9022 Solicitation Document.pdf

RFPSHELL. 12/16/2021

State of Florida Department of Transportation

REQUEST FOR PROPOSAL

Statewide Security Credential Management System for Connected Vehicle Projects

DOT-RFP-23-9022-CA

CONTACT FOR QUESTIONS:

Cassandra Anderson, Procurement Agent 605 Suwannee Street, Mail Station 20

Tallahassee, Florida 32399-0450 cassandra.anderson@dot.state.fl.us

Phone: (850) 414-4479

State of Florida Department of Transportation Central Procurement Office

605 Suwannee Street, Mail Station 20 Tallahassee, Florida 32399-0450

REQUEST FOR PROPOSAL REGISTRATION

PLEASE COMPLETE AND RETURN THIS FORM ASAP

SUBMIT TO CASSANDRA ANDERSON at cassandra.anderson@dot.state.fl.us

RFP Number: DOT-RFP-23-9022-CA

Title: Statewide Security Credential Management System for Connected Vehicle Projects

Proposal Due Date & Time (On or Before): November 15, 2022 @ 9:00 AM Local Time

Potential proposers should notify our office by returning this Registration Form as soon as possible after downloading. Complete the information below and submit to the Florida Department of Transportation Procurement Office by e-mail to cassandra.anderson@dot.state.fl.us

THE REQUEST FOR PROPOSAL DOCUMENT YOU RECEIVED IS SUBJECT TO

CHANGE. Notice of changes (Addenda), will be posted on the Florida Vendor Information Portal at https://vendor.myfloridamarketplace.com/, under this bid number, click on “Search Advertisements”, click on the drop-down arrow beside the box under Advertisement Type, select Request for Proposal, click on the drop-down arrow beside the box for Organization, select FLORIDA DEPARTMENT OF TRANSPORTATION, then go to the bottom of the same page and click on Advertisement Search. It is the responsibility of all potential bidders to monitor this site for any changing information prior to submitting your bid.

Company Name:

Address:

City, State, Zip:

Telephone: ( )

Contact Person:

E-Mail Address:

For further information on this process, e-mail or telephone:

Cassandra Anderson, Procurement Agent cassandra.anderson@dot.state.fl.us

(850) 414-4479 mailto:cassandra.anderson@dot.state.fl.us mailto:cassandra.anderson@dot.state.fl.us https://vendor.myfloridamarketplace.com/ mailto:cassandra.anderson@dot.state.fl.us

Exhibit “C” PRICE PROPOSAL FORM (Page 1 of 2)

RFP Number: DOT-RFP-20-9031-CA FOB: Statewide

RFP Title: Statewide Security Credential Management System for Connected Vehicle Projects.

Services to be provided as specified in attached Exhibit “A”, Scope of Services.

Item # Description Unit Quantity Total Price

Continue the current functioning and operation of the Security Credential Management System (SCMS) platform and enhance the platform per the scope of services.

Lump Sum

1 $___________

Annual Operations, Maintenance Support and training.

Year 3 $___________

Enrollment, Provisioning, Bootstrapping and Certificate Management for each End Entity as added.

Each 5,000 $___________

Connectivity, integration, ongoing maintenance, and support services for FDOT’s RSU Health Monitoring System.

Year 3 $___________

SCMS related implementation support of V2X DEP program deployment activities including integration, testing, and training.

Year 3 $___________

Optional

Description Unit Quantity Price Additional Enrollment, Provisioning, Bootstrapping and Certificate Management for each End Entity as added.

Each Over 5,000 $___________

GRAND TOTAL OF PROJECT (ITEMS 1-5) $_________________________

(Price Proposal Evaluation will be based on the Grand Total of the Project)

SPECIAL NOTES:

The Department has a total maximum budgetary amount of $700,000.00 for the contract resulting from this solicitation. Proposals received that exceed the total maximum budgetary amount will be considered non-responsive. See Special Condition 21, RESPONSIVENESS OF PROPOSALS.

• Item# 3 is based on estimated amount of 5,000. No guarantee is made actual quantity to be deployed. Payment will be made per deployed (or delivered spare) device.

• Item#5 must be bid for a total of 200 hours. Any effort over 200 hours will be compensated on prorata basis.

Exhibit “C” PRICE PROPOSAL FORM (Page 2 of 2)

RENEWAL: see Special Condition 33).

THE UNIT RATE(s) WILL APPLY TO THE INITIAL TERM AND ANY RENEWAL PERIODS.

NOTE: Unit Rates must be stated specifically in dollars and cents, NOT a percentage increase.

MFMP Transaction Fee: All payment(s) to the vendor resulting from this competitive solicitation WILL be subject to the MFMP Transaction Fee in accordance with the referenced Form PUR 1000 General Contract Condition #14. The Transaction Fees imposed shall be based upon the date of issuance of the payment.

NOTE: In submitting a response, the proposer acknowledges they have read and agree to the solicitation terms and conditions and their submission is made in conformance with those terms and conditions.

ACKNOWLEDGEMENT: I certify that I have read and agree to abide by all terms and conditions of this solicitation and that I am authorized to sign for the proposer. I certify that the response submitted is made in conformance with all requirements of the solicitation.

