25-08 Comp contract HR Software Services.pdf

Egg Harbor Township

COUNTY OF ATLANTIC

STATE OFNEW JERSEY

Competitive Contract Solicitation

FAIR & OPEN PUBLIC SOLICITATION PROCESS PURSUANT TO

N.J.S.A. 19:44A-20.5 ET SEQ.

CC# 25-08 HUMAN RESOURCES SOFTWARE

SERVICES

TOWNSHIP OF EGG HARBOR

PUBLIC OPENING August 20, 2025, at 10:30am https://www.bidnetdirect.com/new-jersey/ ehtgov Laura Pfrommer, Mayor

Ray Ellis, Jr., Deputy Mayor

Paul W. Hodson, Committeeman

William Pauls, Committeeman., Paul Rosenberg, Committeeman

Eileen M. Tedesco, RMC, Township Clerk

Thomas D’Intino, Township Administrator https://www.bidnetdirect.com/new-jersey/ehtgov

LEGAL NOTICE

Notice is hereby given by the Township of Egg Harbor that a Competitive Contract in accord with N.J.S.A.

40A:11- 4.1 will be received by the Township on August 20, 2025, at 10:30am prevailing time conducted on electronic platform, in accord with N.J.A.C. 5:34-1 et. Seq., on BIDNET at www.bidnetdirect.com// ehtgov

25-08 Human Resources Software Competitive Contract

NOTE:

It is the bidder’s responsibility to ensure that the bid package is uploaded onto the e-procurement site by the bid opening date and time. Any bid document received after the deadline established by the Department of Purchasing will not be accepted, regardless of the method of delivery.

Bidders must comply with the requirements of N.J.S.A. 10:5-31 et seq., and N.J.A.C. 17:27 et. Seq., The Township of Egg Harbor will award this Competitive Contract in accord with Price and Other Factors as outlined within N.J.S.A 40A:11-4.1 et. Seq., and N.J.A.C. 5:34-4.1 et. Seq., Report of Competitive Contract:

In accord with N.J.S.A. 40A:11-4.4(d) the summary report will be posted on the Township procurement website at www.bidnetdirect.com//ehtgov at least 48 hours prior to the governing body taking action on award.

This procurement has been advertised in accordance with the “Fair and Open Basis” and nothing further shall be required under the Pay-to-Play Legislation (N.J.S.A. 19:44A-20.5).

Date: July 25, 2025 Sean Canning QPA, MPA

Purchasing Agent http://www.bidnetdirect.com/ehtgov http://www.bidnetdirect.com/ehtgov

Applicable to Bid if marked “X”

DOCUMENTATION REQUIRED OR REVIEWED

Initials When Due

Bid Guarantee (Bid Bond or Certified/Cashier’s Check) (with

POA for full amount of Bid Bond)

With Bid

Submission

Consent of Surety (Certificate from Surety company) With Bid

Submission

Performance Bond and Labor and Material Payment Bond

(Required from the Awarded Contractor)

At signing of contract

Maintenance Bond in the Amount of 100 % for a period indicated in “General Conditions” Required from the Awarded

Contractor Upon Acceptance of Project

Upon

Acceptance of

Project

Acknowledgement of Receipt of Addenda (To be Completed if Addenda are Issued)

With Bid

Submission

X Ownership Disclosure Form With Bid

Submission

Named Subcontractors in Bid for Listed Specialty Trades With Bid

Submission

Public Works Contractor Registration Certificate(s) for the

Bidder and all Sub Contractors

Prior to Award, but effective at time of bid

X Business Registration Certificate – Bidder and all Sub

Contractors

Prior to

Contract

Award

Non-Collusion Affidavit With Bid

Submission

X Experience and Qualifications With Bid

Submission

X Insurance and Indemnification Certificate

Prior to

Contract

Award

X Disclosure of Investment Activities in Russia Form

Prior to

Contract

Award

X Disclosure of Investment Activities in Iran Form

Prior to

Contract

Award

Federal debarment Form

Prior to

Contract

Award

Prevailing Wage Certification (PL 2021, C301)

Prior to

Contract

Award

Equipment Certification With Bid

Submission

EEO/AA Form AA-201

After Notice of

Award, Prior to

Signing

Contract

X EEO/AA Form AA-302 or Letter of Federal Approval or

Certificate of Employee Information Report

After Notice of

Award, Prior to

Signing

Contract

X Acknowledgment of Appendix A

This checklist is provided for bidder’s use in assuring compliance with required documentation; however, it does not include all specifications requirements and does not relieve the bidder of the need to read and comply with the specifications.

Bidder

Name:

Date:

Authorized

Representative:

Signature:

Print Name &

Title:

prior to resolution of award

Bid Specification for Human Resources Software Solution

Township of Egg Harbor, New Jersey

1.0 Overview

a. The Township of Egg Harbor, New Jersey, is seeking proposals for a comprehensive Human Resources (HR) software solution in accordance with the competitive contracting process as outlined in the New Jersey Local Public Contracts Law at N.J.S.A. 40A:11-4.1 et seq.

b. Proposals will only be accepted through the Township’s e-procurement platform at www.bidnetdirect.com/ehtgov. All questions regarding this bid must also be submitted via the same platform.

c. The Township seeks the most advantageous proposal, considering price and other factors, to provide a cloud-based HR software solution for approximately 250 employees. The software must include the modules and functionalities specified below.

