2024-4152_RFQ_Addendum_2.pdf

January 2023 (Rev.)

STATE OF CALIFORNIA

CALIFORNIA DEPARTMENT OF TAX AND FEE ADMINISTRATION

ACQUISITIONS MANAGEMENT SECTION

651 BANNON STREET,SUITE 100 SACRAMENTO, CA 95811

PO BOX 942879, SACRAMENTO, CA 94279-0024

1-916-309-5421 www.cdtfa.ca.gov

February 6, 2025

ADDENDUM 2

REQUEST FOR QUOTE

INFORMATION TECHNOLOGY SERVICES

RFQ-ITS No.: 2024-4152

This Addendum is to extend the submission due date to Monday, February 10, 2025.

As a reminder, all quotes must be submitted to ADMIN-AMSContracts@cdtfa.ca.gov.

Thank you, Karen Simmons Acquisitions Analyst

GAVIN NEWSOM

Governor

Amy Tong

Secretary, Government Operations Agency

NICOLAS MADUROS

Director

Key Action Dates Date

1. Release of RFQ-ITS No.: 2024-4152 January 24, 2025

2. Submission of written questions January 31, 2025 by 4:00 p.m.

3. Department’s response to written questions February 4, 2025

4. Submission of Quotes February 6, 2025 February 10, 2025 by 3:00 pm

5. Administration Evaluation February 7, 2025 February 11, 2025

6. Notice of Award February 10, 2025 February 12, 2025

7. Proposed start date of contract March 1, 2025 or upon approval, whichever is later through February 29, 2028, or to be expired exactly three (3) years from the approval/execution date.

http://www.cdtfa.ca.gov/ mailto:ADMIN-AMSContracts@cdtfa.ca.gov

STATE OF CALIFORNIA

CALIFORNIA DEPARTMENT OF TAX AND FEE ADMINISTRATION

ACQUISITIONS MANAGEMENT SECTION

651 BANNON STREET,SUITE 100 SACRAMENTO, CA 95811

PO BOX 942879, SACRAMENTO, CA 94279-0024

1-916-309-5421 www.cdtfa.ca.gov

January 24, 2025

REQUEST FOR QUOTE

INFORMATION TECHNOLOGY SERVICES

RFQ-ITS No.: 2024-4152

You are invited to review and respond to the California Department of Tax and Fee Administration’s (CDTFA’s) Request for Quote - Information Technology Services (RFQ-ITS), No.# 2024-4152 for the following:

Service: Successful Bidder (Contractor) shall provide Financial Industry Reporting web-based Software as a Service (SaaS) industry research system, as outlined in the Sample FI$Cal Purchase Order (PO) and related Exhibits included herein (Attachment 2).

Location: Services shall be provided for the CDTFA Headquarters located at 651 Bannon Street, Suite 100, Sacramento, CA 95811.

BIDDER MINIMUM QUALIFICATIONS:

Services must include mandatory attributes as outlined in the RFQ-ITS. At the State’s option prior to Award, Bidders may be required to submit additional written clarifying information and/or provide a product Demonstration. Failure to submit the required written information as specified may be grounds for Bid rejection.

REQUIRED TO SUBMIT WITH QUOTE:

In submitting your quote, you must comply with the instructions found in Section 11. Administrative Requirements .

Send e-mail responses to the Acquisitions Management Section (AMS) at:

acquisitionscoor@cdtfa.ca.gov

Responses Due: February 6, 2025 February 10, 2025 3:00 pm P.S.T.

Term: March 1, 2025 or upon approval through February 29, 2028.

Contact Person: Karen Simmons: Phone: (916) 309-5422 or at email:karen.simmons@cdtfa.ca.gov

All responses will be reviewed, and the FI$Cal PO will be awarded to the firm with the lowest responsive, responsible quote. CDTFA is not responsible for responses that do not arrive on time.

For questions concerning this RFQ-ITS No.: 2024-4152, please contact the AMS Analyst at the number and/or email listed above.

GAVIN NEWSOM

Governor

Amy Tong

Secretary, Government Operations Agency

NICOLAS MADUROS

Director http://www.cdtfa.ca.gov/ mailto:acquisitionscoor@cdtfa.ca.gov

RFQ-ITS 2024-4152

GENERAL INFORMATION

1. BIDDERS’ INSTRUCTIONS

In submitting your quote, you must comply with the instructions found herein and, in the DGS/PD Bidders’, Instructions included here by reference at: DGS PD 451 Bidder Instructions (ca.gov)

The services required are delineated in the sample FI$Cal PO and Contract Agreement (Attachment 2).

Please read the enclosed documents carefully.

2. PURPOSE

The State of California, Department of Tax and Fee Administration (“CDTFA” or “the State”) requires the services of a Contractor to provide a Financial Industry Reporting web-based Industry research system that meets the mandatory attributes outlined in Exhibit A – SOW.

3. AVAILABILITY

The selected contractor must be able to meet the requirements of this RFQ-ITS No.: 2024-4152 and be ready to begin work upon completion of security clearance, confidentiality certification, and upon agreement approval, and as mutually agreed to between the parties.

4. PERIOD OF PERFORMANCE

The term of this Agreement is for three (3) years and begins on March 1, 2025, or upon approval, whichever is later, through February 29, 2028, or to be expired exactly three (3) years from the approval/execution date.

The contractor shall not be authorized to deliver or commence performance of services as described in the Statement of Work (SOW) until written approval has been obtained from all entities. No delivery or performance of service may commence prior to the execution of the Agreement.

5. KEY ACTION DATES

Listed below are the key action dates and times by which the actions must be taken or completed. If CDTFA finds it necessary to change any of these dates, it will be accomplished via an addendum to this RFQ-ITS No.: 2024-4152.

All dates after the Submission of Quotes on February 6, 2025 February 10, 2025 by 3:00 pm P.S.T.

are approximate and may be changed if needed to allow the State additional time for evaluation and contract execution.

