190000000058 RFP CMS Audit - Revised - Clean Version - posted 11.27.18 - new proposal deadline 12.10.18.docx

STATE OF MICHIGAN

Department of Technology, Management and Budget—Procurement

CMS Onsite Security Assessment Request for Proposal No. 171 190000000058

Solicitation Manager Name: Lisa Spitzley Direct Phone: (517) 249-0440 Email: spitzleyl4@michigan.gov Main Phone: 1-855-MI-PURCH 1-855-647-8724

This is a Request for Proposal (RFP) for:

for an independent information system Security Assessment service on behalf of the Michigan Department of Health and Human Services (MDHHS).

RFP Timeline

11/27/18

*A bidder’s proposal received at 12:00:01 p.m. Eastern is late and subject to disqualification.

This RFP is subject to change. Check www.michigan.gov/SIGMAVSS for current information.

PROPOSAL INSTRUCTIONS

1. PROPOSAL PREPARATION. The State recommends reading all RFP materials prior to preparing a proposal, particularly these Proposal Instructions and the Vendor Questions Worksheet. Bidders must follow these Proposal Instructions and provide a complete response to the items indicated in the table below. References and links to websites or external sources may not be used in lieu of providing the information requested in the RFP within the proposal. Include the bidder’s company name in the header of all documents submitted with your proposal.

RFP Structure and Documentation

2. CONTACT INFORMATION FOR THE STATE. The sole point of contact for the State concerning this RFP is listed on the Cover Page. Contacting any other State personnel, agent, consultant, or representative about this RFP may result in bidder disqualification.

3. QUESTIONS. Bidder questions about this RFP must be posted on www.michigan.gov/SIGMAVSS. no later than the time and date specified on the Cover Page. In the interest of transparency, only written questions are accepted. Answers to questions will be posted on www.michigan.gov/SIGMAVSS. Submit questions using the format below; a Microsoft Excel format or similar is suggested.

4. MODIFICATIONS. The State may modify this RFP at any time. Modifications will be posted on www.michigan.gov/SIGMAVSS . This is the only method by which the RFP may be modified.

5. DELIVERY OF PROPOSAL.

Electronic – The bidder must submit its proposal, all attachments, and any modifications or withdrawals electronically through www.michigan.gov/SIGMAVSS. The price proposal should be saved separately from all other proposal documents. The bidder should submit all documents in a modifiable (native) format (examples include, but are not limited to: Microsoft Word or Excel and Google Docs or Sheets). In addition to submitting documents in a modifiable format, the bidder may also submit copies of documents in PDF. Bidder’s failure to submit a proposal as required may result in disqualification. The proposal and attachments must be fully uploaded and submitted prior to the proposal deadline. Do not wait until the last minute to submit a proposal, as the SIGMA VSS system requires the creation of an account and entry of certain information, in addition to uploading and submitting the materials. The SIGMA VSS system will not allow a proposal to be submitted after the proposal deadline identified in the Cover Page, even if a portion of the proposal has been uploaded.

Questions on how to submit information or how to navigate in the SIGMA VSS system can be answered by calling (517) 373-4111 or (888) 734-9749.

6. EVALUATION PROCESS.

The State will evaluate each proposal based on the following factors:

Proposals receiving of 80 or more technical evaluation points will have pricing evaluated and considered for award.

The State may utilize all bidder information, without regard to a proposal’s technical score, to determine fair market value for goods or services sought. The State is not obligated to accept the lowest price proposal. If applicable, the State’s evaluation will include consideration of a bidder’s qualified disabled veteran (QDV) status under MCL 18.1261(8). Additional information on the QDV preference is available at: http://michigan.gov/micontractconnect/0,https://www.michigan.gov/dtmb/0,5552,7-358-82550_85746_48677-412612--,00.html,7-225-48677-123519--,00.html.

The State strongly encourages strict adherence to the Contract Terms. The State reserves the right to deem a bid non-responsive for failure to accept the Contract Terms. Nevertheless, the bidder may submit proposed changes to the Contract Terms in track changes (i.e., visible edits) with an explanation of the bidder’s need for each proposed change. Failure to include track changes with an explanation of the bidder’s need for the proposed change constitutes the bidder’s acceptance of the Contract Terms. General statements, such as that the bidder reserves the right to negotiate the terms and conditions, may be considered non-responsive.

