27-PRO-0011-S - Perceived Risk Hierarchy Theory (PRHT) Digital Platform.pdf

i

RFP – Rev. 05/13/2019- Office of General Counsel

MORGAN STATE UNIVERSITY™

REQUEST FOR PROPOSALS

FOR

Project Name: PERCEIVED RISK HIERARCHY THEORY (PRHT) DIGITAL PLATFORM

Project Number: 27/PRO-0011-S

PROSPECTIVE OFFERORS (“OFFERORS’) WHO OBTAINED THIS REQUEST FOR

PROPOSALS (“RFP”) FROM ANY SOURCE OTHER THAN THE DIRECTOR OF

PROCUREMENT OR AN AUTHORIZED DESIGNEE, SHOULD IMMEDIATELY PROVIDE

THEIR NAMES AND EMAIL ADDRESSES TO THE MORGAN STATE UNIVERSITY OFFICE

OF PROCUREMENT AND PROPERTY CONTROL (“ISSUING OFFICE”), TO ENSURE

RECEIPT OF ADDENDA AND OTHER COMMUNICATIONS REGARDING THE RFP.

Morgan State University Office of Procurement and Property Control

2101 E. Biddle Street, Suite 1202 Baltimore, MD 21213

(443) 885-3074

NOTE:

ALL BUSINESSES, INCLUDING MINORITY, WOMEN-OWNED, AND SMALL BUSINESSES,

ARE ENCOURAGED TO RESPOND TO THIS SOLICITATION

https://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&ved=2ahUKEwjXxvzEz7HhAhVqm-AKHWNxB2kQjRx6BAgBEAU&url=https://www.youtube.com/channel/UCg4C8vRdNi_2zfl4LTeh3yA&psig=AOvVaw1TgN_9k2rqJhfdxbbs7L55&ust=1554301784716349 https://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&ved=2ahUKEwjXxvzEz7HhAhVqm-AKHWNxB2kQjRx6BAgBEAU&url=https://www.youtube.com/channel/UCg4C8vRdNi_2zfl4LTeh3yA&psig=AOvVaw1TgN_9k2rqJhfdxbbs7L55&ust=1554301784716349� ii

KEY INFORMATION SUMMARY SHEET

Request for Proposals

PERCEIVED RISK HIERARCHY THEORY (PRHT) DIGITAL PLATFORM

RFP Issue Date: August 18, 2026

RFP Issuing Office: Morgan State University Office of Procurement and Property Control

Procurement Officer or Procurement Officer’s Representative: Ryan Waites Office Phone: (443) 885-3417 E-mail: ryan.waites@morgan.edu Fax: (443) 885-8368

Mailing Address: Morgan State University Office of Procurement and Property Control 2101 E. Biddle Street, Suite 1202

Baltimore, MD 21213 Attention: Ryan Waites

Pre-Proposal Conference Date: N/A

Deadline for Questions: August 25, 2026

Closing Date and Time: September 10, 2026, at 2:00 p.m. Local Time.

Oral Presentations (If Applicable): TBD

Contract Term: One (1) Year Base, one (1) Option Year.

Morgan State University is committed to ensuring that persons with disabilities have equally effective opportunities to participate in and benefit from Morgan State University's programs and services. Persons who may require reasonable accommodations pursuant to the Americans with Disabilities Act of 1990 (“ADA”) (42 U.S.C. § 12101 et. seq.) should contact the RFP Issuing Office at 443-885-3074 at least five

(5) days prior to any meeting scheduled in connection with this RFP.

iii

MORGAN STATE UNIVERSITY

NOTICE TO OFFERORS

To help improve the quality of proposal solicitations and to make our procurement process more responsive and "business friendly," we ask that you provide comments and suggestions regarding the enclosed RFP. Please return your comments with your proposal or "no proposal," response, as the case may be. Thank you for your assistance.

Proposal Number: 27/PRO-0011-S Titled: Perceived Risk Hierarchy Theory (PRHT) Digital Platform

I. If you have responded with a "no proposal" please indicate the reasons below:

( ) Other commitments preclude our participation at this time.

( ) The subject of the solicitation is not something we normally provide.

( ) We are inexperienced in the work/commodities required.

( ) The specifications are either unclear or too restrictive (Explain below).

( ) The scope of work is beyond our current capacity.

( ) Doing business with Maryland Government agencies is simply too complicated (Explain below).

( ) We cannot be competitive (Explain below).

( ) Time allotted for completion of the bid/proposal response is insufficient.

( ) Startup time is insufficient.

( ) Bonding/Insurance requirements are prohibitive (Explain below).

( ) Minority Business Enterprise (“MBE”) requirements (Explain below)

( ) Proposal requirements (other than specifications or scope) are unreasonable or too risky (Explain below).

( ) Prior experience with Morgan State University contracts was unprofitable or otherwise unsatisfactory (Explain below).

( ) Payment schedule too slow.

( ) Other:

II. If you have submitted a proposal, but wish to offer suggestions or express concerns, please use the remarks section below.