Key Action Dates Date

1. Release of RFQ-ITS No.: 2024-4152 January 24, 2025

2. Submission of written questions January 31, 2025 by 4:00 p.m.

3. Department’s response to written questions February 4, 2025

4. Submission of Quotes February 6, 2025 February 10, 2025 by 3:00 pm

5. Administration Evaluation February 7, 2025 February 11, 2025

6. Notice of Award February 10, 2025 February 12, 2025

7. Proposed start date of contract March 1, 2025 or upon approval, whichever is later through February 29, 2028, or to be expired exactly three (3) years from the approval/execution date.

https://www.documents.dgs.ca.gov/dgs/FMC/GS/PD/DGSPD%20451.pdf

6. EXECUTIVE ORDER N-6-22 – RUSSIA SANCTIONS

On March 4, 2022, Governor Gavin Newsom issued Executive Order N-6-22 (the EO) regarding

Economic Sanctions against Russia and Russian entities and individuals. “Economic Sanctions” refers to sanctions imposed by the U.S. government in response to Russia’s actions in Ukraine, as well as any sanctions imposed under state law. By submitting an offer, Contractor represents that it is not a target of Economic Sanctions. Should the State determine Contractor is a target of Economic Sanctions or is conducting prohibited transactions with sanctioned individuals or entities, that shall be grounds for rejection of the Contractor’s offer any time prior to contract execution, or, if determined after contract execution, shall be grounds for termination by the State.

7. HEALTH AND SAFETY

Contractors are required to, at their own expense, comply with all applicable health and safety laws and regulations. Upon notice, Contractors are also required to comply with the state agency’s specific health and safety requirements and policies. Contractors agree to include in any subcontract related to performance of this Agreement, a requirement that the subcontractor comply with all applicable health and safety laws and regulations, and upon notice, the state agency’s specific health and safety requirements and policies.

8. WRITTEN QUESTIONS

All questions regarding the content of this RFQ-ITS must be submitted in writing electronically to the AMS’ email box at: acquisitionscoor@cdtfa.ca.gov. Address to the attention of the Karen Simmons and must be received by the date listed in Item 5. Key Action Dates, identified herein. Questions not submitted in writing by the date listed in Item 5. Key Action Dates for submission of written questions shall be answered at the State’s option.

9. RFQ-ITS NO.: 2024-4152 RESPONSE GUIDELINES

This RFQ-ITS No.: 2024-4152 and the Contractor’s quote in response to this document will be made a part of the FI$Cal PO and Contract Agreement. Responses to this RFQ-ITS No.: 2024-4152 must contain all data/information requested and must conform to the format described in this RFQ-ITS No.:

2024-4152. It is the Contractor’s responsibility to provide all required data and any other information deemed necessary for the State’s evaluation team to determine and verify the Contractor’s ability to perform the tasks and activities defined in the SOW, (see Attachment 2, Sample FI$Cal PO and related Exhibits included herein).

10. ASSUMPTIONS AND CONSTRAINTS

There shall be no assumptions, conditions, or constraints included in the bidder’s response. A bid may be rejected if it is conditional or incomplete, or if it contains any alterations of form or other irregularities of any kind.

https://www.gov.ca.gov/wp-content/uploads/2022/03/3.4.22-Russia-Ukraine-Executive-Order.pdf

REQUIRED TERMS AND CONDITIONS

Acceptance of the following terms and conditions which may be viewed via the below links are required by the State of DGS/PD for any vendor’s products, maintenance and/or services. These terms and conditions are non-negotiable, and no other terms and conditions will be accepted.

SaaS

General Services Procurement Division - Information Technology General Provisions – (Cloud Computing Services) – GSPD-ITGP (Cloud)

Current Version (Revised and Effective 11/12/2024)

All the above listed IT General Provisions, Cloud Computing Software General and Special Provisions are located on the DGS/PD webpage, linked here: DGS/PD Required Language for Contracts (ca.gov).

https://www.dgs.ca.gov/%7E/media/Divisions/PD/Acquisitions/Solicitation-Document-Attachments/GSPDITGP-CloudRevised-and-Effective-111224.docx https://www.dgs.ca.gov/PD/Search-Results?search=General%20Provisions&divisionid=7bce8ca3ed8a4aedbdeaf52f5e77df36&activeFilters=division-or-office-facets https://www.dgs.ca.gov/PD/Search-Results?search=General%20Provisions&divisionid=7bce8ca3ed8a4aedbdeaf52f5e77df36&activeFilters=division-or-office-facets

11. ADMINISTRATIVE REQUIREMENTS

The following documents must be submitted (unless noted as “as applicable”) in the RFQ-ITS response.

A. Quote & Certification Sheet - (Attachment 1)

B. Payee Data Record (Std. 204) which can be accessed on the DGS/PD website, linked here: STD 204 - Payee Data Record (ca.gov)

C. Bidder Declaration/Written Version GSPD-05-105 (written), which can be accessed on the DGS/PD website, linked here: Bidder Declaration - Written GS PD-05-105 (ca.gov).

D. Confidentiality Statement (CDTFA-4)

All Bidders, its employees and subcontractor employees working on this Agreement must sign and date the CDTFA-4 Rev. 5 Confidentiality Statement.

E. Mandatory Attributes Assessment Table (Attachment 3)

F. Desirable Attributes Assessment Table (Attachment 4)

G. Disabled Veteran Business Enterprise (DVBE) Declaration DGS PD Std. 843 (as applicable) which can be accessed on the DGS/PD website, linked here: DVBE Declaration DGS PD Std 843 (ca.gov)

H. Darfur Contracting Act, DGS PD 1, which can be accessed on the DGS/PD website, linked here:

Darfur Contracting Act Certification DGS PD 1 (ca.gov)

I. GenAI Disclosure & Factsheet (STD. 1000). In response to Executive Order N-12-23, GenAI, STD. 1000, requires contractors to disclose any GenAI technology used in their solutions or services. Contractors must complete a GenAI Disclosure & Factsheet, allowing the state to assess risks and potentially modify contracts accordingly. Failure to complete and return the STD.

