9078 - Questions and Answers.pdf

FLORIDA DEPARTMENT OF TRANSPORTATION

Procurement Office

605 Suwannee Street, MS 20 Tallahassee, Florida 32399-0450

Phone: (850) 414-4381

QUESTIONS AND ANSWERS DATE: May 13, 2025

BID No.: DOT-ITB-25-9078-SJ

BID Title: Enhancing FDOT Standard Specifications and Construction Guidance with Lange Language Models

OPENING DATE: Wednesday, May 28, 2025 @ 10:00 AM EST

QUESTIONS AND ANSWERS PROVIDED BELOW

Bidders/Proposers must acknowledge receipt of this Questions and Answers Document by completing and returning to the Procurement Office, by no later than the time and date of the bid/proposal opening. Failure to do so may subject the bidder/proposer to disqualification.

Sherill Johnson, Procurement Agent

Bidder/Proposer

Address

Submitted by (Signature)

Failure to file a protest within the time prescribed in Section 120.57(3), Florida Statutes, or failure to post the bond or other security required by law within the time allowed for filing a bond shall constitute a waiver of proceedings under Chapter 120, Florida Statutes.

QUESTIONS AND ANSWERS

Question 1

Could the Department please indicate the planned release date for the Q&A addendum, and—if feasible—adjust the schedule so that proposers have at least ten

(10) business days between the posting of those responses and the proposal submission deadline?

Answer 1 Please see Addendum No. 1 – Revised Timeline attached to the advertisement in the Vendor Information Portal

Question 2 Are vendors permitted to review & redline standard written agreement (page 28 – 41), as part of our RFP submission for the Departments consideration?

Answer 2

No. In submitting a response, the proposer acknowledges they have read and agree to the solicitation terms and conditions which includes the Department’s Standard Written Agreement. Please see Special Condition Section 20 of the solicitation document for additional information.

Question 3 Can the Department please specify the current challenges they want to address with the AI system?

Answer 3

The challenges of the department are: (1)Improving the efficiency of design, review, construction, and inspection processes for construction projects related to codes, specifications, and other methods. (2)Identifying and resolving potential conflicts between different guidelines, specifications, or manuals.(3)Providing engineers, inspectors, and contractors with a tool to quickly find the correct information or point of contact.(4) Implementing AI or Large Language Models into departmental documentation to support future applications and enhancements. and (5) Educating and training department employees in the proper use of AI tools.

Question 4 Can the Department please provide more information on the business and technical users of the AI system?

Answer 4

Since the research focuses on the FDOT Standard Specifications for Road and Bridge Construction, Standard Plans, Handbooks, and Guidebooks, which are publicly available documents, the end goal is to make the results publicly accessible. However, the primary users will be internal employees, consultants, and contractors involved in departmental construction projects.

Additionally, Department wants to insure that any solution complies with FDOT AI Policy. Also to insure there are accuracy (for example minimal hallucination) and timely responses.

Question 5

Task 4 & 5 requires the Principal Investigator to “continue improving, debugging, piloting, monitoring, and managing the system”’ and to submit a “system transfer plan”. Please confirm whether the pilot/prototype AI system itself is part of the scope of this project and an accepted deliverable (beyond the written plan)? If yes, under which task(s) will this software item be accepted?

Answer 5 Yes. The final product of the final developed system will be accepted by Task 6.

Question 6 If system or software deliverables are expected, under which specific task deliverable(s) should vendors include the associated development and hosting costs in the price proposal worksheet?

Answer 6 PI should provide the first prototype AI system for Task 3, along with the corresponding deliverable.

Question 7 As FDOT intends vendors to propose the Anticipated Deliverable Dates in the blank

‘Deliverables Schedule’ table, please confirm that there are no preset milestones other than the overall one-year contract cap. If yes, please specify them.

Answer 7 No. The deliverables must be submitted on time and approved by the Department.

Question 8 Could the Department provide the acceptance criteria that will be used to approve each task deliverable and release payment?

Answer 8 Each deliverable will be reviewed by the Technical Review Committee(TRC). Once the PI addresses the committee's comments and concerns, the Department will release the funds.

Question 9 What target “go-live” date does FDOT envision for the AI assistant to be available to end users?

Answer 9 June 2027.

Question 10 Please describe the existing FDOT infrastructure that will host the system during Task 5.

Answer 10

Task 5 focuses on the transfer and pilot implementation of the AI system within the department. We aim for internal engineers to use the system for various construction projects. There is no specific infrastructure targeted, as usage will depend on the input documents provided.

Without knowing the intended solution/tool, it is more difficult to put specific constraints around targeted infrastructure. For any potential solutions, OIT and Information Security reviews should be included as part of the assessment before a final selection is made.