Remarks:

Offeror Name:

Contact Person:

Signature: Date:

Address:

E-Mail:

Telephone: Fax:

iv

TABLE OF CONTENTS

Morgan State University ........................................................................................................ i KEY INFORMATION SUMMARY SHEET .............................................................................. ii NOTICE TO OFFERORS ........................................................................................................iii TABLE OF CONTENTS .........................................................................................................iv

SECTION 1. INFORMATION FOR OFFERORS

1.1 SUMMARY STATEMENT

1.2 ISSUING OFFICE AND PROCUREMENT OFFICER

1.3 PRE-PROPOSAL CONFERENCE

1.4 QUESTIONS AND INQUIRIES

1.5 PROPOSAL DUE DATE

1.6 DURATION OF PROPOSAL OFFER

1.7 PROCUREMENT METHOD

1.8 MULTIPLE OR ALTERNATE PROPOSALS

1.9 MINORITY BUSINESS ENTERPRISE UTILIZATION – (N/A)

1.10 SMALL BUSINESS PROCUREMENT

1.11 EXPRESSIONS OF INTEREST

SECTION 2. GENERAL INFORMATION FOR OFFERORS

2.1 PURPOSE

2.2 ADDENDA TO THE RFP

2.3 PRE-PROPOSAL MODIFICATION OR WITHDRAWAL OF OFFERS

2.4 CANCELLATION OF SOLICITATION/REJECTION OF ALL PROPOSALS

2.5 DISCUSSIONS

2.6 ORAL PRESENTATIONS

2.7 INCURRED EXPENSES

2.8 ARREARAGES

2.9 VERIFICATION OF REGISTRATION AND TAX PAYMENT

2.10 PREPARATION OF PROPOSALS

2.11 PUBLIC INFORMATION ACT NOTICE

2.12 EXECUTION OF PROPOSALS

2.13 DISCREPANCIES, EXPLANATIONS AND CLARIFICATIONS

2.14 ORDER OF PRECEDENCE

2.15 REQUIRED CONTRACT PROVISIONS

v

2.16 OFFEROR RESPONSIBILITIES

2.17 FALSIFICATION/CONCEALMENT OF MATERIAL FACTS/COLLUSION

2.18 PAYMENT TO THE CONTRACTOR; TAXES

2.19 NEWS/PRESS RELEASES

2.20 RECIPROCAL PREFERENCE

2.21 VENDOR ELECTRONIC FUNDS TRANSFER REGISTRATION

2.22 PARKING/TRAFFIC

2.23 DRUGS AND ALCOHOL

2.24 GOOD FAITH

2.25 PROTESTS

2.26 DEBRIEFING OF UNSUCCESSFUL OFFERORS

2.27 SOC 2 Type 2 AUDIT REPORT

SECTION 3. PERFORMANCE WORK STATEMENT (PWS)

3.1 INTRODUCTION

3.2 BACKGROUND

3.6 TERM OF CONTRACT

3.7 PERFORMANCE PERIOD AND ACCEPTANCE

SECTION 4. CLAUSES

4.1 CLAUSES INCORPORATED IN FULL TEXT

SECTION 5- SPECIAL REQUIREMENTS

5.1 QUALITY CONTROL (QC):

5.2 SUPERVISION OF EMPLOYEES:

5.3 SUBCONTRACTORS/OR STAFF:

5.4 QUALITY ASSURANCE:

SECTION 6. CONTRACT ADMINISTRATION

6.1 PARTNERING:

6.2 POST AWARD CONFERENCE (THE MSU WILL PAY NO ADDITIONAL COST FOR

ATTENDANCE)

SECTION 7. VENDOR PERFORMANCE RATING

7.1 CONTRACTOR EVALUATION RATINGS

7.2 BUSINESS MEETINGS:

7.3 PRODUCTION MEETINGS:

7.4 ADMINISTRATIVE SUBMITTALS:

7.5 NON-CONFORMING PRODUCTS OR SERVICES:

vi

7.6 REMOVAL OF PERSONNEL:

7.7 CONTRACTOR COMPLIANCE:

SECTION 8. INSTRUCTIONS

8.1 SPECIAL INSTRUCTIONS:

8.2 THE UNIVERSITY SHALL NOT PAY COST INCURRED IN SUBMISSION OF PROPOSAL:

8.3 INCORPORATION OF PROPOSAL:

8.4 PROPOSAL SUBMISSION:

8.5 PROPOSED PRODUCTS AND/OR SERVICES THAT EXCEED MINIMUM

REQUIREMENTS:

8.6 GENERAL INSTRUCTIONS:

8.7 PRICE PROPOSAL CONTENT AND FORMAT:

8.8 EVALUATION:

APPENDICES

pg. 1

SECTION 1. INFORMATION FOR OFFERORS

This RFP is governed by Morgan State University’s Procurement Policies and Procedures approved by the Morgan State University Board of Regents on January 11, 2005 and the Board of Public Works September 21, 2005.

1.1 SUMMARY STATEMENT

Morgan State University (“the University” or “Morgan”), an agency and instrumentality of the State of Maryland, located at 1700 East Cold Spring Lane, Baltimore Maryland 21251, is a historically Black institution with the unique designation as Maryland’s preeminent public urban research university. Governed by a Board of Regents, Morgan is independent of the University of Maryland System. Currently, the University enrolls approximately 10,000 students and employs over 2,200 individuals. Offering degree programs from the baccalaureate through the doctorate, Morgan has a comprehensive mission which encompasses instruction, research and public service.

This RFP is intended to provide Offerors with sufficient information to prepare and submit proposals for consideration (“Proposals”) in order to provide Morgan with a qualified Offeror to design, develop, implement, deploy, and support a cloud-based Perceived Risk Hierarchy Theory (PRHT) Digital Platform. In addition, this RFP will provide Offerors an opportunity to present their qualifications, experience, and conceptual approach to providing the requested services. This RFP is subject to all applicable laws and regulations, and Morgan State University policies.

1.2 ISSUING OFFICE AND PROCUREMENT OFFICER

The sole point of contact for the purposes of this RFP is the Director of Procurement or an authorized designee (hereinafter referred to as Procurement Officer) noted on the Key Information Summary Sheet (Page ii). Only the information communicated by the Procurement Officer shall be deemed the official position of University; no other State or University employee, official, or representative has authority to change the requirements of this solicitation. Attempts by an Offeror to contact members of the “Evaluation Committee” or otherwise circumvent this procedure in any manner may be grounds for disqualification of the Offeror from the procurement process.

