Original Agreement and RTC 13.B1 — City Council and Authorities Concurrent, May 27, 2025 (part 2 of 4)

CITY OF SANTA CLARA
Schedule 2 — Final Service Tower Solutions
h) Survey response rates for the City's current annual Customer Satisfaction surveys are low and the City feels the rates need to be improved. What specific approaches or techniques would you use to increase the rates (e.g., (survey length, survey formats).

Response
Improving response rates to the City's annual Customer Satisfaction surveys requires multiple approaches. The following techniques can be used to address the Annual Customer Satisfaction Survey and other surveys such as ongoing end-user surveys:
• Confirm that the invitation is inviting and reminds the users of the circumstance that drove the survey
• Reduce the number of questions to only the critical few that are really needed to drive action • Verify that the questions are concise and easy to understand, and use a scale that makes sense • Verify that the survey is available on the employees' desktops, laptops, and mobile devices • Promote the survey by creating a standard communication that not only can be sent by the 010, but also considers supporting messages from the City Manager and department leaders • Verify that results are published along with high-level summary action plans for the areas that need improvement. This builds confidence that the surveys are taken seriously.

Unisys also recommends evaluating the survey questions in accordance with the concepts of unipolar versus bipolar, which can help improve a user's interest in completing a survey. A unipolar survey measures one characteristic or trait by differing levels. They typically range from the lowest possible level to the highest possible level. For example, "How efficient was the Unisys Service Desk Agent in solving your problem?" Choices are Extremely Efficient, Highly Efficient, Moderately Efficient, Somewhat Efficient, and Not Efficient. In this example, any response is valid and provides insight into the client experience.

When using a unipolar survey, avoid using numbers and avoid using a scale of more than five levels. A bipolar survey measures different (often opposed) characteristics or traits. For example, "How would you rate your experience with the Unisys Service Desk Agent?" Choices are Very Good, Good, Neutral, Bad, and Very Bad. In this example, a neutral response has no meaningful value and provides no insight into the client experience. For bipolar surveys, the best practice is to use a four-response option survey, removing the neutral option (Very Good, Good, Bad, or Very Bad).

The Unisys preferred position is to use unipolar survey questions because they provide higher granularity.

They are also aligned with research that suggests a five-level scale gives people the best choice range.

However, if our clients want to use bipolar survey questions, the Unisys preferred position is to use a fourpoint scale with no 'neutral' option. Last, we recommend providing the user with the option to enter natural text because it allows analysis of natural language.

Page 39 ends

CITY OF SANTA CLARA
Schedule 2 — Final Service Tower Solutions
i) Describe how your solution incorporates DevOps principles into your standard IT services lifecycle, from design through the development process to production support.

Response
The City requires the incorporation of DevOps principles into its standard IT services life cycle, from the design stage through the development process to production support. This is important because applying DevOps principles will bring cost and quality improvements to the City. Unisys will provide DevOps services that are executed from design through development, testing, release, and production support of IT software and application projects. The Unisys DevOps solution aims to break down silos between development and operations, driving collaboration, communication, and integration. This is executed in the standard IT services life cycle by taking an agile development approach. We also promote the involvement of the appropriate stakeholders and resources from various critical functions to create effective teams for project efforts. Additionally, this solution promotes the DevOps goals of continuous integration and continuous delivery. Unisys will implement IT standard software tools as part of this solution. We will validate application changes and integrate them in a continuous process. Changes will be driven by a pipeline approach and delivered to the appropriate environment from development through test and to production in an automated way. The workflow software will give stakeholders the ability to create agile projects and monitor activity as projects are processed from the design phases and throughout the request life cycle. Automation in areas such as testing life-cycle and environment management will be used to improve delivery speed, improve quality, and bring cost improvements. Last, with increased collaboration between development and operational teams, support for production issues will be addressed promptly by assigning the appropriate resources to bring resolution to outstanding issues quickly. These processes are tightly aligned with Scaled Agile Framework for Enterprises (SAFe) development practices and with current DevOps capabilities.

Page 40 ends

CITY OF SANTA CLARA
Schedule 2 — Final Service Tower Solutions
Describe your solution for providing the City with single integrated portal access to the ITSM Suite and its constituent modules, including portal platform, content, City and third party accessibility, system queries, standard and custom/ad-hoc reporting capabilities and process for maintaining and regularly updating portal information over the term of the Agreement. Explain how the portal will provide the cross-functional data and capabilities listed in Schedule 3A (e.g., Procedures Manual, receipts for purchases made on the City's behalf Service Provider contracted Service Levels, knowledge bases, frequently asked questions, inquiry and reporting access into the asset management system, and an end-user interface fOr Incident ticket entry and status tracking all third party provider documentation (including Service Levels), Customer-provided third party documentation, Service Provider Services reporting).

Response
The CSC ServiceNow ITSM solution modules include those in Exhibit 2.1.1-4.

Solution
Name
Process/Function
Supported
ServiceNow Service Automation Platform
Service Desk
Optimization*
Incident Management Incident Management is the creation of incidents through self-service, chat, email, phone calls,
events, and integrations. Categories help organize
incidents and route them to the appropriate group.

Problem Management Problem Management seeks to remove the causes of incidents permanently from the IT infrastructure.

Problem management helps to identify the cause of
an error in the IT infrastructure that is usually
reported as occurrences of related incidents.

Knowledge Management Knowledge Base application provides role-based tools to create, store, and publish important
information. It also provides tools for all users to find and view the information as needed.

Contextual search is enabled throughout the
platform, fully accessible from the ESS for selfhealing.

For additional details, please see clarifying response
in Section 2.1.1.m for details.

Enterprise Self Service Portal Unisys will enable the Employee Self Service portal for CSC. This includes the following:
• Deploying the base landing page for CSC logo,
branding, image, tiles, primary bar, home page
carousel, utility bar, and footer
• Implement 3 personas: End user, Ops
Management, and Executive
• Enable one Knowledge Base, as documented in
Section 2.1.1.m
• Demonstration of the ESS functionality.

Page 41 ends

CITY OF SANTA CLARA
Schedule 2— Final Service Tower Solutions
Solution
Name
Process/Function
Supported ServiceNow Service Automation Platform
Service Request Service Request Management supports the process with capabilities to raise requests, assign to
appropriate groups, automate escalate, and manage
through to fulfilment and reporting.

Unisys will activate and configure the Service
Request Management module and implement one
Basic Service Request and One Incident form, to be
available in the Service Catalog. Parameters for a
Basic Service Request are listed in the Platform
Management Support section below*.
• Additional creation of SRs is scoped as Basic
and is included in Platform Mgmt Support (see
Platform Management section below*)
• Additional SRs that fall under the Med and
Complex category are priced per SR and can be
submitted as a CR.

Service Level Management Service Level Management enables the automation and monitoring of SLAs against IT processes. SLM
measures service delivery and operational
performance against service level and operational
level agreements.

Satisfaction Survey The survey feature allows the creation, sending, and collecting of responses for basic surveys.

Unisys offers a standard survey functionality based
on closure of Service Requests and Incidents. The
requester is notified through email to respond to the
survey. Each request/incident generates a separate
survey. Questions and rules for surveys will be
based on Unisys best practices, in conjunction with
CSC's oversight and approval. The minimum
number of days that pass will be determined to avoid
sending too many surveys.

Unisys will include up to 5 additional surveys as
required by CSC. Design and functionality will be a
joint effort mutually agreed and as directed by CSC.

Password Reset Password reset enables end users to reset their own passwords using self-service and automation. The
Service Desk assisted password reset feature is an
alternative approach that provides a streamlined
process to quickly fulfill password reset requests.

Unisys will develop an orchestration workflow for the
password reset functionality to one back-end
credential store, i.e., AD.

Service
Governance*
Change Management Change Management will manage and deliver change more effectively. It will reduce service
outages and minimize the potential for adverse
impact to business operations. Inbuilt collision
detection and change calendars will help to
schedule changes at the right time.

Page 42 ends

CITY OF SANTA CLARA
Schedule 2 — Final Service Tower Solutions
Solution
Name
Process/Function
Supported
ServiceNow Service Automation Platform
Release Management Release Management includes the planning, design, building, configuration, and testing of hardware and
software releases to a defined set of release
components. It also can be effectively used to
coordinate releases as a vehicle for planning release
and once a release is finalized, a Change item can
be generated.

Configuration
Management*
Asset Management/CMDB The CMDB will serve as the single system of record for all applications, processes, and infrastructure
data. It is a single data model with accurate data
acquisition through Discovery of known and
unknown Cls and integration to SCCM. Built-in data
reconciliation and normalization will ensure
consistent and accurate data.

Asset Management tracks the financial, contractual,
and inventory details of hardware, software, and
physical/virtual infrastructure, as well as non-IT
asset (if applicable) throughout their life cycle. Asset requests are handled using workflows and
maintenance activity is recorded by Asset
Management.

Enterprise
Integrations
Discovery** implementation Unisys will deploy the Discovery module for the inscope servers. Included with the service is the configuration of the MID Server***, Discovery
module with appropriate schedules, testing, and
validation.
**ServiceNow's Discovery module finds applications
and devices on the network, then updates the
CMDB with the information it finds.
***The MID Server is a Java application that runs as
a Windows service or UNIX daemon. It facilitates
communication and movement of data between the
ServiceNow platform and external applications, data
sources, and services.

SCCM integration Unisys will configure the ServiceNow SCCM connector to synchronize into the CMDB. Included
with the service is the configuration of the MID
Server, SCCM connector, testing, and validation.

Nagios integration
SolarWinds integration
Unisys will configure Nagios and SolarWinds events
and integrate them with the ServiceNow instance for
automatic incident creation. Testing and validation
will also be conducted.

HP ArcSight integration Unisys will develop and implement an integration between HP ArcSight and the ServiceNow instance.

Testing and validation will also be conducted.

Support BAU (Business as Usual) This maintenance service includes break/fix and installation of version upgrades and patches for the
application.

Page 43 ends

CITY OF SANTA CLARA
Schedule 2 — Final Service Tower Solutions
Solution
Name
Process/Function
Supported
ServiceNow Service Automation Platform
Platform Management This service includes Level 2 app and admin Support support, Level 3 engineering/dev support, and
regression testing services. The Platform
Management Support also includes more advanced
configuration and minor customization work, up to
40 hours a month. Unused support hours do not
carry forward.

Included with the Level 2 administration support
listed above, up to 10 basic service requests (not to
exceed 8 hours per month) can be created.
*A basic service request is defined as:
• Fewer than 10 questions
• Static question flow (no conditions)
• Simple fulfillment (1-2 similar tickets and no
conditional fulfillment)
• Minimal mapping (access SR to see
questions/answer)
• Standard Notifications
• Standard Approvals
• Standard SLAs.

Exhibit 2.1.1-4. ServiceNow Solution Modules for CSC.

While the City has been through the onboarding process on the Global ITSM system, we will go through the module configuration workshops* again, as shown in Exhibit 21.1-4. Workshops for the ITSM functional modules, as noted in the above table, will be conducted once during the Process and Design phase. This is to allow CSC to validate/change the design from the Global ITSM system. All module configuration workshops follow a similar format; durations will vary depending on the module.

Through a workshop and interviews, Unisys will present our best practice processes and component methodology. From this process, we will define a set of requirements and an implementation approach.

Unisys will then install the updated workflows into the ServiceNow dev/test environment, validate the results, and then deploy into the production environment.

At a high level, Unisys will:
• Examine your provided existing process documentation (if available) • Evaluate the results of the interviews and process documents against our best practices • Capture CSC's specific requirements as they relate to the functional modules supporting CSC's business processes
• Prepare and present an implementation and deployment project plan • Prepare and present a design document, to be approved by CSC prior to implementing to the platform

Page 44 ends

CITY OF SANTA CLARA
Schedule 2- Final Service Tower Solutions
• Implement the updated workflow processes, data tables, data interfaces, Ul components, business logic for the specific modules in your ServiceNow development/test environment • Identify and resolve process and Ul discrepancies discovered • Incorporate approved processes, data tables, and Ul components in the production environment • Effort will be conducted in the development instance first, then testing in the UAT instance, and finally pushed to the production instance
• Provide one train-the-trainer session on the new functionality, supported by a slide presentation.

Note:
• All on boarding workshops during the Process and Design phase, as noted above, will be performed remotely unless onsite meetings are specifically ordered by CSC. • Workshops do not include process discussions or ServiceNow module training.

Page 45 ends

CITY OF SANTA CLARA
Schedule 2 — Final Service Tower Solutions
k) Explain your proposed 1TSM Suite dashboards solution (including an executive dashboard for City executives) and how it will support the execution of responsibilities of key Service Provider and Customer roles and governance bodies and meetings. What specific elements would you propose to include in such dashboards, including elements that address measures of service quality?
Response
The Unisys solution is based on the ServiceNow platform and the deployment benefits from the expertise that Unisys brings from our deep working knowledge of the platform. The Unisys tuned ServiceNow platform is known for its powerful dashboard and reporting capabilities, which will be crucial to support core governance meetings. The application provides many out-of-the-box gauges, dashboards, and report templates that are instantly available to use. Standard and custom-created reports and dashboard items can be displayed on home pages and run on demand. Reports can also be scheduled and sent to users and groups at regular intervals as attachments or can be exported to web pages. This enables wide publishing of reports without sending large attachments to multiple users.

The reports and dashboards were enhanced from Unisys best practices across the different processes.

This rich content can easily be leveraged as a starting point for custom reports that City departments may wish to create. Unisys leverages the in-platform data and analytics to maximize the platform's power and will continue to strive for continual service improvements.

City users can create additional metrics and surveys to collect more data and present subsequent results in interactive reports and dashboards. A simple and flexible reporting engine allows users to quickly generate, customize, and save reports directly from a list of records with a simple right-click for instant analysis. To personalize dashboards, users can drag and drop gauges and reports to highlight the most important information to them. Incident Management includes a version of ServiceNow Performance Analytics that provides many predefined key performance indicators (KPIs), breakdowns, and the ability to visualize the past 180 days of data.

With the ServiceNow Helsinki release, a refreshed and enhanced set of reports and home pages is available for the applications (Incident Management, Problem Management, Change Management, Request Management, etc.) Additionally, this release contains more than 50 dashboards and 425 different visualizations for Service Management, IT Operations Management (CMDB, Event Management), and Security Incident Management.

The Unisys transformation team will configure the ServiceNow dashboards and program reports required to effectively support the various levels of governance that the City requires to support the program.

These reports include key Service Level Agreement (SLA) metrics; quality metrics; operational metrics such as backlog, aging, and priority tickets; and other key analytical metrics that help to identify "shift best" or other opportunities to drive improvement.

Page 46 ends

CITY OF SANTA CLARA
Schedule 2 - Final Service Tower Solutions
1) Describe how your solution will address the service requirements and Service Levels associated with providing the city with periodic reports around operation improvement recommendations and innovation through new products and services. Explain how you will address unique attributes and considerations for each City department in making such recommendations.

We report on article usage stets and comments received, and review/analyze the articles linked to tickets created. Our Knowledge Manager analyzes this data along with data on resolution rates and will work with Unisys groups and client SMEs to address any opportunities to increase resolution and/or reduce handle times. The reporting built into ServiceNow along with reports that our Unisys quality department produces allows Unisys to quickly drive to a root cause of any resolution issues and also identify opportunities to further service desk resolution opportunities. As ServiceNow is built upon KCS principles (Knowledge Centered Support), the structure of the database is already correlated to best practices and allows us to further drive excellence in the Knowledge space.

Response
Service improvement and innovation are crucial to the City's success. Doing them successfully requires not only a continuous improvement and innovation mindset but also a structured approach for tracking these ideas from start to finish. The Unisys solution will establish an approach that meets the City's requirements for reporting on operations improvement recommendations and innovation. The approach is known as the Continuous Service Improvement and Innovation Plan (CSIIP). This process is a formal way to identify, review, prioritize, and track improvement and innovation concepts from start to finish. This approach will enable Unisys account leadership to align with City leadership on activities that are approved, funded if required, prioritized, and launched. The process can be tuned to capture departmental impacts to prevent the team from missing out on key departmental improvements.

This process relies on the efforts of key team members and on overall system metrics. The different system components must come together into an effective view that leadership can rely on and use to measure performance and identify opportunities to drive operational improvement and innovation ideas.

The Unisys solution will enable a Service Level reporting approach that allows performance to be tracked at the required level of detail. This approach includes SLAs related to the Service Desk, Field Services, Infrastructure, Applications, and Project milestones. The ServiceNow platform can be configured to allow the team to look below an aggregate SLA to see how performance is occurring at a department level so that unique actions that might affect a specific department can be identified.

When service improvement measures are not represented in service data, Unisys will augment that data with surveys or other data collection methods that are tailored to the service. Identification of the service improvement recommendations will be determined through periodic outreach to individual departments or groups with common interests. Exposure of new technology with potential for service improvement will be made part of periodic departmental gatherings that are patterned on product user group meetings and

Page 47 ends

CITY OF SANTA CLARA
Schedule 2 — Final Service Tower Solutions
active participation in key product meeting and conferences. We will capture the recommendations and actions as part of our CSLIP process that will track our continuous improvement and innovations actions throughout the year.

Page 48 ends

CITY OF SANTA CLARA
Schedule 2 — Final Service Tower Solutions
tn) Describe your proposed knowledgebase solution and how you will drive its use across City EndUsers as well as Service Provider staff.

Response
The Unisys proposed Knowledge Management solution will reside within the ServiceNow platform. It is configured to address both "how to" and procedural questions and will reflect views that correspond to a user's access level. The articles will be maintained by a Unisys knowledge manager who will respond to user feedback, work with resolver stakeholders, and read survey and quality analysis data with the operation to receive feedback on knowledge artifacts.

Unisys will develop knowledge articles and documentation to handle issues that are high call drivers during the implementation, by the Transition Knowledge Manager. In addition, we will also address issues that are identified by our team and CSC's SMEs as being important to deliver (high urgency and/or impact). We will partner with CSC contacts to identify who should be consulted to develop the list of important problem types and will develop a process to identify any ongoing knowledge gaps so that the knowledge manager can work to create any documentation that may be missing on an ongoing basis. We have an extensive knowledge base of standard articles (COTS) available in our ServiceNow instance that will be available in Istanbul.

The Transition Knowledge Manager will drive processes and will work with the operation team and CSC SMEs to make sure that any pain points are addressed from the transition kickoff through Hypercare. The steady state KM will continue to maintain and develop the changes in knowledge in partnership with any identified CSC SMEs. This work cannot be done without consultation with CSC resources, as identified by CSC's transition team.

Steady state KM's hold meetings on an agreed-to schedule to discuss normal changes and the progress against them. They will also discuss strategies for improving article usage and first call resolution through identifying proceses the service desk can perform to avoid dispatches or referrals to client resolvers - this effort is perfomed in consultation with operational resources and with client SME's. A set of standard reports produced against knowledge-centered metrics gives the KMs and the delivery teams information about how best to deliver services and to maximize LO and Li resolution.

In summary, for the Knowledge Management transition, Unisys will provide the following:
• The top 10 call driver articles
• The top 10 processes with a high urgency and/or impact • The top 10 "how to" articles

Page 49 ends

CITY OF SANTA CLARA
Schedule 2 — Final Service Tower Solutions
• The top 10 procedural articles
• The top 10 Unisys-driven processes to support service delivery.

All of the above will be driven by the Transition Knowledge Manager with a current ticket dump that includes product types, "how to" or instructional data, product types, etc. n) Describe your proposed solution and approach for providing cross-functional Service Integration Services described in Schedule 3A.

Response
Unisys proposes providing the City with an Enterprise Service Management platform, wrapped with endto-end services and support. Our overall Service Management solution includes a new ITSM platform based on ServiceNow. This new ITSM platform, along with the current infrastructure and security monitoring solution, enable the Service Integration Services described in Schedule 3A. The ServiceNow platform will be integrated with existing infrastructure monitoring tools and the Unisys S1EM solution to establish a comprehensive monitoring capability for the City's environment. Automated flow of critical alerts into the ITSM tools as incidents is a key feature; these incidents will be routed with the proper priority to the appropriate resolution teams, including third parties that use the system for resolution. This enables an end-to-end integration of the key components to maintain reliable, high-quality delivery.

The ServiceNow platform has industry best practices for reporting capabilities. This includes various time stamps along the way for incidents and requests to enable analysis to be accomplished at various levels to look for opportunity. Reporting on response and resolution times is a key component that will enable the City to understand the speed at which services are delivered to City employees. The platform also provides a portal that will contain knowledge articles that are available to resolver teams and end users to enable information to be shared in a way that drives a better experience.

The Unisys solution and operational processes are based on a comprehensive set of ITIL-aligned processes for the ITSM functional modules. Our ITIL-aligned processes are certified to ISO 20000, which means that the processes are regularly audited and updated to provide compliance with highest quality standards. Therefore, the City will benefit from a Service Management framework that represents industry best practices.

Page 50 ends

CITY OF SANTA CLARA
Schedule 2 - Final Service Tower Solutions
o) Describe how the Enterprise Architect key position will drive value chains across the City's IT environment and what core competencies and methodologies you will bring through your company's expertise in this area?
Response
The Enterprise Architect will drive value chains across the City's IT environment through the delivery of Five Critical Deliverables, including the IT Strategic Plan (ITSP), the Enterprise Architecture Plan (EAP), The Digital Government Plan (DGP), Innovative Products and Services Report (IPSR), and the Services Strategic Review Report (SSRR).

The Digital Government Plan and the IT Strategic Plan will start with establishing the business goals of each department in terms of the City's Mission and Vision through a series of focus group meetings.

Drawing upon strategic planning methodologies developed by Gartner and the Meta Group, the ITSP will align business goals, driven by the City's Mission and Vision, to enabling technology components, to create a Future State vision. Gaps between the Current State and the Future State then become the building blocks of future projects which will be prioritized based on technical sequencing, expected value, maturity (adoption readiness), and budget. The EAP will take the conceptual picture of the ITSP and determine requirements based on a framework of architectural domains. By using an EA framework to establish requirements, we ensure that new capabilities are introduced that interoperate with existing systems. Development of the City's EAP will draw upon formal frameworks such as Zachman and FEAF, but at a higher abstraction level to reduce the cost of maintenance and sustainability of the EA program appropriate for a city the size of Santa Clara. The ITSP and the EAP form the foundation for governance of the investment in IT based on business goals aligned to the City's Mission and Vision.

The IPSR will be developed by monitoring industry trends and ideas from other municipalities. The Enterprise Architect will use the IPSR to engage City departments to expand awareness of how technology can be used to realize their business goals. This increased engagement in the identification of future change elements will aid in driving adoption of new capabilities and technologies. The SSRR gives the Enterprise Architect the opportunity to monitor progress toward the realization of business goals, and provide suggestions for remediation of adoption risk. Success metrics introduced in the ITSP will form the basis for this assessment.

The Enterprise Architect will drive value by establishing a clear roadmap of technology enabled capabilities that are aligned to business goals that have been developed through diverse engagements with City departments,

Page 51 ends

CITY OF SANTA CLARA
Schedule 2 — Final Service Tower Solutions
p) Describe how you will ensure cross-Service Tower collaboration to ensure that the Service Provider is delivering IT services in a holistic, integrated fashion.

Response
To enhance cross-service tower collaboration, we will transform the environment to one that is driven by DevOps and Agile (the SAFe methodology). Unisys will first properly baseline the performance and efficiency using clearly defined and granular work type items. Each resource will account for their time, which is categorized into operational and project types. Unisys will also bring Organizational Change Management expertise to enable communication and training plans to be developed to further foster the successful adoption of these practices. These methodologies will be the cornerstone of encouraging cross-service tower collaboration in a climate of change and growth. This holistic and integrated approach will establish a climate that provides a solid foundation for clarity, ownership, shared outcomes, and increased productivity.

Unisys will continue to leverage daily tower checkpoints to verify that everyone is moving toward shared goals, has full understanding, and is accountable for his or her areas of ownership. Additionally, tower leadership meetings will review daily progress and provide further opportunities for adjustment. Metrics will be compared to the baseline to show improvement. Furthermore, project plan milestone dates will be evaluated for change.

Page 52 ends

CITY OF SANTA CLARA
Schedule 2- Final Service Tower Solutions

2.1.2 Cross Functional Solution Overview
Instructions: Provide an overview of the Cross Functional solution you propose to address the City requirements stated in Schedule 3A. Incorporate responses to common solution characteristics and description elements listed above. Limit 5 pages.

Response
• Service area roles
• Dedicated on site staff
• Leveraged staff
o Onsite vs. offsite
o Functions to be performed
• Provider COEs or other Service Provider groups e.g., innovation councils • Split between keep the lights on operations, proactive improvement operations, and projects • Level of effort assumptions included in proposed pricing for each of the following areas:
o Operations
• Keep the lights on operations
• Proactive improvement operations
o Projects
The staffing model elements include roles dedicated or leveraged staffing, splits, COEs, councils, and operational or project effort. They are similar for both the City Approach and the Provider Approach. The clarification for each of these elements is in each section (e.g., 2.1.2, 2.2.2., 2.3.2, 2.4.2, 2.5.2), and included in other applicable sections. Furthermore, definition and clarification of split effort, for both approaches, are in the pricing worksheets.

Unisys has a deep understanding of the essential requirements to design and implement an ITSM platform for our customers. We have developed our own best of class toolsets by introducing proprietary processes and configurations. This deep knowledge and experience is transferable to CSC and is included with our solutions. Our methodology focuses on using highly maintainable configurations of the ServiceNow platform, which means customization is very minimal, if at all. This approach also enables integrations to be created to your external infrastructure systems, through orchestration and automation capabilities (i.e., password reset, SCCM, Nagios, SolarWinds, etc.).

Our goal is not just to replicate what is utilized in our global ITSM system but to implement only what is needed to deliver the required services to CSC that provide business value. With our knowledge of your current ITSM environment, we start by conducting a mapping exercise to compare data fields from the legacy to the new, against CSC's business requirements. We will then draft a data design document that will detail the configurations, from the foundation data to the workflow processes, business rules/logic, Ul

Page 53 ends

CITY OF SANTA CLARA
Schedule 2 — Final Service Tower Solutions
components, and data tables/interfaces for CSC's specific functional modules. This exercise cannot be done without consultation with CSC resources, as identified by CSC's transition team.

In our experience, we have stepped into multiple deployments where the contractors have over promised and been unable to meet their timelines and requirements for the client. Fast tracking such implementations has led to end-user dissatisfaction with a tool that is not fully ready for deployment and budget overruns.

Outlined below is a representative sampling of our recent engagements that demonstrates our expertise and knowledge from end-to-end.

Major wholesale food chain
• Implemented Service Request Management for the entire enterprise • Managed incident, problem, and asset management
• Minimized service desk workload by optimizing resolution times • Optimized client's investments by completing deployment within schedule • Improved end-user experience via services which consistently met or exceeded KPIs.

Automotive distributor
• Legacy system was an outdated version of HP Service Manager • Implemented our Service Desk Optimization and Service Governance solution • Implemented end-user services
• Deployment completed on time and within budget
• Expanding services to ITOM modules (ServiceNow Discovery and Service Mapping).

