AMENDMENT No 4_RFP S-DASOBO-00008678_OLCC DSSC_FINAL FOR RELEASE.docx

AMENDMENT NO. 4 to RFP S-DASOBO-00008678 (“RFP”) | OLCC DSSC April 8, 2024

The purpose of this Amendment No. 4 (“Amendment”) to the RFP is to:

1. Declare completion of the first round of scored evaluation (“Round 1”) and disclose the final Round 1 scores and Proposer ranking. The following three (3) organizations are the only Proposers submitting Proposals in response to the RFP. The Department of Administrative Services (“DAS”) deemed each Proposal Responsive for scored evaluation:

a. Accenture

b. Deloitte

c. Encompass Tech Final, high-level Round 1 scores for each Proposer are set out in the table below. Proposers are listed in order of highest Round 1 score to lowest. A Microsoft Excel Spreadsheet reflecting more detailed scoring by scored component is included as an embedded document object inserted below the Round 1 Ranking Table.

2. Establish the Competitive Range for Round 2 Scored Evaluation.

a. DAS and the Oregon Liquor and Cannabis Commission (“OLCC”), together the “State”, have determined to establish a second round of scored evaluation (“Round 2”) involving a Competitive Range limited to the two top-ranking Proposers (“Competitive Range Proposers” or “Finalists”).

i. The State find best value in limiting the balance of evaluation in the procurement to Accenture and Deloitte. The Round 1 scoring results demonstrate a clear separation between the two top-ranking Proposers and the other Proposer evaluated in Round 1. The two top-ranking Proposers each received approximately 82% of the available Round 1 points for Administrative and Technical Proposal evaluation – a metric that presents a compelling natural break in the distribution of scores.

ii. Competitive Range Protest. Under Section 4.12.2 of the RFP, Proposers excluded from a round may submit a Written protest of Competitive Range. Protests must be sent by an authorized representative, be emailed to the Single Point of Contact (“SPC”) for the procurement, be received within 7 calendar days after issuance of the Notice of Competitive Range (unless a different due date and time is specified in such notice), and must:

1. Reference the RFP number;

2. Identify Proposer’s name and contact information; and

3. State the reason for the protest.

DAS will address all protests within a reasonable time and will issue a Written decision to the respective Proposer. Protests that do not include the required information may not be considered by DAS.

3. Round 2 Evaluation.

a. Section 4.13 of the RFP lists diverse means for further evaluating Competitive Range Proposers in subsequent rounds. The State will use Round 2 to leverage several options from such list. These Round 2 evaluation components may have different submission dates, and the round will not conclude until all required evaluation components have been received and evaluated according to requirements in this RFP Amendment or subsequent RFP Amendments.

b. The Round 2 evaluation components addressed in this Amendment include:

i. Revised Price Proposal (Up to 3,000 Points).

1. Round 1 submission requirements obligated Proposers to submit a Price Proposal. The Competitive Range Proposers complied with the requirement. In the RFP, the State deferred scoring such submissions to a subsequent round of competition. The RFP gives the State the option to evaluate the original or a revised submission of Proposer’s RFP Attachment E, Price Proposal Worksheet, and for the quantum of points and by means identified via RFP Amendment(s). The Competitive Range Proposers are therefore required to submit revised Price Proposals in the context of the Requirements depicted in the RFP and the approach and methodologies the Proposer will follow in implementing, deploying, operating and maintaining its proposed DSSC Solution.

2. Competitive Range Proposers must submit Revised Price Proposals via email transmission to the Single Point of Contact (“SPC”) by 5:00 p.m. Pacific Time on April 19, 2024. They must use as a baseline the form embedded as a Microsoft Excel Document Object below but may reasonably modify such form as deemed appropriate to enter its required Revised Price Proposal.

3. In addition to revealed dollar amounts Revised Price Proposals must address the following:

a. Provide a detailed breakdown of the initial licensing purchase and annual operations and maintenance (“O&M”) costs.

b. Describe in detail the included components of O&M Services. For example, the number of annual enhancements included.

c. Break cost down by demonstration component area as follows:

i. ERP

ii. WMS

iii. POS

iv. Support-Call Center-Hardware-Dashboard

4. Price Proposal Scoring. In the RFP, the State reserved the right to score Price Proposals on the basis of mathematical formulae, or without mathematical formulae but ranked in descending order from lowest price to highest with a predetermined number of points awarded based on ranking below the lowest price, or through a subjective evaluation of price. State has determined to use a combination of (i) a mathematical formula applied in a certain manner to reflect a qualitative perspective, and (ii) a subjective evaluation of price through three (3) areas of inquiry.

a. Mathematical Formula Applied to Total Cost (1,500 Points) Price points for “Total” proposed price will be awarded on the basis of the above formula. “A”, the available cost points for the Proposer, is the total of 1,500 Points reduced by the percentage of points not awarded for all other non-cost scored elements in Round 2. For example, if a Proposer receives 80% of all possible non-cost points in Round 2, then that Proposer has 1,200 available cost points (80% of 1,500).

b. Subjective Evaluation Through Three (3) Areas of Inquiry (1,500 Points)

i. Reasonableness of Cost (750 Points). For example:

1. How well do the costs relate to the Services Proposer will provide in the context of all Requirements and Proposer Administrative and Technical Proposal responses?