1.3 PRE-PROPOSAL CONFERENCE

A pre-proposal conference will be held as noted on the Key Information Summary Sheet (Page ii). Offerors shall submit questions in writing to the Procurement Officer prior to the pre-proposal conference. Offerors are not required to attend the pre-proposal conference.

However, in order to ensure adequate seating, all Offerors planning to attend the pre-proposal conference should confirm their attendance, in writing, to the Issuing Office, not less than thirty (30) days in advance of the conference date. A site visit of the facility will directly follow the pre-proposal conference. Any other site visits will require advanced scheduling.

pg. 2

Morgan is committed to ensuring that persons with disabilities have equally effective opportunities to participate in and benefit from Morgan's programs and services. Persons who require reasonable ADA accommodation should contact the Issuing Office at least five (5) days prior to the pre-proposal conference, as well as for any other meeting scheduled in connection with this RFP.

1.4 QUESTIONS AND INQUIRIES

Offerors shall direct all communications regarding this solicitation to the Procurement Officer. Submit questions to the Procurement Officer, in writing (email preferred) not later than the date indicated on the Key Information Summary Sheet (Page ii). Addenda, if required, will be furnished to all potential Offerors known to have received the RFP.

1.5 PROPOSAL DUE DATE

Proposals must be received at the Issuing Office by the time and date indicated in the Key Information Summary Sheet (Page ii). Any Proposal, request for withdrawal, or modification of a proposal that is not received at the Issuing Office by the designated time and date indicated will be considered late and will not be considered.

Delivery of the Proposal to the specified location at the prescribed time and date is the sole responsibility of the Offeror. Requests for extensions will not be granted, nor will late requests for modification, or late requests for withdrawal be considered.

At the sole discretion of the Procurement Officer, exceptions may be made only when the University’s reason for receipt of a late Proposal, Proposal withdrawal request or Proposal modification request is due to the action or inaction of the Procurement Officer.

1.6 DURATION OF PROPOSAL OFFER

Proposals submitted in response to this RFP are irrevocable for ninety (90) days following the closing date for proposals or, if requested by the Procurement Officer, the due date for best and final offers (“BAFO”).

1.7 PROCUREMENT METHOD

This solicitation shall be conducted in accordance with all applicable laws and regulations, as well as the Morgan State University Procurement Policies and Procedures (Approved by the Morgan State University Board of Regents on January 11, 2005 and Approved by the Board of Public Works on September 21, 2005 (MSU Item 1-GM)). The procurement method is “Competitive Sealed Proposals”.

1.8 MULTIPLE OR ALTERNATE PROPOSALS

Multiple or alternate Proposals “will not” be accepted.

1.9 MINORITY BUSINESS ENTERPRISE UTILIZATION – (N/A)

1.10 SMALL BUSINESS PROCUREMENT

If this solicitation indicates that this procurement has been designated for a small business reserve, the provisions of COMAR Title 21.11.01.06 pertaining to small business reserve shall apply and are incorporated herein by reference.

pg. 3

1.11 EXPRESSIONS OF INTEREST

Expressions of interest shall come due, as identified on the Key Information Summary Sheet (Page ii). Failure to provide an expression of interest shall not disqualify Offerors from providing a Proposal. Expressions of Interest may be sent to the Procurement Officer.

SECTION 2. GENERAL INFORMATION FOR OFFERORS

2.1 PURPOSE

The purpose of this solicitation is to provide information to Offerors interested in preparing and submitting proposals to meet the requirements contained herein. Offerors shall familiarize themselves with each section and subsection of this document.

2.2 ADDENDA TO THE RFP

The University reserves the right to amend this solicitation at any time prior to the proposal due date. If any amendments or addenda are required, the Procurement Officer shall send a copy of the amendments to all potential Offerors that are known to have received a copy of the solicitation. All amendments shall include a statement to the effect that Offerors are required to acknowledge receipt of any amendments to the request for proposals. If appropriate, the due date shall be adjusted to ensure that sufficient time is given to prospective Offerors to consider the information contained in the amendment for preparation of their responses.

2.3 PRE-PROPOSAL MODIFICATION OR WITHDRAWAL OF OFFERS

Proposals may be modified or withdrawn by written notice received at the Issuing Office at any time before the proposal due date and time. Any request for withdrawal, or modification, of a Proposal that is not received at the Issuing Office by the designated time and date indicated will be considered late and will not be considered.

At the sole discretion of the Procurement Officer, exceptions may be made only when the University’s reason for receipt of a late request for withdrawal, or modification, is due to the action or inaction of the Procurement Officer.

2.4 CANCELLATION OF SOLICITATION/REJECTION OF ALL PROPOSALS

The University reserves the right to cancel this RFP, to accept or reject any or all proposals, in whole or in part, received in response to this RFP, and to waive or permit cure of minor irregularities as its best interests may require.

2.5 DISCUSSIONS

MSU intends to evaluate proposals and award a contract without discussions with vendors. Therefore, the vendor’s initial proposal should contain the vendor’s best terms from a cost and price and technical standpoint. MSU reserves the right to conduct discussions if the Contracting Officer later determines them deemed to be necessary. If

pg. 4 the Procurement Officer determines that a number of proposals that would otherwise be in the competitive range exceeds the number at which an efficient competition can be conducted, the Procurement Officer may limit the number of proposals in the competitive range to the greatest number that will permit an efficient competition among the most highly rated proposals.

2.6 ORAL PRESENTATIONS

Offerors may be required to make oral presentations to University representatives. If necessary, the Procurement Office will provide notice of the time and place for presentations.

2.7 INCURRED EXPENSES

The University assumes no responsibility for expenses incurred by Offeror in preparing and submitting a Proposal, making an oral presentation, or participating in discussions or any other activity in response to this RFP.