2.0 Submission Requirements

a. Vendors must submit a detailed proposal addressing the following:

b. Monthly Fees: Provide a clear breakdown of all recurring monthly fees for the proposed solution.

c. Number of Controls: Specify the number of administrative controls or user access levels included in the system.

d. Base Cost: Provide the upfront or one-time costs, including implementation, training, and setup fees.

e. Quantity of Employees: The solution must support approximately 250 employees.

f. Rate per Month for Final Cost: Provide the total monthly cost, inclusive of all fees, for the proposed solution servicing 250 employees.

g. Proposals must include a detailed cost structure, implementation timeline, and any additional costs for optional features or services. Vendors must also provide evidence of compliance with New Jersey state laws and regulations.

3.0 Scope of Work

a. The HR software solution must include the following modules and functionalities:

i. Human Resources

ii. Human Resources Management: Centralized platform for managing employee data, including personal information, job history, and performance records.

iii. Workflows Process Automation: Automated workflows for HR processes such as approvals, notifications, and task assignments.

iv. Centralized Document Library: Secure storage and organization of HR documents with version control and access permissions.

v. State Compliance Form Library: Pre-built forms to ensure compliance with New Jersey state regulations, including updates as laws change.

vi. Unlimited Custom Fields: Ability to create and manage custom data fields for employee records without additional costs.

vii. Employee Self-Service: Portal for employees to access and update personal information, view pay stubs, request time off, and complete compliance forms.

1. PROPOSAL MUST BE CAPABLE OF INTEGRATION WITH CURRENT

PAYROLL SOFTWARE – CASA PAYROLL SERVICES

viii. Position Management: Tools to manage job descriptions, classifications, and organizational hierarchies.

ix. Org Chart & Directory: Interactive organizational chart and employee directory with search capabilities.

x. Skills & Certifications Management: Tracking of employee skills, certifications, and renewal deadlines with automated reminders.

xi. Employment Verification: Automated system for verifying employment history and details for external requests.

b. Talent

i. Recruiting: End-to-end recruitment tools, including job posting, applicant tracking, interview scheduling, and candidate communication.

ii. Onboarding: Streamlined onboarding process with digital forms, task assignments, and integration with HR management.

c. Employee Experience

i. AI Assist: AI-powered tools to assist employees and HR staff with tasks such as answering FAQs, guiding workflows, or generating reports.

ii. Community: Features to foster employee engagement, such as internal forums, polls, or event management.

iii. Recognition: Tools to facilitate employee recognition programs, including peer-to-peer awards and milestone celebrations.

d. Mobile App: Fully functional mobile application for iOS and Android, providing access to employee self-service, notifications, and other key features.

4.0 Submission Process

a. All proposals and questions must be submitted electronically via the Township’s e-procurement platform at www.bidnetdirect.com/ehtgov. Hard copy or email submissions will not be accepted.

5.0 Timeline

a. RFP Release Date: July 7, 2025

b. Question Submission Deadline: July 22, 2025

c. Proposal Submission Deadline: July 29, 2025

d. Vendor Selection Date: August – September 2025

e. Contract Start Date: Approximately November 1, 2025

6.0 Contact Information

a. For questions or clarifications, please submit inquiries through the e-procurement platform at www.bidnetdirect.com/ehtgov.

7.0 Proposal Selection Criteria

a. Vendors may be asked to present their proposals in-person to a selection committee and/or to respond to questions. Based on the information provided in the proposal and any additional information presented, a final selection will be made.

b. The Township of Egg Harbor reserves the right to reject any and/or all proposals submitted under N.J.S.A.

40A:11-13.2, or to request information from any vendor regarding the terms of the engagement.

c. This procurement is being conducted as a competitive contract and will be decided upon price and other factors as defined with N.J.S.A. 40A:11-4.1 et. Seq.,

d. Selection will be based upon Price and other factors to include technical ability, managerial ability, cost.

i. Weights will be as follows:

1. Managerial _ 40%

2. Technical_ 40%

3. Cost __ 20%

8.0 APPENDIX

a. ALL FORMS AND QUESTIONS IN APPENDIX A MUST BE

COMPLETED AND SUBMITTED TO THE TOWNSHIPS

SATISFACTION. FAILURE TO PROVIDE FOR THIS

RESPONSE WILL RESULT IN A REJECTION OF THE

PROPOSERS SUBMITTAL

Technical criteria:

(Max Points ) 1 Pt = Poor Response, 3 Points = Average Response, 5 Pts = Concise and Superior

Response

Vendor Name:

Does the vendor's proposal demonstrate a clear understanding of the scope of work and related objectives?

(2) Is the vendor's proposal complete and responsive to the specific RFP requirements?

(3) Has the past performance of the vendor's proposed methodology been documented?

(4) Does the vendor's proposal use innovative technology and techniques?

Sub Total Technical 0 0 0

Management criteria:

3 Points = Average Response, 5

(1) Does the vendor document a record of reliability of timely delivery and on-time and on- budget implementation?

(2) Does the vendor document industry or program experience?

(3) Are the availability of in- house and contract resources documented?

Sub Total Managerial 0 0 0

Cost criteria:

3 Points = Average Response, 5

(1)Relative cost: How does the cost compare to other similarly scored proposals?

(2)Full explanation: Is the price and its component charges, fees, etc. adequately explained or documented?

(3) Does the proposal include quality control and assurance programs?

SUB TOTAL COST 0 0 0

Final Rater Score 0 0 0

EXHIBIT A

MANDATORY EQUAL EMPLOYMENT OPPORTUNITY LANGUAGE

N.J.S.A. 10:5‐31 et seq. (P.L.1975, c.127)

N.J.A.C. 17:27 et seq.