Science and technology company
• Deployed zBoot (a clean implementation of the ServiceNow platform) • Full asset management, software asset management, Service Desk, and Field Services • Deployment completed on time and within budget
• Existing 6-year version of ServiceNow that was not working as expected.

United States Commonwealth Client
• Implementation for IM, PM, CM, Service Catalog, SLM, and AM • ODS integration for reporting
• Monitoring and Event Management

Page 54 ends

CITY OF SANTA CLARA
Schedule 2 — Final Service Tower Solutions
• Discovery and CMDB integration
• SAP integration to Service Catalog and billing
• Implemented processes to provide consistency and support for their requirements.

State agency (Department of Justice)
• Old version of SM tool
• Deployed Service Desk
• Expanding services to include service catalog deployment and additional usage of ServiceNow • Deployment completed on time and within budget.

Unisys is confident that with our dedicated Service Management team and the ServiceNow platform, this allows us to meet the stated requirements and will provide CSC the flexibility to accommodate changes and growth in the organization. Our partnership with ServiceNow augments our capability with our services.

Yes, the proposal presented to CSC includes all activities needed to implement and perform an initial populating of the CMDB, as well as asset and license management system.

Organizing and managing the application tower activities and resources will be similar as with all other towers. Each resource's knowledge and skills must be shared with at least one other resource. A succession plan is critical for a number of reasons, including removing bottlenecks in the organization.

Unisys will cross train and establish a succession plan with each named resource during transition.

Most important, Unisys leadership will train each person on how to think beyond tasks and establish a vision in their domain. Each person must believe in what they are working on, in order to gain satisfaction in a job well done. As such, they must own objectives rather than only tasks. Unisys leadership will strive toward a culture shift of higher-level objectives and owning a vision, which encourages more thinking that is creative and growth.

The applications team will be organized along with major areas of business functionality, giving City employees a known point of contact who understands their business issues. These major areas include Public Safety (Police and Fire), Finance, HR and Admin (ERP, Recruitment, Budget, Document Management), Utility Management (Utility Billing), Land Management (Permitting, Work Order Management), and Web and Digital (City Websites, SharePoint, Agenda Management and Streaming Video, Social media, Citizen engagement). We will ensure that each application has a primary and secondary person assigned to ensure continuity during planned and unplanned absences.

As technology changes, the team will need to adjust and learn. Unisys will provide team members with access to resources within Unisys. Unisys University has a wealth of training available to employees.

Each team member will have a training plan that can be achieved through Unisys provided tools in

Page 55 ends

CITY OF SANTA CLARA
Schedule 2 — Final Service Tower Solutions
meeting established goals. If there is a specific skill needed beyond what is available, Unisys will mutually agree with the City on those requirements, which may include specific training classes, bringing in new resources, etc. The applications team will also forge strong relationships with the City's vendors to ensure understanding the City's business needs and incorporate those into product roadmaps. This will help with future planning but will also help resolve any immediate issues.Each resource on the applications team, each will define their roles and responsibilities as it applies to the City's transformation goals, principles, mission, and vision. Unisys management will help by doing continual levels of follow up, weekly, against those responsibilities. Furthermore, management will not allow deviance to ensure change happens and cultural habits that prevent growth are quickly broken down.

Work plans will establish milestone dates. Resources are accountable to those milestones, consistently, in order to establish a culture of excellence and high performance. Unisys recognizes that if accountability is not consistent, it will breed a culture of mediocrity. Unisys is committed to moving away from this type of culture by showing improvement with measurable results by the end of the transition phase.

Improvements are shown by establishing metrics, snapshotting a baseline, then showing improved progress over the baseline toward mutually agreed milestones.

The PM0 will follow a well-defined and rigorous best practice PM0 methodology. For success, scope must be clearly defined and agreed to by all stakeholders. The scoping process is established from a clear definition methodology and charter process. As such, the current charter process will change to providing options with impacts, rather than only establishing constraints. This change will therefore provide the City facts to make the best decisions on priorities. The Jira tool will provide workflow, capacity, and demand management. Furthermore, source control management, test automation, configuration, and environment management are provided and described herein.

Page 56 ends

CITY OF SANTA CLARA
Schedule 2 — Final Service Tower Solutions
Response
Unisys agrees to and will use the IT guiding principles in Schedule 3A and understands the importance of having the right skills, relationships, focus, and consistency that are required to deliver cross-functional services that work effectively across towers and personnel. To assume a leading role in driving the alignment of strategy with the City's IT business objectives, we will adhere to the strong teamwork processes described in this response.

Unisys will provide a mix of dedicated and remote staff to provision, deliver, and manage the crossfunctional services in Schedule 3A. Onsite resources include key service provider personnel, as described in Schedule 9. Additionally, onsite resources include application analysts, field engineers, endpoint engineers, security and network engineers, and at least two project managers. Unisys will use offsite resources for other functions such as application packaging activities; infrastructure and security monitoring; Level 1 and Level 2 Service Desk agents; and incident management, problem management, knowledge management, reporting, operational analytics, and change management functions.

Unisys will comply with applicable standards, policies, regulations, and applicable laws. These include ITIL/ITSM, PMP, ISO 27001, ISO 17799, PII, PCI, HIPAA, CJIS, CMM1 Level 3, ISO 2000, ISO 27301, ISO 21500, and ISO 18770.

Unisys will provide several key tools critical to our solution, and we will leverage other key tools that the City owns today. One of the most critical tools from Unisys will be the ServiceNow platform, which will be deployed as the enterprise ITSM platform and provide core Service Management functionality such as Incident, Request, Problem, Change, Configuration (CMDB), and Knowledge Management, ServiceNow will also provide the end-user portal for access to knowledge articles for self-help and other end user-centric features. Unisys will also use Nagios and SolarWinds for automated monitoring of the core infrastructure and HP ArcSight, which is used for the Unisys SIEM solution. We will provide key Microsoft tools such as Visio and Project as required in the delivery of service to Unisys Team members.

Unisys will use City-provided licenses and tools such as Microsoft System Center Configuration Manager (SCCM) for use by our end-point engineers and asset management personnel. Other City-provided tools that U nisys will leverage include SCEP, MDT, Flexera, and AirWatch for mobile device management.

Unisys will continually adjust priorities to meet the City's ongoing requirements and recognizes that needs will shift between strategic initiatives, to projects, to operations. We will help to confirm that changes are well understood, so that the City may make the best decisions for meeting competing schedules. Project management is the art of balancing those competing objectives; therefore, Unisys emphasizes the importance of adhering to a robust Program Management Office (PMO). The PM0 will provide a set of policies, processes, and methodologies based on DevOps, SAFe and Project Management Institute that project teams can use to facilitate the implementation of successful projects. These project management tools are identified and deployed as part of the DevOps and SAFe (Agile) transformation with the goal of assuring that stakeholder expectations are clearly understood; issues, risks, and problems are quickly

Page 57 ends

CITY OF SANTA CLARA
Schedule 2 — Final Service Tower Solutions
identified and addressed; and complete and open communications with project stakeholders are maintained. No two projects are identical. The project management tools delivered will provide the flexibility needed to accommodate a wide range of project types while providing the controls needed by the PM0 to track project status and resource utilization effectively.

The PM0 will enable project portfolio management processes and the monitoring of individual projects.

Management reports that clearly identify resource utilization and resource capacity will be published each month. A monthly project portfolio review meeting will be conducted to evaluate project performance, align the project portfolio with strategic objectives, monitor and manage staff capacity, and identify issues and risks. Project timelines will be mutually agreed upon based upon clear scope definition and applicable Project Deliverables. Upon priority or scope changes, the timelines must be adjusted accordingly.

Satisfaction Surveys: Satisfaction surveys are a crucial part of assessing the overall value being delivered across the enterprise. As detailed in our responses to RFP requirements 2.1.1f, 2.1.1g, and

2.1.1h, Unisys will deploy multiple surveys to enable us to capture appropriate feedback from employees to City leaders. Some of the surveys are transactional and focus on how a call to our Service Desk went (for example); others are at a departmental leadership level to assess how IT is supporting the City's business goals, and others are annual surveys to assess overall performance to the City.

Continuous Service Improvement Process: Continuous improvement and innovation is a mindset that Unisys will drive across the enterprise and towers. Identifying opportunities is an obvious step in this process, but it is just as crucial to evaluate, analyze, decide, prioritize, and track the efforts to completion.

Unisys will use an approach called the Continuous Service Improvement and Innovation Plan (CSIIP) to add structure, reporting, and consistent governance for the ideas so that the overall City and Unisys team are aligned with the priorities and progress to drive value to the City.

Critical Deliverables: The critical deliverables are an important part of the program; a strong governance approach will be established to enable the deliverables to be clearly tracked and continuously visible to the City. These deliverables drive quality, define operational methodologies, and establish the strategy for meeting the City's goals as well as reflect on how the program is performing overall to support the City's objectives. To confirm that a strong focus is placed on the creation of the deliverables, Unisys will leverage dedicated account resources supported by our experts as necessary and foster ongoing maintenance of these deliverables in accordance with Schedule 3A, Section 8.0.

IT Governance: To manage and administer the full portfolio of the required deliverables in Schedule 3A, Unisys will develop a leadership framework that fosters a culture of innovation and growth toward higher level business outcomes. We will set priorities in moving toward the City's vision and objectives: to promote a living and working environment that allows for the best quality of life in Santa Clara through technology and innovation. Governance will manage how we listen, innovate, and inspire new technology solutions that demonstrate value to Santa Clara.

Page 58 ends

CITY OF SANTA CLARA
Schedule 2 — Final Service Tower Solutions
Tools and Knowledgebase: Effective knowledge management will drive costs down, increase end-user satisfaction, and drive efficiency. Unisys' ITIL process knowledge and partnership with ServiceNow will bring the best service management expertise and tool on the market to meet the requirements for the proper ITSM tools that are described in Schedule 3A. Unisys will use an ITIL v3 compliant framework and operations model that incorporate Lean Six Sigma principles to maximize the value to the City.

Security Services: The information security program integrates security protections and processes throughout the technology services that are delivered. The program will be defined in collaboration with the business units to confirm that it meets their security needs, and a related Cybersecurity Plan will be developed and maintained as part of the program. To define the program, an Information and Cybersecurity policy will align with the City's security plan and provide the necessary governance for the City to achieve its security objectives, such as maintaining regulatory compliance with PCI. The security expertise and services are also forward leaning to provide protection for future cloud services and future convergence of industrial control systems with IT. Security services will include risk assessment, advisory, planning, awareness, SSAE 16 SOC 1 Type 2 reports, SIEM, penetration testing, intrusion detection and prevention, incident response, threat assessments, physical security, environmental controls, Active Directory administration, vulnerability scanning, patch management, and malware prevention.

ITLC and Operations Services: Unisys recognizes the importance of adhering to a strong methodology for the life cycle of services, as described in Schedule 3A. Therefore, we will perform Information Technology Leadership Council (ITLC) and Operations Services by confirming that the success criteria are defined to the City's success criteria of the objectives. Additionally, Unisys will start life-cycle plans with the following end goal in mind: how the user will learn and benefit from the new technology. When the ideal use case is understood first, high-quality outcomes are maintained.

Service Delivery: To provide capacity management, availability management, service level management, and other functions that are described in Schedule 3A, Unisys will conduct periodic reviews of each functional responsibility to maintain the highest level of quality on time.

As part of Acquisition and Management Services, Unisys will manage the overall procurement process for hardware, software, and services. Unisys will liaise with hardware vendors to cover administration tasks related to the procurement of new devices and consumables as part of daily operations and refresh projects. This process will be initiated by a service request in ServiceNow, where the fulfillment of a service request will trigger a purchase of a new device or consumable.

The Unisys procurement team will also provide input to a Unisys PM0 resource who will liaise with the City to define and maintain the equipment list that can be ordered and confirm that Service Catalog items are current and in line with the respective services. Unisys will not take financial responsibility for the purchased devices; service covers the procedure of facilitating procurement administration on the City's behalf.

Page 59 ends

CITY OF SANTA CLARA
Schedule 2 — Final Service Tower Solutions
Another important area for emphasis under service delivery is asset management. Having the best processes and tools in place for asset management is critical so the City has visibility to make decisions, verify compliance, determine the best department business outcomes, and avoid cost overruns.

Asset management includes hardware and software license tracking as well as a strong methodology and set of tools with automation to help with driving an accurate result. Unisys will use the ServiceNow platform as the core component to drive asset management that improves inventory accuracy and leverage tools such as the Unisys instance of AssetTrack and the City's SCCM tool. This will improve the City's IT portfolio management (e.g., Heat Map Report and TIME Analytics) for better data accuracy.

The current Atrium Configuration Management Database (CMDB) data will be moved or integrated with a ServiceNow CMDB, depending on the accuracy of the CMDB as it stands today. ServiceNow has a direct SCCM Connector that we will implement with a MID Server to handle the communications. For the data center servers, we will implement Discovery to feed the CMDB. Unisys will bring in an Asset Management Subject Matter Expert to review and align the existing data model in preparation for any initial data loads or future automated data loads. The SME will also review current processes and documentation and update to suit current city needs. The existing asset data will be analyzed and updated as necessary. The SME will also work with the reporting team to set up the weekly, monthly asset reports as identified in Schedule 7. These efforts in combination with the ServiceNow CMDB will help Unisys and the City to improve the quality of the current CMDB data and have confidence in the CMDB as a complete, correct, and compliant single system of record to drive business-critical processes. The ServiceNow CMDB also allows quick and easy visualization of the infrastructure and service configuration information to understand impact and risk, make better decisions, and provide high-quality business services. Unisys will also help the City with business development that includes requirements gathering, development of scope, RFP evaluation, and making recommendations.

To further enhance the input channels to the CMDB, Unisys proposes to continue using the AssetTrack tool. It deployed at the city and will be integrated with ServiceNow CMDB by Unisys integration teams.

Unisys client engineers to capture changes applied to the equipment and report any discrepancies will use AssetTrack. The incoming data arrives into a sandbox, where the Unisys Asset Management Team validates it before allowing it to reconcile with the CMDB data. This ensures the accuracy of the CMDB, by avoiding incorrect data entries.

As part of Software License Tracking services, Unisys will record and maintain software information to track instances of software installed in the city environment and cross-reference this inventory with a defined list of approved software (Definitive Software Library) and license details provided by the City.

The Asset Management SME will review and work with Unisys teams to perform the initial load of all software installed instances using agreed technologies and methods during the Transition Unisys will:
• Administer software licenses for the supported environment, including the entry of software contracts

Page 60 ends

CITY OF SANTA CLARA
Schedule 2 — Final Service Tower Solutions
• Initiate procurement of appropriate licenses that reflect ongoing demand • Liaise with software vendor regarding license availability and demands on behalf of the City • Monitor license usage to determine the appropriate versions are available and being used • Maintain consistent versions of in-scope software.

The Unisys Asset Management team does software license compliance monitoring by performing a series of steps listed.

The Unisys Asset Management Team uses the reports of Approved software data from DML (Definitive Media Library), the software contract data, and Software licenses data from ServiceNow to determine the number of active contracts, number of contracts reaching expiry, historical contracts, etc. Using the reports from SCCM, the team reviews the license usage of the software contract along with the number of licenses available in the pool. The Asset Management team then determines whether the organization is still in compliance with the license agreement based on the reviews and will create a software compliance report that will be published to the city on a weekly basis.

The service does not include acquisition or financial responsibility for the software licenses or for software license compliance. Software License Tracking is driven by the Service Request Management and Change Management processes. Changes of ownership, configuration changes, relocation, and other resultant changes to the software asset will be updated in the asset repository.

Unisys will also perform periodic audits of hardware and software assets. Audit could be initiated by the City or initiated internally by Unisys. If any exceptions are discovered during the audit, such as over utilization of licenses, a non-conformance is raised, audit reports are published, and observations are tracked for closure. Based on the audit observations, investigations are initiated and sufficient amounts of licenses are procured or the hardware asset variance is resolved as the case may be.

The Unisys Asset Management solution will deliver a structured and managed approach to provide contracted assets that are collected, captured, and tracked at every stage of the asset life cycle in the asset repository. It will enable tracking of IT equipment from the time it is procured to its disposal. Unisys will track and manage the hardware assets listed in the table below. Unisys will record and track equipment and software details, such as serial number, model number, make, license number, version, and ownership, as well as builds.

ASSET TYPE QUANTITY
Workstations (Desktops & Laptops) 1022
Mobile Devices (Tablets) 310
Printers and Multi-Function devices 182
Network scanners 2

Page 61 ends

CITY OF SANTA CLARA
Schedule 2 - Final Service Tower Solutions
Audio Video equipment 17
Servers (Physical & Virtual) 247
Storage devices 6
Network equipment (switches, routers, firewalls,
wireless controllers)
102
Service Support: Support includes the services described in Schedule 3A, such as incident management, major incident management, problem management, configuration management, and change management. The service desk tower, built under the ITIL processes, provides incident management, service request management, major incident management, problem management, knowledge management, and ancillary support with metrics and reporting. Automation is included with monitoring systems by Nagios and HP ArcSight that flow through the central event management process for generating incident tickets into ServiceNow.

The City's general responsibility for the steady state operation Service is to provide the discovery toolset (SCCM), which enables consistent and regular scanning of the entire online infrastructure. Unisys will provide ServiceNow ITSM and the CMDB along with ServiceNow discovery for discovering the enterprise assets.

To deliver a structured and managed approach to the maintenance of a configuration model of the service, assets, and infrastructure, Configuration Management records details on the individual configuration items and the relationships between service assets and configuration items. The primary focus of Configuration Management is stability in operations of data center equipment, data center software, and support infrastructure.

Unisys will track devices and their relationships with the ServiceNow Discovery tool, which is used to discover server, network, and other data center devices that are part of the organization's assets and listed in the table above. The ServiceNow Discovery tool will automate the process of populating the CMDB by exploring IT systems to identify hardware and software, and then creating instances of Configuration Items (Cis) and relationships from the discovered data.

As discussed in the Service Delivery section, Asset Management delivers a structured and managed approach that enables the contractual details of contracted assets to be tracked and updated in the asset repository. The assets include physical assets such as desktops, laptops, smartphones, printers, and multifunction displays, audiovisual equipment, servers, and network equipment. Asset details are initially loaded by using agreed technologies and methods. The asset information is collected by using automated discovery technologies that are in place in the City's environment, loaded from the data supplied by the City, or manually collected and loaded for specific and low-volume assets. This data will be migrated into the ServiceNow CMDB. Changes of ownership, configuration changes, relocation, and other resultant changes to the assets will be updated in the CMDB.

Page 62 ends

CITY OF SANTA CLARA
Schedule 2 — Final Service Tower Solutions

Page 63 ends

CITY OF SANTA CLARA
Schedule 2— Final Service Tower Solutions

2.2 Service Desk Services (Enclosure D — Schedule 3B)
Summary BAFO:
- Further Clarification and milestones of Road Shows
- Additional definition, frequency and milestones of Tech Cafe

2.2.1 Service Desk Solution Questions
Instructions: In addition to the General Solution questions in Section 4 above, Service Provider shall provide responses to each of the Service Tower specific questions below. Limit responses to each question to a half page.

Unisys Service Delivery Analytics (SDA) continuously works on identifying opportunities to automate resolution or drive incidents and service requests to a lower cost and faster point of resolution such as First Call Resolution. Unisys will review these opportunities periodically and jointly with the City of Santa Clara in order to present incident types that SDA has detected could be classified as First Contact Resolution.
a) Describe the types of Incidents that your Service Desk will be capable of Resolving on a first contact Resolution basis (i.e., directly Resolving / fulfilling, without the need to escalate to a Level 2 or Level 3 resolver group), and how you will drive First Call Resolution through the Service Desk, including service approach, tools, techniques and any year over year increases in the FCR rate. Describe your approach to continually increase First Call Resolution Rates over the Agreement term.

Response
The Unisys Service Desk will be able to resolve on first contact the following categories of incidents; issues with account administration, password resets and unlocks (where approved by the City), connectivity issues, and documented, common hardware error messages. Also resolvable are "How to" questions for common products, such as Active Directory; Office 365; Outlook; Domain Directory; Windows 10, 8, and 7; Internet Explorer; mobile devices; and antivirus/malware solutions. The Service Desk will also answer basic questions about COTS and specific City of Santa Clara applications based on knowledge articles developed by the City and the Unisys Team and driven by call analysis to address top call drivers.

On a monthly basis, the Unisys Service Excellence Office (SEC) will identify top drivers of incidents, customer dissatisfaction, and high-touch resolutions (Level 2, Level 3, and deskside visits) on a monthly basis via data from ServiceNow. The SEO will use this analysis to identify high-value training opportunities for our agents and technicians (or in partnership with our knowledge management team) to develop self-help solutions. This will be an ongoing process that also includes our field engineers to

Page 64 ends

CITY OF SANTA CLARA
Schedule 2 — Final Service Tower Solutions
maintain movement of a resolution from the field, to the desk, and to self-resolution. Items identified within the Knowledge Management platform as First Call Fix articles will be used by the Service Desk Agent to effectively handle First Call Resolution. In conjunction with the SEO, analytics will be reviewed monthly to determine the effectiveness of articles and new types of activities that can be implemented for the SD as part of FCR articles. The actions to drive improvement will be developed with the operational leads and driven to completion. The actions can be incorporated into monthly operational governance to provide visibility to the ongoing improvements in operations.
b) If you are proposing a remote Service Desk solution, please describe what communication approach you propose to use in order to get the City's End-Users to utilize the remote-based, services.

Response:

The Unisys transition team for the account will work with City IT leadership to develop a communication strategy and a plan that showcases the new features that will be brought to the City's employees as the account transitions to the ServiceNow platform. The key features will remind them of the solution's 24x7 availability and the ability to reach out by phone, web, or chat. The plan will also showcase a new portal that will provide them with access to much more information than they had in the past, including self-help articles and incident and request status. This access will include the ability to use mobile devices to access the new end-user portal. Ongoing communication will be developed to demonstrate the Service Desk's impact on the use of knowledge articles, resolution rates, and other key metrics that will help the City's employees to see the benefit of the Service Desk. The team will also be able to leverage the TechCafe and IT Road Shows to help with showcasing the new portal and features that will improve their experience with IT.
c) Ensuring an intimate experience between end users and the Service Desk is important to the City. How will you close the gap between the locations of the End Users and the remote Service Desk location (i.e., End-Users' fixation around the Service Desk not being on premise)? How will you will address Service Desk staff knowledge of the City's environment and skills (both onboarding and continuing) required to provide Level 1 and Level 2 support as defined in Schedule 38?
Response
The.Unisys solution will provide users with 24x7 access to the Unisys Service Desk and access over optional channels such as phone, web submission, and chat, as well as enable our Service Desk agents to have access to information that will also make the interaction personal, including the use of personabased profiles enabled in the ServiceNow platform. Our solution will deploy a new End User portal that will allow City employees to interact with the City IT Department to quickly view the status of their tickets

Page 65 ends

CITY OF SANTA CLARA
Schedule 2 — Final Service Tower Solutions
and service requests, view knowledge articles and frequently asked questions, and see important alerts related to IT. These will help to close the gap between the employees and the Service Desk.

When the Service Desk is working with a City employee, it is crucial to have personal insight related to the employee. Unisys will deploy Computer Telephony Integration (CTI) The CTI solution provides functionality that enables Service Desk agents to automatically get a screen populated with relevant caller's details either though automated Call Line Identification (CLI) or through the caller entering a unique numeric identifier using the telephone numerical keypad. The user's information is enabled for the agent, who will support the user, with a popup already available on the agent desktop.

Unisys will provide the CTI solution within the ServiceNow platform and telephony environment and the service will be available for the agents.

Preliminary process overview:
• Unisys will liaison with CSC, ITSM Team, and network teams to establish direct access • Unisys Service Desk to get direct access (HTTPS) to ITSM from their desktop browser without any Terminal Service being the intermediate interface.
• Unisys IVR application servers to get direct access (HTTPS/SOAP) to enable Web Services functions with ITSM, if applicable
• Unisys will co-ordinate and work with CSC and Avaya to ensure the Web Services coding is carried out by Avaya once the Web services request Template is populated as agreed on • The Employee list needs to be extracted and populated into a text file (Token File) containing only employee id without any special characters and characters to be small case, the file needs to be stored in the path specified. The Token file needs to be updated on a definitive interval. • Unisys will ensure the necessary Service Desk agents are trained and ready with the usage of the necessary tools which would enable CTI
• Post Development will be completed and confirmed the completion of Web Services. There will be an internal testing within Unisys and UAT and with CSC
• Post Acceptance of CT1 feature working as expected, the CTI feature would be enabled on Production and activated
• Unisys to provide project management and regular reporting on progress per agreed project governance
Unisys has a resilient architecture put in place with CTI supported by backend systems spread across different Unisys locations, each backend servers backin up each other. This runs on Unisys Backbone MPLS Connectivity which has a backup link which acts a failover mode. This is Unisys infrastructure and any client adding on gets plugged to this environment. The base Unisys CTI architecture system is shared on the network diagram below.

Page 66 ends

I
=— [a. a ar
I worn D IN•ba MS I

11.1,1,111liklr•
11Ralr.•
.1-, .r. ..„..,140 ...J ---.

I
•
••. .a■ Av.
1/,'
- 16
1 eil
h.... ot
(;)
4,-Ardr.
414 06..11.
roa
..•••••••■
• ...1•411•• ■■

CITY OF SANTA CLARA
Schedule 2 - Final Service Tower Solutions
Unisys Avaya CTI Architecture
1•••s a I ral Syralitos
, _ mebeam _

0.1.: ■•••
%•••■•••■•
• 111•11.1=
Ilmaort.

II.

Example of a ServiceNow Landing Page with a Valid Employee Information (The Name and Email are intentionally masked)
(2, =--••
"J • -1MMIMillii■B
......MIEVZI=VP MEM
Mt
Paw
1=111=C:111111111=== IM:=1:71
•17.•=i1;.:—...c. .•
• • WA... Pm. 4.••=1...•
Ifflaa,tale 1.••• + , 11•1.1.• Gm.= wt... 161.ammalml
• •.-117°] • 11..6.16.0.• MO. 10.10.71=1
Sample Screen of a landing page which would pop with caller information and Incidents created by the user. 111
10110
ONINICPMIN.

16.•■■••

Page 67 ends

CITY OF SANTA CLARA
Schedule 2 — Final Service Tower Solutions
d) Describe your proposed solution for End-User self-help, including self-help plan and provision approach, platform, features/capabilities, effectiveness monitoring, and identifying and implementing approved recommendations for improved or expanded self-help services.

Unisys will leverage self-help tools through the Self-Service Portal as described below. The Portal is a focal point for tasks available to the end users for self-service. The portal allows users to see previous incidents and requests, as well as check the status of currently open records and provide updates, such as additional information, attachments and close /cancel actions.

Response
The Unisys solution brings the power of the ServiceNow platform, persona-based profiles, and the functionality of self-help together with the experience of Unisys through support of clients around the world.

