7360022802Cloud_RFQ_PRB02.docx

NYS Office of General Services Procurement Services Group 73600 – Award 22802 IT Umbrella Contracts – Manufacturer Based Appendix G.3 - Request for Quote - Cloud Solution

Authorized User Instructions for Request for Quote - Cloud Solution

This “Request for Quote - Cloud Solution” should be used when the RFQ includes Cloud Solutions. An Authorized User shall review and refer to the instructions set forth in “Appendix G, How to Use the Manufacturer Umbrella Contract”, and the “Appendix G.5 - RFQ - Cloud Solution Checklist”, prior to developing a Request for Quote (RFQ) document.

Authorized Users should not hesitate to contact the OGS contract manager (http://www.ogs.ny.gov/purchase/snt/awardnotes/7360022802can.HTM) with any questions, concerns, or clarifications not addressed by the “Attachment 11 - How to Use the Manufacturer Umbrella Contract” document.

The “Appendix G.5 - RFQ Cloud Solution Checklist” should be used in conjunction with this RFQ template to help ensure development of a comprehensive RFQ. The checklist is meant as a baseline for a Cloud Solution procurement and is not necessarily an all-inclusive list of requirements. Please click on the icon below to open the checklist.

Additional Authorized User Instructions for Completing Specific RFQ Sections

Optional Questions and Other Events

If a Question Period is needed, include the due date and time within the RFQ Cover.

If a Question period is not needed, type “N/A” in the Question section of the cover and delete Section D of the RFQ.

Additional events may also be included based on Authorized User requirements.

See http://ny.e-ratecentral.com for additional information.

When an Authorized User knows the SKUs for the Products that it wants a Contractor to provide, the Authorized User must describe the Products. The actual SKUs can be identified by Authorized Users on the “Appendix G.2 –Request for Quote - Financial Response.” The Authorized User will complete that form by following the instructions listed on Page 1 under the heading titled “Instructions for When SKUs Have Been Identified by Authorized User.”

See http://ogs.ny.gov/purchase/snt/awardnotes/7360022802TemplatePageCombo.pdf.

When an Authorized User requires a Vendor to provide suggested SKUs and Products to meet a defined need, the Authorized User must include as much information as possible within this section to allow the Vendor to propose SKUs and Products.

For Lot 3 Cloud requirements, describe the Cloud Solution to be provided. The “–Appendix G.5 – Cloud Solution Checklist” can serve as an Authorized User’s baseline, but it may not be an all-inclusive list of requirements. An Authorized User must include any additional requirements in its RFQ. Examples of additional requirements may include: uptime, downtime, estimated number of required log-ins, what the you envision the Cloud Solution doing, or if you are open/closed to Contractor’s suggestions. Please refer to “Appendix G – How to Use the Manufacturer Umbrella Contract” for more information.

For all other Lot requirements, please refer to “Appendix G – How to Use the Manufacturer Umbrella Contract.”

An Authorized User may also include additional requirements in this section, regardless of the included SKUs. Examples may include: applicable statutory requirements, maintenance/service level agreements (SLAs), systems to be integrated, time commitments, prioritization of services, preventative and corrective maintenance activities, a statement of work, installation date requirements, and delivery deadlines.

Examples may include: Installation, Configuration, Recurring Services, and a Project Plan (milestones, timeframes, dependencies, roles/responsibilities, knowledge transfer, deliverable payment points, key personnel requirements, background check requirements, location where work is to be performed, risks, and risk mitigation.)

Optional Authorized User Terms and Conditions

· Inclusion of the NYS Department of Labor Prevailing Rate Schedule when utilizing an Engineer to install Products;

· Expedited delivery timeframe;

· Unique delivery requirements like delivery to an inside location or delivery of heavy equipment to an inside location.

· Additional Vendor incentives, such as discount for expedited payment/Procurement Card use; and

· Any additional requirements imposed by the funding source.

Optional Downstream Prohibition

Optional Dispute Resolution Process

Delete Authorized User Instructions Prior to Distribution

Cover Page – Request for Quote – Cloud Solution

TO BE COMPLETED BY AUTHORIZED USER

Authorized User Information:

Name Street Address City, State, Zip Code Authorized User Delivery Information:

Name Street Address City, State, Zip Code

DESIGNATED CONTACTS

Authorized User shall indicate if Procurement Lobbying Law/Restricted Period is in effect: |_| Yes |_| No Where Procurement Lobbying Law is deemed applicable by the Authorized User, by signing, Contractor affirms that it understands and agrees to comply with the Authorized User’s policies and procedures relative to permissible contacts. Information may be accessed at: Procurement Lobbying:

http://www.ogs.ny.gov/aboutOgs/regulations/defaultAdvisoryCouncil.html)

RFQ LOTS

This RFQ is for Products from the following checked Lots as defined in Award # 22802 – Information Technology Umbrella Contract – Manufacturer Based (Statewide):

|_| Lot 1 – Software |_| Lot 2 – Hardware |_| Lot 3 - Cloud |_| Lot 4 – Related Services

The Authorized User named above is seeking competitive quotes from the Contractor (Manufacturer) and their Resellers (where applicable) of Information Technology Umbrella Contract – Manufacturer Based Contract(s) for the above-referenced Products. If the RFQ includes Lot 4 – Related Services, Contractor must prior to submitting a response to the RFQ either hold an award for Lot 4- Related Services, or be able to provide the services under the other Lots included in the RFQ.

LOT 3 – CLOUD DATA RISK LEVEL: |_| Low |_| Medium |_| High Please note this requirement is Mandatory. If a Contractor wishes to increase their risk level, then refer to Appendix C for instructions on how to do so.

