Kittitas County SOW Microsoft Purview Data Security Strategy PSA v4 20260929

Home Browse Search

Statement of Work September 29, 2026 - Version 4.0 Microsoft Purview Data Security Strategy Page 7 Either Party may initiate requests to change or modify the Project, a Project Phase, or the Deliverable Specifications (each, a "Change Request"). Any Change Request will be governed by (a) the Master Agreement and will utilize the form of written change request (the “Change Request Form”), if applicable, or (b) the following procedure, if the Master Agreement does not address Change Requests (the “Project Change Process”). The Project Lead of the Party requesting a Change Request will submit a Change Request Form to the other Party's Project Lead in a clear and concise manner (each, a “Change Request Form”). Upon execution of a mutually acceptable Change Request Form by both Parties, the obligations of the Parties with respect to such Change Request will be incorporated under this SOW. Commencement of the provision of a Change Request is conditioned upon Trace3's receipt of (a) a Change Request Form signed by both Parties, and (b) either a signed additional Purchase Order or Purchase Order Exception authorizing the mutually agreed upon price for each Change Request. 2.5 ASSUMPTIONS AND CONSTRAINTS 2.5.1 Scope of Services Assumptions • Client's M365 G3 licensing is and remains active for all In-Scope users for the duration of the engagement, and includes Purview eDiscovery (Standard) entitlements • The Project covers up to twenty-four (24) In-Scope departments and the implementation of up to twenty -four (24) Compliance Security Filters • Entra ID attribute remediation is limited to department-identifying attributes for In-Scope users and does not require directory synchronization redesign or HR-system integration • SharePoint Online site URL conventions are remediable through standard administrative configuration; large-scale site restructuring, if required, is out of scope • Remote access will be provided via the County's approved method (e.g., Microsoft Teams, Webex, or Virtual Private Network ("VPN")) and delegated administrative credentials with sufficient privilege to perform the In - Scope work • Trace3’s remediation efforts are limited to the In-Scope attribute, URL alignment, and configuration activities expressly described in this SOW. Broader data governance or information architecture remediation is outside the scope of this SOW. • Client remains responsible for legal and compliance decisions related to its use of the configured Microsoft Purview capabilities. Trace3 is not providing legal advice under this SOW. • Services will be delivered continuously from the start of the Project until the completion of the Deliverables or allotted time unless otherwise stated in this document with the exception of holidays and scheduled time off. 2.5.2 General Assumptions The following general assumptions will apply to the execution of the Deliverables: • Services will generally be performed during normal business hours which are defined as being between 8:00 AM and 5:00 PM Client’s local time. If Services are needed after normal business hours, Trace3 and Client must mutually agree upon the schedule before such after-hours Services commence. • Services detailed in this SOW are expected to be fully delivered by either (a) the End Date or (b) within twelve (12) months of the Effective Date (“Expiration Date”). Client and Trace3 acknowledge and agree that at any point after the Effective Date, should Client or Trace3 reasonably foresee the Services extending beyond Expiration Date, renegotiation of terms of this SOW will be documented using a Project Change Request prior to Expiration Date.