Question 11 For prototype and evaluation phases (Tasks 1-4), does FDOT have any preferred deployment or guideline vendors must adhere to?

Answer 11

Yes. the system must comply with the Department’s AI Policy. Along with the FDOT AI policy, FDOT development standards and F.A.C. Rule 60GG must also be followed to ensure compliance with all state, federal, and FDOT standards. Appendix II should also be provided in advance to potential solution providers.

More information: Application Development Standards & the attached AI Policy and Appendix II

Please note: Appendix II will become a part of the resulting contract.

Question 12

Could the Department please clarify whether it already holds licenses or subscriptions for any large-language-model (LLM) services, or if the selected vendor will be expected to procure and provide access to a commercial LLM platform as part of this engagement?

Answer 12

The Department is conducting a pilot with Copilot and Llama. Also is looking to extend pilots with Claude, Gemini, and OpenAI on Azure, pending security review. However, Task 1 requires the PI to conduct research on LLM systems used by other agencies. If the PI identifies a more effective LLM platform to achieve the project goals, the Department will evaluate the findings and may consider supporting the PI with a reasonable amendment.

Question 13 Can vendors propose offshore staff or hybrid (mix of on-shore & off-shore) for this project?

Answer 13 Yes, but anticipate Geoblocks from FDOT firewall.

Question 14

In reference to Task 3, Can the Department please provide information on the following:

a. The data volume i.e. approximate number of files, total page count, and/or total data size to be ingested.

https://www.fdot.gov/it/appdevstandards

b. Will documents be accompanied by structured metadata (section numbers, revision dates, effective dates, district applicability) that we can use to improve retrieval accuracy?

c. Are the PDFs natively text-based, or do any contain scanned pages, images, or diagrams that will require OCR?

d. Will vendors need to assist with data cleaning, annotation, or labelling?

Answer 14

a. Based on the estimates, our current specification is approximately 1,400 pages (1 MB), the standard plan is about 740 pages (154 MB), and there are 10 to 20 other manuals from the past 20 years. The project manager estimates the total size could be up to 30 GB or more.

b. Yes

c. Most of them are PDFs and Word documents(includes graphics and tables), but they are not limited to scanned pages and images.

d. No

Question 15

In reference to the performance of LLM, can you please provide the following information?

a. Does the Department have any preference or restrictions regarding Commercial-Off- The-Shelf (COTS) solutions that are built on open-source LLMs versus those that rely on proprietary, vendor-hosted models?

b. What performance benchmarks are expected for the web application (e.g., response latency)?

c. What are the preferred interaction modalities—text, voice, images, or multimodal?

d. Are multilingual capabilities required for input, output, or both?

e. Does FDOT have estimates (or a target range) for concurrent users, daily query volume, and peak-hour load the AI assistant must sustain? This will help compute size, storage, and network resources accurately.

f. The objectives call for measuring “accuracy in citing source materials, frequency of hallucinations, and robustness in use of industry jargon.” Could FDOT please provide any quantitative pass/fail thresholds (e.g., ≥95 % citation precision) that will govern deliverable approval?

Answer 15

a. Not at this time

b. Legitimacy, Consistency, User-Friendly, Response Latency, Availability, Security and Compliance.

c. prefer a multimodal approach, but it can start with text and images.

d. Both

e. Since this is a developing research project, it’s difficult to provide an exact estimate.

However, the questions can be evaluated through Tasks 4 and 5. For the proposal development, the department recommends designing the system to support up to 10,000 concurrent users for high-traffic applications. The AI system should be able to process 50,000 queries per hour at peak load during a 24-hour period. Anticipate Response Time should be : 1-2 seconds.

f. Task 1 “This task will focus on reviewing and documenting existing literature on the use of Artificial Intelligence to summarize content from multiple sources. Common sources of performance errors and best practices in testing of products will be documented.”

Task 4 “PI shall work with the PM and the FDOT specification Office to introduce the system to FDOT districts and conduct the survey with FDOT users through workshops.

The Principal Investigator shall summarize the survey results and provide an improvement for the system.”

The pass/fail thresholds will be determined by survey results or a literature review with TRC approval.

Question 16 In reference to Task 4, how many end users and administrators will need formal training, and in which formats (online, in-person)?

Answer 16 It could be online or in person. We anticipate that each district will have 10 people join, with the maximum number of attendees being 100. FDOT will maintain the ability/right to record for future education.

Question 17 Will FDOT provide a reference Q&A set for Tasks 2-3 evaluation, or must the vendor build it (with SME input)?

Answer 17 No

Question 18 After final acceptance, is any warranty or support period expected beyond ordinary bug fixes before contract close-out?