Our solution is integrated with the applications in the ServiceNow platform, i.e. Incident Management, Problem Management, Change Management, etc. and allows the users to submit and view their incidents and service requests in addition to searching for knowledge articles to self-resolve their own issues, even before contacting the Service Desk. To optimize the ServiceNow Knowledge Management process, Unisys used Lean principles as well as improved screen layouts and field-level functionality to reduce the user input required to log, track, and manage knowledge articles. Our solution has an intuitive, rich, fulltext search functionality.

Additionally, contextual search functionality is enabled throughout the platform and fully accessible from the Portal for self-healing; it automatically displays knowledge search results when users enter the description fields for their new incidents. This helps users to deflect or quickly resolve their issues without involving Service Desk agents.

The Live Feed functionality allows users to add comments and discuss a knowledgebase article. This includes the ability to follow an article to see the updates and comments as they are made. This also helps users to deflect or resolve their issues without involving Service Desk agents.

Knowledge contributors can review and approve the publishing of articles in accordance with the knowledge process flow. The content submitted allows for better self-resolve results. The ServiceNow platform has a strong article analytic engine to track the overall effectiveness of the articles and knowledge environment. Both the City and Unisys will deploy a knowledge content strategy, naming content providers and approvers in both organizations to maintain quality and accuracy of all submitted knowledge articles.

Page 68 ends

CITY OF SANTA CLARA
Schedule 2— Final Service Tower Solutions
Unisys will work with the City on a Knowledge Centered Support (KCS) strategy. KCS practices involve collaborating, sharing, using, and improving knowledge. The goal of KCS is to solve a problem once and use the solution often. To take advantage of the knowledge that is available in the phases of Service Desk operations, KCS makes the knowledge captured by the support process available for reuse throughout the organization. Other best practices involve updating articles to enable them to stay relevant and effective and retiring articles that are no longer relevant. Knowledge managers can run reports such as the top 10 articles and those most frequently viewed and used. This ability involves prioritizing and organizing highly frequented or used articles every 6 months.

Knowledge articles and help files will be updated to the knowledge platform in a prioritized fashion. SEO analytics will continue to drive the top issue types to both account for new knowledge articles required to support the City and to maintain up-to-date articles as the environments change. During Transition, Unisys will develop knowledge articles around the top 10 areas as shown in Section 2.1.1.m.

In summary, the approach for Self-Service will result in improved services for users. The knowledge database will be easy to search and follow, thereby increasing self-help in the organization. The Unisys ESS portal has been optimized for seeking knowledge for self-resolve, the ability to submit and status incidents and requests, chatting online, providing feedback and accessing the users own dashboard all empowers the users to be more self-sufficient in their needs.

2.2.2 Service Desk Solution Overview
Instructions: Provide an overview of the Service Desk solution you propose to address the City Service Requirements stated in Enclosure D — Schedule 38. Incorporate responses to common solution characteristics and description elements listed above. Limit 5 pages.

Response: Unisys has a deep understanding of the essential requirements to design and implement an ITSM platform for our customers. We have developed our own best-of-class too/sets by introducing proprietary processes and configurations. This deep knowledge and experience is transferable to CSC and is included with our solutions. Our methodology focuses on using highly maintainable configurations of the ServiceNow platform, which means customization is very minimal, if at all. This approach also enables integrations to be created to your external infrastructure systems, through orchestration and automation capabilities (i.e., password reset, SCCM, Nagios, SolarWinds, etc.).

Our goal is to not just replicate what is used in our global ITSM system but to implement only what is needed to deliver the required services to CSC that provide business value. With our knowledge of your current ITSM environment, we start by conducting a mapping exercise to compare data fields from the legacy to the new, against CSC's business requirements. We will then draft a data design document that

Page 69 ends

CITY OF SANTA CLARA
Schedule 2 — Final Service Tower Solutions
will detail the configurations, from the foundation data to the workflow processes, business rules/logic, Ul components, and data tables/interfaces for CSC's specific functional modules. This exercise will be performed in consultation with CSC resources, as identified by CSC's transition team.

Outlined below is a representative sampling of our recent engagements that demonstrates our expertise and knowledge from end-to-end.

Major wholesale food chain:
• Implemented Service Request Management for the entire enterprise • Managed incident, problem, and asset management
• Minimized service desk workload by optimizing resolution times • Optimized client's investments by completing deployment within schedule • Improved end-user experience via services which consistently met or exceeded KPIs.

United States Commonwealth Client
• Implementation for IM, PM, CM, Service Catalog, SLM, and AM • ODS integration for reporting
• Monitoring and Event Management

Page 70 ends

Response
Solution Summary
The known City objectives and requirements are the base for the proposed Unisys solution. The Service Desk will be delivered from one of our Managed Services Centers (MSCs) in the United States. As required, the support will be in English,
The Service Desk will be the single point of contact for end-user requests, end-user submitted incidents, and infrastructure generated tickets. The Unisys Service Desk in the United States will be staffed and available 24x7
Main solution elements include the following:
• The Unisys ServiceNow platform for incident, service requests, problem, and change requests. • Direct input to ServiceNow interfaces using the web portal and chat. • The Unisys service desk will work with the City's service providers to resolve incidents. With proper entitlement and development of knowledge articles, the Unisys Service Desk will open incidents with

Page 71 ends

CITY OF SANTA CLARA
Schedule 2 — Final Service Tower Solutions
vendors on behalf of the City, obtain status of open issues with providers, and relay additional information where appropriate to approved providers.
• Provision of automated password reset functions using Unisys ServiceNow features where applicable to the City's environment.
• Remote takeover for incident resolution and request fulfillment where applicable, using the Unisys implementation of the LogMeln remote support tool.
• Maintenance of a knowledge database of CSC-specific information, including incorporation of root cause analysis findings from problem resolution.
• Use of the VIP list supplied by CSC when handling user calls. Users that are flagged as VIPs will be handled with a higher priority for service restoration and for other cases where the request requires it be handled at a higher priority.

Service Desk Solution Components
Solution Baseline
With the introduction of the Unisys ServiceNow ITSM tool, users can contact the Service Desk over the phone, by web submissions at the self-service portal, and over chat channels. Unisys staffed agents to enable calls to be answered within 60 seconds. The Unisys solution does not include voicemail as a contact channel.

Unisys considered the following baseline:
• Contract term: 4+2+2 years
• Volume: 620 tickets per month
• Coverage: 24x7
• ITSM tool: Unisys' instance of ServiceNow
• Language: English.

Call Management
This service will provide the technical capability to receive calls from end users and route them to the appropriate Unisys Service Desk agents. Calls from end users will enter the Unisys Call Center from tollfree numbers or local direct inbound dialing telephone numbers. Interactive Voice Response (IVR) prompts will route the call to the proper agent or resolver team.

To make themselves known to the system, Unisys Service Desk agents will use a unique ID to log into the Unisys Automated Call Distributor (ACD). This ID defines the queues from which an agent will receive calls.

Page 72 ends

CITY OF SANTA CLARA
Schedule 2— Final Service Tower Solutions
The Call Center's IVR/Announcement capability can play either prerecorded announcements or announcements recorded as needed to advise on outages or extremely high wait times. This prevents wasted time by users and agents who report on incidents they already know. It also reduces call volumes and therefore wait times for widespread outages.

Queue management information will enable call center supervisors and team leaders to track call wait times, queue depth, and agent availability. It also will give them the capability to assign queues to additional agents during peak periods; this is called workforce management.

Call Management Reporting
This service will provide the technical capability to display real-time information and to retrieve historical information from our Call Management System (CMS). It also will provide management and City reporting, as well as information for supervisor and wallboard displays. The CMS will be configured as a High Availability solution with server locations across several Unisys data centers.

Chat Interaction
This service will provide the technical capability to initiate an instant messaging connection with a Service Desk analyst for assistance in case of trouble or questions. This way, a call to the Service Desk will be avoided.

Dashboards and Reporting
Unisys will leverage the reporting capabilities in ServiceNow for enabling all Service Level Reports related to ITSM described in the Schedule 4 Exhibit 1 document of the RFP. We will develop the dashboards and reports during the transition. They will be accessible to the City and Unisys leadership and allow taking early action on deviations and keeping service levels within the agreed parameters.

Incident Management Service
This technical service will provide the technical capability to manage the Incident Management function, allowing for an incident to be created, manipulated, and closed. This service allows for the various state changes needed to track an incident's life cycle, setting the appropriate priority, assigning incidents to the correct resolver group, and confirming that incident notifications are set. Service Desk analysts will use this service to create, update, and close incidents; to confirm that the appropriate state changes are made throughout the incident's life cycle; and to set the appropriate notifications. Service Desk analysts also will use this service to categorize and report on incidents.

Password Management
This service will provide the technical capability to manage policy definition, setting, management, and resetting of a password for access to a domain or defined application. The ServiceNow password reset tool is an available feature that can be used for password reset activities. Password reset will be initiated by a Service Desk agent or directly by an end user to "self-reset his or her password. Password reset

Page 73 ends

CITY OF SANTA CLARA
Schedule 2 — Final Service Tower Solutions
automation will be initially focused on the top 2 password request types identified by the call data and will be confirmed with the city during transition. In some cases, password reset automation may not be in scope due to the lack of standard integration between the environment and ServiceNow. Custom development of B2B integration to drive Password Reset automation is not included in the scope.

Problem Management
This service will identify and drive resolution of IT problems in the environment. The problem management team will use statistical measures and analysis methodologies to identify problems.

Leveraging a set of investigative tools, the problem management team will collaborate with system owners to identify the root cause of problems for all P1 and P2 Incidents. Upon validation of the problem's root cause, the problem management team will maintain oversight of the problem through an action plan and its implementation. Problem Management team hours of operation would be 5*9 during business hours. The turnaround for the Problem Management team would be 5 days for preliminary RCA and 10 days for final RCA.

Knowledge Management
This service will provide the activities and tools for maintaining consistent, accurate, and timely documentation to support the City's in-scope products and services. Product or application-specific information will be validated with Unisys and the City content owners and then formatted as required before it is published in the Service Desk knowledgebase. Knowledge articles will be used by Unisys Service Desk agents and other Unisys resolvers for issue resolution and by end users who seek self-help.

The knowledgebase will be updated as needed to maintain consistency in resolution of issues.

Remote Takeover and Diagnostics
To initiate a remote takeover session and gain access to an end user's desktop or laptop, a Unisys Service Desk analyst will use this technical service. The analyst will gain control over the device so that work can be performed. The Service Desk analyst will use this service to perform diagnostic steps on the remote end point, determine the problem, and perform remediation steps on the remote end point. This service will entail the creation and storage of audit logs for each remote takeover session for later review or audit. To provide this service, Unisys will use the LogMeln password reset tool.

Service Level Management Service
This service will provide the technical capability to manage the Service Level Management function. This service will allow the description and capture of Service Level Agreements (SLAs) and to set threshold values and targets for the defined Incident Resolution SLAs described in the Service Level Reports in the Schedule 4 Exhibit 1 document of the REP. This service will allow incidents and service requests to be tracked and measured against defined SLA metrics. Additionally, when the SLAs are not met, this service will facilitate the creation of notifications and escalations. It will capture actual performance values of the defined systems against the SLA targets.

Page 74 ends

CITY OF SANTA CLARA
Schedule 2 — Final Service Tower Solutions
Service Request Service
This service will provide the technical capability to manage the Service Request Management function.

This service will allow a service request to be created, manipulated, and closed. This service will facilitate the various state changes needed to track a service request's life cycle and set the appropriate priority for the service request.

Unisys Service Desk Request Management team (this is a separate team from the Li Service Desk) will manage all the Fulfilment requests submitted by CSC end users. However, the requests related to aging tickets or escalation requests will be handled by the LI Service Desk team.

Service Excellence Office
The SE0 is a global center of excellence at Unisys that coordinates with Unisys service delivery groups.

The SEO's goal is to drive improvement by focusing on the following:
• Resolution Optimization. The analysis of incident data to identify candidates and move resolutions steadily from higher skilled analysts ultimately to Level 0. Improve speed of each transaction through increased resolution at the right level.
• Defect Management. Reporting, analysis, and action plans for service defects, such as incorrectly assigned incidents, incorrect diagnoses, and excessive resolution times. • Customer Satisfaction (CSAT) Management. Improve Customer Satisfaction by eliminating the drivers of end-user dissatisfaction.
• End User Productivity Mean Time To Resolve (MTTR). Drive better end-user productivity by analyzing time taken to resolve across all resolvers.

2.3 End-User Services (Enclosure D — Schedule 3C)
Summary BAFO:
• Persona-based detail in ServiceNow and how it relates to End-User Services. • Detail of endpoint services and level 3 support definition. • Training detail and plans.
• Remedial maintenance service process.

2.3.1 End-User Solution Questions
Instructions: In addition to the General Solution questions in Section 4 above, Service Provider shall provide responses to each of the Service Tower specific questions below. Limit responses to each question to a half page.

Page 75 ends

CITY OF SANTA CLARA
Schedule 2— Final Service Tower Solutions
a) Explain how your proposed solution will address the City's desire to minimize unnecessary handoffs and follow ups of open tickets to Service Provider's End-User support staff due to insufficient knowledge of End-Users' ticket history during support activities.

Response
As the new ServiceNow platform is deployed, focus will be placed on training to capture high-quality information on the tickets. The accuracy and completeness of information captured on each ticket will be crucial to technicians arriving informed and prepared. Service Desk staff will be trained to capture as much information as possible by thinking through the eyes of the Field Services staff who will visit the end user. Field Services engineers will thoroughly review the ticket information and the employee's history to confirm a complete understanding before making the visit. Unisys will conduct quality audits of the tickets to verify that ticket information is captured properly. The End User Services (EUS) leader for the City will also enforce and conduct quality audits to verify that our Field Services engineers are taking the time to review ticket information before making visits. The Unisys approach will also focus on misrouted tickets and tickets that could have been handled without a handoff. Quality analysis and efforts for these two areas will lead to fewer mishandled tickets and improved resolution on the first contact or opportunities to improve the self-help features of the end-user portal.

Page 76 ends

CITY OF SANTA CLARA
Schedule 2 — Final Service Tower Solutions
b) The City is interested in moving more toward a people/persona policy based set of standards for its end-users. Please describe how would you propose to implement a people/persona policy based standards approach to manage City end users given the different departments and their differing needs.

From a persona perspective, Unisys will implement three (3) personas: End User, Operations Management, and Executive persona for the Self-Service Portal. • Personas are not roles and are more in the lines of user experience that span across multiple applications. A person with an executive persona has a consistent executive-level experience across the Portal, i.e. dashboards will be displayed. A persona describes key characteristics of users expressing how they view the world; they dictate user experience, roles dictate user access rights to data.
• Roles are typically application specific and are directly tied to data access within the application.

Users could belong to the same persona (user experience) but have different set of roles (data access). Personas will comprise a base set of roles and permissions and admins can assign additional roles for the user for specific access.

Examples of poor candidates for personas: report editor, admin, dept 327 'manager, finance application user, etc.

As stated previously, the three (3) personas that will be implemented for the ServiceNow Portal are:

End Users, Operations Management and Executive personnel. Within the ServiceNow platform, this is achieved by 'group' permissions in the system.

Example: Alva. Pennigton is an End User in the system. Alva does not have any permission roles defined in the system to her. When Alva logs in to the Portal, she has the capability to submit/status incidents and ervice requests, search knowledge, etc. Bernard.Laboy is an operations user that can approve knowledge articles, approve change requests (via the CAB since he belongs to the CAB approval group), and can work incident tickets. When Bernard logs in to the Portal and/or the back end system, the approval widget and link is exposed to him whereas it is not available to Alva.

Response
The ServiceNow ESS platform provides users with persona-based access to the system, presenting them with the right information that applies to their roles and specific organizational needs. This will allow users to be able to find information faster, work smarter, have a better interaction with IT and business, and ultimately make a right decision. During the transition to ServiceNow, Unisys will lead the City through a process to review the right profiles that will drive the highest impact on the environment.

Persona-based access to information is complemented with role-based access to application features and capabilities in the ServiceNow platform. Role-based security defines user access at the module,

Page 77 ends

CITY OF SANTA CLARA
Schedule 2– Final Service Tower Solutions
form, and field levels, so that the right to read, tailor, create, and take ownership of items such as tickets, configuration items, and service catalog items is configurable according to roles and organizational requirements. This capability can be assigned to specific roles, groups, departments, or positions in the organization.

The Service Catalog automatically displays requests related to end users, depending on how the requests are published and made available. This validates that a user only sees requests that are relevant to his or her role. Further restrictions or additions can also be made based on the end user's role, Unisys will look to evaluate the various user types, grouped by roles and personas; understand the City's needs to create an appropriate design; and provide a suitable portal that will provide City end users with ease of use and benefits.

In summary, general users can see a different catalog based on their role, but a manager can see their teams' access. Executives can be configured to see dashboards and only create VIP requests and incidents, etc. Users can easily be given application permissions to perform certain tasks such as change approval.

C) The City is interested in improving customer intimacy through a Service Provider offering where Service Provider staff would be made available to the City's end-users on a scheduled, recurring basis (similar to a "genius bar"). This venue would provide the end-users with the opportunity to bring issues to the Service Provider (e.g., questions around device functionality, break/fix issues, etc.). Please indicate your proposed approach to providing this solution, including proposed frequencies.

Response
Unisys proposes the deployment of the TechCafe, This TechCafe brings a higher quality touch and intimate experience that City employees will embrace.

Equipped with technical and material resources, the TechCafe delivers a flexible, efficient and intimate service to increase workforce productivity and performance. The TechCafe will provide a range of IT support services targeted at top incidents and requests that are commonly seen in the environment, including:
• Resolution of hardware and application issues for in scope hardware and defined applications • Software installation and configuration of approved software applications • Provide basic questions and answers around common end-user devices and applications.

Unisys will work with the City to identify an ideal central location for the TechCafe—a location with easy access by the largest number of End Users. Based on our experience, Unisys recommends a regular time once each week to ensure consistency with the end-users. The initial duration would start with 4-hour sessions and adjust reasonably based on staffing demand. A communication campaign will be developed to announce the grand opening and periodically remind users of the value of the TechCafe. A key process that will be followed is the use of the ServiceNow platform to capture the interactions at the

Page 78 ends

CITY OF SANTA CLARA
Schedule 2 — Final Service Tower Solutions
TechCafe so the demand and impact to the business can be tracked and measured to include customer satisfaction.

The City will be responsible for the facilities, furnishings, equipment, transportation, connectivity, and a secure storage facility.

Page 79 ends

CITY OF SANTA CLARA
Schedule 2— Final Service Tower Solutions
d) The City is interesting in providing City departments with a Service Provider "road show" whereby the Service Provider's End-User staff would visit each department on an established and recurring basis. These enhanced customer touchpoints would provide the department end-users with an opportunity to help with any issues department personnel may be experiencing or answer any questions they may have. Please indicate your proposed approach to providing this solution, including proposed frequencies.

Response
In addition to the TechCafe, Unisys will establish a rotating "road show" with the City that deploys our field engineers to the various departments. This roadshow will provide another outlet to City employees to receive assistance with their top and most common IT issues and requests. Unisys proposes the largest department like PD would be visited once every 4 months, other major departments at least once every 6 months, and the smaller departments once per year. This schedule will be adjusted based on the utilization by each department with some departments being increased in frequency and perhaps others reduced. The schedule will be influenced by the TechCafe proximity and cadence to certain departments and City employees. Additionally, the "road show" format, length and actual participants will be adjusted based on the types of questions being asked and the types of issues being resolved. A communication campaign will be developed to announce the schedule and remind users of coming event. Finally, the incidents and requests resolved at the "road shows" will utilize the ServiceNow platform so the demand and impact to the business can be tracked and measured to include customer satisfaction.

Page 80 ends

CITY OF SANTA CLARA
Schedule 2 — Final Service Tower Solutions
e) The End-User experience is important to the City. At the same time the environment is rapidly changing (e.g., mobility, 0365, personas). As such, end point engineering is foundational to driving many City transformation initiatives and the City requires a strong end point engineering solution. How would you propose to provide an end point engineering team to successfully deliver these critical services?
Unisys will leverage the instance of the AirWatch MDM tool provided by the Department of Justice to define and enforce City-approved device policies (e.g., security, accessibility, data). The Unisys team will also leverage this tool (for mobile devices) along with Microsoft SCCM for laptops and desktop devices in the departments, to make apps available to users when requested/approved apps are outside the core software provided on initial device images.Unisys will provide the following Endpoint Services:
• Desktop Operating System Image Development and Management • Application Packaging Services
• Electronic Software Distribution
• Patch Management
• Endpoint Security Management and Event Monitoring
• Level 3 Engineering Support.

Unisys will deliver these services with an onsite-based dedicated staff of three fulltime Endpoint Engineering Team members with a fourth onsite dedicated team member to provide hands-on EUS technical team leadership and project coordination over the Endpoint and Desk Side engineering staff.

The Endpoint Security Monitoring and Management service will be provided by remote staff to ensure constant monitoring and reliable responses to Anti-Virus and Anti-Malware related events reported while the onsite team members are engaged on projects and day-to-day service delivery of the other Endpoint services. The Endpoint Security Monitoring team will support the currently used tool (SCEP), and if this toolset is replaced, the replacement toolset will be supported for like functionality (Anti-virus and Antimalware).

As new application of technologies like Office 365, Persona's, and mobilization initiatives evolve the End User Experience, the Unisys Endpoint team will support these changes at the departmental level through several means, including: department-specific Image Deployment task sequencing; standardized desktop application configuration management; diligent knowledge management practices, and close collaboration with Level 1 and Level 2 Support to provide effective continuity of services to the departments through all levels of the support process an issue may escalate through. As departments are transformed, Device Images will be adapted to unique departmental application requirements through task sequences that are applied with the image to adapt it to specific requirements within the target

Page 81 ends

CITY OF SANTA CLARA
Schedule 2 — Final Service Tower Solutions
department. When new applications are introduced, Endpoint will coordinate with the Application Team and City Departments to establish and capture standardized app settings and configurations are applied to app packages to be used by the department. As change is introduced and departments evolve, the Endpoint Team will support change processes by harvesting resolution data encountered while solving new and change-related issues into various types of Knowledge Base articles to provide Self-Help, Tips or "Work-Arounds" for Known Problems, and other instructional documents. These will be published and accessible to departmental End Users to assist them through the changes and challenges that surface.

As the End User environment evolves at the City, Unisys Endpoint will ensure device images evolve with it, devices are kept secure through monitoring and patching of vulnerabilities, standardized application configurations ease learning and use of the devices, problems are easily addressed with self-help articles and up to date knowledge-base articles, and effective support through all service levels is readily and proactively provided.

2.3.2 End-User Solution Overview
Instructions: Provide an overview of the End-User solution you propose to address the City Service Requirements stated in Enclosure D — Schedule 3C, as indicated below. Incorporate responses to common solution characteristics and description elements listed above. Limit 5 pages.

Response
Unisys will require certification for the role required to do their function. This training and certification will be part of the Unisys resource performance plan. In addition, Unisys will review the technology roadmap with the City, during each of the mentioned meetings, in determining what upcoming technology skills may be required. Unisys agrees to provide the training and hold the team accountable to complete it. This mirrors our established guiding principle to improve our skills for the effective and strategic use of emerging technologies.

Finally, Unisys will leverage the City specific Knowledge Base and use it as required training, approximately quarterly, with end-user and all help desk staff. All new staff will be required to take the Knowledge Base training prior to engagement.

The Unisys solution will focus heavily on a dedicated onsite team of professional Endpoint Operations engineers and Field Services engineers who are focused on these crucial services. This team will use key tools such as the Unisys provided ITSM platform of ServiceNow. Microsoft System Center Configuration Manager (SCCM), and AirWatch are City provided tools which the team uses to manage mobility devices.

The ServiceNow ITSM tool captures incidents and requests that require Field Services support and enables connection of the right resources to the right asset or incident. Additionally, our commitment to developing and using best practices drives design efficiencies, promotes reusability, improves performance, and enables expanded capabilities.

Page 82 ends

CITY OF SANTA CLARA
Schedule 2 — Final Service Tower Solutions
Endpoint Operations Services Summary
The Unisys onsite dedicated Endpoint Operations team will approach management of end-point devices through a sharp focus on the following:
• Device Image Management — Reliable creation, maintenance, and deployment methodology of base operating system images for devices that are reliable, patched up to date, and configured for an optimal user experience on supported devices
• Enterprise Management Platform — Leveraging 'Microsoft SCCM, this platform will provide reliable image deployment, electronic software deployment, patch management, inventory data collection, software metering, and related reporting functionality to enable end-point devices to be well managed and equipped to meet CSC's operational requirements.
• Group Policy Management — Management of Active Directory Group Policies designed to enhance and safeguard the end-user experience while providing governance for use of end-user devices • Endpoint Security — Maintenance of a safe computing environment and data integrity through monitoring, response, event management leveraging antivirus, antimalware, and encryption (Microsoft BitLocker) functions provided by the operating systems and by System Center Endpoint Protection
• Desktop Application Management — The Endpoint Operations team liaises with the Application Management team to gather optimal configuration settings and requirements of end users and to have those packaged with the commercial software for electronic distribution to end-user devices in a standardized, reliable configuration.

These services will be provided by Endpoint Operations experts who work on site and face-to-face with the end-user community while seeking to drive innovation into the processes and tools used. They will leverage the expertise found throughout our global community of Endpoint Operations experts, including some back office non-client facing expertise provided from various Unisys Service Centers.

Field Services Core Service Areas
Unisys solution assumes that ticket volumes will be consistent with the current environment (approx. 1,490 annually). To the extent such volumes materially change the City and Unisys will review and equitably adjust the City's Field Services requirements and associated pricing.

VIP Support: Unisys will work with the City to define specific onsite support for VIPs in the ServiceNow Platform. For other similar engagements, Unisys recommends a pool of pre-imaged equipment that is stocked at VIP locations. Whenever an incident cannot be (or is not expected to be) resolved within a VIP restore SLA, the VIP's workstation will be replaced to allow the user to continue to work as quickly as possible.

Page 83 ends

CITY OF SANTA CLARA
Schedule 2 — Final Service Tower Solutions
Deskside Support Services: Providing support to remediation of software and connectivity issues that cannot be resolved by remote resolution techniques.

Installs, Moves, Adds, and Changes
Installs, Moves, Adds, and Changes (IMACs) occur as ad hoc requests or as planned, large-scale projects. Unplanned or day-to-day IMAC activity is handled in the same way as hardware service requests, with call placement using the standard service request process: individual requests for IMACs go through the Service Desk or the Unisys Request Coordinator. A separate service request will be logged for each device or unit that is subject to the 1MAC activity.

IMAC Service includes the following activities:
• Installations and De-installations — Upon equipment arrival, Field Services engineers will check for equipment damage, install and configure the equipment, load the software; and test it for full functionality. If a problem is detected, it will be escalated and necessary actions taken to enable device/system operability. End-user familiarization will be provided for the new equipment and software.

