02 - Scope of Work.docx

Request for Proposals for INFORMATION SECURITY SERVICES: Credit Monitoring Services Issued by the State of Idaho Solicitation Number: RFP Event 25

Attachment 2

SCOPE OF WORK

This Scope of Work describes the Deliverables being sought through this RFP and the scope of what Contractors will be expected to offer through a Master Agreement resulting from this RFP. The Scope of Work is intended to provide interested Offerors with sufficient basic information to submit a proposal. It is not intended to limit a proposal's content or exclude any relevant or essential data.

Overview and Definitions - The following definitions apply to this RFP and the Master Agreement(s) resulting from this RFP:

A. Active Participant: An Eligible Person that voluntarily elects to activate their participation by agreeing to use the Notification and Credit Monitoring Services.

B. Adequate Security: Security commensurate with the risk and the magnitude of harm resulting from the loss, misuse, or unauthorized access to or modification of information.

C. Breach or Data Breach: A security incident in which sensitive, protected or confidential Data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so. (This definition is to be considered to be a baseline definition. Participating Entities may further define this term within their individual Participating Addenda).

D. Breach Response Specialist: A specialized role, performed by an attorney, in responding to a Data Breach or other cyber incident.

E. Computer Security Incident Response Team (CSIRT), Computer Incident Response Team (CIRT), or CIRC (Computer Incident Response Center or Computer Incident Response Capability): A capability set up for the purpose of assisting in responding to computer security-related incidents.

F. Data: All information developed, documented, derived, stored, installed or furnished by the Purchasing Entity under a Participating Addendum, including all information related to records owned by or in the possession of the Purchasing Entity. (Data may include PII.)

G. Eligible Person: Every individual or business that meets the criteria established by a Participating Entity to qualify for the Notification and Credit Monitoring Services. The Participating Entity will have sole discretion to determine who qualifies as an Eligible Person.

H. Event: Any observable occurrence in a network or system.

I. Incident, Cyber Security Incident, or Security Incident: A violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices in order to affect a system, application, or network’s integrity or availability and/or the unauthorized access or attempted access to a system or systems.

J. Incident Handling: The mitigation of violations of security policies and recommended practices.

K. Incident Manager: The individual who manages the process to restore normal service operation as quickly as possible to minimize the impact to business operations. Responsible for planning and coordinating all the activities required to perform, monitor, and report on the process.

L. Mandatory (M) & Mandatory Evaluated (ME): (M) is a requirement of the subsequent agreement. (ME) requires a response which is evaluated by the evaluation team. Offerors who do not provide a response to a (ME) section may be found non responsive.

M. Personally Identifiable Information or PII: Information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual.

N. Threat: The potential source of an adverse event; the possibility of a malicious attempt to damage or disrupt a computer network or system.

O. Triggering Event: A Breach or suspected Breach of PII, or any other circumstance which results in a Participating Entity activating Notification and Credit Monitoring Services under the Master Agreement (through a Participating Addendum).

P. Vulnerability: A weakness in a system, application, or network that is subject to exploitation or misuse.

I. (M) Master Agreement Objectives

a. The purpose of this RFP is to establish one or more Master Agreements for Notification and Credit Monitoring Services, a category of the existing cooperative portfolio for Information Security Services.

b. Purchasing Entity may decide, in its sole discretion, to begin using the services described in the Master Agreement for Notification and Credit Monitoring Services at any time during the term of the Master Agreement and Participating Addendum.

II. (ME) Offeror’s Experience and Qualifications

Describe in detail how you will meet the requirements of Section II. Follow the order of this section, and, within your response, include the section numbers (and headings, if any) followed by your response to each particular section identifier.

a. Describe your company’s experience demonstrating that your company has a minimum of five (5) years of experience providing services similar in scope and size to the Notification and Credit Monitoring Services required in the Scope of Work. Provide specific examples that illustrate the specific services furnished and the size, composition, etc. of the entities for whom you have provided services that you are using to demonstrate that your experience meets this minimum requirement.

III. (ME) Identity Restoration Personnel – Experience and Qualifications

Describe in detail how you will meet the requirements of Section III. Follow the order of this section, and, within your response, include the section numbers (and headings, if any) followed by your response to each particular section identifier.

a. All identified restoration personnel must be highly trained, have excellent customer service skills, and be able to communicate clearly in English. Describe in detail the minimum experience, qualifications and training you will require for identity restoration representatives servicing the NASPO ValuePoint Master Agreement. (If you intend to use a subcontractor or subcontractors for all or any part of meeting the requirements for identity restoration personnel, subcontractor staff members must meet the minimum qualifications and training requirements that you identify in your response to this attachment).

