The contractual instrument binding the hosting provider to the build, test and production environments the program depends on. Consumption-priced against the committed environment budget.
SOW-005 · Infrastructure and Hosting Services
1 · Parties, Instrument and Term
| Item | Detail |
|---|---|
| SOW reference | SOW-005 — Infrastructure and Hosting Services |
| Governing agreement | Master Services Agreement between the Client and the Vendor |
| Client | The health plan operating the Enrollment & Claims platform ("Client") |
| Vendor | the infrastructure and hosting provider ("Vendor") |
| Client SOW owner | W. Donnelly — Vendor / Procurement Manager |
| Client technical authority | M. Alvarez — Infrastructure Lead |
| Client program authority | C. Tyrrell — Program Manager |
| Term | From execution through warranty exit at program closeout, Nov 2, 2027 |
| Pricing basis | Consumption against a committed environment budget |
This SOW is issued under and governed by the Master Services Agreement. It creates no rights independent of that agreement, and where the two conflict the order in Section 15 applies.
2 · Background and Purpose
Every other workstream depends on environments: the six integrations are built in them, the offshore team executes tests in them, and the SOX assessment examines controls operating in them. Vendor supplies those environments. Client's own engineers configure and operate what runs inside them — T. Halvorsen and the infrastructure team are Client's, and the boundary between platform and workload is the whole shape of this SOW.
The committed environment budget is $480,000, per the Program Budget line Infrastructure / Cloud Environment Costs. That figure is environment cost only; the $601,500 Infrastructure/DevOps & Security Labor line is Client's own staff and is not payable to Vendor.
3 · Definitions
| Term | Meaning |
|---|---|
| Acceptance | Client's written confirmation that a Deliverable meets its Acceptance Criteria, or the expiry of the Review Period without written rejection, whichever occurs first. |
| Acceptance Criteria | The objective, testable conditions stated against each Deliverable in Section 5. A condition that cannot be tested is not an Acceptance Criterion and does not become one by being written in this table. |
| Review Period | Ten (10) Business Days from Client's receipt of a Deliverable, unless a different period is stated against that Deliverable. |
| Business Day | Monday to Friday excluding US federal holidays. |
| Change Order | A written amendment to this SOW executed by both parties under Section 9. Work performed outside an executed Change Order is performed at Vendor's own cost. |
| Client Data | All data supplied by Client or generated on Client's behalf, including member, claims, provider and eligibility records. Client Data remains Client's property at all times. |
| Environment | A named, separately addressable instance listed in the agreed environment schedule. An environment not on the schedule is not covered and is not chargeable. |
| Maintenance Window | A period agreed in writing at least ten Business Days in advance. Unagreed downtime counts against availability. |
4 · Scope of Services
Scope is stated twice — what Vendor does, and what Vendor does not. The second list is the one that prevents disputes. A boundary discovered during delivery is renegotiated under pressure, at a price set by whoever can least afford to walk away; a boundary written down before execution is simply the deal. Where this SOW is silent, the work is Client's.
In scope. Vendor shall provide:
- Provisioning and availability of build, test and production environments.
- Platform-level patching, backup and restore to the agreed schedule.
- Network connectivity between environments and to Client's corporate network.
- Consumption reporting by environment, monthly, at a granularity Client can reconcile.
- Restore testing on Client request, at least quarterly.
Expressly out of scope. The following are Client's and are named here so that neither party discovers the boundary during delivery:
- Application configuration and deployment, which are Client's.
- Any decision about what data is placed in an environment.
- Performance tuning of Client's workloads.
- Test data masking, which is Client's obligation under SOW-003.
- Environments not named in the agreed environment schedule.