Answer 18 See Task 5, the Principal Investigator shall continue improving, debugging, piloting, monitoring, and managing the system until the project’s completion.

Question 19 On page 15 of the RFP, it says a performance bond is not required, however on page 43, performance bond is required. Please confirm whether it is required or not & any additional details.

Answer 19 No performance bond is required. Page 43 states if applicable.

Question 20

I was seeking some clarification regarding the RFP especially tasks 4 & 5.

Does the principal investigator develop an app or web tool as a part of these tasks or provide manual and survey on existing COTS AI tools? Does “The AI System” mentioned in these tasks refer to existing COTS AI tools?

Answer 20 Yes

Florida Department of Transportation

RON DESANTIS

GOVERNOR

605 Suwannee Street

Tallahassee, FL 32399-0450

JARED W. PERDUE, P.E.

SECRETARY

www.fdot.gov

POLICY Effective: May 21, 2024 Office: Transportation Technology Topic No. 010-325-065-a

ARTIFICIAL INTELLIGENCE (AI) POLICY

To support the mission and vision of the Florida Department of Transportation (Department), it is the policy of the Department to responsibly, transparently, and ethically use artificial intelligence

(AI) with human accountability.

This policy applies to all Department-related activities, employees, vendors, consultants, and contractors that use, acquire, collect, or develop AI solutions. This policy applies to Machine

Learning, Generative Language Models, and covers all embedded and standalone AI technologies/tools.

The use of AI for Department-related purposes must occur within the following boundaries:

AI must supplement or complement the work that is primarily accomplished by a human.

AI usage must engage humans throughout the process, with human involvement in reviews and decisions. Humans are fully responsible for the work and products involving

AI.

AI systems and decision-making processes must be ethical and comply with all applicable laws, rules, regulations, and policies.

AI systems and decision-making processes must be transparent and disclose if the products are generated partially or fully by an AI tool.

AI systems must protect people’s privacy and comply with all applicable data protection regulations.

AI systems must protect information that is exempt from public disclosure pursuant to

Florida’s public records laws, and must comply with all applicable data protection laws, rules, regulations, and policies.

AI data and the output from all AI-related models must be validated by humans to ensure

AI data and its output are free of personally identifiable information and to prevent copyright infringement and other legal challenges.

To ensure the quality and the security of the Department’s data and IT systems, employees, vendors, consultants, and contractors are prohibited from attempting to gain access to AI applications not approved by the Department when using Department’s systems, networks, computers, phones, or other communication devices, when conducting business under contract for the Department, or when using the Department’s data.

DocuSign Envelope ID: 65DBA19D-4B1B-4D2C-BC55-50E4B1A445D5

Florida Department of Transportation

RON DESANTIS

GOVERNOR

605 Suwannee Street

Tallahassee, FL 32399-0450

JARED W. PERDUE, P.E.

SECRETARY

www.fdot.gov

This AI Policy will be integrated into the Department’s internal manuals, guidelines and related documents governing the Department’s projects, including planning, designing, construction and operation of transportation facilities, as appropriate.

Jared W. Perdue, P.E., Secretary

DocuSign Envelope ID: 65DBA19D-4B1B-4D2C-BC55-50E4B1A445D5

STATE OF FLORIDA DEPARTMENT OF TRANSPORTATION

Appendix II

INFORMATION TECHNOLOGY RESOURCES

375-040-29

PROCUREMENT

08/23

Agreement (Purchase Order) #:

CHAPTER 60GG-1, F.A.C. – INFORMATION TECHNOLOGY PROJECT MANAGEMENT AND

OVERSIGHT STANDARDS

Governed by the Department of Management Services’ Florida Digital Service (FL[DS]), Chapter 60GG-1, Florida Administrative Code (F.A.C.), Florida Information Technology Project Management and Oversight Standards, establishes project management principles that State Agencies are required to follow when implementing information technology projects. the Department must adhere to the State project management standards and ensure that all project documentation created by the Vendor, the Department, or in collaboration, is developed and maintained in accordance with Chapter 60GG-1 F.A.C. The Vendor must be familiar with the State project management standards and be prepared to satisfy all requirements. It is important for the Vendor to recognize that documentation, monitoring, or reporting requirements may change mid-project, based on the project’s FL[DS] Risk and Complexity Assessment, outlined in 60GG-

1.002. The Vendor must be adaptable to changes required by Chapter 60GG-1 F.A.C., without increasing cost to the Department.

CHAPTER 60GG-2, F.A.C. – FLORIDA CYBERSECURITY STANDARDS

Governed by the Department of Management Services’ Florida Digital Service, Chapter 60GG-2 F.A.C., Information Technology Security, also known as the Florida Cybersecurity Standards (FCS), establishes cybersecurity standards for information technology (IT) resources.