Proposer: FEID #

Address: City, State, Zip

Authorized Signature: Date:

Printed / Typed: Title:

STATE OF FLORIDA DEPARTMENT OF TRANSPORTATION

DRUG-FREE WORKPLACE PROGRAM CERTIFICATION

375-040-18

PROCUREMENT

03/17

287.087 Preference to businesses with drug-free workplace programs. --Whenever two or more bids, proposals, or replies that are equal with respect to price, quality, and service are received by the state or by any political subdivision for the procurement of commodities or contractual services, a bid, proposal, or reply received from a business that certifies that it has implemented a drug-free workplace program shall be given preference in the award process. In order to have a drug-free workplace program, a business shall:

(1) Publish a statement notifying employees that the unlawful manufacture, distribution, dispensing, possession, or use of a controlled substance is prohibited in the workplace and specifying the actions that will be taken against employees for violations of such prohibition.

(2) Inform employees about the dangers of drug abuse in the workplace, the business's policy of maintaining a drug-free workplace, any available drug counseling, rehabilitation, and employee assistance programs, and the penalties that may be imposed upon employees for drug abuse violations.

(3) Give each employee engaged in providing the commodities or contractual services that are under bid a copy of the statement specified in subsection (1).

(4) In the statement specified in subsection (1), notify the employees that, as a condition of working on the commodities or contractual services that are under bid, the employee will abide by the terms of the statement and will notify the employer of any conviction of, or plea of guilty or nolo contendere to, any violation of Chapter 893 or of any controlled substance law of the United States or any state, for a violation occurring in the workplace no later than 5 days after such conviction.

(5) Impose a sanction on, or require the satisfactory participation in a drug abuse assistance or rehabilitation program if such is available in the employee's community by, any employee who is so convicted.

(6) Make a good faith effort to continue to maintain a drug-free workplace through implementation of this section.

Does the individual responding to this solicitation certify that their firm has implemented a drug-free workplace program in accordance with the provision of Section 287.087, Florida Statutes, as stated above?

YES

NO

NAME OF BUSINESS:

MBE PLANNED UTILIZATION

375-040-24

03/17

PROCUREMENT NO. FINANCIAL PROJECT NO.

(DEPARTMENT USE ONLY)

DESCRIPTION:

I, , (name) (title) of plan to subcontract at least % (percent) of the project costs on the above referenced project to Minority

Business Enterprises.

If I have indicated above that a portion of the project costs will be subcontracted to MBE(s), the firms considered as proposed subconsultants/contractors and the types of services or commodities to be subcontracted are as follows:

MBE SUBCONSULTANTS/CONTRACTORS TYPES OF SERVICES/COMMODITIES

I understand that I will need to submit Minority Business Enterprises (MBE) payment certification forms to the Department for reporting purposes only.

Signed:

Title:

Date:

STATE OF FLORIDA DEPARTMENT OF TRANSPORTATION 375-030-60

Florida Statutes VENDOR CERTIFICATION REGARDING PROCUREMENT

287.135 SCRUTINIZED COMPANIES LISTS OGC – 06/18

Respondent Vendor Name: _____________________________________________________

Vendor FEIN: ___________________

Vendor’s Authorized Representative Name and Title: ___________________________________

Address: ______________________________________________________________________

City: _____________________ State: _____________________________ Zip: ______________

Phone Number: ____________________________________

Email Address: _____________________________________________________

Section 287.135, Florida Statutes prohibits a company from bidding on, submitting a proposal for, or entering into or renewing a contract for goods or services of any amount if, at the time of contracting or renewal, the company is on the Scrutinized Companies that Boycott Israel List, created pursuant to Section 215.4725, Florida Statutes, or is engaged in a boycott of Israel. Section 287.135, Florida Statutes, also prohibits a company from bidding on, submitting a proposal for, or entering into or renewing a contract for goods or services of $1,000,000 or more, that are on either the Scrutinized Companies with Activities in Sudan List or the Scrutinized Companies with Activities in the Iran Petroleum Energy Sector Lists which were created pursuant to s. 215.473, Florida Statutes.

As the person authorized to sign on behalf of Respondent, I hereby certify that the company identified above in the section entitled “Respondent Vendor Name” is not listed on either the Scrutinized Companies with Activities in Sudan List or the Scrutinized Companies with Activities in the Iran Petroleum Energy Sector List, or the Scrutinized Companies that Boycott Israel List. I further certify that the company is not engaged in a boycott of Israel. I understand that pursuant to section 287.135, Florida Statutes, the submission of a false certification may subject company to civil penalties, attorney’s fees, and/or costs.

Certified By: __________________________________________________________ who is authorized to sign on behalf of the above referenced company.

Authorized Signature Print Name and Title: ____________________________________

Date:

Appendix II

INFORMATION TECHNOLOGY RESOURCES

375-040-29

01/22

Agreement (Purchase Order) #: TBD

CHAPTER 60GG-1, F.A.C. – INFORMATION TECHNOLOGY PROJECT MANAGEMENT AND

OVERSIGHT STANDARDS

Governed by the Department of Management Services’ Florida Digital Service (FL[DS]), Chapter 60GG-1, Florida Administrative Code (F.A.C.), Florida Information Technology Project Management and Oversight Standards, establishes project management principles that State Agencies are required to follow when implementing information technology projects. the Department must adhere to the State project management standards and ensure that all project documentation created by the Vendor, the Department, or in collaboration, is developed and maintained in accordance with Chapter 60GG-1 F.A.C. The Vendor must be familiar with the State project management standards and be prepared to satisfy all requirements. It is important for the Vendor to recognize that documentation, monitoring, or reporting requirements may change mid-project, based on the project’s FL[DS] Risk and Complexity Assessment, outlined in 60GG-

1.002. The Vendor must be adaptable to changes required by Chapter 60GG-1 F.A.C., without increasing cost to the Department.

