AGY-21-003-SR_ 6.23.pdf

STATE OF MARYLAND

MARYLAND DEPARTMENT OF TRANSPORTATION

MARYLAND TRANSIT ADMINISTRATION (MDOT MTA)

INVITATION FOR BIDS (IFB)

INVENTORY RECONCILIATION

IFB NUMBER AGY-21-003-SR

ISSUE DATE: JUNE 24, 2021

NOTICE

A Prospective Bidder that has received this document from a source other than eMarylandMarketplace

(eMMA) https://procurement.maryland.gov should register on eMMA. See Section 4.2.

MINORITY BUSINESS ENTERPRISES ARE ENCOURAGED TO

RESPOND TO THIS SOLICITATION.

Inventory Reconciliation Solicitation #: AGY-21-003-SR IFB Document

IFB for MDOT MTA Page ii of 104

NO BID NOTICE/VENDOR FEEDBACK FORM

To help us improve the quality of State solicitations, and to make our procurement process more responsive and business friendly, please provide comments and suggestions regarding this solicitation.

Please return your comments with your response. If you have chosen not to respond to this solicitation, please email or fax this completed form to the attention of the Procurement Officer (see Key Information Summary Sheet below for contact information).

Title: Inventory Reconciliation Solicitation No: AGY-21-003-SR

1. If you have chosen not to respond to this solicitation, please indicate the reason(s) below:

� Other commitments preclude our participation at this time

� The subject of the solicitation is not something we ordinarily provide

� We are inexperienced in the work/commodities required

� Specifications are unclear, too restrictive, etc. (Explain in REMARKS section)

� The scope of work is beyond our present capacity

� Doing business with the State is simply too complicated. (Explain in REMARKS section)

� We cannot be competitive. (Explain in REMARKS section)

� Time allotted for completion of the Bid is insufficient

� Start-up time is insufficient

� Bonding/Insurance requirements are restrictive (Explain in REMARKS section)

� Bid requirements (other than specifications) are unreasonable or too risky (Explain in REMARKS section)

� MBE or VSBE requirements (Explain in REMARKS section)

� Prior State of Maryland contract experience was unprofitable or otherwise unsatisfactory.

(Explain in REMARKS section)

� Payment schedule too slow

� Other: __________________________________________________________________

2. If you have submitted a response to this solicitation, but wish to offer suggestions or express concerns, please use the REMARKS section below. (Attach additional pages as needed.)

REMARKS:

Vendor Name: ________________________________ Date: _______________________

Contact Person: _________________________________ Phone (____) _____ - _________________

Address: ______________________________________________________________________

E-mail Address: ________________________________________________________________

IFB for MDOT MTA Page iii of 104

STATE OF MARYLAND

MARYLAND DEPARTMENT OF TRANSPORTATION

MARYLAND TRANSIT ADMINISTRATION (MDOT MTA)

KEY INFORMATION SUMMARY SHEET

Invitation for Bids Services: - Inventory Reconciliation

Solicitation Number: AGY-21-003-SR

IFB Issue Date: June 24, 2021

IFB Issuing Office: Maryland Department of Transportation Maryland Transit Administration (MDOT MTA)

Procurement Officer: Darica Lawson 6 St Paul Street, 7th Floor Baltimore, Maryland 21202 e-mail:

Office Phone:

dlawson@mdot.maryland.gov 410-767-3763

Bids are to be sent to: submit Via eMMA

Pre-Bid Conference: July 8, 2021 a 1pm Local Time via Microsoft Teams See Attachment A indicate attendance by 7/2

Questions Due Date and Time July 12, 2021 at 1pm Local Time

Bid Due (Closing) Date and Time:

July 28, 2021 at 1pm Local Time Bidders are reminded that a completed Feedback Form is requested if a no-bid decision is made (see page iv).

Public Bid Opening Date, Time and Location

See eMMA for Bid Tabulation

MBE Subcontracting Goal: 20% with no subgoals

Contract Type: Firm Fixed Price

Contract Duration: 5 years

Primary Place of Performance:

Baltimore City and Multiple Counties

SBR Designation: No

Federal Funding: No mailto:dlawson@mdot.maryland.gov

IFB for MDOT MTA Page 1 of 104

1 Minimum Qualifications

1.1 Bidder Minimum Qualifications

The Bidder must provide proof with its Bid that the following Minimum Qualifications have been met:

1.1.1 The Bidder shall have at least five (5) years of verifiable experience in reconciling at least 20,000 inventory records with an asset value greater than 50 million at multiple locations.

Required Documentation: As proof of meeting this requirement, the Bidder shall provide with its Bid three (3) references with the following information from the past five years for performing inventory reconciliation services: Name of client organization; Name, title, telephone number, and e-mail address, if available, of point of contact for client organization; and Value, type, duration, and description of services provided.

1.1.2 The Bidder shall have a Project Manager who possesses five (5) years of experience leading and managing the reconciliation of inventory records. The Bidder shall include in its Bid the detailed resume of the Project Manager.

THE REMAINDER OF THIS PAGE IS INTENTIONALLY LEFT BLANK.