State Agencies are required to follow these standards in the management and operations of state IT resources. The Department must adhere to the Florida Cybersecurity Standards for all IT projects created by the Vendor, Department, or in collaboration. The Vendor must be familiar with the State cybersecurity standards and be prepared to work with the Department to satisfy all requirements.

CHAPTER 60GG-2.002, F.A.C. SYSTEM SECURITY PLANS

In support of the Florida Cybersecurity Standards, 60GG-2 F.A.C. Section 60GG-2.002, F.A.C., the Department requires that all IT systems have a system security plan (SSP). The SSP must address the security setup of the system, ensuring that security controls required by Section 60GG-2.003(5)(g)(4), F.A.C., are in place. The SSP must be submitted by the Vendor and approved by the Department Information Security Manager (ISM) prior to system implementation. The SSP must be completed using the SSP template made available from the Department ISM. The SSP must be submitted during the System Design/Configuration phase to allow time for changes in the security design that may be required. Upon receipt of the SSP, the Department will have ten (10) business days to review. The ISM will respond with feedback, approval, or denial of the plan. The Vendor must allow time for adjustments to the plan and resubmittal to the ISM. After the SSP is approved, the Vendor shall keep the SSP updated as necessary or upon notification by the Department of a deficiency in the SSP. Any change to the SSP must be reviewed by the Department and approved by the ISM.

CHAPTER 60GG-2.002, F.A.C. BACKGROUND CHECKS FOR VENDOR STAFF

Florida Department of Transportation (Department) requires Vendor employees working on systems identified by the Department with a risk factor of moderate or higher to undergo an FBI Level II background check. The Vendor will pay the cost of their employee background checks. The Vendor will utilize the Department’s Originating Agency Identifier (ORI). Contract employees must successfully pass the Level II background check before beginning work on the project.

CHAPTER 60GG-2.002, F.A.C. RISK ASSESSMENTS

The Vendor that operates as a service provider agrees to perform a third-party risk assessment on vendor owned resources that contain Department information. The assessment will follow the schedule below, and create a risk mitigation plan that assigns risk levels and proposed controls. A Plan of Action and Milestones will be shared and communicated with the Department as risk is mitigated. An annual Attestation or Certification from a third-party assessment, or report or proof of certification such as but not limited to a System and Organization Controls (SOC) 2, International Organization for Standardization (ISO) 27001, etc. will be accepted in place of a third-party risk assessment.

Assessment categorization established as per Federal Information Processing Standards (FIPS) 199 Publication standards:

1. High – will be completed every 12 months

2. Moderate – will be completed every 18 months

3. Low – will be completed every 24 months

CHAPTER 60GG-2.005, F.A.C. SECURITY INCIDENT RESPONSE

The Vendor agrees to provide a security incident response plan, which will be added as an addendum to the Department’s overall security incident response plan. The Vendor’s plan shall outline specific actions, response time frames, and roles and responsibilities. The Vendor agrees to align its services with the Department by monitoring and responding to security incidents of Department data and information according to section 282.318, F.S.

In the event of a security incident or breach that involves Department data or IT assets, the Vendor shall within 24 hours of discovery notify the Department’s Information Security Manager (ISM) at ISM@dot.state.fl.us. In addition, the Vendor shall:

1. Take prompt corrective action to cure the incident, and any action pertinent to unauthorized disclosure required by applicable federal and state laws/regulations.

DOT-RFP-25-9078-SJ

https://www.flrules.org/gateway/ChapterHome.asp?Chapter=60GG-1 https://www.flrules.org/gateway/ChapterHome.asp?Chapter=60GG-2 mailto:ISM@dot.state.fl.us

PROCUREMENT OFFICE

2. To the extent known, the Vendor shall provide daily status updates by 5pm EST to the ISM.

3. Vendor updates will continue until notified by the Department’s ISM and will include:

a. The nature of the unauthorized use or disclosure

b. Any confidential information used or disclosed

c. Who made the unauthorized use or received the unauthorized disclosure

d. What the Vendor has done or shall do to mitigate any deleterious effect of the unauthorized use or disclosure

e. What corrective action the Vendor has taken or shall take to prevent future similar unauthorized use or disclosure

4. When notification of affected persons is required under section 501.171, F.S., the Vendor shall provide such notification, but only after the Department’s written approval of the contents of the notice.

CHAPTER 60GG-4, F.A.C. – Cloud Computing For all Agreements utilizing cloud computing, the Vendor will provide demonstrated protections to ensure that systems provisioned in the cloud are appropriately secure and performant, appropriate to the workload and data hosted, and ultimately ensure the availability, integrity and confidentiality of Department’s data and resources. These protections shall be documented in the Agreement.