CHAPTER 60GG-2, F.A.C. – FLORIDA CYBERSECURITY STANDARDS

Governed by the Department of Management Services’ Florida Digital Service, Chapter 60GG-2 F.A.C., Information Technology Security, also known as the Florida Cybersecurity Standards (FCS), establishes cybersecurity standards for information technology (IT) resources.

State Agencies are required to follow these standards in the management and operations of state IT resources. The Department must adhere to the Florida Cybersecurity Standards for all IT projects created by the Vendor, Department, or in collaboration. The Vendor must be familiar with the State cybersecurity standards and be prepared to work with the Department to satisfy all requirements.

CHAPTER 60GG-2.002, F.A.C. SYSTEM SECURITY PLANS

In support of the Florida Cybersecurity Standards, 60GG-2 F.A.C. Section 60GG-2.002, F.A.C., the Department requires that all IT systems have a system security plan (SSP). The SSP must address the security setup of the system, ensuring that security controls required by Section 60GG-2.003(5)(g)(4), F.A.C., are in place. The SSP must be submitted by the Vendor and approved by the Department Information Security Manager (ISM) prior to system implementation. The SSP must be completed using the SSP template made available from the Department ISM. The SSP must be submitted during the System Design/Configuration phase to allow time for changes in the security design that may be required. Upon receipt of the SSP, the Department will have ten (10) business days to review. The ISM will respond with feedback, approval, or denial of the plan. The Vendor must allow time for adjustments to the plan and resubmittal to the ISM. After the SSP is approved, the Vendor shall keep the SSP updated as necessary or upon notification by the Department of a deficiency in the SSP. Any change to the SSP must be reviewed by the Department and approved by the ISM.

CHAPTER 60GG-2.002, F.A.C. BACKGROUND CHECKS FOR VENDOR STAFF

Florida Department of Transportation (Department) requires Vendor employees working on systems identified by the Department with a risk factor of moderate or higher to undergo an FBI Level II background check. The Vendor will pay the cost of their employee background checks. The Vendor will utilize the Department’s Originating Agency Identifier (ORI). Contract employees must successfully pass the Level II background check before beginning work on the project.

CHAPTER 60GG-2.002, F.A.C. RISK ASSESSMENTS

The Vendor that operates as a service provider agrees to perform a third-party risk assessment on vendor owned resources that contain Department information. The assessment will follow the schedule below, and create a risk mitigation plan that assigns risk levels and proposed controls. A Plan of Action and Milestones will be shared and communicated with the Department as risk is mitigated. An annual Attestation or Certification from a third-party assessment, or report or proof of certification such as but not limited to a System and Organization Controls (SOC) 2, International Organization for Standardization (ISO) 27001, etc. will be accepted in place of a third-party risk assessment.

Assessment categorization established as per Federal Information Processing Standards (FIPS) 199 Publication standards:

1. High – will be completed every 12 months

2. Moderate – will be completed every 18 months

3. Low – will be completed every 24 months

CHAPTER 60GG-2.005, F.A.C. SECURITY INCIDENT RESPONSE

The Vendor agrees to provide a security incident response plan, which will be added as an addendum to the Department’s overall security incident response plan. The Vendor’s plan shall outline specific actions, response time frames, and roles and responsibilities. The Vendor agrees to align its services with the Department by monitoring and responding to security incidents of Department data and information according to section 282.318, F.S.

In the event of a security incident or breach that involves Department data or IT assets, the Vendor shall within 24 hours of discovery notify the Department’s Information Security Manager (ISM) at ISM@dot.state.fl.us. In addition, the Vendor shall:

1. Take prompt corrective action to cure the incident, and any action pertinent to unauthorized disclosure required by applicable federal and state laws/regulations.

https://www.flrules.org/gateway/ChapterHome.asp?Chapter=60GG-1 https://www.flrules.org/gateway/ChapterHome.asp?Chapter=60GG-2 mailto:ISM@dot.state.fl.us

PROCUREMENT OFFICE

2. To the extent known, the Vendor shall provide daily status updates by 5pm EST to the ISM.

3. Vendor updates will continue until notified by the Department’s ISM and will include:

a. The nature of the unauthorized use or disclosure

b. Any confidential information used or disclosed

c. Who made the unauthorized use or received the unauthorized disclosure

d. What the Vendor has done or shall do to mitigate any deleterious effect of the unauthorized use or disclosure

e. What corrective action the Vendor has taken or shall take to prevent future similar unauthorized use or disclosure

4. When notification of affected persons is required under section 501.171, F.S., the Vendor shall provide such notification, but only after the Department’s written approval of the contents of the notice.

CHAPTER 60GG-4, F.A.C. – Cloud Computing For all Agreements utilizing cloud computing, the Vendor will provide demonstrated protections to ensure that systems provisioned in the cloud are appropriately secure and performant, appropriate to the workload and data hosted, and ultimately ensure the availability, integrity and confidentiality of Department’s data and resources. These protections shall be documented in the Agreement.