The State may conduct an on-site visit to tour and inspect the bidder’s facilities; require an oral presentation of the bidder's proposal; conduct interviews, research, reference checks, and background checks; and request additional price concessions at any point during the evaluation process.

7. NOTICE OF DEFICIENCY. The State reserves the right to issue a Notice of Deficiency to bidders if the State determines after the proposal deadline that a portion of the RFP was deficient, unclear, or ambiguous. Failure to respond to a Notice of Deficiency timely may be cause for disqualification.

8. CLARIFICATION REQUEST. The State reserves the right to issue a Clarification Request to a bidder to clarify its proposal if the State determines the proposal is not clear. Failure to respond to a Clarification Request timely may be cause for disqualification.

9. RESERVATIONS. The State reserves the right to:

a. Disqualify a bidder for failure to follow these instructions.

b. Discontinue the RFP process at any time for any or no reason. The issuance of an RFP, your preparation and submission of a proposal, and the State’s subsequent receipt and evaluation of your proposal does not commit the State to award a contract to you or anyone, even if all the requirements in the RFP are met.

c. Consider late proposals if: (i) no other proposals are received; (ii) no complete proposals are received; (iii) the State received complete proposals, but the proposals did not meet mandatory minimum requirements or technical criteria; or (iv) the award process fails to result in an award.

d. Consider an otherwise disqualified proposal, if no other proposals are received.

e. Disqualify a proposal based on: (i) information provided by the bidder in response to this RFP; (2) the bidder’s failure to complete registration on www.michigan.gov/SIGMAVSS ; or (3) if it is determined that a bidder purposely or willfully submitted false or misleading information in response to the RFP.

f. Consider prior performance with the State in making its award decision.

g. Consider overall economic impact to the State when evaluating proposal pricing and in the final award recommendation. This includes but is not limited to: considering principal place of performance, number of Michigan citizens employed or potentially employed, dollars paid to Michigan residents, Michigan capital investments, job creation, tax revenue implications, and economically disadvantaged businesses.

h. Consider total-cost-of-ownership factors (e.g., transition and training costs) when evaluating proposal pricing and in the final award recommendation.

i. Refuse to award a contract to any bidder that has failed to pay State taxes or has outstanding debt with the State.

j. Enter into negotiations with one or more bidders on price, terms, technical requirements, or other deliverables.

k. Award multiple, optional-use contracts, or award by Contract Activity.

l. Evaluate the proposal outside the scope identified in Section 6, Evaluation Process, if the State receives only one proposal.

10. AWARD RECOMMENDATION. The contract will be awarded to the responsive and responsible bidder who offers the best value to the State, as determined by the State. Best value will be determined by the bidder meeting the minimum point threshold and offering the best combination of the factors stated in Section 6, Evaluation Process, and price, as demonstrated by the proposal. The State will post a Notice of Recommendation for Award on www.michigan.gov/SIGMAVSS .

11. DEBRIEF MEETING AND BID PROTEST. The State will post a Notice of Recommendation for Award, which will provide instructions on how to request a debrief meeting

If you wish to initiate a protest of the award, you must submit your written protest electronically at BidProtest-DTMB@michigan.gov no later than 3:00 p.m., 5 calendar days after posting the Notice of Recommendation for Award on SIGMA VSS, or by 12:00 pm, the next business day if that date falls on a state holiday or weekend. The State reserves the right to adjust this timing and will publish any change on the SIGMA VSS.

Additional information about the protest process is available at www.michigan.gov/micontractconnect under the “Programs and Policies” link.

12. STATE ADMINISTRATIVE BOARD. Contracts in excess of $500,000 require approval by the State Administrative Board. The State Administrative Board’s decision is final; however, its approval does not constitute a contract. The award process is not complete until the awarded contractor receives a contract fully executed by all parties.

13. GENERAL CONDITIONS. The State will not be liable for any costs, expenses, or damages incurred by a bidder participating in this solicitation. The bidder agrees that its proposal will be considered an offer to do business with the State in accordance with its proposal, including the Contract Terms, and that its proposal will be irrevocable and binding for a period of 180 calendar days from date of submission. If a contract is awarded to the bidder, the State may, at its option, incorporate any part of the bidder’s proposal into a contract. This RFP is not an offer to enter into a contract. This RFP may not provide a complete statement of the State’s environment, or contain all matters upon which agreement must be reached. Other than verified trade secrets, proposals submitted via www.michigan.gov/SIGMAVSS are the State’s property.

