00011717_CloudRFQ - Varonis_FINAL.docx

REQUEST FOR QUOTES (RFQ)

Cloud Solutions Providers

Issue Date: 11/18/2024

Issued To:

bartek.kurek@lumen.com

TeamOregon@SHI.com

dmitchell@smxtech.com aratchford@smxtech.com

Issuing Office: Oregon Department of Transportation

Authorized Purchaser Contact Information:

OFFER DUE DATE AND TIME: 11/25/2024 at 2:30pm

NOTE: The Oregon Department of Transportation is committed to complying with all statutory requirements to ensure that it is providing information that is more accessible to people with disabilities, as required by Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C. 794d), and 36 C.F.R. 1194 Appendix A. This includes information regarding the solicitation process. Please contact the Authorized Representative identified in OregonBuys (see “Buyer”) to request reasonable accommodation for access, due to a disability, to information related to this solicitation, or the solicitation process, or both. Accommodation requests must be received by the Authorized Representative 3 business days prior to the Proposal Submission Deadline (see “Bid Ending Date” and time in OregonBuys).

1. Introduction:

The Oregon Department of Transportation (“ODOT” or “Authorized Purchaser”) is issuing this Request for Quote (“RFQ”) for a Contractor to provide the Varonis data security products listed in Exhibit 1 (Varonis Software Product Specifications).

It is anticipated that 1 Offeror will be selected for a contract from this solicitation.

The resulting contract is estimated to end 5 years from date of execution and may be amended to add additional time.

2. Background Information:

The purpose of this RFQ is to procure a Cloud Solution for the Varonis data security products listed in Exhibit 1 (Varonis Software Product Specifications).

Brand Name Justification: On or about November 7, 2024, ODOT made a brand name determination to acquire the Varonis data security products listed in Exhibit 1 due to the need to integrate with ODOT’s data currently stored within Varonis on-premises software.

Scope of Services:

Offeror shall provide the Software necessary to meet stated needs, in accordance with ODOT standards as described in the Varonis Software Products Specifications (Exhibit No. 1).

The selected Contractor and ODOT will negotiate the deliverable schedule, license terms, ODOT rider to software license terms (if applicable) and costs, within the scope of what is requested here along with the Privacy and Security Requirements set forth in (Exhibit 3) attached to this RFQ for inclusion in the final contract. The Software included in the final contract is contingent upon ODOT’s need at the time of execution, and may reduce, increase or remove anticipated quantities and deliverables requested here.

3. Questions and Requests for Clarification:

All questions and requests for clarification regarding this RFQ must be submitted in writing through e-mail to Michael Day at Michael.day@odot.oregon.gov and must be received no later than 11/20/2024 at 2:30pm.

ODOT may issue revisions, substitutions or clarifications of the RFQ. ODOT will send revisions, substitutions or clarifications, if any, electronically to the above referenced PA Holders.

3.1 Addenda:

Answers to questions ODOT receives and that ODOT, in its sole discretion, determines are substantive and provide new information, will be issued as official Addenda to this RFQ via OregonBuys. When appropriate, as determined by ODOT in its sole discretion, revisions, substitutions, or clarifications of the RFQ will be issued as Addenda to this RFQ. Changes or modifications to this RFQ will be binding on ODOT only if in the form of written Addenda issued by ODOT. ODOT will provide any Addenda to all firms who have received this RFQ.

4. Offer Submittal:

Offers must be received on or before the Offer Due Date and Time identified above via OregonBuys to be considered. Offers submitted by any other means will be rejected. Offerer is solely responsible for ensuring its Offer and all required submittal items are submitted through OregonBuys on or before the Offer Due Date and Time.

Offerers may submit any software terms and conditions or other license agreements outside of the PA for the Software listed in Exhibit 1 as a separate attachment using the Attachment tab in OregonBuys.

Any software terms and conditions or other license agreements outside of the PA are negotiable under this RFQ.