DATA CATEGORIZATION ELEMENTS:

QUESTIONS AND OTHER EVENTS

IS THE RFQ BIDDER POOL LIMITED TO M/WBE, SB, AND SDVOB VENDORS: |_| Yes |_| No

|_| Lowest Price Meeting Specified Technical Requirements and Mandatory Pass/Fail Requirements |_| Best Value with Technical and Financial Score

SERVICE MODEL FOR LOT 3 – CLOUD SOLUTION

(check all that apply)

DEPLOYMENT MODEL FOR LOT 3 – CLOUD SOLUTION

(Check all that apply)

|_| Other

|_| PCI DSS |_| SOX |_| ECPA |_| Other

The Authorized User will not be held liable for any cost incurred by the Vendor for work performed in the preparation of a response to this RFQ or for any work performed prior to the formal execution of an Authorized User Agreement. Responses to the RFQ must be received by the deadline specified above. Vendors assume all risks for timely, properly submitted deliveries. A Vendor is strongly encouraged to arrange for delivery of RFQ responses prior to the date of the RFQ opening. LATE RFQ responses may be rejected. The received time of an RFQ response will be determined by the Authorized User.

SCOPE / MANDATORY REQUIREMENTS

This RFQ is being distributed to the Contractor and Resellers (where applicable) to acquire the following:

[THE FORMAT AND LANGUAGE BELOW ARE PROVIDED AS AN EXAMPLE FOR AN AUTHORIZED USER ATTEMPTING TO PROCURE A CLOUD SOLUTION]

1. SCOPE

[DESCRIBE NEED. IF APPLICABLE DESCRIBE CURRENT SYSTEM(S) THAT THE DATA WILL BE TRANSITIONED FROM INTO THE CLOUD SOLUTION.]

For the duration of an Authorized User Agreement, the Cloud Solution shall conform to the Cloud Solution Manufacturer’s specifications, Documentation, performance standards (including applicable license terms, warranties, guarantees, Service Level Agreements, service commitments, and credits).

2. CLOUD SERVICE MODEL

[DESCRIBE CLOUD SERVICE MODEL.]

3. CLOUD DEPLOYMENT MODEL

[DESCRIBE CLOUD DEPLOYMENT MODEL.]

4. DATA CATEGORIZATION

[DESCRIBE DATA CATEGORIZATION ELEMENTS, OVERALL RISK DETERMINATION, INCLUDING THE MANDATORY DATA RISK LEVEL, AND APPLICABLE STATUTORY REQUIREMENTS, AUTHORIZED USER POLICIES, RULES AND REGULATIONS. BE SURE TO DESCRIBE WHICH DATA RISK LEVEL IS NECESSARY IN ORDER TO BID AND TO MAKE IT CLEAR TO VENDORS THAT THIS IS A MANDATORY SPECIFICATION.]

5. DATA OWNERSHIP

The Authorized User shall own all right, title and interest in Data.

6. DATA LOCATION

[DESCRIBE IF DATA CAN LEAVE CONUS AND IF SO, THE CONDITIONS IN WHICH IT CAN LEAVE CONUS]

7. ENCRYPTION

[DESCRIBE DETAILS FOR ENCRYPTION SUCH AS WHEN THE DATA MUST BE ENCRYPTED, WHEN THE DATA CAN BE NOT ENCRYPTED (IF APPLICABLE), THE MINIMUM ENCRYPTION STANDARDS/REQUIREMENTS SUCH AS NYS-S14-007 (OR SUCCESSOR), AUTHORIZED USER’S RESPONSIBILITIES AND THE CONTRACTOR’S RESPONSIBILITIES.]

8. SECURITY

[DESCRIBE PHYSICAL SECURITY REQUIREMENTS.]

[DESCRIBE ELECTRONIC/DATA SECURITY REQUIREMENTS.]

[DESCRIBE IF CONSENSUS ASSESSMENT INITIATIVE QUESTIONNAIRES (CAIQ) WILL BE REQUIRED.]

9. MAINTENANCE/SUPPORT

[DESCRIBE ANY MAINTENANCE/SUPPORT REQUIREMENTS INCLUDING THOSE FOR REMOTE ADMINISTRATION.]

10. INFRASTRUCTURE SUPPORT SERVICES

[IF DESIRED, INSERT LANGUAGE THAT ALLOWS FOR SUPPORT SERVICES TO BE PROVIDED IN A FOLLOW THE SUN FORMAT SUCH AS “Infrastructure support services that do not directly or indirectly access Data may be provided in a Follow the Sun format.”.]

11. BUSINESS CONTINUITY/DISASTER RECOVERY (BC/DR) OPERATIONS

[DESCRIBE IF THE CONTRACTOR IS REQUIRED TO PROVIDE A BC/DR PLAN. SAID PLAN SHOULD INCLUDE HOW IT WILL IMPACT ACCESS TO THE REQUIRED FEATURES AND FUNCTIONALITY OF THE CLOUD SERVICE.]

12. AUTHENTICATION TOKENS

[DESCRIBE IF AUTHENTICATION TOKENS ARE REQUIRED. IF SO, SET FORTH THE MINIMUM REQUIREMENT SUCH AS THOSE SET FORTH IN NYS ITS POLICY S14-006 AUTHENTICATION TOKENS STANDARD (OR SUCCESSOR).]