1000 may result in disqualification or may potentially void any resulting contract. linked Linked here: STD. 1000 - GenAI Disclosure & Factsheet. Please note that while this form may not apply to this agreement, it is now required of us to obtain this form prior to any Contracts/Purchase Orders are to begin. If not applicable, please notate in Section 2:

Disclosure and Factsheet and complete signature section of the form.

J. California Civil Rights Laws Attachment (DGS OLS 04) which can be found on the DGS/PD website linked here: CALIFORNIA CIVIL RIGHTS LAWS ATTACHMENT, DGS OLS 04 (ca.gov)

K. Commercially Useful Function (CUF) Compliance Form - (Attachment 5)

Note: The CUF Form is not required if neither a Small Business nor Disable Veteran Business Enterprise will be participating. More detail information regarding CUF is located online on the DGS/PD website linked here: Commercially Useful Function for Certified Firms (ca.gov),

12. FI$Cal PO and STANDARD AGREEMENT FORM (SAMPLE)

SAMPLE – FI$Cal PO (Attachment 2)

EXHIBIT A – SOW

EXHIBIT B – Budget Detail and Payment Provisions EXHIBIT C – General Terms and Conditions EXHIBIT D – Special Terms and Conditions https://www.documents.dgs.ca.gov/dgs/fmc/pdf/std204.pdf https://www.documents.dgs.ca.gov/dgs/fmc/gs/pd/gspd05-105.pdf https://www.documents.dgs.ca.gov/dgs/fmc/gs/pd/pd_843.pdf https://www.documents.dgs.ca.gov/dgs/fmc/gs/pd/pd_843.pdf https://www.documents.dgs.ca.gov/dgs/FMC/GS/PD/PD_1.pdf https://www.documents.dgs.ca.gov/dgs/fmc/pdf/std1000.pdf https://www.dgs.ca.gov/PD/Forms?search=Std%201000&topicCategoryFilters=&audienceCategoryFilters=&sort=relevance&activeFilters=&page=1 https://www.dgs.ca.gov/SearchResult?search=California%20Civil%20Rights%20Law&divisionid= https://www.dgs.ca.gov/PD/Resources/Page-Content/Procurement-Division-Resources-List-Folder/Commercially-Useful-Function-for-Certified-Firms?search=Commercial%20Useful%20Function

13. DISABLED VETERANS BUSINESS ENTERPRISE (DVBE) & SMALL BUSINESS/MICRO

BUSINESS (SB/MB) PROGRAMS

DVBE Requirement Program -

The State has established goals for DVBE participating in State contracts. CDTFA has waived this requirement for RFQ ITS No.: 2024-4152.

DVBE Incentive Program -

A DVBE incentive will be granted to bidders achieving DVBE Participation of 1% to 5% (either the prime contractor is a DVBE or will subcontract out between 1% and 5% to a DVBE) of their bid total, in accordance with Military and Veterans Code, § 999.5(a) and (d), and California Code of Regulations §1896.98 et seq.

The DVBE Incentive will be applied during the bid evaluation process and will only be applied to responsive bids. Any Small Business Preference will be calculated prior to the DVBE Incentive calculation.

Bidders that achieve a DVBE Participation of 1% or more will have the DVBE Incentive applied to their bid in an attempt to displace the apparent low bidder. The percentage of DVBE Incentive will be equal to the percentage of DVBE participation. Incentive calculations are for bid evaluation purposes only. The award, if made, will be for the bidder’s actual bid amount.

If applicable, claim the incentive in box #16 on page 1 of Attachment 1. Quote & Certification Sheet for this RFQ-ITS and submit the completed DVBE Declaration Form, DGS PD 843, also located online on the DGS/PD website at: https://www.documets.dgs.ca.gov/dgs/fmc/gs/pd/gspd05- 105.pdf

SB/MB Enterprise Preference Program -

A five percent (5%) small business preference will be granted to Bidders that are California certified small businesses in accordance with California Code of Regulations, Title 2, § 1896 et. seq.

If applicable, claim the preference in box #16 on page 1 of Attachment 1, Quote & Certification Sheet, for this RFQ ITS No.: 2024-4152.

Non-SB/MB Enterprise Preference Program -

Bidders claiming the non-small business preference must commit to subcontract at least 25% of the net bid price with one or more California certified small businesses.

If applicable, claim the preference in in box #16 on page 1 of Attachment 1. Quote & Certification Sheet, of this RFQ ITS No.: 2024-4152 and submit the Bidder Declaration Form (GSPD-05-105 {written} or GSPD-05-106) also located online on the DGS/PD website at:

https://www.dgs.ca.gov/SearchResult?search=bidder%20declaration&divisionid= https://www.dgs.ca.gov/PD/Forms?search=DGS%20PD%20843&topicCategoryFilters=&audienceCategoryFilters=&sort=relevance&activeFilters=&page=1 https://www.dgs.ca.gov/PD/Forms?search=DGS%20PD%20843&topicCategoryFilters=&audienceCategoryFilters=&sort=relevance&activeFilters=&page=1 https://www.dgs.ca.gov/SearchResult?search=bidder%20declaration&divisionid=

14. SAMPLE CONTRACT

The Sample FI$Cal PO and Contract Agreement included in this RFQ is for information purposes only (Attachment 2). Upon Award all contract documents will be processed accordingly for final review and approval by the selected Contractor and CDTFA.