2. Do Proposer personnel position titles and hourly rates reflect the resumes, the list of key persons and other staff through whom Proposer will provide required Services?

ii. Transparency of Cost (350 Points). For example:

1. How traceable are proposed costs to required Proposer Tasks and Deliverables?

2. How inclusive are proposed costs, i.e., is every required item clearly priced out or do there appear to be hidden costs and excluded or unpriced items?

iii. Flexibility of Cost Model (400 Points). For example:

1. Are proposed costs sufficiently unbundled to allow the agency to make reasonable business decisions regarding rollout of a reduced configuration of features and functions for purposes of affordability?

2. What is the ease of determining alternative cost models?

The manner of scoring for these “subjective” price assessments will be consistent with the process for non-price scoring set out in RFP Attachment M under “evaluation criteria”.

ii. Demonstrations. (Up to 15,000 Points).

1. An important focus in Round 2 will be on evaluating the performance of the Competitive Range Proposers’ respective solutions in the context of four (4) demonstration components as follows:

a. Enterprise Resource Planning (ERP);

b. Warehouse Management System (WMS);

c. Point-of-Sale System (POS); and

d. Support-Hardware-Dashboard.

More detail regarding demonstration components is depicted in the MS Excel Spreadsheet embedded document object, OLCC DSSC Demonstration Matrix, inserted below. Within each of the four (4) demonstration components there is a list of particular functional areas (shaded gray in bold text) and in selected functional areas a short list of suggested items (indented and in regular text).

There is also a Customer Request Order | Special Order scenario to consider when demonstrating functional areas to which such scenario may apply.

2. It is the desire of the State to conduct such demonstrations (“Demonstration Day”) During the week of April 22, 2024, but excluding Monday of that week.

A maximum of 15,000 points is available for award, a maximum of 3,750 for each demonstration component. The manner of scoring for a Proposer’s Demonstration Day will be consistent with the process for non-price scoring set out in RFP Attachment M under “evaluation criteria”.

3. Demonstration Days. The State currently plans to set aside one Demonstration Day for each Competitive Range Proposer during the week of April 22, 2024, excluding Monday, April 22, 2024.

a. Each Competitive Range Proposer is responsible for setting up, hosting, and conducting its Demonstration Day as a webinar.

b. On its scheduled Demonstration Day, a Competitive Range Proposer will have up to 6 hours to present all required demonstration components. There will be a morning session from 9:00 a.m. Pacific Time to Noon Pacific Time, and an afternoon session from 1:30 p.m. to 4:30 p.m. Pacific Time.

i. The listed demonstration requirements are in no particular order, and Competitive Range Proposers are free to determine the manner, means and sequencing of presentations between morning and afternoon sessions.

ii. There is no requirement for a Competitive Range Proposer to use all available time for the required demonstrations.

1. A Competitive Range Proposer may complete its demonstrations within the context of a single session, morning or afternoon; or

2. May determine to present in both sessions but using less time than allotted in one or both scheduled sessions.

4. Demonstration Day Submissions.

a. Each Competitive Range Proposer must reply by 5:00 p.m. Pacific Time on Friday, April 12, 2024, to the SPC via email with a list of days in descending order from most to least desired for the period of April 23, 2024, to April 26, 2024. State will try to avoid scheduling Competitive Range Proposers for their least desired Demonstration Day.

b. Each Competitive Range Proposer must submit its Demonstration Day webinar connection details to the SPC via email at least one business day in advance of its scheduled Demonstration Day.

c. By the common deadline of 8 a.m. Pacific Time on April 23, 2024, each Competitive Range Proposer must provide to the SPC via email transmission the following items:

i. Demonstration Day Agenda, Schedule, and identification of participating personnel by name and position;

ii. An electronic copy of its demonstration presentation materials, for example:

1. Slide deck;

2. Relevant documentation regarding particular demonstrated features and functions;

3. Relevant screen shots, and so on;

iii. Completed RFP Attachment J, Statewide Information and Cyber Security Standards Spreadsheet. (See item iii below).

iv. Completed RFP Attachment A, Sample Contract, Redlines. (See item iv below).

iii. RFP Attachment J, Statewide Information and Cyber Security Standards Spreadsheet. (Not Scored).

iv. Contract Redlines Exercise. (Up to 300 Points).

Under RFP Section 5.4.1, Negotiation, State clearly sets out its expectation that each Proposer develop and submit its Proposal, including pricing, based on the terms of the Sample Contract set forth at RFP Attachment A-1; including expectations for indemnity, limitations of liability, and insurance requirements. Notwithstanding this expectation, State indicates in RFP Section 5.4.1 that It may be possible to negotiate all provisions of the final Contract, except those listed below:

1. Choice of law,

2. Choice of venue,

3. Constitutional requirements, and

4. Any and all federal and state laws, and their implementing administrative rules, requirements, and policies and procedures.

In the event that the parties have not reached mutually agreeable terms within 90 calendar days of the date of the Notice of Intent to Award, DAS PS may terminate Negotiations and commence Negotiations with the next highest-ranking Proposer.

In order to expedite the contract negotiation process with the Proposer selected for Contract award, State has determined to require Proposers to provide Sample Contract “Redlines” as part of their Round 2 submissions.