14. CONFIDENTIAL TREATMENT FORM AND THE FREEDOM OF INFORMATION ACT. All portions of the bidder’s proposal and resulting contract are subject to disclosure as required under Michigan’s Freedom of Information Act (FOIA), MCL 15.231, et seq. However, some information may be exempt from disclosure. Under MCL 18.1261(13)(b), records containing “a trade secret as defined under section 2 of the uniform trade secrets act, 1998 PA 448, MCL 445.1902,” are exempt from disclosure under FOIA. In addition, “financial or proprietary information” submitted with a bidder’s proposal is exempt from disclosure under FOIA. A bidder’s failure to comply with this Section is grounds for rejecting a bidder’s proposal as non-responsive. As a part of its proposal, each bidder must follow the procedure below.

a. SUBMIT A COMPLETED “CONFIDENTIAL TREATMENT FORM” (CT FORM) WITH YOUR BID. Completion and submission of the CT Form is required regardless of whether the bidder seeks confidential treatment of information. Failure to submit a completed CT Form may be cause for disqualification from the solicitation process.

i. Complete and sign Section 1 of the CT Form if the bidder does NOT request confidential treatment of information contained in its proposal; or

ii. Complete and sign Section 2 of the CT Form if the bidder requests confidential treatment of certain information. Bidder must also submit a “Public Copy” of the proposal with the trade secret, financial, and proprietary information redacted and clearly labeled as the “Public Copy.”

b. FOIA REQUESTS. If a FOIA request is made for a bidder’s proposal, the Public Copy may be distributed to the public along with the bidder’s CT Form. The CT Form is a public document and serves as an explanation for the redactions to the Public Copy. Do not put any trade secret, financial, or proprietary information in the CT Form. Do not redact the CT Form itself.

c. NO ADVICE. The State will not advise a bidder as to the nature or content of documents entitled to protection from disclosure under FOIA or other laws, as to the interpretation of such laws, or as to the definition of trade secret or financial or proprietary information. Nothing contained in this provision will modify or amend requirements and obligations imposed on the State by FOIA or other applicable law.

d. FAILURE TO REQUEST CONFIDENTIAL TREATMENT. Failure to request material be treated as confidential as specified herein relieves the State, its agencies, and personnel from any responsibility for maintaining material in confidence.

e. Bids containing a request to maintain an entire proposal as confidential may be rejected as non-responsive. Bidders may not request confidential treatment with respect to resumes, pricing, and marketing materials. The State reserves the right to determine whether material designated as exempt by a bidder falls under MCL 18.1261 or other applicable FOIA exemptions. If a FOIA request is made for materials that the bidder has identified as trade secret, financial, or proprietary information, the State has the final authority to determine whether the materials are exempt from disclosure under FOIA.

f. Bidder forever releases the State, its departments, subdivisions, officers, and employees from all claims, rights, actions, demands, damages, liabilities, expenses and fees, which arise out of or relate to the disclosure of all or a portion of bidder’s proposal submitted under this RFP. Bidder must defend, indemnify and hold the State, its departments, subdivisions, officers, and employees harmless, without limitation, from and against all actions, claims, losses, liabilities, damages, costs, attorney fees, and expenses (including those required to establish the right to indemnification), arising out of or relating to any FOIA request, including potential litigation and appeals, related to the portion of bidder’s proposal submitted under this RFP that bidder has identified as a trade secret, or financial or proprietary information. The State will notify bidder in writing if indemnification is sought. The State is entitled to: (i) regular updates on proceeding status; (ii) participate in the defense of the proceeding; (iii) employ its own counsel; and to (iv) retain control of the defense, or any portion thereof, if the State deems necessary. Bidder will not, without the State’s written consent (not to be unreasonably withheld), settle, compromise, or consent to the entry of any judgment in or otherwise seek to terminate any claim, action, or proceeding. If a State employee, official, or law is involved or challenged, the State may control the defense of that portion of the claim. Any litigation activity on behalf of the State, or any of its subdivisions under this Section, must be coordinated with the Department of Attorney General. An attorney designated to represent the State may not do so until approved by the Michigan Attorney General and appointed as a Special Assistant Attorney General.