Location and Portability of Data:

All data will be geographically located within the continental United States. Remote access to data, other than open data, from outside the United States is prohibited, unless approved in writing by the agency head or designee. The Department maintains data ownership and the Vendor will ensure portability to allow for the transfer of data from one cloud service to another. The portability method will be dependent upon data transfer requirements documented in the Agreement. The portability method shall be through an approved extract, transform, and load (ETL) process or, via an industry common electronic format using standard Application Programming Interface (API). The Vendor will clearly document its data egress charge model as part of any response to a solicitation for services.

Disentanglement Services:

If this Agreement is terminated for convenience or default or upon the Agreement completion date or expiration of the Agreement term or any extensions thereof, the Vendor shall cooperate with the Department to facilitate an effective and efficient transition to the Department’s selected successor for the Services. In the event of such Agreement termination, completion, or expiration, Vendor shall:

a. Provide Disentanglement Services for up to one (1) year from the date of termination, completion, or expiration. Unless otherwise agreed to by the Department in writing, the Vendor’s Payment Schedule, and Price Proposal, including labor rates identified in the Price Proposal, shall apply to all transition Work.

b. Make all operational records, documents, data, Systems, and facilities required to maintain day-to-day Operations of the Services being rendered under this Agreement available before the date of such termination, suspension, or expiration.

c. Make all other records, documents, data, and Software which is licensed to the Department and pertaining to the Services rendered for this Agreement available within thirty (30) Calendar Days upon written notice or as otherwise provided in the executed License Agreement.

d. Provide all staff necessary to facilitate transition and succession.

e. Make all necessary provisions for transferring any leases or sub-leases held by the Vendor to the Department, including without limitation, all keys, security codes and other facility access information or devices.

f. Make all necessary provisions for securing, providing, and/or granting Software licenses, to continue Operations.

Service Level Agreement (SLA) Requirements:

The Vendor’s cloud computing availability, performance, and response shall be measured and reported against Service Metrics developed by the Department. “Service Level Agreement” is the collective set of minimum standards for technology performance as set forth in the Agreement. The Department will identify applicable Service Level requirements, with associated penalties/consequences and include them in the Agreement. The Vendor shall:

a. Implement and utilize its current measurement and monitoring methods, tools, and procedures to track and report Vendor’s cloud computing availability, performance, and response in delivering the Hosting and Environment Services relative to the applicable Service Levels and shall produce a monthly written report to the Department.

b. If the Vendor’s cloud computing availability, performance, and/or response falls below the identified SLAs, the Department will be entitled to specified service penalties/financial consequences, as set forth in the Agreement.

SOFTWARE BILL OF MATERIALS (SBOM)

A Software Bill of Materials or “SBOM” is a formal record containing the details and supply chain relationships of various components used in building software. Many commercial off-the-shelf (COTS) software products are created by assembling existing open source and commercial software components. The purpose of the SBOM is to identify these components within a product. An SBOM is useful to those who develop or manufacture software, those who select or purchase software, and those who operate software. An SBOM allows the software developer to ensure the components are up to date and able to respond quickly to new vulnerabilities. Vendors providing software as part of this Agreement shall incorporate a widely used, machine-readable SBOM format, which will allow for greater benefits through automation and tool integration. The Department will use the SBOM to perform vulnerability or license analysis, both of which will be used to evaluate risk in a product. The use of an SBOM provides the Department with a valuable tool to understand the supply chain of software, analyze known vulnerabilities, and manage risk.

COMPUTER HARDWARE/SOFTWARE LIABILITY

In any Agreement for the purchase or maintenance of machines or computer hardware/software or licensed programs, the Vendor's entire liability and the Department's exclusive remedy for damages to the Department related to the machine or computer hardware/software or licensed program which is the subject of this Agreement, or maintenance thereof shall be limited to, at the Department's discretion, 1) the correction by the Vendor of the relevant defect(s); or 2) actual damages up to the greater of an amount equal to 12 months maintenance charges for said product or the purchase price of said product. Such maintenance charges will be those in effect for the specific product when the cause of action arose. The foregoing limitation of liability will not apply to (a) the payment of cost and damage awards resulting from liability in accordance with the Copyright or Patent Infringement paragraph below, or to (b) claims for reprocurement costs or the cost of cover pursuant to Rule 60A-1.006, Florida Administrative Code, or to (c) claims by the Department for personal injury or damage to real property or tangible personal property caused by the Vendor's negligence or tortious conduct.

CONFIDENTIAL INFORMATION

Trade secrets are not solicited or desired as submissions with responses. Respondents are advised to submit a redacted version of the quote if the Vendor deems any portion of the documents, data or records submitted in response to this solicitation to be confidential, trade secret or otherwise not subject to disclosure pursuant to Florida Statutes (F.S.), the Florida Constitution or other authority. Any confidential or trade secret submission must be conspicuously marked as such, and any redacted copy must be clearly titled “Proprietary and Confidential.” Failure to provide a redacted version when confidentiality is claimed by the Vendor may be cause for determination of non-conformance.

CONFLICT OF INTEREST

To prevent any bias, unfair competitive advantage, conflict of interest, or the appearance of any type of impropriety, Vendor personnel must not have been directly or indirectly involved in the development of the Scope of Services or related solicitation documentation by the Department. If Vendor personnel worked in conjunction with the Department on the development of the solicitation document, the Vendor is prohibited from submitting a bid for this solicitation. Vendor personnel assigned to other Department projects outside this Contract, shall hold and maintain any confidential information that could benefit the Vendor on future solicitations in strictest confidence. As a condition of the Agreement, the Department may require contracted personnel to sign a nondisclosure agreement. Violation of the non-disclosure agreement by contracted personnel may result in termination of the individual, and at the Department’s discretion, disqualification of the Vendor from future solicitations.