2.8 ARREARAGES

By submitting a response to this RFP, each Offeror shall be deemed to represent that it is not in arrears in the payment of any obligation due and owing the State of Maryland, including the payment of taxes and employee benefits, and that it shall not become so in arrears during the term of the contract if selected for contract award.

2.9 VERIFICATION OF REGISTRATION AND TAX PAYMENT

Each Offeror ensures that it is appropriately registered to do business in the State of

Maryland, and in good standing with respect to taxes, personal property returns, unemployment insurance, etc., before the closing date. Failure to complete registration with the State Department of Assessments and Taxation (SDAT) may disqualify an otherwise successful Offeror from recommendation for contract award.

2.10 PREPARATION OF PROPOSALS

Proposals should be prepared simply and economically, providing a straight-forward, clear, concise, and cogent description of the Vendor’s ability to fulfill the requirements of this solicitation. Proposals are to be submitted in an attachment in the email and submitted directly to the Procurement Officer named in the Key Information Summary Sheet.

2.11 PUBLIC INFORMATION ACT NOTICE

Offerors should give specific attention to identification of those portions of the proposals that they deem to be confidential, proprietary information or trade secrets and provide any justification why such materials, upon request, should not be disclosed by the State under the Public Information Act, Title 4, Subtitle 3 of the State Government General Provisions Article, Annotated Code of Maryland.

2.12 EXECUTION OF PROPOSALS

Proposals shall be typewritten or written legibly in ink, and signed in ink as follows, depending on the Offeror's form of business organization:

pg. 5

1. Sole Proprietorship. The Proprietor shall sign full name, with address.

2. Partnership and Joint Venture. Submit the proposal in the name of the partnership or joint venture. Clearly state the partnership name and the identity of each general partner, and execute all affidavits and certificates on behalf of the partnership, or on behalf of each general partner. No provision of any agreement among partners will be binding on the University unless it is disclosed in the Offeror’s proposal. Reasonable evidence satisfactory to the University of the authority of one partner to bind other purported partners is required. It is recommended that the proposal contain a copy of the partnership agreement, if one exists. If no partnership agreement exists, and if the number of general partners is reasonably small, each general partner should execute all required documents included in the proposal. At the University's option, all general partners may be required to sign the proposal. Failure to present the University with satisfactory information concerning a purported partnership or joint venture may be grounds for finding a proposal unacceptable.

3. Corporation. An officer or authorized agent of the corporation shall sign with full name, indicate title, and include the name and address of the corporation. In the case of an authorized agent, enclose a letter from an officer of the corporation authorizing said individual to act on behalf of the corporation.

2.13 DISCREPANCIES, EXPLANATIONS AND CLARIFICATIONS

Should an Offeror find discrepancies in the specifications or other provisions included in this solicitation, or be in doubt as to the meaning or intent of any section or subsection, the Offeror shall request clarification from the Procurement Officer. Failure to request clarification prior to the due date shall be a waiver of any claim by the Offeror for expenses made necessary by reason of later interpretation of the contract documents, and the Offeror shall be bound to the University's interpretation. Request clarifications in accordance with the instructions above in Section I. (D) of this RFP.

2.14 ORDER OF PRECEDENCE

The contract to be entered into as a result of the RFP ("Contract") will consist of the following Contract Documents, listed in their order of precedence:

1. The Morgan State University Contract

2. This RFP, including any of its exhibits/attachments

3. The Offeror's Proposal

4. Any other supporting documentation

No modifications to this order of precedence will be accepted.

pg. 6

2.15 REQUIRED CONTRACT PROVISIONS

All proposals submitted, and the contracts executed by the successful Offeror(s), are subject to the applicable Morgan State University Terms and Conditions attached hereto in the Appendices.

By submitting a Proposal in response to this solicitation, the Offeror, if selected for award, shall be deemed to have agreed to and accepted all contract terms and conditions set forth in the Morgan State University contract, which is incorporated by reference.

2.16 OFFEROR RESPONSIBILITIES

The successful Offeror shall be responsible for all products and services required by this

RFP. Subcontractors, if any, must be identified and a complete description of their role relative to the project must be identified.

2.17 FALSIFICATION/CONCEALMENT OF MATERIAL FACTS/COLLUSION

Offerors are advised that pursuant to Section 11-205(b) of the State Finance and

Procurement Article of the Annotated Code of Maryland (MD. State Fin. & Pro. Code § 11-205(b)), a person who, for the purpose of defrauding the State, acts in collusion with another person in connection with the procurement process is liable for damages equal to three (3) times the value of the loss to the State that is attributable to the collusion.

In addition, Offerors are advised that section 11-205.1 of the State Finance and Procurement Article of the Annotated Code of Maryland (MD. State Fin. & Pro. Code § 11-205.1) provides as follows:

(a) In general. -- In connection with a procurement contract a person may not willfully:

(1) falsify, conceal, or suppress a material fact by any scheme or device;

(2) make a false or fraudulent statement or representation of a material fact; or

(3) use a false writing or document that contains a false or fraudulent statement or entry of a material fact.

(b) Aiding or conspiring with others. -- A person may not aid or conspire with another person to commit an act under subsection (a) of this section.

(c) Penalty. -- A person who violates any provision of this section is guilty of a felony and on conviction is subject to a fine not exceeding $ 20,000 or imprisonment not exceeding five (5) years or both.

2.18 PAYMENT TO THE CONTRACTOR; TAXES

Payment is governed by Title 15, Subtitle 1 of the State Finance and Procurement Article, Annotated Code of Maryland. The State of Maryland is exempt from Maryland Retail Sales Tax and Federal Excise Tax.

2.19 NEWS/PRESS RELEASES

The successful Offeror shall issue no press release to any publication, including newspapers, with regard to work being conducted under this contract. The University is

pg. 7 the only entity that may issue or authorize the issuance of any news or press releases to this RFP, its evaluation, award of any contract, and performance there under relating.