Installation of additional software applications (packaged applications that are not included in the standard City image or applications that cannot be packaged) will be done as a separate IMAC with support materials that the City will provide to perform the installation. • Moves — Field Services engineers will de-install equipment according to the move schedule and prepare it for transportation. Once the equipment is transported to the new location, they will reinstall the equipment and test it for full functionality, using a predetermined installation script. • Adds or Changes — Field Services engineers will unpack the product, conduct a physical inspection, set the equipment up or install new or updated software, and connect and functionally test the equipment.
• Replacement of peripherals and reconfiguration of software • De-installation of the equipment
• Disposal of the equipment is beyond Unisys scope thus a third party will manage • Installation of software when Service Desk agents cannot install it remotely • Project-based refreshes (periodical changes) of desktops and laptops.

Unisys IMACD Coordinators will plan and manage the IMACD schedule as agreed with the City or with individual end users and confirm the correct operation of an installed or modified device. An IMACD procedures guide will be produced and agreed with the City and be part of the operations manual used by Unisys Field Services engineers, which will lead to consistent, repeatable execution of services. IMACD Coordinators will perform the following activities:

Page 84 ends

CITY OF SANTA CLARA
Schedule 2 — Final Service Tower Solutions
• Prepare the target location for a trouble-free MAC
• Identify and verify cabling and electrical power
• Document changes or additions to cable and electrical power if required for performing the IMAC • Inform CSC of site changes or additions required
• Understand and document requirements for equipment connectivity • Report correct IMACD completion
• Act as an internal single point of contact for Unisys Field Services technicians for IMACD activities.

For IMACDs, Unisys IMAC Coordinators will confirm equipment and the Unisys resources needed are available to comply with the contracted SLAs.

Remedial Maintenance Services
Unisys Hardware Support and Repair functions provide the resolution of hardware-related problems with desktops, including repair or replacement of components or entire units, rebooting, isolation from the network, and diagnosis and corrective actions. Our Hardware Support and Repair functions can also be performed remotely by remote control or on site by deskside support or Smart Hands support.

In a hardware failure, the Unisys Service Desk will call the OEM to handle the issue if a unit is under warranty.

If the unit is under warranty, a Unisys Field Services technician will check the unit and decide whether the unit is reparable. If the unit is reparable, our Field Services technician will engage the OEM and adhere to their standard warranty repair process for the unit. If the unit is irreparable, the City will purchase a new unit, which Unisys will install. In case a hard disk failure, Unisys will reimage the PC with the City image.

Unisys support of printers and mobile devices will extend to third party vendor maintenance when applicable.

Smart Hands Support Service
This service provides Unisys Field Services engineers to assist in the resolution of other enterprise hardware issues that cannot be completed by remote means and require a physical presence. This can include hardware configuration and use, complex how-to requests, and sporadic fault identification and rectification.

TechCafe
Unisys describes our approach to the "rechCafe in our response to RFP requirement 2.3.1 c.

Road Shows
Unisys describes our approach to road shows in our response to RFP requirement 2.3.1d.

Page 85 ends

CITY OF SANTA CLAFtA
Schedule 2 — Final Service Tower Solutions
Additional Services
After each field service visit, a Unisys Field Services technician will perform the following activities:
• Check the health of the unit as preventive maintenance • Check the asset record, escalate issues, and update the asset record if necessary • Propose actions for the following items:

O Parts
O Swap units
O Desktop and laptop purchases
• Check the stock level and propose further actions.

Page 86 ends

CITY OF SANTA CLARA
Enclosure A—Appendix A BAFO

2.4 Enterprise Compute Services (Enclosure D— Schedule 3D) Summary BAFO:
• CMP deliverables.
• Business Continuity and Disaster Recovery planning detail and process. • Unisys outside SME provided for design and engineering.

2.4.1 Enterprise Compute Solution Questions
Instructions: In addition to the General Solution questions in Section 4 above, Service Provider shall provide responses to each of the Service Tower specific questions below. Limit responses to each question to a half page.
a) What is your proposed solution to provide cloud orchestration (SI) services for the City's evolving cloud environment (e.g., tools, processes, etc.)?
Response
The City has a "Cloud First" strategy in place for new applications and upgrades to existing applications.

They require that the infrastructure activities performed on premise be available and easy to perform in the various cloud provider environments that are currently in place and those of future providers. Cloud orchestration is essential to continue, to maintain the costs and timeframes to implement new applications and services in the cloud. For orchestration of cloud services, Unisys proposes to enable Infrastructure as a Service (laaS) Solutions and a cloud ecosystem for the City by establishing a robust Cloud Management Platform (CMP). This will be achieved through the development of a City cloud strategy that includes service provisioning that leverages ServiceNow catalogs, orchestration, release management, and security management. Unisys is positioned to bring the Unisys Cloud Management Platform as part of the transformation services. This approach will be vendor neutral if multiple cloud providers are used to provide the lowest cost for performance to manage ongoing infrastructure cost. This approach will remain seamless to the other underlying cloud infrastructure. By leveraging the Unisys CMP, the City will move to a more agile approach that leverages DevOps for infrastructure management.

This orchestration approach will be driven by the Unisys Cloud Infrastructure team, which is jointly led by the applications and infrastructure program managers and supported by Unisys CMP experts. This approach will enable the aspects of the Cloud First strategy such as contractual items, security including Active Directory integration, interoperability, and SLAs to be managed properly. Unisys successfully worked with the City to drive Cloud First initiatives. These initiatives include the migration of City websites from internal hosting to a cloud provider (Vision Internet), Accela Customer Relationship Management (PublicStuff), Questica Budget, and Office 365, which is in progress. Additionally, we supported Public Safety applications such as replacing Patient Care with ImageTrend, CAD-to-CAD, and various other Police Dispatch applications.

Page 87 ends

CITY OF SANTA CLARA
Enclosure A—Appendix A BAFO
Deliverables:
• Installation and configuration of the Unisys Cloud Management Platform (CMP) o Ongoing support and maintenance for the Virtual Appliance o Ongoing support and maintenance for the integrated software components o All licensing for products provided by Unisys within the CIVIP platform o Configuration of templates and scripting for standardized virtual resources • The CMP services are listed here:
o Orchestration
o Rapid Deployment
o Automated Provisioning
o Self-Provisioning and Self-Service Interfaces
o Third Party Cloud Provider Service Aggregation
o Business Workload Analysis
o Recommendations and Mapping
o Audit Support
o Analytics and Reporting
o Multi Source Integration
o Automated Run Book execution
• Configuration and modification of ServiceNow catalogs to facilitate Service Requests for CIVIP SelfProvisioning and Self-Service Interfaces o Initial configuration of CMP and ServiceNow Service Catalog objects is provided by a Unisys project team (external to the delivery staff) that specializes in CMP deployments. Postimplementation updates to the catalog will be handled as Service Requests and will be processed by Unisys offsite support teams.

Client Responsibilities and Assumptions:
• The Client will provide virtual resources, CPU, RAM, storage, and network, which meet the requirement for the CMP virtual appliance to be provisioned by Unisys.

Exclusions:
• Licensing for Private Cloud Hypervisor or Operating Systems • Licensing for Client applications

Page 88 ends

CITY OF SANTA CLARA
Enclosure A—Appendix A BAFO
• Migration Services of physical or virtual workloads to or from the Public or Private Cloud. b) Describe your proposed collaboration solution, including setup, maintenance, support, City EndUser training approach.

The Unisys on-site team will work closely with City departments to encourage and seek more adoption of SharePoint (CSI) for collaboration within and between departments.

1. Advise departments of applicable new functionality as it becomes available.

2. Conduct monthly user group meetings to include members from each department to a. Introduce new features
b. Review departmental requests
c. Discuss issues
d. Deliver brief training sessions on relevant functionality. .

3. Conduct deep dives with individual groups to develop detailed requirements and configure and test the solutions.

4. Develop training materials (video, class-room training, FAQ's, QRG's, etc) which can be delivered individually or in a group setting.

5. Redesign the current CSI (SharePoint) Intranet Portal into SharePoint Online (0365) making sure to :
• Perform a fitgap to become familiar with 0365/Sharepoint Online features. • Analyse the City's desired new features for Level of Effort to implement and include in the workplan.
• Cleanup the SharePoint 2010 and prepare for migration to 0365. • Migrate the current content to SharePoint Online.

6. Maintain the current SharePoint 2010 Environment.

7. Maintain a detailed request log, which will be a part of the workplan. This will ensure that requirements are tracked and prioritized and also analysed for LOE.

Response
When faced with a diverse group of end users in 15 departments across the City, it is important to have a strong focus on training to enable the end users to quickly embrace changes to their applications, technologies, and services. Unisys uses Microsoft SharePoint as the collaboration platform to improve productivity and business process automation. We will also leverage the new ServiceNow end-user portal

Page 89 ends

CITY OF SANTA CLARA
Enclosure A—Appendix A BAFO
to provide additional opportunities for collaboration and training. As part of our approach to end-user training, we will meet with end users to gather requirements, create a proof-of-concept, conduct a review to identify and make final adjustments, perform testing (with a strong focus on user acceptance testing), and then send the release to production. We will develop customized training material (e.g., video library, quick reference guides, and webinars) that is relevant to the enterprise and the individual user, delivered in a group setting, or conducted one-on-one depending on the requirement. Additionally, to complement our approach to end-user training, Unisys will conduct a monthly web user group meeting that will be attended by representatives from each of the City's departments and chaired by the IT Department. Our approach to end-user training has led to increased end-user satisfaction. Examples of this end-user satisfaction include team sites for the Finance Department's Comprehensive Annual Financial Report to automate the production of the City's financial statements, an agenda coordinators team to track the status of council agenda items; and the police communications team site to enable sharing of critical information across shifts in Police Dispatch.
c) Describe your proposed mobility solution including requirements development, support of the City's current Air Watch SaaS tool, and End-User access approach and security, Response
The City requires a Mobile Device Management (MDM) solution that can manage mobile devices across various departments, particularly for emergency responders such as the Police and Fire Departments.

This is important because the City's data on devices must be protected. This protection will be achieved through encryption and password protection. Unisys can remotely wipe lost and stolen devices.

Additionally, software deployment can be effectively managed to maintain a common look and feel for devices. Our solution continues the use of the AirWatch SaaS tool, which is owned by the Department of Justice to successfully provide this service today. More than 250 devices from various departments are registered and protected from data theft
Unisys will continue to work closely with the AirWatch product and maintain the MDM solution roadmaps to enable AirWatch and the roadmaps to continue to meet business and security requirements for the City.

2.4.2 Enterprise Compute Solution Overview
Instructions: Provide an overview of the Enterprise Compute solution you propose to address the City Service Requirements stated in Enclosure D – Schedule 3D, as indicated below. Incorporate responses to common solution characteristics and description elements listed above, Limit 5 pages.

Response
Unisys proposes to provide the Enterprise Compute Solution illustrated in Exhibit 2.4.2-1.

Page 90 ends

Support
Requirement Srvs
Remote
Services 24x7
Capacity
Management
Enterprise Solution Services
Messaging Remote
Access
Mon itoring, Dashboard&Analytics
Server
Provisioning
Backup
Management
Non-Incident/
event ali hctievities
will
performed
during
Customers
normal
business hours
Business hours
are 7:00 am —
7:00 pm (Pacific
Time), Monday
through Friday
Enterprise Computing Services
IT Service
Continuity &
Disaster
Recovery
Storage
Management
Database
Support
Enterprise
Computing
Operations—
Windows/Linux
On Premise
Infrastructure
Management
Provisioning
Network Services
Transport
Documentation
Onsite after
hours support
will be provided
for Priority 1
Incidents or as
otherwise
required to meet
Service Levels
Operations and
Administration
Design and
Engineering
Monitoring and
Reporting

CITY OF SANTA CLARA
Enclosure A—Appendix A BAFO
Exhibit 2.4.2-1. Proposed Enterprise Compute Solution.

The City provides business services to its employees and citizens through a robust and secure enterprise architecture that uses City-owned data centers, SaaS solutions with third-party application providers, and increasingly through work packages deployed with cloud providers. This architecture must be secure and available anytime, anywhere 24x7. A highly available, secure, resilient, and redundant enterprise compute environment is a must to enable the critical services that a city like Santa Clara offers to its citizens.

Unisys will provide the City with a systems operational management and project services capability for its data centers, cloud providers, and distributed computing environments. Our Enterprise Computing Services will also include management of systems, network, security, storage, infrastructure, database support, and system consolidation and integration. This will maintain high availability of the City's business applications with little to no downtime beyond planned outages. Unisys successfully demonstrated our commitment to providing and improving this high level of service with our ongoing program to move from a physical server environment, supported by a network with multiple points of failure, to a High Availability virtualized compute environment that is about 85 percent virtualized. We have two data centers that run on a high-speed 10 GB meshed core network that has improved redundancy, availability, and performance. Additional efforts during the rebuild of data centers led to a greener footprint that saves the City 60 percent on power.

Enterprise Computing Services
Unisys Enterprise Computing Services include the following services.

Page 91 ends

CITY OF SANTA CLARA
Enclosure A—Appendix A BAFO
On-Premise Application Infrastructure Management Support: Unisys will provide on-premise application infrastructure management support for critical City applications such as Computer-Aided Dispatch (CAD), PeopleSoft, and Harris NorthStar.

Third-Party Cloud Services Support: Unisys leverages Azure for Office 365 and AWS as the cloud provider for the City. We will support future cloud providers that will use the DevOps and SAFe approach for the City and departments that serve the community. Using the Unisys Cloud Management platform, we will allow for improved orchestration of the cloud infrastructure as it grows to support the City's goals.

This is part of the cloud maturity model and also part of the cloud continuum that is already in progress.

Enterprise Computing Operations: Unisys Data Center Operations Management (DCOM) solution is an ITIL v3 best practice based operation management approach. DCOM uses standardized processes and procedures that enfold the City's IT environment to provide consistent and repeatable support processes.

Moving to ServiceNow will accelerate transformation by providing integrated request management as part of the Service Catalog. ServiceNow integrates with the current on premise environment and with the City's Cloud First strategy. Unisys has successfully implemented and deployed this feature for other clients. This process will drive costs down, improve consistency, and provide a just-in-time approach for systems that require additional resources to meet citizen and department demands. Enterprise computing operations will also organize the communication between different compute towers and coordinate them with project teams for streamlined execution in daily operations and special projects.

Storage and Data Management: The City and Unisys have worked together with storage and data management strategies to support the City's departments and special projects. This includes reviewing the current storage performance and its capacity, as well as evaluating the demand. Unisys will continue to drive data and storage solutions toward the cloud to maintain high availability of data and a scalable infrastructure, as well as improve disaster recovery options.

Physical Database Support: Unisys provides database support for SQL and Oracle engines as part of the current contract. We will continue to provide databases with physical support. This support is provided by remote Unisys staff, but with the continuous transition to the cloud, Unisys will bridge the cloud barrier further. Our expansion of the cloud footprint at the City will further drive the maturity process and continuous improvements in the environment.

Application Support and Web Support: Application and web support is provided by on site staff and remote resources. Unisys will continue to support websites and applications with the same approach. We will keep the current SLA for after-hours support on mission-critical systems. These systems include City websites, PeopleSoft, Public Safety applications, and Utility Billing.

IT Service Continuity and Disaster Recovery: Service Continuity and Disaster Recovery are limited to using High Availability servers with failover connections and multiple ISP feeds. IT Service Continuity and Disaster Recovery (SCDR) will further enhance the use of cloud providers to spin up mission-critical systems and to support offsite data replication in a secure public cloud. Unisys will test these processes once a year to deliver readiness and to meet the SLAs for the City's SCDR. This advance will improve the

Page 92 ends

CITY OF SANTA CLARA
Enclosure A—Appendix A BAFO
support that City citizens receive. It will also provide critical departments with the tools that they must have to continue service if something should happen to the on premise mission-critical systems.

Unisys will provide to the City of Santa Clara Business Continuity and Disaster Recovery Planning (DRP), including the identification and classification of systems that require a Disaster Recovery (DR) plan. The disaster recovery plan, based on the City's RTO and RPO requirements, will include a detailed, step-bystep document which is to be followed during DR testing and/or when a Disaster has been declared. This will require the City to make key technical stakeholders available and responsible to participate in Disaster Recovery Planning Workshops. These workshops will be scheduled within the first three (3) months of the new contract. The Disaster Recovery Plan will be presented back to the City of Santa Clara within 60 days of a successfully completed workshop. The Disaster Recovery Planning is delivered by a separate from the Unisys delivery team but will require input from key technical support staff.

Upon mutual acceptance of the DR plan, Unisys will schedule a test of the DR plan with the City of Santa Clara at a time that will introduce the least amount of impact to the City. Unisys will execute the plan within the first twelve (12) months of the new contract and one (1) time per year for duration of the partnership. Unisys will provide a report with the test results within 15 business days. Upon a DR test failure, Unisys will work to remediate the issue and schedule a retest within 90 days. The Disaster Recovery testing will be led by DRP external team members and Unisys delivery key technical support staff. DR testing is assumed to occur during non-business hours to minimize impact to CSC agencies and constituents. All charges for DR planning and test exercises are included.

Remote Access: Remote access to systems and data for authorized persons is imperative for the City to support the community. This will allow citizens, employees, and City departments to function, especially as the location for these systems shifts from on premise to cloud-based soiutions. Reliable remote access is key for the City to meet changing needs and includes the current VPN Client, Direct Access, and Office 365 methods.

Messaging: The Office 365 project is underway. Once this project is completed, Microsoft will continue to enhance it. As new features are added, they will have to be extended to the field for City personnel.

Collaboration: Across City departments and the various projects underway, collaboration and controlled access are important to have inside public buildings and around the City. Controlled access is important to support effective teamwork on the project teams.

Mobility: As already detailed in our response to RFP requirement 2.4.1c, Unisys worked with AirWatch and MDM while collaborating with the City to create an environment with the ability to support mobile devices. As requirements change, including those for GIS, the Landscape application, and the Public Works Road Conditions application, mobility access will play an important role in achieving effective communication between internal personnel and City of Santa Clara citizens.

Network Services: Unisys will continue to provide a highly available network that allows City employees and citizens to access the applications and services that align with the City's goals. These services will leverage monitoring tools and the ITSM platform to quickly respond to issues and resolve them. This will

Page 93 ends

CITY OF SANTA CLARA
Enclosure A—Appendix A BAFO
include working closely with City telecommunications and fiber partners to maintain a reliable and available network. These are the same services that Unisys provides today and will continue to do so for the duration of the partnership.

Design and Engineering: By leveraging our experience with the design and engineering of network and compute projects, Unisys can recommend a cost-effective approach to meet strategic City project requirements and department goals. We will verify that the right success measurement tools are in place to guide our successful and cost-effective deployment of projects and concurrent operations for the near term and long term. Unisys has included in the services a Unisys Client Architect and technical Subject Matter Experts (SME) to facilitate and oversee design and engineering for the City's IT estate. These individuals are the conduit to the greater Unisys engineering teams and will bring other resources to bear as requested by the City. Reasonable requests for design review or engineering oversight will be handled in this manner. Requests for larger or more complex solutions may require additional staffing which will be reviewed and approved prior to any billable events.

Provisioning: As the City's needs change, the network and security environment will also change. Our network team handles the need to provision new equipment or reconfigure existing equipment to maintain high security. Unisys will use ServiceNow, Nagios, Cisco Prime Infrastructure, Zscaler, SolarWinds, and HP ArcSight to track changes and monitor the environment. These changes often require cross-technical tower support and confirmation of change in the environment. We will leverage those tools to execute, track, and monitor events. These are the same services that Unisys provides today and will continue to provide for the duration of the partnership. Innovation opportunities will be brought forward to the City as they become available for review.

Transport: Transport of data in the ever-growing, always-connected environment is important for having connectivity and control. The use of mobility and the migration from City-owned to employee-owned environments will imply new challenges for monitoring and managing access. Using tools such as AirWatch integrated with ServiceNow and HP ArcSight will allow for access and improved security.

Operations and Administration: Several key components make up part of the Unisys approach to operations and administration. Operations and administration follow ITIL v3 best practice principles by leveraging ITSM and ServiceNow, which will deliver enhanced consistency across technical towers.

Monthly operations review meetings and "shift left" analysis will better support first-time resolution and faster resolve time for incidents. Items discovered will be addressed proactively to maintain the highest level of service.

Documentation: Unisys will create, maintain, and update standard operating documents monthly, quarterly, or yearly. These documents include those for mission-critical systems, processes, and procedures.

Security Planning and Operations: Unisys will provide security management and administration across technology stacks for the City. We worked with the City to define the initial security policies document.

The initial document incorporates current security policies as well as Unisys experience and best

Page 94 ends

CITY OF SANTA CLARA
Enclosure A—Appendix A BAFO
practices. These security policies are managed under the change control process. As requirements or technology change, Unisys will review each security policy document yearly, thereby improving operational procedures and governance with new knowledge acquired through our ongoing service engagement experience.

Firewall Management and Security Intrusion Prevention and Detection: Unisys proactively monitors and manages the City's firewalls, network-based intrusion detection system (NIDS) devices, and hostbased intrusion detection systems (HIDS) for suspicious activity and known intrusions, When an event that affects the firewall or the security of the protected assets occurs, Unisys will evaluate the event, prioritize it, inform key stakeholders of the situation, and act accordingly to rectify the problem. We will attempt to notify the City before unplanned changes to the firewall or IDS-related components. However, in particular circumstances, Unisys may need to shut the firewall down to prevent an active attack from damaging City assets or the firewall itself before communicating with authorized contacts. Unless otherwise stipulated, the City will authorize Unisys to shut its firewalls down if we detect a security breach of the firewall that can affect critical systems or confidential information.

Managed Security Services: These services include physical access tracking, prevention of intrusions to enterprise systems security, and detection as part of an ongoing effort to provide the most robust protection possible against physical terrorism and cyberterrorism.

Enterprise Computing and Network Services follow the same requirements and principles, which include the following:
• A continuous improvement methodology that leverages a service of "shift left,' review of Continuous Service Improvement and Innovation Program results, performance metrics, and key performance indicators. This methodology will allow us to establish improvement areas to help find the critical path across technical towers and team with City counterparts to leverage the highest service levels and to meet continuous improvement goals.
• Innovation brings new technologies and methods to help with life cycle management that will support the City's Cloud First initiatives. Unisys will leverage new tools to improve our cloud strategy in the Application Services commercial off-the-shelf software (COTS) portfolio on a case-by-case basis.

COTS will move to the cloud when deemed appropriate. With our mobile strategy, citizen services and overall engagement will be improved. Innovation will include several components such as Wi-Fi capacity, a new CAD Resource Management System, and integration across City departments to better serve the community.

Support requirements: Unisys will provide 24x7 Remote Service. We will perform non-incident and event activities during the City's normal business hours. Normal client business hours are 7:00 a.m. to 7:00 p.m. (Pacific Time), Monday through Friday. Unisys will provide onsite support during normal business hours. We will provide onsite after-hours support for Priority 1 incidents or as otherwise required to meet service levels.

Page 95 ends

CITY OF SANTA CLARA
Enclosure A—Appendix A BAFO

2.5 Application Management, Configuration and Maintenance Services (Enclosure D - Schedule 3E)

2.5.1 Application Management, Configuration and Maintenance Solution Questions
Instructions: In addition to the General Solution questions in Section 4 above, Service Provider shall provide responses to each of the Service Tower specific questions below. Limit responses to each question to a half page.
a) Describe your process for application portfolio assessment activities, including development of the annual evaluation report of the City's business and enterprise application portfolio with recommendations on application priorities, applications roadmap development.

Response
Over the last seven years, Unisys has worked with City departments to create an Application Portfolio.

This portfolio was developed using the Gartner Application Portfolio Management (APM) portfolio assessment methodology. This portfolio currently has 182 business applications identified with an understanding of the health of each application (Business Value Versus Technical integrity) according to the Gartner TIME methodology (Tolerate Invest Migrate Eliminate). This information is socialized and agreed upon with the departments at least once a year to help drive awareness of the health of the applications and to provide input to budget funding discussions. This assessment identifies both business and technical deficiencies. Many facts about an application are reviewed in these assessments, including:
• Application age
• Does the current platform (server, OS, database, Client, client OS, physical, virtual) comply with the City's Enterprise Architecture standards?
• Security status — PII, PCI, user security, role based • Vendor management
• Product roadmap
• Are the skills required to support the application in line with the City's stated direction? • Is staff training required?
• Opportunity to rationalize (and save costs) — are there other similar applications in use at the City? • How often is the application used?
• Business impact

Page 96 ends

CITY OF SANTA CLARA
Enclosure A—Appendix A BAFO
• Total cost of Ownership, including cost to maintain and support • Interrelationships with other applications.

The Gartner APM (TIME) model to rank business value and technical integrity for each application is a leading approach and one that drives clarity to the application roadmap.

Unisys will continue to manage the City's application portfolio. Our approach to Application Portfolio Management will include the following activities throughout the engagement:
a. Maintenance and enhancement of the application portfolio to continually assess the health of the applications. Due to changes in the business focus and technology, it may become necessary to track additional information regarding the applications (e.g., Windows 10 readiness, Cloud readiness, etc.).
b. Update applications' portfolio inventory data, based on changes to the portfolio (e.g., new applications, upgrades, retired applications, technical changes (virtualization, DR upgrades, and customizations)), the environment, and the City's business needs. c. Facilitate periodic (annual) portfolio reviews with the departments to review their applications.

Monthly Application Portfolio Assessments will be produced with recommendations on application priorities. The outcomes of our application portfolio assessment activities, including assessment of ROI of addressing current business problems, will be reviewed monthly by producing charts and analysis from the repository. Heat maps will be produced to show various issues such as databases and operating systems that are out of date, security issues, and vendor version issues. These items will be reviewed with the respective City departments. During budget cycles, this information will help to prioritize needed upgrades and replacements.

Page 97 ends

CITY OF SANTA CLARA
Enclosure A—Appendix A BAFO
b) Describe your proposed approach to coordinating application lifecycle activities (e.g., testing, configuration, maintenance), with third party application providers (e.g., COTS, SaaS, cloud).

Response
As the incumbent, the Unisys applications team currently performs vendor management activities at all levels in collaboration with department stakeholders and subject matter experts (SMEs).

As part of its strategy for vendor management at the City, Unisys will use the following approach:
• Hold regular executive stakeholder meetings with major application vendors to keep City management current on product roadmaps and new capabilities. • Proactively engage the third party provider SME/technical experts to ensure that application related best practices and latest patches are incorporated in a timely manner.

Monitor feature release schedules from our vendors, plan for testing cycles, and review and prioritize application vendor issues to maintain high-quality service delivery. • Work with the application vendors to ensure:
o Timely identification and mitigation of risks
o Timely resolution of any application-related incidents/issues (e.g., sudden application dumps/errors), escalation of issues to ensure timely assistance from application vendor management, and timely communication to relevant City stakeholders on progress. • Manage communications and set appropriate expectations and project timelines that are agreed to and effectively communicated to the City, Unisys, and the responsible application partner. • Provide input to contract negotiations; understanding the products and vendors helps to create the correct terms and conditions/statement of work for contracts being negotiated by the city. Negotiating the correct deliverables, timelines, and payment milestones is the foundation of a successful project and vendor relationship.
c) Describe your proposed approach for providing the Business Analysis services in Schedule 3E, including how you will engage City departments to understand their unique business needs and translate them into functional and technical requirements, drive solution evaluation and selection, address reporting needs, develop test plans and End-User training and support plans, develop application roadmaps and strategies, and drive departmental customer satisfaction.