ODOT, in its sole discretion, may extend the Offer Due Date and Time. Offers will not be accepted after the Offer Due Date and Time.

ODOT is not responsible for any delays by transmission errors, or delays for any mis delivery for any reason.

ODOT may reject all Quotes or decide to cancel this RFQ if, in its sole determination, it is in the best interest of ODOT.

5. Submittal Requirements:

a. Offers must include submission of the Pricing Sheet (Exhibit No. 2) as an attachment via the Attachments tab in OregonBuys. The Pricing Sheet must be signed by an authorized representative of the Offeror.

5.1. Submitted Offers are subject to disclosure as public records:

If an Offeror includes information and data with its submitted Offer that Offeror regards as proprietary, privileged, or otherwise confidential, Offeror must identify such information and the reason for such protection in a separate document submitted with its Offer and provide a redacted submission along with the original submission. Otherwise, State Parties will assume that Offeror consents to public disclosure of the original submission.

6. Evaluation and Award:

ODOT, in its sole discretion, may reject all Offers or cancel this RFQ at any time.

Submissions will be reviewed to determine if all Submittal Requirements have been met. Those meeting the Submittal Requirements will be evaluated to determine the lowest responsive and responsible Offer for the State.

ODOT’s determination is final.

The Offeror with the lowest responsive and responsible Offer will be awarded a contract in a form substantially similar to the Sample Purchase Order attached as Exhibit 4 to this RFQ. ODOT may negotiate contract terms and conditions with the successful Offeror.

ODOT may award all or a portion of the Software and Cloud Services requested, in its sole discretion.

Exhibit No. 1 Varonis Software Product Specifications

The following is a list of Varonis data security software ODOT intends to purchase under this RFQ:

1. Varonis for Active Directory (SaaS) User Band -4001-6000 Part #: Varonis Systems Inc - VAD-4001-6000SA

1. Varonis for Windows/Network Attached Storage (“NAS”) (SaaS) User Band - 4001-6000 Part #: VWIN-4001-6000SA

· Includes QTY 13 of Extended Event Retention

· 1 Year SaaS Subscription for 13M Daily

· Events for 12 Months Part #: VWIN-4001-6000SA

1. Collector Operating System (“OS”) User Band 11-15 Part #: Varonis Systems Inc - CL-11-15OS, management/administration required

Exhibit No. 2 Pricing Sheet Offerer must complete and sign this Pricing Sheet (Exhibit 2) and upload as an attachment in Oregon Buys in order for offer to be considered.

Pricing should reflect costs for 1 year for each item listed at the quantity indicated.

USER BAND 4001-6000

VARONIS SYSTEMS INC - VAD-4001-6000SA

USER BAND 4001-6000

VARONIS SYSTEMS INC. - VWIN-4001-6000SA

· INCLUDES QTY 13 OF EXTENDED EVENT RETENTION

· 1 YEAR SAAS SUBSCRIPTION FOR 13M DAILY

· EVENTS FOR 12 MONTHS

VARONIS SYSTEMS INC - CL-11-15OS

Signature of Offeror Authorized Representative Date

Exhibit No. 3 Privacy and Security Requirements

In addition to the confidentiality, security, and data privacy requirements in the Participating Addendum, Contractor’s obligations under this contract include the requirements of this exhibit.

1. PURPOSE. The terms and conditions of this Privacy and Security Requirements exhibit address:

1.1. Contractor’s Use of ODOT Data;

1.2. Contractor’s access to State systems and networks;

1.3. Contractor’s Services and delivery of the Services; and

1.4. The periodic exchange of ODOT Data between ODOT’s and Contractor’s systems via electronic means.

2. COMPLIANCE REQUIREMENTS.

2.1. Compliance with Laws, Regulations, and Policies. Contractor and its employees, consultants, and agents shall comply with all applicable state and federal laws and regulations, and State of Oregon policies governing use and disclosure of data and access to State of Oregon networks and information systems, including as those laws, regulations, and policies may be adopted and updated from time to time. Applicable laws, regulations, and policies include but are not limited to:

2.1.1. The Oregon Consumer Information Protection Act, ORS 646A.600 through 646A.628 (OCIPA). Contractor will have access to documents, records or items that contain “Personal Information,” as that term is used in ORS 646A.602(12), and which is subject to the protections of OCIPA. For purposes of OCIPA, Contractor is a vendor.