Each Offeror further agrees that any commercial advertising resulting from a contract must receive prior approval from the University.

2.20 RECIPROCAL PREFERENCE

1. The provisions of Section 14-401 of the State Finance and Procurement Article of the Annotated Code of Maryland (MD. State Fin. & Pro. Code §14-401) and COMAR

21.05.01.04 shall apply to this RFP.

2. Offerors, who are non-Maryland residents, submitting a Proposal for this solicitation shall include in its Proposal a copy of the current statute, resolution, policy, procedure, or executive order of the resident state for the non-Maryland resident Offeror that pertains to that state's treatment of non-Maryland resident Offerors.

3. Although Maryland law does not authorize procuring agencies to favor resident bidders in awarding procurement contracts, many other states do grant their resident businesses preference over Maryland contractors. Therefore, according to COMAR 21.05.01.04, the University may apply, where applicable, the same preference against an out-of-state business that the business's home state, or state in which its principal office or base of business is located, or principal location from which the services required under this RFP would be provided, would apply against an Offeror whose principal office or base of business is located in Maryland.

2.21 VENDOR ELECTRONIC FUNDS TRANSFER REGISTRATION

Contractors of the State are required to complete a COT/GAD Form X-10, Vendor

Electronic Funds Transfer (EFT) Registration Request Form, attached hereto in the Appendices, for each new contract with a value greater than $200,000. Vendors must register for EFT by submitting a completed COT/GAD Form X-10 to the Maryland State Comptroller’s General Accounting Division (GAD) or request an exemption from GAD.

Additionally, by submitting a response to this solicitation, the Offeror agrees to accept payments by electronic funds transfer unless GAD grants an exemption. Any request for exemption must be submitted to GAD for approval at the address specified on the COT/GAD Form X-10, Vendor Electronic Funds Transfer (EFT) Registration Request Form and must include the business identification information as stated on the form and include the reason for the exemption.

2.22 PARKING/TRAFFIC

All vehicles on Morgan State University property must strictly observe Morgan’s Parking

& Traffic Regulations at all times. All fines and penalties related to parking, traffic, or other vehicle violations are the responsibility of the contractor. This applies to vendors, salespersons, company vehicles, and contractor employees’ personal vehicles. Morgan State University’s Parking & Traffic Regulations can be found at:

https://www.morgan.edu/parking https://www.morgan.edu/parking

pg. 8

2.23 DRUGS AND ALCOHOL

This RFP is subject to the provisions of COMAR 21.11.08 (Drug and Alcohol-Free Workplace), and the Morgan State University Drug and Alcohol Abuse Policy (Board of Regents Approved, May 4, 2010). Pursuant to COMAR 21.11.08, Offerors shall submit with its Proposal a certification concerning a drug and alcohol-free workplace. Morgan State University is dedicated to providing a campus environment free of the illegal and/or abusive use of alcohol and/or drugs. The illegal and/or abusive use of drugs and/or alcohol by members of the campus community jeopardizes the safety of the individual and the campus community, and is contrary to the academic learning process. Morgan State University is therefore committed to having a campus that is free of the illegal and/or abusive use of drugs and alcohol. In keeping with this commitment, it is the policy of the University that the illegal and/or abusive use of drugs or alcohol is prohibited on University property or as part of University activities. Further, the possession and/or consumption of alcoholic beverages is prohibited on University premises, except as expressly permitted in writing by the President or designee. Morgan State University Drug and Alcohol Abuse Policy can be found at: https://www.morgan.edu/board-of-regents/policies-and-procedures

2.24 GOOD FAITH

Offerors agree to deal in good faith with the University during the solicitation process and, if selected, during the performance of the contract. In determining an Offeror’s responsibility, the Procurement Officer may consider whether the Offeror has dealt in good faith with Morgan or any other agency of the State of Maryland in the past.

2.25 PROTESTS

An Offeror may protest the proposed award or the award of a contract for this procurement. Any protest must be filed in accordance with Morgan State University’s Procurement Policies and Procedures – Section X, Protests and Claims.

2.26 DEBRIEFING OF UNSUCCESSFUL OFFERORS

Unsuccessful Offerors may request a debriefing. If the Offeror chooses to do so, the request must be submitted in writing to the Procurement Officer within ten (10) days after the Offeror knew, or should have known its Proposal was unsuccessful. Debriefings shall be limited to discussion of the specific Offeror's proposal only and shall not include a discussion of a competing Offeror's proposal. Debriefings shall be conducted at the earliest feasible time.

2.27 SOC 2 Type 2 AUDIT REPORT

A SOC 2 Type 2 Audit applies to the Contract.

2.27.1 The applicable trust principles are: << Security, Availability, Processing

Integrity, Confidentiality, or Privacy.

The University will choose which of the five trust principles apply as defined in the aforementioned Guidance.

2.27.2 In the event the Contractor provides services for identified critical functions, handles Sensitive Data, or hosts any related implemented https://www.morgan.edu/board-of-regents/policies-and-procedures https://www.morgan.edu/board-of-regents/policies-and-procedures

pg. 9 system for the State under the Contract, the Contractor shall have an annual audit performed by an independent audit firm. Critical functions are identified as all aspects and functionality of the Solution including any add-on modules and shall address all areas relating to Information Technology security and operational processes. These services provided by the Contractor that shall be covered by the audit and will collectively be referred to as the “Information Functions and Processes.” Such audits shall be performed in accordance with audit guidance: Reporting on Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy (SOC 2) as published by the American Institute of Certified Public Accountants (AICPA) and as updated from time to time, or according to the most current audit guidance promulgated by the AICPA or similarly-recognized professional organization, as agreed to by the University, to assess the security of outsourced client functions or data (collectively, the “Guidance”) as follows:

1. The type of audit to be performed in accordance with the Guidance is a SOC 2 Type 2 Audit (referred to as the “SOC 2 Audit” or “SOC 2 Report”). All SOC 2 Audit Reports shall be submitted to the Contract Owner (Program or Contract Monitor). The initial SOC 2 Audit shall be completed within a timeframe to be specified by Morgan State University.

