Addendum Three - Attachment A - Terms and Conditions - RFP 758 2400000439-4.pdf

ADDENDUM #3 (June 27, 2024) RFP 758 2400000439-4

• Addition of Attachment I – Commonwealth’s Response to 2nd set of Vendor Questions

• Revision to Attachment B – Cost Proposal Form 06272024

• Revision to Section 1.1 – Estimated Schedule of RFP Activities

• Revision to Section 3.5 – (s)(u)(v)(w)(x)(y)(aa) – Experience

• Revision to Section 3.6 – (B) - Microsoft Solutions Partner

• Revision to Section 3.8 – Value Added Services

• Revision to Section 6.8 (A) – Proposed Solution Content Revision to Section 6.8 (F) – Value Added Services (optional-this will not be scored)

ADDENDUM #2 (June 14, 2024) RFP 758 2400000439-3

• Addition of Attachment H – Commonwealth’s Response to 1st set of Vendor Questions

• Revision to Section 1.1 Estimated Schedule of RFP Activities

• Revision to Attachment G - Microsoft Support Services – Enterprise Coverage (Category 2) Requirements – RFP 758 2400000439 06142024

ADDENDUM #1 (June 10, 2024) RFP 758 2400000439-2

• Revision to Section 1.1 Estimated Schedule of RFP Activities

This is a Re-Solicitation of RFP 758 2400000235 which closed on March 22, 2024, and was not awarded. Because an award was not made, documents requested via an Open Records Request will not be released. At such time an award is made as a result of the new RFP, an Open Records Request may be filed and documents requested for the original RFP as well as for the new RFP may be released in accordance with KRS

61.870 to 61.884.

ATTACHMENT A

Commonwealth of Kentucky Request for Proposal (RFP)

For Microsoft Support Services

RFP 758 2400000439

Release Date: May 24, 2024

CLOSING DATE AND TIME: July 19, 2024 at 3:30pm ET July 12, 2024, at 3:30pm ET June 25, 2024, at 3:30pm ET

Issued by

The Finance and Administration Cabinet On Behalf Of

Commonwealth Office of Technology (COT)

Commonwealth Buyer:

Susan S. Noland, KCPM

Division Director

COMMONWEALTH OF KENTUCKY

FINANCE AND ADMINISTRATION CABINET

Office of Procurement Services

200 Mero Street, 5th Floor

FRANKFORT KY 40622

(502) 564-5951 Susan.Noland@ky.gov

TABLE OF CONTENTS

Proposal Submission Checklist Section 1 – Summary Section 2 – Introduction Section 3 – Scope of Work Section 4 – Commonwealth Office of Technology Requirements Section 5 – Procurement Requirements and Instructions Section 6 – Proposal Submission Section 7 – Proposal Evaluation Section 8 – Negotiations Section 9 – Contract Requirements Section 10 – Standard Terms and Conditions Section 11 – Attachments mailto:Susan.Noland@ky.gov

PROPOSAL SUBMISSION CHECKLIST

The vendor MUST include the following with the proposal submission.

If the items highlighted below are not submitted with the proposal submission, the Commonwealth MUST deem the proposal non-responsive and SHALL NOT consider for award.

All other items MUST be submitted prior to award.

*PROPOSED TECHNICAL SOLUTION

*PROPOSED COST SOLUTION

MANDATORY REQUIREMENTS CHECKLIST [see Attachment F]

TRANSMITTAL LETTER [see Section 6.7(A)]

REVENUE FORM 10A100 KENTUCKY TAX REGISTRATION APPLICATION IF

APPLICABLE (see Section 6.7 (C)], CERTIFICATE OF AUTHORITY- REGISTRATION WITH SECRETARY OF STATE BY

A FOREIGN ENTITY IF APPLICABLE [see Section 6.7 (D)]

REQUIRED ANNUAL AFFIDAVIT AND OTHER AFFIDAVIT(S)

https://finance.ky.gov/office-of-the-secretary/FinanceForms/Annual%20Required%20Affidavit%20for%20Bidders%20Offer ors%20and%20Contractors.pdf

EEO FORMS IF APPLICABLE [see Section 10.19]

*Please see Attachment E - The Protection of Personal Information Security and Breach Investigation Procedures and Practice Act (KRS 61.931), et seq.

effective January 1, 2015.

https://finance.ky.gov/office-of-the-secretary/FinanceForms/Annual%20Required%20Affidavit%20for%20Bidders%20Offerors%20and%20Contractors.pdf https://finance.ky.gov/office-of-the-secretary/FinanceForms/Annual%20Required%20Affidavit%20for%20Bidders%20Offerors%20and%20Contractors.pdf https://finance.ky.gov/office-of-the-secretary/FinanceForms/Annual%20Required%20Affidavit%20for%20Bidders%20Offerors%20and%20Contractors.pdf

SECTION 1 - RFP SUMMARY

1.1 Estimated Schedule of RFP Activities

The following table presents the anticipated schedule for major activities associated with the RFP distribution, proposal submission, proposal evaluation process, and contract award. The Commonwealth reserves the right at its sole discretion to change the Schedule of Activities, including the associated dates and times.