Subject to the four exceptions listed in iv. 1. to iv.4. above, Proposers may either submit the Sample Contract in its entirety with redlines; or a separate document setting out just those redlined Sample Contract provisions, exhibits and attachments that Proposers wish to negotiate with State. A copy of the Sample Contract, RFP Attachment A, is embedded as a document object below:

Regardless of the manner of submission, Sample Contract Redlines must clearly show deletions from, and insertions to, the affected Sample Contract provisions, exhibits and attachments, e.g., strikethrough text for deletions and bold underlined text for insertions.

State will score submitted Sample Contract Redlines in Round 2 for up to 300 points according to the evaluation criteria set out in this Attachment 5 to the Amendment.

The Sample Contract Redlines submission must include tracked changes for any proposed modifications to Sample Contract provisions, exhibits and attachments, and within the context of the parameters for good faith negotiation set out in the RFP in its Section 5.4. State wants to avoid having to negotiate:

1. Supplemental terms and conditions (such as conditions for use of Contractor Intellectual Property not related to type, scope, or access);

2. Extensive changes to provisions within the Sample Contract (e.g., no more than fifteen (15) different provisions (including exhibits and attachments);

3. Substantive changes in general; or

4. Material changes to critical terms and conditions.

State will rely on advice and counsel from their Department of Justice attorneys to determine “extensive”, “substantive”, and “material” proposed changes.

State will award up to 300 Points on the following basis:

SAMPLE CONTRACT REDLINES RATING SCALE

Level 1 – 5 (Ascending order from worst to best) Value Ceiling (Portion of Maximum Total Points) Explanation

4. Means of Submission of Round 2 Documentation.

a. Electronic Mail Submissions

i. The preference is for emailed submissions to the SPC at nicholas.betsacon@das.oregon.gov

b. Email System Limitation

i. The email system available to the SPC will not accept a single email transmission beyond 25 MB in size. Proposers should separate oversized files for submission in two (2) or more transmissions. The system does not alert me of any email rejection.

ii. Therefore, a Proposer should first submit to me an email message with no attachments alerting me that Proposal submissions are about to be transmitted to me in “X” number of emails; and a concluding email with no attachments asking for confirmation of receipt.

iii. In the event you do not receive timely confirmation of receipt from me, i.e., within 1 hour of your final submission, please follow up via phone call to me at (503) 267-6636.

c. Redacted Submissions

i. If Proposer believes any of its submissions are exempt from disclosure under Oregon Public Records Law (ORS 192.311 through 192.478), Proposer shall use the Disclosure Exemption Affidavit, RFP Attachment B, to identify the desired exclusions. Proposer shall also submit a fully redacted version of such submissions, clearly identified as redacted versions.

5. Conclusion

a. Please acknowledge receipt via reply email to me.

b. List of submission deadlines:

i. Competitive Range Protest: 7 calendar days from date of Notice of RFP Amendment 4.

ii. Listed Demonstration Day Preferences: April 12, 2024, by 5:00 p.m. PT.

iii. Revised Price Proposal: April 19, 2024, by 5:00 p.m. PT.

iv. Demonstration Day Submissions (including completed Cyber Security Standards Spreadsheet and Sample Contract Redlines): April 23, 2024, by 8:00 a.m. PT.

c. You may pose written questions to me via email regarding the content of this Amendment No. 4 through April 12, 2024.

d. Many thanks to all three (3) Proposers for your patient participation in the process to date.

Nick Betsacon Single Point-of-Contact (SPC)

(503) 267-6636 nicholas.betsacon@das.oregon.gov

Bid Amendment No. 4 to RFP-S-DASOBO 00008678 OLCC DSSC image3.emf

5_S-DASOBO-00008678_RFP_Attachment_E_PRICE_PROPOSAL DOJ FINAL.xlsx Instructions

ATTACHMENT E

OLCC DISTILLED SPIRITS SUPPLY CHAIN SOLUTION

Price Proposal Instructions

A Proposer wishing to submit a response to this RFP MUST complete and submit a Price Proposal on this Attachment E.

WMS or ERP and POS Worksheets

Section Completion Instructions:

Implementation This section covers one-time implementation costs covering software, hardware, and implementation services through the completion of a warranty period.

Ongoing Services This section covers the ongoing software, hardware, hosting, and labor costs necessary to support the solution post warranty.

Optional Value Added Services This section covers any value added services proposed by a Proposer as a part of their response to this RFP.

Hardware Costs This section covers all hardware required to satisfy the Scope of Services in Attachment I3 and Solution Requirements in Attachment H3 of the RFP.

Transaction Fees This section covers any transaction fees required to satisfy the Scope of Services in Attachment I3.

POS Hardware and Spec Sheet

Proposed Hardware and Consumables

Enter information in each column for any hardware and consumables that are required for Proposer's POS solution. Hardware and consumables should be those that the Proposer recommends as the best fit and value for the Agency under the requirements of RFP.

Optional Hardware and Consumables

Enter information in each column for any hardware and consumables that may be available for purchase by Agency and Liquor Stores.

Rate Card

Complete the spreadsheet for all Proposer positions that may perform work.

For each worksheet, please fill in only the cells that are applicable to Proposer's Price Proposal. If needed, insert lines for additional costs, but do not delete or rename any lines in the worksheet.

