Amendment_5_QA_Response_RFQ32110-00811_Cellular_Services_Devices_and_Business_Solutions_9_3_kw.pdf

DATE: SEPTEMBER 3, 2024

RFQ # 32110-00811 IS AMENDED AS FOLLOWS:

1. This RFQ schedule of Events updates and confirms scheduled RFQ dates. Any event time, or date containing revised or new text is highlighted

2. State Responses to Submitted Questions and Comments in the Table Below Amend and Clarify this RFQ.

STATE OF TENNESSEE

CENTRAL PROCUREMENT OFFICE

REQUEST FOR QUALIFICATIONS# 32110-00811

AMENDMENT # 5

CELLULAR SERVICES, DEVICES, AND BUSINESS

SOLUTIONS

EVENT

TIME

(Central Time

Zone)

DATE

(all dates are State business days)

1. Post RFQ 32110-00811 July 18, 2024

2.

Disability Accommodation Request

Deadline

July 22, 2024

3. Pre-Response Conference 2:00 p.m.

July 25, 2024

4.

Notice of Intent to Respond

Deadline 2:00 p.m.

July 29, 2024

5.

Written “Questions & Comments”

Deadline 2:00 p.m.

August 1, 2024

6.

State response to written “Questions

& Comments”

September 3, 2024

7.

RFQ Technical/Cost Response

Deadline 2:00 p.m.

September 13, 2024

8.

State Notice of Qualified

Respondent(s) Released

September 27, 2024

9. RFQ Competitive Negotiations October 4, 2024

10.

State Notice of Intent to Award

Released and RFQ Files Open for

Public Inspection

October 7, 2024

11. End of Open File Period October 14, 2024

12.

State send contract to Contractor(s) for signature

October 17, 2024

13.

Contractor contract signature

Deadline

October 21, 2024

QUESTIONS AND ANSWERS

RFQ32110-00811 CELLULAR SERVICES, DEVICES, AND BUSINESS SOLUTIONS

RFQ SECTION PAGE QUESTION/COMMENT STATE RESPONSE

Schedule of Events Page7 Would the State consider a two-week extension of the response due date?

Amendments 1, 2, 3 and 4 were issued changing several due dates

Section 3.3.2.2. Page11 What is the maximum size attachment your email server accepts? If our response is over that limit, requiring us to create multiple files, should we add to the subject of the email and file name RFP #32110- 00811 Technical Response (Respondent Name), 1 of X, 2 of X, etc.?

Max size is 25MB (including attachments and email body text).

Respondent may submit multiple submissions in order to deliver the entire RFQ response.

Award Section 5.5

– Evaluation Guide

Page 20 For an email submission, is it acceptable for proposers to submit the evaluation guide tables as a separate document attachment with our response?

Yes

Section A- Mandatory Requirements A.9

Page 24 Confidentiality agreements limit the information that can be provided, what will the state accept as documentation to meet this requirement

Any of the following: -A Contract Document (state local or Coop) that includes the 3000 requirement, -A report provided to the customer that shows the number of users. A contact and contact information the State may use to contact an individual that can provide user numbers. -A letter from a state agency/Local Entity containing the number of users.- or any other correspondence, report or document that demonstrates that the respondent satisfies the requirement.

Section A- Mandatory Requirements A.10

Page 24 Confidentiality agreements limit the information that can be provided, what will the state accept as documentation to meet this requirement

Any of the following: - State Contract ID Number from individual States and or “Authorized Users.” -Name of a Contact and contact information to contact for information. -Contract ID numbers of Participating Addendums from Cooperatives such as NASPO, Omnia, Sourcewell, and others that identify the State or Local entity. -Reports and or correspondence that demonstrates the existence/completion of a contract. – Any other correspondence, report or document to support the requirement.

Mandatory Requirements Section A.12 Mandatory Requirements

Page 24 Contractor’s employees and subcontractors supporting this contract for technical, contractual, fulfillment, trouble shooting, and invoicing/billing services are to be located in the United States.

Notwithstanding the previous statement, services under this Contract relating to help desk services and support, system maintenance, and order processing review may be performed outside of the United States.

All State data must remain in the United States, regardless of whether the data is processed, stored, in-transit, or at rest.

Access to State data shall be limited to US-based (onshore) resources only.

Configuration or development of software and code is permitted outside of the United States. However, software applications designed, developed, manufactured, or supplied by persons owned or controlled by, or subject to the jurisdiction or direction of, a foreign adversary, which the U.S. Secretary of Commerce acting pursuant to 15 CFR 7 has defined to include the People's Republic of China, among others are prohibited.