13. APPLICATION PROGRAM INTERFACE (API) OR SELF ELECTRONIC PORTAL

[DESCRIBE IF THE AUTHORIZED USER WILL ACCEPT AN API OR ANOTHER SELF-SERVICE ELECTRONIC PORTAL. IF YES, THEN DETAIL WHAT INFORMATION SHOULD BE ACCESSED AND/OR WHAT ACTIONS CAN BE TAKEN THROUGH THE DESIRED PORTAL.]

STATEMENT OF WORK

[DESCRIBE STATEMENT OF WORK.]

[THE FORMAT AND LANGUAGE BELOW ARE PROVIDED AS AN EXAMPLE FOR AN AUTHORIZED USER ATTEMPTING TO PROCURE A CLOUD SOLUTION]

1. IMPLEMENTATION OF CLOUD SOLUTION

[DESCRIBE EXPECTATIONS FOR IMPLEMENTATION OF CLOUD SOLUTION.]

2. RECURRING SERVICES

[DESCRIBE EXPECTATIONS FOR RECURRING SERVICES.]

3. TRANSFER OF DATA

[DESCRIBE THE FORMAT DATA MUST BE RETURNED IN.]

[DESCRIBE HOW THE DATA MUST BE RETURED TO THE AUTHORIZED USER.]

[DESCRIBE THE TIMEFRAME THAT THE CONTRACTOR MUST REMOVE ALL OF THE DATA BY (BACKUPS INCLUDED).]

[IF APPLICABLE DESCRIBE THE NEED FOR AN APPLICATION PROGRAMMABLE INTERFACE OR ANOTHER ELECTRONIC TOOL.]

[DESCRIBE PROCEDURES FOR REQUESTING AND AUTHORIZING THE CONTRACTOR TO TRANSFER DATA.]

[DESCRIBE IF THE CONTRACTOR WILL BE REQUIRED TO TRANSFER DATA FROM EXISTING DATABASES TO PHYSICAL STORAGE DEVICES OR IF UNUSUALLY LARGE VOLUMES OF DATA, ETC…]

[DESCRIBE IF IT IS REQUIRED THAT SEVERAL CLOUD SERVICE PROVIDERS WILL SHARE OR TRANSFER DATA BETWEEN THEM FOR A SPECIFIC TIMEFRAME.]

[DESCRIBE IF THE CONTRACTOR WILL BE REQUIRED TO FACILITATE DATA TRANSFER TO A NEW CONTRACTOR AT THE END OF THE CONTRACT TERM. SET FORTH EXPECTATIONS AS TO HOW THAT WILL OCCUR.]

Contractor cannot charge for the transfer of Data unless the charges are provided for in response to this RFQ.

AUTHORIZED USER TERMS AND CONDITIONS

[DESCRIBE AUTHORIZED USER ADDITIONAL TERMS AND CONDITIONS.]

[THE FORMAT AND LANGUAGE BELOW ARE PROVIDED AS AN EXAMPLE FOR AN AUTHORIZED USER ATTEMPTING TO PROCURE A CLOUD SOLUTION]

1. DATA BREACH – REQUIRED CONTRACTOR ACTIONS

[DESCRIBE ALL CONTRACTOR REQUIRED ACTIONS IF A DATA BREACH WERE TO OCCUR.]

[IF APPLICABLE, IF THE CONTRACTOR IS UNABLE TO COMPLETE THE CORRECTIVE ACTION WITHIN THE REQUESTED TIMEFRAME INCLUDE ANY ACCEPTABLE DEVIATIONS FROM APPENDIX B SECTION 52, IF THE AUTHORIZED USER IS RETAINING THE RIGHT TO CONTRACT WITH A THIRD PARTY TO PROVIDE THE REQUIRED SERVICES UNTIL CORRECTIVE ACTIONS HAVE BEEN TAKEN AND SERVICES RESUMED IN A MANNER ACCEPTABLE TO THE AUTHORIZED USER, OR UNTIL THE AUTHORIZED USER HAS COMPLETED A NEW PROCUREMENT FOR A REPLACEMENT SERVICE SYSTEM AND THAT THE CONTRACTOR WILL BE RESPONSIBLE FOR THE REASONABLE COST OF THESE SERVICES DURING THIS PERIOD.]

2. AUTHORIZED USER ACCESS TO DATA

The Authorized User shall have access to its Data at all times, through the term of the Authorized User Agreement, plus [STATE THE ADDITIONAL TIME PERIOD REQUIRED FOR EXPIRATION, TERMINATION OR SUSPENSION OF SERVICES.]

The Authorized User shall have the ability to import or export Data in piecemeal or in its entirety at the Authorized User’s discretion at no charge to the Authorized User. This includes the ability for the Authorized User to import or export Data to/from other Contractors.

[DESCRIBE REQUIREMENTS FOR IMPORTING/EXPORTING DATA. IF APPLICABLE DESCRIBE THE NEED FOR AN APPLICATION PROGRAMMABLE INTERFACE OR ANOTHER ELECTRONIC TOOL.]

3. CONTRACTOR ACCESS TO DATA

[DESCRIBE ANY ALLOWABLE DATA MINING, CROSS TABULATING, MONITORING OF AUTHORIZED USER’S DATA USAGE AND/OR ACCESS OR ANY OTHER DATA ANALYTICS.]

[DESCRIBE ALL SECURITY REQUIREMENTS IF NOT LISTED ABOVE.]

4. SUSPENSION OF SERVICES

During any period of suspension of service, the Authorized User shall have full access to all Data at no charge. The Contractor shall not take any action to erase and/or withhold any Authorized User Data, except as directed by the Authorized User.

[IF APPLICABLE DESCRIBE THE NEED FOR AN APPLICATION PROGRAMMABLE INTERFACE OR ANOTHER ELECTRONIC TOOL.]