15. EVALUATION INFORMATION

Evaluation Process

Each quote response will be checked for the presence of requirement information in conformance with the submission requirements of this RFQ ITS No.: 2024-4152. CDTFA will evaluate each response to this RFQ ITS No.: 2024-4152 to determine its responsiveness to the requirements.

Evaluation Criteria Contract Award will be made on the basis of best value among the Quotes that are responsive to the Administrative Evaluation of the RFQ-ITS and score the highest in the technical requirements.

IMPORTANT: The Bidder with the highest overall score will be considered for the Contract Award.

Final Bids which do not meet the Administrative Requirement specified in Section 11 of this RFQ- ITS may be considered non-responsive and may be rejected. The Bidder that meets all Administrative Requirements and scores the highest on the Requirements and Cost combined, will be considered for Contract Award.

CDTFA shall verify that all Bids are submitted on time. Bids received by the specified time and date will be reviewed for detailed compliance with the requirements of this RFQ-ITS.

1. Evaluation Criteria

The Bid package will be assessed using a combination of Pass/Fail and numerically scored criteria. The Bid packages that pass the Administrative Evaluation will advance to the Product Demonstration, if applicable. The responsive Bidder that has the highest combined score may be awarded the Contract.

Evaluation Max Scoring Administrative Evaluation (Listed in Section 11 – Administrative Requirements)

PASS/FAIL

Technical Requirements Mandatory Attributes Desirable Attributes

PASS/FAIL

5 PTS

Cost Assessment 50 PTS Product Demonstration Product Demonstration, if applicable (refer to item b below)

45 PTS

TOTAL MAXIMUM POSSIBLE POINTS 100 PTS

a. Cost Assessment During Cost Assessment, the Evaluation Team will screen the Cost Response for compliance with all Requirements. Deviations deemed non-material may be waived at the State’s sole discretion. Once the Evaluation Team has evaluated each responsive Bid and verified that it meets all Requirements, the Evaluation Team will determine the Bidder’s Cost Score. The required Quote and Certification Sheet will be checked by the Evaluation Team for mathematical accuracy.

b. Product Demonstration Prior to the contract award, the State reserves the right to request a product demonstration to ensure compliance with the technical specifications outlined in the Exhibit A – SOW. The Product Demonstration is an evaluation of the bidder’s ability to meet CDTFA’s requirements in the Mandatory Attributes Table.

c. Example of Bidders’ Total Scores

The responsive Bidder that has the highest combined score shall be awarded the Contract.

See below for an Example of the Final Score Summary for calculation. The example does not include points awarded for the Product Demonstration.

Example of the Total Score Summary

BIDDER ADMINISTRATIVE

ASSESSMENT

TECHNICAL

POINTS

TECHNICAL

SCORE COST COST SCORE

CALCULATION

COST

SCORE

TOTAL

SCORE

A PASS 4.5/5 = 0.9

0.9X5 = 4.5 4.50 $15,000 Lowest = 50 50.00 54.50

B PASS 3.25/5 = 0.65

0.65X5 = 3.25 3.25 $30,000

15,000/30,000 = 0.50

0.50 X 50 = 25.00

25.00 28.25

C PASS 4.25/5 = 0.85

0.85X5 = 4.25 4.25 $20,000 15,000/20,000 = 0.75

0.75 X 50 = 37.50 37.50 41.75

ATTACHMENT 1

QUOTE & CERTIFICATION SHEET

The below form must be signed and returned. Please type or print clearly.

1. SERVICE: Successful Contractor shall submit one (1) electronic copy to CDTFA’s AMS email at:

acquisitionscoor@cdtfa.ca.gov. The services are outlined in Attachment 2, Sample FI$Cal PO, and Contract Agreement included herein.

The rates, set forth below in clear legible figures, shall remain in force for the stated term of the Agreement and shall include all Contractor’s costs, the cost of reinstatement fees if applicable, the cost of insurance, travel, State sales tax and every other item of expense, direct or indirect, in order to provide the services detailed in, Attachment 2, Sample FI$Cal PO and Contract Agreement.

Rates must be provided for all services listed below. If there is no cost for an item, please indicate N/A in the price area for that item. Failure to provide a complete Offer & Certification Sheet shall be cause for rejection of your Offer.

Cost must be provided for all services listed below. Failure to provide the required rates shall be cause for rejection of your quote.

Term: Year 1: March 1, 2025 – February 28, 2026

Product Description / Part # Qty. Unit Rate Extended Financial Industry Reporting web-based Industry research system 1 EA

Total:

Term: Year 2: March 1, 2026 – February 28, 2027

Product Description / Part # Qty. Unit Rate Extended Financial Industry Reporting web-based Industry research system 1 EA

Total:

Term: Year 3: March 1, 2027 – February 29, 2028

Product Description / Part # Qty. Unit Rate Extended Financial Industry Reporting web-based Industry research system 1 EA

Total:

Grand Total (Year 1 + Year 2 + Year 3): $__________________

NOTE: The CDTFA reserves the right to accept all or part of the Quote and Certification Sheet. The Cost for each Bid will be calculated based on the Grant Total cost. Optional pricing will not be used during evaluation. If CDTFA accepts the Optional Line item, CDTFA will encumber additional funds.

Term: Optional Year 4: March 1, 2028 – February 28, 2029

Financial Industry Reporting web-

Term: Optional Year 5: March 1, 2029 – February 28, 2030

Financial Industry Reporting web-

This information is binding on the Contractor, but not on the CDTFA. For the CDTFA, this information will be used for evaluation purposes only. If a contract is awarded based on this information, both parties will be bound to the pricing information given. By signing below Contractor swears under penalty of perjury that quote is true and correct, and that Contractor has read and understands all documents contained herein.