Response
Unisys understands that Business Analysis is one of the key aspects of the overall services engagement with the City. Through our Business Analysis Services, Unisys will effectively assimilate the key requirements/challenges of City departments and build requisite collateral/documentation that helps deliver the capabilities and user experience that exceed expectations and effectively support the City's business. The on-site team has Business Analysts that have domain knowledge in key areas such as

Page 98 ends

CITY OF SANTA CLARA
Enclosure A—Appendix A BAFO
Finance, Utilities and public safety, ensuring effective communication of departmental needs and vision to the IT department, Unisys and vendors.

Our core activities for providing Business Analysis Services for the City's Departments will be:

1. Introduce our tested and globally accepted methodology, based on the concepts of "design thinking" or "conversation to conception" (Kanban) model, for effectively capturing business requirements to drive the overall application roadmap. We will incorporate the relevant elements of our overall DevOps and Agile approach to service delivery, to introduce technology and process elements that make this service more efficient.

2. Conduct regular meetings with the City's departments concerning their respective business functions to discuss the current status of issues, projects, and upcoming needs. As part of this activity, we will manage their requests, including tracking, incorporating detailed and complete documentation, and reviewing requests with departments and vendors to find and recommend best possible solutions (and alternatives). We will research requirements with vendors and institutions, and conduct a regular review of business practices against industry best practices to suggest improvements. An example of this service is the Utility Billing system projects, for which Unisys set up a Project Management Office to manage Utility Billing system projects and priorities of the major stakeholders.

3. Proactively lead and manage all coordination activities with the application vendors and City's IT staff (if needed) to ensure availability of the required support needed to resolve project level issues/ challenges arising out of shortcomings in applications or supporting software. This will include coordination for relevant functionality updates! business process changes, application patch installation, application upgrade, etc.

4. Lastly, execute an annual scheduled Customer satisfaction survey relating to the Service Provider's Business Analysis services and roles, with distribution restricted to City's end users, department directors, managers, and key subject matter experts (including Customer's IT Department (ITD)).

Page 99 ends

CITY OF SANTA CLARA
Enclosure A—Appendix A BAFO
d) The City is interested in providing business analytics and reporting services to the City departments, on an ad hoc and standing basis. This would be done through extracting data from departments' business applications and packaging the data for reports and analysis. How would you propose to provide this service to the different departments given their differing missions and needs (including staffing approach, and process for report development activities)? Response
Unisys has a thorough knowledge of the current state of data and analytics needs in the City and is working on some key initiatives to help build/deploy robust analytics solutions, such as Microsoft Power BI. To help deliver reports/analytics services that cater to unique needs of various departments, we will provide this service on a project-by-project basis, with an appropriate "change order" based on the overall scope and level of effort required to support each department's needs.

As part of its business analytics services for City, Unisys team will perform the following key activities as part of this engagement:

1. Organize need-based meetings/workshops with Department SMEs to understand and document these business reporting/analytics needs.

2. Our analysts will then assess feasibility of these requirements against the available data sets and inhouse analytics applications (e.g., Cognos), prioritize the feasible requirements in collaboration with Department stakeholders, and provide estimation for building these reports.

3. Present estimates (and associated implementation costs) to the relevant stakeholders as Change Orders (CRs) for approval/signoff.

4. Post CR signoff, Unisys analysts will design, implement, test, and deploy the report, and collaborate with stakeholders/SMEs for user acceptance/signoff and training on these reports.

In addition to the regular ad hoc analytics/reporting work for City's Departments, Unisys analysts will perform regular research and assessment. We will provide the City with recommendations on relevant next generation business analytics capabilities that present significant opportunity for the City to easily interpret rapidly growing volumes of complex data and decipher new ways of improving services to citizens. Typical examples of these are:
a. Open Data Portal that facilitates a single point of access to a wide range of data held within various City Departments. This Portal will enable ease of use, reuse, and distribution, and will enable meaningful insights that help drive quick and informed decision-making. Recently we became aware that the City's budget software vendor, Questica, has an open data product under development (Open Book) and arranged a demo and installation of the product for Santa Clara to be part of the product evaluation team.
b. Growing volumes, sources, and complexity of data and the desire of organizations to analyze and report on larger volumes of this data (historical or dispersed) has led to the advent of new data

Page 100 ends

CITY OF SANTA CLARA
Enclosure A—Appendix A BAFO
analytics platforms based on Big Data. We will work to assess and recommend such relevant platforms, including Unisys' cost-effective Advanced Analytics Platform, based on the City's future needs. We will help the City's users derive meaningful insights over a larger base (including social media) to serve the City's citizens much more effectively. e) Describe your company's SharePoint practice and how you would leverage it in the City's environment.

Response
The Unisys CSC account team has a senior SharePoint/Office 365 subject matter expert and two additional team members who are well-versed in SharePoint and in supporting the City's intranet (CSI).

Our account team domain experts will closely collaborate and work with department stakeholders to redesign and modernize the City's intranet using SharePoint Online, leveraging our experience and expertise from the Unisys global Microsoft SharePoint practice. We will also incorporate best practices for security and enterprise document management, as well as improve business functionality and collaboration. This will be achieved by implementing:
• Customized workflows and forms
• Team sites
• Other SharePoint native functionality, as appropriate.

At Unisys, we continuously maintain and update our Microsoft collateral, best practice information, and lessons learned from our many client engagements. This information is available to our associates on other engagements, such as CSC. We will efficiently reuse this content to deliver solutions to meet and exceed the City's expectations.

We will make our associates aware of the latest trends, including reviewing release notes from Microsoft and configuring new functionality/best practices as needed, and as it becomes available.

Page 101 ends

Design thinking Workflow Unisys Advanced Unisys Application Unisys Application City Website Process tor Business Analysis le Data Analytcs Development 8, Rationalization Administration • i':.:onversation to Conception Foundation Platform Mgmt Services Framework Services Business Analysis
Services
Application Mgmt,
Configuration &
Maintenance Srvs
• Portfolio
Rationalization
Services
Web Support
Services Frct;sA3pp:

Vendors
Business Analytcs
Services
Analytics Services
based on
ServiceNow PPS,
City's Tools
Applicalion
Management
and
Configuration
Unisys
Assessment
Services: on
Gainer TIME
Methodology
City Vilebsle
Development,
Enhancements,
Administration
Kan ban Model (Agile)
2=1 Ideate
ilECEBEIE Radiate
KEY
Ej Base L:1 Optional
On Premise
Unisys Advanced
Analytics Platform
(UADP) for Big
Data AnalYlics
Application
Maintenance
and Support
SaaS Tool
Troux, Setup:

Automation of
Annual Portfolio
Reporting
Social Media
Integration
Content
Management
Training

CITY OF SANTA CLARA
Enclosure A—Appendix A BAFO

2.5.2 Application Management, Configuration and Maintenance Solution Overview
Instructions: Provide an overview of the Application Management, Configuration and Maintenance solution you propose to address the City Service Requirements stated in Enclosure D – Schedule 3E, as indicated below. Incorporate responses to common solution characteristics and description elements listed above. Limit 5 pages.

Response
Our approach to Application Management, Configuration, and Maintenance Services, which is illustrated in Exhibit 2.5.2-1, is driven by our passion and relentless desire to exceed the City's expectations for application services. Unisys clearly understands City's challenges and will use this opportunity to bring in the much needed process improvements and automation in our services offering that will help deliver continuous improvements and innovations and bring in the benefits of improved efficiencies, reduced time to value, and potential cost savings for the City.
'1 Et: Itnrt • . 4
Application Governance and Management Services
Exhibit 2.5.2-1. Unisys Application Management, Configuration, and Maintenance Services.

As part of this strategy, Unisys team will help transform the current state of services through these key initiatives during our engagement with City::
a. Rationalize and standardize the current processes in place for Application Services by using our expertise and Gold partnership in the renowned Scaled Agile Framework for Enterprises (SAFe). This

Page 102 ends

C ITY OF SANTA CLARA
Enclosure A—Appendix A BAFO
framework combines Agile and Lean principles and values to arrive at the specific practices and roles that are required across the enterprise to succeed on the Agile journey. b. Introduce DevOps to provide the much-needed automation across the application life cycle for improved efficiency, effectiveness, and speed of project delivery. DevOps will bring the needed automation for driving effectiveness in service delivery and drastically reduce potential defects to improve services quality and drive costs down.
c. Through Continuous Service Improvement initiatives, consistently enhance the skills of our associates at the City. This will not only meet our associates' aspirations, but also will set the pace for innovation, growth, and overall efficiency and cost benefits.
d. Evaluate new technologies and recommend enhancements that help to drive continuous improvements in operations, reduce the time to market, drive costs down, drive better user experience, and improve user sentiment. Our recommendations are as follows:
i. Open Data Portal, to facilitate a single point of access to a wide range of data held within various City Departments as opposed to the current environment where information is in silos, spread throughout the city (Refer to our response to RFP requirement 2.5.1d.) ii. Advanced Business Analytics based on Big Data capability, using cost-effective solutions like the Unisys Advanced Analytics Platform to solve complex problems in the future. (Refer to our response to RFP requirement 2.5.1d.)
iii. Agile-based business analysis (refer to our response to RFP requirement 2.5.1c) to drive process improvements that help design solutions with improved user experience.

Unisys will work to provide all the services listed as in scope for Application Services SOW (Schedule 3E), including the ongoing and project-based application maintenance, configuration, and maintenance services for Customer's application portfolio, in line with City's expected Service Level Agreements (SLAs), with timely and adequate assistance provided by City's stakeholders in resolving dependencies arising out of external factors where Unisys has no control. These external factors are typically:
a. Delays on the part of the City in its required project participation, providing scope changes and in signoff of deliverables, despite timely reminders from Unisys Team b. Delays on the part of the City in procuring applications and software (or patches) or provisioning required infrastructure for the project
c. Delays from the application or software vendors in providing the required patches, despite timely communication from Unisys Team
d. Change in City's business priorities, and the same resources from Unisys Team are required to address them

Page 103 ends

CM/ OF SANTA CLARA
Enclosure A—Appendix A BAFO
e. Delays in provisioning of the required infrastructure (including the correct versions of application, database, etc. for Non-Production and Production environments) or SaaS environments to build, test, and deploy
f. Timely and complete participation and signoff on deliverables from assigned City stakeholders in accordance with the Project Plan
g. Product/application and environment, Infrastructure, or Environment (Cloud or in-house) issues h. Upsurge in incident volume from the current volume handled by the Unisys Team.

In such scenarios where external factors come into play, Unisys will work tirelessly in coordination with City and any third-party vendors to ensure timely resolution (or workaround) of such external factors that inhibit service quality and impact smooth running of business. In addition, Unisys will document such instances and their resolutions as lessons learned, so impact of such external factors can be minimized in the future.

Our SAFe Strategy for the City
Unisys will use our team of certified Scaled Agile Program Consultants with deep industry expertise to provide the required consulting needed to enable an Agile way of working. Unisys created a framework to help to assess customer organizational readiness for embarking on an Agile-DevOps journey and identifying improvement areas. We will leverage this framework to help with charting the roadmap for achieving the necessary process improvements,
How SAFe Will Work at the City
Detailed Scaled Agile (SAFe®) and DevOps Implementation Approach is provided in response to Question 4.1 d. This section gives an overview of Unisys' Agile/SAFe® strategy for City. The Agile life cycle conforms to an incremental pattern. Development iterations, termed as sprints, are typically contained in 2 to 4 week increments in which constant progress is demonstrated. This life cycle and the accompanying methodology allow for maximum communication and collaboration with clients and development. Unisys' key Agile elements, combined with our enhanced execution capacity that leverages our DevOps stack, will address the scope of application management and configuration to include the following activities:
• Requirements Management: to establish and maintain agreement with the City and other stakeholders on system requirements. The Agile method defines requirements with the sprint cadence of 2 to 4 weeks and uses a user story-driven approach. User stories allow requirements analysts to focus on the goals for the system under development and offer a short narrative describing something that a user wants the system to do. • Analysis and Design: to transform the requirements into a design of the system-to-be; to evolve a robust architecture for the system; and to adapt the design to match the implementation environment, designing it for performance.

Page 104 ends

CITY OF SANTA CLARA
Enclosure A—Appendix A BAFO
• Implementation: to define the organization of the code as implementation subsystems organized in layers to implement the design elements as implementation elements (source files, binaries, executables, etc.), to test the developed components as units, and to integrate the results produced by individual implementers (or teams) with an executable system. • Testing: to focus mainly on evaluating or assessing product quality, which is realized through a combination of leveraging DevOps (e.g. Selenium) for improved testing efficiency and effectiveness and the following core Agile practices:
o Document defects in software quality and advise on the perceived software quality o Validate and prove the assumptions made in design and requirement specifications through concrete demonstration
o Validate that the software product works as designed
o Validate that the requirements are implemented appropriately • Deployment consists of the activities for enabling the software solution's availability for its end users. • Configuration and Change Management are essential for controlling the numerous artifacts produced by the many people who work on a common project. Unisys Agile uses CMMI-compliant processes for configuration management.
• Project Management is the art of balancing competing objectives, managing risk, and overcoming constraints to successfully deliver a product that meets the needs of customers and users. That so few projects are unarguably successful is comment enough on the difficulty of the task. Agile Project Management allows Unisys to manage risk and to demonstrate progress early and often. • Organizational Change Management (0CM) enables the organization to efficiently transition through the change impact by identifying the risks and mitigation as it pertains to employees; identifies key messages to push using a variety of supporting channels; and tracks usage of the new tools or technologies based on targeted communications as well as appropriate training delivered. As a result of the organizational change management strategy, City of Santa Clara will receive:
o OCM plan that provides strategic approach applied to an evidence-based transformation plan that moves organization from current to future state with high adoption rates. o Communication campaign that supports organizational growth through transition, utilizes CSC current communication channels, and tracks effectiveness.

OCM stakeholder analysis will include a focus on how the transition to DevOps environment impacts current stakeholder groups, and specific treatments (communication and training workstreams) that address and support the transition. We will create performance objectives for fully leveraging DevOps environment including achieving service levels as identified in solution SOW. Performance objectives will be addressed through specific training and coaching plan to fully engage impacted users.

Page 105 ends

CITY OF SANTA CLARA
Enclosure A—Appendix A BAFO
• Environment focuses on the activities necessary to configure the process for a project. It describes the activities required to develop the guidelines to support a project. The purpose of the environment activities is to provide the software development organization with the software development environment—processes and tools—that will support the development team. • Operations and Support is a discipline that is adopted by Unisys Agile. It is the recognition that the work is not complete when the project is delivered. The main goal of the Operations and Support discipline is to operate and support the solution in a production environment.

Application Maintenance and Support:

Our approach to Application Maintenance and Support is driven by the ITIL v3 framework. The model focuses on delivery of services to business stakeholders within a set of well-defined service-level expectations. The changes and benefits that are due to a shift to a unified managed service provide a positive impact across many dimensions. Unisys stands behind our commitment to services that will improve over time and be supported by detailed analytics. Applications management will align incident management, problem management, knowledge management, service request management, and service optimization with the ITIL framework to provide process standardization.

Unisys' partnership with ServiceNow allows us to bring not only one of the best service management tools in the market but also our world-class ability to deliver services through a fully ITIL v3 compliant framework and operations model. The Unisys strategy for service management is founded on helping clients to focus on a top-down approach for understanding that business value comes from running IT from the business perspective. Although the Unisys solution is partly based on ITIL-certified products, it incorporates Lean Six Sigma principles to maximize the value to the City. The aspects expected as part of the maintenance services will use our strengths as follows:
a) Preventive Maintenance:
i. Use our expertise in ServiceNow for regular analysis of volume trends in incidents and problems to recommend appropriate remediation measures (e.g., enhancements, system changes, and upgrades,)
Work with our enterprise compute team to help with setting up an adequate application performance monitoring mechanism that maintains continuous monitoring of key business applications, thereby providing business continuity by timely prevention and quick resolution of application breakdowns
iii. Work closely with application vendors, given our knowledge of the City's landscape and challenges, to confirm that applications have the best practices and the latest patch updates in place.

Page 106 ends

CITY OF SANTA CLARA
Enclosure A—Appendix A BAFO
b) Adaptive Maintenance:
i. Unisys will perform regular research and provide periodic updates of application and solution recommendations, which will fill gaps that might exist between the City's vision and current application landscape.
ii. Once City stakeholders accept our recommendations, Unisys will work with relevant vendors to enable the application to meet the requirements (or gaps) with minimal customization. iii. Hold regular meetings with application vendors to confirm that the solution is regularly updated in line with the City's changing business and regulatory needs. iv, Work with the City IT Department to confirm that required clearances are in place for periodic installation of vendor-recommended patches and changes. c) Corrective Maintenance:
i. Ensure timely resolution of incidents.
ii. Perform necessary break/fix activities.
iii. Drive appropriate and timely communication to relevant stakeholders, d) Perfective Maintenance:
i. Work with the enterprise compute team to confirm adequate application performance monitoring, especially the key business applications (e.g., PeopleSoft) to identify problems that affect expected value to City departments
Regularly analyze applications' performance trends and work with appropriate application vendors to understand and develop roadmaps for recommended maintenance best practices and periodic infrastructure changes to avoid degradation of application performance.

Continuous Improvement: As an innovation-driven organization, Unisys believes in driving this culture of innovation and continuous improvement in our associates who are engaged with the City. We see tremendous value in fostering this culture through our proposed engagement team to consistently deliver benefits and cost savings to the City. The following elements are key to success for this program:
• Effective Knowledge Management to drive cost down and increase end-user satisfaction by driving for the quickest and most effective resolution
• Relentless Training of our associates that includes cross-skilling, up-skilling, and relevant certifications.

Page 107 ends

APPENDIX A

CRITICAL DELIVERABLES
for

CITY OF SANTA CLARA

CITY OF SANTA CLARA
Schedule 2 – Final Service Tower Solutions—Appendix A
Table of Contents
Procedures Manual 2
IT Strategic Plan 2
Information/Cyber Security Plan 6
Business Continuity Plan 8
Disaster Recovery Plan 10
Enterprise Architecture Plan 12
Communications Plan 15
ITIL Service Management Standards 17
Enterprise Project Management Standards 20
Digital Strategy Plan 21
Innovative Products and Services Report and Meeting 25
Operational Efficiencies Improvement Report and Meeting 27 End User and Key Department Personnel Scheduled Customer Satisfaction Survey Report and Meeting 28
Services Strategic Review Report and Meeting 28
Annual Execution Plan 28
Technology Refresh Plan 29
Overview of Unisys Innovation Workshops Error! Bookmark not defined.

Global Expertise and Thought Leadership Error! Bookmark not defined.

Page A-i

CITY OF SANTA CLARA
Schedule 2 - Final Service Tower Solutions—Appendix A
Procedures Manual
Guide that details the standard operating procedures for all services. This has items such as process based procedures such as Incident management as well as functional base tasks such as PC installs.

In October of 2013 a series of guides forming the then Procedures Manual was delivered as part of the original contract Critical Deliverables to the city. These guides in some cases are fully inclusive while others point to shared repositories of documents that contain "how to' s" that are frequently used by desktop technicians and other support staff, both onsite and remote. Examples of these guides include, but are not limited to:
• Change Control Procedures
• Problem Management Procedures
• Incident Management
• Data Center Maintenance Plan
• Database Backup and restore
• Security Procedures
• Operations Guide
• LAN Standard and Procedures
• Windows Design
• VPN Procedures
• Server Build Procedures
• Server Patching Procedures
• Endpoint Installation Procedures
• DSS Processes and Procedures
Since publication, there have been changes to the infrastructure, environment, software and business applications that need to be reflected in these documents to bring them up-to-date.

Furthermore, during the transition process new runbooks and helpfiles will be updated and created. These will also be referenced to the knowledge base and portal as applicable. Once these have been updated by the individual service towers and approved, a process will be put in place to update them regularly through the change management process.

Business IT Strategic Plan
Plan that analyzes the current state of the City's Information Technology utilization, capability, capacity, maturity and cost-effectiveness to meet functional business goals and requirements. , Identifies un-met and new business requirements and develops the future state Information Technology landscape, as defined below.

The plan will include a 2-4 year roadmap to help it achieve the identified future state, goals and objectives.

Elements include:

Current State: review and assessment of business strategy, vision and goals, business services and functional requirements, IT utilization, capability, capacity, maturity and cost-effectiveness to meet functional business goals and requirements. , financials, IT environment, service gaps.

Future State: Un-met and new business requirements, IT trends, IT vision, IT capabilities, policies, standards, processes and organization, enterprise architecture, governance model, performance management
Roadmap: Identification and prioritization of business application refresh projects and IT initiatives for the 2- 4 year horizon. The roadmap will include time-lines, budget needs, high level justification and funding sources.

Page A-2

CITY OF SANTA CLARA
Schedule 2 – Final Service Tower Solutions—Appendix A
The Enterprise Architect, assisted by Unisys Consultants and SMEs will develop and update annually the Business IT Strategic Plan (ITSP) based on the departmental goals aligned to the City's Mission and Vision. The ITSP serves to align the technology requirements to the City's business goals, functions, services and requirements for information technology and forms the foundation for the other associated strategic plans, information technology organizational, tactical and operating plans. The Future State vision describes the ideal state in high-level terms that forms the foundation for the acquisition of new technologies to support new capabilities. Identified gaps between the Current State and the Future State are selectively organized into projects that are then prioritized based on budget or technology sequencing requirements. As new approaches/capabilities are identified through trends in technology and service delivery, they will become candidates for update to the ITSP and the other strategic plans. As projects are completed, their components and capabilities will become reflected in the Current State as part of the annual update. As new business goals or technology improvements are identified, their components and capabilities will be incorporated into the Future State, and a new gap analysis will be conducted and the Roadmap updated as part of the annual update. (Please refer to 2.1.1.0.) Unisys will produce a business driven "IT Strategic Plan" in the first year (within 12 months) after "go live", that is intended to provide a high level framework and prioritized roadmap of IT projects and initiatives for a 2-4 year period. Following the initial deliverable, this roadmap document will be revalidated and updated at least once every 12 months to reflect any changes in the City's business priorities and technological advancements and changes.

Unisys will maintain this Strategic Plan and Roadmap and provide effective, monthly communications on progress to ensure that the City makes progress on its vision and goals through the prioritized roadmap.

Deliverable outline
An outline of the "lT Strategic Plan" deliverable that will be produced at the end of a four to six week engagement is outlined below. This is the same work plan as the Digital Strategy Plan insofar as it leverages the same workshops and the same participants. The Digital Strategy is the "envelope plan" whereas the IT Strategic Plan is the "enabler plan". In any case while we develop the interview schedules and the workshops it should be one set that covers the input and planning, deliverable creation for both.

TOC Major Area Content area (sub TOC) Comments
City Goals and Vision *City Goals and Visions -
* IT and Technology
Vision and Goals for City
Describes City's Goals and Visions
for the City as a whole, and specific
departments as perceived by
leadership of City and Department
heads

CITY OF SANTA CLARA
Schedule 2 – Final Service Tower Solutions—Appendix A
# TOC Major Area Content area (sub TOC) Comments
2 Current State of Digital
Technology in the City
* Business services and
functional requirements
* Current State of
Technology / Processes
in various
Departments/City
*IT utilization, capability,
capacity, maturity and
cost-effectiveness to meet
functional business goals
and requirements.
* Enablers / Barriers that
exist today
* Existing IT Projects that
are underway and their
alignment with the ITSP
and Digital Gov
Gaps that still exist in order meet the
City's stated goals and visions.

Technology Enablers that will be
required to fill these gaps with the
current state
3 Future State
Recommendations
*Un-met and new business
requirements, IT trends, IT
vision, IT capabilities,
policies, standards,
processes and
organization, enterprise
architecture, governance
model, performance
management
* Technology Capabilities
Required to support
Future Vision and Goals
* Prioritized list of
business application
refresh projects and IT
initiatives
* Projects Defined with
High level cost, benefit
and Financial Analysis
* Prioritized list of Projects
Prioritized list of Projects and
Initiatives supported by Financials
(high level) costs and benefits and an
implementation plan (high level) in a
roadmap for the City
Page A-4

CITY OF SANTA CLARA
Schedule 2 — Final Service Tower Solutions—Appendix A
# TOC Major Area Content area (sub TOC) Comments
* Projects / Initiatives
recommended
* Implementation
Road map for 2 to 4 year
timeframe
5 Ongoing Governance
Recommendations
* Methodology, Templates
and Documents to track
and monitor ongoing
implementation
* Monthly Status Report
Template
Visual Tracking of Progress made on
various Technology projects and
initiatives, including Financial
performance, and progress against
plan
Tasks I Deliverables / Acceptance Criteria
Unisys will use a team of Consultants and Local Government SMEs, and the onsite team of Applications Program Manager, Enterprise Architect to develop and present the IT Strategic plan, which will be updated annually (every 12 months).The Unisys team will work with City stakeholders who will be identified prior to the initial kickoff meeting and will be involved during the interviews, and also both of the workshops that will be conducted during the engagement to produce the final deliverable - IT Strategic Plan.

Major Task / Deliverable Completion / Acceptance criteria 1 Engagement Plan with Interview
Schedule (Kickoff)
Project Plan Produced and presented to City
Stakeholders and approved by the CIO
2 Interviews with Stakeholders of all
departments (1-2 interviews per
department)
Interviews completed (Questionnaires and
interview notes produced and documented)
3 Preparation for Planning Workshop # 1) Planning Deliverable - PPT Deck and Word Document that outlines City Goals/Mission (for
Digital Transformation), Capabilities, Enablers
and Barriers completed and approved by the
CIO and departments
4 Prioritization/Planning Workshop
Completed (#1)
Planning Deliverable (updated)- PPT Deck
and Word Document that outlines City
Goals/Mission, Capabilities, Enablers and
Page A-5

CITY OF SANTA CLARA
Schedule 2 – Final Service Tower Solutions—Appendix A
Major Task / Deliverable Completion / Acceptance criteria Barriers completed, with capabilities prioritized
after the Workshop, reviewed and approved by
the City.
5 RoadMap Workshop Completed (#2) RoadMap Deliverable – PPT deck and Word document that describes Initiatives/Projects and
their priorities, with High Level Financial
Analysis (costs / benefits), priorities, High level
implementation plan and Roadmap. Completed
and approved by the CIO
6 Final Presentation and Deliverable
Completed
Final Presentation to City Stakeholders (PPT
Deck) and Final Deliverable – IT Strategic Plan
Document (Word doc) completed, presented
and approved by the CIO
Periodic Updates and Ongoing Governance
Monthly Status reports will be produced regarding the progress of various activities and milestones outlined in the IT Strategic Plan. This will be tracked by the Unisys PM0, Applications Program Manager, Enterprise Architect as well as Digital Government SMEs and the City stakeholders.