Anticipated Schedule of Activities

Release of RFP

May 24, 2024

Vendors’ Written Questions due by 12:00 PM ET

(SUBMIT QUESTIONS ON ATTACHMENT D-VENDORS’ QUESTION

FORM)

June 3, 2024

Commonwealth’s Response to Vendors’ Written Questions

June 14, 2024 June 10, 2024

2nd set of Vendors’ Written Questions due by 12:00 PM ET

(SUBMIT QUESTIONS ON ATTACHMENT D-VENDORS’ QUESTION

FORM)

June 21,2024

Commonwealth’s Response to 2nd set of Vendors’ Written Questions June 27, 2024

Proposals due by 3:30 PM ET

July 19, 2024 July 12, 2024 June 25, 2024

1.2 Issuing Office

The Commonwealth of Kentucky, Finance and Administration Cabinet, Office of Procurement Services, is issuing this RFP on behalf of the Commonwealth Office of Technology (COT). The Finance and Administration Cabinet is the only office authorized to change, modify, amend, alter, or clarify the specifications, terms and conditions of this RFP.

A contract, based on this RFP, may or may not be awarded. Any contract award from this RFP is invalid until properly approved and executed by the Finance and Administration Cabinet.

1.3 Agencies to Be Served

This contract shall be for use by THE COMMONWEALTH OFFICE OF

TECHNOLOGY (COT) ON BEHALF OF ALL STATE AGENCIES. COT

APPROVAL IS REQUIRED FOR ALL EXECUTIVE BRANCH AGENCIES’

REQUESTS. No shipments shall be made except upon receipt by vendor of an official delivery order from the using agency.

Political Subdivisions Under Kentucky Statutes, political subdivisions of this State including cities of all classes, counties, and school districts may participate in All State Agency Master Agreements to the same extent as agencies of the Commonwealth. Approval from COT is not required for non-Executive Branch agencies.

SECTION 2 - INTRODUCTION

2.1 Purpose

The purpose of this Request for Proposal (RFP) is to solicit proposals for competitive negotiations pursuant to 200 KAR 5:307.

The Commonwealth will award contracts in the following two (2) categories:

• Category 1: Microsoft Support Services – Hourly Rate

• Category 2: Microsoft Support Services – Enterprise Coverage

The Commonwealth wishes to enter into up to five (5) contract(s) with vendor(s) that are qualified Microsoft Certified Partners that employ certified professionals to provide Microsoft Support Services – Hourly Rate (Category 1) to the Commonwealth. These services shall be provided statewide.

The Commonwealth also wishes to enter into up to five (5) contract(s) with vendor(s) that are qualified Microsoft Certified Partners that employ certified professionals to provide Microsoft Support Services – Enterprise Coverage (Category 2) to the Commonwealth. These services shall be provided statewide.

Vendors may respond to one (1) or both categories. If responding to both categories, vendors shall submit the response for each category separately and not as a combined response. One (1) response and file per category.

Service utilization must be exclusive to Microsoft environments and the entire Microsoft product suite including business, office, networking, messaging, and application development products for all state agencies. Services shall include, but not limited to, short-term break/fix activities, system health-checks, migration and product adoption initiatives, application tuning exercises, consulting and support. The various components of these service areas may include the hardware, hardware configuration and software related support.

This contract shall not include hardware maintenance.

2.2 Background

In the Commonwealth of Kentucky, the management of information technology is a crucial aspect of ensuring efficient government operations and delivering services to the public. The Commonwealth Office of Technology (COT) plays a central role in overseeing, implementing, and managing large-scale IT platforms, infrastructure, end-user devices, cyber-security, software licensing and enterprise services. Cabinets, agencies, and other state government entities employ IT staff that work alongside COT to plan, implement, enhance, and support IT solutions for their respective organizations. The contract(s) resulting from this RFP will provide a wide range of services required to plan, organize, implement, and support Microsoft product environments.

SECTION 3 – SCOPE OF WORK

PROPOSALS THAT DO NOT MEET MANDATORY REQUIREMENTS WILL BE

DEEMED NON-RESPONSIVE AND WILL NOT BE CONSIDERED. REFER TO

ATTACHMENT F – MANDATORY REQUIREMENTS CHECKLIST.

Mandatory Requirement means “a condition set out in the specifications or statement of work that must be met without exception.”

3.1 Scope of Work

Service utilization must be exclusive to Microsoft environments and encompass the entirety of the Microsoft product suite for all state agencies. The services offered under these contracts shall encompass providing Support, Solutions, and/or Consulting Services.

This contract shall not include hardware maintenance.

The Commonwealth explicitly prohibits and shall not reimburse the vendor(s) for any additional charges, such as travel, lodging, administrative support, etc.

COT reserves the right to require agencies to obtain quotes from awarded vendors.

3.2 Credentials

Vendor(s) shall be a Microsoft Certified Partner. The Commonwealth will verify the Partner level status with the Microsoft Corporation. The vendor(s) shall have over five (5) years as a Microsoft Certified Partner. The vendor(s) must have experience with providing Microsoft Support, Solutioning and/or Consulting Services in large enterprise organizations that employ more than 30,000 staff.

Experience in the government sector is preferred.

