ADDENDUM NO. 1

07/31/2026

RFP 758 26000000509

This addendum provides for:

Addition of:

• Attachment H – Commonwealth Response to Vendors Questions

Revision to:

• Section 3.1.1 D. Technical Requirements

• Section 10.11 Payment

• Attachment E Mandatory Requirements Checklist

Commonwealth of Kentucky Request for Proposal (RFP)

For KETS Network Products and Services

RFP 758 2600000509

Release Date: July 13, 2026 CLOSING DATE AND TIME August 14, 2026, at 3:30pm ET

Issued by

The Finance and Administration Cabinet

Commonwealth Buyer:

Dianne Lee NIGP-CPP, CPPB, KCPM

Statewide Procurement Analyst II

COMMONWEALTH OF KENTUCKY

FINANCE AND ADMINISTRATION CABINET

Office of Procurement Services 200 Mero Street, 5th Floor

Frankfort, KY 40622

(502) 782-0799

Dianne.Lee@ky.gov

TABLE OF CONTENTS

Proposal Submission Checklist Section 1 – Summary Section 2 – Introduction Section 3 – Scope of Work Section 4 – Commonwealth Office of Technology Requirements Section 5 – Procurement Requirements and Instructions Section 6 – Proposal Submission Section 7 – Proposal Evaluation Section 8 – Negotiations Section 9 – Contract Requirements Section 10 – Standard Terms and Conditions Section 11 – Attachments

PROPOSAL SUBMISSION CHECKLIST

The vendor MUST include the following with the proposal submission.

If the items highlighted below are not submitted with the proposal submission, the Commonwealth MUST deem the proposal non-responsive and SHALL NOT consider for award.

All other items MUST be submitted prior to award.

• *PROPOSED TECHNICAL SOLUTION

• *PROPOSED COST SOLUTION

• TRANSMITTAL LETTER [see Section 6.7(A)]

• REVENUE FORM 10A100 KENTUCKY TAX REGISTRATION APPLICATION IF

APPLICABLE [see Section 6.7 (C)],

• CERTIFICATE OF AUTHORITY- REGISTRATION WITH SECRETARY OF

STATE BY A FOREIGN ENTITY IF APPLICABLE [see Section 6.7 (D)]

• REQUIRED ANNUAL AFFIDAVIT AND OTHER AFFIDAVIT(S)

https://finance.ky.gov/office-of-the-secretary/FinanceForms/Annual%20Required%20Affidavit%20for%20Bidders%2 0Offerors%20and%20Contractors.pdf

• ATTACHMENT E – MANDATORY REQUIREMENTS CHECKLIST Revised

7/31/2026 https://finance.ky.gov/office-of-the-secretary/FinanceForms/Annual%20Required%20Affidavit%20for%20Bidders%20Offerors%20and%20Contractors.pdf https://finance.ky.gov/office-of-the-secretary/FinanceForms/Annual%20Required%20Affidavit%20for%20Bidders%20Offerors%20and%20Contractors.pdf https://finance.ky.gov/office-of-the-secretary/FinanceForms/Annual%20Required%20Affidavit%20for%20Bidders%20Offerors%20and%20Contractors.pdf

SECTION 1 - RFP SUMMARY

1.1 Estimated Schedule of RFP Activities

The following table presents the anticipated schedule for major activities associated with the RFP distribution, proposal submission, proposal evaluation process, and contract award. The Commonwealth reserves the right at its sole discretion to change the Schedule of Activities, including the associated dates and times.

Anticipated Schedule of Activities

Release of RFP

July 13, 2026

Vendors’ Written Questions due by 12:00 PM ET

(SUBMIT QUESTIONS ON ATTACHMENT D-VENDORS’ QUESTION

FORM)

July 21, 2026

Commonwealth’s Response to Vendors’ Written Questions July 31, 2026 Proposals due by 3:30 PM ET August 14, 2026

1.2 Issuing Office

The Commonwealth of Kentucky, Finance and Administration Cabinet, Office of Procurement Services, is issuing this RFP on behalf of the Kentucky Department of Education (KDE), which includes Kentucky K-12 Public School Districts, KSB, KSD, and KDE, the agency. The Finance and Administration Cabinet is the only office authorized to change, modify, amend, alter, or clarify the specifications, terms and conditions of this RFP.

A contract, based on this RFP, may or may not be awarded. Any contract award from this RFP is invalid until properly approved and executed by the Finance and Administration Cabinet.

1.3 Agencies to Be Served

This contract shall be for use by the Kentucky Department of Education. No shipments shall be made except upon receipt by vendor of an official delivery order from the using agency.

Extending the Contract Use to Other Agencies The Office of Procurement Services reserves the right, with the consent of the vendor, to offer the Master Agreement resulting from this solicitation to other state agencies requiring the product(s) or service(s).