IFB for MDOT MTA Page 2 of 104

2 Contractor Requirements: Scope of Work

2.1 Summary Statement

The Maryland Department of Transportation Maryland Transit Administration (MDOT MTA or the "Administration") is issuing this Invitation for Bids (IFB) in order to procure the services defined in this Section 2, as specified in this IFB, from a contract between the successful bidder(s) and the MDOT MTA: The Maryland Transit Administration (MTA), a mode of the Maryland Department of Transportation (MDOT), is requesting services from a Master Contractor to conduct an inventory reconciliation between all of MTA’s recorded perpetual inventory and the physically counted inventory located at various properties.

2.1.1 It is the State’s intention to obtain goods and services, as specified in this IFB, from a Contract between the selected Bidder and the State.

2.1.2 The Administration intends to make a single award for the work under this IFB. See IFB Section

4.9 Award Basis for more Contract award information.

2.1.3 A Bidder, either directly or through its subcontractor(s), must be able to provide all goods and services and meet all of the requirements requested in this solicitation and the successful Bidder (the Contractor) shall remain responsible for Contract performance regardless of subcontractor participation in the work.

2.1.4 Maryland State and local entities as defined in Finance and Procurement §13-110(a) and nonprofit entities within the State of Maryland may purchase from the Contractor goods or services covered by the Contract at the same prices chargeable to the State. All such purchases by non-executive branch entities, non-State governments, government agencies or nonprofit entities:

Shall constitute Contracts between the Contractor and that entity;

Shall not constitute purchases by the State or State agencies under the Contract;

Shall not be binding or enforceable against the State; and

May be subject to other terms and conditions agreed to by the Contractor and the purchaser.

2.1.5 All Contract prices, terms, and conditions must be provided to any Maryland local government or nonprofit entity requesting services under the Contract. The Contractor bears the risk of determining whether or not a government, agency or organization with which the Contractor is dealing is a State entity.

2.2 Background and Purpose

The Contractor shall be responsible for reconciling MTA’s inventory records. As of our last inventory on 12/31/20 MTA had 26,000 pieces of inventory totaling over 8 billion dollars. The Contractor shall check the inventory records against the items inventoried by MTA Accountable Officers to assure that records exist for each item, and that records for missing items are investigated, and if not found, reported and removed after receiving approval from the Contract Monitor,. See Appendix E of this IFB for a sample of items per location.

A complete physical inventory count (Comprehensive) includes all “Capital Equipment” and “Sensitive Items” and is to be conducted by the Contractor at least once every three years. A Sensitive Items Only Physical Inventory is to be conducted once every year, except the

IFB for MDOT MTA Page 3 of 104

Comprehensive year, by the MTA Accountable Officers. Both types are explained in greater detail below.

2.2.1 The Contractor will conduct a physical inventory based on one of the following classifications:

A. Comprehensive (Nonexpendable Item) – Any non-sensitive capital equipment item or furnishing having a probable useful life in excess of one year and an original procurement cost of $500 or more per unit, such as, furniture, machinery, vehicles, other apparatus; and, all sensitive equipment items, as defined below

B. Sensitive Items - Capital or non-capital equipment items having a probable useful life in excess of one year and an original procurement cost of $250 or more per unit, such as all computer equipment including, but not limited to, laptops, notebook computers, tablets, recording devices, portable tools, hand radios, cameras and the like. Also, “Sensitive Items” include any items with a history of high theft or that is easily concealable regardless of cost. Firearms and other MTA law enforcement devices are always considered sensitive regardless of acquisition cost. All telecommunication devices, except for those assigned to MTA Police, are tracked by the Telecommunications Division and are excluded from inventory.

2.2.2 Project Goals

a) The Agency’s goal for this Inventory Reconciliation is: Reduction of unreconciled items (Outstanding items) from physical inventory against the recorded perpetual inventory and validation of Physical Inventory taken.

2.2.3 State Staff and Roles

a) State Project Manager

1) The State will provide a State Project Manager who will be responsible for reviewing, verifying and providing authorization of all work performed to include, but not limited to counts, scheduling and appropriate staffing.

2.2.4 Other State Responsibilities

a) The State will provide normal office working facilities and equipment reasonably necessary for Contractor performance under the Contract. Any special requirements (e.g., reprographic services, computer time, key data entry) shall be identified.

b) The State is responsible for providing required information, data, documentation, and test data to facilitate the Contractor’s performance of the work, and will provide such additional assistance and services as is specifically set forth.

c) A desk, filing cabinet and telephone. Please note for security reasons, unless the Master Contractor completes security procedures and has prior approval to do so, the Master Contractor will be unable to connect their computer equipment to the State Agency’s LAN or WAN.

IFB for MDOT MTA Page 4 of 104

2.3 Responsibilities and Tasks

The Contractor will complete the requirements as indicated to meet the Agency’s goal through the following objectives:

Provide a Team to reconcile the differences between the perpetual and physical inventories. Reconciled Items are defined as all items in both inventories being located, valued, or liquidated. One of the people on each team must have an accounting background and experience with fixed assets. Multiple teams may be needed to complete the inventory reconciliation within the term of contract.