3.3 Vendor Staff

A. Staff employed by vendor(s) are required to possess Microsoft certification credentials that correspond to the specific type of service they are providing.

For instance, individuals handling Azure services must carry Azure certifications, those involved in O365 services should hold O365 certifications, staff responsible for data center deployments should have server certifications and personnel engaged in SharePoint services should possess SharePoint certifications.

B. Vendor subject matter experts shall be Microsoft certified and possess substantial experience to deliver prompt and effective solutions.

C. Vendor staff must demonstrate proficiency in technical, analytical, and communication skills, enabling them to operate effectively either independently or within a team setting under the supervision of the utilizing agency. Expertise in secure and complex network environments, as well as IT landscapes, is required and imperative. This includes, but is not limited to, knowledge of TCP/IP, routers, multiple firewall configurations, WAN technology, directory services, office environments, and business applications.

D. All vendor personnel and sub-contractors assigned to the Commonwealth must be resources based in the United States. The utilization of offshore resources is prohibited.

3.4 Support Hours

A. Timely response to problems or inquiries via phone should be within a duration of two (2) hours or less.

B. Operational hours shall adhere to the Commonwealth’s conventional working hours, defined as eight (8) hours a day, five (5) days a week (Monday through Friday). Vendor staff shall be available in accordance with the operational requirements of the utilizing agencies. Standard working hours for the Commonwealth are on weekdays from 8:00 a.m. to 5:00 p.m.

(EST).

C. Given the deployment of Microsoft products in mission-critical scenarios, the Vendor should be capable of addressing emergency needs beyond normal working hours, including nights and weekends. 24x7 emergency support would only be engaged for business continuity in mission critical systems. Examples of mission critical platforms are Active Directory and Microsoft Identity Manager.

3.5 Experience

Vendor(s) should have experience implementing, supporting, and/or consulting including (but not limited to):

a. Microsoft cloud services, such as Azure, Microsoft 365, and Dynamics 365

b. Microsoft Windows Server in a multi-server WAN environment

c. Microsoft Exchange in a multi-server hybrid environment

d. Microsoft SQL Server Enterprise, SQL Server Integration Services (SSIS), SQL Server Reporting Services (SSRS)

e. Microsoft Systems Management Server in a multi-site configuration

f. Microsoft Endpoint Configuration Manager (MECM)

g. Microsoft Autopilot

h. Internet Information Services (IIS)

i. Microsoft Endpoint Manager (Intune)

j. Security, Compliance, and Identity Fundamentals

k. Active Directory Forest and multi-domain environments

l. Active Directory Federated Services (ADFS) and the Threat Management

Gateway

m. Microsoft Identity Manager (MIM)

n. Microsoft Entra ID

o. Modern Work

p. Custom software or application development on Microsoft platforms

q. Power Platform

r. End-client Microsoft products such as Windows Operating Systems, Microsoft Office Suite, Microsoft Edge, Microsoft Teams, Visual Studio

s. Power BI, BizTalk, Project Server, and SharePoint On-Premises Configured in a clustered and/or multi-platform environment

t. Windows Virtual Desktop

u. Licensing Assessments and Optimization (reflective of all Microsoft license platforms/programs - cloud and on premise)

v. Volume Licensing Solutions (reflective of all Microsoft license platforms/programs - cloud and on premise)

w. Cloud Licensing and Subscription Services (reflective of all Microsoft license platforms/programs - cloud and on premise)

x. Software Assurance Planning (reflective of all Microsoft license platforms/programs - cloud and on premise)

y. Billing for cloud solutions (reflective of all Microsoft license platforms/programs - cloud and on premise)

z. Compliance Audits and Risk Mitigation

aa. Strategic planning and consultation services, such as assessment services, annual licensing true-up and renewal, and roadmaps aligned with business goals (365 and all Microsoft products/solutions)

3.6 Services

Vendors shall offer one (1) or more of the following services to be eligible for consideration:

A. Microsoft Support Partner

1. The vendor shall provide support services for the Microsoft technologies listed in Section 3.5(a).

2. Support Partner vendor(s) shall provide technical support, proactive maintenance, migration and upgrade assistance, patch management, performance optimization, security services, custom application support, cloud services support, business continuity and disaster recovery support.

3. The vendor should provide support services on all current Microsoft products and future products as developed and released by Microsoft.

Future products should be supported at time of market release.

4. Support Partners should adhere to the Support Hours outlined in Section 3.4.

5. Support Partners must submit their plan for after-hours support and service level agreements (SLA).

6. Specific tasks to be provided will be negotiated by the agency and Vendor prior to work beginning on each project. However, services provided shall be performed in accordance with the terms and conditions of the contract and the Vendor reimbursement rates shall be equal to or less than the contract rates established via this RFP.

B. Microsoft Solutions Partner

1. The vendor shall provide solutioning services for the Microsoft technologies listed in Section 3.5(a).

2. Solutions Partners shall provide planning and execution of Microsoft implementations, including software deployment and system integrations; custom application development utilizing Microsoft technologies; adoption and migration services to Microsoft Azure cloud services; database design, management and optimization; deploy and customize collaboration tools (Teams, SharePoint); implement and customize solutions such as Dynamics 365; design and implement security solutions based on Microsoft technologies ensuring compliance with regulatory standards; planning and implementing disaster recovery and business continuity strategies.

