and reporting of availability, reliability and maintainability that reflect the business, End-User and IT support organization perspectives

Monitoring and trend analysis of the availability, reliability and maintainability of IT systems and components

Reviewing IT Service, system and component availability, identifying unacceptable levels and ensuring appropriate corrective actions are taken to address IT availability shortfalls

Investigating the underlying reasons for unacceptable availability and providing recommendations for resolution


Producing and maintaining a forward-looking Availability Plan, which prioritizes and plans overall IT availability improvements aimed at improving the overall availability of IT Services and Infrastructure components to ensure that existing and future business availability requirements can be met

Providing IT availability reports to ensure that agreed levels of availability, reliability and maintainability are measured and monitored on an ongoing basis

The following table identifies the Availability Management roles and responsibilities that Provider and HACLA will perform.

Table 8. Availability Management Roles and Responsibilities

Availability Management Roles and Responsibilities Provider HACLA

1. Establish criteria and SLRs for Availability Management support requirements, including IT systems and services to be covered

C, I R, A

2. Develop Availability Management policies, process and procedures, and determine appropriate Availability Management tools and methods that support HACLA's Availability Management support requirements

R, A I

3. Participate in the development of Availability Management policies, process and procedures, and identify the tools and availability methods to be used

I R, A

4. Review and approve Availability Management policies, processes and procedures

I R, A

5. Implement agreed-upon Availability Management policies, processes and procedures

R, A I

6. Provide unrestricted read access by HACLA-authorized staff and designated personnel to all current and historical availability knowledgebase data and records

R, A I

7. Ensure that availability requirements are included when requirements are identified, when upgrading and/or designing new IT systems and services to support business users

I R, A

8. Participate in user requirements gathering and analysis when upgrading and/or designing new IT systems and services, to ensure that they are designed to deliver the required levels of availability (mapped to the SLRs) required by the business

R, A I

9. Create availability and recovery design criteria to be applied to upgrades and/or new or enhanced infrastructure design

R, A I

10. Participate in creating availability and recovery design criteria to be applied to upgrades and/or new IT Infrastructure system and services design

R, A C

11. Coordinate with the IT service support and IT service delivery process owners and managers from HACLA to research, review and assess Availability issues and optimization opportunities

R, A C, I

12. Define the availability measures and reporting required for the IT Infrastructure and its components that underpin an upgraded and/or new IT Service, as the basis for an SLR that reflects business, End-User and IT support organization requirements

I R, A

13. Participate with HACLA in defining the availability measures and reporting requirements

R, A I

14. Recommend appropriate tools and practices to measure and report on agreed-upon availability measures for upgraded and/or enhanced IT Infrastructure

R, A I

15. Review and approve availability measurement tools and practices I R, A

16. Ensure that approved availability measurement tools and practices are implemented

R, A I


Availability Management Roles and Responsibilities Provider HACLA

17. Monitor and maintain an awareness of technology advancements and IT best practices related to availability optimization, and periodically provide updates to HACLA IT management

R, A I

18. Ensure that all Availability Management improvement initiatives conform to defined Change Management procedures set forth in the Process and Procedures Manual

R, A I

19. Coordinate and take ownership of Availability Management across all IT service areas within HACLA and Third-Party Service Vendors (e.g., public carriers, Internet service providers, Third-Party Providers, etc.)

R, A I

20. Participate in Problem Management review sessions as appropriate, specifically those problems related to outages of critical systems

R, A C, I

21. Monitor actual IT availability achieved versus targets and ensure shortfalls are addressed promptly and effectively

R, A I

22. Conduct Availability Assessment review sessions and provide cost-justified improvement recommendations

R, A I

23. Participate in availability improvement review sessions I R, A

24. Review and approve cost-justifiable improvement recommendations that HACLA deems appropriate to enhance HACLA IT and business performance needs

I R, A

25. Coordinate with HACLA and Third-Party Service Vendors to gather information on IT systems and service availability issues and trends, to be used for trend analysis

R, A I

26. Produce and maintain an Availability Plan that prioritizes and plans approved IT availability improvements

R, A I

27. Review and approve Availability Plan I R, A

28. Provide IT availability reporting to ensure that agreed levels of availability, reliability and maintainability are measured, reported and monitored on an ongoing basis

R, A I

29. Promote Availability Management awareness and understanding within all IT support organizations, including Third-Party Service Vendors

R, A I

30. Perform regular (e.g., quarterly) reviews of the Availability Management process and its associated techniques and methods to ensure that all are subjected to continuous improvement and remain fit for purpose

R, A I

31. Periodically audit the Availability Management process to ensure that it continues to deliver desired results in compliance with agreed-upon policies, processes and procedures

I R, A

1.3.5 Capacity Management

Capacity Management Services are the activities associated with ensuring that the capacity of the Service Towers matches the evolving demands of HACLA business in the most cost-effective and timely manner. The process encompasses the following: Monitoring of performance and throughput of IT Services and supporting IT components

Understanding current demands and forecasting for future requirements

Developing capacity plans which will meet demand and SLRs

Developing modeling and conducting simulations to manage capacity

Conducting risk assessment of capacity recommendations


Developing and implementing a capacity plan including the financial impact of the Service Towers

Undertaking tuning activities

The following table identifies the Capacity Management roles and responsibilities that Provider and HACLA will perform.

Table 9. Capacity Management Roles and Responsibilities

Capacity Management Roles and Responsibilities Provider HACLA

1. Define Capacity Management requirements and policies R, A C

2. Develop, document and maintain in the Standards, Process and Procedures Manual Capacity Management procedures that meet requirements and adhere to defined policies

R, A I

3. Review and approve Capacity Management process and procedures and policies

I R, A

4. Establish a comprehensive Capacity Management planning process

R, A I

5. Review and approve Capacity Management planning process I R, A

6. Define, develop and implement tools that allow for the effective capacity monitoring/trending of IT Infrastructure, applications and IT components

R, A I

7. Identify future business requirements that will alter capacity requirements

I R, A

8. Develop a periodic (usually yearly) capacity plan, including quarterly updates

R, A I

9. Develop and implement capacity models and run simulations to validate the capacity plan

R, A I

10. Participate in all capacity planning activities I R, A

11. Assess capacity impacts when adding, removing or modifying applications and infrastructure components

R, A I

12. Continually monitor IT resource usage to enable proactive identification of capacity and performance issues

R, A I

13. Capture trending information and forecast future HACLA capacity requirements based on HACLA-defined thresholds

R, A I

14. Assess incidents/problems related to capacity and provide recommendations for resolution

R, A I

15. Recommend changes to capacity to improve service performance R, A I

16. Assess impact/risk and cost of capacity changes R, A I

17. Approve capacity-related recommendations I R, A

18. Maintain capacity levels to optimize use of existing IT resources and minimize HACLA costs to deliver Services at agreed-to SLRs

R, A I

19. Ensure adequate capacity exists within the IT environment to meet SLRs and requirements, taking into account daily, weekly and seasonal variations in capacity demands

R, A I

20. Validate asset utilization and capital efficiency I R, A

1.3.6 Backup and Recovery

Backup and Recovery Services are the activities associated with providing ongoing Backup and Recovery capabilities according to HACLA schedules and requirements. Provider must demonstrate that it will


consistently meet or exceed HACLA's ongoing Backup and Recovery requirements. The following table identifies Backup and Recovery roles and responsibilities that Provider and HACLA will perform.

Table 10. Backup and Recovery Roles and Responsibilities

Backup and Recovery Roles and Responsibilities Provider HACLA

1. Define Backup and Recovery schedules, requirements and policies

R, A C

2. Recommend best practices for Backup and Recovery Services strategies, policies, and process and procedures

R, A I

3. Develop, document and maintain in the Standards and Process and Procedures Manual Backup and Recovery schedules and procedures that adhere to HACLA requirements and policies

R, A I

4. Coordinate the Backup and Recovery Standards and Process and Procedure Manual with HACLA Security and Legal teams

R, A I

5. Review and approve Backup and Recovery schedules and process, procedures and policies

I R, A

6. Define Backup and Recovery Monitoring and Reporting requirements and policies

R, A I

7. Review and approve Backup and Recovery Monitoring and Reporting procedures

I R, A

8. Manage backup media inventory (tape, disk, optical and other media type) including the ordering and distribution of media

R, A I

9. Perform Service Tower component backups and associated rotation of media as required

R, A I

10. Identify and establish a secure off-site location for data media I R, A

11. Archive data media at a secure off-site location R, A C, I

12. Ensure ongoing capability to recover archived data from media as specified (backward compatibility of newer backup equipment)

R, A C, I

13. Test backup media to ensure incremental and full recovery of data is possible and ensure Service Tower component integrity, as required or requested by HACLA

R, A I

14. Recover files, file system or other data required from backup media, as required or requested by HACLA

R, A I

15. Provide Backup and Recovery Monitoring and Reporting requirements and updates as they change

I R, A

16. Provide HACLA access to Backup and Recovery Monitoring and Reporting systems and data

R, A I

1.3.7 IT Service Continuity and Disaster Recovery

IT Service Continuity and Disaster Recovery (DR) Services are the activities associated with providing such Services for HACLA applications, and their associated infrastructure (e.g., CPU, servers, network, data and output devices, End-User devices) and for HACLA Voice Network Services. HACLA applications, associated infrastructure and Voice Network Services will receive DR Services according to HACLA's Business Continuity Plan. Provider must demonstrate that it will consistently meet or exceed HACLA's IT Service Continuity and DR Services requirements. The following table identifies Service Continuity and DR Services roles and responsibilities that Provider and HACLA will perform.


Table 11. IT Service Continuity and DR Roles and Responsibilities

IT Service Continuity and DR Roles and Responsibilities Provider HACLA

1. Define IT Service Continuity and DR Services strategy, requirements and policies

R, A C

2. Recommend best practices for IT Service Continuity and DR Services strategies, policies, process and procedures

R, A I

3. Document IT Service Continuity and DR Services process and procedures that adhere to HACLA requirements and policies

R, A I

4. Review and approve IT Service Continuity and DR Services procedures and policies

I R, A

5. As needed, assist HACLA in other IT continuity and emergency management activities

R, A I

6. Develop and maintain a detailed DR plan to meet IT Service Continuity and DR requirements. Include plans for data, replication, backups, storage management and contingency operations that provide for recovering HACLA's systems within established recovery requirement time frames after a disaster affects HACLA's use of the Services.

R, A I

7. Define data (file system, database, flat files, etc.) replication, backup and retention requirements

R, A C

8. Establish processes to ensure DR plans are kept up to date and reflect changes in HACLA environment

R, A I

9. Establish procedures to ensure the impact to the DR plans are reviewed by the Change Management process

R, A I

10. Review and approve DR plans I R, A

11. Establish DR test requirements I R, A

12. Perform scheduled DR tests per HACLA policies R, A I

13. Coordinate involvement of HACLA End Users for DR testing R A

14. Coordinate involvement of all other parties for DR testing R, A I

15. Participate in DR tests I R, A

16. Track and report DR test results to HACLA R, A I

17. Review and approve DR testing results I R, A

18. Develop action plan to address DR testing results R, A I

19. Review and approve DR testing action plan I R, A

20. Implement action plan and provide ongoing status until completion R, A I

21. Initiate the DR plan in the event of a HACLA DR situation per the DR policies and procedures

R A

22. Initiate the DR plan in the event of a Provider DR situation and notify HACLA per DR policies and procedures

R, A I

23. Coordinate with HACLA during a Provider DR situation per DR policies and procedures

R, A I

24. Provide HACLA access to IT Service Continuity and DR reporting and monitoring systems and data

R, A C, I

1.3.8 Security

Security Services are the activities associated with maintaining physical and logical security of all Service Tower components (hardware and software) and data, virus protection, access protection and other


Security Services in compliance with HACLA Security requirements and FISMA/NIST. The following table identifies Security roles and responsibilities that Provider and HACLA will perform.

Table 12. General Security Roles and Responsibilities

General Security Roles and Responsibilities Provider HACLA

1. Define Security requirements, standards, process and procedures and policies including regulatory requirements

R, A C

2. Assist in developing Security standards, policies and procedures including industry best practices

R, A I

3. Develop, document and maintain in the Standards, Process and Procedures Manual Security requirements, standards, process and procedures and policies including regulatory requirements

R, A I

4. Review and approve Security requirements, standards, procedures and policies including regulatory requirements

I R, A

5. Remain up to date with current Security trends, threats and common exploits as well as security policies, procedures and best practices

R, A I

6. Provide a full-time Security assessment group to conduct continual assessments of HACLA's Security effectiveness

R, A I

7. Conduct risk assessments to identify control or Security gaps R A

8. Conduct self-assessments to identify control or Security gaps R, A I

9. Provide Security plan and IT Infrastructure based on Security requirements, standards, procedures, policies, HACLA's federal, requirements and risks

R, A I

10. Review and approve Security plans and IT Infrastructure I R, A

11. Implement physical and logical Security plans consistent with HACLA Security policies and industry standards (e.g., FISMA/NIST)

R, A I

12. Establish access profiles and policies for adding, changing, enabling/disabling and deleting log-on access of HACLA employees, agents and subcontractors

I R, A

13. Perform log-on/Security-level access changes as detailed in profiles and policies for all Services Towers

R, A I

14. Provide best available commercial off-the-shelf (COTS) Security analysis and monitoring products into HACLA's system and network infrastructure

R, A C

15. Support best available COTS Security analysis and monitoring products into HACLA's system and network infrastructure

R, A I

16. Report Security violations to HACLA-per-HACLA policies R, A I

17. Resolve Security violations per-HACLA policies R, A I

18. Review all Security patches relevant to the IT environment and classify the need and speed at which the Security patches should be installed as defined by Security policies and Change Management

R, A I

19. Install Security patches per HACLA's Change Management process and procedures, including acquiring required HACLA approval

R, A I

20. Maintain all documentation required for Security assessments, audits and internal control and control testing

R, A I


General Security Roles and Responsibilities Provider HACLA

21. Place and support systems with particularly sensitive data in controlled access areas. Only End-Users with current, authorized access permission shall be allowed to enter these areas.

R, A C, I

22. Perform periodic Security audits R, A I

23. Allow Third-Party Security audits R, A I

24. Implement a Security awareness program R, A I

25. Ensure that all Provider staff complete HACLA-required security training, based on HACLA-defined information security roles

R, A I

26. Provide HACLA access to security reporting and monitoring systems and data

R, A C, I

Physical Security focuses on the physical access controls implemented to ensure the security of HACLA's and Provider's data processing equipment, facilities and its associated management systems.

Table 13. Physical Security Roles and Responsibilities

Physical Security Roles and Responsibilities Provider HACLA

1. Provide physical security in conformance with policies, procedures and practices

R, A I

2. Physically secure data processing equipment, facilities and storage media from unauthorized access

R, A I

3. Protect data processing equipment from environment hazards and infrastructure failures (mechanical, electrical, HVAC, cable)

R, A I

4. Physically protect and store fixed and portable media (e.g., tape, optical, portable hard drives, flash drives) containing sensitive data

R, A I

5. Ensure only authorized personnel have access to data processing equipment, facilities and storage media

R, A I

6. Track and monitor all physical access and activities performed on data processing equipment and facilities

R, A I

7. Review logs to show the access to data processing equipment was business-justified

R, A I

8. Provide capability to immediately revoke access to data processing equipment, facilities and storage media

R, A I

9. Maintain physical access audit logs R, A I

10. Physically secure management systems from unauthorized access R, A I

11. Ensure only authorized personnel have access to management systems R, A I

12. Track and monitor all changes performed on management systems R, A I

13. Provide capability to immediately revoke access from management systems R, A I

14. Maintain change audit logs on management systems R, A I

Data Security consists of the activities associated with the classification, management, security and encryption of sensitive/confidential data, and the storage of media containing that data.

Table 14. Data Security Roles and Responsibilities

Data Security Roles and Responsibilities Provider HACLA

1. Provide Data Security in conformance with policies, procedures and practices

R, A I

2. Establish data classifications, descriptions and associated data protection requirements

I R, A


Data Security Roles and Responsibilities Provider HACLA

3. Classify data under HACLA's control I R, A

4. Classify data under Service Provider's control R, A I

5. Protect data based on data classification R, A I

6. Approve provider's data classification I R, A

7. Assume custodial responsibility for all storage media R, A I

8. Protect portable media while in transit and maintain transmittal records R, A I

9. Eradicate all data from storage media (server memory, disk, tape, optical, other) before redeployment or disposal, in accordance with established HACLA policies and procedures

R, A I

10. Perform periodic (e.g., monthly) reconciliation reporting of all data media and perform annual audit to reconcile all storage media

R, A I

11. Report reconciliation discrepancies to HACLA and take corrective action to address issue

R, A I

12. Establish encryption and key management requirements for sensitive or confidential data based on data classification

R, A C

13. Provide an encryption solution that meets HACLA's encryption requirements for data at rest and in transit

R, A I

14. Approve encryption solution for data at rest and in transit I R, A

15. Encrypt data and/or media based on data classification requirements R, A I

16. Establish custodial service requirements for key management I R, A

17. Recommend a key management custodial service that meets HACLA's requirements

R, A I

18. Approve key management custodial service I R, A

19. Implement a custodial service for key management R, A C, I

20. Periodically review data security to ensure data is being protected consistently with data classification

R, A C, I

Identity and Access Management Services consist of the activities to authorize, authenticate and provide access control to the IT Infrastructure. Identity management within this scope is limited to internal access control and does not include participant/beneficiary system access control, authorization and authentication.

Table 15. Identity and Access Management Roles and Responsibilities

Identity and Access Management Roles and Responsibilities Provider HACLA

1. Provide Identity and Access Management in conformance with HACLA practices, policies and procedures

R, A I

2. Establish roles, authorized activities and minimum rights granted to Service Provider personnel (including non-user accounts)

R, A I

3. Establish roles, authorized activities and minimum rights granted to HACLA personnel (including non-user accounts)

I R, A

4. Approve roles and authorization activities performed by Provider I R, A

5. Establish and manage the process for defining, granting, modifying and revoking user accounts and enforcing role restrictions

R, A I

6. Establish and manage process to support temporary access R, A I

7. Review and approve user and system user account management process I R, A

8. Approve Service Provider personnel who are authorized to manage user accounts

I R, A


Identity and Access Management Roles and Responsibilities Provider HACLA

9. Provide IT Identity and Access Management technology solution that integrates with HACLA systems

I R, A

10. Support and maintain IT Identity and Access Management technology solution for infrastructure R, A I

11. Perform engineering, configuration and ongoing management of IT Identity and Access Management technology solution

R, A I

12. Provide and implement a solution to interface HACLA and Service Provider's Identity and Access Management processes

R, A I

13. Approve solution to interface HACLA and Service Provider's Identity and Access Management processes

I R, A

14. Define logging and archiving policies and requirements I R, A

15. Provide logging and archiving specifications/design R, A I

16. Approve logging and archiving specification/design I R, A

17. Log and archive user/account activity according to approved logging and archiving specification/design

R, A I

18. Monthly audit production system access logs and activities to identify malicious or abnormal behavior in accordance with established HACLA policies and standards

R, A I

19. Conduct monthly review of all HACLA account IDs to ensure the accounts are valid/required, removing inactive and unneeded accounts in accordance with established HACLA policies and standards

I R, A

20. Conduct monthly review of all privileged user accounts to ensure the accounts are valid/required, removing inactive and unneeded accounts in accordance with established HACLA policies and standards

R, A I

21. Conduct monthly review of End-User accounts to ensure each user has appropriate minimal permissions required to perform their job function in accordance with established HACLA policies and standards

R, A I

22. Conduct monthly review of privileged user accounts to ensure each user has appropriate minimal permissions required to perform their job function in accordance with established HACLA policies and standards

R, A I

Provider shall provide both Network-based Intrusion Detection/Prevention Services (NIDS) and Host-based Intrusion Detection/Prevention Services (HIDS) using HACLA-owned NIDS/HIDS hardware and software. Provider shall also perform internal threat monitoring for malicious and/or suspicious activity. The following table identifies the roles and responsibilities associated with the Security Monitoring Services.

Table 16. Security Monitoring Services Roles and Responsibilities

Security Monitoring Services Roles and Responsibilities Provider HACLA

1. Develop policies and standards for intrusion detection/prevention I R, A

2. Provide intrusion detection/prevention services and reporting R, A I

3. Allow for independent intrusion detection/prevention services provided by HACLA

R, A I

4. Develop recommendations for improved security R, A I

5. Review and approve recommendations for improved security I R, A

6. Implement approved recommendations R, A C, I

7. Ensure that security incidents are opened for detected/prevented intrusions

R, A I

8. Perform 24R, A7 Real-time Monitoring of equipment and connectivity to detect malicious or abnormal behavior, network intrusions

R, A I


Security Monitoring Services Roles and Responsibilities Provider HACLA

9. Respond to abnormal or malicious activity based on established policies R, A I

10. Provide HACLA reports on activities, anomalies or deficiencies that could result in a compromise of the system's data confidentially, integrity or system performance

R, A I

11. Establish, manage, secure and monitor connectivity to affiliates R, A I

Table 17. Security Configuration Management Roles and Responsibilities

Security Configuration Management Roles and Responsibilities Provider HACLA

1. Certify engineering and Configuration Management are secure R, A I

2. Review and approve engineering designs and Configuration Management security

I R, A

3. Certify equipment meets HACLA's security requirements and provide evidence of compliance

R, A I

4. Periodically review equipment configurations and address any deficiencies or inconsistencies, and provide HACLA with results with detailed recommendations to remediating issues that are found

R, A I

5. Review and approve remediation approach I R, A

6. Provide HACLA with secure baselines for standard components (e.g., routers, servers, DBMS, etc.)

R, A I

7. Establish a baseline for the secure configuration of servers based on HACLA technical control specifications (e.g., CIS benchmark)

I R, A

8. Recommend changes to baseline to meet HACLA requirements I R, A

9. Configure servers to HACLA security requirements R, A I

Table 18. Security Equipment and Connectivity Roles and Responsibilities

Security Equipment and Connectivity Roles and Responsibilities Provider HACLA

1. Monitor security bulletins and advisories for security threats. When threat poses risk to HACLA systems, develop course of action to remediate risk.

R, A I

2. Review and approve course of action to remediate security threat I R, A

3. Identify security patches relevant to the IT environment and classify the need and speed at which they should be installed as defined by security policies

R, A I

4. Provider collaborates with HACLA on plan to implement security patches R, A I

5. Install security patches per the Change, Configuration and Release Management processes and procedures

R, A I

6. Install, configure and maintain anti-virus, intrusion detection, security agents, file integrity monitors on servers

R, A I

7. Provide ongoing support (patches, upgrades, signatures), tuning and management of the security software

R, A I

8. Perform 24R, A7 Real-time Monitoring of security software logs and activity. Detect malicious or abnormal behavior and establish corrective action.

R, A I

9. Establish logging and archiving specifications R, A I

10. Identify logging and archiving specifications in order to support business requirements

I R, A

11. Approve logging and archiving specifications I R, A


Security Equipment and Connectivity Roles and Responsibilities Provider HACLA

12. Log and archive server user and system activity R, A I

13. Provide HACLA reports on any server logs/intrusion detection activities, anomalies or deficiencies that could result in a compromise of the ecommerce system's data confidentially, integrity or system performance

R, A I

14. Periodically review host-based protection tool configurations and recommend changes to address any deficiencies or inconsistencies

R, A I

15. Approve changes to host-based protection tools I R, A

16. Provide ongoing support (patches, upgrades, signatures), tuning and management of the servers, storage and intrusion detection

R, A I

Security Vulnerability and Risk Assessment Services are the activities associated with vulnerability scanning, penetration testing, security assessment and overall risk assessment of the XX system to identify and remediate threats that could be exploited to compromise the system.