2.3.1 The reconciliation of all fixed assets is accomplished on the grounds, building-by-building and room-by-room and shall:

A. Attempt to locate items identified as existing in the location on MTA's perpetual i n v e n t o r y records (see Attachment C) on all items defined as "Sensitive Equipment," and "Non-sensitive Equipment", but unmatched against the physical count results;

B. Verify the indication (i.e. stickers with the date) on each item as it is inventoried that it was inventoried and when;

C. Identify any items defined as "Sensitive Equipment" or "Non-sensitive Equipment" which do not have barcodes or MTA State Property tags, as possible uncounted items to support an unreconci led i tem against the perpe tual inventory records .

Once r e c o r d e d , the item shall be tagged with an MTA State Property Tag supplied by the MTA.

D. Compare all items counted against the Perpetual record, and create a table of items, classified as follows: items matching the perpetual record and tagged with a barcode;

items not contained within the Perpetual record but tagged with a barcode; and items containing no tag to be compared with unreconciled items within the Perpetual records.

The Master Contractor shall populate as many data fields as possible for those items not in the perpetual record, including a detailed description.

E. The Master Contractor shall have a Project Manager available to periodically check the accuracy of the count, at the sole discretion of the MTA. The MTA makes no guarantee that it will request that the inventory be verified by the Master Contractor's Pro jec t Manager .

2.3.2 The Contractor’s Project Manager shall be responsible for the following:

a) Verify and provide authorization of all work performed, including but not limited to inventory counts, scheduling and appropriate staffing.

b) Progress Schedule:

i) Provide the MTA Contract Monitor with a progress report every two weeks consisting of the number of offices, buildings and locations completed, along with the hours worked. The information contained within the progress reports must be included within the Contractor’s invoice. Failure to provide a progress

IFB for MDOT MTA Page 5 of 104 report every two weeks will constitute a violation of the Contract and may result in the MTA withholding payment until the report is received. Failure to include information that matches the progress report with an invoice submitted by the Contractor will delay payment of said invoice.

ii) Provide the MTA Contract Monitor with three (3) copies of a Progress Schedule via an Excel format not less than seven (7) days before commencing the inventory reconciliation.

iii) The Progress Schedule must contain the methodology the Contractor proposes to perform the inventory reconciliation and shall show the dates the Contractor will go to each location, the proposed length of time to be spent at the locations, and the number of personnel who will go to each location. The Progress Schedule shall include milestones for inventory reconciliation completion at each location.

The Progress Schedule shall be reviewed by the Contract Monitor and revised by the Contractor, if required, until the Progress Schedule is acceptable. The Contract Monitor will follow up via e-mail response to the Contractor when the schedule is accepted and contact, if any, MTA facilities and/or personnel to allow access for the Contractor. No work may begin until the Progress Schedule is approved by the MTA Contract Monitor. Failure to submit schedules may result in delays to obtain access into various MTA facilities or grounds. The Progress Schedule shall be continuously updated as necessary and submitted in writing to the MTA Contract Monitor for approval for progress tracking purposes.

2.3.3 Final Report

The Contractor shall provide a final report by the schedule below that will include an Inventory Reconciliation, an overall summary of items reconciled, a schedule of undetermined assets, listing of all outstanding items and listing of total items counts found per location.

The complete Physical Inventory Reconciliation report shall be completed by the Master Contractor and delivered electronically in Microsoft Excel format. It must be compatible to Microsoft Office 2010 or earlier version.

Three (3) hard copies and one electronic copy shall be sent to MTA Contract Monitor.

All final Physical Inventory Reconciliations for the period and type are due by the schedule listed below:

Year 1 (7/1/2021 – 6/30/22) - FY 2022 Comprehensive Inventory Due 6/30/22 Year 2 (7/1/22 – 6/30/23) – FY 2023 Sensitive Inventory Due – 6/30/23 Year 3 (7/1/23 – 6/30/24) – FY 2024 Sensitive Inventory Due – 6/30/24 Year 4 (7/1/24 – 6/30/25) – FY 2025 Comprehensive Inventory Due – 6/30/25 Year 5 (7/1/25 – 6/30/26) – FY 2026 Sensitive Inventory Due – 6/30/22

At a minimum, the Spreadsheets fields shall include: the date the item was inventoried; a description of the item (of sufficient detail to identify the item, for instance "car" is not satisfactory, preference would be "2005 Honda Civic, 1.4 Liter engine"); the facility's street address (or code provided by the Project Manager); it's location within the facility: the Department/PCA Code; the bar code number (if present); and the quantity of the item.

IFB for MDOT MTA Page 6 of 104

2.3.4 A list of MTA locations is included as Attachment E. The inventory reconciliation will take place not only at MTA facilities, maintenance/repair areas, parking lots, warehouses, offices, and stations but also along transit routes - for instance bus shelters, and bus stop signs, and anywhere the MTA operates. Locations of MTA Transit routes for all modes can be found on the MTA website at http://mtamaryland.com/.

http://mtamaryland.com/

IFB for MDOT MTA Page 7 of 104

3 Contractor Requirements: General

3.1 Contract Initiation Requirements

A. Contractor shall schedule and hold a kickoff meeting within 10 Business Days of NTP Date.

At the kickoff, the Contractor shall furnish an updated Project Schedule describing the activities for the Contractor, the State, and any third parties for fully transitioning to the Contractor’s solution.