COPYRIGHT OR PATENT INFRINGEMENT

To the extent permitted by Florida Law, the Vendor, without exception, shall save, defend and hold harmless the Department and its employees from liability of any nature or kind, including cost and expenses, for or on account of any copyrighted, patented or unpatented invention, process, or article manufactured or supplied by the Vendor. The Vendor has no liability when such claim is solely and exclusively due to the combination, operation or use of articles supplied hereunder with equipment or data not supplied by Vendor or is based solely and exclusively upon the Department's alteration of the article. The Department will provide prompt written notification of a claim of copyright or patent infringement. Further, if such claim is made or is pending, the Vendor may, at its option and expense, procure for the Department the right to continued use of, or replace or modify the article to render it non-infringing. If the Vendor uses any design, device, or materials covered by letters, patent or copyright, it is mutually agreed and understood that, without exception, the Agreement price shall include all royalties or other costs arising from the use of such design, device, or materials in any way involved in the work. Copyrighted material will be accepted, as part of a technical Quote, only if accompanied by a waiver that will allow the

Department to make paper and electronic copies necessary for use by the Department staff and agents. It is noted that copyrighted material is not exempt from the Public Records Law, Chapter 119, F.S. Therefore, such material will be subject to viewing by the public.

DATA SECURITY AND CONFIDENTIALITY

The Vendor and its employees must comply with all Department security procedures while working on this Agreement. The Vendor shall provide immediate notice to the Department-OIT Application Services Manager and the Department – Transportation Technology Office (TTO) Information Security Manager (ISM) in the event it becomes aware of any security breach, any unauthorized transmission of State Data as described below or of any allegation or suspected violation of the Department security procedures. Except as required by law or legal process and after notice to the Department, the Vendor shall not divulge to third parties any confidential information obtained by the Vendor or its agents, distributors, resellers, subcontractors, officers or employees in the course of performing Agreement work, including, but not limited to, Chapter 60GG-2, F.A.C., security procedures, business operations information, or commercial proprietary information in the possession of the state and/or the Department.

a. Loss of Data In the event of loss of any Department or State data or record where such loss is due to the negligence of the Vendor or any of its subcontractors or agents, the Vendor shall be responsible for recreating such lost data in the manner and on the schedule set by the Department at the Vendor’s sole expense.

b. Data Protection No state data or information will be transmitted to, stored in, processed in, or shipped to offshore locations or out of the United States of America, regardless of method, except as required by law. Examples of these methods include (but are not limited to):

FTP transfer, DVD, tape, or drive shipping; regardless of level of encryption employed. Access to State Data shall only be available to approved and authorized staff, including remote/offshore personnel, that have a legitimate business need.

DELIVERABLE WARRANTY

Vendor warrants that all Deliverables provided by Vendor shall comply with the form, content, performance, and functionality specified in the Scope or each applicable TWO. If at any time within the Warranty Period, the Department discovers that a Deliverable does not comply with this Warranty, the Vendor shall, at no cost to the Department and in a timely manner, make such Deliverable conform and comply with this Warranty.

Each Deliverable and any other work product provided by Vendor in performing the Services, does not and will not infringe and is not and will not misappropriate or infringe the intellectual property rights, privacy rights or other rights of any other person or entity, nor has any claim of such infringement been threatened or asserted, nor is such a claim pending against Vendor (or to the best of Vendor’s knowledge, any entity from which Vendor has obtained such Deliverable, Work Product, or rights related thereto.

ELECTRONIC ACCESSIBILITY

The Federal Electronic and Information Technology standard can be found at: https://www.section508.gov/. The Department standards set for section 508 compliance information for the supplies and services in this Agreement are available on the Department Standards and Guidance Set website.

ESCROW OF SOURCE CODE

The Vendor shall maintain in escrow a copy of the source code for the licensed software. With each new release of the software provided to the Department, the Vendor shall maintain the updated source code in escrow. In the event the Vendor files for bankruptcy or ceases operations for any reason, the Department shall promptly be provided the current source code in escrow. The Department will only use the source code to support the licensed software subject to the same nondisclosure provisions of this Agreement.

FACILITIES AND EQUIPMENT

Upon completion of Security Awareness Training by the Vendor’s personnel assigned to this project, the Department shall provide necessary access to the Department network. The work will be conducted on-site in the Tallahassee Project Office. The Project will provide work space to use while on site. All property furnished by the Department for use by the Vendor during this Agreement will remain the property of the State of Florida.

GUIDELINES AND STANDARDS

The Vendor agrees to comply with the Department’s best practices and standards, including, but not limited to, the most current version available on the Department Standards and Guidelines Set website.