Table 19. Security Vulnerability and Risk Assessment Roles and Responsibilities

Security Vulnerability and Risk Assessment Services Roles and Responsibilities

Provider HACLA

1. Establish practices, policies and procedures to provide Security Vulnerability and Risk Assessment Services

R, A I

2. Review and identify gaps in Service Provider's practices, policies and procedures

I R, A

3. Collaborate with HACLA in modifying practices, policies and procedures to address gaps while enabling the Provider to efficiently and effectively provide Security Vulnerability and Risk Assessment Services.

R, A I

4. Review and approve final practices, policies and procedures I R, A

5. Maintain practices, policies and procedures R, A I

6. Review and approve Provider-driven changes to practices, policies and procedures with HACLA for approval

R, A I

7. Provide Services in conformance with practices, policies and procedures R, A I

8. Conduct independent vulnerability and penetration testing of the Provider infrastructure

I R, A

9. Develop remediation plans in response to independent vulnerability and penetration testing findings

R, A C, I

10. Establish practices, policies and procedures to provide Security Vulnerability and Risk Assessment Services

R, A I

11. Conduct IT Infrastructure compliance testing R, A I

12. Conduct application vulnerability and penetration testing I R, A

13. Conduct physical vulnerability and penetration testing for the locations housing HACLA data processing equipment and portable media

R, A I

14. Provide HACLA vulnerability and penetration test results/report, including vulnerabilities identified, causes, implications, associated risks, expected date of fix and interim plan/options until a fix is available

R, A I

15. Agree on best course of action until fix is available and agree on plan to implement fix when available

R, A R, A

16. Apply fix in accordance with remediation plan R, A I

17. Validate fix and vulnerability remediation. Provide evidence of remediation. R, A I

Threat Discovery

18. Maintain up-to-date asset vulnerability inventories for all infrastructure elements to include network, server and operating system

R, A I


Security Vulnerability and Risk Assessment Services Roles and Responsibilities

Provider HACLA

19. Gather, consolidate and validate threat discoveries and announcements within agreed-upon time limits from the initial discovery/announcement

R, A I

20. Produce threat exposures given threat and asset vulnerability inventories. Production will occur within agreed-upon time limits from the time threat discovery is validated.

R, A I

21. Validate threat exposures I R, A

22. Evaluate and recommend vulnerability remediation tasking for each validated threat exposure

R, A I

23. Validate remediation tasks I R, A

24. Execute remediation tasks. Communicate remediation status. R, A I

25. Validate remediation I R, A

26. Perform regular security program risk assessment and provide HACLA a report inclusive of risk catalog (including but not limited to associated program and unit-level risks), threat assessment and recommended plan to remediate security vulnerabilities

R, A I

27. Review and approve remediation plan I R, A

28. Implement remediation plan R, A I

29. Validate remediation. Provide proof of remediation. R, A C, I

Security Incident Management Services are the activities associated with identification, classification, management and reporting of a security event.

Table 20. Security Incident Management Roles and Responsibilities

Security Incident Management Services Roles and Responsibilities Provider HACLA

1. Establish practices, policies and procedures to provide Security Incident Management Services

R, A I

2. Review and identify gaps in Service Provider's practices, policies and procedures

I R, A

3. Collaborate with HACLA in modifying practices, policies and procedures to address gaps while enabling the Provider to efficiently and effectively provide Security Incident Management Services

R, A I

4. Review and approve final practices, policies and procedures I R, A

5. Maintain practices, policies and procedures R, A I

6. Review and approve Provider-driven changes to practices, policies and procedures with HACLA for approval

R, A I

7. Provide services in conformance with practices, policies and procedures R, A I

Security Incident Management Services

8. Provide security incident priority level classification, descriptions and approach for managing and communicating incidents based on priority level

R, A I

9. Provide recommended changes to priority-level approach to ensure appropriate communication and management of incidents

I R, A

10. Modify security classification and management approach based on HACLA's required changes

R, A

11. Perform 24R, A7 Real-time Monitoring of logs and activity to detect malicious or abnormal behavior and network intrusions

R, A I


Security Incident Management Services Roles and Responsibilities Provider HACLA

12. Perform initial assessment of security incident. Upon discovery, mitigate damage, and escalate and communicate incident based on incident classification.

R, A I

13. Collect and review all log data collected for a security incident R, A I

14. Manage security incident until closure R, A I

15. Authorize security incident closure as established by HACLA C, I R, A

16. Remediate to reduce the impact of the security incident R, A I

17. Escalate product related threats to the Vendor for remediation R, A I

18. Escalate HACLA custom application related threats to HACLA R, A I

19. Develop a containment solution to security threats that do not have a clear remediation

R, A I

20. Review and approve containment solution I R, A

21. Implement containment solution R, A I

22. Communicate all security breaches to HACLA R, A I

23. Provide guidance in communicating breaches, and support investigations by HACLA security and external parties

R, A

24. Communicate breaches to external parties as required I R, A

25. Provide support to investigations by HACLA security and external parties when approved by HACLA

R, A I

26. Provide technical expertise for security investigations R, A I

27. Maintain the central repository of log files (including application- and system-specific log files) that stores data via an immutable media (e.g., CD-R, AOM, WOR, AM drive)

R, A I

28. Provide incident security reporting detailing any events: when it happened, who performed what actions, and the business impact of the event

R, A I

29. Provide metrics on the number of security incidents to an agreed-upon schedule

R, A I

30. Provide system, application or any other logs requested by HACLA in a real-time, read-only basis

R, A I

31. Provide forensics expertise I R, A

32. Support forensics activities R, A I

33. Provide procedures on engaging security teams in case of security incident R, A I

34. Approve procedures on engaging security teams in case of security incident

I R, A

35. Provide view into current incidents/cases that Provider is investigating (read-only access into Provider's case management tool)

R, A I

Security Compliance and Audit Services are the activities to identify the standards that the HACLA must comply with, and to modify practices, policies and procedures to enable compliance.

Table 21. Security Compliance and Audit Roles and Responsibilities

Security Compliance and Audit Roles and Responsibilities Provider HACLA

1. Identify regulatory, federal and industry or other applicable standards with which HACLA must comply

I R, A

2. Define practices, policies and procedural requirements to conform to standards

I R, A


Security Compliance and Audit Roles and Responsibilities Provider HACLA

3. Collaborate with Provider in adapting practices, policies and procedures to conform to standards

R, A R, A

4. Approve practices, policies and procedures defined by Provider C, I R, A

5. Implement practices, policies and procedures to conform to standards R, A I

6. Coordinate compliance certifications I R, A

7. Support compliance certification activities R, A I

8. Periodically verify compliance with practices, policies and procedures through an annual audit process

I R, A

9. Communicate non-compliance and remediation activities to HACLA R, A I

10. Address non-compliance of practices, policies and procedures R, A I

11. Support HACLA and other Third-Party compliance audits R, A I

12. Continuously assess regulatory, federal, state or industry compliance requirements and changes. Identify changes to practices, processes and procedures to comply.

I R, A

13. Communicate proposed changes to HACLA R, A C, I

14. Modify security practices, processes and procedures to maintain compliance

R, A I

1.4 Service Transition

1.4.1 Change Management

Change Management Services are activities to ensure that standardized methods and procedures are used for efficient and prompt handling of all changes, in order to minimize the impact of change upon Service quality and consequently to improve the day-to-day operations of HACLA. Change Management covers all aspects of managing the introduction and implementation of all changes affecting all Towers and in any of the management processes, tools and methodologies designed and utilized to support the Tower components. The Change Management processes and activities are inter-related and complementary with Release Management and Configuration Management, as well as Incident Management and Problem Management. The Change Management process includes the following process steps:

Determining metrics for measuring effectiveness of a change

Request for technical change (RTC) process

Recording/tracking process

Prioritization process

Responsibility assignment process

Impact/risk assessment process

Participation in IT service continuity and DR planning

Coordination of the IT Operations Committee

Review/approval process

Establishing and managing the schedule of approved changes

Implementation process

Verification (test) process

Closure process


The following table identifies Change Management roles and responsibilities that Provider and HACLA will perform.

Table 22. Change Management Roles and Responsibilities

Change Management Roles and Responsibilities Provider HACLA

1. Define Change Management policies and requirements, including change priority schema and classifications, per the Change Management process components outlined above

R, A C

2. Develop Change Management procedures and processes per the Change Management process components outlined above

R, A I

3. Participate in the development of the Change Management and IT Operations Committee procedures, policies and approval authorities

I R, A

4. Review and approve Change Management process, procedures and policies

I R, A

5. Receive and document all RTCs and classify proposed changes to the Services, which shall include change cost, risk impact assessment and system(s) security considerations

R, A I

6. Review and validate that RTCs comply with Change Management policies, procedures and processes

I R, A

7. Ensure that appropriate back-out plans are documented and in place in the event of systems failure as a result of the change

R, A I

8. Provide Change Management plan to HACLA for review R, A I

9. Approve Change Management plan I R, A

10. Develop and maintain a schedule of planned approved changes (Forward Schedule of Changes [FSC]) for HACLA to review

R, A I

11. Coordinate, schedule and conduct IT Operations Committee meetings to include review of planned changes and results of changes made, ensuring that all appropriate parties are invited and represented in accordance with approved It Operations Committee policies

R, A I

12. Participate in It Operations Committee meetings as HACLA deems appropriate or necessary

I R, A

13. Provide change documentation as required, including proposed metrics as to how effectiveness of the change will be measured

R, A I

14. Review and approve change documentation and change effectiveness metrics

I R, A

15. Review and approve any RTC determined to have a cost, security or significant risk impact to HACLA's IT systems or business

I R, A

16. Authorize and approve scheduled changes or alter the schedule change requests as defined in the Change Management procedures

I R, A

17. Publish and communicate the approved FSC to all appropriate IT and business unit stakeholders within HACLA of change timing and impact

R, A C, I

18. Oversee the approved change build, test and implementation processes to ensure these activities are appropriately resourced and completed according to change schedule

R, A I

19. Ensure that thorough testing is performed prior to release and assess HACLA business risk related to any change that is not fully tested prior to implementation

R, A C, I

20. Participate in business risk assessment for change to be introduced without being fully tested

R, A I

21. Monitor changes, perform change reviews and report results of changes, impacts and change effectiveness metrics

R, A I


Change Management Roles and Responsibilities Provider HACLA

22. Verify that change met objectives based upon predetermined effectiveness metrics, and determine follow-up actions to resolve situations where the change failed to meet objects

R, A I

23. Review and approve Change Management results I R, A

24. Close out RTCs that met the change objectives or changes that were abandoned

R, A I

25. Perform Change Management quality control reviews and audits of Change Management processes and records

C, I R, A

26. Provide HACLA Change Management reports as required and defined by HACLA

R, A C, I

1.4.2 Configuration Management

Configuration Management Services are the activities associated with providing a logical model of the Service Towers' devices or assets (including software licenses) and their relationships by identifying, controlling, maintaining and verifying installed hardware, software and documentation (i.e., maintenance contracts, SLR documents, etc.). The goals are to account for all IT assets and configurations, provide accurate information on configurations, provide a sound basis for Incident, Problem, Change and Release Management, and to verify configuration records against the infrastructure and correct any exceptions. The following table identifies the Configuration Management roles and responsibilities that Provider and HACLA will perform.

Table 23. Configuration Management Roles and Responsibilities

Configuration Management Roles and Responsibilities Provider HACLA

1. Define Configuration Management requirements and policies R, A C

2. Develop, document and maintain in the Standards Process and Procedures Manual Configuration Management procedures that meet requirements and adhere to defined policies

R, A I

3. Review and approve Configuration Management procedures, processes and policies

I R, A

4. Identify and document the configuration item structure R, A I

5. Approve the configuration item structure I R, A

6. Establish Configuration Management database, in accordance with HACLA requirements

R, A I

7. Review and approve Configuration Management database I R, A

8. Select and provide Configuration Management tools R, A C

9. Install and maintain Configuration Management tools R, A I

10. Enter/upload configuration data into configuration database R, A I

11. Establish process interfaces to Incident and Problem Management, Change Management, technical support, maintenance and Asset Management processes

R, A I

12. Establish appropriate authorization controls for modifying configuration items and verify compliance with software licensing

R, A I

13. Establish guidelines for physical and logical separation between development, test and production and the process for deploying and back-out of configuration items

R, A C

14. Develop procedures for establishing configuration baselines as reference points for rebuilds, and provide ability to revert to stable configuration states

R, A I


Configuration Management Roles and Responsibilities Provider HACLA

15. Develop procedures for establishing security baselines as reference points for rebuilds, and provide ability to revert to stable configuration states

R, A I

16. Establish procedures for verifying the accuracy of configuration items, adherence to Configuration Management process and identifying process deficiencies

R, A I

17. Provide a deficiency report and steps taken to address the issues identified

R, A I

18. Provide HACLA Configuration Management reports as required and defined by HACLA

R, A I

19. Audit Configuration Management process and accuracy of configuration data

I R, A

1.4.3 Acquisition and Management

Acquisition and Management Services are the activities associated with the pricing, evaluation (technical and costing), selection and acquisition of new and upgraded Service Tower components (e.g., hardware, software, circuits). The following table identifies the Acquisition and Management roles and responsibilities that Provider and HACLA will perform.

Table 24. Acquisition and Management Roles and Responsibilities

Acquisition and Management Roles and Responsibilities Provider HACLA

1. Define Acquisition and Management requirements and policies R, A C

2. Develop, document and maintain in the Standards and Procedures Manual Acquisition and Management procedures that meet requirements and adhere to defined policies

R, A I

3. Review and approve Acquisition and Management procedures I R, A

4. Develop and maintain list of preferred suppliers/vendors I R, A

5. Approve list of preferred suppliers/vendors I R, A

6. Develop and issue acquisition bid requests as required and approved by HACLA

I R, A

7. Establish audit procedures to ensure compliance with best practices and best pricing

I R, A

8. Perform periodic audits of procurement procedures R, A I

9. Assist in periodic audits of procurement procedures I R, A

10. Evaluate proposals against clearly defined objective criteria I R, A

11. Negotiate contracts for Provider-purchased/leased Service Tower-related components

I R, A

12. Negotiate contracts for HACLA-purchased/leased Service Tower-related components

I R, A

13. Manage the ordering, procurement and delivery processes in compliance with HACLA procurement and acceptance processes

I R, A

14. Manage and track Provider purchase orders and service orders I R, A

15. Coordinate delivery and installation of new products and services, as required

R, A I

16. Ensure that new equipment/hardware complies with established HACLA IT standards and architectures

R, A I

17. Review and approve selection of hardware to be installed in HACLA facilities and software to be installed on HACLA hardware

S R, A

18. Review and approve acquisition acceptance process I R, A

19. Adhere to HACLA acquisition acceptance process R, A C, I


Acquisition and Management Roles and Responsibilities Provider HACLA

20. Terminate, dispose of and relocate assets as needed/specified, and provide disposition reports as needed

R, A C, I

1.4.4 Asset Management

Asset Management Services are the activities associated with process of the ongoing management and tracking of the life cycle of existing, Service Tower components (e.g., hardware, software and software licenses, maintenance, circuits) and their attributes (i.e., location, costs, depreciation, contracts, vendor, serial numbers, etc.). The following table identifies Asset Management roles and responsibilities that Provider and HACLA will perform.

Table 25. Asset Management Roles and Responsibilities

Asset Management Roles and Responsibilities Provider HACLA

1. Define Asset Management requirements and policies R, A C

2. Recommend improvements to Asset Management requirements and policies

R, A C, I

3. Develop, document and maintain in the Standards and Procedures Manual Asset Management process and procedures that meet requirements and adhere to defined policies

R, A C, I

4. Review and approve Asset Management process, procedures and policies

C, I R, A

5. Deploy an Asset Management system that meets HACLA requirements and adheres to defined policies

C, I R, A

6. Maintain and manage an Asset Management system that meets HACLA requirements and adheres to defined policies

R, A C, I

7. Manage life cycle of all assets from identification, requisition ordering, inventory, installation and maintenance to disposal

R, A I

8. Develop asset type list and attributes that would be included in the Asset Management system

R, A C, I

9. Review asset type list and attributes and maintain asset types and attributes in the Asset Management system

R, A I

10. Provide HACLA inquiry and reporting access into the Asset Management system for all assets

R, A I

11. Maintain the accuracy of the data of in-scope assets in the Asset Management system, according to SLRs

R, A I

12. Provide electronic feed file of asset data for various HACLA-defined systems (e.g., financial system, HACLA internal billing system)

R, A I

13. Establish, update and maintain the asset database to include, at a minimum, the following asset attributes: Manufacturer Model Serial number Identification number Location Ownership information (Provider/HACLA — lease/purchase) Cost information Maintenance information and history, including the age of the asset Warranty information Other billing information (e.g., lease information, HACLA-specific

information) Transaction edit history (e.g., locations, billing and user)

R, A I

14. Update in-scope asset records related to all approved change activities (e.g., install/move/add/change activities, break/fix activities, company reorganization and Change Management)

R, A I


Asset Management Roles and Responsibilities Provider HACLA

15. Perform ongoing physical asset audit, in accordance with Asset Management SLRs, to validate that data in the database is accurate and current

R, A I

16. Provide reports of Asset Management audit results R, A I

17. Provide and, upon HACLA approval, implement Asset Management remediation plan for Asset Management deficiencies

R, A I

18. Review and approve audit reports and remediation plans of asset inventory management information

C, I R, A

19. Provide reports of HACLA asset financial information including depreciation, maintenance contracts and value of assets

R, A I

20. Conduct periodic/ad hoc quality assurance audit of Asset Management system

I R, A

1.4.5 Software License Management

Software License Management Services are the activities associated with the identification, acquisition and disposal as well as ongoing management and tracking of software and their corresponding licenses. The following table identifies the Software License Management roles and responsibilities that Provider and HACLA will perform.

Table 26. Software License Management Roles and Responsibilities

Software License Management Roles and Responsibilities Provider HACLA

1. Define Software License Management requirements and policies R, A C, I

2. Recommend improvements to Software License Management requirements and policies

R, A I

3. Develop, document and maintain in the Standards and Procedures Manual Software License Management procedures that meet requirements and adhere to defined policies as mapped to Asset Management

R, A I

4. Review and approve Software License Management processes, procedures and policies

I R, A

5. Manage and maintain (e.g., monitor, track status, verify, audit, perform contract compliance, reassign) software licenses and media through software license life cycle

R, A C, I

6. For HACLA-retained contracts, be responsible for procurement, renewal and upgrade costs, and vendor agreements

I R, A

7. For non-HACLA-retained contracts, be responsible for procurement, renewal and upgrade costs, and vendor agreements

R, A C, I

8. Develop and maintain inventory of all Software licenses within the Asset Management system

R, A I

9. Report to HACLA on any exceptions to Vendor terms and conditions including license non-compliance

R, A I

10. Periodically (at least yearly), conduct software license and maintenance agreements review, allowing for sufficient time prior to expiration for negotiations

R, A I

11. Participate in software license and maintenance agreements review C R, A

12. Provide HACLA with reports and recommendations to use in making software acquisition and discontinuance decisions

R, A I

13. Provide recommendations to purchase additional license allocation, recommending alternatives or curtailing usage where necessary and appropriate, to restore or continue to maintain license compliance

R, A I

14. Identify and report license compliance issues to HACLA and provide recommendations to resolve the compliance issue

R, A I

15. Review license compliance issues and document completed resolution C R, A


Software License Management Roles and Responsibilities Provider HACLA

16. Manage and perform audits and reconcile the number of licenses to the number of installs, as requested by HACLA

R, A I

17. Provide recommendations to HACLA to resolve any software reconciliation issues

R, A I

18. Report on resolution to software reconciliation issues I R, A

19. Obtain approval from HACLA for any license change or replacement R, A I

1.4.6 Release Management

Release Management is concerned with implementing the changes to defined IT services and covers both the software and the hardware. Release Management Services are activities that take a holistic view of a change to a Service to ensure that the technical and non-technical aspects of a release related to software and hardware changes. These changes can be implemented by rolling out a combination of new applications or infrastructure software and/or upgraded or new hardware, or simply by making changes to the documentation, such as service hours or support arrangements. Release Management processes and activities are inter-related and complementary with the Change Management process, as well as Configuration Management and Problem Management. Release Management includes the following activities: Establishing standardized Release Management policies and procedures Managing release planning and scheduling for the overall release schedule, as well as for individual

releases Establishing and managing release documentation and identification schema Managing the release design, build, and configuration processes Release testing and testing management Rollout planning including quality plans and back-out plans Release communication, preparation and training Managing the successful roll out/distribution and installation of all elements of a release Documenting each release and updating the Configuration Management Database (CMDB).

Releases can also consist of a number of problem fixes and enhancements to existing IT services. A release consists of the new or changed software required and any new or changed hardware needed to implement the approved changes. Releases are generally divided into:

Major software releases and hardware upgrades or replacements, normally containing large areas of new functionality. A major upgrade or release usually supersedes all preceding minor upgrades, releases and emergency fixes.

Minor software releases and hardware upgrades, normally containing small enhancements and fixes, some of which may have already been issued as emergency fixes. A minor upgrade or release usually supersedes all preceding emergency fixes.

Emergency software and hardware fixes, normally containing the corrections to a small number of known problems.

The following table identifies Release Management roles and responsibilities that Vendor and HACLA will perform.

Table 27. Release Management Roles and Responsibilities

Release Management Roles and Responsibilities Provider HACLA

1. Define Release Management policies and requirements per the Release Management process components outlined above

R, A C

2. Develop Release Management procedures and processes per the Release Management process components outlined above

R, A I



3. Participate in the development of the Release Management process and procedures and policies

I R, A

4. Review and approve Release Management process, procedures and policies

I R, A

5. Establish and maintain an appropriate secure environment(s) where all authorized versions of all software, in physical or electronic form as applicable (Definitive Software Library [DSL]) and where all hardware spares (Definitive Hardware Store [DHS]) are stored, protected and accounted

R, A I

6. Maintain master copies of all new versions of software (both COTS software packages and application developed custom-built software) in the secured DSL and update configuration item.

R, A I

7. Ensure that all hardware spares are secured in the DHS and reflected in the Configuration Management database(s)

R, A I

8. Establish, manage, update and maintain the overall release plan and release schedule for all planned releases

R, A I

9. Establish and administer the version control schema as it relates to Release Management of HACLA custom applications

R, A I

10. Develop, manage, update and maintain formal release plans for each release in coordination with Change Management

R, A I

11. Develop quality plans and back-out plans as appropriate for each release

R, A I

12. Provide Release Management plans and schedules to HACLA for review

R, A I

13. Review and approve Release Management plans and schedules I R, A

14. Conduct site surveys, as necessary, to assess existing hardware and software being used to validate release package requirements and dependencies

R, A C, I

15. Plan resource levels and requirements for supporting a release R, A C, I

16. Ensure that any new software, hardware or support services required for the release are procured and available when needed

R, A C, I

17. Ensure that all necessary testing environments are available and properly configured to support release testing

R, A C, I

18. Ensure there is segregation of duties between the application developer testers and the Release Management testers

R, A C, I

19. Conduct post-deployment testing as required R, A C, I

20. Schedule and conduct Release Management meetings to include review of planned releases and results of changes made

R, A C, I

21. Identify and document all Configurable Items (CIs) that need to be included in the release, as well as all system interdependencies

R, A C, I

22. Plan and manage the acceptance testing process for each release R, A C, I

23. Review and approve release acceptance testing plans C, I

24. Provide release documentation as required R, A C, I

25. Authorize and approve scheduled releases or alter the schedule as defined in the Release Management procedures

C, I

26. Review Release Management details and alter as appropriate to meet the needs of the HACLA (e.g., back out plan, go/no-go decision)

R, A C, I



27. Notify HACLA-affected HACLAs of release timing and impact, and provide communications to the service desk

R, A C, I

28. Implement release in compliance with Change Management requirements and adherence to detailed release plans

R, A C, I

29. Modify configuration database, asset management items and service catalog (if applicable) to reflect changes to CIs due to the release

R, A C, I

30. Conduct post-mortem of releases that necessitated implementation of the back-out plan, and develop and implement appropriate corrective or follow-up actions to minimize future occurrences

R, A C, I

31. Perform quality control audits and approve release control results I R, A

32. Provide HACLA Release Management reports as required and defined by HACLA

R, A C, I

1.4.7 Integration

Integration Services are the activities associated with ensuring that all individual IT components configured with or added to the IT environment work together cohesively to achieve the intended results. The following table identifies the Integration roles and responsibilities that Provider and HACLA will perform.