By signing below Contractor swears under penalty of perjury that the quote is complete, true, and correct and that the Contractor has read and understands all documents contained herein:

Bidder/Company Name (Printed):

Authorized By (Signature):

Name and Title of Person Signing (Printed):

Date Executed:

County:

State:

1. Company Name 2. Telephone Number

3. Fax Number

4. Address

5 E-Mail Address

Indicate your organization type:

6. Sole Proprietorship 7. Partnership 8. Corporation

Indicate the applicable employee and/or corporation number:

9. Federal Employee ID No. (FEIN) 10. California Corporation No.

11. Indicate applicable license and/or certification information:

12. Authorized Representative (Print) 13. Title

14. Signature 15. Date

16. Are you certified with the Department of General Services, Office of Small Business and DVBE Services (OSDS)

a. California Small Business b. Disabled Veteran Business Enterprise

Yes No Yes No

If yes, enter certification number: If yes, enter your service code below:

NOTE: A copy of your certification is required to be included if either of the above items is checked “Yes”.

Date application was submitted to OSDS, if an application is pending: ___________________

Item Numbers

Instructions

1, 2, 3, 4, 5

Must be completed and are self-explanatory.

Check if your firm is a sole proprietorship. A sole proprietorship is a form of business in which one person owns all the assets of the business in contrast to a partnership and corporation. The sole proprietor is solely liable for all the debts of the business.

Check if your firm is a partnership. A partnership is a voluntary agreement between two or more competent persons to place their money, effects, labor, and skill, or some or all of them in lawful commerce or business, with the understanding that there shall be a proportional sharing of the profits and losses between them. An association of two or more persons to carry on, as co-owners, a business for profit.

Check if your firm is a corporation. A corporation is an artificial person or legal entity created by or under the authority of the laws of a state or nation, composed, in some rare instances, of a single person and his successors, being the incumbents of a particular office, but ordinarily consisting of an association of numerous individuals.

Enter your federal employee tax identification number.

Enter your corporation number assigned by the California Secretary of State’s Office. This information is used for checking if a corporation is in good standing and qualified to conduct business in California.

Complete, if applicable, by indicating the type of license and/or certification that your firm possesses and that is required for the type of services being procured.

12, 13, 14, 15

Must be completed. These items are self-explanatory.

16 If certified as a California Small Business, place a check in the “Yes” box and enter your certification number on the line. If certified as a Disabled Veteran’s Business Enterprise, place a check in the “Yes” box and enter your service code on the line. If you are not certified to one or both, place a check in the “No” box.

If your certification is pending, enter the date your application was submitted to

OSDS.

ATTACHMENT 2

EXHIBIT A

STATEMENT OF WORK

INFORMATION TECHNOLOGY

September 2022 (Rev.)

SAMPLE

DO NOT COMPLETE OR SUBMIT WITH YOUR BID!

1. PURPOSE

A. Contractor, hereinafter referred to as the “Contractor”, agrees to provide to the California Department of Tax and Fee Administration, hereinafter referred to as “CDTFA” or the “State”, a Financial Industry Reporting web-based Industry research system for three (3) years as described herein.

B. The services shall be performed remotely for the CDTFA Headquarters.

C. The services shall be performed March 1, 2025, Monday through February 29, 2028, Monday through Friday, except weekends and State Holidays.

D. The Contractor is not authorized to commence work, as described in this contract, until the contract has been fully executed. Any services provided prior to execution of the contract shall be considered voluntary and non-compensable.

2. PRODUCT DESCRIPTION

Qty. Unit Product Description

1 EA Financial Industry Reporting web-based Industry research system

3. CONTRACT MANAGERS

CDTFA Business Contract Manager Contract Manager

Technology Services Division Company Name:

Contact Name: Contact Name:

Address:

651 Bannon Street, Suite 100, MIC: 26 Sacramento, CA 95811

Address:

Phone: Phone:

Email: Email:

CDTFA Project Manager

Technology Services Division

Contact Name:

Phone:

Email:

https://www.calhr.ca.gov/employees/pages/state-holidays.aspx

EXHIBIT A

Direct all contract inquiries to:

CDTFA Representative Contract Manager Business Management Bureau / Acquisitions Management Section Company Name:

Contact Name: Contracts Unit Contact Name:

Address:

651 Bannon Street, Suite 100, MIC: 24 Sacramento, CA 95811

Address:

Phone: (916) 309-5421 Phone:

Email: acquisitionscoor@cdtfa.ca.gov Email:

Either Contract Manager may be changed without a formal amendment to this contract. The changing party will notify the other party with a ten-day prior written notice by mail, or email, which will contain the new Contract Manager’s name, mailing address, email address and telephone numbers.

4. AMENDMENT

This Agreement may be amended at the CDTFA’s sole discretion to extend the term by two (2) one

(1) year terms. This Agreement may also be amended at the CDTFA’s sole discretion to add and/or remove licenses. If the CDTFA exercises this option, it will initiate an amendment to encumber additional funds or reduce funds, as applicable, at the rates listed in Exhibit B, Budget Detail and Payment Provisions.

5. CONTRACTOR’S RESPONSIBILITIES

A. Provide electronic access to online database services via public data network, Internet access, Internet web browser or private data network.

B. Provide a Point of Contact (POC), such as a Client Relationship Manager (CRM), that will be assigned to assist with any inquiries, including information about usage, login matters, remote training or other account questions.

C. Provide a one-time training in the use of the Contractor’s software and research protocols via telephone, Zoom/Microsoft Teams Meetings and/ or via webinar. Training shall include a product overview including features, reports, and Q&A session with CDTFA designated contact(s).

D. Provide system operation hours at minimum, from 8:00 a.m. through 5:00 p.m. Monday– Friday, Pacific Time (PT).

E. Provide technical support from 8:00 a.m. through 5:00 p.m., Monday-Friday, Pacific Standard Time (PST) via phone number, online submission method, or other way to submit inquires.

F. CDTFA Mandatory Attributes

1) The System will provide specific U.S. Industry Reports categorized by the 5- or 6-digit North American Industry Classification System (NAICS) codes.