Any testing of code outside of the United States must use fake data. A copy of production data may not be transmitted or used outside the United States.

The State declines to make the requested change

Attachment B Section B-General Qualifications & Experience Items.

B.13

Page 28 Will the state accept bio's/executive summaries for team members rather than resumes due to privacy and confidentiality concerns

Summaries are acceptable as long as they contain the information required by B.13. PII data is to be excluded from the information requested

ATTACHMENT D

Cost Proposal & Evaluation Guide Service Plans for Public Safety Plans

Page 38/39 Response Smartphone plans are not throttled. Does State of Tennessee expect all smartphone and Connected Device (i.e., tablets, iPads, Modems, Hotspots/MiFi) plans to be "not throttled."

Yes, all First Responder plans are to be unthrottled.

Attachment D Cost Proposal

Page 39 Does the State have a spreadsheet they would like filled out with the appropriate plans in addition to the included table?

Attachment 3 to Pro Forma contract asks the respondent to list all Service Plans respondent makes available to States in addition to the Plans listed in the Cost Proposal.

Ref. ATTACHMENT F-Reference Questionnaire

Page 45 “RFP # 32110-37101 REFERENCE QUESTIONNAIRE” Can you confirm this should be RFQ#32110-00811?

The correct RFQ number is RFQ # 32110-00811

Pro Forma A.3.h. Page 51 What defines "inoperable" in this context? Please clarify.

Broken (accidental damage, hardware failure, OS incompatibility & defects), stolen.

Pro Forma A.3.j Page 52 Bidder requests the State clarify Paragraph J. Cloud Hosting Statement by providing the STS Security and Risk Management exception process.

All applications that are non-Software as a Service (SaaS) applications and are not hosted in either the State’s Data Center or the State’s Cloud Tenant, must receive an STS Security and Risk Management written approval to be hosted elsewhere. The State will be responsible for obtaining any required internal exceptions and the Contractor is not responsible for obtaining this exception.

Pro Forma A.3.k Page 53 Bidder requests the State modify Paragraph K. Offshore Resource Statement to revise the offshore restrictions in the RFQ as redlined below. While the Bidder will not store any State data outside of the United States, certain services relating to help desk support, system maintenance and order processing may be performed outside of the United States by the Bidder and/or by third party providers for Business Solution software (Section A.13) and MDM applications requested by the State.

k. Offshore Resources Statement:

Unless otherwise agreed in writing by the parties, the Contractor and its subcontractors will not perform any of the services under this Contract from outside of the United States.

Refer to the States response to the Mandatory Requirements section A.12. above referencing Page 24.

Notwithstanding the previous statement, services under this Contract relating to help desk services and support, system maintenance, and order processing review may be performed outside of the United States.

(1) All State data must remain in the United States, regardless of whether the data is processed, stored, in-transit, or at rest.

(2) Except as stated previously above, access to State data shall be limited to US-based (onshore) resources only.

(3) Configuration or development of software and code is permitted outside of the United States. However, software applications designed, developed, manufactured, or supplied by persons owned or controlled by, or subject to the jurisdiction or direction of, a foreign adversary, which the U.S. Secretary of Commerce acting pursuant to 15 CFR 7 has defined to include the People’s Republic of China, among others are prohibited.

(4) Any testing of code outside of the United States must use fake data.

Except as stated previously above, a copy of production data may not be transmitted or used outside the United States.

Pro Forma A.13/A.14.(a)/A.3.( k)

Page 53 Regarding Business Solutions, the Bidder wants to clarify that certain MDM and Business Solutions do not meet the State’s requirements listed in section A.3(k). Will the State consider changing these requirements?

The state’s current MDM solution does meet the requirements listed in A.3. k.

All State data must remain in the United States, regardless of whether the data is processed, stored, in-transit, or at rest.

Access to State data shall be limited to US-based (onshore) resources only.

Configuration or development of software and code is permitted outside of the United States. However, software applications designed, developed, manufactured, or supplied by persons owned or controlled by, or subject to the jurisdiction or direction of, a foreign adversary, which the U.S. Secretary of Commerce acting pursuant to 15 CFR 7 has defined to include the People's Republic of China, among others are prohibited.

Any testing of code outside of the United States must use fake data. A copy of production data may not be transmitted or used outside the United States.

Pro Forma A.4.c. Page 53 If a Carrier does not have a non-roaming network in Nashville, would overnight delivery satisfy this requirement

Local stock is a requirement of the State of TN for expedited requests.