IV. (ME) Call Center Customer Service Representatives and Qualifications

Describe in detail how you will meet the requirements of Section IV. Follow the order of this section, and, within your response, include the section numbers (and headings, if any) followed by your response to each particular section number.

a. All call center customer service representatives must have excellent customer service skills and be able to communicate clearly in English. Describe in detail the minimum qualifications and training for call center customer service representatives to be used in servicing the NASPO ValuePoint Master Agreement. (If you intend to use a subcontractor or subcontractors for all or any part of meeting call center requirements for Notification and Credit Monitoring Services, their staff members must meet the minimum qualifications and training requirements that you identify in your response to this section.

V. (ME) Offeror’s Experience with Statewide or Large Consortium Contracts

Describe in detail how you will meet the requirements of Section V. Follow the order of this section, and, within your response, include the section numbers (and headings, if any) followed by your response to each particular section number.

a. Describe in detail your company’s experience with statewide or large consortium contracts similar to the Master Agreement for Notification and Credit Monitoring Services sought through this RFP. Provide the approximate dollar value of the business’ three (3) largest contracts in the last five (5) years, under which the business provided services identical or very similar to those required by this RFP.

VI. (M) Subcontractors

a. All Offerors must identify whether or not they intend to provide all services directly or through the use of subcontractors. If you do intend to use subcontractors, describe the extent to which you intend to use subcontractors to perform contract requirements, and clearly delineate the categories.

b. Subcontractors are only permitted with written approval from the Lead State and must meet or exceed all minimum requirements in this RFP. Approval by the Lead State of the Contractor’s request to subcontract or acceptance of or payment for subcontracted work by a Participating Entity shall not in any way relieve the Contractor of any responsibility under the Master Agreement and Participating Entity’s Participating Addendum. The Contractor shall be and remain liable for all damages to a Participating Entity caused by negligent performance or non-performance of work under the Master Agreement and Participating Entity’s Participating Addendum by the Contractor’s subcontractor. Subcontractor(s) must maintain the same types and levels of insurance as that required of the Contractor under the Master Agreement; unless the Contractor provides proof to the Lead State’s satisfaction that the subcontractor(s) are fully covered under the Contractor’s insurance, or, except as otherwise authorized by the Lead State.

VII. (ME) Customer Service Response Requirements and Contract Manager Requirements

Describe in detail how you will meet the requirements of Section VII. Follow the order of this section, and, within your response, include the section numbers (and headings, if any) followed by your response to each particular section number.

a. Describe your customer service hours of operation and when key account staff are available.

b. Describe how you handle problem identification and resolution. Describe how you respond to and resolve customer complaints and service issues.

c. Describe how you will assess customer satisfaction.

d. The Contractor must provide a Contract Manager as the single point of contact for management of the NASPO ValuePoint Master Agreement, administered by the state of Idaho. The Contract Manager must have experience managing contracts for services similar to those required in this RFP. Describe in detail your proposed Contract Manager’s experience managing contracts for services similar to those required in this RFP. Provide a detailed resume for the proposed Contract Manager. Additionally, provide the name, phone number, email address, and work hours of the person who will act as Contract Manager if you are awarded a Master Agreement.

e. Describe in detail the roles and responsibilities of the Contract Manager as they apply to the requirements of this RFP.

VIII. (M) Master Agreement Deliverables

a. (M) Contract Manager

i. The Contractor must provide a Contract Manager as the single Point of Contact (POC) for management of the NASPO ValuePoint Master Agreement, administered by the State of Idaho.

b. (M) Participating Entity Point of Contact

i. The Contractor must provide a single POC for each Participating Entity. The POC must be available during the regular business hours of the assigned Participating Entity. The Contractor may assign the same POC to more than one Participating Entity.

c. (M) Quarterly Status Updates and Annual Supplier Review Conferences

i. The Contractor must attend Quarterly Status Update Conferences with the Lead State to review contract issues and/or the Contractor’s performance. The Contractor must annually complete and submit the NASPO ValuePoint Contractor Workbook and attend an Annual Supplier Review Conference. Conferences may be held in Boise, Idaho, or by conference call, at the option of the Lead State.