GOODS, GENERAL SERVICES, AND PROFESSIONAL SERVICES CONTRACTS

During the performance of this contract, the contractor agrees as follows:

The contractor or subcontractor, where applicable, will not discriminate against any employee or applicant for employment because of age, race, creed, color, national origin, ancestry, marital status, affectional or sexual orientation, gender identity or expression, disability, nationality or sex.

Except with respect to affectional or sexual orientation and gender identity or expression, the contractor will ensure that equal employment opportunity is afforded to such applicants in recruitment and employment, and that employees are treated during employment, without regard to their age, race, creed, color, national origin, ancestry, marital status, affectional or sexual orientation, gender identity or expression, disability, nationality or sex.

Such equal employment opportunity shall include, but not be limited to the following: employment, upgrading, demotion, or transfer; recruitment or recruitment advertising; layoff or termination; rates of pay or other forms of compensation; and selection for training, including apprenticeship.

The contractor agrees to post in conspicuous places, available to employees and applicants for employment, notices to be provided by the Public Agency Compliance Officer setting forth provisions of this nondiscrimination clause.

The contractor or subcontractor, where applicable will, in all solicitations or advertisements for employees placed by or on behalf of the contractor, state that all qualified applicants will receive consideration for employment without regard to age, race, creed, color, national origin, ancestry, marital status, affectional or sexual orientation, gender identity or expression, disability, nationality or sex.

The contractor or subcontractor will send to each labor union, with which it has a collective bargaining agreement, a notice, to be provided by the agency contracting officer, advising the labor union of the contractor's commitments under this chapter and shall post copies of the notice in conspicuous places available to employees and applicants for employment.

The contractor or subcontractor, where applicable, agrees to comply with any regulations promulgated by the Treasurer pursuant to N.J.S.A. 10:5‐31 et seq., as amended and supplemented from time to time and the Americans with Disabilities Act.

The contractor or subcontractor agrees to make good faith efforts to meet targeted county employment goals established in accordance with N.J.A.C. l7:27‐5.2.

The contractor or subcontractor agrees to inform in writing its appropriate recruitment agencies including, but not limited to, employment agencies, placement bureaus, colleges, universities, and labor unions, that it does not discriminate on the basis of age, race, creed, color, national origin, ancestry, marital status, affectional or sexual orientation, gender identity or expression, disability, nationality or sex, and that it will discontinue the use of any recruitment agency which engages in direct or indirect discriminatory practices.

The contractor or subcontractor agrees to revise any of its testing procedures, if necessary, to assure that all personnel testing conforms with the principles of job related testing, as established by the statutes and court decisions of the State of New Jersey and as established by applicable Federal law and applicable Federal court decisions.

In conforming with the targeted employment goals, the contractor or subcontractor agrees to review all procedures relating to transfer, upgrading, downgrading and layoff to ensure that all such actions are taken without regard to age, race, creed, color, national origin, ancestry, marital status, affectional or sexual orientation, gender identity or expression, disability, nationality or sex, consistent with the statutes and court decisions of the State of New Jersey, and applicable Federal law and applicable Federal court decisions. The contractor shall submit to the public agency, after notification of award but prior to execution of a goods and services contract, one of the following three documents:

Letter of Federal Affirmative Action Plan Approval; Certificate of Employee Information

Report; or

Employee Information Report Form AA‐302 (electronically provided by the Division and distributed to the public agency through the Division’s website at: http:// www.state.nj.us/treasury/contract_compliance.

The contractor and its subcontractors shall furnish such reports or other documents to the Division of Purchase & Property, CCAU, EEO Monitoring Program as may be requested by the office from time to time in order to carry out the purposes of these regulations, and public agencies shall furnish such information as may be requested by the Division of

Purchase & Property, CCAU, EEO Monitoring Program for conducting a compliance investigation pursuant to N.J.A.C. 17:27‐1.1 et seq http://www.state.nj.us/treasury/contract_compliance

NEW JERSEY ANTI-DISCRIMINATION PROVISIONS

N.J.S.A. 10:2-1 ET SEQ.

Pursuant to N.J.S.A. 10:2-1, if awarded a contract, the contractor agrees that:

a. In the hiring of persons for the performance of work under this contract or any subcontract hereunder, or for the procurement, manufacture, assembling or furnishing of any such materials, equipment, supplies or services to be acquired under this contract, no contractor, nor any person acting on behalf of such contractor or subcontractor, shall, by reason of race, creed, color, national origin, ancestry, marital status, gender identity or expression, affectional or sexual orientation or sex, discriminate against any person who is qualified and available to perform the work to which the employment relates;

b. No contractor, subcontractor, nor any person on his behalf shall, in any manner, discriminate against or intimidate any employee engaged in the performance of work under this contract or any subcontract hereunder, or engaged in the procurement, manufacture, assembling or furnishing of any such materials, equipment, supplies or services to be acquired under such contract, on account of race, creed, color, national origin, ancestry, marital status, gender identity or expression, affectional or sexual orientation or sex;

c. There may be deducted from the amount payable to the contractor by the contracting public agency, under this contract, a penalty of $50.00 for each person for each calendar day during which such person is discriminated against or intimidated in violation of the provisions of the contract; and

d. This contract may be canceled or terminated by the contracting public agency, and all money due or to become due hereunder may be forfeited, for any violation of this section of the contract occurring after notice to the contractor from the contracting public agency of any prior violation of this section of the contract.