3. The vendor should provide solutioning services on all current Microsoft products and future products as developed and released by Microsoft.

Future products shall be supported at time of market release.

4. Solutions Partners should adhere to the Support Hours outlined in Section 3.4.

5. Solutions Partners shall define their plan for knowledge transfer and/or ongoing support for solutions proposed and implemented.

6. Specific tasks to be provided will be negotiated by the agency and Vendor prior to work beginning on each project. However, services provided shall be performed in accordance with the terms and

C. Microsoft Consulting Partner

1. The vendor shall provide consulting services for the Microsoft technologies listed in Section 3.5(a).

2. Consulting Partners shall provide services to plan, implement, and optimize Microsoft technologies, including strategic consulting, guidance on aligning Microsoft solutions, with business strategies;

assessment of technology roadmaps and recommendations for digital transformation; provide assistance on compliance and data protection measures.

3. Consulting Partners should adhere to the Support Hours outlined in Section 3.4.

4. Specific tasks to be provided will be negotiated by the agency and Vendor prior to work beginning on each project. However, services provided shall be performed in accordance with the terms and

D. Microsoft Support Services – Enterprise Coverage:

The vendor should provide the services outlined on Revised Attachment G.

An SOW/quote will be requested from the using agency for specific services needed.

3.7 Reporting

Vendor shall submit monthly reports by close of business on the 15th of the month following the reporting period. Reports shall be for all services provided under this contract. The reports shall be in Excel format and submitted via email to the COT Contracting Officer at stephanier.williams@ky.gov. The report should include the following:

a. The Using Agency Name

b. Project Name/Type of Service(s) Being Provided

c. Total Dollar Amount

d. Number of Hours

e. Project Start and End Date

f. Name of Vendor Staff Assigned to Project

3.8 Value Added Services (optional)

Value-added services may be added to the contract with the prior approval of the Commonwealth Office of Technology (COT) and the Office of Procurement Services (OPS) Buyer of Record. Upon approval, a formal modification will be made to add the service(s). No work shall begin until a contract modification is completed and notice provided by the OPS Buyer that work may begin.

Value-added services are extra features that can be offered that are within scope of this RFP. Submission of value-added services proposals for the support and consulting of end-of-life/legacy Microsoft products and platforms are is welcomed as well as any other value-added services. and will be considered as potential value-added services.

SECTION 4 – COMMONWEALTH OFFICE OF TECHNOLOGY (COT)

REQUIREMENTS

4.1 Commonwealth Information Technology Policies and Standards A. The vendor and any subcontractors shall be required to adhere to applicable

Commonwealth policies and standards.

B. The Commonwealth posts changes to COT Standards and Policies on its

Commonwealth Office of Technology - Home - Commonwealth Office of Technology (Kentucky) website. Vendors and subcontractors shall ensure their solution(s) shall work in concert with all posted changes. Vendors or subcontractors that cannot comply with changes must, within thirty (30) days of the posted change, request written relief with the justification for such relief.

The Commonwealth may: 1) deny the request, 2) approve an exception to the mailto:stephanier.williams@ky.gov https://technology.ky.gov/Pages/index.aspx https://technology.ky.gov/Pages/index.aspx policy/standard, or 3) consider scope changes to the contract to accommodate required changes. Vendors or subcontractors that do not provide the response within the thirty (30) day period shall be required to comply within ninety (90) days of the change.

4.2 Compliance with Kentucky Information Technology Standards (KITS)

A. The Kentucky Information Technology Standards (KITS) reflect a set of principles for information, technology, applications, and organization. These standards provide guidelines, policies, directional statements and sets of standards for information technology. It defines, for the Commonwealth, functional and information needs so that technology choices can be made based on business objectives and service delivery. The vendor shall stay knowledgeable and shall provide a solution that works in concert with these standards for all related work resulting from this RFP.

https://technology.ky.gov/about-the-agency/Pages/kits.aspx

B. The vendor and any subcontractors may be required to submit a technology roadmap for any offered solution. Additional roadmaps will be submitted upon request of the Commonwealth. If required, the roadmap shall include, but is not limited to, planned, scheduled and projected product lifecycle dates and historical release/patch or maintenance dates for the technology. In addition, any guidance on projected release/revision/patch/maintenance schedules would be preferred.

4.3 Compliance with Industry Accepted Reporting Standards Based on Trust Service Principles and Criteria The vendor must employ comprehensive risk and threat management controls based on defined industry standards for service organizations such as ISO AICPA TSP section 100, Trust Services Principles and Criteria. The vendor must annually assert compliance and engage a third-party certification registrar to examine such assertions and controls to provide a Report, such as ISO 9000, ISO 14001, AT101 SOC 2 type 2, on Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, and Privacy, which contains an opinion on whether the operating controls effectively support the assertions. All such reports, including publicly available reports (i.e. AT 101 SOC

3) shall be made available to the Commonwealth for review.