OWNERSHIP OF WORKS AND INVENTIONS

The Vendor agrees that the Department will have full ownership of any works of authorship, inventions, improvements, ideas, data, processes, computer software programs, and discoveries (hereafter called intellectual property) conceived, created, or furnished under this Agreement, with no rights of ownership in Vendor or any subcontractors. Vendor and subcontractors shall fully and promptly disclose to the Department all intellectual property conceived, created, or furnished under this Agreement. Vendor or subcontractor hereby assigns to the Department the sole and exclusive right, title, and interest in and to all intellectual property conceived, created, or furnished under this Agreement, without further consideration. This Agreement operates as an irrevocable assignment by Vendor and subcontractors to the Department of the copyright in any intellectual property created, published, or furnished to the Department under this Agreement, including all rights thereunder in perpetuity. Vendor and subcontractors shall not patent any intellectual property conceived, created, or furnished under this Agreement. Vendor and subcontractors agree to execute and deliver all necessary documents requested by the Department to affect the assignment of intellectual property to the Department or the registration or confirmation of the Department’s rights in or to intellectual property under the terms of this Agreement. Vendor agrees to include this provision in all its subcontracts under this Agreement.

The Vendor agrees that all work materials developed or provided by the Vendor under this Agreement and any prior agreement between the parties will be deemed to be work made for hire and owned exclusively by the State of Florida. The Vendor agrees that any intellectual property contained in a Deliverable and developed as a result of this Agreement will be the sole property of the State of Florida. This provision will survive the termination or expiration of the Agreement. The Vendor retains all ownership rights in any proprietary methodologies, methods, processes, ideas, concepts, algorithms, trade secrets, software documentation, other intellectual property, or procedures of the Vendor that pre-exist or were developed outside the scope of this Agreement. If any such property of Vendor is contained in any of the Deliverables hereunder, the Vendor grants to the Department a royalty-free, paid-up, non-exclusive, perpetual license to use such Vendor intellectual property in connection with the Department’s use of the Deliverables.

PROJECT PLAN SCOPE LANGUAGE

The Department requires that the Vendor create and submit a Project Plan that demonstrates how the creation and maintenance of the application will be carried out. The Project Plan template may be found at https://www.fdot.gov/it/docs/dispFiles.shtm, and is the template https://www.section508.gov/ http://www.fdot.gov/it/AppDevDocsAndGuidelines.shtm which the Department requires the Vendor to follow. The Project Plan must be submitted to the Department within thirty (30) business days after execution of Agreement or as indicated in the Scope of Work. Upon receipt of the Project Plan, the Department will have fourteen (14) business days to review and approve the Project Plan in its sole discretion. No other work may begin prior to the submission and approval of the Project Plan. After the Project Plan is approved, the Vendor shall keep the Project Plan updated as necessary or upon notification by the Department of a deficiency in the Project Plan. Any change to the Project Plan must be approved by the Department.

Purchase of Tangible Personal Property

Contractual services that provide for the Vendor to purchase tangible personal property, as defined in Section 273.02, F.S., for subsequent transfer to the Department may be entered into only in accordance with Rule 60A-1.017, F.A.C. Technology products (e.g., software, networking equipment, etc.) purchased by the Vendor shall be subsequently transferred to the Department and shall be of first quality, supplied by the original product manufacturer or an authorized reseller, and warrantied as appropriate. Technology products procured by the Contractor outside of authorized distributors/retailers are not deemed acceptable to the Department. The Agreement shall specify the quality of the technology products to be acquired, and provisions for warranty, service, and mandatory transfer of ownership to the Department.

SECURITY OF CONFIDENTIAL PERSONAL INFORMATION

The Vendor must implement procedures to ensure the protection and confidentiality of all data, files, and records involved with this Agreement.

Except as necessary to fulfill the terms of this Agreement and with the permission of the Department, Vendor and Vendor’s employees shall not divulge to third parties any confidential information obtained by Vendor or its agents, distributors, resellers, subcontractors, officers, or employees in the course of performing work on this Agreement, including, but not limited to, security procedures, business operations information, or commercial proprietary information in the possession of the State or the Department. If Vendor or Vendor’s employees have access to confidential information in order to fulfill Vendor’s obligations under this Agreement, Vendor agrees to abide by all applicable Department Information Technology Security procedures and policies. For purposes of this Agreement, “Security Incident” means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of Department information in Vendor’s possession. Vendor shall make a report to the Department not more than seven (7) business days after Vendor learns of such use or disclosure.

Vendor’s report shall identify, to the extent known: (i) the nature of the unauthorized use or disclosure, (ii) the confidential information used or disclosed, (iii) who made the unauthorized use or received the unauthorized disclosure, (iv) what Vendor has done or shall do to mitigate any deleterious effect of the unauthorized use or disclosure, and (v) what corrective action Vendor has taken or shall take to prevent future similar unauthorized use or disclosure.

In the event a “Security Incident” also includes a “breach of security”, as defined by section 501.171, F.S., as amended, concerning confidential personal information involved with this Agreement, Vendor shall comply with section 501.171, F.S. When notification to affected persons is required under this section of the statute, Vendor shall provide that notification, but only after receipt of the Department’s approval of the contents of the notice. Defined statutorily, and for purposes of this Agreement, “breach of security” or “breach” means the unauthorized access of data in electronic form containing personal information.

THIRD PARTY TOOLS

Vendors may not use third-party tools which impose licensing responsibility on the Department without written approval by the Department.