SAMPLE CERTIFICATE OF EMPLOYEE INFORMATION REPORT

New Jersey Business Registration Certification

Pursuant to N.J.S.A. 52:32-44, The Township of Egg Harbor (“Contracting

Agency”) is prohibited from entering into a contract with an entity unless the bidder/proposer/contractor, and each subcontractor that is required by law to be named in a bid/proposal/contract has a valid Business Registration Certificate on file with the Division of Revenue and Enterprise Services within the Department of the Treasury.

Prior to contract award or authorization, the contractor shall provide the Contracting Agency with its proof of business registration and that of any named subcontractor(s).

Subcontractors named in a bid or other proposal shall provide proof of business registration to the bidder, who in turn, shall provide it to the Contracting Agency prior to the time a contract, purchase order, or other contracting document is awarded or authorized.

During the course of contract performance:

(1) the contractor shall not enter into a contract with a subcontractor unless the subcontractor first provides the contractor with a valid proof of business registration.

(2) the contractor shall maintain and submit to the Contracting Agency a list of subcontractors and their addresses that may be updated from time to time.

(3) the contractor and any subcontractor providing goods or performing services under the contract, and each of their affiliates, shall collect and remit to the Director of the Division of Taxation in the Department of the Treasury, the use tax due pursuant to the Sales and Use Tax Act, (N.J.S.A.

54:32B-1 et seq.) on all sales of tangible personal property delivered into the State. Any questions in this regard can be directed to the Division of Taxation at (609)292-6400. Form NJ-REG can be filed online at http://www.state.nj.us/treasury/revenue/busregcert.shtml.

Before final payment is made under the contract, the contractor shall submit to the Contracting Agency a complete and accurate list of all subcontractors used and their addresses.

Pursuant to N.J.S.A. 54:49-4.1, a business organization that fails to provide a copy of a business registration as required, or that provides false business registration information, shall be liable for a penalty of $25 for each day of violation, not to exceed $50,000, for each proof of business registration not properly provided under a contract with a contracting agency.

Emergency Purchases or Contracts

For purchases of an emergent nature, the contractor shall provide its Business Registration Certificate within two weeks from the date of purchase or execution of the contract or prior to payment for goods or services, whichever is earlier.

http://www.state.nj.us/treasury/revenue/busregcert.shtml

SAMPLE BUSINESS REGISTRATION CERTIFICATE

PAY TO PLAY ADVISORY

Disclosure Requirement

P.L. 2005, Chapter 271, Section 3 Reporting

(N.J.S.A. 19:44A – 20.27)

Any business entity that has received $50,000 or more in contracts from government entities in a calendar year will be required to file an annual disclosure report with ELEC.

The report will include certain contributions and contract information for the current calendar year.

At a minimum, a list of all business entities that file an annual disclosure report will be listed on ELEC’s website at www.elec.state.nj.us.

If you have any questions please contact ELEC at:

1-888-313-ELEC (toll free in NJ) or 609-292-8700

An analyst from ELEC’s Special Programs Section will assist you.

http://www.elec.state.nj.us/

STATEMENT OF OWNERSHIP DISCLOSURE

N.J.S.A. 52:25-24.2 (P.L. 1977, c.33, as amended by P.L. 2016, c.43)

This statement shall be completed, certified to, and included with all bid and proposal submissions. Failure to submit the required information is cause for automatic rejection of the bid or proposal.

Name of Organization:

Organization Address:

Part I Check the box that represents the type of business organization:

Sole Proprietorship (skip Parts II and III, execute certification in Part IV)

Non-Profit Corporation (skip Parts II and III, execute certification in Part IV)

For-Profit Corporation (any type) Limited Liability Company (LLC)

Partnership Limited Partnership Limited Liability Partnership (LLP)

Other (be specific):

Part II

The list below contains the names and addresses of all stockholders in the corporation who own 10 percent or more of its stock, of any class, or of all individual partners in the partnership who own a 10 percent or greater interest therein, or of all members in the limited liability company who own a 10 percent or greater interest therein, as the case may be. (COMPLETE

THE LIST BELOW IN THIS SECTION)

OR

No one stockholder in the corporation owns 10 percent or more of its stock, of any class, or no individual partner in the partnership owns a 10 percent or greater interest therein, or no member in the limited liability company owns a 10 percent or greater interest therein, as the case may be. (SKIP TO PART IV)

(Please attach additional sheets if more space is needed):

Name of Individual or Business Entity Address

Part III DISCLOSURE OF 10% OR GREATER OWNERSHIP IN THE STOCKHOLDERS, PARTNERS

OR LLC MEMBERS LISTED IN PART II

If a bidder has a direct or indirect parent entity which is publicly traded, and any person holds a 10 percent or greater beneficial interest in the publicly traded parent entity as of the last annual federal Security and Exchange Commission (SEC) or foreign equivalent filing, ownership disclosure can be met by providing links to the website(s) containing the last annual filing(s) with the federal Securities and Exchange Commission (or foreign equivalent) that contain the name and address of each person holding a 10% or greater beneficial interest in the publicly traded parent entity, along with the relevant page numbers of the filing(s) that contain the information on each such person. Attach additional sheets if more space is needed.