Table 28. Integration Roles and Responsibilities

Integration Roles and Responsibilities Provider HACLA

1. Define Integration requirements and policies R, A C, I

2. Develop, document and maintain in the Standards and Procedures Manual Integration procedures that meet requirements and adhere to defined policies

R, A C, I

3. Review and approve Integration processes, procedures and policies I R, A

4. Manage and schedule Integration test environment R, A I

5. Maintain software release matrices across development, QA and production environments and networks

R, A I

6. Validate and approve the software release matrix I R, A

7. Evaluate all new and upgraded Service Tower components or Services for compliance with HACLA security policies, regulations and procedures

R, A C, I

8. Validate new and upgraded Service Tower components or Services for compliance with HACLA security policies, regulations and procedures, as required

C, I R, A

9. Assess and communicate the overall impact and potential risk to Service Tower components prior to testing completion

R, A

10. Define Integration test requirements R, A C, I

11. Define Integration acceptance requirements R, A

12. Conduct Integration and security testing for all new and upgraded equipment, networks, software or services to include unit, system, integration and regression testing, based on requirements defined in requirements and design documents

R, A C, I

13. Stage new and upgraded equipment, software or services to smoothly transition into existing environment, based on requirements defined in requirements and design documents

R, A C, I

14. Perform modifications and performance-enhancement adjustments to HACLA system software and utilities as a result of changes to architectural standards or additions and upgrades to the environment

R, A C, I


Integration Roles and Responsibilities Provider HACLA

15. Test new releases of supported hardware and software to ensure required performance and functionality is maintained in conformance with HACLA SLRs

R, A C, I

16. Provide middleware required to integrate software and hardware I R, A

17. Support middleware required to integrate software and hardware R, A C, I

18. Provide Integration of application software R, A C, I

19. Perform Configuration Management and Change Management activities related to Integration and testing

R, A C, I

20. Accept and approve impact and risk analysis prior to testing completion I R, A

1.4.8 Implementation and Migration

Implementation and Migration Services are the activities associated with the installation of new and upgraded IT components (e.g., hardware, software [operating system] and network components). The following table identifies the Implementation and Migration roles and responsibilities that Provider and HACLA will perform.

Table 29. Implementation and Migration Roles and Responsibilities

Implementation and Migration Roles and Responsibilities Provider HACLA

1. Define Implementation and Migration requirements and policies R, A C, I

2. Develop, document and maintain in the Standards and Procedures Manual Implementation and Migration procedures that meet requirements and adhere to defined policies, including post-deployment verification and back-out plans

R, A I

3. Review and approve Implementation and Migration processes, procedures and policies

I R, A

4. Notify HACLA of equipment migration and redeployment plans and needs

R, A C

5. Coordinate and review all Implementation and Migration plans and schedules with HACLA in advance, in accordance with Change Management policies

R, A I

6. Approve Implementation and Migration plans and schedules I R, A

7. Conduct pre-installation site surveys, as required R, A I

8. Install enhancements to technical architecture or Services provided R, A I

9. Install new or enhanced Service Tower components (e.g., hardware, software, middleware, utilities, networks, peripherals, configurations) in accordance with HACLA Change Management procedures

R, A I

10. Perform Service Tower component upgrades as a result of new and enhanced applications and architectures, and HACLA upgrade plans and requirements (e.g., hardware, software, middleware, utilities, networks, peripherals, configurations) in accordance with HACLA Change Management procedures

R, A I

11. Install physical infrastructure as required (e.g., wiring, cable plant, cooling, etc.) in accordance with HACLA Change Management procedures

R, A I

12. Coordinate Implementation and Migration support activities with HACLA IT staff and Provider help desk

R, A I

13. Perform data migration and conversion by electronic or manual methods as a result of implementation or migration (e.g., databases, network system management repositories, address tables, Management Information Bases [MIBs])

R, A I


Implementation and Migration Roles and Responsibilities Provider HACLA

14. Perform appropriate tests on all installs, moves, adds and changes per requirements, in accordance with HACLA Change Management procedures

R, A I

15. Document post-deployment verification and back-out plans and results per requirements

R, A I

16. Review and approve post-deployment verification and back-out plans and results

I R, A

17. Conduct post-deployment verification plans and results per requirements

R, A I

18. Review initial post-deployment verification results and decide if back out is required

I R, A

19. Conduct back out if required R, A I

20. Provide HACLA IT technical staff and End Users with training related to the implementation of new products and Services per requirements

R, A I

1.4.9 Training and Knowledge Transfer

Training and Knowledge Transfer Services consist of the following three types of training Provider will provide: Training for the improvement of skills through education and instruction for Provider's staff. Provider

will participate in any initial and ongoing training delivered by HACLA as required that would provide a learning opportunity about HACLA's business and technical environment.

Training for HACLA-retained technical staff for the express purpose of exploiting the functions and features of the HACLA computing environment. Delivery methods may include classroom-style, computer-based, individual or other appropriate means of instruction.

Selected classroom-style and computer-based training (case-by-case basis) for standard COTS and Software as a Service (SaaS) applications, including new employee training, upgrade classes and specific skills.

The following table identifies the Training and Knowledge Transfer roles and responsibilities that Provider and HACLA will perform.

Table 30. Training and Knowledge Transfer Roles and Responsibilities

Training and Knowledge Transfer Roles and Responsibilities Provider HACLA

1. Define Training and Knowledge Transfer requirements and policies R, A C, I

2. Develop, document and maintain in the Standards and Procedures Manual Training and Knowledge Transfer procedures that meet requirements and adhere to defined policies

R, A C, I

3. Review and approve Training and Knowledge Transfer processes, procedures and policies

I R, A

4. Develop and deliver training program to instruct HACLA personnel on the provision of Provider Services (e.g., "rules of engagement," requesting Services)

R, A C, I

5. Review and approve Provider-developed training program I R, A

6. Develop, implement and maintain a HACLA-accessible knowledge database/portal

R, A C, I

7. Develop and implement Knowledge Transfer procedures to ensure that more than one individual understands key components of the business and technical environment

R, A C, I

8. Participate in HACLA-delivered instruction on the business and technical environment

R, A C, I


Training and Knowledge Transfer Roles and Responsibilities Provider HACLA

9. Develop, document and deliver training requirements that support the ongoing provision of HACLA Services, including refresher courses as needed and instruction on new functionality

R, A C, I

10. Take training classes as needed to remain current with systems, software, features and functions for which help desk support is provided, in order to improve Service performance (e.g., First-Contact Resolution)

R, A C, I

11. Provide training when substantive (as defined between HACLA and Provider) technological changes (e.g., new systems or functionality) are introduced into HACLA environment, in order to facilitate full exploitation of all relevant functional features

R, A C, I

12. Provide training materials for HACLA technical staff for Level 1-supported applications

R, A C, I

13. Provide ongoing training materials for help desk personnel on HACLA business and technical environments, as defined by HACLA

R, A C, I

14. Provide HACLA-selected classroom-style and computer-based training (case-by-case basis) for standard COTS applications, as requested by HACLA

R, A C, I

1.4.10 Documentation

Documentation Services are the activities associated with developing, revising, maintaining, reproducing and distributing Service Tower information in hard copy and electronic form. The following table identifies the Documentation roles and responsibilities that Provider and HACLA will perform.

Table 31. Documentation Roles and Responsibilities

Documentation Roles and Responsibilities Provider HACLA

1. Recommend Documentation requirements and formats R, A C, I

2. Define Documentation requirements, formats and policies including the timing of document creating and updates (e.g., monthly)

I R, A

3. Develop, document and maintain in the Standards and Procedures Manual Documentation procedures that meet requirements and adhere to defined policies

R, A I

4. Review and approve Documentation requirements, formats and policies

I R, A

5. Provide output in agreed format for support of activities throughout the life cycle of Services, as specified in each Service Tower

R, A I

6. Document system specifications and configurations (e.g., interconnection topology, configurations, network diagrams, data flow diagram, system maps)

R, A I

7. Provide HACLA-specific operating requirements I R, A

8. Document standard operating procedures (e.g., boot, failover/disaster recovery/COOP, spool management, batch processing, backup)

R, A I

9. Review and approve standard operation procedures Documentation I R, A

10. Document job production and maintenance schedules R, A I

11. Review and approve job production and maintenance schedules and Documentation

I R, A


1.5 Service Operations

1.5.1 Incident Management

Incident Management includes the activities associated with restoring normal service operation as quickly as possible and minimizing the adverse impact on business operations of HACLA, thus ensuring that the best possible levels of service quality and availability are maintained. While the Incident Management processes apply to Level 1, Level 2 and Level 3 support groups, Level 1 support — normally at the service desk — is responsible for primary ownership of recording and tracking the Incident. It is also responsible for the close coordination and ongoing monitoring and tracking of, and reporting on, incidents that have been escalated to second-level and third-level support groups, to ensure that escalated incidents are resolved as promptly as possible. The primary activities of Incident Management process include:

Incident detection and recording

Incident classification and initial support

Incident investigation and diagnosis

Incident escalation

Incident resolution and recovery

Incident closure

The Vendor shall be responsible for escalating incidents and coordinating with all appropriate Level 2 and Level 3 support groups, to ensure knowledge capture and transfer regarding incident resolution procedures from Vendor's Level 1 service desk to support the objective of increasing the first call resolution number of incidents capable of being resolved by Level 1 service technicians. The following table identifies the Incident Management roles and responsibilities that Vendor and HACLA will perform.

Table 32. Incident Management Roles and Responsibilities

Incident Management Roles and Responsibilities Provider HACLA 1. Establish criteria for Incident Management support requirements,

including equipment and services to be covered, priority levels, definitions and characteristics, incident classification and prioritization schema, and escalation requirements.

I R, A

2. Develop Incident Management policies, process and procedures that support HACLA's Incident Management support requirements

R, A I

3. Review and approve Incident Management policies and procedures I R, A 4. Provide an Incident Management system and knowledge management

database, including all hardware, software, databases, automated monitoring tools, and management and reporting tools, which are acceptable to HACLA

I R, A

5. Maintain and manage an Incident Management system and knowledge management database, including all hardware, software, databases, automated monitoring tools, and management and reporting tools, which are acceptable to HACLA

R, A C, I

6. Provide unrestricted read access by HACLA-authorized staff and other personnel to all current and historical incident records and knowledgebase data

R, A C, I

7. Monitor the Incident Management system for automatically generated and logged incident alerts and events

R, A C, I

8. Resolve incidents on the first call in accordance with the Procedures Manual, knowledge database documents and configuration database(s)

R, A C, I

9. Log all calls/queries with the service desk R, A C, I 10. Identify, filter and classify events and incidents to a priority level and

handle according to agreed-upon incident response procedures R, A C, I


Incident Management Roles and Responsibilities Provider HACLA 11. Diagnose and resolve incidents; where possible use desktop remote-

control capability — with user's approval and disconnecting when complete. Where possible, implement appropriate corrective actions for known errors (e.g., workarounds for known unresolved problems)

R, A I

12. Escalate incidents to the appropriate next-level service group within Vendor, HACLA, or Third-Party Service Vendor as soon as it is clear that the incident is unable to be resolved without additional assistance, or as required to comply with service-level response times

R, A I

13. Monitor and track incident resolution progress through to final closure and record/update incident record status as appropriate

R, A I

14. Provide expert functional and process assistance for in-scope applications at Level 1 and escalate to Level 2 or 3 resource as required

R, A I

15. Provide Level 1 assistance to inquiries on the features, functions and usage of hardware and software for all in-scope hardware and software

R, A I

16. Provide Level 1 support for applications software on the supported applications. Level 1 support is limited to approved scripts.

R, A I

17. Propose training and Level 1 scripts and workarounds for the service desk for applications software on the approved list

R, A I

18. Approve training and Level 1 scripts and workarounds for the service desk for applications software on the approved list

C, I R, A

19. Provide Level 2 and Level 3 support for applications software on the supported applications list

R, A I

20. Verify that all records (e.g., inventory, asset and Configuration Management records) are updated to reflect completed/resolved incident

R, A I

21. Assist End Users with questions relating to functionality and use of in-scope End-User hardware and software

R, A I

22. Document solutions to resolved incidents in central knowledgebase. Accurately update all information pertinent to trouble ticket, including general verbiage, codes.

R, A I

23. Notify designated HACLA personnel of all Priority 1 and Priority 2 incidents within the designated time frame

R, A I

24. Contact designated HACLA business personnel of applicable Priority 1 and Priority 2 incidents

I R, A

25. Maintain current and historical records of all calls and the resolution of those calls for the life of the contract and provide reporting and trend capabilities

R, A I

26. Troubleshoot, diagnose and resolve incidents for all in-scope hardware and software warranty and non-warranty devices, including removing and/or repairing physically broken or inoperable devices

R, A I

27. Provide dispatch for in-scope End-User devices for all in-scope devices, and repair as required

R, A I

28. Provide end-to-end Incident Identification, Escalation and Resolution Management, and a closure process including the management of those tickets escalated to Third Parties

R, A I

29. Determine wherever possible whether a problem should be opened to address an incident

R, A I

30. Track ongoing status of any incident and their corresponding problem record to ensure that identified problems are addressed and resolved

R, A I

31. Ensure incident resolution activities conform to defined Change Management procedures set forth in the Process and Procedures Manual

R, A I

32. Coordinate and take ownership of incident resolution across all IT service areas with HACLA and Third Parties (e.g., public carriers, Internet service providers, Third-Party providers, etc.)

R, A I


Incident Management Roles and Responsibilities Provider HACLA 33. Periodically review the status of open, unresolved incidents and

related problems and the progress being made in addressing problems

R, A I

34. Participate in problem management review sessions as appropriate R, A I

35. Conduct incident review sessions and provide listing and status of same categorized by incident priority impact

R, A I

36. Participate in Incident Management review sessions I R, A 37. Coordinate with HACLA and Third-Party Level 2 support groups to

acquire and transfer knowledge on incident and problem resolutions, and record this knowledge gained into the knowledge base to facilitate increased ability for Vendor's Level 1 service desk in providing first-call resolution

R, A I

38. Conduct follow-up with End Users who reported the incident to verify that the incident was resolved to the End User's satisfaction

R, A I

39. Close out incidents that were resolved satisfactorily R, A I

40. Provide Incident Management reporting as required R, A I

1.5.2 Problem Management Services

The Vendor shall provide Problem Management Services to minimize the adverse impact of incidents and problems on the business, caused by errors within the IT Infrastructure, and to prevent recurrence of incidents related to these errors by determining the unknown underlying cause (e.g., root cause) of one or more incidents. Ensuring that actions are initiated to improve or correct the situation. The Vendor shall provide reactive problem management services by diagnosing and solving problems in response to one or more incidents that have been reported through Incident Management. Provide proactive Problem Management to identify and solve problems and known errors before incidents occur, including performing predictive analysis activities, where practical, to identify potential future problems, develop recommended mitigation plans, and implement approved corrective mitigation actions and processes. The Vendor will also maintain, update and disseminate information about problems and the appropriate workarounds and resolutions, so that the number and impact of incidents occurring within HACLA's IT Infrastructure is reduced over time. The major activities of Problem Management are: Problem control Error control Proactive prevention of problems Performing major problem reviews Providing Problem Management reporting

The Vendor shall provide Problem Management services for all identified problems that are determined to be related to IT systems and services under the control of the Vendor. The Vendor shall also provide coordination and assistance to HACLA and Third-Party Vendors in performing their Problem Management process. The Vendor is also responsible for ensuring that resolutions to problems are implemented through the appropriate control procedures, especially Change Management and Release Management. The Vendor must coordinate Problem Management activities with the various teams within the Vendor, HACLA and Third-Party Vendors responsible for performing Configuration Management, Availability Management, Capacity Management, IT Service Continuity Management and Service-Level Management activities. The following table identifies the Problem Management roles and responsibilities that Vendor and HACLA will perform.


Table 33. Problem Management Roles and Responsibilities

Problem Management Roles and Responsibilities Provider HACLA 1. Define requirements and policies for Problem Management (e.g., events that

trigger a root-cause analysis [RCA], categorization and prioritization schema, etc.)

I R, A

2. Participate in developing Problem Management requirements and policies R, A I 3. Develop appropriate process and procedures and methodologies that

support HACLA-approved Problem Management requirements and policies that comply with HACLA requirements

R, A I

4. Approve appropriate process and procedures and methodologies that support HACLA-approved Problem Management requirements and policies that comply with HACLA requirements

I R, A

5. Implement appropriate process, procedures and methodologies that support HACLA-approved Problem Management requirements and policies that comply with HACLA requirements

R, A I

6. Establish and maintain a Problem Management knowledgebase that is accessible to HACLA, where information about problems, root cause, known errors, workarounds and problem resolution actions are recorded and tracked. This knowledgebase can be the same as that used by Incident Management.

R, A I

7. Provide unrestricted access by HACLA-authorized staff and other HACLA-designated personnel to all current and historical Problem Management records and knowledgebase data

R, A I

8. Ensure Problem Management activities conform to defined Change Management procedures set forth in the Procedures Manual

R, A I

9. Coordinate with appropriate Incident Management teams and take ownership of Problem Management activities of all problems determined to reside in the Vendor's service area of responsibility (e.g., detection, logging, RCA, etc.)

R, A I

10. Coordinate, escalate and track Problem Management activities within HACLA and Third Parties related to problems determined to reside in all IT Infrastructure areas

R, A I

11. Flag all incidents that require further RCA to be conducted (i.e., Priority 1 and Priority 2 incidents), per the agreed-to procedures

R, A I

12. Ensure that recurring problems that meet defined criteria related to the Vendor's IT service responsibility area are reviewed using RCA procedures

R, A I

13. Conduct proactive trend analysis of incidents and problems, and other data elements to identify recurring situations that are or may be indicative of future problems and points of failure

R, A I

14. Track and report on problems and trends or failures, and identify associated consequences of problems

R, A I

15. Develop and recommend corrective actions or solutions to address recurring incidents and problems, as well as mitigation strategies and actions to take to avert potential problems identified through trend analysis

R, A I

16. Identify, develop, document and recommend appropriate workarounds for known errors of unresolved problems, and notify Incident Management and all other appropriate stakeholders of its availability if approved. Document the workaround in the knowledgebase.

R, A I

17. Review and approve workarounds for implementation, as appropriate I R, A 18. Coordinate and monitor status of RCA activities performed by HACLA and

Third-Party Vendors (i.e., from other IT service areas) R, A I

19. Document and update Problem Management knowledgebase with information regarding problem resolution actions, activities and status (e.g., root cause, known errors, workarounds, etc.) and notify all appropriate stakeholders of availability of information

R, A I


Problem Management Roles and Responsibilities Provider HACLA 20. Coordinate with HACLA and Third-Party Service Vendors to ensure that

knowledge on problems related to other IT service areas is captured and entered into a centralized Problem Management knowledgebase

R, A I

21. Ensure problem resolution activities conform to defined Change Management procedures set forth in the Process and Procedures Manual

R, A I

22. Provide status reports detailing the root cause and procedure for correcting recurring problems as well as Priority 1 and Priority 2 incidents until closure, as determined by HACLA

R, A I

23. Conduct Problem Management review meetings and provide listing and status of same categorized by problem impact

R, A I

24. Participate in Problem Management review meetings, and review and approve recommendations for actions, where appropriate

I R, A

25. Periodically review the state of open incidents and related problems, and the progress being made in addressing Problems

R, A I

26. Participate in and review and approve as appropriate all Problem Management-generated RTCs, as part of the Change Management

I R, A

27. Create RTC documentation with recommended corrective actions to be taken to resolve a problem and submit to HACLA for review and approval

R, A I

28. Conduct periodic Problem Management proactive review sessions R, A I

29. Provide Problem Management reporting as required R, A I

1.5.3 Operations and Administration

Operations and Administration Services are the activities associated with providing a stable IT Infrastructure, and with effectively and efficiently performing procedures to ensure IT services meet SLR targets and requirements. The following table identifies the Operations and Administration roles and responsibilities that Provider and HACLA will perform.

Table 34. Operations and Administration Roles and Responsibilities

Operations and Administration Roles and Responsibilities Provider HACLA

1. Provide Operations and Administration requirements and policies, including schedules for the operation of HACLA Service Tower components

R, A C, I

2. Develop, document and maintain in the Standards and Procedures Manual Operations and Administration procedures that meet requirements and adhere to defined policies

R, A I

3. Develop operational documentation (i.e., Run Books, Contact Lists, Operations scripts, etc.) that meets HACLA requirements

R, A I

4. Review and approve Operations and Administration procedures and operational documentation

I R, A

5. Provide Enterprise System Management tools to monitor the IT Infrastructure and HACLA applications

I R, A

6. Coordinate with HACLA to deploy enterprise Service Tower component management tools to monitor the IT Infrastructure and HACLA applications

R, A I

7. Install and configure enterprise Service Tower component management tools in such a fashion that problems, issues and events are proactively identified, reported and resolved according to prescribed SLRs

R, A I

8. Perform event management monitoring of IT services to detect abnormal conditions or alarms, log abnormal conditions, analyze the condition and take corrective action

R, A I

9. Manage hardware, software, peripherals, Services and spare parts to meet SLRs, minimize downtime and minimize HACLA resource requirements

R, A I



10. Manage and coordinate subcontractors and Third Parties in order to meet SLRs

R, A I

11. Develop and provide operational reports (daily, weekly, monthly) that provide status of operational activities, production issues and key operational metrics

R, A I

12. Review and approve operational reports I R, A

13. Audit Operations and Administration policies for compliance with HACLA security policies

I R, A

14. Provide HACLA with a copy of or access to any Provider or Third Party-supplied documentation (including updates thereto)

R, A I

1.5.4 Maintenance

Maintenance Services are the activities associated with the maintenance and repair of hardware, software and networks to include "break/fix" Services. Installed platform and product version levels are not to be more than one version behind the current commercial release, unless exceptions are coordinated with HACLA where applicable. The following table identifies the Maintenance roles and responsibilities that Provider and HACLA will perform.

Table 35. Maintenance Roles and Responsibilities

Maintenance Roles and Responsibilities Provider HACLA

1. Define Maintenance requirements and policies R, A C, I

2. Develop, document and maintain in the Standards and Procedures Manual Maintenance procedures that meet requirements and adhere to defined policies

R, A I

3. Develop Maintenance schedules R, A

4. Review and approve Maintenance procedures, policies and schedules I R, A

5. Define dispatch requirements and point-of-service locations I R, A

6. Ensure appropriate Maintenance coverage for all Service Tower components

R, A C, I

7. Provide Maintenance and break/fix support in HACLA's defined locations, including dispatching repair technicians to the point-of-service location if necessary

R, A C, I

8. Perform (and/or coordinate with Third-Party Maintenance Vendor if applicable) diagnostics and maintenance on Service Tower components, including hardware, software, peripherals, networks and special-purpose devices as appropriate

R, A C, I

9. Perform an analysis of the impact and/or applicability of Vendor-provided (e.g., Omni) patches and/or service packs, in accordance with HACLA policies and requirements

R, A C, I

10. Approve Vendor-provided patches and/or service packs C, I R, A

11. Review all patches relevant to the IT environment and classify the need and speed at which the Security patches should be installed, as defined by policies and Change Management

R, A C, I

12. Install patches per HACLA's Change Management process and procedures including acquiring required HACLA approval

R, A C, I

13. Install (and/or coordinate with Third-Party Maintenance Vendor if applicable) manufacturer field change orders, service packs, firmware and software maintenance releases, etc.