5. EXPIRATION OR TERMINATION OF SERVICES

Upon expiration or termination of an Authorized User Agreement, the Authorized User shall have full access to all Data for a period of 60 calendar days. During this period, the Contractor shall not take any action to erase and/or withhold any Data, except as directed by the Authorized User. An Authorized User shall have the right to specify a period more than 60 calendar days in its RFQ.

[DESCRIBE IF A CHARGE FOR THIS ACCESS IS ACCEPTABLE.]

[IF APPLICABLE DESCRIBE THE NEED FOR AN APPLICATION PROGRAMMABLE INTERFACE OR ANOTHER ELECTRONIC TOOL.]

6. ACCESS TO SECURITY LOGS AND REPORTS

[DESCRIBE THE FORMAT THAT THE CONTRACTOR MUST PROVIDE SECURITY LOGS AND REPORTS IN IF/WHEN THEY ARE REQUESTED.]

7. CONTRACTOR PERFORMANCE AUDIT

[DESCRIBE THE MATERIALS THAT WILL BE NEEDED TO ASSESS CONTRACTOR’S PERFORMANCE (E.G., PAGE LOAD TIMES, RESPONSE TIMES, UPTIME, FAIL OVER TIME).]

8. MODIFICATION TO CLOUD SERVICE DEPLOYMENT MODEL, SERVICE MODEL, AND/OR INITIAL FUNCTIONALITY WITHIN AN AUTHORIZED USER AGREEMENT

As Cloud services, can be flexible and dynamic, delivery mechanisms may be subject to change. This may result in changes to the deployment model, service model, functionality, or SKU. The OGS and Authorized Users require notification of any such changes to ensure security and business needs are met.

Any changes to the deployment model, service model, functionality, or SKU (e.g., PaaS to IaaS) must be provided to OGS via Appendix C - Contract Modification Procedures.

In addition, notification must be provided to the Authorized User for review and acceptance, prior to implementation. Any changes to the Authorized User Agreement will require the Authorized User to re-assess the risk mitigation methodologies and strategies and revise the Authorized User Agreement as needed.

QUESTIONS

All questions shall be submitted in writing using “QUESTION ATTACHMENT” [to be developed by the Authorized User] citing the document name and document section. The questions shall be emailed to the Designated Contact E-Mail Address indicated on the Cover Page of this RFQ.

Vendors are strongly encouraged to submit questions as early as possible. However, all questions must be submitted by the Question due date and time listed on the Cover Page of this RFQ. Answers to all questions of a substantive nature shall be provided to all Vendors who received this RFQ in the form of a question and answer document.

DOWNSTREAM PROHIBITION

[DESCRIBE ANY DOWNSTREAM PROHIBITION RESTRICTIONS.]

AUTHORIZED USER DISPUTE RESOLUTION PROCESS

Should a dispute or protest arise regarding this RFQ, the dispute or protest will be considered and decided by the Authorized User.

[THE LANGUAGE BELOW IS AN EXAMPLE OF LANGUAGE THAT COULD BE USED IF AN AUTHORIZED USER DOES NOT HAVE A DISPUTE RESOLUTION POLICY]

1. Disputes or Controversies Occurring During the Term of the Authorized User Agreement.

In the event there is a dispute or controversy during the term of the Authorized User Agreement resulting from this RFQ, the Vendor and Authorized User agree to exercise their best efforts to resolve the dispute as soon as possible. The Vendor and Authorized User shall, without delay, continue to perform their respective obligations under the resulting Authorized User Agreement and this Centralized Contract which are not affected by the dispute. Primary responsibility for resolving any dispute arising under the Authorized User Agreement shall rest with the persons designated by the Authorized User and the Contract’s Contract Administrator and/or Account Manager.

In the event the Authorized User is dissatisfied with the Vendor’s Products provided under the Authorized User Agreement, the Authorized User shall notify the Vendor in writing pursuant to the terms of the Contract. In the event the Vendor has any disputes with the Authorized User, the Vendor shall so notify the Authorized User in writing. If either party notifies the other of such dispute or controversy, the other party shall then make good faith efforts to solve the problem or settle the dispute amicably, including meeting with the party’s representatives to attempt diligently to reach a satisfactory result.

If negotiation between such persons fails to resolve any such dispute to the satisfaction of the parties within fourteen (14) business days or as otherwise agreed to by the Vendor and Authorized User, of such notice, then the matter shall be submitted to the persons designated by the Authorized User and the Vendor’s senior officer of the rank of Vice President or higher as its representative. Such representatives shall meet in person and shall attempt in good faith to resolve the dispute within the next fourteen (14) business days or as otherwise agreed to by the parties. This meeting must be held before either party may seek any other method of dispute resolution, including judicial or governmental resolutions. Notwithstanding the foregoing, nothing in this section shall be construed to prevent either party from seeking and obtaining temporary equitable remedies, including injunctive relief.

The Vendor shall extend the dispute resolution period for so long as the Authorized User continues to make reasonable efforts to cure the breach, except with respect to disputes about the breach of payment of fees or infringement of its or its licensors’ intellectual property rights.

Manufacturer / Authorized Reseller Information

This Page is to be Completed By the Manufacturer or Authorized Reseller Responding to the RFQ

The RFQ Response must be fully and properly executed by an authorized person. By signing you certify your express authority to sign on behalf of yourself, your company, or other entity and full knowledge and acceptance of this RFQ (including any Questions/Answers or addenda), the OGS Centralized Contract and that all information provided is complete, true and accurate. Quotes received by RFQ due date/time are binding and non-retractable for 120 days or as stipulated in the RFQ.