Website (URL) containing the last annual SEC (or foreign equivalent) filing Page #’s

Please list the names and addresses of each stockholder, partner or member owning a 10 percent or greater interest in any corresponding corporation, partnership and/or limited liability company (LLC) listed in Part II other than for any publicly traded parent entities referenced above. The disclosure shall be continued until names and addresses of every noncorporate stockholder, and individual partner, and member exceeding the 10 percent ownership criteria established pursuant to N.J.S.A. 52:25-24.2 has been listed. Attach additional sheets if more space is needed.

Stockholder/Partner/Member and Corresponding Entity Listed in Part II

Address

Part IV Certification

I, being duly sworn upon my oath, hereby represent that the foregoing information and any attachments thereto to the best of my knowledge are true and complete. I acknowledge: that I am authorized to execute this certification on behalf of the bidder/proposer; that the Township is relying on the information contained herein and that I am under a continuing obligation from the date of this certification through the completion of any contracts with Township to notify the Township in writing of any changes to the information contained herein; that I am aware that it is a criminal offense to make a false statement or misrepresentation in this certification, and if I do so, I am subject to criminal prosecution under the law and that it will constitute a material breach of my agreement(s) with the, permitting the Township to declare any contract(s) resulting from this certification void and unenforceable.

Full Name (Print): Title:

Signature: Date:

Experience & Qualifications Questionnaire

This questionnaire must be filled out and submitted as a part of the Proposal. Failure to complete this form or to provide any of the requested information will be grounds for the rejection of the bid proposal. If additional space is required, the respondent shall add additional sheets, which identify the question being answered.

Number of years in business under present name & address:

If less than 5 years, list previous names and address:

Within the last 5 years has the business or any officer/partner failed to complete a contract awarded to them: . If yes, provide the details in on a separate page.

Have any liens and lawsuits been filed against the company in the past 5 years:

If yes, please provide details:

List similar services you are now providing for which you have signed contract, but not yet started work:

List all major subcontractors to be used to complete the service and the area of their responsibility:

Please provide at least 3 references below:

Name: Phone:

Address:

Equipment/Service Provided:

Contract Amount:

Non-Collusion Affidavit

STATE OF NEW JERSEY

TOWNSHIP OF EGG HARBOR:

I certify that I am of the firm of the Respondent making this Proposal for the bid or proposal for the above named project, that I executed the said proposal with full authority to do so; that said bidder has not, directly or indirectly entered into any agreement, participated in any collusion or otherwise taken any action in restraint of free, competitive bidding in connection with the above named project; and that all statements contained in said proposal and this affidavit are true, correct, and made with full knowledge that the Township of Egg Harbor relies upon the truth of the statements contained in said Proposals and in the statements contained in this affidavit in awarding the contract for the said project.

I further warrant that no person or selling agency has been employed or retained to solicit or secure such contract upon an agreement or understanding for a commission, percentage, brokerage, or contingent fee, except bona fide employees or bona fide established commercial or selling agencies.

Signature of Representative:

Subscribed and sworn to before me this day of , Print Name of

Affiant:

Notary Public of

My commission expires

*This form MUST be completed, notarized and submitted with the bid document*

Americans with Disabilities Act of 1990

The CONTRACTOR and the OWNER do hereby agree that the provisions of Title 11 of the Americans With Disabilities Act of

1990 (the "ACT") (42 U.S.C~ S12101 et seq.), which prohibits discrimination on the basis of disability by public entities in all services, programs, and activities provided or made available by public entities, and the rules and regulations promulgated pursuant thereunto, are made a part of this contract. In providing any act benefit, or service on behalf of the OWNER pursuant to this contract, the CONTRACTOR agrees that the performance shall be in strict compliance with the Act. In the event that the

Contractor, its agents, servants, employees, or subcontractors violate or are alleged to have violated the Act during the performance of this contract, the CONTRACTOR shall defend the OWNER in any action or administrative proceeding commenced pursuant to this Act. The Contractor shall indemnify, protect, and save harmless the OWNER, its agents, servants, and employees from and against any and all suits, claims, losses, demands, or damages, of whatever kind or nature arising out of or claimed to arise out of the alleged violation. The CONTRACTOR shall, at its own expense, appear, defend, and pay any and all charges for legal services and any and all costs and other expenses arising from such action or administrative proceeding or incurred in connection therewith. In any and all complaints brought pursuant to the OWNER grievance procedure, the

CONTRACTOR agrees to abide by any decision of the OWNER which is rendered pursuant to said grievance procedure. If any action or administrative proceeding results in an award of damages against the OWNER or if the OWNER must any expense to cure a violation of the ADA which has been brought pursuant to its grievance procedure, the CONTRACTOR shall satisfy and discharge the same at its OWN expense.

The OWNER shall, as soon as practicable after a claim has been made against it, give written notice thereof to the

CONTRACTOR along with frill and complete particulars of the claim. if any action or administrative proceedings is brought against the OWNER or any of its agents, servants, and employees, the OWNER shall expeditiously forward or have forwarded to the CONTRACTOR every demand, complaint, notice, summons, pleading, or other process received by the OWNER or its representatives.

It is expressly agreed and understood that any approval by the OWNER of the services provided by the CONTRACTOR pursuant to this contract will not relieve the CONTRACTOR of the obligation to comply with the Act and to defend, indemnify, protect, and save harmless the OWNER pursuant to this paragraph.

It is further agreed and understood that the OWNER assumes no obligation to indemnify or save harmless the CONTRACTOR, its agents, servants, employees and subcontractors for any claim which may arise out of their performance of this Agreement.