On an annual basis (every 12 months), the planning process will be repeated, as necessary, to update and maintain the IT Strategic Plan document.

Information/Cyber Security Plan
A current information security plan and robust set of policies exist as an input. Service Provider will analyze current security posture, any new business and regulatory compliance requirements and laws, and provide recommendations to address any areas where deficiencies or threats have been identified for both on prom and cloud assets. Result will be an updated written plan, policies, standards and procedures that provide the operational and technical responsibilities associated with the Security table in this SOW (e.g., data security, physical security, security operations, patching, malware prevention, monitoring and Incident management, and threat and vulnerability management).

The Plan must be consistent with the NIST Cybersecurity Framework and any new business and regulatory compliance requirements and laws.

A Security Plan exists from 2013 based on the City's business needs and the security and privacy controls listed in the NIST SP 800-53 publication. This plan incorporated the results of an assessment that documented compliance with the controls listed in the NIST special publication. The security plan will benefit by performing a new security assessment, which is included as an optional service in the

CITY OF SANTA CLARA
Schedule 2 – Final Service Tower Solutions—Appendix A
proposed information security solution. The optional annual risk assessment and requirements review is based on business needs and the complete (most current version) NIST Cybersecurity Framework. (The currently released version 1.0 consisting of 22 categories and 98 subcategories and draft version 1.1 consisting of 23 categories and 106 subcategories).

If opted for, the assessment will be performed by the Unisys Security Advisory team using currently released version. The results will be used to benefit the Security Plan.

The following are the aspects of the risk assessment process that will enable the development of a plan that conforms to the NIST Cybersecurity Framework, and is based on the City's priorities and areas of risk.

1. Perform risk assessment
Define scope that includes systems, stakeholders, and compliance requirements.
a. Understand current state of security controls (based on Data Sensitivity requirements, NIST Cybersecurity Framework and other standards and laws, such as HIPAA, California Public Records act, PCI, DOJ, California privacy laws and guidelines, NERC Standards, etc.)
Conduct interviews and perform walkthroughs of in-scope systems and processes
Perform SWOT Analysis (Strengths, Weaknesses, Opportunities, Threats)

2. Determine desired capabilities and maturity levels

3. Perform gap analysis

4. Generate report that includes:

Revised Security Plan, Policies, Standards and Procedures Revised Citywide security breach response plans
Revised security technical architecture
Prioritized risk ranking
Capability assessment findings
Maturity assessment analysis
Remediation and upgrade recommendations
Security action plan
Page A-7

CITY OF SANTA CLARA
Schedule 2 - Final Service Tower Solutions—Appendix A
Business Continuity Plan
The Business Continuity Plan includes working with key stakeholders to re-validate the City's critical business applications and infrastructure assets based on the already defined prioritization framework and updating/enhancing the existing Business Continuity Plan that encompasses all current mission-critical City Applications and the associated IT assets.

The current Business Continuity Plan (BCP) was delivered as part of the original contract Critical Deliverables to the city in January and February of 2014 and consisted of the following documents:
• Business Continuity Program: Information Technology Strategy • Business Impact Analysis
• IT Incident and Communications Management Plan
• Disaster Recovery and Scheduled System Testing
• Data Center Restore Plan
• CSC Information Technology Operations Recovery Plan
• IT Operations Metro Failover Guide
• ITSM Offline Workaround
• CSC - Business Continuity Program Tabletop Test Plan
• CSC - BCDR Risk Assessment Table
• Business Continuity and Information Security Executive Steering Committee Charter.

Since publication, there have been changes to the infrastructure, environment, and business applications that need to be reflected in these. A Business Continuity (BC)/Disaster Recovery (DR) subject matter expert (SME) will facilitate the review, validation, and update of the documents and plans listed above.

There will be a need for the SME to interact with the onsite and in some cases remote staff to obtain updates to the environment and business requirements. The impact on City department resources will be minimized through an effort to reuse discovery and analysis work performed as part of the 2014 deliverable effort. The basic process will be as follows but is subject to revision after the "Create and Review BCP Update Schedule" tasks have been performed:

1. Create and review BCP Update Schedule
a. Review existing BCP documents
b. Assign tasks for data updates
c. Create and review CSC BCP Update Schedule
d. Review the BCP Update schedule with Unisys CSC support team

2. BCP Information Update
a. City of Santa Clara Business Continuity Program: Information Technology Strategy b. Business Impact Analysis based on revised business requirements, RTO and RPO needs

CITY OF SANTA CLARA
Schedule 2 – Final Service Tower Solutions—Appendix A
c. Enterprise Architecture
d. VM Mappings to Volumes
e. Hybrid Cloud and Cloud Backup impacts
f. BCDR Analysis
g. Emergency Incident Contact Lists
h. BCP Information Update - Complete

3. Update BCP plans
a. IT Operations Recovery Plan
b. IT Incident and Communication Management Plan
c. DR and Regular CoSC System Testing (MASTER)
d. City of Santa Clara Business Continuity Tabletop Test Plan e. Datacenter Restore Plan
f. BCP plan update complete
g. Sign off by the City and Unisys on the revised BCP

4. Publication of Revised Business Continuity Plan
The current Business Continuity Plan which is the main document contains the following high level layout and table of contents but may be revised during the update process:

1.0 Introduction

1.1 Purpose

1.2 Scope

1.3 Objectives

2.0 Risk Assessment

2.1 Threat Summary

2.2 Threat Mitigation

2.3 Major Disruption Scenarios

3.0 Business Impact Analysis

3.1 Approach

3.2 Business Function Summary

4.0 City Emergency Operations

4.1 Emergency Operations Plan Priorities

4.2 Emergency Operations Plan Scope

4.2.1 Levels of Response

4.3 City Emergency Operations Responsibilities

4.4 Integration of Departmental Recovery Plans

4.5 The Business Recovery Center

5.0 Business Continuity Framework

6.0 Conceptual Architecture

6.1 High-Availability Architecture

6.2 Disaster Recovery Architecture
Page A-9

CITY OF SANTA CLARA
Schedule 2 – Final Service Tower Solutions—Appendix A

7.0 Recovery Approaches

7.1 Platform Types

7.2 Recovery Techniques

8.0 Plan Maintenance and Testing

9.0 References
Disaster Recovery Plan
This plan is to update and enhance the detailed requirements and design solutions for the recovery of critical IT assets in the event of a major disaster or service disruption.

Unisys will provide to the City of Santa Clara a Disaster Recovery Planning (DRP) for those Business Critical systems that require DR plans. The disaster recovery plan deliverable, based on the City's Recovery Time Objective (RTO) and Recovery Point Objective (RPO) requirements as defined in the Business Continuity Plan (the subject of a separate deliverable), is a detailed step-by-step document which is to be followed by key Unisys and City staff during DR testing and/or when a Disaster has been declared. Unisys will collaborate with CSC on a yearly basis to review and update both the Business Continuity and Disaster Recovery Plans.

This will require the City to make key technical stakeholders available and responsible to participate in Disaster Recovery Planning Workshops. These workshops will be scheduled within the first three (3) months of the new engagement. The Disaster Recovery Plan will be presented back to the City of Santa Clara for their acceptance and approval within 60 days of a successfully completed workshop.

Upon the City of Santa Clara's acceptance of the DR plan, Unisys will schedule a test of the appropriate set of Business Continuity Plans and the DR plan with the City of Santa Clara at a time that will provide the least amount of impact to the City. Unisys will execute the plan within the first twelve (12) months of the new engagement and one (1) time per year starting in year 2 for the duration of our partnership.

Unisys will provide a DR test review report with the results of the DR test within 15 business days of completion of the scheduled DR test. If a DR test is not successful, Unisys will provide a Root Cause Analysis (RCA) for the failed DR test. Unisys will remediate the issue (if the root cause identifies that remediation is within Unisys' scope to resolve or provide appropriate remediation requirements to the City for any out of scope issues) and schedule a retest within 90 days of the remediation, as identified in the RCA.

The primary Disaster Recovery Planning staff is an external team to the onsite Unisys delivery team but will require the input from key technical support staff. Disaster Recovery testing will be led by the Unisys DRP external team members and may require onsite Unisys delivery key technical support staff and possibly CSC User Acceptance Test personnel.

DR testing is assumed to occur during non-business hours to minimize impact to CSC agencies and constituents. All charges for DR planning and test exercises, as described above, are included in the Unisys proposal.

Page A-10

CITY OF SANTA CLARA
Schedule 2 - Final Service Tower Solutions-Appendix A
The main Disaster Recovery Planning document proposed high level layout and table of contents would be as follows but subject to change during the development process:

1. Introduction

1.1 Purpose

1.2 Objective

1.3 Scope

1.4 Assumptions

1.5 Applicable Standards and Guidance

2. Concept of Operations

2.1 Four Phases

2.2 Data Backup Readiness Information

2.3 Site Readiness Information

2.4 Hybrid Cloud Readiness Information

2.5 Roles and Responsibilities

3. Activation and Notification

3.1 Activation Criteria and Procedure

3.2 Notification Instructions

3.3 Outage Assessment

3.4 incident Team(s)

3.5 End User Messaging/Communications Plan

4. Plan Activation Procedures

4.1 Media Retrieval and Delivery

4.2 Cloud Backup Data Recovery

4.3 Disaster Recovery Overview

4.2.1 General Application Description

4.2.2 Recovery Contacts

4.2.3 Data Center Overview

4.3 Infrastructure Recovery Procedures

4.4 Critical Business Application Recovery Procedures

4.5 Website Recovery Procedures

4.6 DNS Changes

4.7 Network Recovery Procedures

5. Reconstitution

5.1 Data Validation Testing

5.2 Functional Validation Testing

5.3 Recovery Declaration

5.4 User Notification

5.5 Cleanup

5.6 Returning Backup Media

5.7 Backing up Restored Systems

5.8 Event Documentation

6. Recovery Plan Testing

7. IT Business Restoration (Return to Normal Operations) Plan Appendices:

Key Personnel and Team Member Contact List
Vendor Contact List
Alternate Telecommunications Provisions
Diagrams
Page A-11

CITY OF SANTA CLARA
Schedule 2- Final Service Tower Solutions—Appendix A
Network Configurations
Hardware Inventory
Recovery Plan Test Report
Related Documents
Enterprise Architecture Plan
Develop an analysis, blueprint and implementation plan for the City's data, applications, and technology.

The Enterprise Architect will develop and maintain an Enterprise Architecture Plan (EAP) based on an Enterprise Architecture Framework of Architectural Domains, including:
• Business Architecture (BA) - structured around mission critical business capabilities/processes based on departmental goals intended to realize the City's Mission and Vision. • Information Architecture (IA) - Information and analytics needs of the business functions, communities of interest, external stakeholders, business partners, etc. • Data Architecture (DA) - structured around the logical data required to support the BA • Security Architecture (SA) - based on the sensitivity and vulnerability of the data (DA) or services (BA)
• Application Architecture (AA) - based on the approved application technologies required to realize the mission critical business processes. This domain will include all application layers, such as:

Access Channels Layer
Presentation Layer (CX and UX)
Shared Services Components
E-Government on-line services
Enterprise applications
Department Specific applications
Middleware Components - Integration Layer; Web Services; Business Rules, etc. • Communication Architecture (CA) - based on the approved technologies required for communication and delivery of services through voice and network capabilities. • Infrastructure Architecture (IA) - based on the approved product technologies required to support the BA, IA, DA, SA, AA, and CA domains. This includes Business Continuity and Disaster Recovery capabilities.

Page A-12

CITY OF SANTA CLARA
Schedule 2– Final Service Tower Solutions—Appendix A
The EA Framework will be leveraged to guide requirements analysis to ensure that new technology components align with the intended Future Vision. Overall, the EAP will provide a high-level view of the City's approach to fulfilling the Future Vision of the IT Strategic Plan and a high-level view into the Tower roadnnaps. The EAP will be updated to reflect changes through delivery of projects or CRs and presented as part of the annual update process. (Please refer to 2.1.1.o.).

Deliverable outline
An outline of the "Enterprise Architecture Plan" deliverable that will be produced at the end of the Digital Strategy Plan and IT Strategic Plan development following approval of those deliverables. # TOC Major Area Content area (sub TOC) Comments
1 City Goals and Vision * City Goals and Visions -
Outside in view of how
City will serve Citizens
and Constituents
* Digital Government
Vision and Goals for City
* business function and
services requirements
* Information and
Analytics requirements
* IT Architecture Drivers
Describes City's Digital Government
Goals and Visions for the City as a
whole, and specific departments as
perceived by leadership of City and
Department heads. This introduction
is taken from the IT Strategic Plan.
2 Enterprise Architecture
Domain Framework and
Domain Descriptions
• Description of the
domains of the
EA Framework
• Specification of
the meta-data to
be captured and
maintained within
each Domain
• Domain detail
descriptions,
components
(bricks),
standards, five
year upgrade
Based on the results of the Digital
Strategy workshops and the IT
Strategy analysis, the EA Domain
Framework will identify those
Architectural Domains to measure
and monitor in order to realize the
City's goals.

CITY OF SANTA CLARA
Schedule 2 – Final Service Tower Solutions—Appendix A
# TOC Major Area Content area (sub TOC) Comments
plans.
3 EA Repository • Description of
the EA repository
to be used to
capture and
maintain the
Domain metadata
The Domain meta-data will be used to
measure the gaps to be filled in order
to realize the City's goals. The EA
repository will enable a digital
modeling capability that will visibly
diagram the alignment of the City's
goals to the underlying architecture of
the solutions.
4 EA Processes • Description of
processes to be
followed in order
to maintain the
EA Domain
Framework in the
EA Repository.

The EA Processes are the methods
to be applied to ensure that selected
projects are staying aligned with the
City's business goals.

Tasks / Deliverables / Acceptance Criteria
The Enterprise Architect to develop and present the Enterprise Architecture Plan, which will be updated annually (every 12 months). The Enterprise Architecture Plan will be developed in conjunction with the Digital Strategy Plan and the IT Strategic Plan and will focus on those gaps that must be filled to ensure realization of the City's goals.

Major Task / Deliverable Completion / Acceptance criteria 1 Draft (Strawman) Enterprise Architecture
Plan (EAP)
Following completion of the Digital Strategy Plan
and the IT Strategic Plan, The Enterprise
Architect will deliver a draft Enterprise
Architecture Plan tailored to the identified gaps
the must be closed in order to realize the City's

CITY OF SANTA CLARA
Schedule 2 – Final Service Tower Solutions—Appendix A
Major Task / Deliverable Completion / Acceptance criteria goals.
2 Presentation and Review of the EAP Review, discussion and adjustment of the EAP to address the identified gaps
3 Finalized EAP Enterprise Architecture Plan Document (Word doc) completed and presented
Finalized document incorporating the comments
and recommendations from the Review.

Approved by the CIO ,
Periodic Updates and Ongoing Governance
On an annual basis (every 12 months), following update of the Digital Strategy Plan document and the IT Strategy Plan document, The Enterprise Architecture Plan will be reviewed and updated to address any needed change in Domains or meta-data necessary to address changes to those underlying plans.

Communications Plan
Written plan that provides direction on how the Service Provider will engage with ITD and other City departments on an ongoing basis, including at both the strategic and operational level. The plan will define the frequency, audience and format of the communications.

The communication plan will serve to describe the strategic collaboration approach and how Unisys maintains an effective partnership with ITD and CSC departments. The plan includes the governance, roles and responsibilities for proactive and reactive communication between Unisys and CSC as well as publicizes successful rollouts and keeping the departments in touch with the IT strategic roadmap.

Reactive communications are event based. Examples of reactive communications are notification of a system outage, notification of resolution of a system outage, software upgrade, and project milestones reached. These communications are sent out at the time of the event. Proactive communications are sent out on a regular schedule. They include messages such as service level performance, such as uptime reports, service desk recaps, security awareness, the IT roadmap, Projects portfolio and progress on the Annual Execution Plan, and user education including tips and advice. These communications will be scheduled on a staggered basis to ensure frequent contact with end users, stakeholders, and department heads. The frequency of each communication will be defined in the plan, in addition to who will send out the communication. Depending on the subject, communications may be sent monthly, quarterly, or annually.

Page A-15

CITY OF SANTA CLARA
Schedule 2 – Final Service Tower Solutions—Appendix A
Communication channels and levels of communication for each stakeholder group are provided in the plan to accommodate the relevancy of information as well as maintain a transparency with ITD/CSC on project progress as well as issues and/or risks and respective mitigation. The communication plan supports the overall project deployment plan and will be updated as needed based on input from Unisys and ITD/CSC.

The communication plan will also define the style and format (templates) of these communications. It is important that they be informative, brief, and professional.

The Communications plan will provide the following benefits:

1. Inform users about events that may affect them (just in time communications) - upgrade announcements, outage alerts, security bulletins.

2. Publicize IT successes.

3. Transparency of costs.

4. Communicate status of IT initiatives over the long term.

The communication plan provides the following table of contents:

Overview to service management communication objectives o Informing impacted users about events such as upgrades, outages, security awareness:
o IT performance success, transparency of costs, IT initiative long term status view Roles and responsibilities for impacted stakeholders
• Schedule of Communications
• Communiciation Content
o Templates
Communication guiding principles & activities
o Project reporting status (including format, review cycle) o Stakeholder/steering committee collaboration
o Communication channels and frequencies
o Communication of issues and risk mitigation
o Approval process
Glossary of terms
Page A-16

CITY OF SANTA CLARA
Schedule 2 – Final Service Tower Solutions—Appendix A
ITIL Service Management Standards
Strategy and execution plan for the deployment and ongoing maintenance of tools, documentation of process necessary to have consistent service management within the enterprise The IT Infrastructure Library (ITIL) is an integrated, process-based, best-practice framework for managing IT services. It provides guidance for creating and operating a service desk that provides efficient communication between the user community and the IT provider. The ServiceNow platform conforms to ITIL v3 processes.

The ServiceNow platform effectively supports ITIL-aligned activities and IT best practices for:
• Incident management
• Problem management
• Knowledge management
• Request fulfillment
• Change management
• Release and deployment
• Service asset and configuration
• Capacity Management
• Financial Management
• Service level management
• Service catalog management.

Unisys deployment/implementation methodology follows the recommended ITIL v3 global processes.

Upon completion of the implementation, a data design document will be provided by the ServiceNow implementation (transition) team. The document will contain the configurations that support the above ITIL processes and CSC's specific business requirements. Any changes to the platform and/or the processes will require the Unisys Change Management process to be followed in order to recognize, control, and communicate the changes, then consequently documented and reviewed.

Key activities associated to the ITIL Processes
Incident management
An unplanned interruption to an IT service or reduction in the quality of an IT service.

Failure of a configuration item that has not yet impacted service is also an incident."

CITY OF SANTA CLARA
Schedule 2 – Final Service Tower Solutions—Appendix A
The process provides detailed procedural guidance on how different types of interactions should be handled. The primary audience for this document includes Service Desk team, ITIL process team, L2 Support, L3 Support and End users.

Problem management
Problem is an underlying cause of one or more Incidents.

The goal of Problem Management Process is to identify and eliminate the Root Cause of the Problem through preventive/corrective actions or reduce the impact of problem on recurrence.

In turn, stabilizing the IT environment.

Knowledge management
Knowledge Management Process provides standardized guidelines for creating and managing solutions in an integrated Knowledge Base (KB). This process includes detailed guidelines in subsequent sections to:

Create or Modify a Knowledge article
Engage the Knowledge Management Team
Review, Approve and Publish a Knowledge Article
Retire Knowledge Article
Retrieve Knowledge Article
Assign articles to Article Owners or Groups
Request fulfillment
Service Request Management is the process responsible for managing the lifecycle of all service requests from the users starting with the registration of the request until the fulfillment and closure of the Service Request.

The goal of Service Request Management is to reduce the complexity and costs associated with how customers interact with IT at the same time also making sure that the customers are able to request for and obtain services within the lowest possible turnaround time.

Customer service & request processes are streamlined through automating end-user management processes. With the effective Service Request Management, you gain business transparency, visibility, and control across all of service support.

Change management
Page A-18

CITY OF SANTA CLARA
Schedule 2 - Final Service Tower Solutions—Appendix A
Change Management is to ensure that standardized methods and procedures are used for efficient and prompt handling of all changes to control IT infrastructure, in order to minimize the number and impact of any related incidents upon service.

Release and deployment
The Release Management Plan is a high-level description of how the unified Global Process for Release Management is designed and implemented internally within Unisys and externally to our customers, when applicable to the scope of contracted services. The plan provides a framework to design and implement the Release Management activities such as Release Planning, Release Building, Acceptance Testing, Rollout Planning, Release Preparation, Release Deployment and Managing Emergency Releases. This document also lists the various roles and responsibilities in Release Management.

Service asset and configuration
Service Asset & Configuration Management (SACM) is the process responsible for providing accurate and complete configuration information about the infrastructure components, including relationships, to support the other ITSM process.

SACM is one of the lifecycle processes in ITIL and is one of the foundations of IT Service Management. This process manages the assets of the organization in order to support the other ITSM processes, provides a logical model of the infrastructure and manages assets and configuration items by identifying, controlling, maintaining and verifying the versions in existence.

Service level management
The process responsible for formal agreements (e.g., Service Level Agreements (SLAs)) and ensuring the supporting agreements (Operation Level Agreements (OLAs)) and contracts (Underpinning Contracts (UCs)) are accurate and up-to-date. This includes the creation of the agreement (planning), obtaining agreement from the business on the content of the SLA, and reviewing service achievements on an on-going basis.

Relationship management between the service provider and the business/customer is based on the SLA. Service Level Management relates availability, capacity, performance, and costs to business demand.

Service catalog management
Service Request Catalog Management is the process responsible for creating and managing a catalog of all available services from which an end user may submit request. The Service Request Catalog integrated with Service Request Management encircles not just a list of Page A-19

CITY OF SANTA CLARA
Schedule 2 - Final Service Tower Solutions—Appendix A
all available services, but also the request forms, underlying approval processes and sequenced fulfillment task components.

The goal of Service Request Catalog Management is to empower the end user to selfsupport, reduce the complexity and costs associated with how customers interact with IT, to Standardize / Simplify the delivery of critical IT processes and workflows, to reduce work volume, fulfillment time and delivery, through automation. In summary, Service Request Catalog Management improves the effectiveness and efficiency of Service Request Management.

Enterprise Project Management Standards
Strategy and execution plan for the deployment of tools, documentation of processes necessary to advance project management methodologies and provide and enterprise view of project and the plan of record The Unisys Services and Solutions Delivery Framework (SDF) is the unique One-Unisys framework that is applied to Unisys projects. It is based on the Project Management Institute (PM!) Program Management Book of Knowledge (PMBOK). The SDF provides an effective structure to verify that consistent, highquality management practices and repeatable processes are applied across Managed Services programs and client projects. Unisys will manage projects with standard processes and practices institutionalized in our SDF methodology.

Unisys will continue to use and update the CSC Project Management methodology residing on the City's CSI SharePoint site and that contains the following high level areas of documents, checklists, templates and other artifacts:
• Requirements Management
• Project Initiation, Charter and Funding
• Project planning
• Schedule management
• Financial management
• Risk management
• Contract management
• Change control
• Third party management
• Measuring, assessing and reporting performance
• Program Management
Unisys will update the above documents to reflect the SAFe Agile methodology being adopted.

Ability to implement an approach to holistically managing the Enterprise IT Portfolio, across the technology life cycle. Furthermore, achieve a clearer focus of the business value of IT assets,

CITY OF SANTA CLARA
Schedule 2 - Final Service Tower Solutions—Appendix A
delivering high-value IT projects that are strategically aligned to meet City business requirements.

This will provide visibility to the stakeholders and allow for decision making on the best use of limited funds available for IT and allow for the setting of priorities by the business community.

Overview of Approach
Reflect the SAFe Agile methodology being adopted, which includes but not limited to:

Understand the current state of project and portfolio management in the City Capture desired vision and outcomes from key executives Develop the portfolio management framework and processes Develop and implement a portfolio management repository Develop and execute a rollout plan to encompass the entire portfolio the CIO is responsible for Train appropriate staff
Standard processes for portfolio, demand and resource management will be adhered to across the account.

Standard reporting formats for project progress and monitoring and Dashboard Reports will be created and delivered on a periodic basis to provide city stakeholders with an easy to read update on the status of the IT Project Portfolio.

Digital Strategy Plan
Strategic Plan to address digital areas relevant to the City of Santa Clara, including: e-Government Portal, Information Dissemination, Constituent Engagement and Communities, Podcasting, Mobility, Social Media, Analytics, Cloud, Digital Transactions, and Open Government/Open Data The plan should include:
'Defining the City's customer and their unmet needs and goals Identifying key opportunities and/or challenges
Defining the City's objectives
Financial Analysis
Developing a vision and prioritizing a set of initiatives Plan Execution and Prioritization of Initiatives
Implementation GoVernance
Please refer to Section 1.0.0 for the Digital Strategy Plan.

CITY OF SANTA CLARA
Schedule 2 — Final Service Tower Solutions—Appendix A
The onsite Applications Program Manager, Business SMEs, Enterprise Architect, and Unisys Digital strategy experts will develop and present the digital strategy plan, which will be updated annually.

Unisys will produce a "Digital Strategy Plan and Roadmap" in the first year (within 12 months) after "go live", that is intended to provide a high level framework and prioritized roadmap of Digital Government related projects and initiatives. Following the initial deliverable, this roadmap document will be revalidated and updated at least once every 12 months to reflect any changes in the City's priorities and technological changes.

Unisys will maintain this roadmap and provide effective communications on progress to ensure that the City makes progress on its citizen and community engagement goals through the prioritized roadmap.

Deliverable outline
An outline of the "Digital Strategy Plan" deliverable that will be produced at the end of a four to six week engagement is outlined below.
# TOC Major Area Content area (sub TOC) Comments
1 City Goals and Vision *City Goals and Visions -
Outside in view of how
City will serve its
customers (Employees,
Vendors, Suppliers,
partners, Stakeholders,
Citizens and
Constituents)
* Digital Government
Vision and Goals for City
* Business services and
constituent requirements
* Information and
Analytics requirements
* Experience - Branding
of the City to ensure
experience is consistent
and compelling.

Describes City's Digital Government
Goals and Visions for the City as a
whole, and specific departments as
perceived by leadership of City and
Department heads

CITY OF SANTA CLARA
Schedule 2 – Final Service Tower Solutions—Appendix A
# TOC Major Area Content area (sub TOG) Comments
2 Current State of Digital
Technology in the City
* Current State of Digital
Government presence,
Information Architecture,
Technology / Processes
in various
Departments/City
* Capabilities Required to
support Future Vision and
Goals
* Enablers / Barriers that
exist today
* Existing IT Projects that
are underway and their
alignment with Digital Gov
Use of Digital Technologies in the
City today to serve all customers -
processes. Gaps that still exist in
order meet the City's stated goals and
visions for Digital Government.