CONFIDENTIAL TREATMENT FORM (CT FORM)

INSTRUCTIONS. Complete either Section 1 or Section 2 of this CT Form and sign where indicated. This CT Form must be signed by the individual who signed the bidder’s proposal. A completed CT Form must be submitted with your proposal, regardless of whether your proposal contains confidential information. Failure to submit a completed CT Form with your bid is grounds for rejecting the proposal as non-responsive. See Section 16 of the Proposal Instructions for additional information.

Section 1. Confidential Treatment Is Not Requested

This section must be completed, signed, and submitted with the proposal if bidder does not request confidential treatment of any material contained in the proposal.

By signing below, the bidder affirms that confidential treatment of material contained in the proposal is not requested.

[Printed Name] [Title] [Company]

Section 2. Confidential Treatment Is Requested

The section must be completed, signed, and submitted with the proposal if bidder requests confidential treatment of any material contained in the proposal. Submission of a completed CT Form is required to request confidential treatment.

Provide the information in the table below. Bidder may add rows or additional pages using the same format shown in the table. Bidder must specifically identify the information to be protected as confidential and state the reasons why protection is necessary. The CT Form will not be considered fully complete unless, for each confidentiality request, the bidder: (1) identifies whether the material is a trade secret (TS), financial information (FI), or proprietary information (PI); (2) explains the specific legal grounds that support treatment of the material as TS, FI, or PI; and (3) provides the contact information for the person at bidder’s organization authorized to respond to inquiries by the State concerning the material. Bidders must not simply cite to an applicable act or case name; rather, bidders must provide a complete justification as to how the material falls within the scope of an applicable act or relevant case law.

CONFIDENTIAL TREATMENT FORM (CT FORM)

By signing below, the bidder affirms that confidential treatment of material contained in its proposal is requested and has attached to this form a redacted “Public Copy” of the bidder’s proposal.

[Printed Name] [Title] [Company]

STATE OF MICHIGAN

VENDOR QUESTIONS WORKSHEET

Provide a detailed response to each question. “You” and “company” refers to the bidder.

1. Contact Information

Bidder’s sole contact person during the RFP process. Include name, title, address, email, and phone number.

Person authorized to receive and sign a resulting contract. Include name, title, address, email, and phone number.

2. Company Background Information

Legal business name and address. Include business entity designation, e.g., sole proprietor, Inc., LLC, or LLP.

What state was the company formed in?

Phone number

Website address

Number of years in business and number of employees

Legal business name and address of parent company, if any

Has there been a recent change in organizational structure (e.g., management team) or control (e.g., merger or acquisition) of your company? If the answer is yes: (a) explain why the change occurred and (b) how this change has affected your company.

Discuss your company’s history. Has growth been organic, through mergers and acquisitions, or both?

Has bidder ever been debarred, suspended, or disqualified from bidding or contracting with any entity, including the State of Michigan? If yes, provide the date, the entity, and details about the situation.

Has your company been a party to litigation against the State of Michigan? If the answer is yes, then state the date of initial filing, case name and court number, and jurisdiction.

Within the last 5 years, has your company or any of its related business entities defaulted on a contract or had a contract terminated for cause? If yes, provide the date, contracting entity, type of contract, and details about the termination or default.

State your gross annual sales for the last 5 years.

If receiving a contract under this RFP will increase your gross revenue by more than 25% from last year’s sales, explain how the company will scale-up to manage this increase.

Describe partnerships and strategic relationships you think will bring significant value to the State.

State the physical address of the place of business that would have primary responsibility for this account if bidder is awarded a contract under this RFP.

3. Qualified Disabled Veteran

To demonstrate qualification as a qualified disabled veteran, you must provide:

(a) Proof of service and conditions of discharge (DD214 or equivalent);

(b) Proof of service-connected disability (DD214 if the disability was documented at discharge or Veterans Administration Rating Decision Letter or equivalent if the disability was documented after discharge); and

(c) Legal documents setting forth the ownership of the business entity.