&"Cambria,Bold"&10RFP S-DASOBO-00000159&"Cambria,Regular" – &"Cambria,Italic"LAS Replacement Project &"Cambria,Regular"&10Att E

Price Proposal

ATTACHMENT E

OLCC DISTILLED SPIRITS SUPPLY CHAIN SOLUTION

PRICE PROPOSAL

Implementation Year 1 Year 2 Year 3 Year 4 Year 5 Year 6 Year 7 Year 8 Year 9 Year 10 Total

One-time costs $ - 0

Licensing (initial) $ - 0

Implementation Services $ - 0

Total $ - 0 $ - 0 $ - 0 $ - 0 $ - 0 $ - 0 $ - 0 $ - 0 $ - 0 $ - 0 $ - 0

Ongoing Services Year 1 Year 2 Year 3 Year 4 Year 5 Year 6 Year 7 Year 8 Year 9 Year 10 Total

Hosting $ - 0

Maintenance & Support $ - 0

Licensing (annual) $ - 0

Total $ - 0 $ - 0 $ - 0 $ - 0 $ - 0 $ - 0 $ - 0 $ - 0 $ - 0 $ - 0 $ - 0

Hardware Costs Year 1 Year 2 Year 3 Year 4 Year 5 Year 6 Year 7 Year 8 Year 9 Year 10 Total

Initial Acquisition $ - 0

Other Hardware Costs $ - 0

Total $ - 0 $ - 0 $ - 0 $ - 0 $ - 0 $ - 0 $ - 0 $ - 0 $ - 0 $ - 0 $ - 0

Transaction Fees Fee Frequency Total

Credit/Debit $ - 0

ACH $ - 0

Other $ - 0

Otional Value Added Services Year 1 Year 2 Year 3 Year 4 Year 5 Year 6 Year 7 Year 8 Year 9 Year 10 Total

$ - 0

$ - 0

$ - 0

Total $ - 0 $ - 0 $ - 0 $ - 0 $ - 0 $ - 0 $ - 0 $ - 0 $ - 0 $ - 0 $ - 0

*Add rows as needed for each section

POS Hardware and Spec Sheet

ATTACHMENT E

OLCC DISTILLED SPIRITS SUPPLY CHAIN SOLUTION

POS PRICE PROPOSAL

POS HARDWARE AND SPECIFICATION SHEET

Proposed Hardware and Consumables

Hardware Name Brand/Manufacturer Model Number Part Number Unit of Measure Price Qty Total Notes

$ - 0

$ - 0

$ - 0

$ - 0

$ - 0

$ - 0

$ - 0

$ - 0

$ - 0

$ - 0

$ - 0

$ - 0

$ - 0

$ - 0

$ - 0

$ - 0

$ - 0

$ - 0

TOTAL $ - 0

Optional Hardware and Consumables

Hardware Name Brand/Manufacturer Model Number Part Number Unit of Measure Price Notes

Rate Card

ATTACHMENT E

OLCC DISTILLED SPIRITS SUPPLY CHAIN SOLUTION

PRICE PROPOSAL

RATE CARD

Title Job Description/Responsibilities Hourly Rate image4.emf image5.emf

OLCC DSSC RD2 DEMONSTRATION MATRIX.xlsx Demonstrations

Enterprise Resource Planning (ERP) Warehouse Management System (WMS) Point-of-Sale (POS) Support-Hardware-Dashboard

Inventory management Inventory management Transactions Support

Create/edit/delete items Create new item, set status Integrated credit card sale Overview of Support/Call Center Offering

Forecast inventory Parent/child association Return

Item pricing Item tracking Online order for licensees

Warehouse Receiving management Pricing Inventory Mangement Hardware

Delivery receiving Bailment Placing an order demonstration of proposed hardware and options available

TIN management Receiving management Receiving an order Agent Dashboard

Customer Request Orders | Special Orders Receiving deliveries Forecasting an order (min/max) predefined or standard reports and export options

Allocate reserved items Setting status Inventroy adjustment creating new ad hoc or standard reports

Update status TIN management Item sales history communications/ notifications

Inventory reconciliation/item tracking Warehouse Storage Classes Pricing data visualization

Any proposed hardware Create/assign storage classes Price changes

Analytics/Reporting Identify available space Related item sale or promotion

Liquor Agent accounts/Store profiles Customer Request Order | Special Order 5% discount to licensees

Liquor Agent dashboards Creating/editing/canceling a CRO

Liquor store inventory audits Picking Electronic Reporting

Liquor store ordering Wave Management Weekly sales

Product catalog Replenishment Transfers/Claims

Distilled spirits supplier online access Managing Suppliers

Receive and manage payments Managing Liquor Stores Customer Relationship Management

Liquor agent sales reporting Claims Add new licensee

Liquor agent compensation Inventory audits/cycle counts Edit licensee

Invoicing Proposed hardware Track licensee sales

Freight carrier management Freight carrier management

Freight carrier rates General Administration/Management tools

F/C Billing Adding notes Employee Time Management

Transportation Claims Reporting/analytics Security

CRO | Special Order Scenario:

Special Order Coordinator confirms request if item is in the system. If the item is not listed the Special Order Coordinator will research and reach out to the company to get quote, COLA and bottle image. Item is then set up in system and confirmed. Request could also be cancelled if not available for shipment to Oregon. CRO is updated as confirmed or cancelled.

If confirmed the Special Order Coordinator generates Suggested Replenishment (SR) request.

SR numbers are tied to the CRO’s sent in by stores. SR's are emailed to suppliers.