Manufacturer or Reseller Signature: Date:

Printed or Typed Name:

Title:

If you are not providing a RFQ Response, place an “x” in the box, please explain why you are not responding, and return this page only.

|_| WE ARE UNABLE TO RESPOND AT THIS TIME BECAUSE:

After fully completing the information above, please submit this page via e-mail with “Request for Quote – Financial Response” (Excel) to the Authorized User indicated on the Cover Page. Authorized User reserves the right to request the original executed page of this RFQ.

image1.emf

22802PR2_AppendixG-5.xlsx Check List

APPENDIX G.5 - CLOUD - RFQ - CLOUD SOLUTION CHECK LIST

OGS highly recommends that all Authorized Users read and become familiar with the Contract, Appendices, Attachments & Appendix G, How to Use the Manufacturer Umbrella Contract before utilizing this checklist in conjunction with drafting an RFQ. Areas that Authorized Users may need to address when procuring their specific Cloud Solution may include but not be limited to what is listed below.

SCOPE YES NO N/A

Does the Cloud Solution fit the Scope of the Contract?

ADDITIONAL LOTS YES NO N/A

Does the Cloud Solution require the utilization of an additional lot(s)?

If yes, which additional lot(s) is needed:

Lot 1

Lot 2

Lot 4

DATA CLASSIFICATION / LEVEL OF RISK YES NO N/A

Has the Data been evaluated and classified into a risk level? (Mandatory)

What is the Risk Level of the Data (Low, Medium or High):

Low Risk Data

Medium Risk Data

High Risk Data

Please note, if an Authorized User determines their Data to be High Risk, then it is Mandatory that the winning bidder have High Risk at the time of the RFQ response due date. Please refer to Section 2.1.2 Data Categorization in Appendix G.g – How to Use the Manufacturer Umbrella Contract – Cloud Solution Supplement.

Does the Authorized User require additional insurance (that exceeds what is already required as per the Contract)?

Will the Authorized User allow a Contractor who has insurance coverage for a lower risk level additional time to obtain enough insurance to respond to an RFQ that has a higher risk level requirement? If so, please provide adequate time for the Contractors to increase their risk levels and for OGS to approve these new levels in time for the RFQ Response due date. Please refer to a Contractor's Appendix D to see which risk level they hold.

Has the Authorized User communicated the Data Classification and associated Level of Risk to the bidder pool?

CLOUD SERVICE MODEL YES NO N/A

What Category is the desired Cloud Solution considered:

(More information pertaining to the Cloud Service Models can be found via: http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-145.pdf )

Infrastructure as a Service (IaaS)

Platform as a Service (PaaS)

Software as a Service (SaaS)

Anything as a Service (XaaS)

Other

CLOUD DEPLOYMENT MODELS YES NO N/A

Which Cloud deployment model is requested:

(More information pertaining to the Cloud Deployment Models can be found via: http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-145.pdf )

Community Cloud

Hybrid Cloud

Private Cloud

Public Cloud

Other

STATUTORY / POLICY REQUIREMENTS YES NO N/A

Are their any laws, policies, regulations and/or rules that the Authorized User requires Contractor to be in compliance with?

Does the Authorized User require Contractor compliance with an NYS ITS Policy(s)?

Do any of the following NYS ITS Policies (or successor policies) apply:

P03-002 - Information Security Policy

P08-001 - Enterprise Plan to Procure Policy

P08-005 - Accessibility of Web-Based Information and Application

S13-002 - Information Classification Standard

S13-003 - Sanitation/Secure Disposal

S13-005 - Cyber Incident Response Standard

S14-002 - Information Classification Standard

S14-003 - Information Security Controls

S14-006 - Authentication Tokens Standard

S14-007 - NYS Encryption Standard

S14-010 - Remote Access

Other(s)

STATUTORY / POLICY REQUIREMENTS (continued) YES NO N/A

Do any of the following National Institute of Standards and Technology (NIST) Policies (or successor policies) apply:

NIST Federal Information Processing Standard (FIPS) Publication 140-2

NIST Federal Information Processing Standards (FIPS) Publication 199 – Standards for Security Categorization of Federal Information and Information Systems

NIST Special Publication 800-53 - Security and Privacy Controls for Federal Information Systems and Organizations.

NIST Special Publication 800-57, Part 1 - Recommendation for Key Management – Part 1: General

NIST Special Publication 800-088r1 - Guidelines for Media Sanitization

NIST Special Publication 800-111 - Guide To Storage Encryption Technologies For End User Devices

NIST Special Publication 800-122 - Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)

NIST Special Publication 800-131A - Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths

Other(s)

Do any of the following (or their successors) apply:

New York State Information Security Controls Standard

New York State Risk Management Standard

Health Insurance Portability and Accountability Act of 1996

Other(s)

Have the applicable laws, policies, rules and regulations that apply been communicated to the Contractor?

CAIQ REQUIRMENT / CONTRACTOR SECURITY YES NO N/A

Is a Consensus Assessment Initiative Questionnaire (CAIQ) required to be submitted by the Contractor?

Is the Authorized User retaining the right to request the CAIQ annually?

Is a Written description of Contractor's physical/virtual security and/or internal control processes required?

Has the Authorized User specified the required format that Security Logs and Reports need to be in when they are requested?

MODIFICATION TO CLOUD SOLUTION YES NO N/A

Has the Authorized User set forth how/when they want to be notified if there are fundamental changes to the Cloud Solution?

Has the Authorized User retained the right to review the changes and re-assess the risk mitigation methodologies and strategies and to revise the Authorized User Agreement as needed?

