120_Water_RFP_Clarification_.pdf

January 9, 2023

120 Water Audit, Inc d/b/a 120 Water

Attention: Paul, Schuler, Director Enterprise Sales

250 S Elm Street Zionsville, IN 46077

Sent by email: paul.schuler@120water.com

Re: Request for Clarification-Solicitation No. BPM004287- Statewide Asbestos, Lead, and Mold Consultant and Abatement Services, and Lead Service Line Consultant Services.

Dear Mr. Schuler, Thank you for participating in the above referenced Request for Proposal (RFP). Pursuant to A.R.S. 41-

2534, A.A.C. R2-7-C313, Clarification of Offers, the following is being submitted to your Firm as a respondent to the statewide asbestos, lead, and mold consulting and abatement services, and Lead

Service Line Consulting solicitation. A request for clarification is to provide a greater understanding of the offer. Clarifications are not negotiations and/or material changes to the request for proposal.

A request for clarification shall not be considered a determination that the offer is susceptible for award. The following questions are presented for your consideration and clarification is required and will be provided via a Google Meeting, and a written confirmation of all questions asked, including those that are not part of this document shall be provided to ADEQ, no later than 5:00 PM on January 13, 2023, Arizona local time. Details of the meeting are below:

Date: Thursday, January 12, 2023

Time: 11:00 -12:00 PM, Arizona time

Meeting Link: Video call link: https://meet.google.com/ntp-jfpy-vrc

Or dial: 2417-666-314 1(US) + PIN: 640 308 593 # mailto:paul.schuler@120water.com

Category A- Exhibit A- Revised Pricing Sheet (A copy of the pricing sheet submitted with the proposal is attached for your reference).

• Please walk the team through the Lead service line consultant technology line items

• Clarify the $900 one-time fee for Record Digitization line item

• Does the excavating line item include the following?

o site repair or permitting o Line repair if 120 water hits a water/sewer line o Backfilling?

Category B- Special Terms and Conditions

Due to the nature of 120 Water Audits proposed solution for a Lead Service Line Consultant services, the following Terms and Conditions will be incorporated into the solicitation and become part of any resultant contract, and are hereby presented for your review.

All exceptions taken to the Terms and conditions shall be submitted to the procurement officer in writing, utilizing the attached Attachment 4 Supplements no later than January 18, 2023 at 12:00PM, Arizona local time, clearly identifying the specific paragraphs of the terms and conditions where the exceptions occur.

Any exceptions not included in such a section shall be without force and effect in any resulting Contract unless such exception is specifically accepted by the Procurement Officer in a written statement. 120

Water Audit’s preprinted or standard terms will not be considered by the State as a part of any resulting

Contract

The following terms and conditions will be incorporated into and become part of any contract enter into upon and if awarded.

1. Data and Information Handling

1.1. Applicability. Article 1 applies to the extent the Work includes handling of any (1) State’s proprietary and sensitive data or (2) confidential or access-restricted information obtained from

State or from others at State’s behest.

1.2. Data Protection and Confidentiality of Information. Contractor warrants that it will establish and maintain procedures and controls acceptable to State for ensuring that State’s proprietary and sensitive data is protected from unauthorized access and information obtained from State or others in performance of its contractual duties is not mishandled, misused, or inappropriately released or disclosed. For purposes of this paragraph, all data created by Contractor in any way related to the Contract, provided to Contractor by State, or prepared by others for State are proprietary to State, and all information by those same avenues is State’s confidential information. To comply with the foregoing warrant:

1.2.1. Contractor shall: (a) notify State immediately of any unauthorized access or inappropriate disclosures, whether stemming from an external security breach, internal breach, system failure, or procedural lapse; (b) cooperate with State to identify the source or cause and respond to each unauthorized access or inappropriate disclosure; and (c) notify State promptly of any security threat that could result in unauthorized access or inappropriate disclosures; and

1.2.2. Contractor shall not: (a) release any such data or allow it to be released or divulge any such information to anyone other than its employees or officers as needed for each person’s individual performance of his or her duties under the Contract, unless State has agreed otherwise in advance and in writing; or (b) respond to any requests it receives from a third party for such data or information, and instead route all such requests to State’s designated representative.