Once product is received it is allocated to the oldest open CRO. If all the product was received and sent the CRO is completed.

image6.emf

10_S-DASOBO-00008678_RFP_Attachment J_STATEWIDE SECURITY STANDARDS-corrected.xlsx Instructions

ATTACHMENT J TO RFP S-DASOBO-00008678 | OLCC DSSC SOLUTION | STATEWIDE INFORMATION AND CYBER SECURITY STANDARDS

This tool is provided to assist agencies in defining and gathering information security requirements. Agencies may have additional information security requirements required by law, regulations, or policies.

Requirements Template for Moderate Systems Description and Use Instructions:

The requirements are directly from the 2019 Statewide Information and Cyber Security Standards, as such the below sections are Static.

o Control (Column’s A-D) o Control Name (Column E): Control details can be viewed in the attached comment, or found in the 2019 Statewide Information and Cyber Security Standards.

o Applicability:

Low (All): (Column F)

Moderate (Column G)

Agency Task: Depending on agency preference, in consultation with Cyber Security Services BISO, agency can designate whether the control applies to on premise, off premise or both, in relation to the Agency.

o Location

On Premise (Column H)

Off Premise (Column I)

Proposer Task: Proposer will complete the remaining sections per instructions below.

o Requirement Implemented by (Columns J-L): Proposer responds to indicate if the control is the responsibility of the agency, the vendor, or if it is a shared control.

X: signifies the control is the responsibility of the entity

Blank: signifies the control is not the entity's responsibility o Vendor Control is (Columns M-P): The Vendor selects whether the control is provided as part of the Base solution, an Add-on, from a Third Party, or Not Supported

X: signifies where the control is provided

Blank: signifies the control is not provided o Comments (Column R): Proposer shall provide comments on how the control is met. If the control is not supported, please indicate compensating controls, or your Plan of Action and Milestones.

Requirements Template

CONTROL Control Name CONTROL ENHANCEMENT NAMES (are in caps) Applicability Location (in relation to Agency) Proposer Response

Requirement Implemented by Vendor Control is: How Control is Met. (If not supported, please indicate your Plan of Action and Milestones.)

All Moderate On Premise Off Premise Agency Vendor Shared (agency/vendor) Base Add-on Third Party Not supported Comments

Governance

PM-1 Information Security Program Plan

PM-4 Plan of Action and Milestones Process

Control Detail: Control Detail:

a.Implement a process to ensure that plans of action and milestones (see CA-5) for the agency security programs and associated organizational systems:

1.Are developed and maintained;

2.Document the remedial information security and privacy action to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the State; and 3.Are reported in accordance with established reporting requirements; and b.Review plans of action and milestones for consistency with organizational risk management strategy and organization-wide priorities for risk response actions X

PM-5 System Inventory

Control Detail: Control Detail:

Develop, document, and maintain an inventory of all organizational systems that create, collect, use, process, store, maintain, disseminate, disclose, or dispose of agency information to allow the agency to regularly review its information assets and ensure, to the extent reasonably practicable, that such information is accurate, relevant, timely, and complete.

a.Develop and maintain an inventory of all hardware assets whether connected to the Agency’s network or not (CIS-1.4).

1.Utilize an active discovery tool to identify devices connected to the Agency's network, and update the Agency's hardware asset inventory as appropriate(CIS-1.1);

2.Utilize a passive discovery tool to identify devices connected to the Agency’s network, and update the Agency’s hardware asset inventory as appropriate (CIS-1.2);

3.Where Dynamic Host Configuration Protocol (DHCP) is used, employ logging on all DHCP servers or IP address management tools to support updating the organization's hardware asset inventory (CIS-1.3);

4.Ensure that the asset inventory includes information determined to be necessary by the Agency to achieve effective property accountability, including but not limited to: i)Network address;ii)Hardware (MAC) address;iii)Machine name;iv)Asset owner (including agency, division, department, program, etc.);v)Date and time that the asset record was last updated in the inventory; andvi)Network connectivity that is authorized for the asset (CIS-1.5);

5.Ensure that unauthorized components are removed from the network, quarantined, or the inventory is updated to reflect that the component is unauthorized, in a timely manner(CIS-1.6);

6.Review and update the list of authorized components: i)Utilizing automated tools or manual processes;ii)At a minimum annually;iii)When required due to system upgrades or other significant changes; andiv)As an integral part of system component installations;

7.Maintain an up to date inventory of all Agency network boundaries (i.e. points of ingress and egress)(CIS-12.1): i)This inventory must include a list of all authorized wireless access points connected to the Agency’s network (CIS-15.1); and 8.The inventory must include a list of each of the organization’s authentication systems, including those located onsite or at a remote service provider (CIS-16.1); and b.Develop and maintain an inventory of all software that is required in the enterprise for any business purpose on any business system (CIS-2.1):

1.Ensure that only software applications or operating systems currently supported by the software's vendor are added to the Agency's authorized software inventory. Software currently in use and no longer supported must be identified as unsupported in the inventory system (CIS-2.2);

2.Utilize software inventory tools throughout the organization to support the documentation of all software on Agency systems (CIS-2.3);

3.Ensure that the following items are tracked in the software inventory system:i)Name;ii)Version;iii)Publisher;iv)Agency System Owner(s); v)Term / End of Support; andvi)Install date for all software, including operating systems authorized by the organization (CIS-2.4);