R, A C, I

14. Perform (and/or coordinate with Third-Party Maintenance Vendor if applicable) product patch, "bug fix," service pack installation or upgrades to the current installed version

R, A C, I

15. Perform Maintenance-related software distribution and version control, both electronic and manual

R, A C, I


Maintenance Roles and Responsibilities Provider HACLA

16. Replace (and/or coordinate with Third-Party Maintenance Vendor if applicable) defective parts, including preventive Maintenance, according to the manufacturer's published mean-time-between-failure rates

R, A I

17. Conduct (and/or coordinate with Third-Party Maintenance Vendor if applicable) Maintenance and parts management and monitoring during warranty and off-warranty periods

R, A I

1.5.5 Technology Refreshment and Replenishment

Technology Refreshment and Replenishment (TR&R) Services are the activities associated with modernizing the IT environment on a continual basis, to ensure that the system components stay current with evolving industry-standard technology platforms. The following table identifies the TR&R roles and responsibilities that Provider and HACLA will perform.

Table 36. TR&R Roles and Responsibilities

TR&R Roles and Responsibilities Provider HACLA

1. Recommend TR&R life cycle management policies, procedures and plans appropriate for support of HACLA business requirements

R, A C, I

2. Develop, document and maintain in the Standards and Procedures Manual TR&R procedures, and develop TR&R plans that meet requirements as well as adhere to defined policies and Change and Release Management processes

R, A C, I

3. Review and approve TR&R policies, procedures and plans I R, A

4. Perform the necessary tasks required to fulfill the TR&R plans R, A I

5. Provide management reports on the progress of the TR&R plans R, A I

6. Periodically review the approved TR&R implementation plans to ensure they properly support HACLA business requirements

I R, A

1.6 Account Management Account Management Services are the activities associated with the ongoing management of the Service environment. The following table identifies Account Management roles and responsibilities that Provider and HACLA will perform.

Table 37. Account Management Roles and Responsibilities

Account Management Roles and Responsibilities Provider HACLA

1. Define Account Management requirements and policies I R, A

2. Develop, document and maintain in the Standards Process and Procedures Manual Account Management procedures that meet requirements and adhere to defined policies

R, A I

3. Review and approve Account Management process and procedures I R, A

4. Develop a detailed "IT" catalog that details Services offered, including all Service options, pricing, installation time frames, order process (new, change and remove service) and prerequisites

R, A I

5. Approve Service catalog I R, A

6. Develop a Service ordering process that clearly defines how to order, change or delete Services

R, A C, I

7. Recommend criteria and formats for administrative, Service activity and Service-Level Reporting

R, A C, I

8. Review and approve criteria and formats for administrative, Service activity and Service-Level Reporting

I R, A


Account Management Roles and Responsibilities Provider HACLA

9. Develop and implement customer satisfaction program for tracking the Quality of Service (QoS) delivery to End Users

R, A I

10. Review and approve customer satisfaction program for tracking the QoS delivery to End Users

I R, A

11. Provide reporting (e.g., statistics, trends, audits, customer satisfaction results)

R, A I

Appendix 8

End-User Services Roles and Responsibilities

Appendix 8 - End-User Services Roles and Responsibilities - 10.21.2015 Page 2 of 9


R Responsible



A Accountable



S Supporting



C Consulted



I Informed



1.0 General Roles and Responsibilities The Provider is responsible for providing End-User Services defined in Section 6.2 of the SOW.

General Roles and Responsibilities Provider HACLA

1. Provide expert Level 1 (Level 2 and Level 3, if applicable) assistance for inquiries about the features, functions and usage of hardware and software.

R, A

2. Identify, escalate (e.g., Level 2 and Level 3 escalation), manage Incident Resolution and Close Incidents and Service Requests, including those escalated to Third Parties.

R, A

3. Provide appropriately trained Service Desk staff for Level 1 (and Level 2, if applicable) remote support to meet HACLA's requirements.

R, A

4. Coordinate the Root Cause Analysis process on recurring and Priority 1 and 2 Incidents.

R, A S


2.0 Service Desk End-User Services

2.1 Single Point of Contact

Single Point of Contact (SPOC) Services provide toll-free support for logging, tracking, Resolution and reporting of Service Desk Incidents and Service Requests for all HACLA-supported environments. Table 1 identifies the SPOC roles and responsibilities that the Provider and HACLA will undertake.

Table 1. SPOC Roles and Responsibilities

SPOC Roles and Responsibilities Provider HACLA

1. Recommend SPOC procedures. R, A

2. Develop, document and maintain in the Standards and Procedures Manual SPOC Provider procedures that meet HACLA's requirements and policies.

R, A S

3. Review and approve SPOC procedures. I R, A

4. Select and implement software and hardware (e.g., IVR, ACD) needed to collect, track and manage Service Requests and Service Desk Incidents received by the Service Desk.

R, A

5. Provide SPOC call-in access via a toll-free number for all Service Desk Services described in this SOW for all HACLA's IT Service Towers and HACLA's Sites.

R, A

6. Provide SPOC and coordination for all Incident reports and requests for information and Service (e.g., IMACs) in the Service Towers supported under this SOW.

R, A

7. Provide multiple alternative communications channels, including voice messages, email and intranet. In the case of Voice Communications Services, any IVR system must allow for immediate exit from the system and live communication with a Service Desk agent.

R, A

8. Record and redirect out-of-scope Service Tower Incidents and Service Requests.

R, A

2.2 IT Service Desk Operations and Administration

IT Service Desk Operations and Administration Services relate to the activities associated with providing a stable Service Desk environment and to effectively and efficiently perform procedures to ensure IT Services meet Service-Level Requirement (SLR) targets. Table 2 identifies the Service Desk Operations and Administration roles and responsibilities that the Provider and HACLA will undertake.

Table 2. IT Service Desk Operations and Administration Roles and Responsibilities

Service Desk Operations and Administration Roles and Responsibilities

Provider HACLA

9. Define Service Desk Operations and Administration requirements and policies.

R, A C, I

10. Develop, document and maintain in the Standards and Procedures Manual Service Desk Operations and Administration procedures that meet requirements and adhere to defined policies.

R, A C

11. Review and approve Service Desk Operations and Administration procedures.

I R, A

12. Provide additional Resources, as needed, during planned and unplanned critical events.

R, A

13. Track/manage/report Service Desk utilization. R, A

14. Provide escalation contact list(s) for HACLA's contacts. I R, A


Service Desk Operations and Administration Roles and Responsibilities

Provider HACLA

15. Maintain and provide escalation contact list(s) for all Service Towers (including Third Parties such as vendors and service providers).

R, A

16. Issue broadcasts or other notices to provide status updates, as required, for planned and unplanned events.

R, A I

17. Provide End User or manager online/portal access to Service Requests and Incident reports.

R, A

18. Develop and execute procedures for conducting End-User Satisfaction surveys in accordance with the Service-Level Requirements.

R, A I

19. Review and approve procedures for conducting End-User Satisfaction surveys.

I R, A

20. Maintain a continuous improvement program that improves Service Desk Service delivery.

R, A S

21. Identify solutions that minimize the need to call the Service Desk (e.g., additional End-User training, Self-Help Support opportunities, Root Cause Analysis).

R, A S

22. Review and approve solutions that minimize the need to call the Service Desk.

I R, A

23. Coordinate and make available environment documentation (i.e., Network configuration and inventory of software to be supported).

R, A

2.3 Service Request and Incident Management

Service Request and Incident Management Services relate to the activities associated with end-to-end Incident Management processes, including escalation to Level 2 and Level 3 specialists through a defined process, including the Provider's primary resources, Third Parties, such as hardware and software suppliers, other Third Party service providers as well as HACLA's internal technical support resources. Table 3 identifies the Service Request and Incident Management roles and responsibilities that the Provider and HACLA will undertake.

Table 3. Service Request and Incident Management Roles and Responsibilities

Service Request and Incident Management Roles and Responsibilities

Provider HACLA

24. Recommend Service Request and Incident Management procedures. R, A

25. Identify and describe priorities, response and Resolution targets for Incidents and Service Requests that have differing impacts.

R, A

26. Develop, document and maintain in the Standards and Procedures Manual Service Request and Incident Management procedures, including procedures to receive and respond to HACLA's Service Request Calls according to defined prioritization and Resolution targets that meet HACLA's requirements and policies.

R, A

27. Review and approve Service Request and Incident Management procedures.

I R, A

28. Ensure that responses to Service Requests are based on priority and impact, rather than the method used to notify the Service Desk (e.g., by telephone, email, fax or direct input to Service Request system by End Users).

R, A

29. Provide a system to document, manage and track all Incidents, Service Requests, Incident reports and inquiries, regardless of the means by which the Service Requests are submitted (e.g., by telephone, email, fax or direct online input by End Users).

R, A


Service Request and Incident Management Roles and Responsibilities

Provider HACLA

30. Provide an end-to-end Incident identification, escalation, Resolution (management) and Closure process, including Incidents escalated to Third Parties.

R, A

31. Receive, track, answer and Resolve, or monitor to closure, End User and technical staff calls.

R, A

32. Categorize, prioritize and log all Incidents (e.g., inquiries/problems/Service Requests) in the Service Desk Incident system.

R, A

33. Monitor Incidents (i.e., Service Desk Incidents) and escalate per policies and procedures until Resolution and End-User satisfaction is achieved.

R, A

34. Troubleshoot Incidents using the Provider's knowledge databases and/or Third Party knowledge databases (e.g., application vendor knowledge databases).

R, A

35. Resolve Incidents at Level 1, if possible; otherwise escalate to appropriate Level 2 or 3 resources as required.

R, A S

36. Provide expert functional and process "how to" assistance for in-scope applications at Level 1, and escalate to Level 2 or 3 resources as required.

R, A

37. Document solutions to Resolved Incidents in knowledge database. R, A

38. Verify acceptance of Services by contacting the End User to confirm results and level of satisfaction.

R, A

39. Identify Incident characteristics and root cause for Level 1 and 2 Incidents.

R, A S

40. Ensure that recurring Incidents that meet defined criteria are reviewed using Root Cause Analysis processes.

R, A

41. Verify that all records (e.g., inventory, asset and configuration management records) are updated to reflect completed/Resolved Service Requests (e.g., IMACs).

R, A

42. Provide authorization for Closing of Service Requests and Service Desk Incidents.

R, A

43. Send Service Requests and Service Desk Incident Closure notices per HACLA's policies.

R, A

2.4 Remote Device and Software Management

Remote Device and Software Management Services relate to the activities associated with managing, maintaining and troubleshooting devices and software remotely over the Network to minimize the need to dispatch technical personnel for Incident Resolution. Table 4 identifies the Remote Desktop Management roles and responsibilities that the Provider and HACLA will undertake.

Table 4. Remote Device and Software Management Roles and Responsibilities

Remote Device and Software Management Roles and Responsibilities Provider HACLA

44. Define policies for the use of Service Desk remote control tools. R, A C, I

45. Develop, document and maintain in the Standards and Procedures Manual Service Desk Remote Device and Software Management procedures that meet requirements and adhere to defined policies.

R, A S

46. Review and approve Remote Device and Software Management procedures and policies.

I R, A


Remote Device and Software Management Roles and Responsibilities Provider HACLA

47. Resolve Incidents and diagnose underlying Problems using remote-control capability and, when possible, implement corrective actions to resolve Problems. If Resolution is not possible, escalate per the escalation procedures.

R, A

48. Utilize remote controls to manage and update software, and to maintain configuration and inventory information.

R, A

49. Utilize remote control tools to manage and enforce compliance with standards.

R, A

50. Assist in enabling the enforcement of compliance with standards and the appropriate optimization of devices and software.

R, A

2.5 End-User Administration

End-User Administration Services relate to the activities associated with managing and coordinating account activation, termination, Changes and expiration, and the management of End-User LAN resources. Table 5 identifies the End-User Administration roles and responsibilities that the Provider and HACLA will undertake.

Table 5. End-User Administration Service Roles and Responsibilities

End-User Administration Services Roles and Responsibilities Provider HACLA

51. Define requirements and policies regarding End-User Administration. R, A C, I

52. Develop, document and maintain in the Standards and Procedures Manual End-User Administration Provider procedures that meet HACLA's requirements and policies.

R, A C

53. Review and approve End-User Administration procedures and policies.

I R, A

54. Receive, track and process requests for End-User account activation, changes and terminations.

R, A

55. Coordinate End-User account administration, activation, changes and terminations (e.g., Password/account setup and Password Reset, remote access connectivity, email accounts, End-User IDs).

R, A

56. Create, change and delete End-User accounts per requests, in accordance with HACLA's security policies.

R, A

57. Coordinate, as necessary, with other specialized areas to manage End-User accounts.

R, A

58. Perform Password Resets as required, in accordance with HACLA's security policies.

R, A

2.6 Installs, Moves, Adds, Changes (IMACs)

IMAC Services relate to the activities associated with the end-to-end management and coordination of IMAC Service Requests, including gathering the business requirements, providing authorization, logging the requests, and facilitating fulfillment. All authorized IMAC requests are passed automatically to the proper support team, depending on the product or Service being requested. The proper support team could be from the Provider or HACLA, or a combination of these, depending on the request. Examples of IMACs include, without limitation, adding PCs and moving local printers and telephones. Table 6 identifies the IMAC roles and responsibilities that the Provider and HACLA will undertake.

Table 6. Installs, Moves, Adds and Changes (IMAC) Roles and Responsibilities

IMAC Roles and Responsibilities Provider HACLA

59. Recommend IMAC procedures. R, A


IMAC Roles and Responsibilities Provider HACLA

60. Develop, document and maintain in the Standards and Procedures Manual IMAC Provider procedures that meet HACLA's requirements and policies.

R, A C

61. Review and approve IMAC procedures and policies. I R, A

62. Receive and track IMAC Service Requests. R, A

63. Obtain the requisite approvals from the relevant HACLA's stakeholders.

R, A

64. Confirm the requirements and scope and acquire HACLA's approval of the IMAC Service Request.

R, A

65. Contact the End User and schedule an appropriate, agreed time for the work to take place.

R, A

66. Approve IMAC schedule. I R, A

67. Coordinate approved IMAC requests with local support teams for delivery of IMAC services.

R, A

68. Track and report status of IMAC requests. R, A

69. Contact End User to confirm completion of IMACs and satisfaction. R, A

70. Verify completion of IMACs. R, A

2.7 Self-Help Support

Self-Help Support Services relate to the activities associated with IVR capabilities, out-of-prime-time voice messaging with guaranteed call-back response, intranet-based automated Self-Help Support, etc. Table 7 identifies the Self-Help Support roles and responsibilities that the Provider and HACLA will undertake.

Table 7. Self-Help Support Roles and Responsibilities

Self-Help Support Roles and Responsibilities Provider HACLA

71. Define Self-Help Support requirements and policies. R, A C, I

72. Develop, document and maintain the Standards and Procedures Manual for Self-Help Support that adheres to HACLA's policies.

R, A C

73. Review and approve Self-Help Support procedures and policies. I R, A

74. Implement Self-Help Support capabilities that enable End Users to perform self-service, including Password Resets and other administrative functions, "how to" support through End-User access to knowledge bases and online Incident status checking.

R, A

75. Monitor and review the effectiveness of Self-Help Support capabilities and usage.

I R, A

76. Develop and provide recommendations for improvements to Self-Help Support capabilities.

R, A S

77. Review and approve recommendations for improvements to Self-Help Support capabilities.

I R, A

78. Implement approved recommendations for improvements to Self-Help Support capabilities.

R, A

2.8 Catalog Procurement

Catalog Procurement Services relate to the activities associated with developing and maintaining an online product catalog available to approved End Users for the procurement of approved products. Table 8 identifies Catalog Procurement Services roles and responsibilities that the Provider and HACLA will undertake.


Table 8. Catalog Procurement Services Roles and Responsibilities

Catalog Procurement Services Roles and Responsibilities Provider HACLA

79. Define Catalog Procurement requirements and policies. R, A C, I

80. Develop, document and maintain in the Standards and Procedures Manual Catalog Procurement procedures that meet HACLA's requirements and policies.

R, A

81. Review and approve Catalog Procurement procedures and policies. I R, A

82. Provide and maintain an electronic product catalog and ordering function that is accessible to HACLA's End Users.

R, A

83. Define content and approve pricing for product catalog. I R, A

84. Validate and process product requisitions (e.g., validate the accuracy of requisitions, obtain proper approvals and create orders from requisitions).

I R, A

85. Provide ongoing tracking and reporting on the status of all requisitions. I R, A

86. Place product orders, based on processed requisitions per approved procedure.

I R, A

87. Provide order fulfillment estimate and commitment date. I R, A

88. Provide ongoing tracking and reporting on the status of all orders. I R, A

89. Provide order tracking and reporting to order close-out per procedure. I R, A

2.9 Exception Requests

Exception Request Services relate to the activities associated with fulfilling End-User requests for products or Services that are outside HACLA's standard policies. Table 9 identifies the Exception Requests role and responsibilities that the Provider and HACLA will undertake.

Table 9. Exception Request Roles and Responsibilities

Exception Request Roles and Responsibilities Provider HACLA

90. Define Exception Request policies and requirements. R, A C, I

91. Develop, document and maintain in the Standards and Procedures Manual Exception Requests process, procedures and required forms that meet HACLA's requirements and policies.

R, A

92. Review and approve Provider Exception Requests procedures and policies.

I R, A

93. Document Exception Requests in Service Desk Incident management system, collect and analyze the request, recommend Exception Request action, process the request to fulfillment or denial, and advise the originator of the status.

R, A

94. Review and approve exception requests. R, A

95. Take the necessary action to implement the request. R, A

96. Provide Exception Request status to requestor, when approved. R, A

3.0 Other Responsibilities

3.1 Service Desk Reporting

Service Desk Reporting Services relate to the activities associated with the preparation of and access to Service Desk reports that are based on defined criteria. Table 10 identifies Service Desk Reporting Services roles and responsibilities that the Provider and HACLA will undertake.


Table 10. Service Desk Reporting Roles and Responsibilities

Service Desk Reporting Roles and Responsibilities Provider HACLA

97. Recommend a list of Service Desk management reports. R, A

98. Review and approve list of Service Desk management reports. I R, A

99. Report on Service Desk statistics and trends as specified in the Standards and Procedures Manual (e.g., Service Request volumes and trends by types of End User).

R, A I

100. Report on trends in Service Requests, and indicate any need for training.

R, A I

101. Audit report results and Service Desk operations periodically. R, A

102. Provide online/portal access to HACLA's Service Desk reports. R, A

Appendix 9

Data Center Services Roles and Responsibilities

Appendix 9 - Data Center Serivces Roles and Responsibilities - 10.21.2015 Page 2 of 10


R Responsible



A Accountable



S Supporting



C Consulted



I Informed



1.0 General Responsibilities The following table identifies general roles and responsibilities associated with Section 6.3.1 of the SOW. The letter "R" is placed in the column under the Party that will be responsible for performing the task. Provider responsibilities are indicated in the column labeled "Provider."

Table 1 General Roles and Responsibilities (According to RASCI Definition).


1. Comply with HACLA policies and standards and regulations applicable to HACLA, including information systems, personnel, physical and technical security

R, A C

2. Manage event and workload processes across all platforms R, A I

3. Provide technical support for all hardware/equipment of the Data Center computing infrastructure.

R, A I

4. Support Data Center infrastructure System Software (e.g., operating systems, utilities, databases, and Middleware as listed in the applicable SOW appendices)

R, A I

5. Provide and support Data Center Networks (e.g., LAN and WAN connections) and related operations (e.g., procure, design, build, systems monitoring, Incident diagnostics, troubleshooting, Resolution and escalation, security management, and capacity planning/analysis) as required to meet HACLA's computing requirements

R, A I



6. Provide and support Data Center-related environmental elements (e.g., HVAC, dual redundant UPS, power, cable plant, fire detection and suppression systems, temperature and humidity controls, and controlled physical access with 24/7 manned security)

R, A I

7. Conduct applications test-to-production migration activities R, A C

8. Implement and coordinate all Changes to the Data Center infrastructure including those that may affect the Service levels of any other Service Tower and Third Parties

R, A C

9. Create, maintain and provide all appropriate project plans, project time and cost estimates, technical Specifications, management documentation and management reporting in a form/format that is acceptable to HACLA

R, A C, S

1.1 Data Center Computing Services

1.1.1 Operations and Administration

Operations and Administration Services are the activities associated with the day-to-day management of the Data Center computing environment. They provide and supporting a stable infrastructure and effectively and efficiently perform operational and processing procedures to ensure Services meet service-level requirement (SLR) targets and requirements. Table 2 identifies the Operations and Administration roles and responsibilities that the Provider and HACLA will perform.

Table 2 Operations and Administration Roles and Responsibilities (According to RASCI Definition).


Monitoring Operations Roles and Responsibilities Provider HACLA

1. Define monitoring requirements and policies R, A C, I

2. Develop monitoring procedures that meet requirements and adhere to defined policies and document in the Standards and Procedures Manual

R, A

3. Review and approve monitoring procedures and policies C, I R, A

4. Provide proactive and scheduled console monitoring of infrastructure and systems (e.g., hardware, network, batch schedule, interfaces, and table spaces), respond to messages and take corrective action as required

R, A I

5. Develop and maintain standard automated scripts to perform monitoring on systems Software

R, A C, S

6. Identify and report Problems including system, file, disk and application Problems

R, A I

7. Provide troubleshooting, repair and escalation of Problems in the Data Center computing environment

R, A I

8. Provide preventative measures for proactive monitoring and self-healing capabilities to limit Outages that impact Service delivery

R, A I

9. Identify and report application Problems R, A I

10. Resolve or assist in Resolving application Problems in accordance with the SLR, and escalate as required

R, A C, S

Job Scheduling and Execution Operations Roles and Responsibilities Provider HACLA

11. Define job scheduling requirements and policies, application interdependencies, HACLA contacts, and rerun requirements for all production jobs

R, A C, I

12. Develop job-scheduling procedures that meet requirements and adhere to defined policies and document in the Standards and Procedures Manual

R, A C, S



13. Review and approve job-scheduling policy and procedures C, S R, A

14. Provide job scheduling, job execution, reporting and Resolution, taking into account infrastructure and system interdependencies

R, A I

15. Implement and manage scheduling tools for managing/automating job execution (e.g., job workflow processes, interdependencies, HACLA contacts, and rerun requirements file exchange functions and print management)

R, A C, I

16. Define production, test and demand batch scheduling requirements I R, A

17. Prepare production, test and demand batch jobs for execution R, A I

18. Execute production, test and demand batch jobs on required systems

R, A I

19. Monitor progress of scheduled jobs and identify and Resolve issues in scheduling process

R, A I

20. Startup and shut-down online/interactive systems according to defined schedules or upon approved request

R, A I

21. Maintain database of job scheduling, contact, rerun and interdependencies

R, A I

22. Provide quality control for reprocessing activities, such as batch reruns

R, A I

23. Prepare job run parameters R, A I

24. Validate job results per HACLA instructions R, A C, S

25. Notify HACLA and maintain a history of job completion results R, A C, S

Electronic Data Exchange Management Roles and Responsibilities Provider HACLA

26. Define electronic data exchange format requirements and policies, including transport (e.g., electronic data interchange [EDI], RAML, FTP), delivery locations, format and schedule requirements

C, S R, A

27. Develop procedures for performing electronic data exchange that meet requirements and conform to industry standards, and document in the Standards and Procedures Manual

R, A C

28. Review and approve electronic data exchange procedures C R, A

29. Develop and maintain a repository of all HACLA electronic data exchange distribution and exchange entities

R, A I

30. Provide and support electronic interfaces between the Provider-hosted environments and Third Parties (e.g., list)

R, A I

31. Execute electronic data exchange production and test distribution according to production schedules

R, A I

32. Monitor all electronic data exchange transactions to ensure proper completion

R, A I

33. Rerun transactions as required and escalate non-Resolved electronic data exchange transactions to HACLA contact

R, A I

34. Perform recovery operations for electronic data exchange transactions as required

R, A I

35. Interface directly with HACLA electronic data exchange distribution entities according to defined, entity-unique HACLA procedures

R, A I

System Administration Roles and Responsibilities Provider HACLA

36. Define system administration requirements and policies R, A C, I

37. Develop procedures for performing system administration that meet requirements and adhere to defined policies, and document in the Standards and Procedures Manual

R, A I

38. Review and approve systems administration policy and procedures C, I R, A

39. Set up and manage End-User accounts, perform access control, manage files and disk space, and transaction definitions

R, A I



40. Perform system or component configuration Changes necessary to support computing services in conformance with Change Management requirements

R, A I

41. Provide usage statistics reports that will be used to support chargeback and other reporting requirements

R, A I

1.1.2 Storage and Data Management

Storage and Data Management Services are the activities associated with the provisioning and day-to-day management of the installed Data Center storage and data environment (e.g., direct access storage devices [DASD]), redundant array of independent disks (RAID), storage area Network (SAN), Network-attached storage (NAS), tape and optical, providing a stable support infrastructure and effectively and efficiently performing procedures to ensure Services meet SLR targets and requirements. The following table identifies the Storage and Data Management roles and responsibilities that the Provider and HACLA will perform.