SECTION 2 - INTRODUCTION

2.1 Purpose

The purpose of this Request for Proposal (RFP) is to solicit proposals for competitive negotiations pursuant to 200 KAR 5:307. The Office of Procurement Services issues this Solicitation on behalf of the Kentucky Department of Education (KDE) to establish up to five (5) Master Agreements for Kentucky Education Technology System (KETS) Network Products & Services. Contracts resulting from this solicitation will provide E-Rate eligible purchasing vehicles for network products and services for KY Department of Education, KY’s Public School Districts, the KY School of the Blind (KSB), and the KY School for the Deaf (KSD) - currently 175 sites in total. This Contract is expected to be effective on the award date so as to be eligible for E-Rate applications covering the purchases of products and services beginning July 1, 2027.

2.2 Background

The Kentucky Department of Education (KDE), Office of Education Technology (OET) is located in Frankfort, Kentucky and provides Education Technology services to the Commonwealth’s public school districts, Area Technology Centers (ATC), the Kentucky School for the Blind (KSB), and the Kentucky School for the Deaf (KSD). Further information about KY public schools can be found at https://openhouse.education.ky.gov.

As mandated by KRS 156.670, a plan related to purchasing, developing and using technology to accomplish specific purposes in Kentucky's public school systems must be developed and must cover at least a five-year period. This plan, known as the KETS Master Plan for Education Technology, was originally adopted by the State Board for Elementary and Secondary Education in May 1992. The Master Plan is updated every six (6) years and identifies (a) things we already do well that we want to continue doing well over the next six (6) years, (b) areas to improve upon, and (c) emerging items likely to occur that need to be accounted for by this Master Plan. The studies, research, standards, governance and technology needs for the state and districts that play a critical role in executing the Master Plan are also identified. The Master Plan for Education Technology is located on the KDE Web site at:

https://www.education.ky.gov/districts/tech/Pages/KETS-2024-2030-KETS- Master-Plan.aspx

This plan for technology is consistent with the underlying tenets of the Kentucky Education Reform Act, which addresses the need to ensure baseline equitable access to and pricing of education technology by establishing standards for the type of technology within each school. This means equity in price and support response for a school no matter how wealthy/poor, big/small or its location (rural/urban).

https://openhouse.education.ky.gov/ https://www.education.ky.gov/districts/tech/Pages/KETS-2024-2030-KETS-Master-Plan.aspx https://www.education.ky.gov/districts/tech/Pages/KETS-2024-2030-KETS-Master-Plan.aspx

KETS has established and maintains architectural design and configuration standards to ensure enhancement, maximization and security of the education technology environment in Kentucky. Any technology procured or secured by a district, in a category for which a KETS technology need standard is established, regardless of whether the item is used to reduce the technology need or not, must meet or exceed the KETS standard in compliance with 701 KAR 5:110.

SECTION 3 – SCOPE OF WORK

PROPOSALS THAT DO NOT MEET MANDATORY REQUIREMENTS WILL BE

DEEMED NON-RESPONSIVE AND WILL NOT BE CONSIDERED. REFER TO

ATTACHMENT E – MANDATORY REQUIREMENTS CHECKLIST – Revised 7/31/2026.

Mandatory Requirement means a condition set out in the specifications or statement of work that must be met without exception.”

3.1 Scope of Work/Technical Requirements

This contract covers the purchasing or leasing of hardware and services for Network Infrastructure. These include management software for ease of operations, management, and monitoring of network performance, functionality, and security; warranties; services of installations; services for maintenance of ongoing programs and technical help. For contractual definitions refer to Attachment F – Contractual Definitions (OEM Held Network Contract).

Managed Internal Broadband Services (MIBS) For the purposes of the E-Rate program, The Federal Communications Commission (FCC), via the Universal Service Administrative Company (USAC), has determined that some of the features of networking equipment and hardware such as monitoring‚ automation‚ analytics‚ and optimization that are built in or native to the networking equipment hardware itself may constitute services which fall under the Managed Internal Broadband Services (MIBS) category of service.

For the purposes of this Request for Proposal (RFP) the Kentucky Department of Education (KDE) has identified the following distinctions: MIBS Functionality and MIBS Services.

1. MIBS Functionality (Integrated Device Capabilities – Included in this RFP)

MIBS Functionality refers to built-in‚ embedded capabilities in network devices for the purposes of management‚ monitoring‚ automation‚ or optimization‚ with such capabilities being effectively out-of-the-box or intrinsic capabilities․ All proposed solutions, including any user-facing interfaces, dashboards, or management platforms, shall comply with accessibility requirements defined in 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) and the World Wide Web Consortium’s (W3C) Web

Content Accessibility Guidelines (WCAG) 2.0, conformance level Double-A or greater.

Functions such as these include‚ but are not limited to:

a. Performance monitoring and telemetry

b. Automated configuration or optimization features

c. AI-powered insights or anomaly detection

d. Embedded analytics and reporting

Such functionality is considered to exist within the network equipment if

a. It comes pre-installed with the device

b. Does not need the use of third-party management services

c. It does not depend on any separately contracted managed services

2. MIBS Services (Device-independent Third Party Service – Not included in this

RFP)

MIBS Services are a line of continuing network management services provided by a third-party Vendor․

a. Network monitoring and alerting

b. Configuration management

c. Performance tuning and optimization

d. Incident response and remediation

e. Reporting and operational support

These services:

a. Extend beyond device-level functionality

b. Typically provided as subscription or contractual services

c. Are directly established between a school district and a service provider

This RFP seeks a pricing and purchasing vehicle for E-Rate eligible devices with MIBS Functionality. It does not seek MIBS Services. Contract awardees and their selected resellers may offer MIBS Services to districts in response to district requests for quote, however, districts are required to conduct their own full E-Rate competitive bidding process (including filing their own FCC Form 470) in order for these services to be eligible for E-Rate support.