Furthermore, the CONTRACTOR expressly understands and agrees that the provisions of this indemnification clause shall in no way limit the CONTRACTOR'S obligations assumed in this Agreement, nor shall they be construed to relieve the

CONTRACTOR from any liability, nor preclude the OWNER from taking any other actions available to it under any other provisions of the Agreement or otherwise at law.

Furthermore, the contractor expressly understands and agrees that the provisions of this indemnification clause shall in no way limit the contractor’s obligations assumed in this Agreement, nor shall they be construed to relieve the contractor from any liability, nor preclude the owner from taking any other actions available to it under any other provisions of the Agreement or otherwise at law.

Part 2: Additional Information

Disclosure of Investment Activities in Iran

Person or Entity

Part 1: Certification

COMPLETE PART 1 BY CHECKING EITHER BOX.

Pursuant to Public Law 2012, c. 25, any person or entity that is a successful bidder or proposer, or otherwise proposes to enter into or renew a contract, must complete the certification below to attest, under penalty of perjury, that neither the person or entity, nor any parent entity, subsidiary, or affiliate is identified on the State Department of Treasury's

Chapter 25 list as a person or entity engaging in investment activities in Iran. The list is found on Treasury’s website at www.state.nj.us/treasury/purchase/pdf/Chapter25List.pdf.

The Chapter 25 list must be reviewed prior to completing the below certification. If a vendor or contractor is found to be in violation of law, action may be taken as appropriate and as may provided by law, rule or contract, including but not limited to imposing sanctions, seeking compliance, recovering damages, declaring the party in default and seeking debarment or suspension of the party.

I certify, pursuant to Public Law 2012, c. 25, that neither the person or entity listed above, nor any parent entity, subsidiary, or affiliate thereof is listed on the N.J. Department of the

Treasury’s list of entities determined to be engaged in prohibited activities in Iran pursuant to P.L. 2012, c. 25 ("Chapter 25 List"). I further certify that I am the person listed above, or I am an officer or representative of the entity listed above and am authorized to make this certification on its behalf. I will skip Part 2 and sign and complete the Certification below.

OR

I am unable to certify as above because the person or entity and/or a parent entity, subsidiary, or affiliate thereof is listed on the N.J. Department of the Treasury’s Chapter

25 list. I will provide a detailed, accurate and precise description of the activities in Part 2 below sign and complete the Certification below.

http://www.state.nj.us/treasury/purchase/pdf/Chapter25List.pdf

PLEASE PROVIDE FURTHER INFORMATION RELATED TO INVESTMENT ACTIVITIES IN IRAN.

You must provide a detailed, accurate and precise description of the activities of the person or entity, or a parent entity, subsidiary, or affiliate thereof engaging in investment activates in Iran below and, if more space is needed, on additional sheets provided by you.

Part 3: Certification of True and Complete Information

I, being duly sworn upon my oath, hereby represent and state that the foregoing information and any attachments there to the best of my knowledge are true and complete. I attest that I am authorized to execute this certification on behalf of the above-referenced person or entity.

I acknowledge that the Township is relying on the information contained herein and thereby acknowledge that

I am under a continuing obligation from the date of this certification through the completion of any contracts with the Township to notify the Township in writing of any changes to the answers of information contained herein.

I acknowledge that I am aware that it is a criminal offense to make a false statement or misrepresentation in this certification, and if I do so, I recognize that I am subject to criminal prosecution under the law and that it will also constitute a material breach of my agreement(s) with the Township and that the Township at its option may declare any contract(s) resulting from this certification void and unenforceable.

Full Name (Print) Title

Signature Date

CERTIFICATION OF NON‐INVOLVEMENT IN PROHIBITED ACTIVITIES

IN RUSSIA OR BELARUS

Pursuant to N.J.S.A. 52:32-60.1, et seq. (L. 2022, c. 3) any person or entity (hereinafter “Vendori”) that seeks to enter into or renew a contract with a State agency for the provision of goods or services, or the purchase of bonds or other obligations, must complete the certification below indicating whether or not the Vendor is identified on the Office of

Foreign Assets Control (OFAC) Specially Designated Nationals and Blocked Persons list, available here:

https://sanctionssearch.ofac.treas.gov/. If the Department of the Treasury finds that a Vendor has made a certification in violation of the law, it shall take any action as may be appropriate and provided by law, rule or contract, including but not limited to, imposing sanctions, seeking compliance, recovering damages, declaring the party in default and seeking debarment or suspension of the party.

I, the undersigned, certify that I have read the definition of “Vendor” below, and have reviewed the Office of Foreign

Assets Control (OFAC) Specially Designated Nationals and Blocked Persons list, and having done so certify:

(Check the Appropriate Box)

A.

That the Vendor is not identified on the OFAC Specially Designated Nationals and Blocked Persons list on account of activity related to Russia and/or Belarus.

B. That I am unable to certify as to “A” above, because the Vendor is identified on the OFAC Specially Designated

Nationals and Blocked Persons list on account of activity related to Russia and/or Belarus.

C.

That I am unable to certify as to “A” above, because the Vendor is identified on the OFAC Specially Designated

Nationals and Blocked Persons list. However, the Vendor is engaged in activity related to Russia and/or Belarus consistent with federal law, regulation, license or exemption. A detailed description of how the Vendor’s activity related to Russia and/or Belarus is consistent with federal law is set forth below.

(Attach Additional Sheets If Necessary.)