d. (M) Participating Addendum Services

i. A Purchasing Entity may decide, in its sole discretion, to begin using the services described in the Master Agreement at any time during the term of the Master Agreement and Participating Addendum.

ii. A Participating Entity must not execute a Participating Addendum to a Contractor for a Category for which the Contractor has not been awarded a Master Agreement.

e. (M) Security of Information

i. Protection of Data must be an integral part of the business activities of the Contractor to ensure that there is no inappropriate or unauthorized use of Data at any time. To this end, the Contractor must safeguard the confidentiality, integrity, and availability of Data and comply with the following conditions:

ii. All Purchasing Entity Data obtained by the Contractor under a Participating Addendum must become and remain property of the Purchasing Entity.

iii. At no time shall any Data or processes which either belong to or are intended for the use of the Purchasing Entity or its officers, agents, or employees, be copied, disclosed, or retained by the Contractor or any party related to the Contractor for subsequent use in any transaction that does not include the Purchasing Entity.

iv. The Contractor must meet or exceed the requirements of the Purchasing Entity’s security policies, standards, and regulatory and contractual obligations as defined in the Participating Entity’s Participating Addendum and Purchase/Work Order. The Contractor must have security measures in place to ensure that a Purchasing Entity’s sensitive or protected information and/or Data at rest, in use, or in transit is not compromised through a breach* of the Contractor’s system and/or applications.

v. The Contractor must notify the Purchasing Entity of any suspected or actual Breach of the Purchasing Entity’s or Active Participant’s Data immediately upon discovery.

vi. The Contractor must be AICPA SOC 2 compliant or maintain equivalent security controls that cover the security, availability, processing integrity, and confidentiality of Data. The Contractor must keep all information regarding the Purchasing Entity, Eligible Persons and Active Participants, whether obtained from the Purchasing Entity, from Eligible Persons, or through performance of the services under the Master Agreement, confidential and secure and additionally must dispose of all information in a manner that meets or exceeds the AICPA SOC 2 standards, available at https://us.aicpa.org/interestareas/frc/assuranceadvisoryservices/serviceorganization-smanagement

vii. The Contractor must provide the Lead State with the results of the SOC 2 type 2 or equivalent audit of its development and operational practices, conducted within the last two (2) years and including all management comments and plans to correct identified deficiencies upon request. If the Contractor has not yet completed a SOC 2 type 2 or equivalent audit, the Contractor must inform the Lead State of the date when the results will be provided, not more than six (6) months following Master Agreement award.

viii. The Lead State may terminate the Master Agreement for the Contractor’s failure to provide the audit results requirements in this section within the timeframe specified in this section.

ix. The Contractor must continue to complete SOC 2 type 2 or equivalent audits at least one (1) time every two (2) years throughout the term of the Master Agreement and must provide the results to the Lead State within six (6) months of completion of the audit.

x. The Contractor must contact the Purchasing Entity immediately upon receipt of any electronic discovery, litigation holds, discovery searches, expert testimony, or other similar requests which in any way might reasonably require access to the Purchasing Entity’s Data.

xi. The Contractor must not respond to subpoenas, service of process, and other legal requests related to the Purchasing Entity without first notifying the Purchasing Entity unless prohibited by law from providing such notice.

xii. The Purchasing Entity owns all rights, title and interest in its Data that is related to the services provided under any Order. The Contractor must not access the Purchasing Entity’s user accounts or Data, except (i) in the response to service or technical issues, (ii) as required by the express terms of the Order, or (iii) at the Purchasing Entity’s written request.

IX. (ME) NOTIFICATION AND CREDIT MONITORING SERVICES

Describe in detail how you will meet the requirements of Section IX. Follow the order of this section, and, within your response, include the section numbers (and headings, if any) followed by your response to each particular section number.

a. (ME) Orders

i. A Purchasing Entity may customize services ordered. The Contractor must maintain the ability to provide all services available under this Notification and Credit Monitoring Services throughout the term of the Master Agreement. A Purchasing Entity may elect to use a limited selection of services rather than all services provided under this Notification and Credit Monitoring Services. For example, a Purchasing Entity may activate Call Center and Credit Monitoring and Identity Theft Monitoring services but not Notification services.

ii. Each Purchasing Entity has sole discretion to determine if and when it will activate services and to define the eligibility requirements for Eligible Persons to register for the services provided under the Master Agreement and Participating Addendum.

iii. Activation of services shall commence upon written notification to the Contractor by a Purchasing Entity.

iv. The Purchasing Entity will provide the Contractor with a list of apparent Eligible Persons as detailed below in IX.b.