1.3. Personally Identifiable Information. Without limiting the generality of paragraph 1.2, Contractor warrants that it will protect any personally identifiable information (“PII”) belonging to State’s employees or other contractors or members of the general public that it receives from State or otherwise acquires in its performance under the Contract. For purposes of this paragraph:

1.3.1. PII has the meaning given in the [federal] Office of Management and Budget (OMB)

Memorandum M-17-12 Preparing for and Responding to a Breach of Personally

Identifiable Information, January 3, 2017; and

1.3.2. “protect” means taking measures to safeguard personally identifiable information and prevent its breach that are functionally equivalent to those called for in that OMB memorandum and elaborated on in the [federal] General Services Administration

(GSA) Directive CIO P 2180.1 GSA Rules of Behavior for Handling Personally Identifiable

Information.

NOTE (1): For convenience of reference only, the OMB memorandum is available at:

https://dpcld.defense.gov/Privacy/Authorities-and-Guidance/

NOTE (2): For convenience of reference only, the GSA directive is available at:

https://www.gsa.gov/directive/gsa-rules-of-behavior-for-handling-personally-identifiable-information-(pii)-https://dpcld.defense.gov/Privacy/Authorities-and-Guidance/ https://www.gsa.gov/directive/gsa-rules-of-behavior-for-handling-personally-identifiable-information-(pii)-https://www.gsa.gov/directive/gsa-rules-of-behavior-for-handling-personally-identifiable-information-(pii)-

2. Information Technology Work

2.1. Applicability. Article 2 applies to any Invitation for Bids, Request for Proposals, or Request for

Quotations for "Information Technology," as defined In A.R.S. §18-101(6) “…all computerized and auxiliary automated information processing, telecommunications and related technology, including hardware, software, vendor support and related services, equipment and projects,” if and to the extent that the Work is or includes Information Technology.

2.2. Background Checks. Each Contractor's personnel who is an applicant for an information technology position must undergo the security clearance and background check procedure, which includes fingerprinting, as required by A.R.S. § 41-710, Eligible Agency, or Co-Op Buyer.

Contractor shall obtain and pay for the security clearance and background check. Contractor personnel who will have administrator privileges on a State network must additionally provide identity and address verification and undergo State-specified training for unescorted access, confidentiality, privacy, and data security

2.3. Information Access

2.3.1. System Measures. Contractor shall employ appropriate system management and maintenance, fraud prevention and detection, and encryption application and tools to any systems or networks containing or transmitting State’s proprietary data or confidential information.

2.3.2. Individual Measures. Contractor personnel shall comply with applicable State policies and procedures regarding data access, privacy, and security, including prohibitions on remote access and obtaining and maintaining access identifications (IDs) and passwords. Contractor is responsible to State for ensuring that any State access IDs and passwords are used only by the person to whom they were issued. Contractor shall ensure that personnel are only provided the minimum only such level of access necessary to perform his or duties. Contractor shall, on request, provide a current register of the access IDs and passwords and corresponding access levels currently assigned to its personnel.

2.3.3. Access Control. Contractor is responsible to State for ensuring that hardware, software, data, information, and that has been provided by State or belongs to or is in the custody of State and is accessed or accessible by Contractor personnel is only used in connection with carrying out the Work and is never commercially exploited in any manner whatsoever not expressly permitted under the Contract. State may restrict access of Contractor personnel, or instruct Contractor to restrict their access, if in its determination the requirements of this subparagraph are not being met.