Signature of Vendor’s Authorized Representative Date

Print Name and Title of Vendor’s Authorized Representative Vendor’s FEIN https://pub.njleg.state.nj.us/Bills/2022/PL22/3_.PDF https://sanctionssearch.ofac.treas.gov/ https://sanctionssearch.ofac.treas.gov/ https://sanctionssearch.ofac.treas.gov/ https://sanctionssearch.ofac.treas.gov/ https://sanctionssearch.ofac.treas.gov/ https://sanctionssearch.ofac.treas.gov/ https://sanctionssearch.ofac.treas.gov/ https://sanctionssearch.ofac.treas.gov/

Vendor’s Name Vendor’s Phone Number

Vendor’s Address (Street Address) Vendor’s Fax Number

Vendor’s Address (City/State/Zip Code) Vendor’s Email Address i Vendor means: (1) A natural person, corporation, company, limited partnership, limited liability partnership, limited liability company, business association, sole proprietorship, joint venture, partnership, society, trust, or any other nongovernmental entity, organization, or group; (2) Any governmental entity or instrumentality of a government, including a multilateral development institution, as defined in Section 1701(c)(3) of the

International Financial Institutions Act, 22 U.S.C. 262r(c)(3); or (3) Any parent, successor, subunit, direct or indirect subsidiary, or any entity under common ownership or control with, any entity described in paragraph (1) or (2).

NJ Rev. 1.22.2024

APPENDIX A

TOWNSHIP OF EGG HARBOR

Division of Information Technology

Cloud Product Security Questionnairre 3515 Bargaintown Road Egg Harbor Township, New Jersey 08234

(609) 926-4017 SNewsome@ehtgov.org

Rev 4/2023

THIS DOCUMENT IS CONFIDENTIAL FOR COMPUTER SECURITY PURPOSES

** FOR OFFICIAL USE ONLY ** Page 1 of 3

Product Name Contact Name and Information for Follow-up:

Company Name Company Address Company Support Telephone Number Company Website (Support portal) Type of technical support that you offer:

This product will store/handle PII (Personally Identifiable Information):

This product will store/handle PHI (Protected Health Information):

This product will store/handle PCI/DSS Data (Payment Card Industry):

Category & Question Response (Drop- Down)

More information / clarification space

About the Company

1. Has your company/organization been credentialed with SOC1/SOC2 (not just the data center) or ISO 27001/27002 or similar?

2. Does your company have a qualified security officer (or team) on staff?

3. Does the company maintain insurance coverage for cyber-related liabilities?

4. Does the Cyber Liability coverage include loss, theft, or failure to protect PII, PHI, or confidential information (including violation of security laws), PCI or DSS violations, including any failure to prevent a security breach General Security Posture

5. Does your company/organization subscribe to and enforce any industry standard frameworks (such as CJIS, ISO 27001/27002, CIS Top 18, etc). If yes, please identify in remarks column

6. Do you perform external penetration tests and internal vulnerability scans (at least annually for each) for general business systems?

7. Do you separate the production/product network from other non-related computer networks (front office/development) (network segmentation)?

8. Do you assign roles to limit data access of employees to only that needed to perform their essential duties?

9. Does your internal e-mail system require "modern authentication" and multi-factor ID?

Personnel Security

10. Are background checks conducted for all perspective employees and subcontractors who have access to sensitive information?

11. Does the company allow employment of persons with a serious criminal history events, such as felonies, thefts, fraud, or other similar convictions?

12. Can company representatives access a readable or downloadable form of our data without our involvement (e.g., is a customer key required to access our data internally?)

Support Access

13. Are unique user logins (ID) required for all technicians and representatives?

14. Are complex passwords required for these accounts?

15. How often are password changes required for these accounts?

16. Is MFA required for all technicians/company representatives to access our data?

17. Do you log all access to our data by company agents?

18. Does the company have a policy in practice to immediately expire access of former employees?

Awareness/Training

19. Does your company require Computer Security Awareness (CSA) training at least annually?

Questions 21-23 are regarding your CSA training program:

Basic Product and Company Information

Thank you for reviewing our questionnaire. Our agency is a customer or prospective customer of a cloud-based product that your company provides. This worksheet helps us plans for security needs and demonstrate compliance in some areas, so your participation is appreciated and important to us and the public we serve.

This is a generic questionnaire to address many different types of cloud services. Some cloud products may store more or less information than others, so this list is an assessment tool and not necessarily a list of strict requirements. We understand that not all questions may apply, and there is a “N/A” option for those situations. Please help us by answering the questions you can to the best of your ability.

We require these forms to be returned to the Division of Information Technology. If you have received this from a Department Head or known contact, you may also return it to and work with that person. Otherwise, please return to Steve Newsome (Director, Information Technology) at snewsome@ehtgov.org. Questions can be sent to this address or by phone (609) 926-4037.

20. How is your awareness program delivered (Please describe below)?

PII, PHI, and PCI/DSS data can be further explained by the NJ Statewide Information Security Manual (Pages 46-48) at (clickable):

https://www.cyber.nj.gov/NJ-Statewide-Information-Security-Manual.pdf }

Cloud Product Security Questionnairre 3515 Bargaintown Road Egg Harbor Township, New Jersey 08234

(609) 926-4017 SNewsome@ehtgov.org

Rev 4/2023

THIS DOCUMENT IS CONFIDENTIAL FOR COMPUTER SECURITY PURPOSES

** FOR OFFICIAL USE ONLY ** Page 2 of 3

21. Are all employees delivered training at least annually on identifying, handling, and the risk, legal and contractual needs for PII, PHI, and confidential customer data

22. Are all employees delivered training at least annually covering how to identify and respond with safe handling to E-mail risks, including Phishing/Spear-phishing, social engineering scams.