Where applicable, in response to school district E-Rate mini-bid requests for quote, Vendors must identify the percentage of functionality deemed by USAC to fall under both the Internal Connections and the Managed Internal Broadband Services categories. In cases in which a product performs both Internal Connections and MIBS functions, but USAC has not determined the percentage “split” between Internal Connections and MIBS, Vendors shall provide a “best estimate” based on the overall functionality of the product when it is operated in a typical school network environment. Additionally, Vendors shall identify whether or not the MIBS product functionality is performed by Artificial Intelligence (AI).

3.1.1 Technical Requirements

A. Qualified Vendor:

A Qualified Vendor is an original equipment manufacturer (OEM) of enterprise level network solutions that meet or exceed all technical specifications outlined in this solicitation. A manufacturer must bid direct and may not bid through a manufacturer-authorized reseller. Each (OEM) will be allowed to submit one (1) bid only.

After the award, the manufacturer may propose the use of up to three (3) agents/resellers. The Kentucky Department of Education reserves the right to review and give final approval to the proposed agents/resellers and/or any change in agents/resellers after the initial contract award. The manufacturer is still responsible for ALL aspects of the contract requirements regardless of the usage of an agent(s)/reseller(s). A manufacturer SHALL NOT be allowed to have more than three (3) agents/resellers.

Agent/resellers selected by contract holders shall agree to submit a signed ATTACHMENT G KETS Network Products and Services Reseller Agreement form signifying agreement and compliance with the terms and conditions of the contract, including, but not limited to:

a. Eligibility and good standing to provide services under the federal E-Rate program

b. Meeting or exceeding the minimum discount off MSRP established by the

OEM under contract

c. Obtaining OEM sign-off on all responses to E-Rate mini-bid requests for quote from KY school districts

d. Naming and assigning specific personnel to support roles (E-Rate, technical, sales, warranty, etc.) and

e. Quotes must indicate the length of time for which they are valid

f. Providing sales and activity data to the OEM contract holder at a minimum on a quarterly basis and as directed by Office of Education Technology

(OET)

The vendor shall provide the KETS Network Products and Services Reseller Agreement to KDE for review at the initiation and at the renewal of contracts as needed based on input and feedback.

Changes to the assignment of resellers by contract holders will be limited to April 1 through September 30 of each calendar year, thereby ensuring continuity of providers during the typical E-Rate “application season”.

Exceptions to this must be pre-approved by OET.

For this solicitation and resulting contract(s), an agent/reseller is defined as a company or individual that represents the manufacturer in quotes for products and/or services, purchase order review, delivery and/or warranty and support services of the manufacturer’s product(s). Quotes for products and/or service shall be on the letterhead of the entity presenting the quote. All financial documentation including quotes and invoices shall be issued by the OEM or agent/reseller responsible for delivering products and/or services.

Contract holders shall provide a link to an active list of KETS and E-Rate eligible products and services available under resulting contract(s) which includes current MSRP. This link will be referenced and made available on the appropriate page of the KDE Website where these contracts and product standards are identified.

B. Categories:

Vendor and all those working on behalf of the Vendor who holds the contract must comply with all requirements established under the E-Rate program, and the Vendor shall maintain and provide a link to an updated price list that clearly identifies KETS and E-Rate eligible products and services which includes current MSRP. Vendor shall clearly distinguish between E-rate eligible and non E-Rate eligible components. This contract is the mechanism by which Kentucky public school districts and the Kentucky Department of Education purchase (or lease) and maintain network products and associated services. These products and services may be hardware or software-based and ensure effective delivery of network traffic across the customers’ Network Infrastructure (Local Area Network (LAN) and Wide Area Network (WAN). These offerings may be a combination of products and services that are on customer premises or provider/cloud hosted. These offerings might also include subscription-based services.

The type of products may include (but are not necessarily limited to):

A. E-Rate Eligible Basic Services:

a. Switches (Wired L2 and L3)

b. Routers

c. Wireless Access Points

d. Wireless Controllers (physical or virtual)

e. Cables/Accessories (including related components used for internal broadband connections)

f. Basic Firewalls

g. SD-WAN (hardware with MIBS functionality)

h. Software Licenses (right-to-use, client access)

i. Installation/Initial Configuration

j. Training (On-site in conjunction with installation/initial configuration)

k. Basic Maintenance Support for Hardware and/or Software

B. Non-E-Rate Eligible Basic Services

a. Network Access Control

b. Network Software (Management, Security and/or Analytics)

c. Network Professional Services

d. Network Accessories

e. Wireless – Configuration Software

f. Technician/System Admin Training (off-site, advanced)

g. Advanced Firewall

h. LAN/WAN Edge Devices (3rd party)

i. Security-related enhancements

j. Network Monitoring

k. Traffic Logging, Reporting and/or Analysis.