2.4. Pass-Through Indemnity

2.4.1. Indemnity from Third Party. For computer hardware or software included in the Work as discrete units that were manufactured or developed solely by a third party, Contractor may satisfy its indemnification obligations under the Contract by, to the extent permissible by law, passing through to State such indemnity as it receives from the third-party source (each a “Pass-Through Indemnity”) and cooperating with State in enforcing that indemnity. If the third party fails to honor its Pass-Through

Indemnity, or if a Pass-Through Indemnity is insufficient to indemnify State

Indemnitees to the extent and degree, Contractor is required to do by the Uniform

Terms and Conditions, then Contractor shall indemnify, defend and hold harmless

State Indemnitees to the extent the Pass-Through Indemnity does not.

2.4.2. Notification of Claims. State shall notify Contractor promptly of any claim to which a

Pass-Through Indemnity might apply. Contractor, with reasonable consultation from

State, shall control of the defense of any action on any claim to which a Pass-Through

Indemnity applies, including negotiations for settlement or compromise, provided that:

2.4.2.1. State reserves the right to elect to participate in the action at its own expense;

2.4.2.2. State reserves the right to approve or reject any settlement or compromise on reasonable grounds and if done so timely; and

2.4.2.3. State shall in any case cooperate in the defense and any related settlement negotiations.

2.5. Systems and Controls. In consideration for State having agreed to permit Pass-Through

Indemnities in lieu of direct indemnity, Contractor agrees to establish and keep in place systems and controls appropriate to ensure that State funds under this Contract are not knowingly used for the acquisition, operation, or maintenance of Materials or Services in violation of intellectual property laws or a third party’s intellectual property rights.

2.6. Redress of Infringement

2.6.1. Replace, License, or Modify. If Contractor becomes aware that any Materials or

Services infringe, or are likely to be infringing, on any third party’s intellectual property rights, then Contractor shall, at its sole cost and expense and in consultation with State, either:

2.6.1.1. replace any infringing items with non-infringing ones;

2.6.1.2. obtain for State the right to continue using the infringing items; or

2.6.1.3. modify the infringing items so that they become non-infringing, so long as they continue to function as specified following the modification.

2.6.2. Cancellation Option. In every case under 2.6.1, if none of those options can reasonably be accomplished, or if the continued use of the infringing items is impracticable, State may cancel the relevant Order or terminate the Contract, and

Contractor shall take back the infringing items. If State does cancel the Order or terminate the Contract, Contractor shall refund to State:

2.6.2.1. for any software created for State under the Contract, the amount State paid to Contractor for creating it;

2.6.2.2. for all other Materials, the net book value of the product provided according to generally accepted accounting principles; and

2.6.2.3. for Services, the amount paid by State or an amount equal to twelve (12) months of charges, whichever is less.

2.6.3. Exceptions. Contractor will not be liable for any claim of infringement based solely on any of the following by a State Indemnitee:

2.6.3.1. modification or use of Materials other than as contemplated by the Contract or expressly authorized or proposed by a Contractor Indemnitor;

2.6.3.2. operation of Materials with any operating software other than that supplied by Contractor or authorized or proposed by a Contractor Indemnitor; or

2.6.3.3. combination or use with other products in a manner not contemplated by the Contract or expressly authorized or proposed by a Contractor Indemnitor.

2.7. First Party Liability Limitation

2.7.1. Limit. Subject to the provisos that follow below and unless stated otherwise in the

Special Terms and Conditions, State’s and Contractor’s respective first party liability arising from or related to the Contract is limited to the greater of $1,000,000 (one million dollars) or three (3) times the purchase price of the specific Materials or

Services giving rise to the claim.

2.7.2. Provisos. This paragraph limits liability for first party direct, indirect, incidental, special, punitive, and consequential damages relating to the Work regardless of the legal theory under which the liability is asserted. This paragraph does not limit liability arising from any:

2.7.2.1. Indemnified Claim against which Contractor has indemnified State Indemnitees under paragraph 6.2;

2.7.2.2. claim against which Contractor has indemnified State Indemnitees under paragraph 6.3; or

2.7.2.3. provision of the Contract calling for liquidated damages or specifying amounts or percentages as being at-risk or subject to deduction for performance deficiencies.