DATA ACCESS YES NO N/A

Has the required amount of uptime been addressed?

Has the acceptable amount of downtime been addressed?

Have the desired dates and times for acceptable downtime been set forth?

Has the Authorized User dictated that the Data must remain in CONUS?

Does the Authorized User want to allow for Application Programming Interfaces (API) (or similar feature) to access their Data?

Does the Authorized User require their Data to be backed up?

Has the Authorized User described the process a Contractor (and/or an affiliate of the Contractor) needs to go through to gain access to the Authorized User's Data?

Has the Authorized User set forth a process and/or Written agreement for the Contractor (or an affiliate of the Contractor) to access Authorized User's Data in any form?

Does the Authorized User want to designate a point of contact to authorize access to the Authorized User's data?

Has the Authorized User advised Contractor how to handle requests for Data by Third Parties?

Are Authentication Tokens required?

If yes, do Authentication Tokens need to be in compliance with NYS ITS Policy S14-006 (or successor policy)?

Should the Contractor be able to copy or transfer Data?

Has the Authorized User addressed whether or not the Contractor is allowed to conduct Data Mining, cross tabulate, monitor Authorized User’s Data usage and/or access, or perform any other Data Analytics?

If yes, have the details been addressed?

DATA ENCRYPTION YES NO N/A

Has Data Encryption been addressed?

If yes, does the proposed method of Encryption meet or exceed NYS-S14-007 (or successor policy)?

When does the Data need to be Encrypted:

At All Times

DATA ENCRYPTION (continued) YES NO N/A

In Use

In Transit

At Rest

Has the Authorized User addressed what they are responsible for regarding Encryption?

Has the Authorized User determined who will have access to the encryption key?

Has the Authorized User addressed what the Contractor is responsible for regarding Encryption?

SECURITY INCIDENT YES NO N/A

Have Data Security Provisions been set forth?

Does the Authorized User have or did they create a Security Incident Response Plan?

Is the Security Incident Response Plan in compliance with ITS Policy NYS-P03-002 (or successor policy)?

Has the Authorized User addressed what they are responsible for if there is a Security Incident?

Has the Authorized User addressed what the Contractor is responsible for if there is a Security Incident?

DATA BREACH YES NO N/A

Has the Authorized User set forth a Designated Contact and at least one telephone # to be notified if there is a Data Breach?

Is being notified within 24 hours of a confirmed Data Breach acceptable to the Authorized User?

If no, has the Authorized User set forth a timeframe less than 24 hours for notification of a data breach in the RFQ?

Has the Authorized User set forth the same timeframe as set forth in the RFQ for notification of a data breach in the Authorized User Agreement?

Does the Authorized User have coordinated incident response plan? (Mandatory)

If no, has the Authorized User created a coordinated incident response plan? (Mandatory)

Has the Authorized User addressed what they are responsible for if there is a Data Breach?

Has the Authorized User addressed what the Contractor is responsible for if there is a Data Breach?

Is there a set timeframe for corrective action to be taken if there is a Data Breach?

DATA TRANSFER / RETURN YES NO N/A

Have provisions been set forth for the Data Transfer Plan?

Has the Authorized User set forth the specific format that their Data needs to be returned to in (i.e. - Microsoft Excel, Microsoft Word…)

Does the Authorized User want to allow for an Application Program Interface (API) (or similar feature) for the return or transfer of their Data?

Does the Authorized User currently need services to transfer Data from existing Databases to physical storage devices or to facilitate movement of large volumes of Data?

Has the Authorized User addressed a possible future need for services to transfer Data from existing Databases to physical storage devices or to otherwise facilitate movement of large volumes of Data?

Has the Authorized User addressed a possible future need for services to transfer Data from existing Databases to physical storage devices or to otherwise facilitate movement of Data at the end of the Authorized User Agreement?

Will the Authorized User require the Contractor to transfer Data to a new Contractor?

Has the Authorized User advised the Contractor that there may by a need for cloud services to overlap when the Authorized User is transitioning between providers?

Is the Authorized User willing to pay for the transfer of Data?

Is there a payment provision for the last 6 months of services that may be needed in order to transition the Data?

DATA DESTRUCTION YES NO N/A

Have provisions been set forth for Data Destruction?

Does the storage medium holding the Data need to be destroyed (if applicable)?

If yes, are there instructions pertaining to how the storage medium holding the Data needs to be destroyed?

If yes, is the method of destruction in compliance with ITS S13-003 and S14-003 (or successor policies)?

Does the Data require Cryptographic Erase/Cryptographic Key Destruction?

If yes, do the Cryptographic Erase procedures need to meet or exceed NIST 800-088r1 or NIST 800-57, Part 1?

Has the Authorized User set forth their responsibilities for Cryptographic Key Destruction?

Has the Authorized User set forth the Contractor's responsibilities for Cryptographic Key Destruction?

Is a Certificate of Destruction required for the Data?

If yes, does the Certificate of Destruction need to meet a particular standard?

THINGS TO CONSIDER YES NO N/A

Has the Authorized User advised of their contact information?

Does the desired Cloud Solution require a Pre-Installation Site Visit?

If yes, have the details of a Pre-Installation Site Visit been set forth?

THINGS TO CONSIDER (continued) YES NO N/A

Does the Authorized User want to have a kick off meeting with the Contractor?

Does the Authorized User want to utilize the polling document?

Is the Authorized User willing to utilize an Application Program Interface (API) or other electronic portal for various purposes?

Does the Authorized User want to negotiate more advantageous terms and conditions than those originally established with the Manufacturer Umbrella Contract and Attachments (Specifically Appendix B) be included to allow for lower prices or other Cloud Solution specific advantages?