EXHIBIT A

2) The NAICS Codes reports must contain statistics and analysis on the following categories:

i. Market characteristics and products including:

a) Supply chains and demand

b) Products and services

c) Major market

d) Business locations and revenues by state/county or other jurisdictions

ii. Current, past, and future performance

iii. Operating conditions

iv. Major companies and participants

v. Risks and Opportunities by sector

vi. Trends by sector

vii. Operations by sector and companies including:

a) Capital requirements and intensity

b) Regulations at state and national level

c) Revenue volatility

viii. Company Reports containing key statistics including:

a) Revenue and expenditure data

b) Various ratios

c) Annual changes

d) Revenue forecasts

3) The System will provide California specific reports, as well as other United States state-specific industry reports, categorized by NAICS codes.

4) The California specific reports, as well as other United States state-specific industry reports, will provide information on the following categories:

i. Industry data

ii. Analysis

iii. Forecasts at a local level

iv. Industry reports by county

5) The System will provide U.S. and California Business Environment Profiles which will include the following categories:

i. Consumer attitudes

ii. Demographics

iii. Other key indicators such as:

a) Economic indicators

b) Business environment

c) Industry risks

d) Forecasting

6) The System will provide U.S. and California reports on employment by the following categories:

i. Industries

ii. Consumer Price Index (CPI)

iii. Building permits

iv. Forecasting

v. Risk analysis

vi. Taxable sales

vii. Retail sales

viii. Income and expenditures

EXHIBIT A

7) The System will provide statistical data on various sectors and industries (organized by NAICS codes) and products as listed in the 2017 NAICS publication manual1.

8) The System will provide ad hoc requests/reporting related to various topics and industries needed for revenue estimates.

9) If entering CDTFA data into an online or cloud-based repository, the System must comply with the Cloud Computing Policy outlined in Exhibit C “Terms & Conditions”, and employ the capabilities outlined in Attachment 1 - Cloud Security Standard, Statewide Information Management Manual (SIMM) 5315-B.

G. Desirable Attributes

1) System provides Market trend reports and information, as needed.

2) System provides industry reports for:

i. Canada

ii. Mexico

iii. China

iv. Europe

v. Other countries not listed, if applicable.

3) System provides access to various other economic data and indicators available for download as needed.

6. CDTFA’S RESPONSIBILITIES

A. Designate authorized staff (POC) to contact the Contractor.

B. Request assistance via the Contractor’s designated method(s) of contact (phone, email, web form, etc.).

C. Open a support ticket for technical support needs as required by the Contractor.

D. CDTFA staff shall assist with troubleshooting activities as suggested by the Contractor.

7. SUBCONTRACTORS

Contractor may not subcontract any work, including subcontracting with temporary service agencies, without the express written approval of the CDTFA. If it is anticipated that subcontractors will be used, the Contractor shall provide to the CDTFA the names of the subcontractors, references for the subcontractors, and the portions and monetary percentages of the work to be done by the subcontractors. The Contractor retains total responsibility for fulfilling the requirements of this Agreement.

8. HEALTH AND SAFETY

Contractors are required to, at their own expense, comply with all applicable health and safety laws and regulations. Upon notice, Contractors are also required to comply with the state agency’s specific health and safety requirements and policies. Contractors agree to include in any subcontract related

1 https://www.census.gov/naics/reference_files_tools/2017_NAICS_Manul.pdf https://www.census.gov/naics/reference_files_tools/2017_NAICS_Manul.pdf

EXHIBIT A

to performance of this Agreement, a requirement that the subcontractor comply with all applicable health and safety laws and regulations, and upon notice, the state agency’s specific health and safety requirements and policies.

9. CONTRACTOR’S PERFORMANCE

A. CDTFA shall routinely evaluate the work performance of the Contractor and/or Provider to determine if CDTFA standards and Departmental policies and procedures are being maintained.

Any Contractor, and/or Provider who fail to perform or who are physically or mentally incapable of performing the required duties as required by this Agreement shall not be permitted to perform service.

B. Failure to provide services on three (3) or more occasions may result in termination of this Agreement.

C. The CDTFA Contract Manager or designee shall state in writing the reasons the Contractor and/or Provider did not meet the required policies or standards. CDTFA shall not pay Contractor for any services performed by Contractor and/or Provider which are deemed unacceptable in accordance with the required services contemplated by this Agreement.

10. SUSPENSION OR STOP WORK NOTIFICATION

A. CDTFA may, at any time, issue a notice to suspend performance or stop work under this Agreement. The initial notification shall be a written directive issued by the CDTFA. Upon receipt of said notice, the Contractor is to suspend and/or stop all, or any part, of the work called for by this Agreement.

B. Written confirmation of the suspension or stop work notification with directions as to what work (if not all) is to be suspended and how to proceed will be provided within thirty (30) days of the written notification. The suspension or stop work notification shall remain in effect until further written notice is received from CDTFA. The resumption of Work (in whole or part) will be at CDTFA’s discretion and upon receipt of written confirmation. Upon receipt of a suspension or stop work notification, the Contractor shall immediately comply with its terms and take all reasonable steps to minimize or halt the incurrence of costs allocable to the performance covered by the notification during the period of work suspension or stoppage. Within thirty (30) days of the issuance of a suspension or stop work notification, CDTFA shall either:

1) Cancel, extend, or modify the suspension or stop work notification; or

2) Terminate the Agreement.

If a suspension or stop work notification issued under this clause is canceled or the period of suspension or any extension thereof is modified or expires, the Contractor may resume work only upon written concurrence of CDTFA.

C. If the suspension or stop work notification is cancelled and the Agreement resumes, changes to the services, deliverables, performance dates, and/or contract terms resulting from the suspension or stop work notification shall require an amendment to the Agreement.