In lieu of the documentation identified above, you may provide proof of certification by the National Veterans Business Development Council.

Enter the names of documents submitted with your proposal to demonstrate status as a qualified disabled veteran.

4. Participation in RFP Development or Evaluation

Did your company, an employee, agent, or representative of your company, or any affiliated entity participate in developing any component of this solicitation? For purposes of this question, business concerns, organizations, or individuals are affiliates of each other if, directly or indirectly: (1) either one controls or has power to control the other or (2) a third party controls or has the power to control both. Indicia of control include, but are not limited to, interlocking management or ownership, identity of interests among family members, shared facilities or equipment, and common use of employees.

If you entered “YES”, you are not eligible for contract award or to work as a subcontractor for the awarded vendor.

5. State of Michigan Experience and Prior Experience

Does your company have experience working with the State of Michigan? If so, please provide a list (including the contract number) of the contracts you hold or have held with the State for the last 10 years.

Describe at least 3 relevant experiences from the last 5 years supporting your ability to successfully manage a contract of similar size and scope for the work described in this RFP.

Experience 1

Company name Contact name Contact role at time of project Contact phone Contact email

City State Zip

1. Project name and description of the scope of the project

2. What role did your company play?

3. How is this project experience relevant to the subject of this RFP?

Dollar value

Start and end date (mm/yy – mm/yy)

Status (completed, live, other – specify phase)

Results obtained

Experience 2

Company name

Contact role at time of project

City

1. Project name and description of the scope of the project

Dollar value

Start and end date (mm/yy – mm/yy)

Status (completed, live, other – specify phase)

Results obtained

Experience 3

Company name

Contact role at time of project

City

1. Project name and description of the scope of the project

Dollar value

Start and end date (mm/yy – mm/yy)

Status (completed, live, other – specify phase)

Results obtained

6. Standard Contract Terms

Bidder must affirm agreement with the attached Contract Terms. If not in agreement, written exceptions in accordance with Section 6 Evaluation Process must be provided with Bidder’s proposal.

7. Other

Bidder must enter company name here

STATE OF MICHIGAN

Request For Proposal No. 190000000058 CMS Onsite Security Assessment

SCHEDULE A

STATEMENT OF WORK

CONTRACT ACTIVITIES

This schedule identifies the anticipated requirements of any Contract resulting from this RFP. The term “Contractor” in this document refers to a bidder responding to this RFP.

The Contractor must respond to each requirement or question, and explain how it will fulfill each requirement. Attach any supplemental information and appropriately reference within your response.

Project Request:

This is a Request for Proposal (RFP) for an independent information system Security Assessment service on behalf of the Michigan Department of Health and Human Services (MDHHS).

Multiple SOM Medicaid information systems must be assessed annually to determine their level of compliance against the Centers for Medicare and Medicaid Services (CMS) Minimal Acceptable Risk Standards for Exchanges (MARS-E) security framework. The annual project will produce a Security Assessment Report (SAR) that documents the security posture of the SOM Medicaid related information systems. This report is submitted to CMS annually as part of an attestation package.

Acronyms:

Definitions:

Agency Controls – Controls that affect the data of that agency (Agency Policies, IRS, HIPAA, etc.). A policy, standard or procedure or other service or requirement an Agency has in place for the entire Agency, such as HIPAA training.

Application Controls – Controls that affect Application Functionality. Application controls are the sole responsibility of the application or the business area for the application, such as account management processes, logging, etc.

Common Control – Comprise both Enterprise and Agency Controls; i.e., Common Controls = Enterprise Controls + Agency Controls.

Enterprise Controls – Controls that affect all Agencies because of a shared infrastructure, framework or process. Enterprise is a SOM service, such as single sign-on, the data center, or vulnerability scans. It can also be PSP.

Hybrid Controls – Situations where there is a convergence between the controls based on Enterprise, Agency, and Application interdependencies – Example (Affordable Care Act – Medicaid Compliance Office). Hybrid is an Enterprise or Agency control in addition to an application control.

Production Environment - A production environment is where the real-time staging of resources and controls that provide a live service running an organization are executed, and includes the personnel, processes, data, hardware, and software needed to perform day-to-day operations.