3.2 End of Contract Transition

3.2.1 The Contractor shall provide transition assistance as requested by the State to facilitate the orderly transfer of services to the State or a follow-on contractor, for a period up to 60 days prior to Contract end date, or the termination thereof. Such transition efforts shall consist, not by way of limitation, of:

a) Provide additional services and support as requested to successfully complete the transition;

b) Maintain the services called for by the Contract at the required level of proficiency;

c) Provide updated System Documentation (see Appendix 1), as appropriate; and

d) Provide current operating procedures (as appropriate).

3.2.2 The Contractor shall work toward a prompt and timely transition, proceeding in accordance with the directions of the Contract Monitor. The Contract Monitor may provide the Contractor with additional instructions to meet specific transition requirements prior to the end of the Contract.

3.2.3 The Contractor shall ensure that all necessary knowledge and materials for the tasks completed are transferred to the custody of State personnel or a third party, as directed by the Contract Monitor.

3.2.4 The Contractor shall support end-of-Contract transition efforts with technical and project support to include but not be limited to:

a) The Contractor shall provide a draft Transition-Out Plan 120 Business Days in advance of Contract end date.

The Transition-Out Plan shall address at a minimum the following areas:

1) Any staffing concerns/issues related to the closeout of the Contract;

2) Communications and reporting process between the Contractor, the Administration and the Contract Monitor;

3) Security and system access review and closeout;

4) Any hardware/software inventory or licensing including transfer of any point of contact for required software licenses to the Administration or a designee;

5) Any final training/orientation of Administration staff;

6) Connectivity services provided, activities and approximate timelines required for Transition-Out;

7) Knowledge transfer, to include:

a) A working knowledge of the current system environments;

b) Review with the Administration the procedures and practices that support the business process and current system environments;

IFB for MDOT MTA Page 8 of 104

c) Working knowledge of all technical and functional matters associated with the solution, its architecture, data file structure, interfaces, any batch programs, and any hardware or software tools utilized in the performance of the Contract;

d) Documentation that lists and describes all hardware and software tools utilized in the performance of the Contract;

8) Plans to complete tasks and any unfinished work items (including open change requests, and known bug/issues); and

9) Any risk factors with the timing and the Transition-Out schedule and transition process.

The Contractor shall document any risk factors and suggested solutions.

The Contractor shall ensure all documentation and data including, but not limited to, System Documentation and current operating procedures, is current and complete with a hard and soft copy in a format prescribed by the Contract Monitor.

The Contractor shall provide copies of any current daily and weekly back-ups to the Administration or a third party as directed by the Contract Monitor as of the final date of transition, but no later than the final date of the Contract.

Access to any data or configurations of the furnished product and services shall be available after the expiration of the Contract as described in Section 3.2.5.

3.2.5 Return and Maintenance of State Data

a) Upon termination or the expiration of the Contract Term, the Contractor shall: (a) return to the State all State data in either the form it was provided to the Contractor or in a mutually agreed format along with the schema necessary to read such data; (b) preserve, maintain, and protect all State data until the earlier of a direction by the State to delete such data or the expiration of 90 days (“the retention period”) from the date of termination or expiration of the Contract term; (c) after the retention period, the Contractor shall securely dispose of and permanently delete all State data in all of its forms, such as disk, CD/DVD, backup tape and paper such that it is not recoverable, according to National Institute of Standards and Technology (NIST)-approved methods with certificates of destruction to be provided to the State; and (d) prepare an accurate accounting from which the State may reconcile all outstanding accounts. The final monthly invoice for the services provided hereunder shall include all charges for the 90-day data retention period.

b) During any period of service suspension, the Contractor shall maintain all State data in its then existing form, unless otherwise directed in writing by the Contract Monitor.

c) In addition to the foregoing, the State shall be entitled to any post-termination/expiration assistance generally made available by Contractor with respect to the services.

3.3 Invoicing

3.3.1 General

a) The Contractor shall e-mail the original of each invoice and signed authorization to invoice to the Contract Monitor bhaden@mdot.maryland.gov and accounts payable at mtaaccountspayable@mta.maryland.gov :

All invoices for services shall be verified by the Contractor as accurate at the time of submission.

mailto:bhaden@mdot.maryland.gov mailto:mtaaccountspayable@mta.maryland.gov

IFB for MDOT MTA Page 9 of 104

An invoice not satisfying the requirements of a Proper Invoice (as defined in COMAR 21.06.09) cannot be processed for payment. To be considered a Proper Invoice, invoices must include the following information, without error:

1) Contractor name and address;

2) Remittance address;

3) Federal taxpayer identification (FEIN) number, social security number, as appropriate;

4) Invoice period (i.e. time period during which services covered by invoice were performed);

5) Invoice date;

6) Invoice number;

7) State assigned Contract number;

8) State assigned (Blanket) Purchase Order number(s);

9) Goods or services provided;

10) Amount due; and

11) Any additional documentation required by regulation or the Contract.

Invoices that contain both fixed price and time and material items shall clearly identify each item as either fixed price or time and material billing.