2.1.2. Oregon’s Statewide Information Security Standards: https://www.oregon.gov/eis/cyber-security-services/Documents/eis-css-statewide-information-technology%28IT%29-control-standards.pdf, including security controls that meet or exceed “Moderate” security controls in the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53.

2.1.3. Oregon’s Statewide Information Security Plan: https://www.oregon.gov/eis/cyber-security-services/Documents/eis-css-statewide-information-security-program-plan.pdf.

2.1.4. Oregon’s Statewide IT Policies: https://www.oregon.gov/das/Pages/policies.aspx#IT.

3. NOTIFICATIONS.

3.1. Breach Notification. In the event Contractor or its subconsultants or agents discover or are notified of an incident or a breach, including a failure to comply with Contractor’s confidentiality obligations under the Participating Addendum or this contract, Contractor shall notify the APM (or delegate) immediately, and in no event more than 24 hours following discovery or notification of the incident or breach. If the State determines that an incident or breach requires notification of ODOT clients, or other notification required by law, the State will have sole control over the notification content, timing, and method, subject to Contractor’s obligations under applicable law.

3.2. Requests for ODOT Data. In the event Contractor receives a third-party request for ODOT Data, including any electronic discovery, litigation hold, or discovery searches, Contractor shall first give ODOT notice and provide such information as may be reasonably necessary to enable ODOT to protect its interests.

4. PRIVACY OBLIGATIONS. In addition to Contractor’s obligations under the terms and conditions of the Participating Addendum and the contract:

4.1. Generally. Contractor shall hold all ODOT Data, and other information as to personal facts and circumstances obtained by Contractor on ODOT clients, as confidential, using the highest standard of care applicable to the data, and shall not divulge any ODOT Data without the written consent of the APM except as required by other terms of this Privacy and Security Requirements exhibit or applicable law.

4.2. Limited Purposes. Contractor shall limit the use or disclosure of ODOT Data to persons directly connected with the administration of the Participating Addendum and contract. Confidentiality policies apply to all requests from outside sources.

4.3. Privacy Protections. ODOT Data may include information, such as client records, subject to specified confidentiality protections under state or federal law. Contractor shall comply with laws, regulations, and policies applicable to the information, including as specified in the Participating Addendum and contract.

4.4. Training. Contractor’s employees, subconsultants, and agents who will access ODOT Data have received training on the privacy and security obligations relating to ODOT Data, including client records. Contractor shall provide periodic privacy and security training to its employees, subconsultants, and agents.

4.5. Responsible for Compliance. Contractor is responsible for the compliance of its employees, agents, and subconsultants with the Participating Addendum, and contract, including this Exhibit 4, and with any third-party licenses to which access is subject.

4.6. Privacy and Security Measures. Contractor represents and warrants it has established and will maintain privacy and security measures that meet or exceed the standards set in laws, rules, and regulations applicable to the safeguarding, security and privacy of ODOT Data, including client records, State networks, and information assets, regardless of the media. Contractor shall monitor, periodically assess, and update its security controls and risk to ensure continued effectiveness of those controls.

4.7. Security Risk Management Plan. Contractor shall ensure the level of security and privacy protection required in accordance with the Participating Addendum and contract is documented in a security risk management plan. Contractor shall make its security risk management plan available to the State for review upon request.