4.4 System Vulnerability and Security Assessments

The Commonwealth reserves the right to conduct, in collaboration with the vendor, non-invasive vulnerability and security assessments of the software and infrastructure used to provide services prior to implementation and periodically thereafter. Upon completion of these assessments, the Commonwealth will communicate any findings to the vendor for action. Any cost relating to the alleviation of the findings will be the responsibility of the vendor. Mitigations will be subject to re-evaluation after completion. In cases where direct mitigation cannot be achieved, the vendor shall communicate this and work closely with the https://technology.ky.gov/about-the-agency/Pages/kits.aspx

Commonwealth to identify acceptable compensating controls that will reduce risk to an acceptable and agreed upon level. An accredited third-party source may be selected by the vendor to address findings, provided they will acknowledge all cost and provide valid documentation of mitigation strategies in an agreed upon timeframe.

4.5 Privacy, Confidentiality and Ownership of Information

The Commonwealth is the designated owner of all Commonwealth data and shall approve all access to that data. The vendor shall not have ownership of Commonwealth data at any time. The vendor shall not profit from or share Commonwealth data. The vendor shall be in compliance with privacy policies established by governmental agencies or by state or federal law. Privacy notice statements may be developed and amended from time to time by the Commonwealth and will be appropriately displayed on the Commonwealth portal (Ky.gov). The vendor should provide sufficient security to protect the Commonwealth and COT data in network transit, storage, and cache. All Commonwealth data, including backups and archives, must be maintained at all times within the contiguous United States. All Commonwealth data, classified as sensitive or higher, as defined in Enterprise Standards, must be encrypted in-transit from vendor’s network and at rest while stored on vendor’s laptops or other portable media devices.

4.6 License Agreements

If applicable, any proposed software agreements, i.e. license agreement, subscription agreement, end-user license agreement, etc. shall include the following, or similar, language:

“All terms in this agreement/EULA shall be read as applicable only to the extent permitted by Kentucky law and no term in violation of the Kentucky law, inclusive of Kentucky Procurement Law, shall be given effect.”

If applicable, any third-party software licenses and cloud resources necessary for the proposed solution may be procured via the Commonwealth’s existing contracts.

4.7 Software Version Requirements

All commercially supported and Commonwealth approved software components such as Operating system (OS), Database software, Application software, Web Server software, Middle Tier software, and other ancillary software must be kept current. In the event that a patch interferes with the solution, the vendor must present a plan for compliance to the Commonwealth outlining the constraints and an appropriate plan of action to bring the solution in to compliance to allow this patch to be applied in the shortest timeframe possible, not to exceed three (3) months, unless otherwise negotiated with the Commonwealth.

4.8 No Surreptitious Code Warranty

The vendor represents and warrants that no copy of licensed software provided to the Commonwealth contains or will contain any Self-Help Code or any Unauthorized Code as defined below. This warranty is referred to in this contract as the "No Surreptitious Code Warranty”.

As used in this contract, "Self-Help Code" means any back door, time bomb, drop-dead device, or other software routine designed to disable a computer program automatically with the passage of time or under the positive control of a person other than the licensee of the software. Self-Help Code does not include Software routines in a computer program, if any, designed to permit an owner of the computer program (or other person acting by authority of the owner) to obtain access to a licensee's computer system(s) (e.g. remote access) for purposes of maintenance or technical support.

As used in this contract, "Unauthorized Code" means any malware designed to permit unauthorized access to disable, erase, or otherwise harm software, equipment, or data; or to perform any other such actions. The term Unauthorized Code does not include Self-Help Code.

In addition, vendor will use up-to-date commercial virus detection software to detect and remove any viruses from any software prior to delivering it to the Commonwealth.

The vendor shall defend the Commonwealth against any claim and indemnify the Commonwealth against any loss or expense arising out of any breach of the No Surreptitious Code Warranty.

4.9 Project Governance

Vendor shall work with the agency and appropriate COT offices, when needed, in the cases of data governance, security aspects, hosting, integration, etc., provided that such work does not expand the scope of the services as described in this RFP absent a corresponding change order agreed to by the parties reflecting such expansion.

4.10 Application and Service Requirements

Current Enterprise Applications and Services

1. COT provides a number of Enterprise Shared Services to State agencies.

Vendor shall use published IT Applications and Services provided on KITS for: Enterprise Service Bus, Enterprise Content Management, Data Warehousing, Data Analytics and Reporting, Business Intelligence, Web Services, GIS, unless explicitly approved by COT.

2. Vendor provided dedicated application components (i.e., Application Servers, Databases, etc.) shall comply with KITS or if the technology is not included in KITS, the technology must be accepted by the Commonwealth for inclusion in KITS or granted a written exception to

KITS according to COT Information Technology Standards Policy currently

CIO-051.

3. Vendor applications must describe in detail all available features and functionality accessible via APIs.

4. All business applications must support the ability to use modern authentication for authentication and authorization. Modern authentication technologies would include SAML 2.0, WSFED, OAuth, or OpenID Connect.

4.11 Project Management Requirements

The COT Division of Governance and Strategy (COT-DGS) is responsible for overseeing large and complex technology projects throughout the Commonwealth. The vendor shall adhere to Project Management standards and reporting requirements established by COT-DGS, which are posted at https://technology.ky.gov/services-and-support/Pages/About-the-Project- Management-Branch.aspx. These include, but are not limited to, having a documented project schedule, risk management, issue management and reporting project status to the CIO monthly in the format defined by COT-DGS. In addition to the project management standards required by COT-DGS, agency specific requirements may be defined in this RFP.