The audit period covered by the initial SOC 2 Audit shall start with the Contract Effective Date unless otherwise agreed to in writing by the Contract Monitor. All subsequent SOC 2 Audits after this initial audit shall be performed at a minimum on an annual basis throughout the Term of the Contract, and shall cover a 12-month audit period or such portion of the year that the Contractor furnished services.

2. The SOC 2 Audit shall report on the suitability of the design and operating effectiveness of controls over the Information Functions and Processes to meet the requirements of the Contract, including the Security Requirements identified by the University relevant to the trust principles as defined in the aforementioned Guidance.

3. The audit scope of each year’s SOC 2 Report may need to be adjusted

(including the inclusion or omission of the relevant trust services principles of Security, Availability, Processing Integrity, Confidentiality, and Privacy) to accommodate any changes to the environment since the last SOC 2 Report. Such changes may include but are not limited to the addition of Information Functions and Processes through modifications to the Contract or due to changes in Information Technology or the operational infrastructure. The Contractor shall ensure that the audit scope of each year’s SOC 2 Report engagement shall accommodate these changes by including in the SOC 2 Report all appropriate controls related to the current environment supporting the Information Functions and/or

pg. 10

Processes, including those controls required by the Contract.

4. The scope of the SOC 2 Report shall include work performed by any subcontractors that provide essential support to the TO Contractor or essential support to the Information Functions and Processes provided to the University under the Contract. The Contractor shall ensure the audit includes all such subcontractors operating in performance of the Contract.

5. All SOC 2 Audits, including those of the Contractor, shall be performed at no additional expense to the University.

6. The Contractor shall provide to the Contract Owner/Monitor, within 30 calendar days of the issuance of each SOC 2 Report, a complete copy of the final SOC 2 Report(s) and a documented corrective action plan addressing each audit finding or exception contained in the SOC 2 Report.

The corrective action plan shall identify in detail the remedial action to be taken by the Contractor along with the date(s) when each remedial action is to be implemented.

7. If the Contractor currently has an annual, independent information security assessment performed that includes the operations, systems, and repositories of the Information Functions and Processes being provided to the University under the Contract, and if that assessment generally conforms to the content and objective of the Guidance, Morgan State University will determine in consultation with appropriate University Department/s and audit authorities whether the Contractor’s current information security assessments are acceptable in lieu of the SOC 2 Report(s).

8. If the Contractor fails during the Contract term to obtain an annual SOC 2

Report by the date specified in Section AA.2.1, the University shall have the right to retain an independent audit firm to perform an audit engagement of a SOC 2 Report of the Information Functions and Processes utilized or provided by the Contractor under the Contract. The Contractor agrees to allow the independent audit firm to access its facility/ies for purposes of conducting this audit engagement(s), and will provide the necessary support and cooperation to the independent audit firm that is required to perform the audit engagement of the SOC 2 Report.

The University will invoice the Contractor for the expense of the SOC 2 Report(s), or deduct the cost from future payments to the Contractor.

9. Provisions in Section AA.1-2 shall survive expiration or termination of the

Contract. Additionally, the Contractor and shall flow down the provisions of Section AA.1-2 (or the substance thereof) in all subcontracts.

pg. 11

SECTION 3. PERFORMANCE WORK STATEMENT (PWS)

3.1 INTRODUCTION

The School of Community Health and Policy proposes the development of an electronic, cloud-based version of the Perceived Risk Hierarchy Theory (PRHT) Inventory, a validated assessment tool designed to identify and quantify risk among youth in real time.

In an era where predictive analytics are transforming healthcare delivery, PRHT represents a next-generation public health innovation, leveraging data science to proactively identify elevated risk for adverse outcomes, including substance use, HIV exposure, and community violence. Rather than reacting to crises, PRHT enables early detection and rapid intervention, positioning communities to act before risk escalates into harm.

This project will fund the design, development, and deployment of a secure, scalable software platform that administers the PRHT instrument electronically across desktop and mobile devices. The platform will generate an individualized Risk Quotient (RQ) within minutes, allowing practitioners, educators, and community partners to connect youth with appropriate services in real time.

By digitizing PRHT, this initiative will significantly expand its reach, usability, and national scalability, transforming it into a decision-support tool for public health systems, schools, and community-based organizations.

3.2 BACKGROUND

The mission of the School of Community Health and Policy is to improve population health outcomes through innovation, equity-driven research, and community-engaged practice. Youth in disinvested and structurally vulnerable communities often experience delayed identification of risk, resulting in missed opportunities for prevention and early intervention.

The PRHT framework addresses a critical gap in public health infrastructure: the absence of rapid, actionable, and context-sensitive risk assessment tools that can be deployed at scale.

Current systems often:

• Identify risk too late.

• Operate in silos (education, health, justice).

• Lack real-time analytics to guide intervention.

PRHT responds to these limitations by:

• Providing immediate risk stratification (Risk Quotient (RQ)).

• Enabling cross-sector data integration.

pg. 12

• Supporting precision public health interventions.

This effort aligns directly with the school's commitment to:

• Advancing health equity.

• Reducing preventable morbidity and mortality among youth.

• Strengthening community-based prevention systems.

3.3 OBJECTIVES

The objectives of this project are to design, implement, and operationalize a scalable PRHT digital platform that enhances early risk detection and intervention.

Objective 1 – Risk Identification and Analytics

Develop a platform capable of generating real-time statistical analyses at the individual, group, and community levels using PRHT data, enabling targeted intervention strategies informed by both local and comparative datasets.