C. Single Point of Contact:

It is crucial to have a dedicated account team with which to form a partnership.

This working partnership affords the Vendor (OEM) insight into how KDE and K-12 public school districts operate. Vendor shall provide an account team that includes, but is not limited to, a sales account representative that is also the Single Point of Contact (SPOC), pre-sales engineer, and a post-sales support level staff to serve the needs of the K-12 customers. Vendor shall name the assigned person that will be the single point of contact (SPOC) for contract issues. Vendor shall ensure that this person and all salespersons of their product will be knowledgeable in:

a. All the details of the KETS contract including the mini-bid process.

b. The KY public school, district office, and KDE customer base

c. The most current KETS Master Plan on our KDE web site and year round current events in KETS

d. Federal E-Rate program and provide assistance to KDE or K-12 public school districts in completing their annual E-Rate filing.

The SPOC must be proactive in sharing information or presenting a point of view with the selling staff and the manufacturer(s) of the KETS products.

Each reseller shall provide an account team that includes, but is not limited to, a sales account representative that is also the Single Point of Contact (SPOC), pre-sales engineer, and a post-sales support level staff to serve the needs of the K-12 customers. In addition, each Reseller shall provide a single email address for all E-Rate related correspondence, including but not limited to mini-bid requests, BEAR form assistance, bulk up load assistance, etc This mailbox should be monitored by multiple people connected to the Reseller.

KETS customers shall notify the OET Vendor Manager when Vendors fail to meet the requirements of the contract. The OET Vendor Manager will work directly with the SPOC to remedy the issue and work with KDE staff and Vendor escalation points of contact to escalate issues as needed.

Upon contract award, Vendor shall provide a description of a copy of procedures for requesting escalation, complaint resolution and identify the staff available for installations, billing problems, etc. Vendor shall provide updated information annually at a minimum.

D. Deliverables:

1. Deliverables, Penalty and Penalty Waiver:

All deliveries of equipment shall be provided within thirty (30) calendar days of the Vendor’s receipt of the purchase order from the customer, unless otherwise requested by the purchasing agency in writing. Delivery is defined as the receipt of goods and completion of installation, if required.

Customers purchasing from contracts resulting from this solicitation shall have thirty (30) calendar days from the date the customer receives a complete order to notify the Vendor of any issues with the order (i.e. missing or damaged parts).

Vendor may consider the order accepted by the customer after the close of the thirty (30) calendar day window.

2. Deliverables Penalties:

Vendor shall agree when delivery and/or installation is not made within the contracted timeframes, one percent (1%) per day from the total invoice amount may be deducted from the Vendor’s invoice for each day the Vendor fails to meet the contracted timeframe. Penalties will continue to be charged to the Vendor until the delivery and installation, if applicable, is complete.

3. Deliverables Penalty Waiver:

Vendor shall not be penalized if within the thirty (30) day delivery period, they have supplied OET and the customer with a written notice indicating the particular model ordered is not available in inventory anymore and a newer different model will be shipped in its place. In this case, the Vendor at the request of KDE/OET shall submit the new model to KDE/OET for evaluation testing. The new model shall not be shipped to the customer until which time the model has been added to the KETS contract. The Vendor shall not use this penalty waiver to notify customers falsely with intentions to stall and send the same unit originally ordered. This conduct may result in termination of contract.

Once the Vendor receives notification, their new model is now available for sales; the thirty (30) day clock starts again.

E. Leasing

Leasing should be made available as an option to KETS customers. Leasing agreements shall meet all legal requirements for the Commonwealth and KDE.

Vendor shall quote hardware warranty coverage for the duration of the lease period. If the lease exceeds threshold of $100,000 then the lease must be approved by KDE before the lease can be approved. Below is a link to the guidelines and regulations regarding leases;

https://www.education.ky.gov/districts/tech/Pages/District%20Lease.aspx https://www.education.ky.gov/districts/tech/Pages/District%20Lease.aspx

F. Warranty:

Vendor shall agree to include one (1) year of Primary Service Coverage Timeframe (PSCT) for maintenance/warranty in the initial purchase cost. After the initial one (1) year period, if hardware maintenance is desired, it will be the responsibility of the customer to procure from either this contract or other approved sources.

1. Primary Service Coverage Timeframe maintenance/warranty shall meet the following criteria:

a. The KETS customer’s PSCT falls between the hours of 7:30 am and

5:00 pm customer’s local time, Monday - Friday, excluding state observed holidays;

b. The Vendor shall be available to provide warranty service during the

PSCT.

c. Vendor shall respond within four (4) business hours to begin the diagnostics/fault determination. Vendor should perform all fault determination.

d. Next business day onsite response. Onsite is defined that the Vendor goes to the location of the equipment purchased, e.g. a school district office, state agency, etc. Vendor shall come on-site to install any replacement parts or perform repair work, so the network equipment is operational three

(3) business days of the initial call.

e. All technicians shall be properly certified and or licensed to service network hardware;

f. Perform diagnostics and repair remotely if applicable versus onsite response with the customer’s prior approval.

g. Replacement parts shall be new or reconditioned, and of equal or better quality than original parts;

h. There shall be no charge for any shipping and handling of parts or labor charges for troubles or issues with the equipment;

i. Vendor shall ensure any optional -- year two and beyond PSCT coverage, or the Extended Service Coverage Timeframe – maintenance/warranty cost is the same throughout the state.

j. Vendor shall perform a backup on all devices that have backup capability prior to making hardware or software changes;

k. Vendor shall be provided access to the customer’s building where the network equipment is located as required to fulfill customer service requests.