Location and Portability of Data:

All data will be geographically located within the continental United States. Remote access to data, other than open data, from outside the United States is prohibited, unless approved in writing by the agency head or designee. The Department maintains data ownership and the Vendor will ensure portability to allow for the transfer of data from one cloud service to another. The portability method will be dependent upon data transfer requirements documented in the Agreement. The portability method shall be through an approved extract, transform, and load (ETL) process or, via an industry common electronic format using standard Application Programming Interface (API). The Vendor will clearly document its data egress charge model as part of any response to a solicitation for services.

Disentanglement Services:

If this Agreement is terminated for convenience or default or upon the Agreement completion date or expiration of the Agreement term or any extensions thereof, the Vendor shall cooperate with the Department to facilitate an effective and efficient transition to the Department’s selected successor for the Services. In the event of such Agreement termination, completion, or expiration, Vendor shall:

a. Provide Disentanglement Services for up to one (1) year from the date of termination, completion, or expiration. Unless otherwise agreed to by the Department in writing, the Vendor’s Payment Schedule, and Price Proposal, including labor rates identified in the Price Proposal, shall apply to all transition Work.

b. Make all operational records, documents, data, Systems, and facilities required to maintain day-to-day Operations of the Services being rendered under this Agreement available before the date of such termination, suspension, or expiration.

c. Make all other records, documents, data, and Software which is licensed to the Department and pertaining to the Services rendered for this Agreement available within thirty (30) Calendar Days upon written notice or as otherwise provided in the executed License Agreement.

d. Provide all staff necessary to facilitate transition and succession.

e. Make all necessary provisions for transferring any leases or sub-leases held by the Vendor to the Department, including without limitation, all keys, security codes and other facility access information or devices.

f. Make all necessary provisions for securing, providing, and/or granting Software licenses, to continue Operations.

Service Level Agreement (SLA) Requirements:

The Vendor’s cloud computing availability, performance, and response shall be measured and reported against Service Metrics developed by the Department. “Service Level Agreement” is the collective set of minimum standards for technology performance as set forth in the Agreement. The Department will identify applicable Service Level requirements, with associated penalties/consequences and include them in the Agreement. The Vendor shall:

a. Implement and utilize its current measurement and monitoring methods, tools, and procedures to track and report Vendor’s cloud computing availability, performance, and response in delivering the Hosting and Environment Services relative to the applicable Service Levels and shall produce a monthly written report to the Department.

b. If the Vendor’s cloud computing availability, performance, and/or response falls below the identified SLAs, the Department will be entitled to specified service penalties/financial consequences, as set forth in the Agreement.

CHAPTER 60GG-5, F.A.C. – Enterprise Architecture To document compliance with the State of Florida Enterprise Architecture: Transforming the Way Florida Purchases and Manages State Technology Resources (EA Document), all new Departmental technology procurements exceeding $195,000 must include the Form FL[DS]-01, Technology Initiative Management Form (FL[DS]-01) and comply with associated requirements.

Prior to the Scheduled Implementation Date for the IT Resource:

The following FL[DS]-01 Domains and associated deliverables must be completed and submitted to FL[DS] prior to implementing the IT resource, in accordance with paragraphs (6) and (7) of Rule 60GG-5.002, F.A.C:

1. Security Domain Deliverables, which include creating and maintaining:

a. A Security Testing deliverable, to include the performance of testing and results demonstrating that the IT resource is secure. Testing includes, but is not limited to:

i. Vulnerability Scanning;

ii. Security Scanning;

iii. Penetration Testing; and

iv. Risk Assessment.

2. Data Domain Deliverables, which include:

a. Complete submittal of applicable datasets to FL[DS], along with associated metadata and business terms; and

b. Data Management Plan that describes the lifecycle of the applicable Data that is collected and managed from collection through archival.

3. Infrastructure Domain Deliverables, which require the following:

a. A visual diagram of the IT resource’s physical and software assets, including where the current and proposed IT resource are located and how the assets are connected;

b. Documentation of applicable development, test, and production environment;

c. Documentation of the IP addresses, URLs, domain names, certificates, and domain provider(s) used to publicly identify an online interface; and

d. Disaster recovery plan that is operational, functional, and regularly validated and identifies a strategy for processing critical applications during a major hardware or software failure, outage, or the destruction of infrastructure.