5 · Deliverables and Acceptance
| ID | Deliverable | Acceptance Criteria | Review Period |
|---|---|---|---|
| D-H1 | Environment schedule and provisioning | Each named environment provisioned, reachable, and demonstrated against Client's connectivity test. | 10 BD |
| D-H2 | Backup and restore evidence | A restore performed from backup into a non-production environment, with elapsed time and data integrity evidenced. | 10 BD |
| D-H3 | Monthly consumption report | Consumption by environment, reconcilable to the invoice line by line, issued within five Business Days of month end. | 5 BD |
| D-H4 | Production readiness attestation | Written attestation that production meets the agreed availability, backup and access-control configuration ahead of the Go-Live gate. | 10 BD |
Each Deliverable is submitted with the evidence its Acceptance Criteria call for. Client has the Review Period to accept or to reject in writing with specific, criterion-by-criterion reasons. Silence for the whole Review Period is Acceptance — deemed acceptance — because a program cannot hold a vendor to a date while leaving its own review open-ended.
A rejection must identify which Acceptance Criterion failed and how. "Not what we expected" is not a rejection; it is a Change Order conversation. Vendor re-submits within ten Business Days and a second Review Period of five Business Days runs. A Deliverable rejected twice on the same criterion escalates under Section 12 rather than looping.
The Review Period is deliberately short and deliberately symmetrical. Client gains a fixed window in which to find defects, and Vendor gains certainty that the window closes. Neither party benefits from an acceptance process that can be extended by not answering — the program has a baselined schedule and an acceptance clause that cannot expire is a schedule risk carried by whichever party is not writing the emails.
6 · Client Responsibilities and Dependencies
Vendor's obligations are conditional on the following. Each dependency names a Client owner, because a dependency without an owner is an excuse rather than a commitment. Where Client fails to meet a dependency and that failure demonstrably delays Vendor, the affected dates move by the period of delay and no more — a missed dependency does not reopen scope or price.
| Client provides | Named owner |
|---|---|
| Environment schedule and sizing decisions | M. Alvarez — Infrastructure Lead |
| Access-control policy and approved user list | M. Alvarez — Infrastructure Lead |
| Architecture and connectivity requirements | J. Albert — Solution Architect |
| Budget approval and Change Order signature | W. Donnelly — Vendor / Procurement Manager |
7 · Fees and Payment
Money is expressed against named Deliverables rather than against elapsed time, so that the question of whether a sum has been earned has an answer that does not depend on recollection. Percentages are used rather than restated dollar amounts, so that a Change Order to the value does not silently leave a payment schedule that no longer sums.
Charged monthly in arrears on consumption actually incurred, against a committed environment budget of $480,000. Consumption pricing means Client pays for what it uses; the commitment is a ceiling and a planning figure, not a floor.
- Each invoice reconciles line by line to the D-H3 consumption report. An invoice line without a corresponding report line is not payable.
- Vendor notifies Client in writing on reaching 80% of the committed budget, and again at 95%.
- Environments decommissioned at Client's request stop accruing charges from the date of decommission, not the date of the next billing cycle.
Invoices are payable thirty days from receipt of a correct invoice. Client may withhold the disputed portion of an invoice, and only that portion, pending resolution under Section 12.
8 · Key Personnel and Service Levels
Service levels are stated as measures a third party could evaluate from the reporting alone. A commitment that requires the parties to agree afterwards whether it was met is not a service level; it is a topic for a meeting. Each measure below is either evidenced by a Deliverable in Section 5 or is directly observable in the weekly delivery forum.
| Measure | Commitment |
|---|---|
| Production availability | 99.5% monthly, measured excluding agreed maintenance windows |
| Severity 1 incident response | 15 minutes, 24x7 |
| Severity 2 incident response | 2 business hours |
| Restore from backup | Demonstrated quarterly; RPO 24 hours, RTO 4 hours |
| Consumption report | Within 5 Business Days of month end |
Vendor shall not replace a named individual without Client's prior written consent, save where the individual leaves Vendor's employment. A replacement is inducted at Vendor's cost and Client is not charged for the replacement's familiarization.
9 · Change Orders
Either party may propose a change. Vendor prices it within five Business Days, stating the effect on fees, on dates, and on any other Deliverable. No change is effective until both parties sign, and work performed in anticipation of a Change Order is at Vendor's own cost — the clause exists so that goodwill work does not become an invoice later.
Changes that alter the program baseline set at the Nov 3, 2026 milestone are additionally subject to program change control and the Change Control Board, not to this SOW alone.