2. Optional Extended Service Coverage Timeframe (ESCT) coverage up to 24 x 7 shall be available if purchased;

a. Vendor shall provide a pricing option for Extended Service Coverage Timeframe (ESCT) to be added to the PSCT one (1) year maintenance/warranty included with the initial purchase of the hardware.

b. Vendor shall ensure any optional ESCT maintenance/warranty cost is the same throughout the state.

c. Vendor shall call and/or email customer back within one clock (1) hour of customer placing call to begin the diagnostics/fault determination and provide applicable information including ticket number;

d. Vendor goes onsite to the location of the equipment purchased, e.g. a school district office, state agency, etc. Vendor shall come on-site to install any replacement parts or perform repair work so the network equipment is operational within twenty-four (24) clock hours (one (1) business day) of the initial call.

3. Optional Post-PSCT Maintenance/Warranty (Year Two and Beyond)

a. Vendors may offer optional maintenance and warranty support services for periods beyond the PSCT one (1) year maintenance/warranty.

b. If optional post– PSCT maintenance/warranty is purchased, the Vendor shall provide separate, itemized pricing for post-PSCT warranty support:

i. Identify pricing per device, per system, or per site, as applicable

ii. Ensure pricing is clearly distinguishable from eligible equipment costs

iii. Post-PSCT maintenance/warranty service levels shall:

a. At minimum, match PSCT service levels

b. Allow customers to select alternative service levels (e.g., Extended Service Coverage Timeframe)

c. Customers may:

i. Renew annually

ii. Upgrade/change service level

iii. Decline continued maintenance/warranty

4. Optional Multi-Year Maintenance/Warranty

Vendors may provide optional multi-year maintenance/warranty pricing (e.g.,3-year or 5-year terms), provided:

a. Such options are not bundled into base equipment cost

b. All pricing is separately identified

c. Selection is at the customer’s discretion

d. At a minimum matches PSCT service levels

G. Sales Reporting:

Vendor shall maintain accurate records indicating sales from the KETS contract. Quarterly sales and warranty data shall be reported as directed by KETS Contract Management and shall contain, at a minimum, the following fields: date of invoice, PO #, customer name, item manufacturing part number, Item serial number, item description (must include model name and number), type of product, unit list price, quantity, total list price, total discounted price, discount off MSRP (percentage), and applicable reseller name if resellers are utilized for the contract.

Vendor shall prepare and submit electronically this information no later than ten

(10) business days after the end of each quarter to the KETS Contract Management at ketscontractmgmt@education.ky.gov. The Vendor SPOC shall submit quarterly sales reports. The vendor shall not rely on KDE for reminders to submit reports. It is the responsibility of OET to report any failure to submit and/or late submissions of sales reports on the annual contract review.

H. Services Requirements:

The Vendor shall provide a comprehensive list of Services offered under this RFP. Rates shall be clearly tied to the scope of work required for each services engagement.

Engagement Requirements: Any services engagement initiated under this contract shall require mutual written acceptance between the Vendor and the Agency/District including agreement on:

1. The detailed scope of work

2. Required resources and/or materials

3. Estimated timeframe for completion

4. Final deliverables

No work shall commence until both parties have approved the engagement in writing.

mailto:ketscontractmgmt@education.ky.gov

3.2 Value Added Services

Value-added services may be added to the contract with the prior approval by the Commonwealth Office of Technology and the Office of Procurement Services Buyer of Record. Upon approval, a formal modification will be made to add the service(s). No work shall begin until a contract modification is completed and notice provided by the OPS Buyer that work may begin.

SECTION 4 – COMMONWEALTH OFFICE OF TECHNOLOGY (COT)

REQUIREMENTS

4.1 Commonwealth Information Technology Policies and Standards

A. The Vendor and any subcontractors shall be required to adhere to applicable Commonwealth policies and standards.

B. The Commonwealth posts changes to COT Standards and Policies on its Commonwealth Office of Technology - Home - Commonwealth Office of Technology (Kentucky) website. Vendors and subcontractors shall ensure their solution(s) shall work in concert with all posted changes. Vendors or subcontractors that cannot comply with changes must, within thirty (30) days of the posted change, request written relief with the justification for such relief. The Commonwealth may: 1) deny the request, 2) approve an exception to the policy/standard, or 3) consider scope changes to the contract to accommodate required changes. Vendors or subcontractors that do not provide the response within the thirty (30) day period shall be required to comply within ninety (90) days of the change.