Objective 2 – Cloud-Based Ecosystem Development

Establish a secure, cloud-based infrastructure that supports:

• Data collection and storage.

• Partner access and engagement.

• Integration of intervention tools and resources.

• Continuous monitoring of outcomes.

Objective 3 – Strategic Partnerships and Collaboration

Facilitate collaboration among Morgan State University faculty, public school systems (e.g., BCPS), and community stakeholders to co-develop intervention strategies and ensure real-world applicability.

Objective 4 – Modular Expansion

Design and implement additional PRHT modules addressing:

• Behavioral risk.

• School attendance and academic performance.

• Substance use.

• Sexual health behaviors.

These modules will allow the system to evolve into a comprehensive youth risk intelligence platform.

pg. 13

3.4 SCOPE OF WORK

The Contractor shall design, develop, test, deploy, and support a secure, cloud-based PRHT Platform capable of administering the PRHT Inventory electronically, generating real-time Risk Quotients (RQ), and enabling data-driven intervention and reporting.

The work shall be performed in accordance with the task areas identified below.

Task Requirements

Task 1 - Project Management and Planning

Requirements

The Contractor shall:

• Develop and maintain a comprehensive Project Management Plan (PMP), including the Work Breakdown Structure (WBS).

• Establish project timelines, milestones, and reporting cadence.

• Conduct kickoff and recurring stakeholder meetings, including technical demonstrations and backlog grooming activities

Deliverables

• PMP (within 15 calendar days after award).

• Monthly Progress Reports.

• Risk Management Log

Performance Standards

• PMP approved within 10 business days of submission.

• Bi-weekly SPI and CPI reviews demonstrate SPI ≥ 1.0 and

CPI ≥ 1.0.

• Minimum one technical demonstration per month.

Task 2 – System Architecture and Design

Requirements

The Contractor shall:

pg. 14

• Design a multi-platform architecture supporting web, tablet, and mobile devices.

• Ensure compatibility with iOS and Android operating systems.

• Define system components, data flows, and integration points.

• Ensure compatibility with AWS or Azure cloud environments.

Deliverables

• System Architecture Design Document.

• Data Flow Diagrams.

• Technical Specifications.

Timeline

Within 30 calendar days after award.

Performance Standards

• Architecture approved within no more than two revision cycles.

• 100 percent compliance with agency IT standards.

Task 3 – PRHT Instrument Digitization and Software Development

The Contractor shall:

• Convert the PRHT Inventory into an interactive digital format.

• Develop automated scoring algorithms to generate Risk Quotients (RQ).

• Develop interfaces for:

Data entry.

Dashboard visualization.

Risk reporting.

Deliverables

pg. 15

• Functional PRHT Digital Instrument.

• RQ Scoring Engine.

• User Interface Prototypes and Final Build.

Timeline

• Initial Prototype: Day 60.

• Final Build: Day 120.

Performance Standards

• Scoring Accuracy ≥ 99%.

• System Uptime ≥ 99% during testing.

• Successful User Acceptance Testing (UAT) approval.

Task 4 – Cloud Infrastructure and Data Integration

Requirements

The Contractor shall:

• Design, configure, and maintain a secure cloud-hosted environment supporting the PRHT Platform.

• Develop and implement databases, application programming interfaces (APIs), and integration services necessary to support platform functionality.

• Establish secure data transmission protocols and interfaces between application components.

• Configure user authentication, role-based permissions, and access controls.

• Implement backup, recovery, and disaster recovery procedures.

• Ensure compatibility with AWS or Microsoft Azure cloud hosting environments.

• Develop and maintain data dictionaries, system interfaces, and integration documentation.

• Support future integration with third-party applications and external data sources.

Deliverables

• Cloud Infrastructure Design Document.

• Database Design Specification.

pg. 16

• API and Integration Documentation.

• Data Dictionary.

• Backup and Disaster Recovery Plan.

• Cloud Security Configuration Documentation.

Timeline

• Preliminary Design: Day 45

• Cloud Environment Configuration: Day 75

• Final Configuration and Documentation: Day 120

Performance Standards

• System availability of 99.5% or greater during operational periods.

• Data transmission latency shall not exceed five (5) seconds under normal operating conditions.

• Daily automated backups successfully completed.

• Recovery procedures capable of restoring system functionality within twenty-four (24) hours.

• No critical security vulnerabilities remaining unresolved prior to production deployment.

Task 5 – Data Analytics and Reporting Functionality

The Contractor shall:

• Develop analytics capabilities supporting individual, group, and community-level reporting.

• Create configurable dashboards for authorized users.

• Implement reporting functionality to support trend analysis and intervention planning.

• Develop data visualization tools including charts, graphs, and risk indicators.

• Provide export functionality to commonly used formats including PDF, CSV, and Excel.

• Support configurable reporting parameters, filters, and date ranges.

pg. 17

• Develop automated reporting capabilities for recurring analyses.

• Provide data aggregation and comparison functionality across user-defined populations.

Deliverables

• Analytics Module.

• Interactive Dashboard Suite.

• Standard Report Library.

• Data Visualization Components.

• Report Export Functionality.

• Analytics User Guide.

Timeline

• Analytics Prototype: Day 90

• Dashboard Demonstration: Day 105

• Final Analytics Solution: Day 135

Performance Standards

• Standard reports generated within ten (10) seconds.

• Data accuracy maintained at 99% or greater.

• Dashboard functionality available 99.5% of operational hours.

• Exported reports successfully generated without data loss.

• User acceptance testing approval for all reporting functions.

Task 6 – Referral and Resource Integration

The Contractor shall:

• Develop referral functionality connecting users with appropriate intervention programs and resources.

• Create workflows supporting referral submission, tracking, monitoring, and closure.