If yes, do any of the more advantageous terms and conditions conflict with the carved out sections as listed in Appendix B, Section 28 (C)? (Mandatory)

Has it been made clear that the Cloud Solution can not exceed 60 months?

Have the goals for SBs, MBEs, WBEs and/or SDVOBs been considered?

Do Prevailing Wage Rates need to be addressed?

Does Living Wage need to be addressed?

Has the Authorized User set forth their particular security procedures?

Has the Authorized User drafted a Statement of Work that will need to be negotiated with a Contractor to formalize all functional requirements and then be incorporated into the Authorized User Agreement? (Highly Recommended - See below for additional details)

Has the Authorized User stated that the Contractor is required to identify all Warranties, Guaranties, Service Level Agreements, Performance Standards, Service Commitments, Credits, etc… that relate to the Cloud Solution offering? (Highly Recommended)

Is the Authorized User prepared to negotiate a Service Level Agreement (SLA) and incorporate the same into the Authorized User Agreement?

Has the Authorized User set forth that they will not accept Service Level Objectives/Goals (SLOs)? (Highly Recommended)

Has a date been set to start planning for a replacement Cloud Solution (at least 1 year prior to the expiration of the Cloud Solution that this RFQ pertains to)?

Has the Authorized User's Legal Department reviewed the request to procure the Cloud Solution?

PRICING YES NO N/A

Does the Authorized User require fixed pricing over the life of the Authorized User Agreement based upon the Umbrella Contract - Manufacturer Based Price List?

Does the Authorized User want to entertain Cloud Solutions that have SKUs on the Umbrella Contract- Manufacturer Based Price List for pre-set price increases over the life of the Authorized User Agreement?

Does the Authorized User want to utilize Retainage?

Does the Authorized User want to reserve the right for unanticipated Enhancements?

Does the Authorized User desire to include language that allows pricing to be held for Products that may be re-purchased within the next 6 to 12 months? (Recommended)

Does the Authorized User want to include language that allows for a fixed price discount to meet future needs? (Recommended)

Does the Authorized User want to include language that allows them to apply the discount from the list price for all other Products or services that may fit within the original RFQ Scope for unforeseen future needs or technological developments? (Recommended)

INCREASE / DECREASE OF USAGE YES NO N/A

Have costs related to the use of the Cloud Solution at current levels as well as changes in Volume been considered?

If yes, have costs pertaining to changes in volume been incorporated into the evaluation/method of award?

Has the Cost per unit to expand current usage volume, including additional volume discount tiers, been considered?

Has the Cost per unit resulting of a decrease in Authorized User's volume been considered?

Are notification timeframes for increases and/or decreases in commitments required?

Have emergency increases in usage that may temporarily increase costs been considered?

Has the Authorized User considered saving money by purchasing a preconfigured Cloud Solution instead of a Custom Cloud Solution?

Has the Total Cost of Ownership been considered?

Should the cost of stored Data be based upon availability?

MAINTENANCE / SUPPORT AGREEMENT YES NO N/A

Are Maintenance/Support Services required?

If yes, does the Maintenance/Support Agreement identify the following:

Scope of Services

Service Level Agreements

Service Level Agreement Penalties/Rewards

Guarantee for Support Availability

Guarantee for Response Time

MAINTENANCE / SUPPORT AGREEMENT (continued) YES NO N/A

Delivery and Acceptance Timeframes and Procedures

Time Commitments & Prioritization of Services

Preventive and Corrective Maintenance/Support Activities

Reporting Requirements/Problem Escalation and Follow-Up Procedures

Who Can Request Support on the Behalf of the Authorized User

How Support Can be Accessed

Error Notification and Correction Process

Minimum Timeframe within the Contractor Must Notify the State Prior to Making Changes to Existing Technical Access Requirements

Other(s)

Does the Authorized User want to allow Maintenance/Support Agreement to automatically renew?

If yes, has the Authorized User set up a mechanism to remind them that they can cancel the automatic renewal provision via Written notice no later than 30 calendar days prior to the anniversary date of the Authorized User Agreement?

Has the Authorized User set up a mechanism to force them to cancel the automatic renewal provision via Written notice no later than 30 calendar days prior to the end date of the Authorized User Agreement?

Are Service Sheets for all Maintenance/Support requests required?

If yes, has the Authorized User specified that the Service Sheets must include the following:

Date and Time Notified by Authorized User

Date and Time of Arrival of Contractor

Description of Malfunction Reported by Authorized User

Diagnosis of Failure and Work Performed by Contractor

Date and Time Failure was Corrected

Charges for the Service

Name of Person Performing the Service

Other(s)

Is Remote Administration, Maintenance and Support required?

Has the Authorized User addressed that Support services that do not directly or indirectly access Data may be provided in a Follow the Sun format?

Has the Authorized User stated the days and hours when the system may be unavailable for maintenance?

If yes, is it ensured that maintenance occurs during periods of little or no demand?

SERVICE REPORTS YES NO N/A

Are Service Reports desired by the Authorized User?

If yes, did the Authorized User advise how they want to receive the Service Reports?

If yes, has the Authorized User set forth the information they want in the Service Reports such as the following:

Date and Time Contractor was Notified

Date and Time of Contractor's Arrival

Make and Model of the Product

Description of Malfunction Reported by the Authorized User

Diagnosis of Failure and/or Work Performed by Contractor

Date and Time Failure was Corrected by Contractor

Type of Service - Maintenance/Support or Warranty

Charges, if any, for the Service

Other(s)

Would the Authorized User accept a duplication of Appendix H, Maintenance and Warranty Service Report (which may be requested by OGS)?