The Administration reserves the right to reduce or withhold Contract payment in the event the Contractor does not provide the Administration with all required deliverables within the time frame specified in the Contract or otherwise breaches the terms and conditions of the Contract until such time as the Contractor brings itself into full compliance with the Contract.

Any action on the part of the Administration, or dispute of action by the Contractor, shall be in accordance with the provisions of Md. Code Ann., State Finance and Procurement Article §§ 15-215 through 15-223 and with COMAR 21.10.04.

The State is generally exempt from federal excise taxes, Maryland sales and use taxes, District of Columbia sales taxes and transportation taxes. The Contractor, however, is not exempt from such sales and use taxes and may be liable for the same.

Invoices for final payment shall be clearly marked as “FINAL” and submitted when all work requirements have been completed and no further charges are to be incurred under the Contract. In no event shall any invoice be submitted later than 60 calendar days from the Contract termination date.

3.3.2 Invoice Submission Schedule

The Contractor shall submit invoices in accordance with the following schedule:

a) For items of work for which there is one-time pricing (see Attachment B –Bid Form) those items shall be billed in the month following the acceptance of the work by the Administration.

b) For items of work for which there is annual pricing, see Attachment B–Bid Form, those items shall be billed in equal monthly installments for the applicable Contract year in the month following the performance of the services.

3.3.3 Deliverable Invoicing [[Remove if payment is not by deliverable. Adjust as appropriate.]]

a) Deliverable invoices shall be accompanied by notice(s) of acceptance issued by the State for all invoices submitted for payment. Payment of invoices will be withheld if a signed DPAF is not

IFB for MDOT MTA Page 10 of 104 submitted (see online example at http://doit.maryland.gov/contracts/Documents/_procurementForms/DeliverableProductAcceptan ceForm-DPAFsample.pdf).

Payment for deliverables will only be made upon completion and acceptance of the deliverables as defined in Section 2.

3.3.4 For the purposes of the Contract an amount will not be deemed due and payable if:

a) The amount invoiced is inconsistent with the Contract;

b) The proper invoice has not been received by the party or office specified in the Contract;

c) The invoice or performance is in dispute or the Contractor has failed to otherwise comply with the provisions of the Contract;

d) The item or services have not been accepted;

e) The quantity of items delivered is less than the quantity ordered;

f) The items or services do not meet the quality requirements of the Contract;

g) If the Contract provides for progress payments, the proper invoice for the progress payment has not been submitted pursuant to the schedule;

h) If the Contract provides for withholding a retainage and the invoice is for the retainage, all stipulated conditions for release of the retainage have not been met; or

i) The Contractor has not submitted satisfactory documentation or other evidence reasonably required by the Procurement Officer or by the Contract concerning performance under the Contract and compliance with its provisions.

3.3.5 Travel Reimbursement

j) There shall be no reimbursement for Routine Travel. Contractor shall not be reimbursed for Non-Routine Travel without prior Contract Monitor approval.

k) Routine Travel is defined as travel within a 50-mile radius of the Administration’s base location, as identified in the IFB, or the Contractor’s facility, whichever is closer to the consulting site.

There will be no payment for labor hours for travel time or reimbursement for any travel expenses for work performed within these radiuses or at the Contractor’s facility.

l) Non-routine Travel is defined as travel beyond the 50-mile radius of the Administration’s base location, as identified in the IFB, or the Contractor’s facility, whichever is closer to the consulting site. Non-routine travel will be reimbursed according to the State’s travel regulations and reimbursement rates, which can be found at: www.DBM.maryland.gov - search: Fleet Management. If non-routine travel is conducted by automobile, the first 50 miles of such travel will be treated as routine travel and as described in Section 3.3.6.b, and will not be reimbursed.

MTA has public transit that contractors can utilize for inventory reconciliation purposes beyond a 50 Mile radius. Special circumstances that involve non-routine travel will be subject to the project Manager’s approval.

3.4 Liquidated Damages

3.4.1 MBE Liquidated Damages

This contract requires the contractor to make good faith efforts to comply with the Minority Business Enterprise (“MBE”) Program and contract provisions. The State and the Contractor acknowledge and agree that the State will incur damages, including but not limited to loss of goodwill, detrimental impact on economic development, and diversion of internal staff resources, if the Contractor does not make

IFB for MDOT MTA Page 11 of 104 good faith efforts to comply with the requirements of the MBE Program and MBE contract provisions.

The parties further acknowledge and agree that the damages the State might reasonably be anticipated to accrue as a result of such lack of compliance are difficult to ascertain with precision.

