Vendor Technology Oversight - Applications

Purpose

This document defines the State of Maine’s standards, expectations, and operating model for acquiring, implementing, and managing applications and the technology provided by vendors. It clarifies the statutory authority of the Chief Information Officer, outlines the roles and responsibilities of all participating parties, and establishes the processes, service levels, compliance requirements, and collaboration needed to ensure secure, efficient, and consistent delivery of technology solutions across state agencies. This document serves as a guide for agencies, MaineIT staff, technology vendors, and Procurement Services to support effective decision‑making and successful application lifecycle management.

Overview

Maine State Statute Title 5, Chapter 163 §1982 generally establishes the CIO as the head of the Office of Information Technology and gives them authority over information technology policy, standards, and planning for executive branch agencies. This includes:

Developing and enforcing statewide IT policies and standards
Approving technology acquisitions and implementations
Coordinating IT systems to ensure compatibility and efficiency
Managing enterprise architecture and security standards

The above statute explicitly tasks the CIO with setting policies and standards for IT systems and gives the CIO sole authority to approve any technology procurement. For example, if the CIO sets a standard that all agencies must use a specific cloud platform or security protocol, agencies are legally required to comply.

Title 5, Chapter 163 §1972states that the CIO approves technology initiatives, contracts and acquisitions including enterprise initiatives. This includes any company or organization that provides technology-related products or services to other businesses or consumers, in this case State Agencies. These may be in the form of direct technology or in Agency service contracts that leverage technology. Vendors can specialize in different areas, such as:

Hardware: Selling physical devices like computers, servers, networking equipment, or IoT devices.
Software: Providing applications, operating systems, or platforms (e.g., Microsoft, Adobe).
Cloud Services: Offering infrastructure, storage, or computing power via the cloud (e.g., AWS, Azure).
IT Services: Delivering consulting, support, maintenance, or managed services.
Cybersecurity: Supplying tools and services to protect systems and data.

No matter which Agency holds a contract with a vendor, any contract changes or initiations require all technology that is leveraged through that contract to CIO review and approval prior to the contract completion.

Definitions

Executive Sponsor	The Agency Partner representative that has accountability for the strategic direction and budget of the program within the Agency that the application supports
Product Owner	The Agency Partner representative with the authority to determine the business objectives of an application and the priority of the product features that are developed.
Product Manager	The OIT representative who works with the Agency Partner and vendor to ensure that the technology provided adheres to OIT standards and policies.
Subject Matter Expert	The Agency Partner representative, whose responsibilities include articulating the business rules and can speak to the functionality required of the application being developed and maintained.
Data Steward	The agency designee who determines the access rules and security requirements of the data contained in the application.
Technology Vendor	An entity contracted with the State of Maine that creates, sells, or supports technology solutions that help businesses or individuals operate more effectively. These products or services could include Hardware, Software, Cloud Services, IT Services, Cybersecurity or any other service that leverages technology to deliver services to a State Agency.
Software / Application	A computer program, either specifically created or configured, to assist State of Maine users to perform a useful business function.
Least Privilege	An information security concept which maintains that a user or entity should only have access to the specific data, resources and applications needed to complete a required task.
Device / Hardware	Any piece of equipment that uses scientific knowledge or electronic components to perform a task or solve a problem. Examples include but are not limited to: smartphones, computers, tablets and e‑readers, smartwatches, routers and modems, cameras, kiosks, drones, smart home devices (like smart thermostats or speakers)
Office of State Procurement Services	A branch of the Bureau of General Services tasked with ensuring that state departments and agencies purchase goods and services in a manner that ensures the greatest possible economy while maintaining quality. The division oversees the competitive bidding process for contracts and grants, ensuring that awards are made based on cost, quality and timeliness of delivery.
Support Model	A collection of documented methods and resources used by the Application Owners to provide and manage end-to-end service and product delivery following deployment.