4. Testing Domain Deliverables, completing the following:

a. Testing Environment is included in the Infrastructure Diagram, and is a replica of the Production Environment;

b. User guide that provides instruction on the use of the IT resource;

c. Training plan to ensure all user groups receive the necessary training to use the application/system;

d. User Acceptance Test results to demonstrate that the application/system solves the Use Case(s) and fulfills business requirements;

e. Service Level Agreement is established detailing the following:

i. The vendor’s requirement to meet an uptime percentage of 99.999%; and

ii. The applicable financial consequences to be imposed for failure to meet the established uptime.

f. For applications/systems that support more than 10,000 users, there must be documentation of Load Test results. The Load Test results must show the maximum number of connections and transactions supported by the application/system without degradation; and

g. Code Review documentation to identify potential Security defects.

SOFTWARE BILL OF MATERIALS (SBOM)

A Software Bill of Materials or “SBOM” is a formal record containing the details and supply chain relationships of various components used in building software. Many commercial off-the-shelf (COTS) software products are created by assembling existing open source and commercial software components. The purpose of the SBOM is to identify these components within a product. An SBOM is useful to those who develop or manufacture software, those who select or purchase software, and those who operate software. An SBOM allows the software developer to ensure the components are up to date and able to respond quickly to new vulnerabilities. Vendors providing software as part of this Agreement shall incorporate a widely used, machine-readable SBOM format, which will allow for greater benefits through automation and tool integration. The Department will use the SBOM to perform vulnerability or license analysis, both of which will be used to evaluate risk in a product. The use of an SBOM provides the Department with a valuable tool to understand the supply chain of software, analyze known vulnerabilities, and manage risk.

COMPUTER HARDWARE/SOFTWARE LIABILITY

In any Agreement for the purchase or maintenance of machines or computer hardware/software or licensed programs, the Vendor's entire liability and the Department's exclusive remedy for damages to the Department related to the machine or computer hardware/software or licensed program which is the subject of this Agreement, or maintenance thereof shall be limited to, at the Department's discretion, 1) the correction by the Vendor of the relevant defect(s); or 2) actual damages up to the greater of an amount equal to 12 months maintenance charges for said product or the purchase price of said product. Such maintenance charges will be those in effect for the specific product when the cause of action arose. The foregoing limitation of liability will not apply to (a) the payment of cost and damage awards resulting from liability in accordance with the Copyright or Patent Infringement paragraph below, or to (b) claims for reprocurement costs or the cost of cover pursuant to Rule 60A-1.006, Florida Administrative Code, or to (c) claims by the Department for personal injury or damage to real property or tangible personal property caused by the Vendor's negligence or tortious conduct.

CONFIDENTIAL INFORMATION

Trade secrets are not solicited or desired as submissions with responses. Respondents are advised to submit a redacted version of the quote if the Vendor deems any portion of the documents, data or records submitted in response to this solicitation to be confidential, trade secret or otherwise not subject to disclosure pursuant to Florida Statutes (F.S.), the Florida Constitution or other authority. Any confidential or trade secret submission must be conspicuously marked as such, and any redacted copy must be clearly titled “Proprietary and Confidential.” Failure to provide a redacted version when confidentiality is claimed by the Vendor may be cause for determination of non-conformance.

CONFLICT OF INTEREST

To prevent any bias, unfair competitive advantage, conflict of interest, or the appearance of any type of impropriety, Vendor personnel must not have been directly or indirectly involved in the development of the Scope of Services or related solicitation documentation by the Department. If Vendor personnel worked in conjunction with the Department on the development of the solicitation document, the Vendor is prohibited from submitting a bid for this solicitation. Vendor personnel assigned to other Department projects outside this Contract, shall hold and maintain any confidential information that could benefit the Vendor on future solicitations in strictest confidence. As a condition of the Agreement, the Department may require contracted personnel to sign a nondisclosure agreement. Violation of the non-disclosure agreement by contracted personnel may result in termination of the individual, and at the Department’s discretion, disqualification of the Vendor from future solicitations.

COPYRIGHT OR PATENT INFRINGEMENT

To the extent permitted by Florida Law, the Vendor, without exception, shall save, defend and hold harmless the Department and its employees from liability of any nature or kind, including cost and expenses, for or on account of any copyrighted, patented or unpatented invention, process, or article manufactured or supplied by the Vendor. The Vendor has no liability when such claim is solely and exclusively due to the combination, operation or use of articles supplied hereunder with equipment or data not supplied by Vendor or is based solely and exclusively upon the Department's alteration of the article. The Department will provide prompt written notification of a claim of copyright or patent infringement. Further, if such claim is made or is pending, the Vendor may, at its option and expense, procure for the Department the right to continued use of, or replace or modify the article to render it non-infringing. If the Vendor uses any design, device, or materials covered by letters, patent or copyright, it is mutually agreed and understood that, without exception, the Agreement price shall include all royalties or other costs arising from the use of such design, device, or materials in any way involved in the work. Copyrighted material will be accepted, as part of a technical Quote, only if accompanied by a waiver that will allow the Department to make paper and electronic copies necessary for use by the Department staff and agents. It is noted that copyrighted material is not exempt from the Public Records Law, Chapter 119, F.S. Therefore, such material will be subject to viewing by the public.