4.8. Audit Rights and Access. Contractor shall maintain records in such a manner as to clearly document its compliance with and performance under this Privacy and Security Requirements exhibit, and provide ODOT, the Oregon Secretary of State, the federal government, and their duly authorized representatives access to Contractor’s officers, agents, consultants, subconsultants, employees, facilities and records to:

4.8.1. Determine Contractor’s compliance with this Privacy and Security Requirements exhibit,

4.8.2. Validate Contractor’s written security risk management plan, or

4.8.3. Gather or verify any additional information ODOT may require to meet any state or federal laws, rules, or orders.

4.8.4. Access to facilities, systems, and records under this section will be granted following reasonable notice to Contractor. Records include paper or electronic form, system security logs, and related system components and tools (including hardware and software), required to perform examinations and audits, and to make excerpts and transcripts, including for data forensics.

5. ACCESS TO STATE SYSTEMS.

5.1. ODOT Review of Access Requests. If required for access to State networks and systems, ODOT will review requests and will:

5.1.1. Notify Contractor of the approval or denial of its request for each user for whom access has been requested;

5.1.2. Provide any unique log-on identifier required for authorized access;

5.1.3. Provide updates to approved inquiry processes and instructions to Contractor.

5.2. Contractor’s Responsibilities for User Accounts. Contractor shall facilitate completion of any forms for each person for whom access to state networks and systems is requested.

5.2.1. Contractor is responsible for all activities that occur through its access, including for any acts related to a lost or stolen user ID or password.

5.2.2. Contractor is responsible for ensuring information provided by its users is accurate, complete, and up to date.

5.2.3. Contractor shall immediately notify ODOT when a user, group of users, or Contractor, no longer requires access, whether due to changes in duties or due to changes in Contractor’s programs related to the Participating Addendum or contract.

5.3. Security and Disposal. Contractor shall maintain security of equipment, and ensure the proper handling, storage and disposal of all information assets accessed, obtained, or reproduced by Contractor and its users to prevent inadvertent destruction or loss. Contractor shall ensure proper disposal of equipment and information assets when authorized use ends, consistent with Contractor’s record retention obligations and obligations regarding information assets under the Participating Addendum and contract.

5.4. Prevention of Unauthorized Access. Contractor shall prevent any access to State of Oregon networks and information systems by its users that is not authorized in accordance with the Participating Addendum, contract, and applicable law, and shall implement and maintain safeguards to prevent unauthorized access.

5.5. No Overseas Access. Contractor shall not allow access to Agency Data from locations outside of the United States or its territories, nor allow use of any information asset in any country or in any manner prohibited by governing applicable law, rule, or policy.

5.6. Authorized Access and Use Only. No user may access or use ODOT Data for any purpose other than those specifically authorized through the Participating Addendum or contract.

5.6.1. Users shall not use access to obtain or attempt to obtain any ODOT Data or information assets not authorized or intentionally made available.

5.6.2. The use and disclosure of any information asset is strictly limited to the minimum information necessary to the exchange of ODOT Data between the parties.

5.6.3. Except as otherwise specified or approved by ODOT, neither Contractor nor its users may modify, alter, delete, or destroy any information asset.

5.7. Revocation or Termination of Access. Breach, or wrongful use or disclosure of ODOT Data or other Confidential Information by Contractor or its users, may cause the immediate revocation of the access granted though the contract, in the sole discretion of ODOT, or ODOT may specify a reasonable opportunity for Contractor to cure the unauthorized use or disclosure and end the violation, and terminate the access if Contractor does not do so within the time specified by ODOT. Legal actions also may be taken for violations of applicable regulations and laws.

5.8. No Unauthorized Distribution. Contractor shall not sell, make available, or provide ODOT Data or other Confidential Information in any form to any other persons or organizations, and shall not use ODOT Data or other Confidential Information for any purposes other than as allowed under the Participating Addendum or contract and applicable law.

5.9. No Impairment. Contractor shall not use this access in any manner which could damage, disable, overburden, or impair State of Oregon networks or information systems, or interfere with any other entity’s use or benefit of the network and information systems.