Therefore, upon a determination by the State that the Contractor failed to make good faith efforts to comply with one or more of the specified MBE Program requirements or contract provisions, the Contractor agrees to pay liquidated damages to the State at the rates set forth below. The Contractor expressly agrees that the State may withhold payment on any invoices as a set-off against liquidated damages owed. The Contractor further agrees that for each specified violation, the agreed upon liquidated damages are reasonably proximate to the loss the State is anticipated to incur as a result of such violation.

a. Failure to submit each monthly payment report in full compliance with COMAR 21.11.03.13B (3): $23.00 per day until the monthly report is submitted as required.

b. Failure to include in its agreements with MBE subcontractors a provision requiring submission of payment reports in full compliance with COMAR 21.11.03.13B (4): $82.00 per MBE subcontractor.

c. Failure to comply with COMAR 21.11.03.12 in terminating, canceling, or changing the scope of work/value of a contract with an MBE subcontractor and/or amendment of the MBE participation schedule: the difference between the dollar value of the MBE participation commitment on the MBE participation schedule for that specific MBE firm and the dollar value of the work performed by that MBE firm for the contract.

d. Failure to meet the Contractor’s total MBE participation goal and subgoal commitments: the difference between the dollar value of the total MBE participation commitment on the MBE participation schedule and the MBE participation actually achieved.

e. [DO NOT INCLUDE IN CONTRACTS THAT ARE SUBJECT TO SECTION 15-226 OF

THE STATE FINANCE AND PROCUREMENT ARTICLE – CONSTRUCTION

CONTRACTS – PROMPT PAYMENT OF SUBCONTRACTORS]. Failure to promptly pay all undisputed amounts to a subcontractor in full compliance with the prompt payment provisions of this contract: $90.00 per day until the undisputed amount due to the subcontractor is paid.

Notwithstanding the use of liquidated damages, the State reserves the right to terminate the contract and exercise all other rights and remedies provided in the contract or by law.

3.5 Disaster Recovery and Data

The following requirements apply to the Contract:

3.5.1 Redundancy, Data Backup and Disaster Recovery

a) Unless specified otherwise in the IFB, Contractor shall maintain or cause to be maintained disaster avoidance procedures designed to safeguard State data and other confidential information, Contractor’s processing capability and the availability of hosted services, in each case throughout the Contract term. Any force majeure provisions of the Contract do not limit the Contractor’s obligations under this provision.

b) The Contractor shall have robust contingency and disaster recovery (DR) plans in place to ensure that the services provided under the Contract will be maintained in the event of disruption to the Contractor/subcontractor’s operations (including, but not limited to, disruption to information technology systems), however caused.

1) The Contractor shall furnish a DR site.

IFB for MDOT MTA Page 12 of 104

2) The DR site shall be at least 100 miles from the primary operations site, and have the capacity to take over complete production volume in case the primary site becomes unresponsive.

c) The contingency and DR plans must be designed to ensure that services under the Contract are restored after a disruption within twenty-four (24) hours from notification and a recovery point objective of one (1) hour or less prior to the outage in order to avoid unacceptable consequences due to the unavailability of services.

d) The Contractor shall test the contingency/DR plans at least twice annually to identify any changes that need to be made to the plan(s) to ensure a minimum interruption of service.

Coordination shall be made with the State to ensure limited system downtime when testing is conducted. At least one (1) annual test shall include backup media restoration and failover/fallback operations at the DR location. The Contractor shall send the Contract Monitor a notice of completion following completion of DR testing.

e) Such contingency and DR plans shall be available for the Administration to inspect and practically test at any reasonable time, and subject to regular updating, revising, and testing throughout the term of the Contract.

3.5.2 Data Export/Import

a) The Contractor shall, at no additional cost or charge to the State, in an industry standard/non-proprietary format:

1) perform a full or partial import/export of State data within 24 hours of a request; or

2) provide to the State the ability to import/export data at will and provide the State with any access and instructions which are needed for the State to import or export data.

b) Any import or export shall be in a secure format per the Security Requirements.

3.5.3 Data Ownership and Access

a) Data, databases and derived data products created, collected, manipulated, or directly purchased as part of a IFB are the property of the State. The purchasing State agency is considered the custodian of the data and shall determine the use, access, distribution and other conditions based on appropriate State statutes and regulations.

Public jurisdiction user accounts and public jurisdiction data shall not be accessed, except (1) in the course of data center operations, (2) in response to service or technical issues, (3) as required by the express terms of the Contract, including as necessary to perform the services hereunder or (4) at the State’s written request.

The Contractor shall limit access to and possession of State data to only Contractor Personnel whose responsibilities reasonably require such access or possession and shall train such Contractor Personnel on the confidentiality obligations set forth herein.

At no time shall any data or processes – that either belong to or are intended for the use of the State or its officers, agents or employees – be copied, disclosed or retained by the Contractor or any party related to the Contractor for subsequent use in any transaction that does not include the State.

The Contractor shall not use any information collected in connection with the services furnished under the Contract for any purpose other than fulfilling such services.

3.5.4 Provisions in Sections 3.5.1 – 3.5.3 shall survive expiration or termination of the Contract.

Additionally, the Contractor shall flow down the provisions of Sections 3.5.1-3.5.3 (or the substance thereof) in all subcontracts.

IFB for MDOT MTA Page 13 of 104

3.6 Insurance Requirements

The Contractor shall maintain, at a minimum, the insurance coverages outlined below, or any minimum requirements established by law if higher, for the duration of the Contract, including option periods, if exercised:

3.6.1 The following type(s) of insurance and minimum amount(s) of coverage are required:

a) Commercial General Liability - of $1,000,000 combined single limit per occurrence for bodily injury, property damage, and personal and advertising injury and $3,000,000 annual aggregate.