BACKGROUND

To provide SOM citizens with access to Medicaid, MDHHS must meet legal and regulatory requirements to maintain compliance with the Patient Protection & Affordable Care Act of 2010 (ACA). The SOM has multiple Medicaid systems that are interoperable with and dependent on the Federally Facilitated Marketplace and its federal trusted data sources to provide Medicaid eligibility determination services for the SOM citizens. The annual Independent information system security assessment is required to retain the Authority to Connect (ATC) to federal systems in order to determine Medicaid eligibility, enrollment, and benefits for SOM citizens.

Each year in support of MDHHS, DTMB Agency Services coordinates with an independent third-party Contractor to complete an annual information systems Security Assessment and submit a SAR to CMS. Assessments must be performed in accordance with MARS-E framework. CMS mandates that all MARS-E security and privacy controls attributable to a specific system or application be assessed over a three-year period, with a subset of the controls assessed annually.

SCOPE

The Contractor must conduct an annual security assessment of select SOM Medicaid related information systems and document deficiencies, gaps, and/or vulnerabilities of all applicable controls against the CMS Catalog of MARS-E security and privacy controls. The annual assessment must be performed on production only environments for the following SOM Medicaid related information system(s):

· Integrated Service Delivery Portal (ISD Portal)

· Cloud hosted solution (Salesforce) supported by DTMB and Deloitte Consulting.

· Bridges Integrated Automated Eligibility Determination system (“Bridges”).

· State hosted Datacenter and collaboratively supported with Deloitte Consulting.

· State of Michigan Medicaid HUB Solution system (“HUB”).

· State hosted Datacenter and collaboratively supported with Deloitte Consulting.

· Modified Adjusted Gross Income (MAGI) Eligibility Determination system (“Rules Engine”).

· Contractor hosted Datacenter and collaboratively supported with CGI Technologies.

· MAGI Viewer system (“Internal Viewer Application”).

· Contractor hosted Datacenter and collaboratively supported with MAXIMUS.

· CHAMPS (Community Health Automated Medicaid Processing System)

· State hosted Medicaid Management Information System (MMIS).

· MDHHS - Health Services Data Warehouse

· State hosted Teradata data warehouse supporting health services programs.

The annual assessment may include physical data center inspections. The Contractor may be required to complete site visits with vendors to evaluate controls.

· State of Michigan Enterprise Datacenter located in Michigan.

· CGI Datacenters:

Production Data Center, Phoenix, AZ Backup Data Center, Philadelphia, PA

· MAXIMUS Datacenters Englewood, CO

Assessment Controls planned for annual assessment:

1. GENERAL REQUIREMENTS

A. Project Initiation and Kick-off

The Contractor must conduct the following activities as a part of the initiation and kick off phase of the annual assessment:

1. Develop a Project Plan:

a. Submit the Project Plan to the SOM.

b. Review, revise and incorporate SOM changes.

c. Collaboratively work with SOM on the final plan delivered within 10-days prior to the scheduled assessment Contractor kick-off meeting. The final plan must be accepted by SOM within 5 days prior to the scheduled Contractor kick-off meeting.

2. Review list of participating stakeholders for each system and location as provided by the SOM.

3. Lead the assessment kick-off meeting that involves all participating SOM assessment project stakeholders.

a. Kick-off agenda must include but not be limited to:

· Introductions of the assessment team;

· Define roles and responsibilities, expectations, anticipated timelines.

· Contractor’s approach to assessment;

· Provide contact information;

4. Gather SOM artifacts that may include but are not limited to:

a. CMS MARS-E documentation.

b. Questionnaires or other documentation provided by assessment participants responding to the in-scope controls.

c. Evidence related to MARS-E controls in scope for the year.

5. Key personnel must be on-site in Lansing, Michigan during the initiation phase of the annual assessment.

Deliverables for 1.A Project Initiation:

The Contractor must provide the following deliverables for the project initiation phase:

Bidder must check a box below for Section 1.A:

The Bidder must explain in detail how you will meet this requirement within this response box.

B. Project Execution The Contractor must conduct the following activities as a part of the execution phase of the annual assessment:

1. Validate and review “security control documentation for each in scope system as defined within the Project Plan.

2. Direct SOM on necessary steps for completion of security control documentation as appropriate for the identified systems.