23. If applicable to credit card processing, are all employees delivered training at least annually on their responsibilities for safeguarding financial data and PCI compliance

About Our Data

24. Is our data (in whole, part, or anonymized) used outside of the intended purpose of the product and/or shared/sold to any third-party?

25. Does the product have a method to remove all information, copies, and backups of our data upon request or termination of service?

26. Is our data backed up and restorable?

28. Are backups retained for at least 14 days, with at least one backup restorable for each of the preceding 14 days?

30. Are data backups tested and verified as working?

31. How often are backups tested and verified?

32. Are backups encrypted at rest with a minimum of AES256?

33. If applicable, are backups encrypted in transit?

35. Does a utility exist to allow us to copy a data backup (en masse) to our location?

Product

36. Does the product and infrastructure comply with, and carry a certification if available, any of the following: (CJIS, NIST, FedRAMP, etc).

37. Is encryption required for data in transit?

38. If web-based encryption is used, does the product require/permit only TLS 1.2 and above, a valid PKI certificate with a 2048 bit or above key size, permit only modern ciphers (outdated ciphers disabled), encrypts with AES128 or above.

39. Product supports TLS 1.2 and above in general, and disabling all access to TLS 1.1 and prior versions (along with outdated ciphers)?

40. Does the product support multi-factor ID through the use of codes sent to phones or an Authenticator application?

41. Does the product have the ability to synchronize with Active Directory?

42. Does the product support SAML?

43. Does the product have the ability for us to specify authorized public IP addresses to which logins may be restricted?

44. Does the product have the ability to set account and password policies for groups of users, such as: password length, password complexity, password expiration, password lockouts on failure, expire accounts?

45. Does the product has the ability to produce audit reports of persons logged in, origin location, and their activities, within the interface?

46. Product has the ability to produce reports of users, password last changed dated, lockout, and active/inactive status?

47. Does your support system for the product conform to the questions above?

48. If your product sends out E-mail, do you keep a copy of messages sent and for how long?

49. If your product sends out E-Mail, does the mail server use industry frameworks for authentication and policy (SPF, DEMARC)?

50. If your product sends out E-Mail, does it attempt to do so using our existing E-mail domain name (@ehtgov.org, @ehtpd.com, @mcculloughgolf.com)

51. Are product application servers patched (all software) on a regular schedule for security vulnerabilities?

52. Does the company scan for vulnerabilites (CVE) of application servers at least twice annually, with required remediations of any findings?

53. Does the company employ Intrustion Prevention Systems (IPS), Data Loss Protection (DLP) and other systems to identify data loss or attempts?

Data Centers

54. Are cloud data centers being used? In which countries are the data centers located.

55. Does the Data Center have a SOC-1 or SOC-2 credential?

56. Are servers on-premise to the company being used to process the application and/or store our data?

57. Is our data encrypted at rest?

58. Describe controls for physical access to any on-premise assets that can access our data:

Security Incident Response

59. Does the company have an Incident Response Plan in place?

34. Who holds the decryption keys for the backup? How is the decryption key protected?

29. In a typical, everyday scenario, if our backup needed to be restored, how long would the process take?

60. Please describe how we will be notified of a security breach, intrusion, or similar event effecting the company or product.

27. How often are data backups performed?

Cloud Product Security Questionnairre 3515 Bargaintown Road Egg Harbor Township, New Jersey 08234

(609) 926-4017 SNewsome@ehtgov.org

Rev 4/2023

THIS DOCUMENT IS CONFIDENTIAL FOR COMPUTER SECURITY PURPOSES

** FOR OFFICIAL USE ONLY ** Page 3 of 3

62. Please describe the method by which we would report a security breach or concern about your product to you:

61. Please briefly summarize your security procedures and investigation resources, in the event that we suspect a security event that we report to you:

Additional Comment Space snewsome Rectangle snewsome Line

System Description

These specifications are presumed to be for a web-based software system (“Product”), which the vendor (“Company”) provides the hosting service and all server components, and the Township (the “Customer”) accesses though services using the Internet and a standard web browser.

Web Interface Requirements

1. Product will have full support and compatibility with the Microsoft Edge web browser, without modifications to the browser configuration.

2. Product will be updated as needed for the duration of the contract or subscription to maintain full support and compatibility with the future generally available version of Microsoft Edge web browser, without modifications to the browser configuration.

3. All data communications (data in transit) between product servers and clients at customer will be encrypted with a minimum 128 bit encryption using TLS 1.2 or better.

4. Product servers will use certificates for SSL/TLS encryption signed by a generally accepted CA (certificate authority). Custom or self-signed certificates will not be acceptable for customer clients to access Product services.

5. The product’s web interface will not use or deploy data collection or tracking utilities to that will be shared or sold to any third-party that is not directly necessary for the operation of the Product.

Desktop Requirements

6. Product will be compatible with Microsoft Windows 11, or currently in-support Microsoft operating system while customer in contract or subscription.

7. Any desktop-installed components will be capable of running in user-only mode (no “local admin” administrative privileges within the operating system).

8. Any desktop-installed software will be capable of installation using command-line, silent installation that can be scripted for deployment.

9. Compatible with EDR security systems (currently, Crowdstrike).

Mobile device application

10. Product will include a…