Table 2 Storage and Data Management Roles and Responsibilities (According to RASCI Definition).

Storage and Data Management Roles and Responsibilities Provider HACLA

1. Recommend Provider-standard Storage and Data Management procedures

R, A C

2. Develop, Storage and Data Management Provider procedures that meet HACLA requirements and adhere to HACLA policies, and document and maintain in the Standards and Procedures Manual

R, A I

3. Review, provide additional procedures as required and approve Storage and Data Management procedures

I R, A

4. Provide data storage Services (e.g., RAID array, SAN, NAS, tape, optical, etc.)

R, A I

5. Monitor and control storage performance according to technical Specifications, Storage and Data Management policies, and perform tuning as required

R, A I

6. Maintain and improve storage resource efficiency R, A I

7. Maintain dataset placement and manage data catalogs R, A I

8. Perform data and file backups and restores per established procedures and SLRs

R, A I

9. Manage file transfers and other data movement activities R, A I

10. Provide input processing, for activities such as loading Third-Party media (e.g., tape) and receipt and/or transmission of batch files

R, A I

11. Acquire and manage consumables, such as tape, disks, etc., in support of the backup requirements. Coordinate acquisition of additional materials as needed

R, A C, S

Media Operations Roles and Responsibilities Provider HACLA

12. Recommend Provider-standard Media Operations procedures R, A C

13. Develop, document and maintain in the Standards and Procedures Manual Media Operations Provider procedures that meet HACLA requirements and adhere to HACLA policies

R, A C, S

14. Review, provide additional procedures as required and approve media processing procedures

I R, A

15. Maintain a media library and media management system R, A I

16. Manage the media inventory to ensure that adequate media resources are available. Coordinate acquisition of additional media as needed

R, A I

17. Manage input media availability to meet processing SLR. R, A I

18. Load and manage Third-Party media R, A I

19. Provide secure off-site storage for designated media and transport media to HACLA's approved off-site location as required

R, A C, S

20. Perform periodic audits to ensure proper cataloging of media R, A I

1.1.3 Output Management

Output Management Services are the activities associated with delivering printed and electronic output in HACLA's required formats and destinations, including remote printing and print to file, per HACLA-approved schedules. Table 4 identifies the Output Management roles and responsibilities that the Provider and HACLA will perform.

Table 4 Output Management (According to RASCI Definition)

Output Management Roles and Responsibilities Provider HACLA

1. Define Output Management requirements and policies R, A C, I


Output Management Roles and Responsibilities Provider HACLA

2. Develop procedures for performing Output Management that meet requirements and conform to defined policies, including the management of transport, delivery locations and scheduling requirements, and document in the Standards and Procedures Manual

R, A C

3. Review and approve Output Management procedures and policies C R, A

4. Provide print Output Management and distribution R, A I

5. Separate and organize printed output materials accordingly R, A I

6. Ensure that printed output is delivered to HACLA-specified delivery locations according to the schedule

R, A I

7. Package and coordinate designated output for pickup by USPS or private delivery services (e.g., FedEx, UPS)

R, A I

8. Ensure that output devices are functioning, including performing or coordinating routine maintenance

R, A I

9. Create and distribute HACLA data products for HACLA customers, including volume creation (e.g., CDs, cartridges, FTP)

R, A I

10. Acquire and manage consumables, such as paper, print ribbons, ink, tapes, etc. Coordinate acquisition of additional materials as needed.

R, A I

1.1.4 Collaborative Computing

Collaborative Computing Services are the activities associated with the supporting collaborative tools (e.g., MS Exchange/Outlook). These activities include the acquisition, installation, upgrades, maintenance, support and tuning of collaborative applications for optimal performance and mailbox administration. Table 5 identifies the Collaborative Computing roles and responsibilities that Provider and HACLA will perform.

Table 5 Collaborative Computing Roles and Responsibilities (According to RASCI Definition).

Collaborative Computing Roles and Responsibilities Provider HACLA

1. Define Collaborative Computing requirements and policies R, A C, I

2. Participate in defining and accept Collaborative Computing policies and procedures for functions including email, calendaring and messaging delivery components

R, A I

3. Develop and document in the Standards and Procedures Manual Collaborative Computing procedures that meet requirements and adhere to defined policies

R, A I

4. Review and approve Collaborative Computing procedures and policies I R, A

5. Provide system administration services including mailbox administration, add/move/delete, mailbox permissions, and creation of distribution lists and owners

R, A I

6. Provide public folder administration services, including creation/deletion of folders, folder owner permissions and ownership assignment, and folder replication management

R, A I

7. Provide security services specific to collaboration systems (e.g., SPAM filtering)

R, A I

8. Perform application upgrades (e.g., service packs, hot fixes, dot releases)

R, A I

9. Install, test, provide technical support, database administration and security administration for Collaborative Computing applications

R, A I

10. Provide technical assistance and subject matter expertise support as required by HACLA staff and Third-Party solution providers

R, A I

11. Provide email archiving to meet regulatory and compliance requirements

R, A I


1.1.5 Database Administration

Database Administration Services are the activities associated with the maintenance and support of existing and future databases. This includes responsibility for managing data, namely dataset placement, database performance, and data recovery and integrity at a physical level. Table 6 identifies the Database Administration roles and responsibilities that the Provider and HACLA will perform.

Table 6 Database Administration Roles and Responsibilities

Database Administration Roles and Responsibilities Provider HACLA

1. Define Database administration requirements and policies including authorization requirements for End-Users, roles, schemas, etc., and approve Change requests

R, A C, I

2. Develop and document in the Standards and Procedures Manual Database Administration procedures that meet requirements and adhere to defined policies

R, A I

3. Review and approve Database Administration procedures and procedures

I R, A

4. Provide security administration, including managing role and End-User database permissions in accordance with HACLA policies

R, A I

5. Perform database restores from export dumps or backups R, A I

6. Create/refresh development/test QA databases from production data R, A I

7. Execute authorization Service Requests R, A I

8. Define and provide database creation, configuration, upgrade, patches and refresh requirements

R, A C, I

9. Execute database creation, configuration, upgrades, patches and refresh

R, A I

10. Execute all database system-level Changes (initialization parameters) R, A I

11. Execute all schema Changes for all instances R, A I

12. Define and provide database data definition requirements for applications installations, moves, adds and changes (IMAC for tables, triggers, attributes, etc.)

R, A C, I

13. Execute database data definition requirements for applications (IMAC for tables, triggers, attributes, etc.)

R, A I

14. Maintain documentation for all database instance parameters and system settings

R, A I

15. Maintain consistent database parameters and system settings across all similar instances. Consistency must be maintained according to established development to QA, and to production life cycle

R, A I

16. Define database definition and manipulation requirements for applications and developer schemas

R, A C, I

17. Execute database data definitions for applications and developer schemas

R, A I

18. Define and execute database performance and tuning scripts, and keep database running at optimal performance for HACLA's workload

R, A C

19. Implement and administer appropriate database management tools across all database instances. Performance metrics and historical data must be available for trending and reporting over a minimum of six months

R, A I

20. Identify locking conflicts, latch contention, rollback requirements, etc., for all database instances

R, A I

21. Resolve locking conflicts, latch contention, rollback requirements, etc., for all database instances

R, A C, I

22. Provide technical assistance and subject-matter expertise to HACLA application developers and Third-Party vendor support

R, A I


Database Administration Roles and Responsibilities Provider HACLA

23. Provide data dictionary expertise, End-User data assistance, Data Warehouse Metadata definition, data mapping functions, and creation of data cubes

I R, A

24. Monitor database and generate automatic Help Desk Trouble Tickets for Problems

R, A I

25. Open, track and manage all database Problems to Resolution R, A I

26. Patch database Software as needed according to established development to QA to production life cycle

R, A I

27. Manage database communication Software configuration, installation and maintenance

R, A I

28. Provide database storage management R, A I

29. Define database backup schedules, retention periods, levels (i.e., full, incremental or differential)

R, A C, I

30. Execute HACLA's database backup and recovery policies R, A I

1.1.6 Middleware Administration

Middleware Administration Services are the activities associated with the maintenance and support of existing and future Middleware. Table 7 identifies the Middleware Administration roles and responsibilities that Provider and HACLA will perform.

Table 7 Middleware Administration Roles and Responsibilities

Middleware Administration Roles and Responsibilities Provider HACLA

1. Define Middleware requirements and policies R, A C, I

2. Develop and document in the Standards and Procedures Manual Middleware Administration procedures that meet requirements and adhere to defined policies

R, A I

3. Review and approve Middleware Administration procedures and policies

I R, A

4. Define authorization requirements for End-Users, roles, objects, etc., and approve Change requests

R, A

5. Implement Middleware configurations R, A I

6. Create, alter and delete application object Changes R, A I

7. Establish and maintain configuration and system parameters in a consistent manner across like server environments

R, A I

8. Execute processes for the proper maintenance and functioning of Middleware systems (e.g., load balancing, tuning, configuration management)

R, A I

9. Execute authorization Change requests R, A I

10. Execute Middleware creation, upgrade and refresh R, A I

11. Execute all Middleware system-level Changes (i.e., initialization parameters)

R, A I

12. Execute all object Changes for all instances R, A I

13. Maintain consistent Middleware parameters and system settings across all like instances according to established development to QA to production life cycle

R, A I

14. Implement and administer appropriate Middleware management tools across all Middleware instances

R, A I

15. Patch Middleware Software as needed, according to established development to QA to production life cycle. Correlate internal Change request to vendor tracking codes

R, A I

16. Provide Middleware communication Software configuration, installation and maintenance

R, A I


Appendix 10

Network Services Roles and Responsibilities

nserna

Typewritten Text

nserna

Typewritten Text

Appendix 10 - Network Serivces Roles and Responsibilities - 10.21.2015 Page 2 of 4

P = Perform H = Help or assist A = Approve

Network Roles and Responsibilities Provider HACLA

Service Management

Recommend a technology solution that best meets business needs and expense/service-level expectations

P

Authorize and approve technology solution P

Recommend policies and procedures P

Authorize and approve policies and procedures P

Define services and standards P

Perform business liaison P

Manage/track service orders P

Asset Management

Procure assets (circuits, hardware and software) P A

Terminate, dispose of or relocate assets as needed P A

Track assets (user, location, asset ID and finances) P

Maintain asset/parts inventory P

Report on inventory as needed P

Engineering

Perform capacity monitoring and planning P

Design network layout P

Authorize and approve a network technology plan P

Install/test/maintain network facilities P

Design hardware/LAN/WLAN system layout P A

Authorize and approve a hardware/LAN/WLAN technology plan P

Provide electrical wiring, wiring closets and cabling P

Install/test/maintain hardware/LAN/WLAN system facilities P A

Design hardware/IP telephony system layout P A

Authorize and approve hardware/IP telephony technology plan P

Install/test/maintain hardware/IP telephony system facilities P

Technical Services

Test, install and tune network system software P

Install application software as needed P

Manage network hardware and circuits to optimize service levels and minimize resource requirements

P

nserna

Typewritten Text



Establish network definitions for links to specific applications P

Provide technical assistance as requested P

Performance Management

Define SLRs P

Document service-level objectives and agreements P A

Measure and analyze performance relative to objectives and agreements P

Develop improvement plans P

Authorize and approve improvement plans P

Implement improvement plans P

Report on service-level results P

Change Management

Establish change requirements (circuits, switches, communication processors, interface equipment, termination equipment and user access)

P

Determine change logistics P

Determine change cost and impact P A

Schedule and conduct a change management meeting P

Authorize and approve change P

Notify affected HACLAs of change timing and impact P

Implement change P

Verify that change met objectives and did not have other, negative impacts

P

Report the results of change P

Perform quality control P

Security (physical/logical access to systems)

Establish security requirements P A

Maintain the physical security of assets P

Conduct periodic security checks per requirements P

Report security violations P

Resolve security violations (If beyond the security of assets, the HACLA remains in charge of overall security.)

P

Disaster Recovery

Establish disaster recovery requirements P

Maintain a disaster recovery plan and provision P

Test the plan P

Track and report test results P

Operations Operate network control center consoles, and monitor service P

Identify and resolve problems P

Perform LAN/WLAN administration to include file and print sharing, logon user ID and password maintenance

P

MACD

Receive and track requests for MACD P



Confirm the requirements and scope, and acquire recipient approval of the installations, moves, adds and changes request

P

Contact the user and schedule an appropriate, agreed time for the work to take place in remote offices

P

Contact the user and schedule an appropriate, agreed time for the work to take place

P

Approve the MACD schedule P

Verify the completion of MACD by contacting the user to confirm satisfaction

P

Planning and Analysis

Identify and recommend the network solution that best meets the recipient's business needs and expense/service-level expectations

P H, A

Approve network solutions and expense/service levels P

Perform operational planning for network capacity and performance purposes

P

Reporting Roles and Responsibilities

Report on network statistics and trends as requested (such as traffic volumes)

P

Report on trends in service requests for network services P

Audit results and operations periodically P

Provide online/portal access to recipient network reports P

Remote Access Roles and Responsibilities

Define Remote Access policies and procedures P A

Develop and document in the Standards and Procedures Manual Remote Access procedures that meet requirements and adhere to defined policies

P

Review and approve Remote Access procedures P

Install, test, provide technical support, administration and security administration for Remote Access hardware and Software

P

Provide testing support for defined HACLA applications that will be made available via Remote Access

P

Provide technical assistance and subject matter expertise as required by HACLA infrastructure staff and Third-Party solution providers for Remote Access products and solutions

P

Perform system or component configuration Changes that are necessary to support Remote Access Services

P


RFP for Services (Fed) Exhibit B– Proposal Price/Cost Form September 2015 (V1)

Exhibit B

Proposal Price/Cost Form

Company Name: ____________________________________________________________________

Company Address: __________________________________________________________________

Point of Contact Name: ____________________________________ Title: _____________________

Phone: ( ) ____________________________ Email: _________________________________

FEE SCHEDULE ALSO SEE ATTACHED Appendix 3 of Exhibit A The undersigned proposes and agrees to furnish the Services at the price(s) listed above. All prices are fully-burdened, which means that all general conditions, taxes, insurance, bonds, and permits (if required) are included in the above prices. This proposal is valid for the Minimum Acceptance Period set forth in the RFP. ALL SERVICE PROVIDERS SUBMITTING QUOTES MUST COMPLETE THE FOLLOWING CERTIFICATION: Self-Certification re Los Angeles Business Tax Registration Certificate ☐ Bidder has a valid Los Angeles Business Tax Registration Certificate (attach)

☐ Bidder certifies that it is not required to hold a valid Los Angeles Business Tax Registration Certificate to deliver the Goods described herein

By: _____________________________________________ Title ____________________________


RFP for Services (Fed) Exhibit C– Insurance Requirements September 2015 (V1)

Exhibit C

Contractual Requirements for Insurance (Services)

(attached)


RFP for Services (Fed) Exhibit C– Insurance Requirements September 2015 (V1) 1

Contractual Requirements for Insurance (Services)

General Requirements Notwithstanding any inconsistent statement in any required insurance policies or any subsequent endorsements attached thereto, all insurance policies, except for the Workers' Compensation policy, shall be endorsed to name the Authority, its Board of Commissioners, officers, employees, servants, agents, successors, assigns, instrumentality entities, subsidiaries and related non-profit corporations as Additional Insureds. Contractor shall require the carriers of all required insurance policies to waive all rights of subrogation against the Authority and its Board of Commissioners, officers, employees, servants, agents, successors, assigns, instrumentality entities, subsidiaries and related non-profit corporations. Each policy of insurance shall be endorsed to reflect such waiver. Acceptability of Insurers: Insurance shall be placed with licensed insurers admitted to transact business in California, and shall have a current A.M. Best’s rating of no less than B+. Professional liability coverage provided by non-admitted, non-rated providers will be considered by the Risk Manager on a case-by-case basis. Acceptability of Documentation: the Authority shall make the final determination as to whether the documentation submitted by the Contractor conforms to the requirements set forth herein. Claims: Contractor agrees to notify Authority of any claim by a third party or any incident or event that may give raise to a claim arising from the performance of the Contract. Deductibles or Self-Insured Retentions: Any deductibles or self-insured retentions shall be set forth on the Certificate of Insurance and shall be subject to the review and approval of the Authority’s Risk Manager, who shall have the sole discretion to require Contractor’s insurer to reduce or eliminate such deductibles or self-insured retentions as respects the Authority, or require the Contractor provide a financial guarantee satisfactory to the Authority guaranteeing payment of losses and related investigations, claims administration, and defense expenses. Delivery: All evidence of required insurance coverage shall be delivered to the Authority at the address specified in the “Notice” section of the Contract. All certificates and endorsements are to be received and approved by the Authority in sufficient time before work commences to permit Contractor to remedy any deficiencies.

Endorsements: Endorsement forms must be signed by an authorized representative of the insurance company and must include a contact phone number. Signatures must be originals; the Authority will not accept facsimile (rubber stamp, photocopy, etc.) or initialed signatures. The name of the Insurance Company underwriting the coverage and its address shall be noted on the endorsement form. The endorsement shall include reference to the activity and the specific the Authority contract number. Endorsements to excess policies will be required when primary insurance is insufficient in complying with the Authority requirements. Exceptions: Any exception to or deviation from the requirements listed herein, requires the advance written approval of the Authority’s Risk Manager. Indemnity Coverage: Coverage shall not extend to any indemnity coverage for the active negligence of the additional insured in any case where the agreement to indemnity the additional



insured would be invalid under subdivision (b) of Section 2782 of the California Civil Code. Primary Insurance: Required insurance coverage shall be “primary” as it pertains to the Authority, its officers, officials and employees. Any insurance or self-insurance maintained by the Authority, its officers, officials and employees is wholly separate from the Contractor’s insurance and in no way relieves the Contractor from its responsibility to provide insurance. Term of Coverage: (a) Required insurance shall be maintained by Contractor in full force and effect during the

entire period of performance of the Contract. (b) Required insurance certificates shall show coverage as of start of work and for at least 90

days thereafter. If the policy coverage is written on a claims-made form, the “Retro Date” shall be shown and shall be before the date of the Contract or the beginning of the Contract work. It is Contractor’s responsibility to ensure the required insurance certificates and endorsements provided to the Authority are current.

(c) Insurance coverage required hereunder shall not be canceled, renewal refused, or

materially changed unless the Authority is provided written notice at least 30 days advance written notice of the same.

(d) In the event of a material modification, cancellation, expiration or reduction in coverage,

the Contract shall terminate forthwith, unless the Authority receives, at least 10 days prior to such effective date, properly executed Certificate(s) of Insurance and required endorsement(s) evidencing the required coverage is in full force and effect. In the alternative, and at its sole discretion, the Authority may obtain or renew Contractor’s required insurance, and pay all or a part of the premiums. Upon demand, Contractor shall repay the Authority all monies paid to obtain or renew the required insurance. The Authority may offset the cost of the premium against any monies due Contractor from the Authority.

Reservation of Right to Adjust Requirements. If, during the term of the Contract or any extension thereof, there is a material change in the scope of work, or there is a material change in the equipment to be used in the performance of the scope of work that will add additional exposure, the Authority reserves the right to adjust the types of insurance required under the Contract and/or the monetary limits of liability for the insurance coverage currently required herein, if, in the Authority’s Risk Manager’s reasonable judgment, the type or amount of insurance carried by the Contractor has become inadequate. Workers’ Compensation. By signing the Contract, Contractor hereby certifies that it is aware of the provisions of Section 3700 et seq., of the Labor Code, which require every employer to be insured against liability for Workers' Compensation or to undertake self-insurance in accordance with the provisions of that Code, and that it will comply with such provisions at all such times as they may apply during the performance of the Work pursuant to the Contract.



Required Insurance Coverage

(Services) ☒ Workers’ Compensation (statutory)/Employer’s Liability: $1,000,000 (the Authority as a certificate holder and no exclusions for lead or asbestos) ☒ Comprehensive General Liability: $2,000,000 (the Authority as an additional insured with Endorsement)

( X ) Premises and Operations ( X ) Contractual Liability, Oral and Written ( X ) Independent Contractors ( X ) Products/Completed Operations ( X ) Broad Form Property Damage Incl. Completed Operations ( X ) Personal Injury, Excl. C, deleted ( X ) Broad Form Liability Endorsement ( X ) Fire Legal Liability

☐ Automobile Liability: $500,000 (the Authority an additional insured)

( X ) Owned Automobiles ( X ) Non-Owned/Hired Automobiles

☒ Errors and Omissions (Professional Liability) with limits of $1,000,000 (the Authority as a certificate holder) ☐ Pollution Legal Liability3: $ _______________ per incident

3 Asbestos and/or lead work


RFP for Services (Fed) Exhibit D - Declaration of Compliance with MBE/WBE September 2015 (V1)

Exhibit D

Declaration of Compliance with MBE/WBE Outreach Program Requirements

[attached]


RFP for Services (Fed) Exhibit D - Declaration of Compliance with MBE/WBE September 2015 (V1) 1

HOUSING AUTHORITY OF THE CITY OF LOS ANGELES Declaration of Compliance with MBE/WBE

Outreach Program Requirements

“Minority Business Enterprise” (MBE) means a certified business of which is at least 51% of which is owned and controlled by one or more minority group members, or, in the case of a publicly-owned business, one in which at least 51% of its voting stock is owned by one or more minority group members, and whose management and daily business operations are controlled by one or more such individuals. Minority group members include, but are not limited to, African/Black Americans, Hispanic/Latino Americans, Native Americans, Asian Pacific Americans, Asian Indian Americans and Hasidic Jewish Americans. “Women Business Enterprise" (WBE) means a certified business of which at least 51% of which is owned and controlled by one or more women, or, in the case of publicly held corporation, 51% of the stock is owned by one or more women and whose management and daily business operations are controlled by one or more such individuals. The undersigned, as an authorized representative of the business identified herein, hereby declares that the following statements are, to the best of his/her/its knowledge, true and correct with respect to the efforts made in a "good-faith" attempt to comply with the MBE/WBE outreach project requirements of the Housing Authority of the City of Los Angeles (“Authority”), and that said business can provide to the Authority evidence of the efforts described herein within three working days of such request.

1. Identified Bid Items ( ) We identified specific items in the bid/proposal to be performed or procured from MBE/WBE businesses.

( ) We did not identify such items.