Customer Expectations

A shared understanding of roles is required for any successful technological implementation. The table below identifies the responsibilities of participants in a typical vendor delivered application implementation. While each item is distinct from another, they are dependent on each other, and all require collaboration from vendor, MaineIT, Procurement Services and the requesting agency. The interplay of these functions illustrates the need for a close working relationship between Maine IT and agencies throughout the entire process.

Services Requested	What MaineIT Provides	What Agency Provides	What the Vendor Provides	What Division of Procurement Services Provides
Procurement of Technology	Architectural review of technology included in the procurement. Security vetting of the proposed technology. Technology requirements for RFP Final approval on any technology Participant on the RFP scoring panel Answer technical questions in Q&A Contract review and Technical Policies Systems Analysis of requirements	RFP coordination RFP writing RFP scoring Answer non-technical questions in Q&A Draft Contract for Review	All documentation required to perform architectural and security reviews. Submit Bids Ask Questions	Oversee Procurement process Provide Guidelines for Contract Construction
Technology Management & Consulting Services	Feasibility analysis: Assessing technical and financial viability of proposed applications. Budget Development: creating application budgets for projects and operations. Technology Roadmap communication Technology planning Documenting appropriate application details in the enterprise application repository Supervision of technical staff Systems Analysis of requirements	Articulate and Define business processes and business rules to analysts developing requirements. Review and sign off on requirement documents to ensure planned functionality meets business needs. Prioritize agency needs for technology services by participating in backlog reviews Articulate and advocate for appropriate budget for technology needs by participating in and budget development. Articulate future technology for planning purposes Strategic Plan	Requirements development: Understanding business needs and translating / documenting them into technical specifications. Backlog grooming: Supervision of their technical staff
Design and Development Services	Oversee / consult on technical development. Provide deployment oversight Vetting architecture and toolsets Systems Analysis of requirements	Provide branding graphics and graphic design requirements Collaborate with design team on interface requirements Provide user acceptance testing on user interfaces Review prototypes for suitability to business processes	User Interface /User Experience design: Creating user-friendly and visually appealing interfaces. Architecture design: Defining the structure and technology stack. Prototyping: Building interactive mockups to validate design concepts. Branding alignment: Ensuring the app reflects the organization’s identity. Frontend development: Building the user interface (e.g., using React, Angular, Vue). Backend development: Creating server-side logic, APIs, and databases (e.g., Node.js, .NET, Java, Python). Mobile development: Native (iOS/Android) or cross-platform (Flutter, React Native). Cloud-native development: Leveraging cloud platforms like AWS, Azure, or GCP.
Integration Services	Follow the Data Exchange Policy API development & integration: Connecting with third-party services or internal systems. MSB Middleware services: Facilitating communication between different applications. Data integration: Syncing with databases, data lakes, or enterprise systems in consultation with Enterprise Data Systems (EDS) Monitoring and logging of data transfers	Follow the Data Exchange Policy Ensure all data exchanges have a signed Memorandum of Agreement (MoA) amongst the Authorized Custodians of the transacted data.	Follow the Data Exchange Policy API development & integration: Connecting with third-party services or internal systems. MSB Middleware services: Facilitating communication between different applications. Data integration: Syncing with databases, data lakes, or enterprise systems in consultation with Enterprise Data Systems (EDS) Monitoring and logging of data transfers
Maintenance & Support Services	Oversight and agency support for their vendor technology management	Prioritize agency needs for technology services and issue resolution Articulate business needs for availability of production systems Assist with the scheduling of system outages for maintenance Ensure funds are available to maintain the currency of their application. User support: Helpdesk or in-app support services.	Bug fixes and updates: Ongoing improvements and patching. Performance monitoring: Ensuring uptime and responsiveness. User support: Helpdesk or in-app support services. Issue resolution / escalation
Security & Compliance Services	Ensure security testing is complete and vetted. Follow waiver policies.	Articulate the sensitivity of data and any compliance requirements for the system. Articulate access rules for users of the system and data.	Authentication & authorization: Implementing secure login systems (OAuth, SSO). Data encryption: At rest and in transit. Compliance: GDPR, HIPAA, SOC 2, etc. Follow waiver policies and remediate waivers in a timely fashion.
Data Analysis	Analysis of existing data for purposes of data migration. Vet data migration plans for technical viability	Define business rules for data. Review data quality outputs Determine acceptable levels of error in data Correct any invalid data in source systems. Determine scope of data being migrated	Develop processes for businesses to analyze the quality of data during modernization projects. Report on data quality during migrations. Develop and execute data migration plan.
Data Governance	Follow the guidelines of the Chief Data Officer	Follow the guidelines of the Chief Data Officer Establish and document data sharing and access rules	Follow the guidelines of the Chief Data Officer
Hosting platforms & Development Toolsets	Bring proposed new technology to Enterprise Architecture for vetting. Ensure vendor provided technology meets OIT standards for security and reliability.	Consult with MaineIT on available tools.	Provide detailed architectural plans and diagrams that can be used for architectural vetting. Integrate with MaineIT if hosted in Maine’s environment.
Testing, Deployment & Change Management	Participate and Ensure Change Management Policy and Application Deployment Certification Policy are followed Determine required tests for Deployment Certification and review results	Follow Change Management Policy and Application Deployment Certification Policy Participate in the Product Owner role as defined in policy Perform User Acceptance Testing prior to deployment. Regression Test	Follow Change Management Policy and Application Deployment Certification Policy Run the following tests as deemed appropriate by the application director and the CIO. Accessibility Test Data Conversion and Migration Test Interfaces Test Security Test Performance Test Restoration Test Regression Test End-to End Test
Project Management	Assist in the development of a business case with the PMO. Engage with the PMO in identifying potential projects. Provide & Manage resources to projects to conduct previously outlined services Provide a State of Maine project manager if required. Provide portfolio management services.	Engage with the PMO in the execution of projects. Supply subject matter expertise. Supply user acceptance testing	Provide a project manager for implementation projects
Database Access CRUD	Ensure the principles of Least Privilege are followed	Follow principles of Least Privilege Read data in the database	Follow principles of Least Privilege Create objects in the database Read data in the database Update data in the database Delete data in the database