Pro Forma A.4.d Page 53

Contractor no longer supports hardcopy delivery of customer setup sheet. Will the State allow the customer setup sheet to be delivered electronically to support green initiatives?

Yes, so long as the electronic delivery contains all information that is requested on the paper copy, and the vendor can modify the information sent electronically at the state’s request per A.4.d pg 53

Pro Forma A.4.h. General ITSM

Can the State provide details on existing API's available into the current ITSM platform?

There are hundreds of potential API’s available. We utilize the REST API tool in ServiceNow to customize a solution based on a internal customer’s need.

Pro Forma A.4.h.

and C.5.a.8

Page 54/62 We request that any change to the existing ITSM process include language allowing for a compatibility review, perhaps “to be agreed upon” similar to as shown in the secure bill delivery section (C.5.a.1.).

The ITSM platform is an enterprise- wide solution that STS is not the only stakeholder on the product chosen. Out of the box, there are hundreds of potential API’s available. We utilize the REST API tool in ServiceNow to customize a solution based on an internal customer’s need.

Pro Forma A.10.a.

and A.10.b.

Bidder requests the State modify section a, regarding notice for planned network outages to revise the requirements in the RFQ as redlined below.

a. The Contractor will provide the State’s named contacts with a minimum two-week forty-eight

(48) hour advanced notification when practicable of planned network outage or maintenance. The advanE.10ced notification must include the geographical area affected, the expected impact to normal service operations, and the expected start and end time of the maintenance, including the time when network services are expected to be returned to normal service operational thresholds.

Bidder requests the State modify section b, regarding updates for unplanned network outages to revise the requirements in the RFQ as redlined below.

b. Contractor will provide the State’s named contacts with notification of an unplanned network event (in accordance with the Contractor’s

The state declines to make this change (see Schedule).

Disaster Recovery Plan) within one (1) two (2) hours of the Contractor’s confirmation that there is an unplanned disruption of normal service operations and an estimated time to restoration of normal service operational thresholds. The Contractor will provide access to a network status portal that will provide updates for to the State’s named contacts every half hour until service is restored.

Pro forma A.14.d/ C.5. b.3.

Page 59/62 Conflicts in Tax application conflict between References A.14.d and C.5.b.3

There is no conflict.

(C.5.d.3) Sales & Use, Property, Income, Excise & franchise Taxes are not the same as (A.14.d.)

Appropriate Taxes, Fees and Surcharges-such as the Universal Service Fund (USF), and other Regulatory Fees.

Pro Forma

GENERAL

Ordering from Supplier

What is the expected timeframe between an agency order and STS submitting the order to the vendor?

Once agency approval on the order is given, the current SLA for Review order tasks is 76 hours.

Pro Forma C.5 Invoice Requirements

Page 61 Does the State foresee any changes to the data field mapping for invoice submission different from the current contract?

At this time, there are no foreseen changes.

Pro Forma C.5.a.2. Page 61 Regarding “Invoice must be received by the last day of the month for the previous billing cycle”. Will the State consider the language be revised to say the invoice must be received 15 days after the end of the billing cycle?

Billing cycle dates can vary whereas the end of the month may not be a feasible timeframe for a bill cycle close mid-month.

No, the file can’t be received after the last day of the month. The billing cycle should be set to allow the vendor enough time to send the billing file by the last day of the month.

Pro Forma C.5.a.4 Page 61 Regarding “Upon satisfactory completion of a ninety (90) calendar day billing acceptance period, the State’s billing services team shall issue written notification of billing acceptance.” Does this mean the initial 90 days after contract

The initial 90-day acceptance period after contract is accepted.

acceptance only or 90 days after each bill submission?

Pro Forma C.5.d.5. Page 63 Number 5 states, “The Contractor cannot submit new charges to the State that are outside of the State’s fiscal year which runs July 1 to June 30.” Contractor submits invoices in July for services utilized in June. Please clarify the requirement.

The intention of this clause is to prevent the vendor from billing for services that are grossly outside the billing period.

For example, billing in November for a service period of February.

This clause does not apply to normal billing operations.

Contractor submits invoices in July for services utilized in June.

This is acceptable as the contractor is finishing the billing cycle for a fiscal year.

Pro Forma C.9.a.2.

Please define level III data reporting that the contractor is required to provide.

The State will not pay invoices via a Purchasing Card (C.9.a.(2)) for any contracts resulting from this solicitation.