Technology Enablers that will be
required to fill these gaps.
3 Future State
Recommendations
*Un-met Digital
Government needs
* Information Architecture
(IA) - Information and
analytics needs of the
business functions,
communities of interest,
external stakeholders,
business partners, etc.
* Prioritized list of
business requirements
* Projects Defined with
High level cost, benefit
and Financial Analysis
* Prioritized list of Projects
* Projects / Initiatives
recommended
* Implementation
Road map for 2 to 4 year
timeframe
Prioritized list of Projects and
Initiatives supported by Financials
(high level) costs and benefits and an
implementation plan (high level) in a
road map for the City

CITY OF SANTA CLARA
Schedule 2 — Final Service Tower Solutions—Appendix A
# TOC Major Area Content area (sub TOG) Comments
4 Digital Technologies
Supplement
* Description of Projects /
Digital Technology
recommended and how
they will be applied
* Latest Trends in key
Digital Technologies
relevant to City - Open
Data / Open Gov, Cloud,
Mobility, Social Media,
Analytics etc (in the
projects included in the
Roadmap)
Report that identifies innovative
products and services in the areas of
Digital Government, Portals,
Information Dissemination, Digital
Transactions, Analytics, Mobility, loT,
Collaboration, Websites, Digital
Workspace of the Future, Constituent
Engagement, Business Operations,
Social Media, Remote connections
etc. that are especially relevant to
fulfilling the City's Goals and Vision in
closing the gap with current state
5 Ongoing Governance
Recommendations
* Methodology, Templates
and Documents to track
and monitor ongoing
implementation
* Status Report Template
Tasks / Deliverables / Acceptance Criteria
Unisys will use a team of Consultants and Digital Government SMEs, and the onsite team of Applications Program Manager, Enterprise Architect to develop and present the digital strategy plan, which will be updated annually (every 12 months).The Unisys team will work with City stakeholders who will be identified prior to the initial kickoff meeting and will be involved during the interviews, and also both of the workshops that will be conducted during the engagement to produce the final deliverable - Digital Strategy Plan.

Major Task / Deliverable Completion I Acceptance criteria 1 Engagement Plan with Interview
Schedule (Kickoff)
Project Plan Produced and presented to City
Stakeholders and approved by the CIO
2 Interviews with Stakeholders of all
departments
Interviews completed (Questionnaires and
interview notes produced and documented)
3 Preparation for Planning Workshop # 1) Planning Deliverable - PPT Deck and Word Document that outlines City Goals/Mission (for
Digital Transformation), Digital Government

CITY OF SANTA CLARA
Schedule 2 – Final Service Tower Solutions—Appendix A
Major Task / Deliverable Completion / Acceptance criteria Capabilities, Enablers and Barriers completed
4 Prioritization/Planning Workshop
Completed (#1)
Planning Deliverable (updated)- PPT Deck
and Word Document that outlines City
Goals/Mission (for Digital Transformation),
Digital Government Capabilities, Enablers and
Barriers completed, with capabilities prioritized
after the Workshop, reviewed with City, and
approved by the CIO.
5 RoadMap Workshop Completed (#2) RoadMap Deliverable – PPT deck and Word document that describes Initiatives/Projects and
their priorities, with High Level Financial
Analysis (costs / benefits), priorities, High level
implementation plan and Roadmap. Completed
and approved by the CIO.
6 Final Presentation and Deliverable
Completed
Final Presentation to City Stakeholders (PPT
Deck) and Final Deliverable – Digital Strategy
Plan Document (Word doc) completed,
presented and approved by the CIO.

Periodic Updates and Ongoing Governance
Periodic Status reports will be produced regarding the progress of various activities and milestones outlined in the Digital Strategy Plan. This will be tracked by the Unisys PM0, Applications Program Manager, Enterprise Architect as well as Digital Government SMEs and the City stakeholders.

On an annual basis (every 12 months), an abbreviated version of the planning process consisting of one facilitated workshop will be conducted to update and maintain the Digital Strategy Plan document.

Innovative Products and Services Report and Meeting
Written report which identifies innovative products and services of potential use to the enterprise and departments to support business objectives and challenges based on trends in local government customer engagement and business operations service delivery and trends in the general IT marketplace The Applications Program Manager, Business SMEs, Enterprise Architect, assisted by Unisys Consultants and Local Government SMEs will develop and present semi-annually the Innovative Page A-25

CITY OF SANTA CLARA
Schedule 2 – Final Service Tower Solutions—Appendix A
Products and Services Report (IPSR). The reports will be based on published, general IT marketplace trend data and local government trends in service delivery improvement, such as Smart City initiatives from various municipalities. The IPSR will include products that reflect new ideas or approaches to service delivery or to the introduction of new services which align with the City's Mission and Vision.

Based on feedback from the presentation of the 1PSR, Unisys will update supporting plans as part of the annual update process (such as the IT Strategic Plans, Digital Strategy Plan and the Enterprise Architecture Plan) to reflect the change in Future Vision, which in turn will be updated in terms of new gaps/projects to develop the new capabilities annually. (Please refer to 2.1.1.0.) The initial version of the Report will be produced during the development of the Digital Strategy Plan.

Subsequently, it will be updated every six months. This will be contained as a sub-component of the Digital Strategy Plan so that the report is closely tied to the Future State recommendations, and the roadmap developed for Digital Government Transformation.

Content Outline for the Innovative Products and Services Report (Sub Chapter of the Digital Strategy Plan document)
# TOC Major Area Content area (sub TOC) Comments
4 Digital Technologies
Supplement
* Description of Projects /
Digital Technology
recommended and how
they will be applied
* Latest Trends in key
Digital Technologies
relevant to City - Open
Data / Open Gov, Cloud,
Mobility, Social Media,
Analytics etc (in the
projects included in the
Roadmap)
Report that identifies innovative
products and services in the areas of
Smart Cities, Digital Government,
Analytics, Mobility, loT, Collaboration,
Digital Workspace of the Future,
Customer Engagement, Business
Operations, Social Media etc. that are
especially relevant to fulfilling the
City's Goals and Vision in closing the
gap with current state
Tasks / Deliverables / Acceptance Criteria
The initial version will be delivered as a part of the Digital Strategy Plan (refer to this section). Subsequent to the initial version. It will be updated every six months. However, the Digital Strategy Plan document itself will only be updated every 12 months.

CITY OF SANTA CLARA
Schedule 2 – Final Service Tower Solutions—Appendix A
Operational Efficiencies Improvement Report and Meeting Written report which provides the enterprise and departments recommendations for operational improvements that increase efficiency and effectiveness through the better use of existing applications and technology or improved processes
Unisys is committed to delivering quality solutions and services to the City by collaboratively working with them in a structured, formal and transparent manner, with innovation and continual improvement recognized as key to ultimately delivering higher satisfaction.

CSIIP is a program undertaken in collaboration where CSC and Unisys identify and introduce measurable improvements and innovation opportunities. There are increasing demands for organizations to deliver "better, faster and cheaper" services to the public and business partners. This in turn, requires that Information Technology (IT) deliver innovative and cost-effective solutions when supporting their business communities. Unisys partners with the City to deliver continuous operational efficiencies and improvement for our services and innovation for value realization and boost business performance.

The objective of CSIIP is;
• Deliver a formal plan collaboratively with the City to implement improvements and bring in innovation to services and IT processes;
• Utilizes a formal methodology and tool set to enable the tracking and management of the outstanding transition and refresh issues;
• To facilitate the highest satisfaction by providing one single place to collaboratively manage and log improvement initiatives triggered by Continual Service Improvement & Innovation Initiatives.

All the different list items and tracking sheet info from the disparate activities are consolidated to a single repository, transparent and visible to both parties, and jointly managed The CSIIP program will be formally launched via a collaborative workshop with the City. This validates the strategy and objectives, and identifies/classifies/prioritizes the initiatives and contributive actions required, short-term and long-term, along with respective owners. All of the improvement initiatives, innovation plans/roadmaps and related action items are centrally located and managed through the on-going governance structures.

The goal of the workshops is to:
• Identify innovation ideas;
• Categorize the identified idea in terms of functional areas / ownership of project execution; • Further classify the ideas so that we understand their technical maturity, level of impact they can bring to the program, and ease of implementation;
• Complete high-level opportunity profiles for each innovation opportunity (including more quantitative assessment of ROI and overall benefits) and suitable timing in terms of implementation;
• Determine how these innovations (including project ideas) can be more effectively built into a future state architecture and roadmap for the program.

The governance of the CSIIP component falls within the overall Account Governance structure.

Innovation ideas will be analyzed for progress against planned results.

Page A-27

CITY OF SANTA CLARA
Schedule 2 — Final Service Tower Solutions—Appendix A
Unisys will update the Operational Efficiencies report, which provides the enterprise and department recommendations for operational improvements that increase efficiency and effectiveness through the better use of existing applications and technology. This report will be reviewed quarterly as part of the operational governance meeting. The onsite delivery team, the Unisys SEO office, the service desk, and other Unisys offsite supporting teams will be responsible for creating and updating this report.

End User and Key Department Personnel Scheduled
Customer Satisfaction Survey Report and Meeting
Written report that presents the results of the annual End User and key department personnel scheduled customer satisfaction surveys and recommendations on how to improve areas of customer dissatisfaction.

Unisys will draw from experience and best practices to ensure the survey is planned and executed toward a successful outcome. Unisys and the City will work on a mutually agreeable list of questions for the survey. The survey will be sent to the departments using the ServiceNow framework, which will also collate the results. After a detailed analysis, a report will be provided. The report will include results, provide recommendations, and establish metrics for improvement. Follow-on meetings, as described in the governance processes, will review the metrics, note areas for improvement and action.

Services Strategic Review Report and Meeting
Written report that assesses how Service Provider is performing against enterprise and department strategic objectives of the Agreement and provides relevant service improvement recommendations and action plan The Enterprise Architect will develop and present annually the Services Strategic Review Report (SSRR) based on the strategic objectives identified in the Enterprise Architecture Plan and the IT Strategic Plan and associated plans, such as the digital strategy. The SSRR will be organized around identified gaps between the Future Vision and the Current State of City capabilities which based on the City's departmental goals. These goals form the foundation for technology projects intended to improve the delivery of services to the City's constituents in the fulfillment of the City's Mission and Vision. The SSRR will identify any gaps in expected deliveries and provide recommendations for remediation including steps to be taken to improve delivery and recommendations for process change or other performance improvements. Any approved change in approach or content of deliverables will also be reflected back into the supporting plans as needed as part of the annual update of those plans. (Please refer to 2.1.1.0.) Annual Execution Plan
Written plan that outlines the major activities, projects and associated schedules that the Service Provider will perform in the coming year to deliver the Services meeting existing Service Levels and to meet enterprise and department business plans and objectives outlined in the IT Strategic Plan (see Schedule 17).

After the IT Strategic plan and associated plans, such as the digital strategy have been developed, it must be translated into a comprehensive execution plan. The Annual Execution Plan (AEP) will clearly outline the objectives of the Strategic Plans execution, the activities that are needed to achieve these objectives,

CITY OF SANTA CLARA
Schedule 2 - Final Service Tower Solutions—Appendix A
who is responsible for these activities, and when the objectives are to be achieved. The AEP will outline the manner in which the strategic vision is to be achieved. The implementation plan translates the strategy into day-to-day management.

The Applications Program Manager and Infrastructure Program Manager will develop the AEP plan to execute the strategy.

First the strategy will be translated into objectives, which will then be used to create the tasks, activities, and responsibilities that are required to achieve the objectives of the strategy. This forms the AEP, or prescriptive work plans, which will be kept short and action-oriented. The AEP will be translated into roadmaps, project plans, and work plans for the Service Towers, so that progress against the AEP and IT strategic plan can be measured.

The plan will be reviewed monthly as part of the Service Tower Review Meetings and adjustments made as appropriate using the change management process.

Technology Refresh Plan
Written plan that to be developed., maintained, updated, and followed by the Service Provider in periodically replacing or refreshing the technology used to perform the Services or provide the deliverables, or otherwise used by the Service Provider and its subcontractors in connection with the systems. The Plan will be aligned to the City's budgeting process.

The Technology Refresh Plan (TRP) is derived from the IT Strategy, Application changes, and Infrastructure capacity. Each of the main towers hardware and software roadmaps; Applications and Data Repositories, Infrastructure, and End Point are updated throughout the year. The Enterprise Architect will work with each tower lead in providing an updated Technology Refresh Plan detailing the technology impacting the City's budgeting process. As such, any new or augmented technology component needed to fulfill the delivery of services or project deliverables will be detailed in the TRP. This will include both the introduction of new capabilities and the upgrade or refresh of existing capabilities with new technology. The Technology Refresh Plan will align with the City's budgeting process by reflecting the budget categories for capital expense. The TRP will also reflect the roadmaps of the Tower plans, Enterprise Architecture Plan, Digital Government Plan, and the IT Strategic Plan in order to provide concrete budgetary estimates of expected costs.

The TRP provides the following table of contents:
• Overview of the TRP objectives
o Reference to roadmaps and plans that justify the technology proposed that meets the business objectives
Trade-off analysis of why technology was chosen, or reference therein; congruence with the Enterprise Architecture
Budget costs and rationalization
Page A-29

CITY OF SANTA CLARA
Schedule 2 – Final Service Tower Solutions—Appendix A
Schedule of milestones to meet City's timelines
Approval process as applicable
Page A-30
SCHEDULE 3A

CROSS - FUNCTIONAL SERVICES SOW

TO MASTER SERVICE AGREEMENT

BY AND BETWEEN

CITY OF SANTA CLARA
AND

SERVICE PROVIDER
Schedule 3A — Cross - Functional Services SOW
Table of Contents

1. OVERVIEW 3

2. SERVICE DESCRIPTION AND MAJOR FUNCTIONS 3

3. SUPPORTED SYSTEMS AND QUANTITIES 5

4. RESPONSIBILITY MATRIX 5

5. SUPPORT REQUIREMENTS 5

6. SERVICE LEVELS 5

7. REPORTS 5
S. CRITICAL DELIVERABLES 6

9. CHANGES TO MSA 9
List of Exhibits

1. EXHIBIT 1— DEFINITIONS 8

2. EXHIBIT 2— RESPONSIBILITY MATRIX 9

3. EXHIBIT 3— SUPPORTED ENVIRONMENTS AND TOOLS 40

Page 2 of 45 ends

Schedule 3A - Cross - Functional Services SOW

1. Overview
This Statement of Work ("SOW") has been entered into pursuant to the Master Services Agreement (the "MSA") between Customer and Service Provider.

2. Service Description and Major Functions
Service Provider will perform the common services and activities that apply to the provision, delivery, and management of all IT services across all Service Towers (collectively, the "Cross Functional Services").

In addition, Service Provider will be responsible for the development, implementation, ongoing maintenance and management of, and upgrades to, the common set of IT life cycle and ITSM processes and tools that will be utilized across all Customer IT service delivery organizations including third party providers (the "ITSM Suite"), and integration of the ITSM Suite with Customer systems, tools and interfaces. Fees for the Cross Functional Services will be included within the Fees for each Service Tower as specified in Schedule 5 to the Agreement. Service Provider will ensure that (A) applicable Service Towers are integrated and consistent with the Cross Functional Services, and (B) the Services are delivered utilizing the cross-Service Tower processes and tool sets (e.g., tools in the ITSM Suite); provided.

Service Provider's provision of the Services shall comply with all applicable standards, policies, and state and federal regulations and laws (e.g., ISO 27001, ISO 17799, PII, PCI, HIPAA, CJIS). Service Provider's provision of the Services shall be consistent with all applicable standards (e.g., ITIL/ITSM, COBIT, CMMI Level 3, ISO 20000, ISO 27301, ISO 21500, ISO 19770).

IT Organization Guiding Principles
The following are guiding principles of the Customer that the Customer expects Service Provider to achieve across the IT services environment. These guiding principles will be a key performance measurement as part of a balanced scorecard contract governance approach. These guiding principles will be a key basis for the eighteen-month review detailed in Section 2.1.3. • Roles and responsibilities are well-defined and understood. • The right skills and teams in place to meet service requirements. • Work is performed effectively in cross-functional groups, not in silos. • Sound relationships and teamwork exists between teams. • A strong customer focus will be found among team members. • Strong and trusted relationships exist with customer groups. • Service levels are in place with the business that transcends functional groups. • The business understands the value delivered by the Service Provider. • A consistent and effective project methodology is in use. • A clear set of IT principles underlie decision making. • Clarity in who performs decision making.
• Work priorities are consistent across all IT teams.
• Resources are well-managed.
• The organizational structure is the most appropriate to deliver the services.

Across all Services provided, Service Provider understands that the objective of the relationship is not just for Service Provider to operate the environment, but for Service Provider to take a leading role in driving alignment between IT strategy and Customer IT business objectives with the overall objective of making Customer IT the IT provider of choice for all Customer departments. Each Service Tower will both perform the core responsibilities associated Service operations and driving operational efficiencies as well as contribute to the strategic development of services within Customer's business. At the same time, Service Provider personnel will work seamlessly across Service Towers in such a manner that the Customer! End-User will experience the Services from a seamless perspective (i.e., not siloed by Service Tower). The IT Governance responsibilities section and the associated resources detailed in this SOW provide the core of IT service management but all resources and Services are responsible for contributing

Page 3 of 45 ends

Schedule 3A - Cross - Functional Services SOW
recommendations, expertise and project efforts to continue to transform the services provided to the Customer departments.

Without limiting Service Provider's obligations under the Agreement, including this Schedule 3A and the other Schedules referenced in the Agreement, Service Provider's solution and technical approaches for this Service Area shall conform with the Service Provider's solution and technical approaches as provided in the following documents, as such documents may be amended during the term of this Agreement by the Parties in writing, and which are hereby incorporated into this Schedule 3A by reference. Nothing in the following documents shall limit Service Provider's obligations under the Agreement. If the provisions of this Schedule 3A or any other Schedule (including Appendixes) conflict with one or more of the following documents, the provisions of this Schedule 3A or such other Schedule (including Appendixes) shall control.
• Final Service Area Solutions.docx

2.1.1 Satisfaction Surveys
In addition to the ongoing Service Desk customer satisfaction surveys referenced in Schedule 3B, Service Provider will work with Customer's CIO or their designee to prepare scheduled satisfaction surveys of (1) Customer end users, and (2) Customer department key personnel. These surveys will be distributed to (1) Customer end users, and (2) department directors, managers and key subject matter experts (including the Customer's IT Department ("1TD")) on an annual basis and will be used to measure the overall satisfaction with the operational and strategic services being provided by the Service Provider.

Key components of the customer satisfaction surveys shall include measurement of customer satisfaction with Service Provider performance related to
• Integration of Services across Service Towers (seamless services to the End-Users) • Focus on innovation
• Focus on operational improvements
• Business analysis services effectiveness for Customer departments • Service Provider training in and knowledge of the City's environment (including departments' specific businesses)
• First Call Resolution
• Service Desk's end to end ownership of tickets (regardless of ultimate Incident resolver group or entity that fulfills a Service Request)
• Knowledge of End-User's Service Desk call history and persona • Knowledge of an End-User's ticket history before engaging an End-User for break-fix or Service Request activities
• Knowledge of the Services and Services available to the End-Users (e.g., service catalog) • Transparency and proactive communication in ticket handling Service Requests and Incident Resolution
• Knowledgebase currency and relevancy to End-Users
• Level of End-User disruption and time required for patching and testing • Self-service services
• Online portal for access to Procedures Manual, Service Provider contracted Service Levels, all third party provider documentation (including Service Levels), Customer-provided third party documentation, Service Provider Services reporting, knowledge base, frequently asked questions, self-service services, and an end-user interface for Incident ticket entry and status tracking
Service Provider shall meet with Customer annually and provide a report on its annual End-User and department survey findings to the Customer, including the identification of any areas of Customer

Page 4 of 45 ends

Schedule 3A - Cross - Functional Services SOW
dissatisfaction. Service Provider shall develop, for the Customer's review and approval, service improvement plans as required to address areas of Customer dissatisfaction. This report and meeting is a Critical Deliverable, as set forth in Section 8 below.

Satisfaction Surveys shall meet the associated Service Levels set forth in Schedule 4.

2.1.2 Continuous Service Improvement Process
Service Provider will provide Continuous Service Improvement Processes (Continuous Service Improvement Process at a customer/account-specific level across all Service Towers. Service Provider will foster a culture of continuous improvement where individuals are encouraged to bring ideas based on observations within projects and day to day operations sharing best practices and lessons learned.

As part of its Continuous Service Improvement Process obligations, Service Provider shall be responsible for providing reports to and meeting with the Customer regarding proposed operational improvement recommendations, as well as innovative products and services. These two Critical Deliverables are defined in more detail in Section 8 below.

Additionally, every eighteen (18) months Service Provider will engage a team of Service Provider subject matter experts and management staff to perform a strategic review of the Services and develop a corresponding report to the Customer (the "Services Strategic Review Report"); this written report and related review meeting with Customer will focus on assessing whether Service Provider is meeting the strategic objectives of the relationship and guiding principles of the Customer's ITD as documented earlier in this Section. Service Provider will report on the finding of the review and create action plans for recommendations coming from the review. This activity is also a Critical Deliverable, as identified in Section 8 below.

3. Supported Systems and Quantities
Not applicable to this SOW.

4. Responsibility Matrix
Exhibit 2 sets forth the Responsibility Matrix for services relevant to this SOW.

The responsibilities defined in the cross functional services matrix apply to all services delivered within the account.

5. Support Requirements
Support requirements are specified in Section 5 of Schedules 3B - 3E.

6. Service Levels
Service Levels that apply to this SOW are provided in Schedule 4 - Service Levels.

7. Reports
Service Provider shall provide reports relating to the Cross-Functional Services, as set forth in Schedule 7 - Reports. Service Provider will recommend new reports as capabilities and requirements evolve.

Page 5 of 45 ends

Deliverable
Procedures Manual
Timeline
Customer approved version before the
end of transition
Updated regularly through change
management
12 Months from service commencement
Updated annually
Before end of Transition, then every 12
months thereafter
Updated as required through change
management
Schedule 3A - Cross - Functional Services SOW

8. Critical Deliverables
Customer has identified a number of Services deliverables that it considers to be of particular importance ("Critical Deliverables"). These Critical Deliverables span Service Towers and are foundational to quality IT service delivery and the Customer's goals and objectives the Agreement. Service Provider shall provide these Critical Deliverables to Customer in accordance with the descriptions and timelines set forth in the table below. In some cases, Critical Milestones may be associated with Service Provider's failure to timely provide such Critical Deliverables to Customer (see Schedule 4 for applicable Critical Milestones and Corrective Assessments). Critical Deliverables are not meant to represent all deliverables Customer expects from the Service Provider.

As of the Effective Date of the Agreement, the Critical Deliverables associated with Cross - Functional Services are provided in the table below.

IT Strategic Plan
Information/Cyber
Security Plan
Description
Guide that details the standard operating
procedures for all services. This has
items such as process based procedures
such as Incident management as well as
functional base tasks such as PC
installs.

Plan that analyzes the City enterprise IT
organization's current state, future state
and develops a 2-4 year road map to help
it achieve identified goals and objectives.

Elements include:
• Current State: review and
assessment of business
strategy, vision and goals,
capabilities and priorities,
financials, IT environment,
service gaps
• Future State: IT vision, IT
capabilities, enterprise
architecture, key processes,
governance model, performance
management
• Roadmap: budgeting,
identification and prioritization of
IT initiatives for the 2-4 year
horizon, and strategic plan
road map development
A current information security plan and
robust set of policies exist as an input.

Service Provider will analyze current
security posture and provide
recommendations to address any areas
where deficiencies or threats have been
identified for both on prem and cloud
assets. Result will be an updated written
plan and procedures that provide the
operational and technical responsibilities
associated with the Security table in this
SOW (e.g., data security, physical

Page 6 of 45 ends

Schedule 3A - Cross - Functional Services SOW
Deliverable Description Timeline
security, security operations, patching,
malware prevention, monitoring and
Incident management, threat and
vulnerability management).

The Plan must be consistent with the
NIST Cybersecurity Framework.

Business Continuity
Plan
The Business Continuity Plan project
includes working with key stakeholders
to re-validate the City's critical business
applications and infrastructure assets
based on the already defined
prioritization framework and
updating/enhancing the existing
Business Continuity Plan that
encompasses all current mission-critical
City Applications and the associated IT
assets.
6 months from go-live
Updated regularly through change
management
Disaster Recovery Plan This plan is to update and enhance the detailed requirements and design
solutions for the recovery of critical IT
assets in the event of a major disaster or
service disruption.
6 months from service commencement
Updated regularly through change
management
Enterprise Architecture
Plan
Develop an analysis, blueprint and
implementation plan for the City's data,
applications, and technology.
12 months from go live and every 12
months thereafter
Updated as required through change
management
Communications Plan Written plan that provides direction on how the Service Provider will engage
with ITD and other City departments on
an ongoing basis, including at both the
strategic and operational level.
6 months from service commencement
and every 12 months thereafter
•Updated as required through change
management
ITIL Service
Management Standards
Strategy and execution plan for the
deployment and ongoing maintenance of
tools, documentation of process
necessary to have consistent service
management within the enterprise
6 months from go-live
Updated regularly through change
management
Enterprise Project
Management Standards
Strategy and execution !Dian for the
deployment of tools, documentation of
processes necessary to advance project
management methodologies and provide
and enterprise view of project and the
plan of record
6 Month from go-live
Updated regularly through change
management
Digital Strategy Plan Strategic Plan to address digital areas relevant to municipalities, including:
mobility, social media, analytics, cloud,
digital transactions, and open
government/open data
The plan should include:
12 months from go live and every 12
months thereafter
Updated as required through change
management

Page 7 of 45 ends

Schedule 3A - Cross - Functional Services SOW
Deliverable Description Timeline
• Defining the City's customer and
their unmet needs and goals
• Identifying key opportunities
and/or challenges
• Defining the City's objectives
• Financial analysis
• Developing a vision and
prioritizing a set of initiatives
• Plan, execution and prioritization
of Initiatives
• Implementation governance
Innovative Products
and Services Report
and Meeting
Written report which identifies innovative
products and services of potential use to
the enterprise and departments to
support business objectives and
challenges based on trends in local
government customer engagement and
business operations service delivery and
trends in the general IT marketplace
Every 6 months during the term of the
Agreement
Operational Efficiencies
Improvement Report
and Meeting
Written report which provides the
enterprise and departments
recommendations for operational
improvements that increase efficiency
and effectiveness through the better use
of existing applications and technology
or improved processes
Every 6 months during the term of the
Agreement
Presented at quarterly Operational
Governance meeting
End-User and Key
Department Personnel
Scheduled Customer
Satisfaction Survey
Report and Meeting
Written report that presents the results of
the annual End-User and key
department personnel scheduled
customer satisfaction surveys and
recommendations on how to improve
areas of customer dissatisfaction.

Every 12 months during the term of the
Agreement
Services Strategic
Review Report and
Meeting
Written report that assesses how Service
Provider is performing against enterprise
and department strategic objectives of
the Agreement and provides relevant
service improvement recommendations
and action plan
Every 12 months during the term of the
Agreement
Annual Execution Plan Written plan that outlines the major activities, projects and associated
schedules that the Service Provider will
perform in the coming year to deliver the
Services meeting existing Service Levels
and to meet enterprise and department
business plans and objectives outlined in
the IT Strategic Plan (see Schedule 17).