4.Tie the software inventory system to the hardware asset inventory so all devices and associated software are tracked(CIS-2.5) 5.Ensure that the inventory includes a list of each of the organization’s authentication systems, including those located onsite or at a remote service provider (CIS-16.1) 6.Ensure that unauthorized software is removed, or the inventory is updated to reflect that the software is unauthorized, in a timely manner (CIS-2.6); and 7.Review and update the list of authorized software programs:i)At a minimum annually;ii)When required due to system upgrades or other significant changes; andiii)As an integral part of system component installations X

PL-1 Planning Policy and Procedures

PL-2 System Security and Privacy Plans

Control Detail: Control Detail:

a.Develop system security plans that:

1.Are consistent with the organization’s enterprise architecture;

2.Explicitly define the authorization boundary for the system;

3.Describe the operational context of the system in terms of missions and business processes;

4.Provide the security categorization of the system including supporting rationale;

5.Describe the operational environment for the system and relationships with or connections to other systems;

6.Provide an overview of the security requirements for the system;

7.Identify any relevant overlays (e.g. manufacturer, name, IP address, etc.), for appropriate distribution, if applicable;

8.Describe the security controls in place or planned for meeting those requirements including a rationale for the tailoring decisions; and 9.Are reviewed and approved by the authorizing official or designated representative prior to plan implementation;

b.Distribute copies of the system security plan(s) and communicate subsequent changes to the plans to designated Agency personnel;

c.Review the system security plan(s) on an annual basis;

d.Update the security plan(s) to address changes to the system and environment of operation or problems identified during plan implementation or security control assessments; and e.Protect the security plan(s) from unauthorized disclosure and modification.

X

PL-2(3) PLAN AND COORDINATE WITH OTHER ORGANIZATIONAL ENTITIES

Control Detail: Control Detail:

Plan and coordinate security-related activities affecting the system with appropriate agency information security oversight, change management, and other stakeholders , before conducting such activities to reduce the impact on other organizational entities that may be affected by changes to the system. X

PL-4 Rules of Behavior

Control Detail: Control Detail:

a.Establish and provide to individuals requiring access to the system, the rules that describe their responsibilities and expected behavior for information and system usage, security, and privacy;b.Receive a documented acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the system;c.Review and update the rules of behavior at least every three years; andd.Require individuals to read and re-sign when the rules of behavior are revised or updated, or at least annually X

PL-4(1) SOCIAL MEDIA AND NETWORKING RESTRICTIONS

Control Detail: Control Detail:

Include explicit restrictions on the use of social media and networking sites, and the posting of organizational information on public websites X

PL-8 Security and Privacy Architectures

Control Detail: Control Detail:

a.Develop security architecture for the system that:

1.Describe the philosophy, requirements, and approach to be taken for protecting the confidentiality, integrity, and availability of organizational information;

2.Describe how the security architecture is integrated into and supports the enterprise architecture; and 3.Describe any security-related assumptions about, and dependencies on, external services;

b.Review and update the security architecture for the system every three years to reflect updates in the enterprise architecture, or any time there is a significant change to the system; and c.Reflect planned security architecture changes in the system security plan X

PL-10 Baseline Selection

Control Detail: Control Detail:

Select a control baseline (Low, Moderate, or Moderate +) for the system. X

PL-11 Baseline Tailoring

Control Detail: Control Detail:

Tailor the selected control baseline by applying specified tailoring actions. After selecting an appropriate control baseline, organizations initiate a tailoring process to align the controls more closely with the specific protection needs and concerns of their stakeholders, or local, state, and federal regulatory requirements. X

Risk

RA-1 Risk Assessment Policy and Procedures

RA-2 Security Categorization

Control Detail: Control Detail:

a.Categorize the system and information it processes, stores, and transmits;1.System classification must take into account:

i)The classification of the information received, stored, or processed:

(1)Level 1 Published: Low-sensitive information. Information that is not protected from disclosure, that if disclosed will not jeopardize the privacy or security of agency employees, clients, and partners. The disclosure, alteration, or destruction of Level 1 information generally has a low impact on security;

(2)Level 2 Limited: Sensitive information that may not be protected from public disclosure, but if made easily and readily available may jeopardize the privacy or security of agency employees, clients, or partners. The disclosure, alteration, or destruction of Level 2 information generally has a Low impact on security;

(3)Level 3 Restricted: Sensitive information intended for limited business use that may be exempt from public disclosure because, among other reasons, such disclosure will jeopardize the privacy or security of agency employees, clients, partners, or individuals who otherwise qualify for an exemption. Information in this category may be accesses and used by internal parties only when specifically authorized to do so in the performance of their duties. The disclosure, alteration, or destruction of Level 3 information generally has a moderateimpact on security; and (4)Level 4 Critical: Information that is deemed extremely sensitive and is intended for use by named individual(s) only. This information is typically exempt from public disclosure because, among other reasons, such disclosure would potentially cause major damage or injury up to and including death to the named individual(s), agency employees, clients, partners, or cause major Harm to the agency. The disclosure, alteration, or destruction of Level 4 information generally has a highimpact on security; and ii)The FIPS 199 categorization of the system;

b.Document the security categorization results including supporting rationale, in the system security plan; and c.Verify that the authorizing official or designee reviews and approves the security categorization decision. X