DATA SECURITY AND CONFIDENTIALITY

The Vendor and its employees must comply with all Department security procedures while working on this Agreement. The Vendor shall provide immediate notice to the Department-OIT Application Services Manager and the Department – Transportation Technology Office (TTO) Information Security Manager (ISM) in the event it becomes aware of any security breach, any unauthorized transmission of State Data as described below or of any allegation or suspected violation of the Department security procedures. Except as required by law or legal process and after notice to the Department, the Vendor shall not divulge to third parties any confidential information obtained by the Vendor or its agents, distributors, resellers, subcontractors, officers or employees in the course of performing Agreement work, including, but not limited to, Chapter 60GG-2, F.A.C., security procedures, business operations information, or commercial proprietary information in the possession of the state and/or the Department.

a. Loss of Data In the event of loss of any Department or State data or record where such loss is due to the negligence of the Vendor or any of its subcontractors or agents, the Vendor shall be responsible for recreating such lost data in the manner and on the schedule set by the Department at the Vendor’s sole expense.

b. Data Protection No state data or information will be transmitted to, stored in, processed in, or shipped to offshore locations or out of the United States of America, regardless of method, except as required by law. Examples of these methods include (but are not limited to):

FTP transfer, DVD, tape, or drive shipping; regardless of level of encryption employed. Access to State Data shall only be available to approved and authorized staff, including remote/offshore personnel, that have a legitimate business need.

DELIVERABLE WARRANTY

Vendor warrants that all Deliverables provided by Vendor shall comply with the form, content, performance, and functionality specified in the Scope or each applicable TWO. If at any time within the Warranty Period, the Department discovers that a Deliverable does not comply with this Warranty, the Vendor shall, at no cost to the Department and in a timely manner, make such Deliverable conform and comply with this Warranty.

Each Deliverable and any other work product provided by Vendor in performing the Services, does not and will not infringe and is not and will not misappropriate or infringe the intellectual property rights, privacy rights or other rights of any other person or entity, nor has any claim of such infringement been threatened or asserted, nor is such a claim pending against Vendor (or to the best of Vendor’s knowledge, any entity from which Vendor has obtained such Deliverable, Work Product, or rights related thereto.

ELECTRONIC ACCESSIBILITY

The Federal Electronic and Information Technology standard can be found at: https://www.section508.gov/. The Department standards set for section 508 compliance information for the supplies and services in this Agreement are available on the Department Standards and Guidance Set website.

ESCROW OF SOURCE CODE

The Vendor shall maintain in escrow a copy of the source code for the licensed software. With each new release of the software provided to the Department, the Vendor shall maintain the updated source code in escrow. In the event the Vendor files for bankruptcy or ceases operations for any reason, the Department shall promptly be provided the current source code in escrow. The Department will only use the source code to support the licensed software subject to the same nondisclosure provisions of this Agreement.

FACILITIES AND EQUIPMENT

Upon completion of Security Awareness Training by the Vendor’s personnel assigned to this project, the Department shall provide necessary access to the Department network. The work will be conducted on-site in the Tallahassee Project Office. The Project will provide work space to use while on site. All property furnished by the Department for use by the Vendor during this Agreement will remain the property of the State of Florida.

GUIDELINES AND STANDARDS

The Vendor agrees to comply with the Department’s best practices and standards, including, but not limited to, the most current version available on the Department Standards and Guidelines Set website.

OWNERSHIP OF WORKS AND INVENTIONS

The Vendor agrees that the Department will have full ownership of any works of authorship, inventions, improvements, ideas, data, processes, computer software programs, and discoveries (hereafter called intellectual property) conceived, created, or furnished under this Agreement, with no rights of ownership in Vendor or any subcontractors. Vendor and subcontractors shall fully and promptly disclose to the Department all intellectual property conceived, created, or furnished under this Agreement. Vendor or subcontractor hereby assigns to the Department the sole and exclusive right, title, and interest in and to all intellectual property conceived, created, or furnished under this Agreement, without further consideration. This Agreement operates as an irrevocable assignment by Vendor and subcontractors to the Department of the copyright in any intellectual property created, published, or furnished to the Department under this Agreement, including all rights thereunder in perpetuity. Vendor and subcontractors shall not patent any intellectual property conceived, created, or furnished under this Agreement. Vendor and subcontractors agree to execute and deliver all necessary documents requested by the Department to affect the assignment of intellectual property to the Department or the registration or confirmation of the Department’s rights in or to intellectual property under the terms of this Agreement. Vendor agrees to include this provision in all its subcontracts under this Agreement.

