Customer Service and Records Administration Services for ABLE United

The ABLE United Program requires comprehensive records administration, customer service, reporting, andoperational support services necessary to operate a Qualified ABLE Program. The services summarized belowand detailed further in the example Contract included as Appendix A, represent the minimum required services.The selected Respondent will provide these services in accordance with the Program disclosures (included asAppendix B) and the Business Rules (included as Appendix C). Respondents may propose additionalenhancements that provide value to the Program.3.01(1) Recordkeeping and Account AdministrationThe selected Respondent will provide full-service recordkeeping and administrative support for ABLE Accounts,including account establishment and maintenance, processing of contributions and withdrawals, transactionrecordkeeping, tax reporting, and other operational functions necessary to administer ABLE Accounts.The selected Respondent will also provide debit or prepaid card functionality for ABLE Account Owners as partof its core service offering.3.01(2) Customer Service and Participant SupportThe selected Respondent will provide participant support services for ABLE Account Owners, contributors, andprospective participants across multiple contact channels, including telephone, online chat, electroniccommunications, and written correspondence. Respondents should be capable of supporting accessiblecommunications and digital services consistent with ADA requirements.3.01(3) Technology Platform and Online AccessThe selected Respondent will provide a secure, reliable, and scalable technology platform that enables onlineaccount opening and management, contribution and withdrawal processing, investment allocation changes,and participant access to account information and transaction history. The platform shall be accessible throughweb and mobile-compatible interfaces and designed to support a high-quality user experience consistent withaccessibility standards, including compliance with applicable ADA requirements.The platform shall support integration with third-party systems, including financial institutions, payment processors,and Program partners, and shall maintain accuracy and consistency across systems. Security controls for theplatform are addressed in Sections 3.01(6), 3.01(10, and 3.01(11).3.01(4) Governance and Audit SupportThe selected Respondent will support Board oversight and Program administration through operational reportingand reconciliation support. The Respondent must maintain appropriate independent audit reports and providedocumentation supporting operational controls and disaster recovery testing.3.01(5) Data Ownership and AccessThe selected Respondent will maintain Program Data in a secure environment and acknowledges that allProgram Data is owned by the Board. The Respondent shall provide the Board with timely, complete, andunrestricted access to Program Data for purposes including Program oversight, reporting, audit, and transition toa successor vendor.The selected Respondent shall maintain appropriate data access controls, audit logs, and data governancepractices to ensure the integrity, security, and traceability of Program Data. The Respondent shall support dataextraction and delivery in industry-standard, machine-readable formats upon request and shall ensure that5Program Data can be transferred to the Board or its designee without delay, degradation, or additional costbeyond agreed-upon contractual terms.3.01(6) Data Protection and Security ControlsThe selected Respondent will maintain data protection and access controls appropriate for the administrationof financial accounts and compliance with applicable federal and state requirements.The selected Respondent shall implement controls that include encryption of data at rest and in transit, userauthentication, role-based access controls, and protection of sensitive information.Requirements for monitoring, fraud and threat detection, and incident response are addressed in Sections 3.01(8)and 3.01(10).Requirements for security governance, audits, reporting, and compliance documentation are addressed inSection 3.01(11).3.01(7) Investment Option AdministrationThe selected Respondent will support the administration of Board-approved Investment Options, including theallocation of contributions and withdrawals and coordination with underlying investment managers andcustodians.The selected Respondent may also support the administration of an FDIC-insured option if approved by theBoard.The selected Respondent must perform these services in compliance with applicable federal and state laws,regulations, and Program requirements governing Qualified ABLE Programs.3.01(8) Incident Response and Cybersecurity OperationsThe selected Respondent will maintain a formal Incident Response Program to support the timely detection,response, and remediation of system and cybersecurity incidents.The selected Respondent shall develop and maintain a documented Incident Response Plan that defines roles,escalation procedures and communication protocols. The Plan shall be reviewed at least annually and updatedas necessary.The selected Respondent shall notify the Board of any security breach as soon as practicable, participate incybersecurity and disaster recovery tabletop exercises led by the Board, and shall coordinate with Board staffand other service providers during incident response activities.The selected Respondent shall document and report incidents, including preparing and delivering Root CauseAnalysis (RCA) reports for critical and high-severity events, and shall demonstrate the ability to respond to andresolve incidents in a manner that minimizes impact to program operations and participants.3.01(9) Business Continuity and Disaster RecoveryThe selected Respondent will maintain Business Continuity and Disaster Recovery (BC/DR) capabilities to ensurecontinuity of operations in the event of system disruptions or disasters. The Respondent shall develop and maintaina Business Continuity Plan that addresses operations within the first forty-eight (48) hours of a disruption and shallconduct annual testing of business continuity and disaster recovery plans. The Respondent shall identify andremediate any deficiencies.The selected Respondent shall maintain secure, up-to-date backups of all critical systems and data and shalldemonstrate the ability to sustain and restore operations in a timely manner following system outages,cybersecurity incidents, or other disruptions.63.01(10) System Monitoring and Threat DetectionThe selected Respondent will continuously monitor systems, integrations, and user activity to ensure systemperformance, data integrity, and security. The Respondent shall monitor for fraud, suspicious activity,unauthorized access, and data anomalies. The Respondent shall implement automated alerting and escalationprocedures and shall proactively identify, investigate, and resolve issues to maintain system stability and security.3.01(11) Security Governance and ComplianceThe selected Respondent will maintain a comprehensive security and compliance program and a securitygovernance framework aligned with applicable regulatory requirements and industry best practices. TheRespondent shall conduct quarterly security audits and user access reviews and shall maintain audit logs forsystem access, data changes, and administrative activity.The selected Respondent shall participate in security training and awareness programs, including phishingsimulations as required by the Board, and shall demonstrate compliance with applicable federal and staterequirements governing financial accounts and data protection. The Respondent shall provide documentationand reporting to support compliance and audit requirements.3.01(12) Reporting, Documentation, and TransparencyThe selected Respondent will provide operational reporting and maintain documentation necessary to supportProgram oversight, audit readiness, and continuity of operations. The Respondent shall provide monthly reportingon system performance, incidents, and support activity and shall maintain current documentation related toimplementation plans, security plans, business continuity, system configurations, integrations, and securitycontrols.The selected Respondent shall provide quarterly reporting on documentation updates, audit findings, andcorrective actions. All documentation shall be maintained in a format that supports audit, compliance, andtransition to a future service provider, if required.3.01(13) Value-Added ServicesThe Respondent may offer services other than those specifically outlined in the solicitation that it believes offeradditional operational benefits, efficiencies, or risk reduction (Value-Added Services). Although the Board hasidentified its current business needs, those needs are not intended to limit the Respondent’s innovations orcreativity in preparing a Response. The Board will consider innovative ideas, new concepts, and partnershiparrangements not otherwise presented in this ITN, including unique business features, special services, cost savingsor shared-savings arrangements, discounts, or terms and conditions specific to the selected Respondent. If theRespondent is awarded the Contract and a Value-Added Service is included in the Contract without anestablished start date, the Board will provide the agreed-upon notice before the service is implemented.