4.12 Applicable Security Control Framework Compliance

The vendor must have an awareness and understanding of the NIST Special Publication 800-53 Security Control Framework and employ safeguards that meet or exceed the moderate level controls as defined within the standard. The vendor must provide sufficient safeguards to provide reasonable protections around the Commonwealth’s data to ensure that the confidentiality, integrity, and availability is maintained at an appropriate level. These include but are not limited to:

• Access Control The vendor must employ policy and process that provide for stringent control to limit physical and logical access to systems that house Commonwealth data, on a need to know basis, provide clear separation of duties, and adheres to least privilege principles.

• Awareness and Training The vendor must provide the appropriate role specific training for staff to ensure that there is awareness and understanding of roles and responsibilities as they relate to the protections around the Commonwealth’s data.

• Audit and Accountability There must be sufficient auditing capability to ensure that actions are tracked and there is individual accountability for all actions taken by vendor staff.

• Configuration Management The vendor must work within established baselines that provide minimal functionality needed to ensure service delivery without exposing unnecessary risk. The vendor must also employ structured change control processes that https://technology.ky.gov/services-and-support/Pages/About-the-Project-Management-Branch.aspx https://technology.ky.gov/services-and-support/Pages/About-the-Project-Management-Branch.aspx provide a level of coordination with the client agreed upon in a Service Level Agreement (SLA).

• Contingency Planning The vendor must employ contingent planning policy and procedures that ensure service delivery based on agreed SLA levels while maintaining all Commonwealth data within the continental Unites States.

• Identification and Authorization The vendor must employ appropriate identity and access management policies and procedures to ensure that access is appropriately authorized and managed at a level to ensure that access is provisioned and de-provisioned in a timely and efficient manner.

• Incident Response The vendor must employ policy and procedures to ensure that an appropriate response to all identified security incidents are addressed in a timely manner and are reported to the appropriate parties in an agreed upon SLA timeframe.

The vendor must also ensure that all staff are sufficient trained to ensure that they can identify situations that are classified as security incidents.

• Maintenance The vendor must employ policy and procedures that ensure that all maintenance activities are conducted only by authorized maintenance staff leveraging only authorized maintenance tools.

• Media Protection The vendor must employ policy and procedure to ensure that sufficient protections exist to protect Commonwealth data on all storage media throughout the media lifecycle and maintain documentation from media creation through destruction.

• Physical and Environmental Controls The vendor must employ physical and environmental policies and procedures that ensure that the service and delivery infrastructure are located in a physically secure and environmentally protected environment to ensure the confidentiality, integrity, and availability of Commonwealth data.

• Personnel Security The vendor must employ policies and procedures to ensure that all staff that have access to systems that house, transmit, or process Commonwealth data have been appropriately vetted and have been through a background check at the time of hire and periodically thereafter.

• System and Communications Protections The vendor must employ physical and logical protection that protect system communications and communication media from unauthorized access and to ensure adequate physical protections from damage.

4.13 IRS Publication 1075 -Exhibit 7 Safeguarding Contract Language

Publication 1075 (Rev. 11-2021) (irs.gov)

I. PERFORMANCE

https://www.irs.gov/pub/irs-pdf/p1075.pdf

In performance of this contract, the Contractor agrees to comply with and assume responsibility for compliance by officers or employees with the following requirements:

(1) All work will be performed under the supervision of the contractor.

(2) The contractor and contractor’s officers or employees to be authorized access to FTI must meet background check requirements defined in IRS Publication 1075. The contractor will maintain a list of officers or employees authorized access to FTI. Such list will be provided to the agency and, upon request, to the

IRS.

(3) FTI in hardcopy or electronic format shall be used only for the purpose of carrying out the provisions of this contract. FTI in any format shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of this contract.

Inspection or disclosure of FTI to anyone other than the contractor or the contractor’s officers or employees authorized is prohibited.

(4) FTI will be accounted for upon receipt and properly stored before, during, and after processing. In addition, any related output and products require the same level of protection as required for the source material.

(5) The contractor will certify that FTI processed during the performance of this contract will be completely purged from all physical and electronic data storage with no output to be retained by the contractor at the time the work is completed.

If immediate purging of physical and electronic data storage is not possible, the contractor will certify that any FTI in physical or electronic storage will remain safeguarded to prevent unauthorized disclosures.

(6) Any spoilage or any intermediate hard copy printout that may result during the processing of FTI will be given to the agency. When this is not possible, the contractor will be responsible for the destruction of the spoilage or any intermediate hard copy printouts and will provide the agency with a statement containing the date of destruction, description of material destroyed, and the destruction method.

(7) All computer systems receiving, processing, storing, or transmitting FTI must meet the requirements in IRS Publication 1075. To meet functional and assurance requirements, the security features of the environment must provide for the managerial, operational, and technical controls. All security features must be available and activated to protect against unauthorized use of and access to

FTI.