TRAINING

The Vendor shall provide, at its own expense, training necessary for keeping Vendor staff abreast of industry advances and for maintaining proficiency in equipment and systems that are available on the commercial market.

http://www.leg.state.fl.us/STATUTES/index.cfm?App_mode=Display_Statute&Search_String=&URL=0500-0599/0501/Sections/0501.171.html

E-VERIFY

375-031-06

PROCUREMENT

OGC – 10/21

Contract No:

Financial Project No(s):

Project Description:

In accordance with the contract, the Vendor/Consultant/Contractor hereby acknowledges and certifies compliance with Section 448.095, Florida Statutes. The Vendor/Consultant/Contractor shall register with and use the E-Verify system to verify the work authorization status of all newly hired employees. The Vendor/Consultant/Contractor shall utilize the U.S. Department of Homeland Security’s E-Verify system, in accordance with the terms governing use of the system. The Vendor/Consultant/Contractor shall comply with Section 448.095, Florida Statutes, for the duration of the contract term, including any extensions or renewal periods.

Company/Firm:

Authorized Signature:

Title:

Date:

SPECIAL NOTE:

THIS FORM MUST BE COMPLETED BY THE INTENDED AWARDED VENDOR PRIOR TO CONTRACT

EXECUTION. IT DOES NOT NEED TO BE SUBMITTED BACK TO THE DEPARTMENT, AT THIS TIME, BY VENDORS RESPONDING TO THIS INVITATION TO BID.

I N T R O D U C T I O N S E C T I O N

1) INVITATION

The State of Florida Department of Transportation, hereinafter referred to as the “Department”, requests written proposals from qualified Proposers to provide a Statewide Security Credential Management System for Connected Vehicle Project. It is anticipated that the term of the contract will begin upon execution of contact and be effective for 3 years thereafter.

The Department intends to award this contract to the responsive and responsible Proposer whose proposal is determined to be the most advantageous to the Department. After the award, said Proposer will be referred to as the “Vendor”. For the purpose of this document, the term "Proposer" means the prime Vendor acting on its own behalf and those individuals, partnerships, firms, or corporations comprising the Proposer team. The term "proposal" means the complete response of the Proposer to the Request for Proposals (RFP), including properly completed forms and supporting documentation.

2) TIMELINE

Provided below is a list of critical dates and actions. These dates are subject to change. Notices of changes (Addenda) will be posted on the Florida Vendor Information Portal at https://vendor.myfloridamarketplace.com/ (click on “Search Advertisements”) under this RFP number. It is the responsibility of all potential proposers to monitor this site for any changing information prior to submitting your proposal.

ACTION / LOCATION DATE LOCAL TIME

DEADLINE FOR TECHNICAL QUESTIONS 10/31/2022 05:00 PM

(There is no deadline for administrative questions)

PROPOSALS DUE, ON OR BEFORE 11/15/2022 09:00 AM

(Technical and Price Proposal) Florida Department of Transportation Central Procurement Office Attn: Cassandra Anderson, Procurement Agent Phone: (850) 414-4479 CO.Purch@dot.state.fl.us

PUBLIC OPENING (Technical Proposal) 11/15/2022 10:00 AM Florida Department of Transportation Attn: Cassandra Anderson, Procurement Agent 605 Suwannee Street, Mail Station 20 Tallahassee, Florida 32399-0450

PUBLIC OPENING / MEETING (Price Proposal) 12/20/2022 09:30 AM Florida Department of Transportation Attn: Cassandra Anderson, Procurement Agent 605 Suwannee Street, Mail Station 20 Tallahassee, Florida 32399-0450

POSTING OF INTENDED AWARD 12/20/2022

mailto:CO.Purch@dot.state.fl.us

3) AGENDA FOR PUBLIC MEETINGS

Agenda – Public Opening (Technical Proposals) Agenda for Public Opening of Technical Proposals for DOT-RFP-23-9022-CA:

Starting Time: see “Timeline” in RFP solicitation

- Opening remarks of approx. 2 minutes by Department Procurement Office personnel.

- Public input period – To allow a maximum of 15 minutes total for public input related to the

RFP solicitation.

- At conclusion of public input or 15 minutes, whichever occurs first, the Technical Proposals received timely will be opened, with proposer’s name read aloud and tabulated. Price proposals will be kept secured and unopened until the Price Proposal Opening.

- Adjourn meeting.

Agenda – Price Proposal Opening & Intended Award Meeting Agenda for Price Proposal Opening and Intended Award meeting for DOT-RFP-23-9022-CA:

Starting Time: see “Timeline” in RFP solicitation

- Opening remarks of approx. 2 minutes by Department Procurement Office personnel.

- Public input period – To allow a maximum of 15 minutes total for public input related to the

RFP solicitation.

- At conclusion of public input or 15 minutes, whichever occurs first, the Technical evaluation scores will be summarized.

- Announce the firms that did not achieve the minimum technical score.

- Announce the firms that achieved the minimum technical score and their price(s) as price proposals are opened.

- Calculate price scores and add to technical scores to arrive at total scores.

- Announce Proposer with highest Total Score as Intended Award.

- Announce time and date the decision will be posted on the Vendor Information Portal

(VIP).

- Adjourn.

4) SPECIAL ACCOMMODATIONS

Any person with a qualified disability requiring special accommodations at a pre-proposal conference, public meeting, oral presentation and/or opening shall contact the contact person at the phone number, e-mail address on the title page at least five (5) working days prior to the event. If you are hearing or speech impaired, please contact this office by using the Florida Relay Services which can be reached at

1 (800) 955-8771 (TDD).