Initial __________

2. Advertisement ( ) We advertised for bids/proposals from interested business enterprises for not less than (15) fifteen calendar days prior to the submission of bids in more than one daily or weekly newspaper, trade association publications, minority or trade oriented publications, trade journals, internet, social media or other media. Proof of advertisement is attached.

( ) We did not advertise for bids from MBE/WBE businesses.

Initial __________

3. Written Notice ( ) We provided written notice of our interest in bidding and requested assistance from organizations such as _______________________________________________________ which provide assistance in the recruitment and placement of MBE/WBE and other business enterprises not less than _____ days prior to the submission of the bids/proposals. ( ) We did not provide such written notice.

Initial __________


RFP for Services (Fed) Exhibit D - Declaration of Compliance with MBE/WBE September 2015 (V1) 2

4. Participation ( ) We obtained participation by MBE/WBE businesses to produce a level of participation by interested subcontractors including _______% MBE and ________% WBE. [Note: Attainment of the anticipated levels of participation, by itself, shall not be construed as evidence of "good-faith" outreach.]

( ) We did not obtain participation by MBE/WBE businesses.

Initial __________

5. Negotiations ( ) We negotiated in good-faith with interested MBE/WBE businesses and did not unjustifiably reject bids prepared by any enterprise. [NOTE: Bidder may be requested to submit a list of all subcontractors for each item of work solicited, including dollar amounts of potential work for MBE/WBE businesses.]

( ) We did not engage in such negotiations.

Initial __________

_________________________________________ Signature _________________________________________ Title


RFP for Services (Fed) Exhibit E - EEO Certification September 2015 (V1)

Exhibit E Equal Employment Opportunity Certification

(attached)


RFP for Services (Fed) Exhibit E - EEO Certification September 2015 (V1) 1

HOUSING AUTHORITY OF THE CITY OF LOS ANGELES EQUAL EMPLOYMENT OPPORTUNITY CERTIFICATION

The following certification must be submitted by any person or business entity (Contractors and Subcontractors) offering to perform services for the Authority when the underlying contract for those services will be paid using federal funds and the contract work is subject to the Equal Opportunity Clause set forth at 41 CFR 60-1.4(a) for non-construction services or 41 CFR 60-1.4(b) for construction services. 1. Contractor/Subcontractor Certification of Exemption (Indicate whether you are or are not claiming and exemption as indicated)

☐ I, the undersigned, on behalf of the business identified below, do not claim an exemption from the Equal Opportunity Clause set forth at 41 CFR 60-1.4.

☐ I, the undersigned, on behalf of the business identified below and as authorized by 41 CFR 60-1.5(a), claim a complete exemption from the Equal Opportunity Clause set forth at 41 CFR 60-1.4 based on the following circumstances: ☐ Contractor has less than 50 employees ☐ Contractor is receiving an award of less than

$10,000 ☐ Contractor is a religious entity within the meaning of 41 CFR 60-1.5(a)(5)

☐ Contractor is an educational institution within the meaning of 41 CFR 60-1.5(a)(6)

☐ Contractor is entitled to the following exemption under 41 CFR 60-1.5(a): I further certify that said business will comply with all applicable civil rights laws that prohibit discrimination in employment and in the delivery of services.

_________________________________________ ☐ Acting as Prime Contractor ☐ Acting as Subcontractor Business Name

_________________________________________ __________________ Signature Date

(Indicate whether you have not participated in a previous contract/subcontract (2a) or whether you have participated in a previous contract or subcontract (2b) as indicated)

2a Contractor/Subcontractor Certification of No Previous Participation

☐ I, the undersigned, on behalf of the business identified below, certify that said business has not participated in a previous contract or subcontract subject to the Equal Opportunity Clause set forth at 41 CFR 60-1.4. I further certify that said business will comply with all applicable civil rights laws that prohibit discrimination in employment and in the delivery of services.

_________________________________________ ☐ Acting as Prime Contractor ☐ Acting as Subcontractor Business Name

_________________________________________ __________________ Signature Date

OR


RFP for Services (Fed) Exhibit E - EEO Certification September 2015 (V1) 2

2b. Contractor/Subcontractor Certification of Previous Participation and Reporting Compliance ☐ I, the undersigned, on behalf of the business identified below, certify that said business has participated in a previous contract or subcontract subject to the Equal Opportunity Clause set forth at 41 CFR 60-1.4. ☐ Contractor represents that it has filed with the Joint Reporting Committee, the Deputy Assistant Secretary or the Equal Employment Opportunity Commission all required Standard Form 100 (also known as “Employer Information Report EEO-1”) filings. ☐ Contractor represents that it has not filed with the Joint Reporting Committee, the Deputy Assistant Secretary or the Equal Employment Opportunity Commission all required Standard Form 100 (also known as “Employer Information Report EEO-1”) filings.4 I further certify that said business will comply with all applicable civil rights laws that prohibit discrimination in employment and in the delivery of services. _________________________________________ ☐ Acting as Prime Contractor ☐ Acting as Subcontractor Business Name

_________________________________________ __________________ Signature Date

4 Proposed Contractors and Subcontractors who have not filed the required report are not eligible for contract award unless such Contractor/Subcontractor submits a report covering the delinquent period or such other period specified by the Director, Office of Federal Contract Compliance, U.S. Department of Labor.


RFP for Services (Fed) Exhibit F - Affirmative Action Certification September 2015 (V1)

Exhibit F Affirmative Action Program Certification

(attached)


RFP for Services (Fed) Exhibit F - Affirmative Action Certification September 2015 (V1) 1

HOUSING AUTHORITY OF THE CITY OF LOS ANGELES AFFIRMATIVE ACTION PROGRAM CERTIFICATION

(Non-Construction) The following certification must be submitted by any person or business entity (Contractors and Subcontractors) offering to perform non-construction services for the Authority when the underlying contract for those services will be paid using federal funds and the contract work is subject to the requirements of 41 CFR 60-2. 1. Contractor/Subcontractor Certification of Exemption (Indicate whether you are or are not claiming and exemption as indicated)

☐ I, the undersigned, on behalf of the business identified below, do not claim an exemption from development and maintenance of an Affirmative Action Program.

☐ I, the undersigned, on behalf of the business identified below and as authorized by 41 CFR 60-2.1(b), claim a complete exemption from development and maintenance of an Affirmative Action Program based on the following circumstances: ☐ Contractor has less than 50 employees ☐ Contractor is receiving an award of less than

$50,000 _________________________________________ ☐ Acting as Prime Contractor ☐ Acting as Subcontractor Business Name

_________________________________________ __________________ Signature Date

2. Contractor/Subcontractor Certification of Affirmative Action Program Compliance ☐ I, the undersigned, on behalf of the business identified below, certify that said business has formulated and has on file at each establishment affirmative action programs that comply with the requirements set forth at 41 CFR 60-2. The undersigned further certifies that said business will require its first tier subcontractors to establish affirmative action compliance programs that comply with the requirements set forth at 41 CFR 60-2, unless said subcontractors qualify for an exception under 41 CFR 60-2.1(b). ☐ I, the undersigned, on behalf of the business identified below, certify that said business has not formulated an affirmative action program for each of its establishments. The undersigned further certifies that if awarded an Authority-contract for services, said business will, within 120 days of the commencement of the contract award, develop and maintain at each establishment affirmative action programs that comply with the requirements set forth at 41 CFR 60-2. The undersigned further certifies that said business will require its first tier subcontractors to establish affirmative action compliance programs that comply with the requirements set forth at 41 CFR 60-2, unless said subcontractors qualify for an exception under 41 CFR 60-2.1(b). _________________________________________ ☐ Acting as Prime Contractor ☐ Acting as Subcontractor Business Name

_________________________________________ __________________ Signature Date


RFP for Services (Fed) Exhibit G - List of Subcontractors September 2015

Exhibit G List of Subcontractors

[attached]


RFP for Services (Fed) Exhibit G - List of Subcontractors September 2015 (V1)

HOUSING AUTHORITY OF THE CITY OF LOS ANGELES List of Subcontractors

Contractor certifies that it has investigated the eligibility of each Subcontractor listed below and has determined that none is (1) debarred, suspended or otherwise ineligible to be awarded contracts by any agency of the United States Government or to participate in programs of the U.S. Department of Housing and Urban Development, or (2) ineligible to perform work on a public works project pursuant to California Labor Code Sections 1777.1 or 1777.7. Project Title: _________________________________________ Company Name: ______________________________________

BUSINESS NAME & ADDRESS

CONTACT INFORMATION

TRADE/BUSINESS

1.

___________________________________________________________

___________________________________________________________

___________________________________________________________

☐ check if subcontractor qualifies as Section 3 Business

Name: _________________________ Phone: _________________________

Trade: __________________________________

2.

____________________________________________________________

____________________________________________________________

____________________________________________________________


Name: _________________________ Phone:_________________________

Trade:____________________________________

3.

____________________________________________________________

____________________________________________________________

____________________________________________________________


Name:_________________________ Phone: _________________________

Trade:____________________________________

(Submit additional forms as needed)


RFP for Services (Fed) Exhibit H - Vendor Application September 2015 (V1)

Exhibit H Vendor Application (Pages 1 - 3)

(attached)


RFP for Services (Fed) Exhibit I - Workforce Profile September 2015 (V1)

Exhibit I Workforce Profile

(attached)


HOUSING AUTHORITY OF THE CITY OF LOS ANGELES CONTRACTOR WORKFORCE PROFILE

Please insert the information requested below for each permanent, full-time (eight hours or more per day) employee employed by the business. OCCUPATION MALE EMPLOYEES FEMALE EMPLOYEES

Hispanic or

Latino

White Black or African

American

Native Hawaiian or Pacific Islander

Asian Amer. Indian

or Alaska Native

Two or More

Races

Total Hispanic or

Latino

White Black or African

American

Native Hawaiian or Pacific Islander

Asian Amer. Indian

or Alaska Native

Two or More

Races

Total

Exec/Senior Mgrs

First/Mid-Lvl Mrgs

Professionals Technicians Sales Workers Admin Support Craft Workers Operatives Laborers & Helpers

Service Workers

Totals Race and ethnic designations are those used by the Equal Employment Opportunity Commission, and do not denote scientific definitions of anthropological origins. Definitions of the race and ethnicity categories are as follows: Hispanic or Latino - A person of Cuban, Mexican, Puerto Rican, South or Central American, or other Spanish culture or origin, regardless of race. White (Not Hispanic or Latino) - A person having origins in any of the original peoples of Europe, the Middle East, or North Africa. Black or African American (Not Hispanic or Latino) - A person having origins in any of the black racial groups of Africa. Native Hawaiian or Other Pacific Islander (Not Hispanic or Latino) - A person having origins in any of the peoples of Hawaii, Guam, Samoa, or other Pacific Islands. Asian (Not Hispanic or Latino) - A person having origins in any of the original peoples of the Far East, Southeast Asia, or the Indian Subcontinent, including, for example, Cambodia, China, India, Japan, Korea, Malaysia, Pakistan, the Philippine Islands, Thailand, and Vietnam. American Indian or Alaska Native (Not Hispanic or Latino) - A person having origins in any of the original peoples of North and South America (including Central America), and who maintain tribal affiliation or community attachment. Two or More Races (Not Hispanic or Latino) - All persons who identify with more than one of the above six races.

_____________________________________________________________________________ Total Number of Full-Time Employees: ____________ Name of Business

_____________________________________________________________________________ Date: ____________________________ Signature/Title


RFP for Services (Fed) Exhibit J - Section 3 Forms September 2015 (V1)

Exhibit J Section 3 Forms

(attached)


RFP for Services (Fed) Exhibit K – SBE/MBE/WBE Certification September 2015 (V1)

Exhibit K Small, Minority, Women-Owned Business Concern Representation Certification

All businesses submitting proposals under this RFP shall complete and submit this form.5 A. “Small Business Concern” means a concern, including its affiliates, that is independently owned and operated, not dominate in the field of operation in which it is bidding, and qualified as a small business under the criteria and size standards in 13 CFR 121. ☐ The undersigned represents and certifies that it is not a Small Business Concern

☐ The undersigned represents and certifies that it is a Small Business Concern

B. “Women-Owned Small Business Concern" means a small business that is at least 51% owned and controlled by a woman or women who are U.S. citizens and who also control and operate the business.

☐ The undersigned represents and certifies that it is not a Women-Owned Small Business Concern

☐ The undersigned represents and certifies that it is a Women-Owned Small Business Concern

C. “Minority Enterprise” means a business which is at least 51% owned by one or more minority group members, or, in the case of a publicly-owned business, at least 51% of its voting stock is owned by one or more minority group members, and whose management and daily operations are controlled by one or more such individuals. For purposes of this definition, minority group members are Black Americans, Hispanic Americans, Native Americans, Asian Pacific Americans, Asian Indian Americans and Hasidic Jewish Americans. ☐ The undersigned represents and certifies that it is a Minority Enterprise

☐ The undersigned represents and certifies that it is not a Minority Enterprise Check the applicable boxes:

☐ Black Americans ☐ Hispanic Americans ☐ Native Americans

☐ Asian Pacific Americans ☐ Asian Indian Americans ☐ Hasidic Jewish Americans.

Business Name: ____________________________________________________________________

By: _____________________________________________ Title _____________________________

5 Based upon HUD Form 5369-C


RFP for Services (Fed) Exhibit L - HUD Form 5369-B September 2015 (V1)

Exhibit L Instructions to Offerors (Non-Construction) (HUD Form 5369-B)

(attached)

nserna

Typewritten Text

nserna

Typewritten Text

nserna

Typewritten Text

nserna

Typewritten Text

nserna

Typewritten Text

nserna

Typewritten Text

nserna

Typewritten Text

nserna

Typewritten Text


RFP for Services (Fed) Exhibit M – Proposed Contract September 2015 (V1)

Exhibit M Proposed Contract

(attached)

nserna

Typewritten Text


Contract for Services (Fed) September 2015 (V1) 1

CONTRACT BETWEEN HOUSING AUTHORITY OF THE CITY OF LOS ANGELES

AND ____________________________________

THIS CONTRACT (“Contract”) is made and entered into this insert day of insert month, 2015 ("Commencement Date"), by and between the Housing Authority of the City of Los Angeles, State of California, a public body, corporate and politic (hereinafter referred to as the "Authority"), and insert Contractor name, (hereinafter referred to as the "Service Provider").

RECITALS WHEREAS, the Authority requires insert description services (“Services”), to be performed at insert address that otherwise cannot be provided by regular employees of the Authority; and WHEREAS, the Authority has determined that the most effective and feasible manner of obtaining such Services is by contracting for them; and WHEREAS, using competitive proposal procedures, the Authority issued Request for Proposals (RFP) insert number for the Services; and WHEREAS, Service Provider is a corporation duly organized and in good standing in the State of California, and has the qualifications, background, knowledge, experience and expertise to perform the obligations set forth in this Contract; and WHEREAS, the Board of Commissioners, by resolution adopted on insert date authorized the Authority to contract with Service Provider for said Services; and WHEREAS, the Authority and Service Provider desire to enter into this Contract for the Services upon the terms and conditions set forth herein. NOW, THEREFORE, in consideration of the mutual covenants, benefits and promises herein stated, the parties hereto agree as follows: Section 1. STATEMENT OF SERVICES Service Provider shall, in a manner satisfactory to the Authority, completely perform the Services set forth in the "Scope of Services" attached hereto as Exhibit 1 and incorporated herein by this reference. The Service Provider shall also perform in accordance with its proposal submitted in response to the Authority’s Request for Proposals (“Service Provider’s Proposal”). Any conflicts between the requirements of the Scope of Services attached hereto and the Scope of Services presented in the Service Provider's Proposal shall be referred for resolution to the Authority, whose decisions in such matters shall be final and binding on both parties. Section 2. SERVICE PROVIDER’S DUTIES, WARRANTIES AND RESPONSIBILITIES A. Service Provider agrees to abide by and perform all of the Services specified in this Contract and all exhibits and attachments thereto, the General Conditions for Contract for Services attached hereto as Exhibit 3 and incorporated herein by this reference.



Service Provider shall provide, furnish, and supply all things necessary and incidental for the Services to be performed, including, but not limited to, provision of all necessary labor, materials, equipment and transportation, unless otherwise specified herein. B. Service Provider warrants that it is free to enter into this Contract and is not subject to any obligation or disability which will or might prevent or interfere in fully keeping and performing all of the conditions to be kept and performed under this Contract. C. Service Provider further warrants that it has not paid anyone for the purpose of entering into this Contract, and that entering into this Contract and performing the services hereunder will not constitute a conflict of interest. Service Provider further warrants that neither it, nor its agents or representatives, has offered or given gratuities in the form of entertainment, gifts, favors or other items or services of value to any officer or employee of the Authority with a view toward securing: (i) award of this Contract, (ii) amendment of the Contract after award, (iii) favorable treatment of Service Provider by the Authority in the administration of the Contract or in the making of any determination with respect to Service Provider’s performance of its obligations under the Contract. D. Service Provider further warrants that the Services to be performed hereunder shall be completed in a manner consistent with professional standards practiced among those firms within Service Provider’s profession, doing the same or similar work under the same or similar circumstances. F. Service Provider shall be responsible for any technical accuracy, timely completion of reports, and other services furnished by Service Provider under this Agreement. Service Provider shall, at no additional cost to the Authority, correct and/or revise any errors, omissions, or other deficiencies in its reports, calculations, and other services. Section 3. FEES, PAYMENTS AND INVOICES A. Basic Services. For Service Provider’s full and complete performance of its obligations under this Contract, the Authority shall pay Service Provider on a Firm Fixed Price basis, the fees set forth in the Schedule of Fees attached hereto as Exhibit 2 and incorporated herein by this reference (“Contract Fees”). The Contract Fees are acknowledged to be fully burdened to include all direct costs, indirect costs and profit, and shall remain fixed for the entire Contract Term, including any option terms that may be exercised by the Authority. B. Additional Services. Any work determined by the Authority to be necessary for the proper completion of the Services, but which is not included within the Scope of Services shall be considered "Additional Work." Only the Authority’s Contracting Officer identified in the Notices section herein or his or her authorized designee may authorize Additional Work. The parties expressly acknowledge that any other Authority employees are without authorization to order Additional Work or to waive contractual requirements of this Contract. Failure of the Consultant to secure proper authorization for Additional Work shall constitute a waiver of any and all right to adjustment in the Maximum Cumulative Payment Obligation amount set forth herein, and Consultant shall not be entitled to compensation for such unauthorized services. Any such approval of Additional Work by the Contracting Officer, as well as any other material change in the terms and conditions of this Contract, shall only be binding upon either party if confirmed in a written amendment to this Contract executed by both parties. The Authority will pay for



Consultant's completion of Additional Services in accordance with paragraph B of the Fee Schedule. C. Reimbursable Expenses. Consultant has estimated and the Authority has accepted the reimbursable expenses identified in paragraph C of the Fee Schedule as reimbursable expenses that may be reasonably and necessarily incurred in the performance of the Services. Reimbursable expenses are in addition to compensation for Basic and Additional Services and shall be billed at actual net cost, without any "mark ups" or surcharges. All expenses must be supported by back up documentation (e.g., receipts, invoices, or proof of expenditure). Expenses that exceed $500.00 must be approved by the Authority, in writing and in advance of incurring the cost. The Authority does not reimburse for local travel costs, including but not limited to travel time from Consultant’s office to the Authority’s Office or the Project site. Local travel consists of travel within Los Angeles County and its immediate surrounding areas including but not limited to Orange County and Riverside Counties. D. Maximum Cumulative Payment Obligation. Notwithstanding any other provision of this Contract to the contrary, the Authority's maximum cumulative payment obligation to Service Provider under this Contract shall be insert sum ($insert dollar value), including all amounts payable to Service Provider for its costs arising from, or due to termination of, this Contract.

E. Remittance. The Authority shall remit the appropriate payment to Service Provider within 45 Days of the Authority’s approval of Service Provider’s request for payment. F. Automatic Deposit of Payments. Service Provider shall be paid by Automatic Deposit with a Financial Institution that is a member of the Automatic Clearing House. The Automatic Deposit Form must be completed and submitted to the Authority prior to the performance of Services under this Contract. G. Invoices. Service Provider shall submit invoices to the Authority for payment in arrears of work being performed and not more frequently than once per calendar month. Service Provider's invoices shall specify the following: (i) name of person(s) performing the work; (ii) description of work and location where work was performed; (iii) dates of work performance and hours of work performed; (iv) total amount due and payable; (v) Contract number assigned for Services; and (vi) signature of Service Provider’s authorized representative attesting that the invoice is true and accurate. Request for reimbursement of reimbursable expenses shall be itemized and supported by documentation. Invoices shall be addressed as follows:

Housing Authority of the City of Los Angeles 2600 Wilshire Blvd, Finance Dept., Department, 4th Floor Los Angeles, California 90057 Attention: Accounts Payable

Section 4. TERM OF CONTRACT A. Single Contract Term ☐ This is a single-term Contract, which shall commence on the Commencement Date



and continue in full force and effect through insert date unless earlier terminated as provided elsewhere in this Contract or extended by written amendment to this Contract. B. Multi-Term Contract ☐ 1. This is a multi-year Contract, which shall commence on the Commencement Date and continue in full force and effect through insert date unless earlier terminated as provided elsewhere in this Contract or extended by written amendment to this Contract. 2. The following option terms apply: (a) 1st Option Term. The Authority, at its sole discretion, may elect to extend the term of this Contract for the period through insert date (“1st Option Term”) by giving notice to the Service Provider prior to the expiration of the Initial Term. (b) 2nd Option Term. The Authority, at its sole discretion, may elect to extend the term of this Contract for the period through insert date (“2nd Option Term”) by giving notice to the Service Provider prior to the expiration of the 1st Option Term. (c) 3rd Option Term. The Authority, at its sole discretion, may elect to extend the term of this Contract for the period through insert date (“3rd Option Term”) by giving notice to the Service Provider prior to the expiration of the 2nd Option Term. 3. The maximum term of this Contract shall be five years. Section 5. INSURANCE During the term of this Contract, Service Provider shall, at its own cost and expense, procure and maintain the insurance required by the RFP, as described in the Contractual Requirements for Insurance, which is incorporated herein by this reference. Copies of Service Provider’s certificates of insurance are attached hereto as Exhibit 4. It is Service Provider’s responsibility to provide updated certificates of insurance during the life of this Contract. Section 6. NOTICES

A. Any notices to be given pursuant to this Contract shall be in writing, and all such notices and any other document to be delivered shall be delivered by personal service or by deposit in the United States mail, certified or registered, return receipt requested, postage prepaid, and addressed to the party for whom it is intended as follows: For the Authority:

Contracting Officer: Housing Authority of the City of Los Angeles Attn: Ken Simmons, Chief Operating Officer 2600 Wilshire Boulevard, 3rd Floor Los Angeles, CA 90057

Contracts Dept.: Housing Authority of the City of Los Angeles



Attn: insert, Contract Administrator 2600 Wilshire Boulevard, 4th Floor Los Angeles, CA 90057 Project Manager: Housing Authority of the City of Los Angeles

Attn: insert, Project Manager 2600 Wilshire Boulevard, 4th Floor Los Angeles, CA 90057

For Service Provider:

To: insert Service Provider information

B. Either party may, from time to time, by written notice to the other, designate a different address which shall be substituted for the one above specified. Notices, payments and other documents shall be deemed delivered upon receipt by personal service or upon deposit in the United States mail. Section 7. SUBCONTRACTING; ASSIGNMENT A. Service Provider and the Authority agree that Service Provider’s unique talents, knowledge and experience form a basis for this Contract and that the services to be performed by Service Provider under this Contract are personal in character. Therefore, Service Provider shall not subcontract, assign or delegate any portion of this Contract or any duties or obligations hereunder unless approved by the Authority in a written instrument executed and approved by the Authority in writing. Neither party shall, on the basis of this Contract, contract on behalf of or in the name of the other party. Any Contract that violates this Subcontracting; Assignment section shall confer no rights on any party and shall be null and void. B. To the extent Service Provider is permitted by the Authority in writing to subcontract, assign or subcontract any portion of this Contract or any duties or obligations hereunder, Service Provider shall remain fully liable and responsible for all acts and omissions of its subcontractors in connection with the Services, as if it engaged in the acts and omissions directly. Section 8. AUTHORITY’S RIGHTS AND REMEDIES IN GENERAL A. All of the Authority’s rights and remedies under the Contract are cumulative, and shall be in addition to those rights and remedies available in law or in equity. Designation in the Contract of certain breaches as material shall not waive the Authority’s authority to designate other breaches as material nor limit the Authority’s right to terminate the Contract, or prevent the Authority from terminating the Contract for breaches that are not material. The Authority’s determination of whether there has been noncompliance with the Contract so as to warrant exercise by the Authority of its rights and remedies for default under the Contract, shall be binding on all parties. No termination or action taken by the Authority after such termination shall prejudice any other rights or remedies of the Authority provided by law or equity or by the Contract upon such termination, and the Authority may proceed against Service Provider to recover all liquidated damages and losses suffered by the Authority.