3. Perform security assessment and security controls testing of the SOM Medicaid related information systems, including compensating controls, based on the MDHHS completed MARS-E template and DTMB’s PSP.

4. Monitor assessment progress; deliver weekly status reports to SOM assessment project stakeholders.

5. Provide guidance to SOM assessment project stakeholders on leading best practices and CMS expectations during the annual security assessment.

6. Key personnel must be on-site in Lansing, Michigan during the execution phase of the annual assessment.

Deliverable for 1B Project Execution:

The Contractor must provide the following deliverables for the project execution phase:

Bidder must check a box below for Section 1.B:

The Bidder must explain in detail how you will meet this requirement within this response box.

C. Project Completion The Contractor must conduct the following activities as a part of the completion phase of an annual assessment:

1. Complete a Security Assessment Report (SAR) for the following CMS FFM In-Boundary systems;

a. Integrated Service Delivery Portal (ISD Portal)

b. Bridges Integrated Automated Eligibility Determination system (“Bridges”).

c. State of Michigan Medicaid HUB Solution system (“HUB”).

d. Modified Adjusted Gross Income (MAGI) Eligibility Determination system (“Rules Engine”).

e. MAGI Viewer system (“Internal Viewer Application”).

2. Complete separate Security Assessment Report (SAR) for the following Non-FFM Out-of-Boundary systems;

a. Community Health Automated Medicaid Processing System (CHAMPS)

b. MDHHS Health Services Data Warehouse

3. Conduct a closeout meeting as planned and coordinated by DTMB with SOM project stakeholders, presenting the accepted SAR results.

4. Key personnel must be on-site in Lansing, Michigan during the completion phase of the annual assessment.

5. Complete and submit the SOM SUITE Stage Exit documentation to MDHHS Program Manager The Contractor must not consider any aspect of the annual assessment project to be complete until Contractor has received a written confirmation of satisfactory work from the MDHHS Program Manager in accordance with the terms and conditions of the Contract.

Bidder must check a box below for Section 1.C:

The Bidder must explain in detail how you will meet this requirement within this response box.

D. Deliverables for 1.C. Project Completion:

The Contractor must provide the following deliverables for the project completion phase:

Security Assessment Report (SAR)

– FFM In-Boundary Systems The SAR is complete, reviewed by DTMB, accepted by MDHHS and ready for submission to CMS.

Security Assessment Report (SAR)

– Non-FFM Out-of-Boundary Systems The SAR is complete, reviewed by DTMB, accepted by MDHHS for submission to other federal partners.

Project Lessons Learned

(SUITE PMM-0103)

The purpose of the Lessons Learned document is to help the project team share knowledge gained from experiences that may benefit the entire organization in their future project work.

Affidavit – Destruction of All Department Data

(MDHHS – 5684)

Affidavit – Destruction of all MDHHS data including PHI, PII and any other sensitive or confidential information as needed if storage use outside of the SOM repository is approved by the MDHHS Security Manager.

Stage Exit Documentation

(SUITE SEM-0189)

Signed and Accepted by MDHHS

Bidder must check a box below for Section 1.D:

The Bidder must explain in detail how you will meet this requirement within this response box.

E. Business Requirements Detail

1. The Contractor must use weekly status meetings to communicate project status and recommend to SOM assessment project team course correction as required.

2. The Contractor must provide gap analysis within the annual Security Assessment Report (SAR) for each individual MARS-E control against enterprise common and application controls.

3. The Contractor must document, and leverage lessons learned annually for future assessments.

Bidder must check a box below for Section 1.E:

The Bidder must explain in detail how you will meet this requirement within this response box.

F. Functional Requirements Detail The Contractor must evaluate whether the SOM is operating within the MARS-E control framework by reviewing the control, then determining through evidence and observation, whether the control is in place and operates according to the control description.

Bidder must check a box below for Section 1.F:

The Bidder must explain in detail how you will meet this requirement within this response box.

G. Technical Requirements Detail Prior to the start of the Contractor on-site work, SOM must approve the Contractor’s use of foreign devices such as laptops or mobile devices.

Bidder must check a box below for Section 1.G:

The Bidder must explain in detail how you will meet this requirement within this response box.