SLA

Application uptimes and recovery times are covered through the contract with the vendor which should include at a minimum all MaineIT’s policies including but not limited to the Remote Hosting Policy. Off-hour production application support can be arranged through the contracting process.

For services that are not contractually hosted or supported by the vendor, the uptimes and recovery times are covered by the standard production published service level agreement for the MaineIT area providing that service. These can be viewed at the following link: Standard SLA CTS Production Services.

Because the needs of each application are quite varied and platform dependent, each constituent piece of the solution is managed by its own SLA. For instance, if a database is hosted in Maine’s Oracle environment the SLA for Oracle databases is relevant. If the application’s database is hosted in a vendor provided cloud environment the vendors contractual SLA applies.

How To Start

For a new application acquisition contact MaineIT Enterprise Shared Services Directors to get started.

A ticket in the Enterprise Ticketing System is required for all non-production work requests. All production work requests require an authorized RFC. If applicable, a billing code is required for those items that are not part of the base published rate.

If the published Service Level Agreement is not met, issues can be escalated to the next priority level by contacting any of the following individuals:

The Enterprise Shared Services Director responsible for your application, or your friendly Account Managers.

Priority Levels for Monitoring

The standard production published service level agreement can be viewed at the following link: Standard SLA Maine IT Production Services.
Standard business hour coverage is 7:00AM – 5:00PM Monday through Friday, excluding holidays, please contact MaineIT Operations.
If service is required for non-production systems outside of the standard business hours, prior arrangements will be required with the director of the service area and associated fees will apply.
Contracted Service Levels apply for vendor provided support.

On the Bill

For staff time the service category used is either Personnel Services or Personnel Services – Non State Resource. Infrastructure could be SQL Database Services, Oracle Database Services, Storage or another service such as Tableau. Technology vendors may be billed directly or through MaineIT billing depending on the contract.