2.7.3. Purchase Price Determination. If the Contract is for a single-agency and a single Order

(or if no Order applies), then “purchase price” in Subparagraph 2.7.1 above means the aggregate Contract price current at the time of Contract expiration or earlier termination, including all Contract Amendments having an effect on the aggregate price through that date. In all other cases, “purchase price” above means the total price of the Order for the specific equipment, software, or services giving rise to the claim, and therefore a separate limit will apply to each Order.

2.7.4. No Effect on Insurance. This paragraph does not modify the required coverage limits, terms, and conditions of, or any insured’s ability to claim against any insurance that

Contractor is required by the Contract to provide, and Contractor shall obtain express endorsements that it does not.

2.8. Information Technology Warranty

2.8.1. Specified Design. Where the Scope of Work for information technology, Work provides a detailed design specification or sets out specific performance requirements, Contractor warrants that the Work will provide all functionality material to the intended use stated in the Contract, provided that, the foregoing warranty does not extend to any portions of the Materials that are:

2.8.1.1. modified or altered by anyone not authorized by Contractor to do so;

2.8.1.2. maintained in a way inconsistent to any applicable manufacturer recommendations; or

2.8.1.3. operated in a manner not within its intended use or environment.

2.8.2. COTS Software. With respect to Materials provided under the Contract that are commercial-off-the-shelf (COTS) software, Contractor warrants that:

2.8.2.1. to the extent possible, it will test the software before delivery using commercially available virus detection software conforming to current industry standards;

2.8.2.2. the COTS software will, to the best of its knowledge, at the time of delivery be free of viruses, backdoors, worms, spyware, malware, and other malicious code that could hamper performance, collect unlawfully any personally identifiable information, or prevent products from performing as required by the Contract; and

2.8.2.3. it will provide a new or clean install of any COTS software that State has reason to believe contains harmful code.

2.8.3. Payment has no Effect. The warranties in this paragraph are not affected by State’s inspection, testing, or payment.

2.9. Specific Remedies. Unless expressly stated otherwise elsewhere in the Contract, State’s remedy for breach of warranty under paragraph 2.8 includes, at State’s discretion, re-performance, repair, replacement, or refund of any amounts paid by State for the nonconforming Work, plus (in every case) Contractor’s payment of State’s additional, documented, and reasonable costs to procure materials or services equivalent in function, capability, and performance that was first called for. For clarification of intent, the foregoing obligations are limited by the limitation of liability in paragraph 2.7. If none of the foregoing options can reasonably be effected, or if the use of the materials by State is made impractical by the nonconformance, then State may seek any remedy available to it under law.

2.10. Section 508 Compliance. Unless specifically authorized in the Contract, any electronic or information technology offered to the State of Arizona under this Contract shall comply with

A.R.S. §18-131 and §18-132 and Section 508 of the Rehabilitation Act of 1973, which requires that employees and members of the public shall have access to and use of information technology that is comparable to the access and use by employees and members of the public who are not individuals with disabilities.

2.11. Cloud Applications. The following are required for Contractor of any cloud solution that hosts

State data outside of the State’s network or transmits and/or receives State data.

2.11.1. Submit a completed Arizona Baseline Infrastructure Security Controls assessment spreadsheet as found at: https://azdohs.gov/information-technology-it-policies-standards-and-procedure, and mitigate or install compensating controls for any issues of concern identified by State. Contractor is required to provide any requested documentation supporting the review of the assessment. The assessment shall be re-validated on a minimum annual basis.

2.11.2. State reserves the right to conduct penetration tests or hire a third party to conduct penetration tests of the Contractor’s application. Contractor will be alerted in advance and arrangements made for an agreeable time. Contractor shall respond to all serious flaws discovered by providing an acceptable timeframe to resolve the issue and/or implement a compensating control.

2.11.3. Contractor must submit a copy of system logs from the cloud system to the State of Arizona security team on a regular basis to be added to the State SIEM (Security Information Event Monitor) or IDS (Intrusion Detection System).