• Develop searchable resource directories and intervention databases.

pg. 18

• Enable authorized users to assign, track, and monitor referrals.

• Provide automated notifications and alerts associated with referral activities.

• Support documentation of referral outcomes and intervention status.

• Develop administrative capabilities for maintaining and updating resource inventories.

Deliverables

• Referral Management Module.

• Resource Directory Database.

• Referral Workflow Documentation.

• Notification and Alert Functionality.

• Administrative User Guide.

Timeline

• Referral Design Review: Day 90

• Functional Prototype: Day 120

• Final Operational Module: Day 150

Performance Standards

• Referral transactions processed within five (5) seconds.

• Referral status updates reflected in the system in real time.

• Resource search results returned within three (3) seconds.

• Notification delivery success rate of 95% or greater.

• Referral workflow functions successfully pass all user acceptance testing requirements.

Task 7 – Testing and Quality Assurance

The Contractor shall:

• Develop and implement a comprehensive Testing and Quality Assurance Plan.

pg. 19

• Conduct unit testing, integration testing, system testing, security testing, and user acceptance testing.

• Perform performance and load testing to validate system scalability.

• Conduct vulnerability assessments and identify corrective actions.

• Track, prioritize, and resolve defects identified during testing activities.

• Document test results and corrective actions.

• Support University participation during testing and validation activities.

Deliverables

• Testing and Quality Assurance Plan.

• Test Scripts and Test Cases.

• Security and Vulnerability Assessment Report.

• Defect Tracking Log.

• User Acceptance Testing Results.

• Final Test Summary Report.

Timeline

• Testing Plan: Day 60

• Integration Testing: Day 120

• User Acceptance Testing: Day 150

• Final Testing Completion: Day 165

Performance Standards

• 100% execution of approved test cases.

• All critical and high-severity defects resolved prior to deployment.

• Security testing completed with no unresolved critical vulnerabilities.

• Successful completion of User Acceptance Testing.

• System performance meets all operational requirements.

Task 8 – Deployment and Training

pg. 20

• Deploy the PRHT Platform into the production environment.

• Execute all deployment and migration activities.

• Develop user documentation and training materials.

• Deliver training sessions for system administrators, technical personnel, and end users.

• Provide operational transition support.

• Conduct knowledge transfer activities to University personnel.

• Support post-deployment stabilization activities.

Deliverables

• Deployment Plan.

• Production Implementation Checklist.

• User Manuals.

• System Administration Guide.

• Training Materials and Presentations.

• Knowledge Transfer Documentation.

• Deployment Completion Report.

Timeline

• Training Material Development: Day 150

• User Training Completion: Day 170

• Production Deployment: Day 180

Performance Standards

• Deployment completed without critical system failures.

• Training delivered to all designated personnel.

• Minimum participant satisfaction rating of 90%.

• Knowledge transfer activities completed and accepted by the University.

• Production environment operational within approved deployment schedule.

Task 9 – Maintenance and Support

pg. 21

• Provide operational, technical, and application support throughout the contract period.

• Maintain system functionality, security, and performance.

• Perform corrective, adaptive, and preventive maintenance activities.

• Apply software updates, patches, and enhancements as authorized.

• Monitor platform availability and performance.

• Provide incident management and issue resolution services.

• Maintain a help desk capability for reporting and tracking service requests.

• Provide monthly maintenance and performance reports.

Deliverables

• Maintenance and Support Plan.

• Help Desk Procedures.

• Monthly Performance Reports.

• Monthly Incident Reports.

• Software Update Documentation.

• System Availability Reports.

Timeline

• Maintenance Plan: Within 15 calendar days after deployment.

• Support Services: Continuous throughout the contract period.

• Monthly Reports: Due by the 10th business day of each month.

Performance Standards

• Platform availability of 99.5% or greater.

• Critical system incidents responded to within one (1) hour.

• High-priority incidents responded to within four (4) hours.

• Critical issues resolved within twenty-four (24) hours.

• Non-critical issues resolved within five (5) business days.

• Monthly performance reports submitted on time 100% of the contract term.

pg. 22

3.5 DATA SECURITY AND COMPLIANCE

The Contractor shall comply with all applicable federal, state, and institutional data protection requirements, including:

• Role-Based Access Control (RBAC).

• Encryption of data at rest and in transit.

• HIPAA compliance, where applicable.

• FERPA compliance, where applicable.

• Multi-factor authentication.

• Routine security audits and vulnerability assessments.

The Contractor shall coordinate with the appropriate Department of Information Technology (DIT) to ensure alignment with IT policies and obtain all necessary approvals prior to deployment.

3.6 TERM OF CONTRACT

The term of the contract shall begin on the issuance of the notice to proceed, for one (1) year with one (1) one-year option renewal to be exercised at the sole discretion of the University.

3.7 PERFORMANCE PERIOD AND ACCEPTANCE

The selected contractor shall be paid the contract rate thirty (30) days after receipt of valid invoice for requested services.

Deliverable Acceptance: The University shall review submitted deliverables within ten

(10) business days of receipt. Deliverables shall be accepted when they satisfy all requirements identified in the PWS. If deficiencies are identified, the Contractor shall correct and resubmit the deliverable within five (5) business days or within a mutually agreed-upon timeframe. Payment for deliverables may be contingent upon acceptance by the University's Technical Representative.

pg. 23

SECTION 4. CLAUSES

4.1 CLAUSES INCORPORATED IN FULL TEXT

MORGAN STATE UNIVERSITY PROCUREMENT POLICIES AND

PROCEDURES

APPENDIX A - TERMS AND CONDITIONS

Mandatory Terms and Conditions of Written Solicitations Over $100,000.

1. Instructions and information to vendors concerning the solicitation requirements, including the time and date set for receipt of the responses and the address where responses are to be delivered;

2. The purchase description, delivery or performance schedule, and any…