Therefore, the State will not require any Level lll data.

Pro Forma D.32 Crime Insurance Page.74

Please provide a definition as to cyber theft and extortion.

Cyber theft and extortion: The contractor’s crime insurance policy should include coverage for financial losses sustained by the contractor, or a third-party client/customer of the contractor, flowing from digital theft or ransomware attacks that hold data, website, computer systems, or other sensitive information hostage until a ransom payment is made to the attacker.

Pro Forma E.10.a.2.

Hosted Data

Page 76 Bidder requests the State modify section a.(2), regarding Federal Information Processing Standard to revise the requirements in the RFQ as redlined below. While Bidder maintains the highest level of encryption available under the 3GPP industry standards for cellular traffic encryption, Bidder is not the manufacturer of hardware.

a.(2). The Contractor shall encrypt Confidential State Data at rest and in transit using the highest level of encryption and algorithms available under the 3GPP industry standards for cellular traffic encryption current version of Federal Information Processing Standard (“FIPS”) 140-2 or 140-3 (current applicable version) validated encryption technologies. The State shall control all access to encryption keys. The Contractor shall provide installation and maintenance support at no cost to the State.

The state will not consider any redlines during the Question and Answer period of the Solicitation (see

Pro Forma E.10.a.3 Hosted Confidential Data

Page 77 a.(3). The Contractor and the Contractor’s processing environment containing Confidential State Data shall maintain a cybersecurity program that shall either (1) be in accordance with at least one of the following security standards: (i) International Standards Organization (“ISO”) 27001;………….

The State declines to make this change

Pro Forma E.11 Pll Page 79 Bidder requests the State modify this section to revise the requirements in the RFQ as redlined below.

(i) keep PII confidential and may use and disclose PII only as necessary to carry out those specific aspects of the purpose for which the PII was disclosed to Contractor and in accordance with this Contract, GLBA and Privacy Laws;

and (ii) implement and maintain appropriate technical and organizational measures regarding information security to: (A) ensure the security and confidentiality of PII; (B)

The state will not consider any redlines during the Question and Answer period of the Solicitation (see protect against any threats or hazards to the security or integrity of PII; and (C) prevent unauthorized access to or use of PII. Contractor shall immediately promptly notify State: (1) of any disclosure or use of any PII by Contractor or any of its employees, agents and representatives in breach of this Contract; and (2) of any disclosure of any PII to Contractor or its employees, agents and representatives where the purpose of such disclosure is not known to Contractor or its employees, agents and representatives. [. . .] The Contractor shall report to the State any instances of unauthorized access to or potential disclosure of PII in the custody or control of Contractor (“Unauthorized Disclosure”) that come to the Contractor’s attention. Any such report shall be made by the Contractor within twenty-four (24) hours after the Unauthorized Disclosure has come to the attention of the Contractor.

Contractor shall take all necessary measures to halt any further Unauthorized Disclosures. The Contractor, at the sole discretion of the State, shall provide no cost credit monitoring services for individuals whose PII was affected by the Unauthorized Disclosure. The Contractor shall bear the cost of notification to all individuals affected by the Unauthorized Disclosure, including individual letters and public notice. The remedies set forth in this Section are not exclusive and are in addition to any claims or remedies available to this State under this Contract or otherwise available at law.

The obligations set forth in this Section shall survive the termination of this Contract. Notwithstanding anything to the contrary, nothing in this Contract shall be read to prohibit Contractor’s release of data or records in response to lawful U.S. process and/or as may be required by state or federal law.

Pro Forma E.13 Page 81 The requested detail’s for the quarterly report directly conflicts with the State’s confidential data and personally identifiable information requirements.

The quarterly report line items needs to be revised to remove references to authorized users and non-state entities to comply with the State’s requirements and CPNI FCC rules and regulations.

The Quarterly Report does not ask for any “PERSONS” personal information only for the state agency name/location/spend/pr oduct or service, etc. and Authorized User as defined in E.12 (entities such as a school district name/location/spend/pr oduct or service, etc. and not specific people).

Pro Forma E.15 Page 82 How will the State calculate the 1% fee, and will we receive a detailed invoice?

The fee is one percent (1.0% or 0.01) of the total sales derived from State Agencies plus those local “Authorized Users” that are using this Statewide Contract.

The Contractor will not receive an invoice.

3. RFQ Amendment Effective Date. The revisions set forth herein shall be effective upon release.

All other terms and conditions of this RFQ not expressly amended herein shall remain in full force and effect.