The minimum limits required herein may be satisfied through any combination of primary and umbrella/excess liability policies.

b) Errors and Omissions/Professional Liability - $1,000,000 per combined single limit per claim and $3,000,000 annual aggregate.

c) Crime Insurance/Employee Theft Insurance - to cover employee theft with a minimum single loss limit of $1,000,000 per loss, and a minimum single loss retention not to exceed $10,000.

The State of Maryland and the Administration should be added as a “loss payee.”

d) Cyber Security / Data Breach Insurance – (For any service offering hosted by the Contractor) ten million dollars ($10,000,000) per occurrence. The coverage must be valid at all locations where work is performed or data or other information concerning the State’s claimants or employers is processed or stored.

e) Worker’s Compensation - The Contractor shall maintain such insurance as necessary or as required under Workers’ Compensation Acts, the Longshore and Harbor Workers’ Compensation Act, and the Federal Employers’ Liability Act, to not be less than. one million dollars ($1,000,000) per occurrence (unless a state’s law requires a greater amount of coverage).

Coverage must be valid in all states where work is performed.

f) Automobile or Commercial Truck Insurance - The Contractor shall maintain Automobile or Commercial Truck Insurance (including owned, leased, hired, and non-owned vehicles) as appropriate with Liability, Collision, and PIP limits no less than those required by the State where the vehicle(s) is registered, but in no case less than those required by the State of Maryland.

3.6.2 The State shall be listed as an additional insured on the faces of the certificates associated with the coverages listed above, including umbrella policies, excluding Workers’ Compensation Insurance and professional liability.

3.6.3 All insurance policies shall be endorsed to include a clause requiring the insurance carrier provide the Procurement Officer, by certified mail, not less than 30 days’ advance notice of any non-renewal, cancellation, or expiration. The Contractor shall notify the Procurement Officer in writing, if policies are cancelled or not renewed within five (5) days of learning of such cancellation or nonrenewal. The Contractor shall provide evidence of replacement insurance coverage to the Procurement Officer at least 15 days prior to the expiration of the insurance policy then in effect.

3.6.4 Any insurance furnished as a condition of the Contract shall be issued by a company authorized to do business in the State.

3.6.5 The recommended awardee must provide current certificate(s) of insurance with the prescribed coverages, limits and requirements set forth in this section within five (5) Business Days from notice of recommended award. During the period of performance for multi-year contracts, the Contractor shall provide certificates of insurance annually, or as otherwise directed by the Contract Monitor.

IFB for MDOT MTA Page 14 of 104

3.6.6 The Contractor shall require any subcontractors to obtain and maintain comparable levels of coverage and shall provide the Contract Monitor with the same documentation as is required of the Contractor.

3.7 Security Requirements

The following requirements are applicable to the Contract:

3.7.1 Employee Identification

a) Contractor Personnel shall display his or her company ID badge in a visible location at all times while on State premises. Upon request of authorized State personnel, each Contractor Personnel shall provide additional photo identification.

b) Contractor Personnel shall cooperate with State site requirements, including but not limited to, being prepared to be escorted at all times, and providing information for State badge issuance.

c) Contractor shall remove any Contractor Personnel from working on the Contract where the State determines, in its sole discretion, that Contractor Personnel has not adhered to the Security requirements specified herein.

d) The State reserves the right to request that the Contractor submit proof of employment authorization of non-United States Citizens, prior to commencement of work under the Contract.

3.7.2 Security Clearance / Criminal Background Check

A security clearance is not required for Contractor Personnel assigned to the Contract.

Persons with a criminal record may not perform services under the Contract unless prior written approval is obtained from the Contract Monitor. The Contract Monitor reserves the right to reject any individual based upon the results of the background check. Decisions of the Contract Monitor as to acceptability of a candidate are final. The State reserves the right to refuse any individual Contractor Personnel to work on State premises, based upon certain specified criminal convictions, as specified by the State.

3.7.3 On-Site Security Requirement(s)

1) Contractor Personnel may be subject to random security checks when entering and leaving State secured areas. The State reserves the right to require Contractor Personnel to be accompanied while in secured premises.

2) Some State sites, especially those premises of the Department of Public Safety and Correctional Services, require each person entering the premises to document and inventory items (such as tools and equipment) brought onto the site, and to submit to a physical search of his or her person. Therefore, Contractor Personnel shall always have available an inventory list of tools being brought onto a site and be prepared to present the inventory list to the State staff or an officer upon arrival for review, as well as present the tools or equipment for inspection. Before leaving the site, the Contractor Personnel will again present the inventory list and the tools or equipment for inspection.

Upon both entering the site and leaving the site, State staff or a correctional or police officer may search Contractor Personnel. Depending upon facility rules, specific tools or personal items may be prohibited from being brought into the facility.

e) Any Contractor Personnel who enters the premises of a facility under the jurisdiction of the Administration may be searched, fingerprinted (for the purpose of a criminal history background check), photographed and required to wear an identification card issued by the Administration.