D. CDTFA shall not be liable to the Contractor for loss of profits because of any suspension or stop work notification issued under this clause.

EXHIBIT A-ATTACHMENT 1

CLOUD SECURITY STANDARD

SIMM 5315-B

State of California

California Department of Technology

Office of Information Security

Cloud Security Standard

August 2020

Office of Information Security Cloud Security Standard SIMM 5315-B

August 2020

RFQ-ITS 2024-4152

EXHIBIT A-ATTACHMENT 1

REVISION HISTORY

REVISION DATE OF RELEASE OWNER SUMMARY

OF CHANGES

Initial Release August 2020 Office of Information Security (OIS)

New Standard in support of SAM Sections 4983 - 4983.1, Technological Alternatives – Cloud Computing Policy, and SAM Sections 5315 - 5315.1, Information Security Integration, and System and Services Acquisition.

5315-B

August 2020

RFQ-ITS 2024-4152

EXHIBIT A-ATTACHMENT 1

TABLE OF CONTENTS

I. INTRODUCTION

II. MINIMUM CLOUD SECURITY REQUIREMENTS

A. Identify

B. Protect

C. Detect

D. Respond

E. Recover

III. QUESTIONS

5315-B

August 2020

RFQ-ITS 2024-4152

EXHIBIT A-ATTACHMENT 1

I. INTRODUCTION

Cloud computing is a model for enabling on-demand network access to configurable computing resources. These resources are provided under three service models:

- Infrastructure as a Service (IaaS), the capability to provision processing, storage, networks, and other fundamental computing resources;

- Platform as a Service (PaaS), the capability to deploy applications onto cloud infrastructure using programming languages and tools supported by the provider; and

- Software as a Service (SaaS), the capability to use the provider’s applications running on cloud infrastructure.1

The responsibility to secure these resources is shared between the customer and the cloud service provider, with varying responsibilities depending on the resource type and service model. Even with this shared responsibility, state entities remain ultimately responsible for selecting and configuring cloud services commensurate with risk tolerance and regulatory requirements.

II. MINIMUM CLOUD SECURITY REQUIREMENTS

To protect information and systems in cloud services, state entities must comply with the Cloud Computing Policy, State Administrative Manual (SAM) Sections 4983-4983.1, and employ the capabilities outlined in this Cloud Security Standard, SIMM 5315-B.

A. Identify

Identification and asset classification enable an entity to focus and prioritize efforts in alignment with its business needs and risk management strategy. To maintain an inventory of cloud information assets in accordance with SAM Section 5305.5, Information Asset Management, state entities shall:

1. Maintain an inventory of accounts with cloud service providers including root email addresses, account IDs, and points of contact.

2. Maintain a method of tracking configuration changes and viewing inventory and configuration history of cloud services.

3. Apply resource tags to data and applications according to their categorization and criticality.

B. Protect

Protective controls are proactive activities and security measures in support of the entity’s overall risk mitigation strategy and due diligence.

Identity and Access Management

Security of cloud services stems from managing authentication and fine-grained authorization. To safeguard cloud systems in accordance with SAM Section 5360, Identity and Access Management, state entities shall:

1. Maintain a tiered account management structure and apply restrictions on subordinate accounts (e.g., denying the removal of logging and security features, denying access to services that do not comply with regulatory requirements).

1 See SAM Section 4819.2 for complete definitions of cloud computing and each service model.

https://www.dgs.ca.gov/Resources/SAM/TOC https://cdt.ca.gov/policy/simm/

5315-B

August 2020

RFQ-ITS 2024-4152

EXHIBIT A-ATTACHMENT 1

2. Restrict usage of superuser access (i.e., root users) to the creation of less-privileged users for role-based access and administrative actions that can only be performed with superuser access.

3. Require multi-factor authentication for all (1) privileged access, (2) user access to sensitive or confidential data, and (3) accounts representing official communications from state departments.

4. Configure fine-grained user permissions according to least privilege. Ensure attempts to perform actions not permitted prompt notification of insufficient privilege.

5. Periodically audit access and remove unused credentials and permissions.

6. Maintain logical perimeters between production and non-production environments (e.g., development, test). Prohibit using the same credentials across environments, except where single sign-on technologies generate unique credentials for federated access.

7. Prohibit embedding credentials directly into code – configure applications to retrieve necessary credentials programmatically. Where feasible, programmatically generate temporary credentials instead of long-term credentials like passwords or access keys.

8. Provide access to cloud services by federated authentication through a centralized identity management system.

9. Deploy adaptive access control technologies to dynamically adjust authentication requirements based on contextual information (e.g., device content, endpoint security posture, user or entity behavior, location context, network context, targeted application).

Infrastructure Protection

Infrastructure protection controls limit the impact of unintended access or potential vulnerabilities, employing defense in depth. PaaS and SaaS resources may already have these controls implemented by the service provider. SAM Section 5315.6 requires state entities to configure information assets to provide only essential capabilities. In cloud systems, state entities shall:

10. Establish network topologies to limit traffic routing only between resources as necessary.

11. Limit resource exposure to the public internet to only those resources intended to be publicly accessible and protected accordingly, including deployment of endpoint defense capabilities in accordance with SAM Section 5355.

12. Deploy Web Application Firewalls and/or Distributed Denial of Service protection services to protect public-facing applications.

13. Require authentication and authorization when accessing cloud-based resources even across dedicated network connections, except resources intended to be publicly accessible.

14. Limit virtual machine access to instance metadata services.

Additionally, state entities are encouraged to:

15. Limit deployments and maintenance to automated technologies as much as possible, disabling services used for manual administration.

16. Utilize tools to programmatically scan for weak configurations, including identification and vulnerability assessment of public facing resources. Configure notification and/or automated remediation where possible.

17. Employ deployment practices which replace running instances with new instances created from an updated configuration, rather than updating running instances.