2. Acceptance

2.1. Acceptance, Inspection and Testing

The SOM will use the following criteria to determine acceptance of the Contract Activities:

A. All Deliverables (Written Deliverables and Service Deliverables) require formal written approval by the SOM, in accordance with the following procedures. Formal approval by the SOM requires that the Deliverable be confirmed in writing by the SOM to meet its specifications. The parties acknowledge that the approval process set forth herein will be facilitated by ongoing consultation between the parties, visibility of interim and intermediate Deliverables and collaboration on key decisions.

B. The SOM’s obligation to comply with any review period is conditional on the timely receipt of deliverables requiring review.

C. The SOM will approve in writing a Deliverable upon confirming that it conforms to MARS-E requirements. The SOM may, but shall not be required to, conditionally approve in writing a Deliverable that contains material deficiencies if the SOM elects to permit Contractor to rectify them post-approval. In any case, Contractor will be responsible for working diligently to correct within a reasonable time at Contractor’s expense all deficiencies in the Deliverable that remain outstanding at the time of SOM approval.

D. The SOM, at any time and in its reasonable discretion, may halt the approval process if such process reveals deficiencies in or problems with a Deliverable in a sufficient quantity or of a sufficient severity as to make the continuation of such process unproductive or unworkable. In such case, the SOM may return the applicable Deliverable to Contractor for correction and re-delivery prior to resuming the approval process.

Bidder must check a box below for Section 2.1:

The Bidder must explain in detail how you will meet this requirement within this response box.

2.2 Process for approval of Written Deliverables:

The SOM Review Period for Written Deliverables will be five Business Days for Written Deliverables of 100 pages or less and 10 Business Days for Written Deliverables of more than 100 pages. SOM requires a review of draft deliverables. The SOM agrees to notify Contractor in writing by the end of the SOM Review Period either stating that the Deliverable is approved in the form delivered by Contractor or describing any deficiencies that must be corrected prior to approval of the Deliverable (or at the SOM’s election, subsequent to approval of the Deliverable). If the SOM delivers to Contractor a notice of deficiencies, Contractor will correct the described deficiencies and within five Business Days resubmit the Deliverable in a form that shows all revisions made to the original version delivered to the SOM. Contractor’s correction efforts will be made at no additional charge. Upon receipt of a corrected Deliverable from Contractor, the SOM will have a reasonable additional period of time, not to exceed the length of the original SOM Review Period, to review the corrected Deliverable to confirm that the identified deficiencies have been corrected.

Bidder must check a box below for Section 2.2:

The Bidder must explain in detail how you will meet this requirement within this response box.

3. Staffing

3.1. Contractor Representative

The Contractor must appoint a Contractor Representative, specifically assigned to State of Michigan accounts, that will respond to State inquiries regarding the Contract Activities, answering questions related to ordering and delivery, etc. (the “Contractor Representative”).

The Contractor must notify the Contract Administrator at least 14 calendar days before removing or assigning a new Contractor Representative.

Bidder must check a box below for Section 3.1:

Bidder must identify Contractor Representative in this response box below:

3.2. Technical Support, Repairs and Maintenance

The Contractor must specify its toll-free number for the State to make contact with the Contractor for technical support, repairs and maintenance. The Contractor must be available for calls and service during the hours of 8 am to 5 pm EST.

Bidder must check a box below for Section 3.2:

The Bidder must explain in detail how you will meet this requirement within this response box below:

3.3. Work Hours

The Contractor must provide Contract Activities during the State’s normal working hours Monday – Friday, 8:00 a.m. to 5:00 p.m. EST, and possible night and weekend hours depending on the requirements of the project.

Bidder must check a box below for Section 3.3:

The Bidder must explain in detail how you will meet this requirement within this response box below:

3.4. Key Personnel

A. Key Personnel must be specifically assigned to the State account, be knowledgeable on the contractual requirements, and respond to State inquires within 48 hours.

Based on the scope and key activities for the annual assessment and to meet the SOM’s compliance obligations timeline, the SOM estimates an annual six week engagement model and a subsequent one week period for the SAR completion with the following Key Personnel:

a. Onsite project manager

b. Onsite security assessment lead

c. Security assessment analysts onsite as needed.

At least one assessment analyst must have experience assessing an enterprise service bus (ESB).

Contractor Key Personnel should have the following experience:

· Five years recent experience in managing IT…