3. Contractor must employ a government-rated cloud compartment to better protect sensitive or regulated State data.

https://aset.az.gov/resources/policies-standards-and-procedures https://azdohs.gov/information-technology-it-policies-standards-and-procedure https://azdohs.gov/information-technology-it-policies-standards-and-procedure

4. Insurance Requirements

Indemnification Clause To the fullest extent permitted by law, Contractor shall defend, indemnify, and hold harmless the State of Arizona, and its departments, agencies, boards, commissions, universities, and any jurisdiction or agency issuing permits for any work included in the project, and their respective directors, officers, officials, agents and employees (hereinafter referred to as "Indemnitee") from and against any and all claims, actions, liabilities, costs, losses, or expenses, (including reasonable attorney's fees), (hereinafter collectively referred to as "Claims") arising out of actual or alleged bodily injury or personal injury of any person (including death) or loss or damage to tangible or intangible property caused, or alleged to be caused, in whole or in part, by the negligent or willful acts or omissions of Contractor or any of Contractor's directors, officers, agents, employees, volunteers or subcontractors. This indemnity includes any claim or amount arising or recovered under the Workers' Compensation Law or arising out of the failure of Contractor to conform to any federal, state or local law, statute, ordinance, rule, regulation or court decree. It is the specific intention of the parties that the Indemnitee shall, in all instances, except for Claims arising solely from the negligent or willful acts or omissions of the Indemnitee, be indemnified by Contractor from and against any and all Claims. It is agreed that Contractor will be responsible for primary loss investigation, defense and judgment costs where this indemnification is applicable.

This indemnification will survive the termination of the above listed contract with the Contractor.

This indemnity shall not apply if the contractor or sub-contractor(s) is/are an agency, board, commission or university of the State of Arizona.

Technology Errors & Omissions Insurance

• Each Claim $2,000,000

• Annual Aggregate $2,000,000

a. Such insurance shall cover any, and all errors, omissions, or negligent acts in the delivery of products, services, and/or licensed programs under this contract.

b. Coverage shall include copyright infringement, infringement of trade dress, domain name, title or slogan.

c. In the event that the Tech E&O insurance required by this Contract is written on a claims-made basis, Contractor warrants that any retroactive date under the policy shall precede the effective date of this Contract and, either continuous coverage will be maintained or an extended discovery period will be exercised for a period of two (2) years, beginning at the time work under this Contract is completed.

Network Security (Cyber) and Privacy Liability

• Each Claim $2,000,000

• Annual Aggregate $2,000,000

a. Such insurance shall include, but not be limited to, coverage for third party claims and losses with respect to network risks (such as data breaches, unauthorized access or use, ID theft, theft of data) and invasion of privacy regardless of the type of media involved in the loss of private information, crisis management and identity theft response costs. This should also include breach notification costs, credit remediation and credit monitoring, defense and claims expenses, regulatory defense costs plus fines and penalties, cyber extortion, computer program and electronic data restoration expenses coverage (data asset protection), network business interruption, computer fraud coverage, and funds transfer loss.

b. In the event that the Network Security and Privacy Liability insurance required by this Contract is written on a claims-made basis, Contractor warrants that any retroactive date under the policy shall precede the effective date of this Contract and, either continuous coverage will be maintained, or an extended discovery period will be exercised for a period of two (2) years beginning at the time work under this Contract is completed.

c. The policy shall be endorsed, as required by this written agreement, to include the State of Arizona, and its departments, agencies, boards, commissions, universities, officers, officials, agents, and employees as additional insureds with respect to vicarious liability of the insured arising out of the activities performed by or on behalf of the Contractor.

d. Policy shall contain a waiver of subrogation endorsement, as required by this written agreement, in favor of the State of Arizona, and its departments, agencies, boards, commissions, universities, officers, officials, agents, and employees for losses arising from work performed by or on behalf of the Contractor.

If you have any questions or concerns, please do not hesitate to contact me at forbin.merrilyn@azdeq.gov or 602-771-4779. Thank you for your time and consideration on this matter.

Sincerely, Merilyn Forbin Senior Procurement Specialist