The Vendor agrees that all work materials developed or provided by the Vendor under this Agreement and any prior agreement between the parties will be deemed to be work made for hire and owned exclusively by the State of Florida. The Vendor agrees that any intellectual property contained in a Deliverable and developed as a result of this Agreement will be the sole property of the State of Florida. This provision will survive the termination or expiration of the Agreement. The Vendor retains all ownership rights in any proprietary methodologies, methods, processes, ideas, concepts, algorithms, trade secrets, software documentation, other intellectual property, or procedures of the Vendor that pre-exist or were developed outside the scope of this Agreement. If any such property of Vendor is contained in any of the Deliverables hereunder, the Vendor grants to the Department a royalty-free, paid-up, non-exclusive, perpetual license to use such Vendor intellectual property in connection with the Department’s use of the Deliverables.

PROJECT PLAN SCOPE LANGUAGE

The Department requires that the Vendor create and submit a Project Plan that demonstrates how the creation and maintenance of the application will be carried out. The Project Plan template may be found at https://www.fdot.gov/it/docs/dispFiles.shtm, and is the template which the Department requires the Vendor to follow. The Project Plan must be submitted to the Department within thirty (30) business days after execution of Agreement or as indicated in the Scope of Work. Upon receipt of the Project Plan, the Department will have fourteen (14) business days to review and approve the Project Plan in its sole discretion. No other work may begin prior to the submission and approval of the Project Plan. After the Project Plan is approved, the Vendor shall keep the Project Plan updated as necessary or upon notification by the Department of a deficiency in the Project Plan. Any change to the Project Plan must be approved by the Department.

Purchase of Tangible Personal Property Contractual services that provide for the Vendor to purchase tangible personal property, as defined in Section 273.02, F.S., for subsequent transfer to the Department may be entered into only in accordance with Rule 60A-1.017, F.A.C. Technology products (e.g., software, networking equipment, etc.) purchased by the Vendor shall be subsequently transferred to the Department and shall be of first quality, supplied by the original product manufacturer or an authorized reseller, and warrantied as appropriate. Technology products procured by the Contractor outside of authorized distributors/retailers are not deemed acceptable to the Department. The Agreement shall specify the quality of the technology products to be acquired, and provisions for warranty, service, and mandatory transfer of ownership to the Department.

https://www.section508.gov/ http://www.fdot.gov/it/AppDevDocsAndGuidelines.shtm

SECURITY OF CONFIDENTIAL PERSONAL INFORMATION

The Vendor must implement procedures to ensure the protection and confidentiality of all data, files, and records involved with this Agreement.

Except as necessary to fulfill the terms of this Agreement and with the permission of the Department, Vendor and Vendor’s employees shall not divulge to third parties any confidential information obtained by Vendor or its agents, distributors, resellers, subcontractors, officers, or employees in the course of performing work on this Agreement, including, but not limited to, security procedures, business operations information, or commercial proprietary information in the possession of the State or the Department. If Vendor or Vendor’s employees have access to confidential information in order to fulfill Vendor’s obligations under this Agreement, Vendor agrees to abide by all applicable Department Information Technology Security procedures and policies. For purposes of this Agreement, “Security Incident” means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of Department information in Vendor’s possession. Vendor shall make a report to the Department not more than seven (7) business days after Vendor learns of such use or disclosure.

Vendor’s report shall identify, to the extent known: (i) the nature of the unauthorized use or disclosure, (ii) the confidential information used or disclosed, (iii) who made the unauthorized use or received the unauthorized disclosure, (iv) what Vendor has done or shall do to mitigate any deleterious effect of the unauthorized use or disclosure, and (v) what corrective action Vendor has taken or shall take to prevent future similar unauthorized use or disclosure.

In the event a “Security Incident” also includes a “breach of security”, as defined by section 501.171, F.S., as amended, concerning confidential personal information involved with this Agreement, Vendor shall comply with section 501.171, F.S. When notification to affected persons is required under this section of the statute, Vendor shall provide that notification, but only after receipt of the Department’s approval of the contents of the notice. Defined statutorily, and for purposes of this Agreement, “breach of security” or “breach” means the unauthorized access of data in electronic form containing personal information.

THIRD PARTY TOOLS

Vendors may not use third-party tools which impose licensing responsibility on the Department without written approval by the Department.

TRAINING

The Vendor shall provide, at its own expense, training necessary for keeping Vendor staff abreast of industry advances and for maintaining proficiency in equipment and systems that are available on the commercial market.

http://www.leg.state.fl.us/STATUTES/index.cfm?App_mode=Display_Statute&Search_String=&URL=0500-0599/0501/Sections/0501.171.html