Every 12 months during the term of the
Agreement
Updated regularly through change
management
Technology Refresh
Plan
Written plan that to be developed.,
maintained, updated, and followed by the
Service Provider in periodically replacing
or refreshing the technology used to
perform the Services or provide the
deliverables, or otherwise used by the
Due each January during the term of the
Agreement (to align with the City's
annual budget process).

Page 8 of 45 ends

Schedule 3A - Cross - Functional Services SOW
Deliverable Description Timeline
Service Provider and its subcontractors
in connection with the systems. The Plan
will be aligned to the City's budgeting
process.
a Changes to MSA
This SOW does not change any terms in the MSA and its Schedules.

Page 9 of 45 ends

Schedule 3A — Cross - Functional Services SOW
EXHIBIT 1 — DEFINITIONS
See Schedule 1 — Definitions for a list of defined terms and associated definitions.

Page 10 of 45 ends

Schedule 3A Cross - Functional Services SOW
EXHIBIT 2— RESPONSIBILITY MATRIX
The Responsibility Matrix below shows which party is responsible for the listed task. It is not the intent of the Responsibility Matrix to absolutely identify or define every process, activity or task to be performed by Service Provider as a managed services function.

The responsibility matrices for Cross — Functional Services is set forth below.

GENERAL RESPONSIBILITIES
IT Governance
No. Function/Responsibility Service
Provider Customer
Management and Communication

1. Manage and Administer the portfolio of service the
Customer delivers to its customers through a customer
facing service catalog
X
2 .

Interface with users of Customer IT services to
understand where opportunities for improvement exist
and make recommendations for portfolio
improvements
Interface with other Service Provider customers as
well as IT industry and municipal government user
groups to understand technical and strategic direction; recommend changes to the service portfolio based on
industry best practices and evolution
X

3. X

4. Develop and execute communication plans (e.g. IT
best practices, marketing plans for new services,
project success stories, presentation materials for
stakeholder meetings)
X

5. Approve communication plans X

6. Participate in IT Users group meeting, contribute
agenda items and lead select agenda items X

7. Participate in IT executive meetings with Customer
stakeholders, including Customer departments as
required
X

8. Participate in other meetings as necessary to support overall objectives X
Standards Management

9. Establish and maintain Procedures Manual (e.g., all
operations manuals, support plans, user guides,
procedures for interacting with the service provider)
X

10. Approve Procedures Manual X

11. Proactively amend the Procedures Manual as required to reflect current procedures and other designated
Procedures Manual content
X

12. Provide Customer with online portal access to
Procedures Manual X
Project Management

13. Establish a governance structure for portfolio and
project management X

14. Define project priorities for IT enterprise projects X

Page 11 of 45 ends

Schedule 3A - Cross - Functional Services SOW
No. Function/Responsibility Service
Provider Customer

15. Establish a comprehensive capacity and demand
management planning process to include current
capacity vs. utilization and capacity requirements
__projection for a rolling one year period
Provide business demand projections to support
Service Provider capacity planning
X

16. X

17. Review and approve capacity management planning
process
X

18. Define, provide and implement tools that allow for the effective capacity monitoring/trending and reporting of IT infrastructure, applications and IT components
X

19. Identify future business requirements that will alter capacity requirements (e.g. strategic plan)
X

20. Participate in all capacity planning activities X

21. Assess capacity impacts to a[l technology when
adding, removing or modifying Services, applications
and infrastructure
X

22. Continually monitor IT resource usage to enable
proactive identification of capacity and performance
issues
X

23. Capture capacity trending information and forecast
future Customer capacity requirements based on
Customer defined thresholds
X

24. Assess Incidents/Problems related to throughput
performance
X

25. Recommend changes to capacity to improve service
performance
X

26. Develop and present to Customer quarterly Capacity
Management plan
X

27. Review and approve quarterly capacity management
plan
X

28. Develop and present quarterly capacity management
executive summary
X

29. Assess impact/risk and cost of capacity changes X

30. Approve capacity related recommendations X

31. Maintain capacity levels to optimize use of existing IT resources and minimize Customer costs to deliver
Services at agreed to Service Levels
Ensure adequate capacity exists within the IT
environment to meet Service Levels taking into
account daily, weekly, hardware and software lifecycle
and cyclical business variations in capacity demands
Develop and implement a best practices project
management methodology framework
X
X
X

32. 33.

34. Perform project/sub-project cost estimation for a
specific Service Provider scope of work using agreed
standard and consistent project estimation tools and
techniques that can size projects and can categorize
them by level of effort (e.g., minimal, medium, difficult).

Coordinate with Customer, third party providers and
other third parties as required
X

35. Develop and document a detailed project plan and X

Page 12 of 45 ends

Schedule 3A - Cross - Functional Services SOW
No. Function/Responsibility Service
Provider Customer
update such project plan on periodic basis as defined
by Customer (e.g., monthly, bi-monthly, weekly). The
initial project plan and updates thereto will be subject to Customer's review and approval

36. Manage projects using industry standard best
practices for projects such as infrastructure
deployment projects, application implementation
projects, and RFP development and vendor selection
projects
Provide project management as defined in the project
requirements and plan, including Customer, third party
providers and other third parties as required
X
X

37. 38. Periodically provide (at the frequency specified by Customer), and review with Customer, Service
Provider project metrics reporting on Service
Provider's achievement of milestones and acceptance
of deliverables and other measurements associated
, with each project phase, sub-project, and activity
X

39. Conduct periodic (e.g., weekly) project status meetings with appropriate Customer stakeholders in accordance
with the project communications plan with Customer
project manager and other key Customer participants
as Customer may require
X

40. Participate in periodic project status report meetings X

41. Provide written project status reports on a mutually agreed frequency to the Customer project manager,
including status updates of applicable items in the
project plan (e.g. project schedule, budget), in a format agreed to by Customer and documented in the
Procedures Manual
X

42. Execute projects in accordance with Customer
guidelines and standards and consistent with industry
best practices (e.g., PMI best practices), including
executing standard project life cycle activities (e.g., project initiation, planning, execution, control and
closure, and acceptance)
X

43. Review and approve all changes of scope, key
milestones, key assumptions, and project budgets X

44. Manage and maintain a central repository and project management applications/tool-set X

45. Maintain a central PM0 web site X

46. Maintain an executive dashboard for planned and in
flight projects X

47. Maintain the portfolio and projects repository X

48. Monitor project portfolios and programs, focusing on the horizontal impact of Customer projects X

49. Manage Service Provider resources utilization both for operations and project usage X

50. Coordinate implementation projects with impacted
departments, functional areas and/or vendors and
other City stakeholders
X

51. Work with departments to facilitate alignment of project work being led by other entities X

Page 13 of 45 ends

Schedule 3A - Cross - Functional Services SOW
No. Function/Responsibility Service
Provider Customer

52. Prioritize and approve plan of record projects X

53. Manage and execute the project status review data
gathering process, annual assessment of all IT related
projects in the Customers environment
X

54. Assist Customer with reviewing and prioritizing capital IT budget requests X

55. Provide support for planned special events during
customer normal business hours and after hours (on
an exception basis)
X
Other

56. Conduct administrative and operations clean up
activities on an ongoing basis (e.g., closing inactive
accounts, non-active VPN users)
X

57. Develop written materials for award applications and presentations for City-attended conferences, as
requested by the City
X
Tools and Knowledgebase
No. Function/Responsibility Service
Provider Customer
Tools

1. Provide, manage, maintain, operate and utilize the
integrated ITSM Suite and integrated web portal in
accordance with industry best practices. The modules
will include:
• Service Desk
• Incident management/problem management
• Event management
• Configuration management
• Change management and release
management
• Asset management and CMDB
• Service Request management
• Knowledge management
• Software license management
• Project management
X

2. Develop, document, manage, maintain and utilize
cross-Service Tower ITSM processes based on the
ITSM Suite standard processes
X
,
3 .

Provide, manage, maintain, operate and utilize the
single secure ITSM web portal for Customer access to
all documentation described in the Agreement (e.g.,
Procedures Manual, Service Provider contracted
Service Levels, all third party provider documentation
(including Service Levels), Customer-provided third
party documentation, Service Provider Services
reporting)
X

4. Provide, manage, and maintain third party provider
access to the ITSM Suite, integrated components and
the ITSM web portal for use in the delivery of IT
services in their respective service areas
X
Oversee and enforce use of the integrated ITSM Suite,
integrated components and processes and ITSM web X

Page 14 of 45 ends

Schedule 3A Cross - Functional Services SOW
No. Function/Responsibility Service
Provider Customer
portal across Service Towers and third party provider - managed IT service areas
6 .

Provide Customer and third party provider inquiry and
reporting access into the ITSM Suite via a real-time
access reporting portal in exportable and analyzable
format and provide ad hoc and recurring (e.g.,
monthly) reporting as scheduled or requested by
Customer
X

7. Design, implement and maintain the ITSM Suite to
allow cross-IT operational tool integration and
reporting
X
8 . Integrate the ITSM Suite with Service Desk tools and processes
X

9. Develop ITSM Suite reports and dashboards (e.g.,
performance and balanced scorecard dashboards) to
support the execution of responsibilities of key Service Provider and Customer roles and governance bodies
and meetings, as defined in Schedule 17 to the
Agreement
X

10. Provide and maintain a self service web portal for all authorized Customer end users—English-based EndUser portal that provides and maintains knowledge base, frequently asked questions, and an end-user
interface for Incident ticket entry and status tracking X

11. Provide licenses required for Customer End-User and support staff to access the Suppler provided toolset X

12. Develop a detailed customer facing IT service catalog which details Services offered including all Service
options, pricing, installation timeframes, order process (e.g., new, change & remove service) and
prerequisites
X
Knowledge Management and Knowledgebase

13. Develop and execute an enterprise-wide knowledge
management plan across all Service Towers and third
party services, with roles and responsibilities for
Service Provider, Customer and third party providers
X

14. Participate in development of knowledge management
plan X

15. Approve knowledge management plan X

16. Develop procedures for knowledge management,
based on Client-approved knowledge management
plan
X

17. Approve knowledge management procedures X

18. Create, maintain and update knowledgebase entries
on an ongoing basis, as such knowledge is developed
(e.g., through Incident Resolution activities, Root
Cause Analyses, event management activities,
Service Requests, new or modified operational
procedures, any new release of information pertaining
to changes and upgrades)
X

19. Update knowledgebase as relevant, for knowledge
that is generated by Customer X

20. Provide the support agreements with third party X

Page 15 of 45 ends

Schedule 3A - Cross - Functional Services SOW
No. Function/Responsibility Service
Provider Customer
vendors for access to knowledge bases and Level 3
support

21. Coordinate knowledgebase updates from third party
providers as relevant, for knowledge that is generated
by third party providers
X

22. Provide Customer's authorized end users with single web portal access for all knowledgebases X

23. Maintain accuracy and currency of the
knowledgebases in order to meet associated Service
Levels
X

24. Audit knowledgebases to ensure that Service Provider and Customer are following established knowledge
management procedures
X

25. Periodically review knowledgebases and provide
reporting on accuracy of same X

26. Create, maintain and regularly update frequently
asked question content for in-scope services available
on the self service portal
X

27. Make content creation recommendations to the City
and third-party service providers for out-of-scope
services
X

28. Provide templates and best practices to the City and/or third-party Service Providers related to the creation of out-of-scope content
X

29. Manage and maintain third party provider
documentation in Service Provider managed
knowledgebase
X

CROSS FUNCTIONAL SECURITY RESPONSIBILITIES
Security Services
High-level Security Functions
No. Function/Responsibility Service Customer ustomer

1. Forensics/Pentest X

2. Policy Development X

3. Policy Compliance X

4. Security Risk Assessment X

5. Physical Security at Service Provider Service
Locations

6. Recommend environmental controls at
Customer Service Locations X

7. Provide environmental controls at Customer
Service Locations X

8. Provide environmental controls at Service
Provider Service Locations X

9. Identity and access management (policy,
process, procedures) X

10. Access administration & execution X

Page 16 of 45 ends

Schedule 3A - Cross - Functional Services SOW
High-level Security Functions
No. Function/Responsibility Service
Provider Customer

11. Event monitoring X

12. Alert management X

13. Event logging and reporting X

14. Security Incident management X

15. Security event correlation (SIEM) X

16. Lead security Incident response team (AVERT) X

17. Participate with security Incident response team
(AVERT) X

18. Patch management (security and non-security) X

19. Malware prevention X

20. Vulnerability scans X

21. Securit audits X
Detailed Security Services
General Security Services

22. Provide Customer policies and requirements
relating to security
X

23. Participate in Customer information security
awareness programs
X

24. Provide a Service Provider information security
officer that works with Customer or Third Parties
for security requirements and activities
X
25 Remain up to date with current IT security
trends, threats, common exploits and security
best practices
X

26. Develop and implement an Information/Cyber
Security Plan, to include physical and logical
security plans consistent with Customer policies
with respect to security and develop and
provide documentation demonstrating
adherence to Customer policies and
requirements relating to security for Customer's
review and approval. At a minimum, to include a
security framework, end-to-end scope to cover
all systems and data, regular risk assessments
and threat modeling, proactive Incident
response planning, and a committed cyber
security resource leading the implementation
effort
X

27. Review and approve Information / Cyber
Security Plan, including physical and logical
security plans
X

28. Protect Customer data, logically and physically,
when in use, at rest and during transmission
against unauthorized access or modification,
which includes compliance with Customer's
cyber security standards and any other
Customer policies relating to data security
X
Physical Security at Customer Service
Locations

29. Manage the Customer Service Location
endpoints (e.g. card readers)
X

Page 17 of 45 ends

Schedule 3A- Cross - Functional Services SOW
No.

High-level Security Functions
Service
Provider Customer Function/Responsibility

30. Manage cabling to designated interface points
at Customer Service Locations
X

31. Provision and decommission badges as
required for Service Provider Personnel access
to Customer Service Locations
X

32. Provide and manage other Customer Service
Location physical security as required by
Customer (i.e., guards, video recording)
X

33. Provide, maintain and report approved
Customer Service Location access list for
Service Provider Personnel to Customer in
accordance with Customer policies and
requirements, for Customer's review and
approval
X

34. Approve Customer Service Location access list X

35. Manage third-party access to Service Provider
zones in Customer Service Locations in
accordance with Customer policies and
requirements relating to security (e.g.,
escorting, badging)
X

36. Define and provide Service Provider access
zones in Customer Service Locations
X
Physical Security at Service Provider
Service Locations

37. Provide physical security at Service Provider
Service Locations in accordance with applicable
Customer policies, requirements and industry
standards
X
Security Operations
Security Integrity Advisory

38. Provide security advisory information to
Customer in an agreed upon manner
X

39. Evaluate security advisories, assign a risk value
and communicate recommended action plan to
Customer
X
Patch Management

40. Recommend Customer policies related to
software and security patch deployment and
priority levels
X

41. Review and approve Customer policies related
to software and security patch deployment and
priority levels
X

42. Comply with Customer policies related to
software version control and patch management
X

43. Review all software and security patches
relevant to the IT environment and classify
patches based on Customer policies
X

44. Install software and security patches in
accordance with change management process
X

45. Review and approve security patch
deployments
X

Page 18 of 45 ends

Schedule 3A — Cross - Functional Services SOW
High-level Security Functions
No. Function/Responsibility Service
Provider Customer
Malware Prevention

46. Install, configure and operate malware
protection software on service environment
device endpoints (where possible) for
continuous scanning, eradication and reporting
of detected malware and malware Incident
Resolution
X

47. Deploy anti-malware updates and patches
following a Malware Incident per the Customer
patch and change and release management
procedures
X

48. Provide automated detection and removal of
malicious code using anti-malware software
X

49. Monitor Service Provider information and
manage up-to-date information on malicious
code outbreaks and deploy the appropriate
software signature files to protect against the
malicious code
X
.
50 Promptly notify Customer on detection of
malicious code within Customer's IT
environment
X

51. Implement the Customer established action
plan and escalation procedures for a malicious
code event beyond what is automatically fixed
by the anti-malware software
X
Security Information and Event Management
(SIEM)

52. Manage security logs and aggregate data
across Service Tower components (e.g.,
network, security, servers, databases,
applications), and consolidate monitored data to
help avoid missing important security events
X

53. Review event data for common attributes and
correlate events into meaningful groups that can
be used for risk identification
X

54. Provide automated analysis of correlated events
and alert Customer, Service Provider team and
third parties as required (e.g., dashboard, email)
X

55. Provide dashboard reporting tool that takes
event data and turns it into informational charts
to assist in seeing patterns, or identifying
activity that is not forming a standard pattern
X

56. Provide automated compliance function that
gathers compliance data, and produces reports
that adapt to existing security, governance and
auditing processes
X

57. Retain Customer historical data to facilitate
correlation of data over time and comply with
Customer data retention requirements
X

58. Provide forensic analysis capability (i.e., ability to search across logs on different nodes and
time periods based on specific criteria)
X

Page 19 of 45 ends

Schedule 3A - Cross - Functional Services SOW
No.

High-level Security Functions
Service
Provider Customer Function/Responsibility
Monitoring and Incident Management

59. Provide, implement and manage Customerapproved security analysis and monitoring tools and processes, and provide documentation
demonstrating adherence to Customer policies
related to security and reporting management
X

60. Report security risks and security Incidents to
the Customer, in accordance with Customer
policies and consistent with Information/Cyber
Security Plan Risk Management provisions
X

61. Provide documented details of security
Incidents, including history and management
activities
X

62. Resolve security risks and breaches originating
from internal and external sources
X

63. Coordinate the Resolution of security risks and
security Incidents (e.g., denial of service
attacks, spoofing, web exploits) originating from
outside the Customer IT environment
X
System Administrative Privilege Support

64. Disable terminated users or inactive accounts in
accordance with Customer policies
X

65. Identify and report to Customer policy violations
originating from administrative IDs (e.g., login
violations, resource access violations)
X

66. Identify and report to Customer systematic
attacks (e.g., attempts to logon)
X
Security Status Checking and Validation

67. Maintain Service Tower documentation required
to support security assessments, audits and
internal control and control testing
X

68. Support audit activities by providing a security
assessment audit coordinator to define audit
controls and coordinate audits
X

69. Provide security assessment audit focal point to
define audit controls and coordinate audit
activities
X

70. Provide support for audit activities (e.g., data
collection, audit software installation, report
generation)
X

71. Develop plans to remediate audit findings that
do not comply with the established Customer
policies and requirements related to security
X

72. Review and approve audit findings and
remediation plans
X

73. Implement audit findings remediation plans X

74. Perform security assessments to identify control
or security gaps and provide trending problem
reports to Customer, and provide remediation
plans
X

75. Approve remediation plans X

Page 20 of 45 ends

Schedule 3A - Cross - Functional Services SOW
No.

High-level Security Functions
Function/Responsibility Service
Provider Customer

76. Conduct security planning and review sessions
to review results of security assessments and
remediation plans
X

77. Implement Customer-approved security
assessment remediation plan
X
Threat and Vulnerability Management

78. Provide integrated monitoring of threats and
vulnerabilities for all Configuration Items (Cis)
required for the provision of the in-scope
Services
X

79. Provide automated alerts to the appropriate
service delivery teams of pre-defined events,
prior to actual performance impact
X

80. Provide automated creation of Incident records in
the Incident Management tool based on predefined thresholds being reached or breached X

81. Provide automated recovery, repair, and/or
remediation of threats and vulnerabilities based
on alerts and pre-defined rules
X

82. Provide automated identification and suggestion
of pre-defined recovery, repair, and/or
remediation activities to guide operator activities
in the event that operator intervention is required
X

83. Provide ability to support Customer-directed
monitoring activities in addition to the predefined
recovery, repair or remediation activities
X

84. Provide monitoring and reporting of performance
trends to support trend analysis
X

Page 21 of 45 ends

Schedule 3A Cross - Functional Services SOW

IT LIFE CYCLE (ITLC) & OPERATIONS SERVICES
"IT Life Cycle and Operations Services" means those functions described in this section and will apply to all Service Area environments (e.g., applications, software, network, hardware, services). Service Provider will manage all Service Tower IT life cycle activities in accordance with the following common life cycle and operational services.

Planning and Analysis Services
No. Function/Responsibility Service
Provider Customer

1. Define Customer requirements at the enterprise and
the operating unit level for all Service Towers (e.g.,
business, technology strategy, functional, Availability, capacity, performance, backup and IT business
continuity)
X

2. Perform Planning and Analysis Services based on
Customer requirements (e.g., functional, Availability,
capacity, performance, business continuity and
disaster recovery)
X

3. Provide analysis of alternatives and recommendations, including projects and strategic initiatives, to meet
Customer functional and technical objectives and
requirements for Customer's review and approval
X

4. Review and approve analysis of alternatives and
recommendations to meet Customer functional and
technical objectives and requirements
X

5. Execute and provide leadership to deliver on
Customer approved Projects and strategic initiatives
X

6. Provide information and data as available for Planning and Analysis Services (e.g., business planning reports, enterprise architecture)
X

7. Monitor technical trends, meet with Customer semiannually and provide semi-annual reports on innovative products and services with potential use for Customer as they align with Customer's business and
technology strategy
X

8. Perform assessments for the implementation of new
applications and technologies that best meet
Customer requirements and cost objectives, as
requested by Customer or as otherwise required
X

9. Participate in technical and business planning
sessions to establish standards, architecture and
project initiatives, as requested by Customer or as
otherwise required
X

10. Manage, maintain and update technology standards
for the Customer IT environment (e.g., End-User
devices, computing devices, network devices)
X

11. Approve technology standards for the Customer IT
environment (e.g., End-User devices, computing
devices, network devices)
X

12. Conduct regular planning and conduct regular
planning meetings with Customer for technology
refreshes and upgrades, as requested by Customer or
as otherwise required
X

Page 22 of 45 ends

Schedule 3A - Cross - Functional Services SOW
No. Function/Responsibility Service
Provider Customer

13. Participate in regular planning and planning meetings with Service Provider for technology refreshes and
upgrades
X

14. Perform technical reviews, semi-annually or as
otherwise required, and provide recommendations for
operational improvements that increase scalability,
reliability, Availability, security, efficiency and
effectiveness or reduce costs
X

15. Participate in ongoing initial project and strategic initiative-specific planning activities and provide
proposals in accordance with the IT life cycle services and processes described in this Schedule
X

16. Provide analyses of business impacts related to
Service Provider's IT planning and analysis roles and
responsibilities described herein based on Service
Provider's industry knowledge and capabilities and
other business knowledge as applicable (e.g.,
business process improvements resulting from IT
improvement, customer satisfaction improvements,
revenue generation, business cost savings)
X

17. Provide input to annual budget for Services to
Customer
X

18. Support Customer's budgeting and planning processes and other requests from Customer X
Requirements Definition Services
No. Function/Responsibility Service
Provider Customer

1. Provide appropriate technical support staff (e.g.,
domain functional experts, solution architects and
engineers) to participate in functional and technical
requirements development
X

2. Facilitate, participate in and conduct requirements
gathering activities (e.g., functional and technical) with Customer stakeholders as required to determine >
Service Tower requirements
X

3. Participate in Service Provider-led requirements
gathering activities
X

4. Review and approve requirements with key
stakeholders
X

5. Document requirements necessary to deliver the
Services in accordance with Customer defined formats
X

6. Ensure requirements meet Customer policies related
to security
X

7. Document cross-Service Tower and Third Party
Provider integration requirements
X

8. Define testing requirements and criteria (e.g., unit testing, system testing, performance testing,
regression testing, security testing and user
acceptance testing) based on Customer policies and
X

Page 23 of 45 ends

Schedule 3A- Cross - Functional Services SOW
No. Function/Responsibility Service
Provider Customer
procedures for specific events (e.g., production
changes, small enhancements, enhancements,
projects) for Customer's review and approval

9. Approve testing requirements X

10. Document requirements and testing criteria for
Customer's review and approval
X

11. Approve testing criteria X

12. Work with Customer or Third Party Providers for endto-end test plan development (e.g., provide testing requirements, scheduling)
X

13. Provide Service Tower and project hours as
applicable, following requirements gathering activities as required
X
Design Specifications
No. Function/Responsibility Service
Provider Customer

1. Provide a design document standard for which all
design packages will be delivered
X

2. Document and deliver design specifications, including cross-Service Tower integration specifications, for
Customer's review and approval
X

3. Approve design specifications X

4. Provide Service Tower and project hours as
applicable, following design gathering activities as
required
X
Integration and Testing
No. Function/Responsibility Service
Provider Customer

1. Develop functional and/or technical system test plans and criteria for Changes to Service Tower components
(e.g., unit, system, integration, security, regression) X

2. Prepare test plans for proposed Changes to Service
Tower components based on Customer quality
assurance and testing polices and processes for
Customer's review and approval
X

3. Approve test plan X

4. Assess and communicate to Customer the overall
impact and potential risk to Service Tower components
prior to implementing Changes
X
5 .

Evaluate all new and upgraded Service Tower
components, configurations or services for compliance
with Customer policies and requirements related to
security
X

6. Implement and support test environments as required X

7. Provide test environment requirements X

8. Approve test environment requirements X

9. Conduct testing of Changes to Service Tower X

Page 24 of 45 ends

Schedule 3A - Cross - Functional Services SOW
No. Function/Responsibility Service
Provider Customer
components in non-production environments unless
otherwise approved by Customer

10. Test new releases of supported hardware and
software in accordance with test plans to ensure
required performance and functionality is maintained
and in conformance with Customer policies and
requirements
X

11. Plan and proactively communicate test plans to
Customer in order to minimize Customer/departmental
involvement in testing and minimize impact to
Customer's business operations
X

12. Provide Customer with test results for Changes to
Service Tower components and configurations for
Customer's review and approval
X

13. Approve test results X

14. Document all errors discovered in testing and propose a remediation plan
X

15. Approve remediation plan X

16. Implement known error rennediation plan as agreed
upon
X

17. Conduct retesting as required to fulfill requirements and achieve Customer approval
X
Implementation and Migration Services
No. Function/Responsibility Service
Provider Customer

1. Coordinate and review all implementation and
migration plans and schedules with Customer in
advance, to obtain Customer's review and approval, in
accordance with change and release management
procedures
X

2. Approve implementation and migration plans and
schedules
X

3. Perform Service Tower component upgrades as a
result of new and enhanced applications, architectures
and upgrade plans and requirements
X

4. Perform modifications and performance enhancement
adjustments to Service Tower components as a result
of implementing Changes
X

5. Coordinate implementation and migration activities,
including Change communication, with Customer and
Third Parties
X

6. Coordinate and support data migration and conversion by electronic or manual methods as a result of
implementation or migration (e.g., databases)
X

7. Perform appropriate tests as part of implementation
and migration activities (e.g., tests on database
IMACs)
X

8. Determine user acceptance testing ("UAT") and
Service Provider testing support requirements
X

Page 25 of 45 ends

City Council and Authorities ConcurrentMay 27, 2025

City Council and Authorities Concurrent
May 27, 2025