5.10. Prohibition on Data Mining. Contractor shall not capture, maintain, scan, index, share or use ODOT Data stored or transmitted by virtue of the Services, or otherwise use any data-mining technology, for any non-authorized activity. For purposes of this requirement, “non-authorized activity” means the data mining or processing of data, stored or transmitted through the Services or State systems, for unrelated commercial purposes, advertising or advertising-related purposes, or for any other purpose other than security analysis that is not explicitly authorized in the Participating Addendum or contract.

5.11. Incidents and Breaches. Contractor shall comply, and shall cause its subconsultants to comply, with any requirements for identifying and addressing a security incident or breach. This requirement applies regardless of whether the incident or breach was accidental or otherwise.

6. SUSPENSION OR TERMINATION.

6.1. ODOT may immediately revoke the access granted Contractor for Contractor’s failure to comply with the requirements of this Privacy and Security Requirements exhibit. In such event, ODOT will provide subsequent written notice to Contractor’s point of contact. ODOT may, to the extent it determines it is reasonable and able to do so, provide advance notice to Contractor to cure any deficiency or breach of this Privacy and Security Requirements exhibit.

6.2. Either party may terminate access under this Privacy and Security Requirements exhibit, and ODOT may modify access, upon written notice if there are changes to or revised interpretations of federal or state laws, rules, or regulations, or if either party has changes in policies that require such action.

7. RETURN OF ODOT DATA. Upon expiration or termination of the Participating Addendum or contract for any reason whatsoever, Contractor shall immediately deliver to ODOT all of ODOT’s information assets, including ODOT Data, that are in the possession or under the control of Contractor in whatever stage and in a format acceptable to ODOT.

7.1. Except as necessary to meet obligations under Participating Addendum, Section 9, Access to Records, Contractor shall not retain any copies of ODOT Data or other electronic Confidential Information. Contractor shall notify ODOT of any conditions that make returning all such ODOT property not feasible. Upon ODOT’s written acknowledgement that returning all ODOT Data and electronic Confidential Information is not feasible, Contractor shall purge or destroy retained ODOT Data and electronic Confidential Information in all its forms in accordance with the most current version of NIST SP 800-88 (or other agreed-upon standard) and on request provide ODOT with written certification of sanitization.

7.2. Contractor shall maintain protections required by law, the Participating Addendum or the contract for any retained ODOT Data and electronic Confidential Information for so long as Contractor (including through any subconsultant) retains it.

8. COSTS. Each party will bear its own costs related to the acquisition of all equipment, software, data lines or connections necessary for access to State of Oregon networks and information systems, unless otherwise agreed to by written agreement between the parties. Each party is responsible for securing compatible hardware, equipment, and software, and network connections. Each party is responsible for complying with the licenses for third party products, including software and services that allow access.

9. INTERPRETATION. Any ambiguity in this Privacy and Security Requirements Exhibit will be resolved to permit ODOT to comply with applicable privacy and security laws and State of Oregon and ODOT policies interpreting those laws.

10. SUBCONSULTANTS. Contractor shall ensure all subconsultants providing services related to this Privacy and Security Exhibit comply with its terms.

Exhibit No. 4 Sample Price Agreement

STATE OF OREGON

PURCHASE ORDER (PO) NO.

PAGE

Agency

PO Date

Delivery Date

Bid Number

Requisition No.

Contractor Name and Address

Bill To

Contractor FEIN

Ship To

FOB

Terms

Item

Description

Quantity

U/M

Unit Price

Extended Amt.

THIS PURCHASE ORDER IS PLACED AGAINST STATE OF OREGON PARTICIPATING ADDENDUM #_______. THE TERMS AND CONDITIONS CONTAINED IN THE PARTICIPATING ADDENDUM APPLY TO THIS PURCHASE AND TAKE PRECEDENCE OVER ALL OTHER CONFLICTING TERMS AND CONDITIONS, EXPRESS OR IMPLIED.

Sub Total

Freight

Authorized Agent/Approved Date

Total image1.png image2.png