IFB for MDOT MTA Page 15 of 104

f) Further, Contractor Personnel shall not violate Md. Code Ann., Criminal Law Art. Section 9-410 through 9-417 and such other security policies of the agency that control the facility to which the Contractor Personnel seeks access. The failure of any of the Contractor Personnel to comply with any provision of the Contract is sufficient grounds for the State to immediately terminate the Contract for default.

3.7.4 Data Protection and Controls

A. Contractor shall ensure a secure environment for all State data and any hardware and software (including but not limited to servers, network and data components) provided or used in connection with the performance of the Contract and shall apply or cause application of appropriate controls so as to maintain such a secure environment (“Security Best Practices”).

Such Security Best Practices shall comply with an accepted industry standard, such as the NIST cybersecurity framework.

B. To ensure appropriate data protection safeguards are in place, the Contractor shall implement and maintain the following controls at all times throughout the Term of the Contract (the Contractor may augment this list with additional controls):

1) Establish separate production, test, and training environments for systems supporting the services provided under the Contract and ensure that production data is not replicated in test or training environment(s) unless it has been previously anonymized or otherwise modified to protect the confidentiality of Sensitive Data elements. The Contractor shall ensure the appropriate separation of production and non-production environments by applying the data protection and control requirements.

2) Apply hardware and software hardening procedures as recommended by Center for Internet Security (CIS) guides https://www.cisecurity.org/ Security Technical Implementation Guides (STIG) https://public.cyber.mil/stigs/, or similar industry best practices to reduce the systems’ surface of vulnerability, eliminating as many security risks as possible and documenting what is not feasible or not performed according to best practices. Any hardening practices not implemented shall be documented with a plan of action and milestones including any compensating control. These procedures may include but are not limited to removal of unnecessary software, disabling or removing unnecessary services, removal of unnecessary usernames or logins, and the deactivation of unneeded features in the Contractor’s system configuration files.

3) Ensure that State data is not comingled with non-State data through the proper application of compartmentalization Security Measures.

4) Apply data encryption to protect Sensitive Data at all times, including in transit, at rest, and also when archived for backup purposes. Unless otherwise directed, the Contractor is responsible for the encryption of all Sensitive Data.

5) For all State data the Contractor manages or controls, data encryption shall be applied to such data in transit over untrusted networks.

6) Encryption algorithms which are utilized for encrypting data shall comply with current Federal Information Processing Standards (FIPS), “Security Requirements for Cryptographic Modules”, FIPS PUB 140-2:

http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf https://www.cisecurity.org/ https://public.cyber.mil/stigs/ http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf

IFB for MDOT MTA Page 16 of 104 http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401vend.htm

7) Enable appropriate logging parameters to monitor user access activities, authorized and failed access attempts, system exceptions, and critical information security events as recommended by the operating system and application manufacturers and information security standards, including Maryland Department of Information Technology’s Information Security Policy.

8) Retain the aforementioned logs and review them at least daily to identify suspicious or questionable activity for investigation and documentation as to their cause and remediation, if required. The Administration shall have the right to inspect these policies and procedures and the Contractor or subcontractor’s performance to confirm the effectiveness of these measures for the services being provided under the Contract.

9) Ensure system and network environments are separated by properly configured and updated firewalls.

10) Restrict network connections between trusted and untrusted networks by physically or logically isolating systems from unsolicited and unauthenticated network traffic.

11) By default “deny all” and only allow access by exception.

12) Review, at least annually, the aforementioned network connections, documenting and confirming the business justification for the use of all service, protocols, and ports allowed, including the rationale or compensating controls implemented for those protocols considered insecure but necessary.

13) Perform regular vulnerability testing of operating system, application, and network devices. Such testing is expected to identify outdated software versions; missing software patches; device or software misconfigurations; and to validate compliance with or deviations from the security policies applicable to the Contract. Contractor shall evaluate all identified vulnerabilities for potential adverse effect on security and integrity and remediate the vulnerability no later than 30 days following the earlier of vulnerability’s identification or public disclosure, or document why remediation action is unnecessary or unsuitable. The Administration shall have the right to inspect the Contractor’s policies and procedures and the results of vulnerability testing to confirm the effectiveness of these measures for the services being provided under the Contract.

14) Enforce strong user authentication and password control measures to minimize the opportunity for unauthorized access through compromise of the user access controls. At a minimum, the implemented measures should be consistent with the most current Maryland Department of Information Technology’s Information Security Policy (https://doit.maryland.gov/policies/Pages/default.aspx), including specific requirements for password length, complexity, history, and account lockout.

15) Ensure State data is not processed, transferred, or stored outside of the United States (“U.S.”). The Contractor shall provide its services to the State and the State’s end users solely from data centers in the U.S. Unless granted an exception in writing by the State, the Contractor shall not allow Contractor Personnel to store State data on portable devices, including personal computers, except for devices that are used and kept only at its U.S. data centers. The Contractor shall permit its Contractor http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401vend.htm https://doit.maryland.gov/policies/Pages/default.aspx

IFB for MDOT MTA Page 17 of 104

Personnel to access State data remotely only as required to provide technical support.

16) Ensure Contractor’s Personnel shall not connect any of its own equipment to a State LAN/WAN without prior written approval by the State, which may be revoked at any time for any reason.