RA-3 Risk Assessment

Control Detail: Control Detail:

a.Conduct a risk assessment, including the likelihood and magnitude of harm, from:1.The unauthorized access, use, disclosure, disruption, modification, or destruction of the system, the information it processes, stores, or transmits, and any related information; and2.Problems arising from the processing of regulated data;

b.Document risk assessment results in a risk assessment report;

c.Disseminate risk assessment results to designated personnel as defined in the System Security Plan; and d.Update the risk assessment at a minimum every three years, or when there are significant changes to asystem, its environment of operation, or other conditions that may impact security. X

RA-3(1) SUPPLY CHAIN RISK ASSESSMENT

Control Detail: Control Detail:

a.Assess supply chain risks associated with systems, system components, and system services; and b.Update the supply chain risk assessment at a minimum every three years, or when there are significant changes to the relevant supply chain, when changes to the system, environments of operation, or other conditions may necessitate a change in the supply chain. X

RA-5 Vulnerability Scanning

Control Detail: Control Detail:

a.Scan for vulnerabilities using a current SCAP-compliant scanning tool on the system and hosted applications at least weekly, and when new vulnerabilities potentially affecting the system/applications are identified and reported(CIS-3.1);

b.Employ vulnerability scanning tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for:

1.Enumerating platforms, software flaws, and improper configurations;

2.Formatting checklists and test procedures; and 3.Measuring vulnerability impact;

c.Analyze vulnerability scan reports and results from any additional security control assessments;

d.Remediate legitimate vulnerabilities in accordance with an organizational assessment:

1.Utilizing a risk-rating process to prioritize the remediation of discovered vulnerabilities; and (CIS-3.7); and 2.Comparing the results from back-to-back vulnerability scans to verify that vulnerabilities have been remediated in a timely manner (CIS-3.6);

e.Share information obtained from the vulnerability scanning process and security control assessments with designated agency officials to help eliminate similar vulnerabilities in other systems (i.e., systemic weaknesses or deficiencies); and f.Employ vulnerability scanning tools that include the capability to regularly update the vulnerabilities to be scanned. X

RA-5(2) UPDATE BY FREQUENCY, PRIOR TO NEW SCAN, OR WHEN IDENTIFIED

Control Detail: Control Detail:

Update the system vulnerabilities to be scanned prior to a new scan, or when new vulnerabilities are identified and reported. X

RA-5(5) PRIVILEGED ACCESS

Control Detail: Control Detail:

a.Perform authenticated vulnerability scanning with agents running locally on each system, or with remote scanners that are configured with elevated rights on the system being tested, with the exception of systems where this is not feasible and such exceptions are approved by Agency System Owner or designee, and documented (CIS-3.2);

b.Use a dedicated account for authenticated vulnerability scans. Such accounts must not be used for any other administrative activities (CIS-3.3); and c.Where feasible, tie the account used for authenticated vulnerability scans to specific machines, at specific IP addresses (CIS-3.3). X

RA-7 Risk Response

Control Detail: Control Detail:

Respond to findings from security assessments, monitoring, and audits. X

RA-9 Criticality Analysis

Control Detail: Control Detail:

Identify critical system components and functions by performing a criticality analysis for, system components, or system services and document the analysis in the System Security Plan X

Compliance

AU-1 Audit and Accountability Policy and Procedures

AU-2 Audit Events

Control Detail: Control Detail:

a.Verify that, at a minimum, all systems are capable of auditing the following events:

1.Startup and shutdown;

2.Installation and removal of software;

3.Error messages;

4.Account creation, modification, or deletion;i)Systems must be configured to issue an alert when an account is added to or removed from any group assigned administrative privileges (CIS-4.8);

5.User logon and logoff;

6.Unsuccessful logon attempts (CIS-4.9);

7.Attempted access to deactivated accounts (CIS-16.12);

8.Successful and unsuccessful change of password;

9.Creation or modification of super-user groups; (CIS-4.8) 10.Startup and shutdown of audit functions;

11.Manual clearing or modification of the audit log file;

12.Change of file or user permissions or privileges (e.g. use of SUID/GUID, CHOWN, SU, etc.);

13.Execution of command-line processes for command shells such as Microsoft PowerShell and Bash (CIS-8.8);

14.Changes made to an application or database by a batch file;

15.Changes to database or application records, where the application has been bypassed to produce the change (via file or other database utility);

16.Modifications to the application or database;

17.Accesses to information and files;

18.Configuration changes;

19.Remote access outside of the internal network, and all dial-in access to the system;

20.Domain Name System (DNS) query logging for detection of hostname lookups for known malicious domains (CIS-8. 7); 21.Execution of command-line processes for command shells such as Microsoft PowerShell and Bash (CIS-8.8);

22.Remote access outside of the internal network, and all dial-in access to the system;NOTE: Remote access is defined as a type of network access that involves communication through external networks. Internal networks include LANs and WANs; and 23.All system and interactions concerning:

i)Information classified as Level 3 (Restricted) or above according to the statewide Information Asset Classification Policy; and b.Coordinate the security audit function with other organizational entities requiring audit-related information, to enhance mutual support and help guide the selection of auditable events; and c.Document a rationale for why the auditable events are deemed to be adequate to support after-the-fact investigations of security incidents.