10 · Warranty
Vendor warrants that the Services are performed by suitably qualified personnel in a professional and workmanlike manner, and that Deliverables conform to their Acceptance Criteria for ninety (90) days after Acceptance. Vendor's sole obligation for a breach of this warranty is to re-perform the affected Services at no charge.
The warranty does not cover defects arising from Client's modification of a Deliverable, from Client Data supplied incorrectly, or from an environment Vendor does not control. It survives to program closeout on Nov 2, 2027.
11 · Data Protection, Confidentiality and Intellectual Property
Client Data is disclosed for the sole purpose of performing the Services. Vendor processes it only on Client's documented instructions, restricts access to personnel with a demonstrable need, and returns or destroys it within thirty days of termination, certifying destruction in writing.
Where Vendor handles protected health information, the parties' Business Associate Agreement governs and prevails over this SOW to the extent of any conflict. Vendor notifies Client of any suspected unauthorized access without undue delay and in any event within twenty-four hours of becoming aware.
Client owns all Deliverables and all derivative work created under this SOW on Acceptance. Vendor retains its pre-existing materials and grants Client a perpetual, irrevocable, royalty-free license to use them to the extent embedded in a Deliverable — so that Client is never unable to operate what it has paid for.
12 · Governance and Escalation
Day-to-day direction runs through the Client SOW owner. Matters not resolved within five Business Days escalate to the Program Manager; matters not resolved within a further five Business Days escalate to the Steering Committee. Neither party may suspend performance while an escalation is open.
Vendor attends the program's weekly delivery forum and reports against the measures in Section 8. Reporting is a contractual obligation, not a courtesy: a service level that is not reported is not being managed.
13 · Limitation of Liability
Each party's aggregate liability under this SOW is limited to the fees paid or payable under this SOW in the twelve (12) months preceding the event giving rise to the claim. Neither party is liable for indirect, incidental or consequential loss, or for loss of profit, revenue or anticipated saving.
⚠ The cap does not apply to: breach of confidentiality; unauthorized access to or disclosure of Client Data, including any incident engaging HIPAA breach-notification obligations; infringement of a third party's intellectual property; or either party's fraud or wilful misconduct. Those are uncapped, deliberately — a cap expressed as a multiple of fees is meaningless against a notifiable breach affecting member records.
14 · Termination and Transition Assistance
Client may terminate for convenience on thirty days' written notice, paying for Services properly performed and for Deliverables accepted to the date of termination, and for no more. Either party may terminate for material breach unremedied thirty days after written notice.
On termination for any reason Vendor provides transition assistance for up to ninety days at the rates in Section 7: knowledge transfer, documentation, configuration exports and reasonable access to the personnel who did the work. Transition assistance is not conditional on the reason for termination or on any disputed sum — a program that cannot exit a vendor it is in dispute with does not have a contract, it has a hostage.
15 · Order of Precedence
Where documents conflict, the order of precedence is: (1) the Business Associate Agreement, on any matter it addresses; (2) the Master Services Agreement; (3) this SOW; (4) an executed Change Order, which prevails over this SOW only on the matter it changes; (5) any Vendor quotation, proposal or order-acknowledgement, which is included for reference and creates no obligation.
⚠ Vendor's standard terms, wherever they appear — in a portal click-through, an invoice footer, or an order acknowledgement — are expressly excluded.
16 · General Conditions
Neither party may assign this SOW without the other's written consent, save to a successor to substantially the whole of its business. Vendor may not subcontract any part of the Services without Client's prior written consent, and remains fully responsible for any permitted subcontractor's acts and omissions.
Neither party is liable for failure caused by an event beyond its reasonable control, provided it notifies promptly and mitigates. Inability to pay is never such an event. Nothing in this SOW creates a partnership, joint venture or employment relationship, and neither party may hold itself out as agent of the other.
Vendor's personnel remain Vendor's employees or contractors for all purposes including tax, benefits and insurance. Client directs the what and the when; Vendor directs the how and the who.
17 · Execution
Executed by the authorized representatives of each party. ⚠ The Program Manager signs nothing: program authority is not signing authority, and the separation is deliberate.