CONTRACTOR'S ASSOCIATES YES NO N/A

Are background checks required for certain Contractor Staff?

Does the Authorized User require the separation of job duties?

Is it a requirement that Contractor staff knowledge of Data be limited to that which is absolutely needed to perform job duties?

Is it stated that Contractors must identify and detail all Reseller/Subcontractor relationships in regards to the Cloud Solution and implementation thereof?

Has the Authorized User addressed how they intend to handle staffing changes of the Contractor or its Subcontractor?

CONTRACTOR PERFORMANCE YES NO N/A

Does the Authorized User want to assess the Contractor's performance either independently or via a third party at the Authorized User's expense?

Has the Authorized User set forth the materials that they may request the Contractor to produce?

Has the Authorized User set forth the parameters that may be used to monitor performance such as the following:

Uptime

Downtime

CONTRACTOR PERFORMANCE (continued) YES NO N/A

Amount of Time that is Acceptable for an Error Correction

Acceptable Level of Latency

Recovery Time Objective

Recovery Point Objective

Timeliness of Incident Reporting

Incident Resolution Times

Subcontractor Performance

Page Load Times

Other(s)

Does the Authorized User require performance, payment or Bid Bond, or negotiable irrevocable letter of credit or other form of security for faithful performance of the Authorized User Agreement?

Does the Authorized User want to list the consequences for failure to perform?

If yes, are the consequences in compliance with the Contract and Appendix B?

Are there remedies for failure to perform?

If yes, are the remedies in compliance with the Contract and Appendix B?

DISPUTE RESOLUTION YES NO N/A

Has the Authorized User set forth a bid dispute resolution process?

Has the Authorized User developed and communicated an Authorized User Agreement dispute resolution process?

Has the Authorized User set forth how they need their Data returned to them in the event there is a dispute during the Authorized User Agreement?

MANAGED SERVICES, ETC… YES NO N/A

Are Managed Services required?

If yes, have the minimum requirements for Managed Services been set forth?

Is Remote Administration required?

If yes, have the minimum requirements for Remote Administration been set forth?

BUSINESS CONTINUITY / DISASTER RECOVERY YES NO N/A

Does the Authorized User wish to have a Business Continuity / Disaster Recover (BC/DR) plan in place?

Has a BC/DR plan been drafted by the Authorized User?

Will the Authorized User accept and/or negotiate a BC/DR plan as drafted by the Contractor?

Has the Authorized User addressed what they are responsible for in the BC/DR plan?

Has the Authorized User addressed what the Contractor is responsible for in the BC/DR plan?

Does the Contractor need to specify how the BC/DR plan will impact the uptime?

ENVIRONMENTAL / RECYCLING YES NO N/A

Does the Cloud Solution include a Product that will require physical disposal?

If yes, is there a policy(s) that will need to be complied with?

Is a Record of Disposition required?

If yes, has the preferred or required documentation of the disposition been specified?

EXPIRATION, TERMINATION OR SUSPENSION OF SERVICES YES NO N/A

Does the Authorized User have an exit strategy in place?

Have additional specifics about Suspension of Services been addressed?

Does the Authorized User want to address any specifics pertaining to Remedies for Breach of contract?

Has the Authorized User set forth expectations for Expiration or Termination of Services?

Has a timeframe been set for the return of Data?

Does the Authorized User envision needing full access to their Data for more than 60 calendar days after an expiration or termination of an Authorized User Agreement?

STATEMENT OF WORK (HIGHLY RECOMMENDED) YES NO N/A

Has the Authorized User drafted a Statement of Work that will need to be negotiated with a Contractor to formalize all functional requirements for the Authorized User Agreement?

If yes, has the Authorized User addressed all desired concepts which can include but not be limited to:

Project Plan - Milestones / Timeframes

Project Plan - Dependencies

Project Plan - Roles & Responsibilities

Project Plan - Knowledge Transfer

Project Plan - Other Decision Points

Project Timeline (i.e. Site Visits, Question & Answer Period, etc…)

Language to Retain Discounts for Product/Service Purchases

Background Checks

Deliverables/Payment Points and Retainage

Key Personnel Interviews

STATEMENT OF WORK (HIGHLY RECOMMENDED) (continued) YES NO N/A

Location Where Work Will Be Performed

Risk Projections and Mitigation Strategies Based on the Presented RFQ

Uptime

Downtime

Response Time

Security Conditions

Disaster Recovery/Business Continuity

Data Transfer Services

Chargebacks for Not Meeting Service Levels

Liquidated Damages for Not Meeting Service Levels

Penalties for Not Meeting Service Levels

Technical Requirements

Required Services

Required Reports

Deliverables

Other(s)

&"Arial,Regular"&8NYS Office of General Services Procurement Services &"Arial,Regular"&8Group 73600 - Award 22802 IT Umbrella Contracts - Manufacturer Based First Periodic Recruitment RFQ - Cloud Solution Checklist &"Arial,Regular"&8Page &P of &N

&"Arial,Regular"&8NYS Office of General Services Procurement Services &"Arial,Regular"&8Group 73600 - Award 22802 IT Umbrella Contracts - Manufacturer Based Appendix G.5 - RFQ - Cloud Solution Checklist &"Arial,Regular"&8Page &P of &N

&"Arial,Regular"&8July 2017 &"Arial,Regular"&8Attachment 12C, Part 1 - RFQ Cloud Solution Checklist

&"Arial,Regular"&8February 2022 http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-145.pdfhttp://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-145.pdf