(8) No work involving FTI furnished under this contract will be subcontracted without the prior written approval of the IRS.

(9) Contractor will ensure that the terms of FTI safeguards described herein are included, without modification, in any approved subcontract for work involving

FTI.

(10) To the extent the terms, provisions, duties, requirements, and obligations of this contract apply to performing services with FTI, the contractor shall assume toward the subcontractor all obligations, duties and responsibilities that the agency under this contract assumes toward the contractor, and the subcontractor shall assume toward the contractor all the same obligations, duties and responsibilities which the contractor assumes toward the agency under this contract.

(11) In addition to the subcontractor’s obligations and duties under an approved subcontract, the terms and conditions of this contract apply to the subcontractor, and the subcontractor is bound and obligated to the contractor hereunder by the same terms and conditions by which the contractor is bound and obligated to the agency under this contract.

(12) For purposes of this contract, the term “contractor” includes any officer or employee of the contractor with access to or who uses FTI, and the term “subcontractor” includes any officer or employee of the subcontractor with access to or who uses FTI.

(13) The agency will have the right to void the contract if the contractor fails to meet the terms of FTI safeguards described herein.

II. CRIMINAL/CIVIL SANCTIONS

(1) Each officer or employee of a contractor to whom FTI is or may be disclosed shall be notified in writing that FTI disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any FTI for a purpose not authorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution.

(2) Each officer or employee of a contractor to whom FTI is or may be accessible shall be notified in writing that FTI accessible to such officer or employee may be accessed only for a purpose and to the extent authorized herein, and that access/inspection of FTI without an official need-to-know for a purpose not authorized herein constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution.

(3) Each officer or employee of a contractor to whom FTI is or may be disclosed shall be notified in writing that any such unauthorized access, inspection or disclosure of FTI may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each unauthorized access, inspection, or disclosure, or the sum of actual damages sustained as a result of such unauthorized access, inspection, or disclosure, plus in the case of a willful unauthorized access, inspection, or disclosure or an unauthorized access/inspection or disclosure which is the result of gross negligence, punitive damages, plus the cost of the action. These penalties are prescribed by IRC sections 7213, 7213A and 7431 and set forth at 26 CFR 301.6103(n)-1.

(3) Additionally, it is incumbent upon the contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000.

(4) Granting a contractor access to FTI must be preceded by certifying that each officer or employee understands the agency’s security policy and procedures for safeguarding FTI. A contractor and each officer or employee must maintain their authorization to access FTI through annual recertification of their understanding of the agency’s security policy and procedures for safeguarding FTI. The initial certification and recertifications must be documented and placed in the agency's files for review. As part of the certification and at least annually afterwards, a contractor and each officer or employee must be advised of the provisions of IRC sections 7213, 7213A, and 7431 (see Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training on the agency’s security policy and procedures provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches. (See Section 10) For the initial certification and the annual recertifications, the contractor and each officer or employee must sign, either with ink or electronic signature, a confidentiality statement certifying their understanding of the security requirements.

III. INSPECTION

The IRS and the Agency, with 24 hour notice, shall have the right to send its inspectors into the offices and plants of the contractor to inspect facilities and operations performing any work with FTI under this contract for compliance with requirements defined in IRS Publication 1075. The IRS’ right of inspection shall include the use of manual and/or automated scanning tools to perform compliance and vulnerability assessments of information technology (IT) assets that access, store, process or transmit FTI. Based on the inspection, corrective actions may be required in cases where the contractor is found to be noncompliant with FTI safeguard requirements.

SECTION 5 – PROCUREMENT REQUIREMENTS AND INSTRUCTIONS

5.1 Procurement Requirements

Procurement requirements are listed under “Procurement Laws, Preference, Regulations and Policies” and “Response to Solicitation” located on the eProcurement Web page at https://finance.ky.gov/eProcurement/Pages/procurement-laws-regulations-and-policies.aspx and https://finance.ky.gov/eProcurement/Pages/doing-business-with-the-commonwealth.aspx respectively. The vendor must comply with all applicable statutes, regulations and policies related to this procurement.

5.2 Access to Solicitation, RFP, and Addenda

The Commonwealth wants each prospective vendor to have full and complete information on which to base a proposal response. Only information presented or referred to in this RFP and any additional written information that is supplied by the Commonwealth Buyer shall be used by vendors in preparing the response.

The solicitation, addenda, and attachments shall be posted to the Kentucky Vendor Self Service link at https://vss.ky.gov

It is not necessary to register to access the solicitation. Unregistered vendors can access solicitations by clicking on public access.

In the event of any conflict or variation between the solicitation or modification as issued by the Commonwealth and the vendor’s response, the version as issued shall prevail.