5315-B

August 2020

RFQ-ITS 2024-4152

EXHIBIT A-ATTACHMENT 1

Data Protection State entities are entrusted with protecting the integrity and confidentiality of data processed by their information systems. Cloud technologies simplify data protection by providing managed data storage services with native protection and backup features, but these features must be configured and managed appropriately.

State entities shall:

18. Select and configure storage services according to data availability (i.e., resilience to system downtime) and durability (i.e., resilience to data loss) requirements, which may include replication across cloud service provider zones and/or regions.

19. Configure fine-grained data access policies.

20. Protect data at rest by employing SAM Section 5350.1 compliant encryption and/or tokenization methods to transform confidential, sensitive, or personal data into a form that is unreadable to unauthorized users.

21. Protect data encryption keys from unauthorized use by defining restrictive policies for key use that enforce the principles of least privilege and separation of duties (e.g., separate users with key administration permissions from users with key use permissions, separate applications that require permission to encrypt data from applications that require permission to decrypt data, require decryption requests to come from a trusted network path).

22. Establish encryption key rotation policies to limit the impact of a single compromised key.

23. Employ SAM Section 5350.1 compliant encryption methods to protect data in transit outside trusted network boundaries, even across dedicated network connections to cloud service providers.

24. Configure data retention policies to automatically destroy data when it is no longer needed, in accordance with SAM Section 5310.6.

Additionally, state entities are encouraged to:

25. Employ techniques for automated discovery and classification of sensitive data.

26. Employ encryption methods to protect data in transit even within trusted network boundaries.

C. Detect

Detective controls identify potential security threats or incidents, supporting timely investigation and response. SAM Section 5345 requires state entities to continuously identify and remediate vulnerabilities. In cloud systems, state entities shall:

1. Log cloud management events to centralized log storage for each cloud service provider, maintaining audit records in accordance with SAM Section 5335.2.

2. Establish threat prevention capabilities to identify weak configurations and notify security personnel. Configure automated remediation where possible.

3. Establish threat detection capabilities informed by threat intelligence and configure alerts to notify security personnel.

Additionally, state entities are encouraged to:

4. Implement tools to detect access credentials being stored in source control repositories.

5. Publish cloud logs to the Security Information and Event Management (SIEM) system operated by the California Department of Technology (CDT) Security Operations Center

(SOC).

https://www.dgs.ca.gov/Resources/SAM/TOC https://www.dgs.ca.gov/Resources/SAM/TOC https://www.dgs.ca.gov/Resources/SAM/TOC

EXHIBIT A-ATTACHMENT 1

D. Respond

Respond controls enable timely event and incident response which is essential to reducing the impact if an incident were to occur. State entities shall comply with incident management requirements as outlined in SAM Sections 5340-5340.4, and shall:

1. Ensure incident response plans include procedures for notifying and coordinating with cloud service providers.

2. Ensure incident response procedures include providing access to external incident responders and protecting this access from unintentional use.

Additionally, state entities are encouraged to:

3. Configure automated remediation of weak configurations.

4. Configure automated responses for incident investigation, such as isolating resources from network access but preserving resource state.

E. Recover

Recover controls facilitate longer term recovery activities following events or incidents. With cloud services, primarily SaaS solutions, the service provider hosts the data in its application, and unless properly planned and provisioned for in the contract with the service provider it may be difficult or impossible to obtain the data in a usable format at contract termination. For business continuity, state entities shall:

1. Provision for data preservation and retrieval in agreements with cloud service providers, including but not limited to:

a. Identification of requisite formats for transfer of data to state entity or subsequent service provider.

b. A defined transition period to enable a successful transfer of data from service provider to state entity.

2. Configure automated data backups and virtual machine snapshots across zones and/or regions, according to recovery time and recovery point objectives.

Additionally, state entities are encouraged to:

3. Define and deploy cloud infrastructure using code-like methods, back up configurations and scripts, and protect them from deletion.

III. QUESTIONS

Questions regarding the implementation of this standard may be sent to: California

Department of Technology Office of Information Security Security@state.ca.gov mailto:Security@state.ca.gov

ATTACHMENT 3

MANDATORY ATTRIBUTES ASSESSMENT TABLE

The requirements described below are Mandatory. Bidders must submit the Mandatory Attributes Assessment Table with all checkboxes completed with the Bid package. This table is mandatory and is Pass/Fail.

Req. # DESCRIPTION Meets Req.

Yes No

1.

The System will provide specific U.S. Industry Reports categorized by the 5- or 6-digit North American Industry Classification System (NAICS) codes.

2.

The NAICS Codes reports must contain statistics and analysis on the following categories:

• Market characteristics and products including:

o Supply chains and demand o Products and services o Major market o Business locations and revenues by state/county or other jurisdictions

• Current, past, and future performance

• Operating conditions

• Major companies and participants

• Risks and Opportunities by sector

• Trends by Sector

• Operations by sector and companies including:

o Capital requirements and intensity o Regulations at state and national level o Revenue volatility

• Company Reports containing key statistics including:

o Revenue and expenditure data o Various ratios o Annual changes o Revenue forecasts

3. The System will provide California specific reports, as well as other United States state-specific industry reports, categorized by NAICS codes.

4.

The California specific reports, as well as other United States state-specific industry reports, will provide information on the following categories:

• Industry data

• Analysis

• Forecasts at a local level

• Industry reports by county

5315-B

August 2020

RFQ-ITS 2024-4152

ATTACHMENT 3

MANDATORY ATTRIBUTES ASSESSMENT TABLE

Req. # DESCRIPTION Meets Req.

5.

The System will provide U.S. and California Business Environment Profiles which will include the following categories:

• Consumer attitudes

• Demographics

• Other key indicators such as:

o Economic indicators o Business environment o Industry risks o Forecasting

6.

The System will provide U.S. and California reports on employment by the following…