B. No action or failure to act by the Authority or its Project Manager will constitute a waiver of a right afforded them under the Contract, nor will such action or failure to act constitute approval of or acquiescence in a condition or breach thereunder, except as may be specifically agreed in writing. No waiver by the Authority or its Project Manager of any condition, breach or default will constitute a waiver of any other condition, breach or default; nor will any such waiver constitute a continuing waiver. No provision contained in the Contract shall create or give to third parties any claim or right of action against the Authority or its Project Manager, or Service Provider. Section 9. SECTION 3 COMPLIANCE A. Service Provider shall comply with the Authority’s Section 3 Guide and Compliance Plan (the “Authority’s Plan”), including requisite periodic reporting responsibilities. Additionally, Service Provider shall satisfy its obligations set forth in its most recent Economic Opportunity Plan (“EOP”) and supporting documents, which identify Service Provider’s Section 3 commitments, including, without limitation, hiring and/or training of Section 3 Residents or other Section 3 economic opportunities. B. Section 3 commitments are triggered in full upon commencement of work and/or first assignment. Service Providers who satisfy their Section 3 requirement by making contribution to the Section 3 Fund will be required to provide their contribution within 30 days after each contract year expiration via a separate check made payable to the Housing Authority of the City of Los Angeles. Deductions and withholdings from invoices will not be accepted in lieu of contribution. The contribution amount will be calculated in accordance with the Authority’s Section 3 Guide and Compliance Plan and based on the Authority’s Net Payments to the Service Provider during the contract term. C. Service Provider’s failure to comply with requirements of the Authority’s Plan and/or failure to satisfy its EOP commitments may subject Service Provider to the penalties for default under the Authority’s Plan, including monetary fines and debarment. Section 10. YOUTH PROTECTION POLICY A. Application of Policy to Contract Work ☐ The Authority has determined that the Services will not likely result in employees, volunteers and/or agents of the Service Provider awarded the contract having more than limited contract with or supervision of minors within the meaning of the Authority’s Youth Protection Policy for Service Providers, and as such, the requirements of said Policy will not apply to this Contract. ☐ The Authority has determined that the Services will likely result in employees, volunteers and agents of the Service Provider awarded the contract having more than limited contract with or supervision of minors within the meaning of the Authority’s Youth Protection Policy for Service Providers, and as such, the requirements of said Policy will apply to this Contract. B. Service Provider Responsibilities Under Youth Protection Policy



The Authority’s Youth Protection Policy for Service Providers (“Policy”) was adopted by the Authority in an effort to help ensure the safety of minors served by the Authority’s programs, and requires, to the greatest extent permitted by law, criminal background checks for all employees, volunteers and agents of Service Providers (and their subcontractors) who, in the scope of providing services to the Authority, may have more than limited contact with or supervision of minors. The Policy is incorporated herein by this reference. Service Provider acknowledges the Authority has provided Service Provider access to the Policy, which is posted on the Authority’s public website. 1. As part of its contractual obligations hereunder, the Service Provider is responsible for satisfying all Service Provider requirements set forth in the Policy, including the following: (a) Completing Background Check on all “Covered Persons,” a term defined in the Policy; (b) Prohibiting all Covered Persons from coming into contact with or supervising minors until cleared by the Background Checks required under the Policy; (c) Certifying to the completion of requisite Background Checks by providing to the Authority, in writing, a list of all Covered Persons who have cleared Background Checks (“Cleared Background Check List”) and ensuring ensure its Cleared Background Check List is current, accurate, and available to the Authority upon demand; (d) If eligible, applying for subsequent arrest notification with the Department of Justice in order to receive subsequent arrest notice for Covered Persons; (e) Immediately notifying the Authority, in writing, in the event any Covered Person is arrested for a crime that, if convicted, would cause the person not to pass the Background Check required by the Policy and ensuing arrested persons do not come into contact with or supervise Minors until cleared of all charges; (f) Immediately notifying the Authority, in writing, in the event any Covered Person is investigated for material violations of the Policy and ensuring such person does not come into contact with or supervise Minors until the investigation is complete; and (g) Requiring Covered Persons to sign an affidavit, under penalty of perjury, that contains the provisions described in the Policy. 2. Additionally, Service Provider is required to submit proof of insurance coverage protecting against incidences involving minors, under either a General Liability policy or a separate Abuse and Molestation policy, and to maintain such coverage for the duration of the Contract Term. Section 11. MISCELLANEOUS PROVISIONS A. Successorship. Service Provider and the Authority acknowledge that the provisions of this Contract are binding upon the Parties, their employees, agents, heirs, successors and assigns.



B. Governing Law. This Contract shall be enforced and interpreted under the laws of the State of California without regard to conflict of law principles. In any action arising out of this Contract, Service Provider consents to personal jurisdiction, and agrees to bring all such actions, exclusively in state or federal courts located in Los Angeles County, California C. Severability. If any provision or any part of a provision of this Contract shall be finally determined to be superseded, invalid, illegal, or otherwise unenforceable pursuant to any applicable legal requirements, such determination shall not impair or otherwise affect the validity, legality, or enforceability of the remaining provision or parts of this Contract, which shall remain in full force and effect as if the unenforceable provision or part were deleted. D. No Waiver. No waiver of any provision of this Contract shall be deemed, or shall constitute, a waiver of any other provision, whether or not similar, nor shall any such waiver constitute a continuing or subsequent waiver of the same provision. No waiver shall be binding unless executed in writing by the party making the waiver. Further, the failure of either Service Provider or the Authority to insist, in any one or more instances, on the performance of any of the obligations required by the other under this Contract shall not be a construed as a waiver or relinquishment of such obligation or right with respect to future performance. E. Amendments. This Contract may not be changed, altered, or amended in any way except in writing signed by a duly authorized representative of each party. F. Entire Agreement. The Contract, including all exhibits and other documents incorporated herein or made applicable by reference, constitutes the entire agreement of the parties concerning the subject matter hereof and supersedes all prior agreements, understandings and commitments, whether oral or written. The Contract shall not be amended in any way except by a writing expressly purporting to be such an amendment, signed and acknowledged by both of the parties hereto. G. Binding Authority to Sign and Authorization. Each of the Parties to this Contract hereby represents that all necessary and appropriate actions of their governing bodies, as applicable, have been taken to make the Contract a binding obligation of each of the Parties hereto. The persons executing the Contract warrant that they are duly authorized to execute the Contract on behalf of and bind the Parties each purports to represent. H. Survival. The provisions of the Contract which by their nature survive termination of the Contract or final completion, including all warranties, indemnities, payment obligations, and the Authority's right to audit Service Provider's books and records, shall remain in full force and effect after final completion or any termination of the Contract. I. Counterparts. This Contract may be executed in counterparts, each of which shall be deemed to be an original. J. Working Papers. All statements, records, schedules, working papers and memoranda made by Service Provider incident to, or in the course of, rendering services to the Authority pursuant to this Contract, except for the deliverables submitted by Service Provider to the Authority and except for records which held by the Authority and are part of the Authority's records, shall be and remain the property of Service Provider in the absence of an express



agreement between Service Provider and the Authority to the contrary. No such statements, records, schedules, working papers, or memoranda shall be sold, transferred, or bequeathed, without the consent of the Authority, to anyone other than the Authority’s licensee, successor’s, or assigns, or any combined or merged business or successor in interest to Service Provider. K. Licenses and Permits. Service Provider warrants that it has all necessary licenses, permits and certifications for the Services to be performed under this Contract, including a valid Business Tax Registration Certificate(s) issued by the City of Los Angeles, if applicable. Service Provider shall show proof of such licenses, permits and certifications to the Authority prior to the commencement of the Contract. L. Performance Evaluation. Service Provider’s performance under the Contract, including any work performed by its subcontractors or others under the supervision or control of Service Provider, will be evaluated in accordance with the Authority’s Service Provider Evaluation Form, a copy of which is available at www.hacla.org/forms (copy available upon request). Service Provider understands and agrees that the Authority may rely upon completed Service Provider Evaluation Forms in assessing Service Provider’s qualifications, responsibility and ability to perform on future contracting opportunities with the Authority, and further, that an over-all assessment of “Unsatisfactory”, may result in the Service Provider’s disqualification or debarment from future contracting opportunities with the Authority.

M. Interpretation. Should interpretation of this Contract or any portion thereof, be necessary, it is deemed that this Contract was prepared by the parties jointly and equally, and shall not be interpreted against either party on the grounds that the party prepared the Contract or caused it to be prepared. The captions and headings of the various articles and paragraphs of this Contract are for convenience and identification only and shall not be deemed to limit or define the content of the respective articles and paragraphs hereof.

[THIS SECTION INTENTIONALLY BLANK]




In executing this Contract, the Authority and Service Provider each individually represents that it has the necessary financial resources to fulfill its obligations under this Contract, and each has the necessary corporate approvals to execute this Contract, and to perform the services described herein. IN WITNESS WHEREOF, the Authority and the Service Provider have executed this Contract on the day and year first above written. Approved as to form HOUSING AUTHORITY OF THE MICHAEL N. FEUER CITY OF LOS ANGELES City Attorney By: ______________________________ By: _____________________________ CASEY PAK KEN SIMMONS

Deputy City Attorney Chief Operating Officer General Counsel for the Housing Authority of the City of Los Angeles

insert Service Provider name

By: _____________________________ (Signature of Person Authorized To Sign)

_____________________________ (Printed Name of Person Authorized To Sign)

Title: ___________________________


Contract for Services (Fed) Exhibit 1 - Scope of Services September 2015 (V1)

Exhibit 1 Scope of Services

[to be attached]


Contract for Services (Fed) Exhibit 2 - Contract Fees September 2015 (V1)

Exhibit 2 Contract Fees

[to be attached]


Contract for Services (Fed) Exhibit 3 - General Conditions September 2015 (V1)

Exhibit 3 General Conditions for Contract for Services

[attached]


Contract for Services (Fed) Exhibit 3 - General Conditions September 2015 (V1) 1

CONTRACT GENERAL CONDITIONS FOR SERVICES

Federally Funded Contracts that Exceed the Simplified Acquisition Threshold

1. Definitions (HUD) [Source: HUD Form 5370-C, General Conditions for Non-Construction Contracts, Section I, clause 1] The following definitions are applicable to the Contract: (a) “Authority or “Housing Authority (HA)” means the Housing Authority [of the City of Los Angeles]. (b) “Contract” means the contract entered into between the Authority and the Contractor. It includes the contract form, the Certifications and Representations, these contract clauses, and the scope of work. It includes all formal changes to any of those documents by addendum, Change Order, or other modification. (c) “Contractor” means the person or other entity entering into the contract with the Authority to perform all of the work required under the contract. (d) "Day" means calendar days, unless otherwise stated. (e) “HUD” means the Secretary of Housing and Urban Development, his delegates, successors, and assigns, and the officers and employees of the U.S. Department of Housing and Urban Development acting for and on behalf of the Secretary. 2. Definitions (Authority) The following definitions are also applicable to the Contract and these General Conditions: (a) “Contract” also includes all exhibits and attachments to the Contract entered into between the Authority and the Contractor, Contractor’s Proposal submitted in response to the Authority’s Request for Proposals and all exhibits and attachments thereto, Contractor’s Section 3 Economic Opportunity Plan (EOP), Contractor’s Insurance Endorsements, Change Orders (if any), and Contract Modifications (if any). (b) “Contract Fees” means the amount the Authority shall pay Contractor for the performance of the Contract as set forth in Exhibit 2 to the Contract, subject to adjustments as provided in the Contract Fees and Maximum Cumulative Payment Obligation section of the Contract. (c) “General Conditions” or “General Conditions of Contract” means these General Conditions for Services, including any exhibits and attachments attached hereto, which are specifically made a part of these General Conditions by this reference. (d) “General Conditions for Non-Construction Contracts, Section I” means HUD Form 5370-C, Section I - Clauses for All Non-Construction Contracts greater than $100,000 (exp. 1/31/2017). All references to “HA” in the General Conditions for Non-Construction Contracts Section I refer to



the Authority as defined above. (f) “PHA” means the Authority. (g) “Work” means all of Contractor’s services required by the Contract, including procuring and furnishing all materials, equipment, services and labor reasonably inferable from the Contract. Sometimes referred to as “services” under the HUD clauses set forth herein. 3. Changes [Source: General Conditions for Non-Construction Contracts, Section I, clause 2] (a) The HA may at any time, by written order, and without notice to the sureties, if any, make changes within the general scope of this contract in the services to be performed or supplies to be delivered. (b) If any such change causes an increase or decrease in the hourly rate, the not-to-exceed amount of the contract, or the time required for performance of any part of the work under this contract, whether or not changed by the order, or otherwise affects the conditions of this contract, the HA shall make an equitable adjustment in the not-to-exceed amount, the hourly rate, the delivery schedule, or other affected terms, and shall modify the contract accordingly. (c) The Contractor must assert its right to an equitable adjustment under this clause within 30 days from the date of receipt of the written order. However, if the HA decides that the facts justify it, the HA may receive and act upon a proposal submitted before final payment of the contract. (d) Failure to agree to any adjustment shall be a dispute under clause Disputes, herein. However, nothing in this clause shall excuse the Contractor from proceeding with the contract as changed. (e) No services for which an additional cost or fee will be charged by the Contractor shall be furnished without the prior written consent of the HA. 4. Termination for Convenience and Default [Source: General Conditions for Non-Construction Contracts, Section I, clause 3] (a) The HA may terminate the Contract in whole, or from time to time in part, for the HA's convenience or the failure of the Contractor to fulfill the Contract obligations (default). The HA shall terminate by delivering to the Contractor a written Notice of Termination specifying the nature, extent, and effective date of the termination. Upon receipt of the notice, the Contractor shall: (i) immediately discontinue all Work affected (unless the notice directs otherwise); and (ii) deliver to the HA all information, reports, papers, and other materials accumulated or generated in performing the Contract, whether completed or in process. (b) If the termination is for the convenience of the HA, the Authority shall be liable only for payment for services rendered before the effective date of the termination. (c) If the termination is due to the failure of the Contractor to fulfill its obligations under the Contract (default), the HA may (i) require the Contractor to deliver to it, in the manner and to the extent directed by the HA, any Work as described in subparagraph (a)(ii) above, and



compensation be determined in accordance with the Changes clause, above; (ii) take over the Work and prosecute the same to completion by Contract or otherwise, and the Contractor shall be liable for any additional cost incurred by the HA; or (iii) withhold any payments to the Contractor, for the purpose of off-set or partial payment, as the case may be, of amounts owed to the HA by the Contractor. (d) If, after termination for failure to fulfill Contract obligations (default), it is determined that the Contractor had not failed, the termination shall be deemed to have been effected for the convenience of the Authority, and the Contractor shall been entitled to payment as described in paragraph (b) above. (e) Any disputes with regard to this clause are expressly made subject to the terms of clause titled Contract Adjustments and Disputes herein. 5. Contract Termination; Debarment [Source: HUD Form 5370-C, General Conditions for Non-Construction Contracts, Section I, clause 8] A breach of these Contract clauses may be grounds for termination of the Contract and for debarment or denial of participation in HUD programs as a Contractor and a subcontractor as provided in 24 CFR Part 24. 6. Examination and Retention of Contractor's Records [Source: General Conditions for Non-Construction Contracts, Section I, clause 4] (a) The HA, HUD, or Comptroller General of the United States, or any of their duly authorized representatives shall, until 3 years after final payment under this contract, have access to and the right to examine any of the Contractor's directly pertinent books, documents, papers, or other records involving transactions related to this contract for the purpose of making audit, examination, excerpts, and transcriptions. (b) The Contractor agrees to include in first-tier subcontracts under this contract a clause substantially the same as paragraph (a) above. "Subcontract," as used in this clause, excludes purchase orders not exceeding $10,000. (c) The periods of access and examination in paragraphs (a) and (b) above for records relating to: (i) appeals under the clause titled Disputes; (ii) litigation or settlement of claims arising from the performance of this contract; or, (iii) costs and expenses of this contract to which the HA, HUD, or Comptroller General or any of their duly authorized representatives has taken exception shall continue until disposition of such appeals, litigation, claims, or exceptions. 7. Rights to Data [Source: General Conditions for Non-Construction Contracts, Section I, clause 5] The HA shall have exclusive ownership of, all proprietary interest in, and the right to full and exclusive possession of all information, materials and documents discovered or produced by Contractor pursuant to the terms of this Contract, including but not limited to reports, memoranda or letters concerning the research and reporting tasks of this Contract.



8. Disputes [Source: General Conditions for Non-Construction Contracts, Section I, clause 7] (a) All disputes arising under or relating to this contract, except for disputes arising under clauses contained in Section III, Labor Standards Provisions, including any claims for damages for the alleged breach there of which are not disposed of by agreement, shall be resolved under this clause. (b) All claims by the Contractor shall be made in writing and submitted to the HA. A claim by the HA against the Contractor shall be subject to a written decision by the HA. (c) The HA shall, with reasonable promptness, but in no event in no more than 60 days, render a decision concerning any claim hereunder. Unless the Contractor, within 30 days after receipt of the HA's decision, shall notify the HA in writing that it takes exception to such decision, the decision shall be final and conclusive. (d) Provided the Contractor has (i) given the notice within the time stated in paragraph (c) above, and (ii) excepted its claim relating to such decision from the final release, and (iii) brought suit against the HA not later than one year after receipt of final payment, or if final payment has not been made, not later than one year after the Contractor has had a reasonable time to respond to a written request by the HA that it submit a final voucher and release, whichever is earlier, then the HA's decision shall not be final or conclusive, but the dispute shall be determined on the merits by a court of competent jurisdiction. (e) The Contractor shall proceed diligently with performance of this contract, pending final resolution of any request for relief, claim, appeal, or action arising under the contract, and comply with any decision of the HA. 9. Assignment of Contract [Source: HUD Form 5370-C, General Conditions for Non-Construction Contracts, Section I, clause 9] The Contractor shall not assign or transfer any interest in the Contract; except that claims for monies due or to become due from the Authority under the Contract may be assigned to a bank, trust company, or other financial institution. If the Contractor is a partnership, the Contract shall inure to the benefit of the surviving or remaining member(s) of such partnership approved by the Authority. 10. Certificate and Release [Source: HUD Form 5370-C, General Conditions for Non-Construction Contracts, Section I, clause 10] Prior to final payment under this contract, or prior to settlement upon termination of this contract, and as a condition precedent thereto, the Contractor shall execute and deliver to the HA a certificate and release, in a form acceptable to the HA, of all claims against the HA by the Contractor under and by virtue of this Contract, other than such claims, if any, as may be specifically excepted by the Contractor in stated amounts set forth therein. 11. Organizational Conflicts of Interest



[Source: HUD Form 5370-C, General Conditions for Non-Construction Contracts, Section I, clause 11] (a) The Contractor warrants that to the best of its knowledge and belief and except as otherwise disclosed, it does not have any organizational conflict of interest which is defined as a situation in which the nature of Work under the Contract and a Contractor's organizational, financial, contractual or other interests are such that: (1) award of the Contract may result in an unfair competitive advantage; or (2) the Contractor's objectivity in performing the Contract Work may be impaired. (b) The Contractor agrees that if after award it discovers an organizational conflict of interest with respect to the Contract or any task/delivery order under the Contract, he or she shall make an immediate and full disclosure in writing to the Contracting Officer, which shall include a description of the action which the Contractor has taken or intends to take to eliminate or neutralize the conflict. The Authority may, however, terminate the Contract or task/delivery order for the convenience of the Authority if it would be in the best interest of the Authority. (c) In the event the Contractor was aware of an organizational conflict of interest before the award of the Contract and intentionally did not disclose the conflict to the Contracting Officer, the Authority may terminate the Contract for default. (d) The terms of this clause shall be included in all subcontracts and consulting agreements wherein the work to be performed is similar to the service provided by the prime Contractor. The Contractor shall include in such subcontracts and consulting agreements any necessary provisions to eliminate or neutralize conflicts of interest. 12. Inspection and Acceptance [Source: General Conditions for Non-Construction Contracts, Section I, clause 12] (a) The HA has the right to review, require correction, if necessary, and accept the work products produced by the Contractor. Such review(s) shall be carried out within 30 days so as to not impede the work of the Contractor. Any product of work shall be deemed accepted as submitted if the HA does not issue written comments and/or required corrections within 30 days from the date of receipt of such product from the Contractor. (b) The Contractor shall make any required corrections promptly at no additional charge and return a revised copy of the product to the HA within 7 days of notification or a later date if extended by the HA. (c) Failure by the Contractor to proceed with reasonable promptness to make necessary corrections shall be a default. If the Contractor's submission of corrected work remains unacceptable, the HA may terminate this contract (or the task order involved) or reduce the contract price or cost to reflect the reduced value of services received. 13. Dissemination or Disclosure of Information [Source: HUD Form 5370-C, General Conditions for Non-Construction Contracts, Section I, clause 17] No information or material shall be disseminated or disclosed to the general public, the news



media, or any person or organization without prior express written approval by the HA. 14. Contractor's Status [Source: General Conditions for Non-Construction Contracts, Section I, clause 18] It is understood that the Contractor is an independent contractor and is not to be considered an employee of the HA, or assume any right, privilege or duties of an employee, and shall save harmless the HA and its employees from claims suits, actions and costs of every description resulting from the Contractor's activities on behalf of the HA in connection with this Agreement. 15. Other Contractors [Source: HUD Form 5370-C, General Conditions for Non-Construction Contracts, Section I, clause 19] The Authority may undertake or award other contracts for additional work at or near the site(s) of the Work under the Contract. The contractor shall fully cooperate with the other contractors and with Authority and HUD employees and shall carefully adapt scheduling and performing the Work under the Contract to accommodate the additional work, heeding any direction that may be provided by the Contracting Officer. The contractor shall not commit or permit any act that will interfere with the performance of work by any other contractor or Authority employee. 16. Prohibition against Liens [Source: HUD Form 5370-C, General Conditions for Non-Construction Contracts, Section I, clause 20] The Contractor is prohibited from placing a lien on HA’s property. This prohibition shall apply to all subcontractors. 17. Training and Employment Opportunities for Residents in the Project Area (Section 3, HUD Act of 1968; 24 CFR 135) [Source: General Conditions for Non-Construction Contracts, Section I, clause 21 (Training and Employment Opportunities for Residents in the Project Area)] (a) The work to be performed under this contract is subject to the requirements of section 3 of the Housing and Urban Development Act of 1968, as amended, 12 U.S.C. 1701u (section 3). The purpose of section 3 is to ensure that employment and other economic opportunities generated by HUD assistance or HUD-assisted projects covered by section 3, shall, to the greatest extent feasible, be directed to low- and very low-income persons, particularly persons who are recipients of HUD assistance for housing. (b) The parties to this contract agree to comply with HUD's regulations in 24 CFR Part 135, which implement section 3. As evidenced by their execution of this contract, the parties to this contract certify that they are under no contractual or other impediment that would prevent them from complying with the Part 135 regulations. (c) The contractor agrees to send to each labor organization or representative of workers with which the contractor has a collective bargaining agreement or other understanding, if any, a notice advising the labor organization or workers' representative of the contractor's commitments under this section 3 clause, and will post copies of the notice in conspicuous places at the work site