5.3 RFP Terminology

For the purpose of this RFP, the following terms may be used interchangeably:

o Proposer, Offeror, Contractor, Provider, or Vendor o Commonwealth Buyer, Buyer, Purchaser, or Contract Officer o RFP, Solicitation, or Procurement o Bid, Proposal, or Offer o Commonwealth of Kentucky, Commonwealth, or State, Agency, COT o Fiscal Year will be defined as the Commonwealth fiscal year: July 1 through

June 30 o Biennium will be defined as the Commonwealth biennium: July 1 of each even numbered year through June 30 of the next even numbered year https://finance.ky.gov/eProcurement/Pages/procurement-laws-regulations-and-policies.aspx https://finance.ky.gov/eProcurement/Pages/procurement-laws-regulations-and-policies.aspx https://finance.ky.gov/eProcurement/Pages/doing-business-with-the-commonwealth.aspx https://finance.ky.gov/eProcurement/Pages/doing-business-with-the-commonwealth.aspx https://vss.ky.gov/ o Requirements that include the words “Shall”, “Will”, “Must” indicate a mandatory requirement o Mandatory Requirement means a condition set out in the specifications or statement of work that must be met without exception.”

5.4 Restrictions on Communications

The Commonwealth Buyer named on the Cover Sheet of this RFP shall be the sole point of contact throughout the procurement process. All communications, oral and written (regular, express, or electronic mail,), concerning this procurement shall be addressed to the Buyer.

For violation of this provision, the Commonwealth shall reserve the right to disqualify the vendors’ proposal response.

5.5 Confidentiality of Contract Terms

The contractor and the Commonwealth agree that all information communicated between them before the effective date of the contract shall be received in strict confidence and shall not be necessarily disclosed by the receiving party, its agents, or employees without prior written consent of the other party. Such material will be kept confidential subject to Commonwealth and Federal public information disclosure laws.

Upon signing of the contract by all parties, terms of the contract become available to the public, pursuant to the provisions of the Kentucky Revised Statutes.

The contractor shall have an appropriate agreement with its subcontractors extending these confidentiality requirements to all subcontractors’ employees.

5.6 Written Questions Regarding this RFP

Vendors are encouraged to submit written questions pursuant to Section 1.1 of this RFP. Written questions shall be submitted to the Commonwealth Buyer via email at Susan.Noland@ky.gov. Vendors should submit questions on Attachment D Vendors Question Form. No questions shall be accepted after the date(s) listed in Section 1.1 unless the question(s) is considered material to the procurement. The Commonwealth shall respond to salient questions in writing by issuing an addendum to the solicitation. The addendum shall be posted to the Kentucky Vendor Self Service site.

5.7 Vendor Response and Proprietary Information

The RFP specifies the format, required information, and general content of proposals submitted in response to the RFP. The Finance and Administration Cabinet will not disclose any portions of the proposals prior to Contract Award to anyone outside the Finance and Administration Cabinet, representatives of the agency for whose benefit the contract is proposed, representatives of the Federal Government, if required, and the members of the evaluation committees. After a contract is awarded in whole or in part, the Commonwealth shall have the right to duplicate, use, or disclose all proposal data mailto:Susan.Noland@ky.gov submitted by vendors in response to this RFP as a matter of public record.

Although the Commonwealth recognizes the vendor's possible interest in preserving selected data which may be part of a proposal, the Commonwealth must treat such information as provided by the Kentucky Open Records Act, KRS

61.870 et sequitur.

Informational areas which normally might be considered proprietary shall be limited to individual personnel data, customer references, selected financial data, formulae, and financial audits which, if disclosed, would permit an unfair advantage to competitors. If a proposal contains information in these areas that a vendor declares proprietary in nature and not available for public disclosure, the vendor should declare in the Transmittal Letter [see Section 6.7 (A)] the inclusion of proprietary information and shall noticeably label as proprietary each file containing such information. Proprietary information shall be submitted separately and identified as “Proprietary Data”. Proposals containing information declared by the vendor to be proprietary, either in whole or in part, outside the areas listed above may be deemed non-responsive to the RFP and may be rejected.

5.8 Notification of Award of Contract

The procurement process will provide for the evaluation of proposals and selection of the successful proposal in accordance with State law and regulations. KRS Chapter 45A of the Kentucky Model Procurement Code provides the regulatory framework for the procurement of services by State agencies.

All applicable statutes, regulations, policies and requirements shall become a part of an award as well as the Information Technology requirements.

For additional award information, vendors may email the Commonwealth Buyer.

5.9 Protest

Pursuant to KRS 45A.285, the Secretary of the Finance and Administration Cabinet, or his designee, shall have authority to determine protests and other controversies of actual or prospective offerors in connection with the solicitations or selection for award of a contract.

Any actual or prospective offeror or contractor, who is aggrieved in connection with solicitation or selection for award of a contract, may a file protest with the Secretary of the Finance and Administration Cabinet. A protest or notice of other controversy must be filed promptly and in any event within two (2) calendar weeks after such aggrieved person knows or should have known of the facts giving rise thereto. All protests or notices of other controversies must be in writing and shall be addressed and mailed to:

Holly M. Johnson, Secretary

COMMONWEALTH OF KENTUCKY

FINANCE AND ADMINISTRATION CABINET

200 MERO STREET, 5TH FLOOR

FRANKFORT, KY 40622

The Secretary of Finance and Administration Cabinet shall promptly issue a decision in writing. A copy of that decision shall be mailed or otherwise furnished to the aggrieved party and shall state the reasons for the action taken.

The decision by the Secretary of the Finance and Administration Cabinet shall be final and conclusive.

5.10 Vendor Notification – Ineligible for Award

The…