X

AU-2(3) REVIEWS AND UPDATES

Control Detail: Control Detail:

Review and update audited events at least annually, or when a major change to the system occurs. X

AU-3 Content of Audit Records

Control Detail: Control Detail:

a.Configure systems to generate audit records containing sufficient information to establish what type of event occurred, when the event occurred, where the event occurred, the source of the event, the outcome of the event, and the identity of any individuals or subjects associated with the event. At a minimum, the following elements shall be identified within each audit record (CIS-6. 3):

1.Date and time when the event occurred;

2.The software or hardware component of the system where the event occurred;

3.Source of the event (e.g. network address, console);

4.Type of event that occurred;

5.Subject identity (e.g. user, device, process context);

6.The outcome (i.e. success or failure) of the event; and 7.Network traffic data on all network boundary devices (CIS-12.8). X

AU-3(1) ADDITIONAL AUDIT INFORMATION

Control Detail: Control Detail:

Generate audit records containing additional information as required by applicable laws and regulations, specific to the system. X

AU-4 Audit Storage Capacity

Control Detail: Control Detail:

Allocate sufficient audit record storage capacity to comply with State of Oregon records retention schedules and any other applicable retention requirements (CIS-6.4). X

AU-5 Response to Audit Processing Failures

Control Detail: Control Detail:

For all systems a.Configure to provide alerts to designated Agency personnel in the event of audit processing failures when the failure occurs;

b.Take appropriate action to address the restoration of logging functionality immediately upon discovery; and c.Ensure that systems receiving, processing, or storing regulated data comply with applicable laws and regulations, specific to the system X

AU-5(1) AUDIT STORAGE CAPACITY

Control Detail: Control Detail:

Provide a warning to designated officials (to include system administrators, Information Security Officers, Operational Security Officers) when allocated audit record storage volume reaches 80% utilization, or as specified by regulations specific to the system. X

AU-6 Audit Review, Analysis, and Reporting

Control Detail: Control Detail:

a.Review and analyze system audit records at least weekly for the following:

1.Indications of inappropriate or unusual activity related to potential unauthorized access(CIS-6.7); and 2.Other anomalies or abnormal events;

b.Report incidents discovered during audit record review and analysis according to agency, State of Oregon, and Federal Incident Response Policy and procedures.

1.Findings involving a potential unauthorized disclosure of FTI must be reported to the office of the appropriate special agent-in -charge for the Treasury Inspector General for Tax Administration (TIGTA)and to the IRS Office of Safeguards immediately, but no later than 24 hours after identification of the possible incident; and 2.Findings involving a potential unauthorized disclosure of Social Security Administration Provided Information (SSPI) must be reported to the Social Security Administration Regional Office or System Security Contact within one hour after identification of the possible incident.

X

AU-6(1) AUTOMATED PROCESS INTEGRATION

Control Detail: Control Detail:

Employ automated mechanisms to integrate audit review, analysis, and reporting processes to support organizational processes for investigation and response to suspicious activities. X

AU-6(3) CORRELATE AUDIT REPOSITORIES

Control Detail: Control Detail:

Analyze and correlate audit records across different repositories to gain Agency-wide situational awareness (CIS-6. 5). X

AU-6(4) CENTRAL REVIEW AND ANALYSIS

Control Detail: Control Detail:

a.Aggregate logs to a central log management system for analysis and review. Automated mechanisms for centralized reviews and analyses include, for example, Security Information and Event Management (SIEM) products (CIS-6.6); and b.Send malware detection events to anti-malware administration tools and centralized log servers for alerting and analysis (CIS-8.6) X

AU-7 Audit Reduction and Report Generation

Control Detail: Control Detail:

a.Provide and implement an audit reduction and report generation capability that:

1.Supports near real-time audit review, analysis, and reporting requirements described in AU-6, and after-the-fact investigations of security incidents;

i)The audit reduction and report capability must be tuned on a regular basis in order to better identify actionable events and decrease event noise (CIS-6.8); and 2.Does not alter the original content or time ordering of audit records.

X

AU-7(1) AUTOMATIC PROCESSING

Control Detail: Control Detail:

Provide and implement the capability to process audit records for events of interest based on individual items, or combinations of items contained in the audit records, as defined in AU-3 (CIS-6.8). X

AU-8 Time Stamps

Control Detail: Control Detail:

a.Use internal system clocks to generate time stamps for audit records.

1.Time stamps generated by the systems shall include both the date and the time; and b.Record time stamps that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT) (CIS-6.1). X

AU-8(1) SYNCHRONIZATION WITH AUTHORITATIVE TIME SOURCE

Control Detail: Control Detail:

a.Provide at least two authoritative State of Oregon time sources for synchronization;

b.The State authoritative time sources must be sourced by at least three unique Stratum One time sources;

c.Compare and synchronize internal system clocks with at least one of the Oregon enterprise-wide primary authoritative time sources, to ensure that time stamps in audit records are as accurate as possible and correlate across different systems or system components (CIS-6.1); and d.Configure internal system clocks to synchronize to the authoritative time source at least weekly, or when the time difference between systems is greater than 5 minutes. X

AU-8(2) SECONDARY AUTHORITATIVE TIME SOURCE

Control Detail: Control Detail:

a.Identify a secondary Oregon enterprise-wide authoritative time source that is in a different geographic region than the primary authoritative time source; and b.Synchronize the internal system clocks to the secondary authoritative time source if the primary authoritative time source is unavailable. X

AU-9 Protection of Audit Information

Control Detail: Control Detail:

Protect audit information and audit tools from unauthorized access, modification, and deletion. X

AU-9(4) ACCESS BY SUBSET OF…