v. The Purchasing Entity may provide a Frequently Asked Question (FAQ) script to ensure the Contractor’s staff provide consistent responses to inquiries about a Triggering Event. When an FAQ is provided by the Purchasing Entity, the Contractor shall direct its staff in its use.

b. (ME) Notifications

i. The Contractor must meet each state’s unique rules governing the need to notify affected persons of Triggering Events, including content and timing requirements.

ii. Upon issuance of an Order, the Contractor must work with each Purchasing Entity to develop a sample Notification Plan and template based on each Purchasing Entity’s requirements in order to facilitate timely notification in the event of a Triggering Event.

iii. The Notification Plan may include information including but not limited to:

iv. An overview of the Purchasing Entity’s requirements;

v. A general timeline for the Purchasing Entity notifying the Contractor of the Triggering Event, the Purchasing Entity providing information to the Contractor, and the Purchasing Entity determining whether or not the Contractor will send notifications to affected persons;

vi. A notification template that the Contractor may use to develop notices to send to affected persons, or to customize for a specific Triggering Event, at the option of the Purchasing Entity;

vii. A general timeline for the Purchasing Entity approving the draft notification and the Contractor sending the notifications; and

viii. The Purchasing Entity’s selected method of sending notifications.

ix. The Notification Plan and template must be approved by the Purchasing Entity and in place within sixty (60) calendar days of execution of an Order. If a Triggering Event occurs prior to the development and approval of a Notification Plan and template, the Contractor must immediately work with the Purchasing Entity to make the required timely notifications.

x. Upon notification by a Purchasing Entity that a Triggering Event has occurred which requires notifications, and at the option of the Purchasing Entity, the Contractor must intake, review, and data cleanse the Purchasing Entity-furnished data set of identified apparent Eligible Individuals which includes but is not limited to review of National Change of Address (NCOA).

xi. The Contractor shall remove repetitive information for the same individual (de-duplicate the Data) and provide a final notification list and a duplicate list (names removed during the de-duplication process) to the Purchasing Entity for approval within seven (7) calendar days of receipt of the data set and prior to sending notifications.

xii. Upon notification by a Purchasing Entity that a Triggering Event has occurred which requires notifications, and at the option of the Purchasing Entity, the Contractor must prepare, print (if notification by mail is ordered), and send all notifications via the delivery method specified by the Purchasing Entity.

xiii. The Purchasing Entity shall provide written approval of any notice prior to it being sent.

xiv. The Purchasing Entity shall approve the final notification list (if data cleansing is ordered by the Purchasing Entity) or otherwise provide a list of names and address, in Microsoft Excel or another mutually agreeable file format, of persons to whom the notification must be sent.

xv. The Contractor must send notifications within the timeframe required by the Purchasing Entity’s laws and regulations.

xvi. The Contractor shall only use the contact information provided by the Purchasing Entity to send the required notifications, unless the Purchasing Entity agrees in writing to allow the Contractor to send additional materials or make additional contact.

c. (ME) “Codes Only” Reduced Scope Service

i. The Contractor must also provide, as an alternative to full enrollment in the services described above, a “codes only” reduced scope service (triple bureau) in which the Contractor issues a list of PINs (unique activation codes) upon request by a Participating Entity, which can be used by Eligible Persons on a per-occurrence basis. The PINs must be valid for redemption for a minimum of ninety (90) calendar days from the date of issuance. Eligible Persons must have the option to enroll online via the Contractor’s website, or offline via toll free telephone number.

d. (ME) Call Center

i. The Contractor must provide a call center that may be reached via toll free number 24x7, every day of the year.

ii. The Contractor must clearly identify to callers the method to access services for each distinct Triggering Event.

iii. Staff at the call center must answer questions regarding services, eligibility, and enrollment in a courteous and professional manner, using the FAQ script, if one is provided by the Purchasing Entity. Additionally, all calls to the call center must be answered by a call center staff member within one (1) minute of the call being placed.

e. (ME) Customer Service Requirements

i. The Contractor must provide the highest quality of customer service to each Eligible Person and Active Participant. All customer service representatives must treat all Eligible Persons and Active Participants with respect and offer assistance in resolving any issues, concerns, or complaints.

ii. If the customer service representative cannot adequately address the concerns of an Eligible Person or Active Participant, the concern must be elevated according to the agreed-upon Service Level Agreement (SLA).