C. Vendor shall comply with Section 10.31 regarding Artificial Intelligence

4.2 Compliance with Industry Accepted Reporting Standards Based on Trust Service Principles and Criteria The Vendor must employ comprehensive risk and threat management controls based on defined industry standards for service organizations such as AICPA TSP section 100, Trust Services Principles and Criteria. The Vendor must annually assert compliance and engage a third party to examine such assertions and, controls to provide a Report, such as AT101 SOC 2 type 2, on Controls at a Service Organization Relevant to Security, Availability, Processing, Integrity, Confidentiality, and Privacy, which contains an opinion on whether the operating controls effectively support the assertions. All such reports, including publicly available reports (i.e. AT 101 SOC 3) shall be made available to the Commonwealth for review.

4.3 System Vulnerability and Security Assessments

The Commonwealth reserves the right to conduct, in collaboration with the Vendor, non-invasive vulnerability and security assessments of the software and infrastructure used to provide services prior to implementation and periodically https://technology.ky.gov/Pages/index.aspx https://technology.ky.gov/Pages/index.aspx thereafter. Upon completion of these assessments, the Commonwealth will communicate any findings to the Vendor for action. Any cost relating to the alleviation of the findings will be the responsibility of the Vendor. Mitigations will be subject to re-evaluation after completion. In cases where direct mitigation cannot be achieved, the Vendor shall communicate this and work closely with the Commonwealth to identify acceptable compensating controls that will reduce risk to an acceptable and agreed upon level. An accredited third party source may be selected by the Vendor to address findings, provided they will acknowledge all cost and provide valid documentation of mitigation strategies in an agreed upon timeframe.

4.4 Privacy Assessments

The Commonwealth reserves the right to conduct Privacy assessments of the collection, use, maintenance and sharing of Commonwealth data by any Vendor services, software, and infrastructure used to provide services prior to implementation and periodically thereafter. Upon completion of this assessment, the Commonwealth will communicate any findings to the Vendor for action. Any cost relating to the alleviation of the findings will be the responsibility of the Vendor.

Mitigations will be subject to re-evaluation after completion. In cases where direct mitigation cannot be achieved, the Vendor shall communicate this and work closely with the Commonwealth to identify acceptable compensating controls or privacy practices that will reduce risk to an acceptable and agreed upon level. An accredited third party source may be selected by the Vendor to address findings, provided they will acknowledge all cost and provide valid documentation of mitigation strategies in an agreed upon timeframe.

4.5 Privacy, Confidentiality and Ownership of Information

The Commonwealth is the designated owner of all Commonwealth data and shall approve all access to that data. The Vendor shall not have ownership of Commonwealth data at any time. The Vendor shall not profit from or share Commonwealth data. The Vendor shall be in compliance with privacy policies established by governmental agencies or by state or federal law. Privacy notice statements may be developed and amended from time to time by the Commonwealth and will be appropriately displayed on the Commonwealth portal (Ky.gov). The Vendor should provide sufficient security to protect the Commonwealth and COT data in network transit, storage, and cache. All Commonwealth data, including backups and archives, must be maintained at all times within the contiguous United States. All Commonwealth data, classified as sensitive or higher, as defined in Enterprise Standards, must be encrypted in-transit and at rest.

4.6 EU GDPR Compliance

The Commonwealth of Kentucky requires all Vendor contracts to comply with the European Union’s General Data Privacy Regulation [Regulation (EU) 2016/679] (the “GDPR”) when the Commonwealth is a “controller” or “processor” of “personal data” from an individual “data subject” located in the European Union, as those terms are defined in the GDPR. The Contractor acknowledges and agrees that it is acting as a “processor” of “personal data” for the Commonwealth under this Agreement and that all applicable requirements of the GDPR are incorporated by reference as material terms of this Agreement. The Contractor represents and warrants that (1) it is aware of and understands its compliance obligations as a “processor” under GDPR; (2) it has adopted a GDPR compliance policy/program, a copy of which has been provided to the Commonwealth; (3) it will process “personal data” only in accordance with the Commonwealth’s instructions; and (4) with regard to its obligations under this Agreement, it shall comply with all applicable requirements of the GDPR to the same extent as adopted by the Commonwealth. Additionally, the Contractor shall indemnify and hold harmless the Commonwealth, and its employees from and against any claims, demands, suits, damages, penalties, fines, or costs arising from any violation of GDPR by the Contractor.

4.7 Data Quality

The vendor shall provide proposed levels of data quality per the following dimensions.

Data Quality is the degree to which data is valid, accurate, complete, unique, timely, consistent with all requirements and business rules, and relevant for a given use. The vendor shall provide data quality definitions and metrics for any data elements. Data has to be of the appropriate quality to address the needs of the Commonwealth of Kentucky. The following dimensions can be used to assess data quality:

• Validity – The data values are in an acceptable format.

• Accuracy – The data attribute is accurate.

• Completeness – There are no null values in a data field.

• Uniqueness – There are no duplicate values in a data field.

• Timeliness – The data attribute represents information that is not out-of-date.

• Consistency – The data attribute is consistent with a business rule that may be based on that attribute itself, or on multiple attributes.

• Adherence to business rules – The data attribute or a combination of data attributes adheres to specified business rules.