S P E C I A L C O N D I T I O N S

1) MyFloridaMarketPlace

PROPOSERS MUST BE REGISTERED IN THE STATE OF FLORIDA’S MYFLORIDAMARKETPLACE

SYSTEM BY THE TIME AND DATE OF THE TECHNICAL PROPOSAL OPENING OR THEY MAY BE

CONSIDERED NON-RESPONSIVE (see Special Condition 21). All prospective proposers that are not registered should go to https://vendor.myfloridamarketplace.com/ to complete on-line registration, or call 1-866-352-3776 for assisted registration.

All payment(s) to the vendor resulting from this competitive solicitation WILL be subject to the MFMP Transaction Fee in accordance with the referenced Form PUR 1000 General Contract Condition #14.

The Transaction Fees imposed shall be based upon the date of issuance of the payment.

2) Florida Department of Financial Services (DFS) W-9 REQUIREMENT

The Florida Department of Financial Services (DFS) requires all vendors that do business with the state to submit an electronic Substitute Form W-9. Vendors must submit their W-9 forms electronically at https://flvendor.myfloridacfo.com to receive payments from the state. Contact the DFS Customer Service Desk at (850) 413-5519 or FLW9@myfloridacfo.com with any questions.

3) QUESTIONS & ANSWERS

In accordance with section 287.057(25), Florida Statutes, respondents to this solicitation or persons acting on their behalf may not contact, between the release of the solicitation and the end of the 72-hour period following the agency posting the notice of intended award, excluding Saturdays, Sundays, and state holidays, any employee or officer of the executive or legislative branch concerning any aspect of this solicitation, except in writing to the procurement officer or as provided in the solicitation documents.

Violation of this provision may be grounds for rejecting a response.

Any technical questions arising from this Request for Proposal must be forwarded, in writing, to the procurement agent identified below. Questions must be received no later than the time and date reflected on the Timeline. The Department’s written response to written inquiries submitted timely by proposers will be posted on the Florida Vendor Information Portal at https://vendor.myfloridamarketplace.com/(click on “Search Advertisements”), under this RFP number. It is the responsibility of all potential proposers to monitor this site for any changing information prior to submitting their proposal.

WRITTEN TECHNICAL QUESTIONS should be submitted to:

Cassandra Anderson, Procurement Agent CO.Purch@dot.state.fl.us

Questions regarding administrative aspects of the proposal process should be directed to the Procurement Agent in writing at the address above or by phone: (850) 414-4479

4) ORAL INSTRUCTIONS / CHANGES TO THE REQUEST FOR PROPOSAL (ADDENDA)

No negotiations, decisions, or actions will be initiated or executed by a proposer as a result of any oral discussions with a State employee. Only those communications which are in writing from the Department will be considered as a duly authorized expression on behalf of the Department.

Notices of changes (Addenda) will be posted on the Florida Vendor Information Portal at https://vendor.myfloridamarketplace.com/ (click on “Search Advertisements”) under this RFP number. It is the responsibility of all potential proposers to monitor this site for any changing information prior to submitting your proposal. All Addenda will be acknowledged by signature and subsequent submission of Addenda with proposal when so stated in the Addenda.

5) DIVERSITY ACHIEVEMENT

MINORITY BUSINESS ENTERPRISE (MBE) UTILIZATION

The Department, in accordance with Title VI of the Civil Rights Act of 1964, 42 USC 2000d- 2000d-4, Title 49, Code of Federal Regulations, U.S. Department of Transportation, Subtitle A, Office of the Secretary, Part 21, Nondiscrimination in federally-assisted programs of the Department of Transportation issued pursuant to such Act, hereby notifies all bidders that the Department will affirmatively ensure that in any contract/agreement entered into pursuant to this advertisement, minority and disadvantaged business enterprises will be afforded the full opportunity to submit bids in response to this invitation and will not be discriminated on the basis of race, color, national origin, or sex in consideration for an award.

The Department encourages small, minority, women, and service-disabled veteran businesses to compete for Department contracts, both as “Vendor” and as subcontractors. The Department, its https://flvendor.myfloridacfo.com/ mailto:FLW9@myfloridacfo.com https://vendor.myfloridamarketplace.com/ vendors, suppliers, and consultants should take all necessary and reasonable steps to ensure that small, minority, women, and service-disabled veteran businesses have the opportunity to compete for and perform contract work for the Department in a nondiscriminatory environment. Bidders are requested to indicate their intention regarding MBE participation on the MBE Planned Utilization form and to submit the completed form with their Price Proposal. The contract vendor will be asked to submit payment certification for MBE subcontractors used.

To request certification or to locate certified MBEs, call the Office of Supplier Diversity, Department of Management Services at (850) 487-0915, or access their MBE directory on the Internet at www.osd.dms.state.fl.us/.

6) SCOPE OF SERVICES

Details of the services, information and items to be furnished by the Vendor are described in Exhibit "A", Scope of Services, attached hereto and made a part hereof.

7) INTENDED AWARD

The Department intends to award a contract to the responsive and responsible vendor with the highest cumulative total points for the evaluation criteria specified herein (See Section 30, Proposal Evaluation).

The Intended Award decision will be announced after final evaluation and totaling of scores at the Price Proposal opening specified in the Timeline (See Introduction Section 2 Timeline).

If the Department is confronted with identical pricing or scoring from multiple vendors, the Department shall determine the order of award using the following criteria, in the order of preference listed below (from highest…