iii. The Contractor must provide resources to assist Eligible Persons and Active Participants in a manner consistent with the agreed-upon SLA; and Call centers and customer support personnel located within the United States.

f. (M) Credit Monitoring/Identity Theft Protection

The Contractor must provide the following minimum services (Section f. below) to all Active Participants:

(ME) Enrolling Eligible Persons

i. When a Purchasing Entity notifies the Contractor to activate services, the Purchasing Entity will provide a list including names and addresses of all Eligible Persons.

ii. The Contractor must begin enrolling Eligible Persons who choose to become Active Participants as soon as it receives the list.

iii. At a minimum, the Contractor must provide Eligible Persons the option to enroll by phone, mail, and online.

iv. The Contractor shall not require Active Participants to provide any information beyond the information typically required and essential to provide the contracted services.

v. The Contractor shall not automatically subscribe or enroll Active Participants in follow-on services, require Active Participants to enroll in follow-on services, or imply that follow-on services are otherwise required by Active Participants. Follow-on services are any additional services offered by the Contractor that are not included in the Master Agreement or Participating Addendum.

vi. The Contractor must terminate services to each Active Participant at the end of each Enrollment Term.

vii. There must not be an automatic renewal of the service to the Active Participant. The Contractor must notify each Active Participant in writing of the upcoming service termination no later than one (1) month before the expiration of the Enrollment Term.

g. (M) Enrollment Term

i. Eligible Persons that elect to become Active Participants shall receive Credit Monitoring, Identity Theft Monitoring and alerts/notifications for a period of one (1) year. The Purchasing Entity may elect to provide Active Participants services for additional period(s) of not less than one (1) year each. Upon the expiration of the Enrollment Term between the Contractor and an Active Participant, the Contractor must dispose of all of the Active Participant’s information by a secure method.

h. (ME) Credit Monitoring

i. The Contractor must provide daily monitoring of one (1) or three (3) of the three (3) major credit bureaus, depending on the level of services elected by the Purchasing Entity. The Contractor must monitor for activity including, but not limited to, new lines of credit and credit inquiries.

i. (ME) Identity Theft Monitoring

i. The Contractor must provide monitoring designed to detect theft of an Active Participant’s identity. Examples of such monitoring include but are not limited to monitoring of new accounts, public records, address changes, non-credit/payday loans, and scanning of underground/black market websites for use of protected information.

j. (ME) Alerts/Notifications

i. The Contractor must provide alerts/notifications to Active Participants related to anomalous or suspicious activities identified by the Contractor through the Contractor’s Credit Monitoring and Identity Theft Monitoring. The Contractor must notify Active Participants via the notification method identified by the Active Participant within twelve (12) hours of identifying the activity.

k. (ME) Identity Theft Restoration Assistance

i. The Contractor must provide identity theft restoration assistance to any Active Participant who becomes a victim of identity theft while enrolled in Credit Monitoring and Identity Theft Monitoring services, even if the identity theft is not discovered until after the Credit Monitoring and Identity Theft Monitoring services have expired. At a minimum, the Contractor must:

ii. Provide access to a contact center available 24x7, every day of the year, that can provide identity theft resolution customer care services. Individuals staffing this contact center must be trained and experienced in assisting customers with understanding their credit reports and restoring their credit; automated responses will not satisfy this requirement.

iii. Review occurrences of identity theft and provide an initial course of action within forty-eight (48) hours of the report of the occurrence.

iv. Provide one-on-one counseling to assist Active Participants with resolving any identity theft problems, such as contacting the Active Participant’s creditors and others in order to resolve the identity theft problem on the Active Participant’s behalf.

v. Continue providing restoration assistance until the Contractor and Active Participant agree that the identity theft issues have been resolved or the Contractor has exhausted the insurance policy.

l. (ME) Identity Theft Insurance

i. The Contractor must provide insurance to all Active Participants for loss due to identity theft, which meets the following minimum requirements:

ii. Not less than one million dollars ($1,000,000) in coverage for each Active Participant.

iii. Coverage for at least the following losses which result solely from the theft of the individual’s identity:

iv. Costs associated with re-filing applications including but not limited to loan applications and grants applications that were denied because of the identity theft.

v. Costs for notarizing affidavits, long-distance calls, and postage required to restore the individual’s identity.

vi. Costs for six (6) credit reports within the twelve (12) months following the theft.

vii. Lost wages resulting from the need to take time off from work in order to engage in identity restoration activities. Lost wages include reimbursement of paid time off (e.g. vacation, annual leave, etc.) taken for the purpose of engaging in identity restoration activities.