4.8 License Agreements

Any proposed software agreements, i.e. license agreement, subscription agreement, end-user license agreement, etc. shall include the following language, or similar, and must be submitted to the Commonwealth Office of Technology (COT) for review and approval prior to the award of the contract:

“Governing Law shall be the Commonwealth of Kentucky, Franklin County. All terms of the vendor/subvendor agreement/EULA shall be read as applicable only to the extent permitted by Kentucky law and no term in violation of the Kentucky law, inclusive of Kentucky Procurement Law, shall be given effect.”

Any third-party software licenses and cloud resources necessary for the proposed solution may be procured via the Commonwealth’s existing contracts.

4.9 Software Version Requirements

All commercially supported and Commonwealth approved software components such as operating system (OS), Database software, Application software, Web Server software, Middle Tier software, and other ancillary software must be kept current. In the event that a patch interferes with the solution, the Vendor must present a plan for compliance to the Commonwealth outlining the constraints and an appropriate plan of action to bring the solution into compliance to allow this patch to be applied in the shortest timeframe possible, not to exceed three months, unless otherwise negotiated with the Commonwealth.

4.10 No Surreptitious Code Warranty

The contractor represents and warrants that no copy of licensed Software provided to the Commonwealth contains or will contain any Self-Help Code or any Unauthorized Code as defined below. This warranty is referred to in this contract as the "No Surreptitious Code Warranty”. As used in this contract, "Self-Help Code" means any back door, time bomb, drop-dead device, or other software routine designed to disable a computer program automatically with the passage of time or under the positive control of a person other than the license of the software. Self- Help Code does not include Software routines in a computer program, if any, designed to permit an owner of the computer program (or other person acting by authority of the owner) to obtain access to a licensee's computer system(s) (e.g.

remote access) for purposes of maintenance or technical support. As used in this contract, "Unauthorized Code" means any virus, Trojan horse, spyware, worm or other Software routines or components designed to permit unauthorized access to disable, erase, or otherwise harm software, equipment, or data; or to perform any other such actions. The term Unauthorized Code does not include Self-Help Code.

In addition, contractor will use up-to-date commercial virus detection software to detect and remove any viruses from any software prior to delivering it to the Commonwealth. The Vendor shall defend the Commonwealth against any claim, and indemnify the Commonwealth against any loss or expense arising out of any breach of the No Surreptitious Code Warranty.

4.11 Network Connection Requirements

A. Vendor shall work with KDE and/or all Kentucky public schools to establish any network connections. If a secure site-to-site connection is required, the Vendor shall employ a secure site-to-site connection procured by KDE.

B. Vendor shall notify KDE and/or all Kentucky public schools of network bandwidth requirements and if caching is required for implementation Vendor shall resolve caching requirements, in coordination with KDE.

C. Vendor shall, at KDE’s discretion, provide appropriate access to enable the Commonwealth to perform additional security measures, such as decryption of the network traffic if required for inspection. If the proposed solution does not have the ability to meet this requirement, the Vendor must provide an alternative such as audit reporting of this function.

D. Vendor shall provide notifications to the KDE Customer Service Center and/or applicable local school district service for unplanned outages within 5 minutes.

E. Vendor shall notify KDE Change Management and/or applicable local school district, through the KDE Customer Service Center and/or applicable local school district, a minimum of two (2) business days prior to any planned outage.

4.12 Applicable Security Control Framework Compliance

The Vendor must have an awareness and understanding of the NIST Special Publication 800-53 Security Control Framework and employ safeguards that meet or exceed the moderate level controls as defined within the standard. The respondent must provide sufficient safeguards to provide reasonable protections around the Commonwealth’s data to ensure that the confidentiality, integrity, and availability is maintained at an appropriate level. These include but are not limited to:

• Access Control The Vendor must employ policy and process that provide for stringent control to limit physical and logical access to systems that house Commonwealth data, on a need to know basis, provide clear separation of duties, and adheres to least privilege principles.

• Awareness and Training The Vendor must provide the appropriate role specific training for staff to ensure that there is awareness and understanding of roles and responsibilities as they relate to the protections around the Commonwealth’s data.

• Audit and Accountability There must be sufficient auditing capability to ensure that actions are tracked and there is individual accountability for all actions taken by Vendor staff.

• Configuration Management The Vendor must work within established baselines that provide minimal functionality needed to ensure service delivery without exposing unnecessary risk. The Vendor must also employ structured change control processes that provide a level of coordination with the client agreed upon in a Service Level Agreement (SLA).

• Contingency Planning The Vendor must employ contingent planning policy and procedures that ensure service delivery based on agreed SLA levels while maintaining all Commonwealth data within the continental Unites States.

• Identification and Authorization

The Vendor must employ appropriate identity and access management policies and procedures to ensure that access is appropriately authorized and managed at a level to ensure that access is provisioned and de-provisioned in a timely and efficient manner.

• Incident Response The Vendor must employ policy and procedures to ensure that an appropriate response to all identified security incidents are addressed in a timely manner and are reported to the appropriate parties in an agreed upon SLA timeframe. The Vendor must also ensure that all staff are sufficient trained to ensure that they can identify situations that are classified as security incidents.