where both employees and applicants for training and employment positions can see the notice. The notice shall describe the section 3 preference, shall set forth minimum number and job titles subject to hire, availability of apprenticeship and training positions, the qualifications for each; and the name and location of the person(s) taking applications for each of the positions; and the anticipated date the work shall begin. (d) The contractor agrees to include this section 3 clause in every subcontract subject to compliance with regulations in 24 CFR Part 135, and agrees to take appropriate action, as provided in an applicable provision of the subcontract or in this section 3 clause, upon a finding that the subcontractor is in violation of the regulations in 24 CFR Part 135. The contractor will not subcontract with any subcontractor where the contractor has notice or knowledge that the subcontractor has been found in violation of the regulations in 24 CFR Part 135. (e) The contractor will certify that any vacant employment positions, including training positions, that are filled (1) after the contractor is selected but before the contract is executed, and (2) with persons other than those to whom the regulations of 24 CFR Part 135 require employment opportunities to be directed, were not filled to circumvent the contractor's obligations under 24 CFR Part 135. (f) Noncompliance with HUD's regulations in 24 CFR Part 135 may result in sanctions, termination of this contract for default, and debarment or suspension from future HUD assisted contracts. 18. Ownership of Results/Work for Hire (a) Any interest (including, but not limited to, property interests and copyright interests) of contractor or its subcontractors, in drawings, plans, specifications, studies, reports, memoranda, computational sheets or other documents (including but not limited to, electronic media) prepared by contractor or its subcontractors in connection with Services to be performed under this Contract shall become the property of and will be transmitted to the Authority at the conclusion of this Contract. Contractor may, however, retain one copy for its files. Notwithstanding the foregoing, in the normal course of the contractor’s activities, contractor shall have an unrestricted right to reuse its standard construction drawings, details, specifications and other related documents, including the right to retain electronic data or other reproducible copies thereof, and the right to reuse portions or the information contained in them which is incidental to the overall design of the Project. (b) Any and all artworks, copy, posters, billboards, photographs, videotapes, audiotapes, systems designs, software, reports, diagrams, surveys, source codes or any original works of authorship created by contractor or its subcontractors in connection with Services performed under this Contract shall be Works for Hire as defined under Title 17 of the United States Code, and all copyrights in such works are the property of the Authority. In the event that it is ever determined that any works created by contractor or its subcontractors under this Contract are not Works for Hire under U.S. law, contractor hereby assigns all copyrights to such works to the Authority. With the prior written approval of the Authority, contractor may retain and use copies of such works for reference and as documentation of its experience and capabilities. (c) After the completion of the Project, contractor shall not permit any reproductions to be made of any Authority-owned documents without the written approval of the Authority and shall



refer all requests for such documents by other persons to the Authority. 19. General Indemnification (Contractors and Service Providers) (a) The Contractor shall hold harmless, indemnify and defend the Authority and its officers, employees, commissioners, servants, agents, successors, assigns, instrumentality entities, subsidiaries and related non-profit corporations, as well as the directors, officers, employees, commissioners, servants, agents, successors, and assigns of the Authority’s instrumentality entities, subsidiaries, and related non-profit corporations (collectively, “Indemnified Parties”) from and against all claims, actions, lawsuits, complaints, demands, damages, liabilities, losses, obligations, taxes, settlements, judgments, costs or expenses (including without limitation reasonable attorney fees and costs), whether or not involving a third party claim, which arise out of, relate to, or result from (i) any breach of any representation or warranty of Contractor contained in this Contract; (ii) any breach of any covenant or other obligation or duty of the Contractor under this Contract or under applicable law; and/or (iii) any acts or omissions by Contractor, in each case whether or not caused by the negligence of the Authority or any other Indemnified Party, and whether or not the relevant claim has merit. This indemnification provision shall not apply to any claims resulting solely from the gross negligence or willful misconduct of the Authority, the Authority’s officers, employees, commissioners, servants, agents, successors, assigns, instrumentality entities, subsidiaries, and related non-profit corporations, or the directors, officers, employees, commissioners, servants, agents, successors, and assigns of the Authority’s instrumentality entities, subsidiaries, and related non-profit corporations. The Contractor's obligations set forth above shall survive the expiration or termination of the Term of this Contract, including any Option Term. (b) The Authority does not, and shall not waive any rights that it may have against the Contractor by reason of the acceptance by the Authority, or the deposit with the Authority, of any insurance policies or endorsements required pursuant to this Contract. This indemnification provision shall apply regardless of whether or not said insurance policies or endorsements are determined to be applicable to any claims, actions, lawsuits, complaints, demands, damages, liabilities, losses, obligations, taxes, settlements, judgments, costs or expenses described above. 20. Indemnification for Patent and Copyright Infringement (a) Contractor shall defend (with legal counsel reasonably acceptable to the Authority), indemnify and hold harmless the Authority and its officers, employees, commissioners, servants, agents, successors, assigns, instrumentality entities, subsidiaries and related non-profit corporations, as well as the directors, officers, employees, commissioners, servants, agents, successors, and assigns of the Authority’s instrumentality entities, subsidiaries, and related non-profit corporations (collectively, “Indemnified Parties”) from and against all claims, actions, lawsuits, complaints, demands, damages, liabilities, losses, obligations, taxes, settlements, judgments, costs or expenses, including without limitation reasonable attorney fees and costs, that may at any time arise for any claim that the Work, or any part thereof, or the operation or use of the Work or any part thereof, constitutes infringement of any United States patent, copyright, trade secret, trade name, trademark, service mark or any other proprietary right of any person or persons now or hereafter issued. (b) The Authority will give prompt written notice to Contractor of any such action or proceeding and will reasonably provide authority, information and assistance in the defense of same.

nserna

Typewritten Text



Contractor shall keep the Authority informed of all developments in the defense of such actions. (c) If the Authority is enjoined from the operation or use of the Work, or any part thereof, as the result of any patent or copyright suit, claim, or proceeding, Contractor shall at its sole expense take reasonable steps to procure the right to operate or use the Work. If Contractor cannot so procure such right within a reasonable time, Contractor shall promptly, at Contractor’s option and at Contractor’s expense, (i) modify the Work so as to avoid infringement of any such patent or copyright or (ii) replace said Work with Work that does not infringe or violate any such patent or copyright. (d) Above paragraphs (a) and (b) hereof shall not be applicable to any suit, claim or proceeding based on infringement or violation of a patent or copyright (i) relating solely to a particular process or product of a particular manufacturer specified by the Authority and not offered or recommended by Contractor to the Authority or (ii) arising from modifications to the Work by the Authority or its agents after acceptance of the Work. (e) The obligations set forth in this Indemnification for Patent and Copyright Infringement clause shall constitute the sole agreement between the parties relating to liability for infringement of violation of any patent or copyright. 21. Warranty of Title Contractor warrants good title to all materials, supplies, and equipment incorporated in the Work. 22. Contract Modifications The Authority may modify the Contract unilaterally: (1) pursuant to a specific authorization stated in a Contract section; or (2) for administrative matters that do not change the rights or responsibilities of the parties (i.e., change in the Authority address). All other Contract modifications shall be in the form of supplemental agreements signed by Contractor and the Authority. 23. Reporting Requirements Contractor, at such times and in such forms as the Authority may require, shall promptly and timely provide to the Authority such periodic reports as it may request pertaining to the Work undertaken pursuant to this Contract, the costs and obligations incurred or to be incurred in connection herewith, and any other matters covered by this Contract. 24. Order of Provisions; Interpretation (a) In the event of a conflict between the Contract and these General Conditions for Large Purchase Federally-Assisted Services (these “General Conditions”), the Contract shall prevail. In the event of a conflict between the Contract or these General Conditions and any applicable state or local law or regulation, the state or local law or regulation shall prevail. (b) With respect to the Contract, Addenda shall govern over other portions of the Contract to the extent specifically noted; subsequent Addenda shall govern over prior Addenda only to the extent specifically noted.



(c) The Contract may omit modifying words such as “all” and “any,” and articles such as “the” and “an,” but the fact that a modifier or an article is absent from one statement and appears in another is not intended to affect the interpretation of either statement. The use of the word “including,” when following any general statement, shall not be construed to limit such statement to specific items or matters set forth immediately following such word or to similar items or matters, whether or not nonlimiting language (such as “without limitation,” “but not limited to,” or words of similar import) is used with reference thereto, but rather shall be deemed to refer to all other items or matters that could reasonably fall within the broadest possible scope of such general statement. (d) Whenever the context so requires, the use of the singular number shall be deemed to include the plural and vice versa. Each gender shall be deemed to include any other gender, and each shall include corporation, partnership, trust, or other legal entity whenever the context so requires. The captions and headings of the various subdivisions of the Contract are intended only for reference and convenience and in no way define, limit, or prescribe the scope or intent of the Contract or any subdivision thereof. (e) Any claimed inconsistency between a HUD provision and the Authority’s provisions that supplement the HUD provision, the Authority shall have the sole power to decide which provision shall govern in the best interests of the Authority. (f) If a claimed inconsistency cannot be resolved through the order of precedence, the Authority shall have the sole power to decide which document or provision shall govern as may be in the best interests of the Authority. 25. Accounting Records Contractor shall keep full and detailed accounts and exercise such controls as may be necessary for proper financial management under the Contract in accordance with generally accepted accounting principles and practices. 26. Interest of Members of Congress [Source: HUD Form 5370-C, General Conditions for Non-Construction Contracts, Section I, clause 13] No member of or delegate to the Congress of the United States of America or Resident Commissioner shall be admitted to any share or part of the Contract or to any benefit to arise there from, but this provision shall not be construed to extend to the Contract if made with a corporation for its general benefit. 27. Interest of Members, Officers, or Employees and Former Members, Officers, or Employees [Source: HUD Form 5370-C, General Conditions for Non-Construction Contracts, Section I, clause 14] No member, officer, or employee of the HA, no member of the governing body of the locality in which the project is situated, no member of the governing body in which the HA was activated, and no other public official of such locality or localities who exercises any functions or responsibilities with respect to the project, shall, during his or her tenure, or for one year thereafter,



have any interest, direct or indirect, in this contract or the proceeds thereof. 28. Energy Efficiency [Source: HUD Form 5370-C, General Conditions for Non-Construction Contracts, Section I, clause 6] The contractor shall comply with all mandatory standards and policies relating to energy efficiency which are contained in the energy conservation plan issued in compliance with the Energy Policy and Conservation Act (Pub.L. 94-163) for the State in which the Work under the Contract is performed. 29. Limitation on Payments to Influence Certain Federal Transactions [Source: HUD Form 5370-C, General Conditions for Non-Construction Contracts, Section I, clause 15] (a) Definitions. As used in this clause: "Agency" as defined in 5 U.S.C. 552(f), includes Federal executive departments and agencies as well as independent regulatory commissions and Government corporations, as defined in 31 U.S.C. 9101(1). "Covered Federal Action" means any of the following Federal actions: (i) The awarding of any Federal contract; (ii) The making of any Federal grant; (iii) The making of any Federal loan; (iv) The entering into of any cooperative agreement; and, (v) The extension, continuation, renewal, amendment, or modification of any Federal contract, grant, loan, or cooperative agreement. Covered Federal action does not include receiving from an agency a commitment providing for the United States to insure or guarantee a loan. "Indian tribe" and "tribal organization" have the meaning provided in section 4 of the Indian Self-Determination and Education Assistance Act (25 U.S.C. 450B). Alaskan Natives are included under the definitions of Indian tribes in that Act. "Influencing or attempting to influence" means making, with the intent to influence, any communication to or appearance before an officer or employee of any agency, a Member of Congress, an officer or employee of Congress, or an employee of a Member of Congress in connection with any covered Federal action. "Local government" means a unit of government in a State and, if chartered, established, or otherwise recognized by a State for the performance of a governmental duty, including a local public authority, a special district, an intrastate district, a council of governments, a sponsor group representative organization, and any other instrumentality of a local government. "Officer or employee of an agency" includes the following individuals who are employed by an agency: (i) An individual who is appointed to a position in the Government under title 5, U.S.C., including a position under a temporary appointment; (ii) A member of the uniformed services as defined in section 202, title 18, U.S.C.; (iii) A special Government employee as defined in section 202, title 18, U.S.C.; and, (iv) An individual who is a member of a Federal advisory committee, as defined by the Federal Advisory Committee Act, title 5, appendix 2.



“Person" means an individual, corporation, company, association, authority, firm, partnership, society, State, and local government, regardless of whether such entity is operated for profit or not for profit. This term excludes an Indian tribe, tribal organization, or other Indian organization with respect to expenditures specifically permitted by other Federal law. "Recipient" includes all contractors, subcontractors at any tier, and subgrantees at any tier of the recipient of funds received in connection with a Federal contract, grant, loan, or cooperative agreement. The term excludes an Indian tribe, tribal organization, or any other Indian organization with respect to expenditures specifically permitted by other Federal law. "Regularly employed” means, with respect to an officer or employee of a person requesting or receiving a Federal contract, grant, loan, or cooperative agreement, an officer or employee who is employed by such person for at least 130 working days within one year immediately preceding the date of the submission that initiates agency consideration of such person for receipt of such contract, grant, loan, or cooperative agreement. An officer or employee who is employed by such person for less than 130 working days within one year immediately preceding the date of submission that initiates agency consideration of such person shall be considered to be regularly employed as soon as he or she is employed by such person for 130 working days. "State" means a State of the United States, the District of Columbia, the Commonwealth of Puerto Rico, a territory or possession of the United States, an agency or instrumentality of a State, and a multi-State, regional, or interstate entity having governmental duties and powers. (b) Prohibition. (i) Section 1352 of title 31, U.S.C. provides in part that no appropriated funds may be expended by the recipient of a Federal contract, grant, loan, or cooperative agreement to pay any person for influencing or attempting to influence an officer or employee of any agency, a Member of Congress, an officer or employee of Congress, or an employee of a Member of Congress in connection with any of the following covered Federal actions: the awarding of any Federal contract, the making of any Federal grant, the making of any Federal loan, the entering into of any cooperative agreement, and the extension, continuation, renewal, amendment, or modification of any Federal contract, grant, loan, or cooperative agreement. (ii) The prohibition does not apply as follows: (1) Agency and legislative liaison by Own Employees. (a) The prohibition on the use of appropriated funds, in paragraph (i) of this section, does not apply in the case of a payment of reasonable compensation made to an officer or employee of a person requesting or receiving a Federal contract, grant, loan, or cooperative agreement, if the payment is for agency and legislative activities not directly related to a covered Federal action. (b) For purposes of paragraph (b)(ii)(1)(a) of this clause, providing any information specifically requested by an agency or Congress is permitted at any time. (c) The following agency and legislative liaison activities are permitted



at any time only where they are not related to a specific solicitation for any covered Federal action: (1) Discussing with an agency (including individual demonstrations) the qualities and characteristics of the person's products or services, conditions or terms of sale, and service capabilities; and, (2) Technical discussions and other activities regarding the application or adaptation of the person's products or services for an agency's use. (d) The following agency and legislative liaison activities are permitted where they are prior to formal solicitation of any covered Federal action: (1) Providing any information not specifically requested but necessary for an agency to make an informed decision about initiation of a covered Federal action; (2) Technical discussions regarding the preparation of an unsolicited proposal prior to its official submission; and (3) Capability presentations by persons seeking awards from an agency pursuant to the provisions of the Small Business Act, as amended by Public Law 95-507 and other subsequent amendments. (e) Only those activities expressly authorized by subdivision (b)(ii)(1)(a) of this clause are permitted under this clause (2) Professional and technical services. (a) The prohibition on the use of appropriated funds, in subparagraph (b)(i) of this clause, does not apply in the case of- (1) A payment of reasonable compensation made to an officer or employee of a person requesting or receiving a covered Federal action or an extension, continuation, renewal, amendment, or modification of a covered Federal action, if payment is for professional or technical services rendered directly in the preparation, submission, or negotiation of any bid, proposal, or application for that Federal action or for meeting requirements imposed by or pursuant to law as a condition for receiving that Federal action. (2) Any reasonable payment to a person, other than an officer or employee of a person requesting or receiving a covered Federal action or an extension, continuation, renewal, amendment, or modification of a covered Federal action if the payment is for professional or technical services rendered directly in the preparation, submission, or negotiation of any bid, proposal, or application for that Federal action or for meeting requirements imposed by or pursuant to law as a condition for receiving that Federal action. Persons other than officers or employees of a person requesting or receiving a covered Federal action include consultants and trade associations. (b) For purposes of subdivision (b)(ii)(2)(a) of clause, "professional and technical services" shall be limited to advice and analysis directly applying any professional or



technical discipline. (c) Requirements imposed by or pursuant to law as a condition for receiving a covered Federal award include those required by law or regulation, or reasonably expected to be required by law or regulation, and any other requirements in the actual award documents. (d) Only those services expressly authorized by subdivisions (b)(ii)(2)(a)(1) and (2) of this section are permitted under this clause. (3) Selling activities by independent sales representatives. (a) The prohibition on the use of appropriated funds, in subparagraph (b)(i) of this clause, does not apply to the following selling activities before an agency by independent sales representatives, provided such activities are prior to formal solicitation by an agency and are specifically limited to the merits of the matter: (i) Discussing with an agency (including individual demonstration) the qualities and characteristics of the person's products or services, conditions or terms of sale, and service capabilities; and (ii) Technical discussions and other activities regarding the application or adaptation of the person's products or services for an agency's use. (c) Agreement. In accepting any contract, grant, cooperative agreement, or loan resulting from this solicitation, the person submitting the offer agrees not to make any payment prohibited by this clause. (d) Penalties. Any person who makes an expenditure prohibited under paragraph (b) of this clause shall be subject to civil penalties as provided for by 31 U.S.C. 1352. An imposition of a civil penalty does not prevent the Government from seeking any other remedy that may be applicable. (e) Cost Allowability. Nothing in this clause is to be interpreted to make allowable or reasonable any costs which would be unallowable or unreasonable in accordance with Part 31 of the Federal Acquisition Regulation (FAR), or OMB Circulars dealing with cost allowability for recipients of assistance agreements. Conversely, costs made specifically unallowable by the requirements in this clause will not be made allowable under any of the provisions of FAR Part 31 or the relevant OMB Circulars. 30. Clean Air and Water [Source 2 CFR Part 200, Appendix II] (Contracts in Excess of $150,000) Contactor shall comply with the Clean Air Act, as amended, 42 USC 7401 et seq., the Federal Water Pollution Control Water Act, as amended, 33 U.S.C. 1251 et seq., and standards issued pursuant thereto in the facilities in which the Contract is to be performed. 31. Procurement of Recovered Materials [Source: HUD Form 5370-C, General Conditions for Non-Construction Contracts, Section I, clause 22] (a) In accordance with Section 6002 of the Solid Waste Disposal Act, as amended by the Resource Conservation and Recovery Act, the Contractor shall procure items designated in



guidelines of the Environmental Protection Agency (EPA) at 40 CFR Part 247 that contain the highest percentage of recovered materials practicable, consistent with maintaining a satisfactory level of competition. The Contractor shall procure items designated in the EPA guidelines that contain the highest percentage of recovered materials practicable unless the Contractor determines that such items: (1) are not reasonably available in a reasonable period of time; (2) fail to meet reasonable performance standards, which shall be determined on the basis of the guidelines of the National Institute of Standards and Technology, if applicable to the item; or (3) are only available at an unreasonable price. (b) Paragraph (a) of this clause shall apply to items purchased under the Contract where: (1) the Contractor purchases in excess of $10,000 of the item under the Contract; or (2) during the preceding Federal fiscal year, the Contractor: (i) purchased any amount of the items for use under a contract that was funded with Federal appropriations and was with a Federal agency or State agency or agency of a political subdivision of a State; and (ii) purchased a total of in excess of $10,000 of the item both under and outside that contract. 32. Equal Employment Opportunity [Source: HUD Form 5370-C, General Conditions for Non-Construction Contracts, Section I, clause 16] During the performance of the Contract, the Contractor agrees as follows: (a) The Contractor shall not discriminate against any employee or applicant for employment because of race, color, religion, sex, sexual orientation, gender identity or national origin. (b) The Contractor shall take affirmative action to ensure that applicants are employed, and that employees are treated during employment without regard to their race, color, religion, sex, sexual orientation, gender identity or national origin. Such action shall include, but not be limited to (1) employment; (2) upgrading; (3) demotion; (4) transfer; (5) recruitment or recruitment advertising; (6) layoff or termination; (7) rates of pay or other forms of compensation; and (8) selection for training, including apprenticeship. (c) The Contractor shall post in conspicuous places available to employees and applicants for employment the notices to be provided by the Contracting Officer that explain this clause. (d) The Contractor shall, in all solicitations or advertisements for employees placed by or on behalf of the Contractor state that all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity or national origin. (e) The Contractor shall send, to each labor union or representative of workers with which it has a collective bargaining agreement or other contract or understanding, the notice to be provided by the Contracting Officer advising the labor union or workers' representative of the Contractor's commitments under this clause, and post copies of the notice in conspicuous places available to employees and applicants for employment. (f) The Contractor shall comply with Executive Order 11246, as amended, and the rules, regulations, and orders of the Secretary of Labor.



(g) The Contractor shall furnish all information and reports required by Executive Order 11246, as amended and by rules, regulations, and orders of the Secretary of Labor, or pursuant thereto. The Contractor shall permit access to its books, records, and accounts by the Secretary of Labor for purposes of investigation to ascertain compliance with such rules, regulations, and orders. (h) In the event of a determination that the Contractor is not in compliance with this clause or any rule, regulation, or order of the Secretary of Labor, the Contract may be canceled, terminated, or suspended in whole or in part, and the Contractor may be declared ineligible for further Government contracts, or federally assisted construction contracts under the procedures authorized in Executive Order 11246, as amended. In addition, sanctions may be imposed and remedies invoked against the Contractor as provided in Executive Order 11246, as amended, the rules, regulations, and orders of the Secretary of Labor, or as otherwise provided by law. (i) The Contractor shall include the terms and conditions of this clause in every subcontract or purchase order unless exempted by the rules, regulations, or orders of the Secretary of Labor issued under Executive Order 11246, as amended, so that these terms and conditions will be binding upon each subcontractor or vendor. The Contractor shall take such action with respect to any subcontractor or purchase order as the Secretary of Housing and Urban Development or the Secretary of Labor may direct as a means of enforcing such provisions, including sanctions for noncompliance; provided that if the Contractor becomes involved in, or is threatened with, litigation with a subcontractor or vendor as a result of such direction, the Contractor may request the United States to enter into the litigation to protect the interests of the United States. 33. Affirmative Action Program [Source: 41 CFR 60-1.4 and 41 CFR 60-2] Unless otherwise exempt under 41 CFR 60-2.1(b), within 120 days after award of the Contract, Contractor shall have developed for each of its establishments a written affirmative action compliance program that complies with the requirements of 41 CFR 60-1.40. Contractor shall also require its lower tier subcontractors who have 50 or more employees and receive a subcontract of $50,000 or more and who are not otherwise exempt under 41 CFR 60-2.1(b) to establish a written affirmative action compliance program that complies with the requirements of 41 CFR 60-1.40.


Contract for Services (Fed) Exhibit 4 - Certificates of Insurance September 2015 (V1)

Exhibit 4 Service Provider Certificates of Insurance

(attached)