viii. Legal fees incurred in the defense of a civil suit against the Active Participant for non-payment, which suit resulted from the identity theft, or for removal of a judgment against the Active Participant that resulted from the identity theft.

ix. In the event the Contractor’s underlying policy for identity theft insurance is terminated, the Contractor must notify all Active Participants and must have another policy of equal value in place immediately upon termination to ensure that no coverage gaps exist.

x. Identity theft insurance requirements extend to any identity theft that occurs while the Active Participant is enrolled, even if the identity theft is not discovered until after the Credit Monitoring and Identity Theft Monitoring services have expired.

m. (ME) Reporting

i. Monthly Usage Reports

The Contractor must provide monthly usage reports to each Purchasing Entity that has activated services, in a format acceptable to the Purchasing Entity. Information that must be contained within usage reports includes but is not limited to the following:

1. Number of Active Participants (including type of service);

2. Aggregate count of Active Participants;

3. Number of credit monitoring alerts issued by type;

4. Number of identity theft alerts issued by type;

5. Number and types of corrective action(s) taken for identify theft protection and identity theft resolution;

6. Number of telephone calls from either Eligible Persons or Active Participants (separately identified) answered by the Contractor’s call centers;

7. Average “wait time” experienced by callers before speaking to the Contractor’s representatives; and

8. Number of identity theft insurance claims filed by Active Participants.

n. (ME) Ad Hoc Reporting

i. Upon request by the Purchasing Entity, the Contractor must provide ad hoc reporting. Unless prohibited by law, requested data may include, but is not limited to names, addresses, and email addresses of Active Participants.

o. (ME) Identity Restoration Personnel

i. The Contractor must ensure all identity restoration personnel that provide services are trained experts in the field relevant to the services ordered.

X. (ME) NOTIFICATION AND CREDIT MONITORING SERVICES – VALUE ADD SERVICES

Describe in detail how you will meet the requirements of Section X. Follow the order of this section, and, within your response, include the section numbers (and headings, if any) followed by your response to each particular section number.

a. Offerors who can supply value-add services beyond what is required should describe those value-add services enter the cost(s) for such within their Cost Proposals.

b. Proposed Value Add Options may become part of the Master Agreement, at the Lead State’s sole option. Proposed value-add services that become part of the Master Agreement will then be accessible by Purchasing Entities, as long as the Participating Addendum contemplates the proposed value-add services.

XI. (M) COST

a. Discounts to Remain Firm or Greater

i. Any percentage discount from the Contractor’s submitted price schedule is not to decrease for all updates or revisions of Contractor’s price schedule during the life of the Contract and any subsequent contract renewals; however, Contractor may increase the discount at any time. New items or replacement products are to be discounted at the same (or greater) rate as similar products or replaced items.

b. Price List Access

i. At any time during the Contract and for a three (3) year period following the end of the Contract, the State reserves the right to request from the Contractor access to and/or a copy of the applicable price list used for the Contract’s pricing basis for Contract pricing verification. Failure to provide the requested price list within three (3) business days following the State’s request may result in Contract termination.

c. (M) Price Changes

i. Price decreases or discount increases are permitted and encouraged at any time. Any price reductions announced by a manufacturer must be applied at the time of the announcement for the products that have not yet been delivered to the Participating Entities.

ii. All discounts offered must remain firm or higher during the term of the contract.

iii. Price lists may be updated no more often than quarterly. Updated price lists may include new items but may not increase the price of items that have previously appeared. Price increases must be calculated from the published price list and may only be requested in accordance with changes made by the manufacturer or distributor in their established, nationally distributed price list or published catalog. The Lead State reserves the right to accept or reject any proposed price increase. A price increase will not be effective until approved, in writing, by the Lead State.

d. (M) Audit Rights

i. The Contractor agrees to allow State and Federal auditors and State purchasing staff access to all the records relating to this Contract for audit, inspection, and monitoring of services or performance. Such access will be during normal business hours or by appointment.

e. (M) Change In Contractor Representative

i. The Lead State Procurement Officer, at his/her sole discretion, may require a change in Contractor’s Named Representative by giving written notice to Contractor.

f. (M) Contractor Insurance Requirements

i. The Contractor shall minimally meet insurance requirements as defined in the Sample Master Agreement. Participating Entities may have different insurance requirements.

Attachment 2, SCOPE OF WORK image1.png image2.png