• Maintenance The Vendor must employ policy and procedures that ensure that all maintenance activities are conducted only by authorized maintenance staff leveraging only authorized maintenance tools.

• Media Protection The Vendor must employ policy and procedure to ensure that sufficient protections exist to protect Commonwealth data on all storage media throughout the media lifecycle and maintain documentation from media creation through destruction.

• Physical and Environmental Controls The Vendor must employ physical and environmental policies and procedures that ensure that the service and delivery infrastructure are located in a physically secure and environmentally protected environment to ensure the confidentiality, integrity, and availability of Commonwealth data.

• Personnel Security The Vendor must employ policies and procedures to ensure that all staff that have access to systems that house, transmit, or process Commonwealth data have been appropriately vetted and have been through a background check at the time of hire and periodically thereafter.

• System and Communications Protections The Vendor must employ physical and logical protection that protect system communications and communication media from unauthorized access and to ensure adequate physical protections from damage.

4.13 IRS Publication 1075 -Exhibit 7 Safeguarding Contract Language

Publication 1075 (Rev. 11-2021) (irs.gov)

I. PERFORMANCE

In performance of this contract, the Contractor agrees to comply with and assume responsibility for compliance by officers or employees with the following requirements:

(1) All work will be performed under the supervision of the contractor.

https://www.irs.gov/pub/irs-pdf/p1075.pdf

(2) The contractor and contractor’s officers or employees to be authorized access to FTI must meet background check requirements defined in IRS Publication 1075.

The contractor will maintain a list of officers or employees authorized access to FTI. Such list will be provided to the agency and, upon request, to the IRS.

(3) FTI in hardcopy or electronic format shall be used only for the purpose of carrying out the provisions of this contract. FTI in any format shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of this contract. Inspection or disclosure of FTI to anyone other than the contractor or the contractor’s officers or employees authorized is prohibited.

(4) FTI will be accounted for upon receipt and properly stored before, during, and after processing. In addition, any related output and products require the same level of protection as required for the source material.

(5) The contractor will certify that FTI processed during the performance of this contract will be completely purged from all physical and electronic data storage with no output to be retained by the contractor at the time the work is completed.

If immediate purging of physical and electronic data storage is not possible, the contractor will certify that any FTI in physical or electronic storage will remain safeguarded to prevent unauthorized disclosures.

(6) Any spoilage or any intermediate hard copy printout that may result during the processing of FTI will be given to the agency. When this is not possible, the contractor will be responsible for the destruction of the spoilage or any intermediate hard copy printouts and will provide the agency with a statement containing the date of destruction, description of material destroyed, and the destruction method.

(7) All computer systems receiving, processing, storing, or transmitting FTI must meet the requirements in IRS Publication 1075. To meet functional and assurance requirements, the security features of the environment must provide for the managerial, operational, and technical controls. All security features must be available and activated to protect against unauthorized use of and access to FTI.

(8) No work involving FTI furnished under this contract will be subcontracted without the prior written approval of the IRS.

(9) Contractor will ensure that the terms of FTI safeguards described herein are included, without modification, in any approved subcontract for work involving FTI.

(10) To the extent the terms, provisions, duties, requirements, and obligations of this contract apply to performing services with FTI, the contractor shall assume toward the subcontractor all obligations, duties and responsibilities that the agency under this contract assumes toward the contractor, and the subcontractor shall assume toward the contractor all the same obligations, duties and responsibilities which the contractor assumes toward the agency under this contract.

(11) In addition to the subcontractor’s obligations and duties under an approved subcontract, the terms and conditions of this contract apply to the subcontractor, and the subcontractor is bound and obligated to the contractor hereunder by the same terms and conditions by which the contractor is bound and obligated to the agency under this contract.

(12) For purposes of this contract, the term “contractor” includes any officer or employee of the contractor with access to or who uses FTI, and the term “subcontractor” includes any officer or employee of the subcontractor with access to or who uses FTI.

(13) The agency will have the right to void the contract if the contractor fails to meet the terms of FTI safeguards described herein.

II. CRIMINAL/CIVIL SANCTIONS

(1) Each officer or employee of a contractor to whom FTI is or may be disclosed shall be notified in writing that FTI disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any FTI for a purpose not authorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution.

(2) Each officer or employee of a contractor to whom FTI is or may be accessible shall be notified in writing that FTI accessible to such officer or employee may be accessed only for a purpose and to the extent authorized herein, and that access/inspection of FTI without an official need-to-know for a purpose not authorized herein constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution.

(3) Each officer or employee of a contractor to whom FTI is or may be disclosed shall be notified in writing that any such unauthorized access, inspection or disclosure of FTI may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each unauthorized access, inspection, or disclosure, or the sum of actual damages sustained as a result of such unauthorized access, inspection, or disclosure, plus in the case of a willful unauthorized access, inspection, or disclosure or an unauthorized access/inspection or disclosure which is the result of gross negligence, punitive damages, plus the cost of the action. These penalties are prescribed by IRC sections 7213, 7213A and 7431 and set forth at 26 CFR 301.6103(n)-1.

(3) Additionally, it is incumbent upon the contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material…