Attachment A-KHS POS_CRM update COT requirements.pdf

ADDENDUM #1 (NOVEMBER 27, 2019) RFP 758 20000000153-2

TO POST NEW COT REQUIREMENTS-REPLACE ALL OF

SECTION 30 TO REFLECT UPDATED REQUIREMENTS.

ADD ATTACHMENT I-KOG REQUIREMENTS IN ITS ENTIRETY.

PROPOSAL SUBMISSION CHECKLIST

The vendor MUST include the following with the proposal submission.

If the items highlighted below are not submitted with the proposal submission, the Commonwealth MUST deem the proposal non-responsive and

SHALL NOT consider for award.

All other items MUST be submitted prior to award.

FACE OF SOLICITATION - SIGNED [see Section 60.4]

*PROPOSED TECHNICAL SOLUTION UNDER SEALED COVER AND BY

CLOSING DATE AND TIME [see Sections 60.5 – 60.7]

*PROPOSED COST SOLUTION UNDER SEALED COVER AND BY CLOSING

DATE AND TIME [see Section 60.8 & Attachment B]

*MANDATORY REQUIREMENTS CHECKLIST [see Attachment G]

TRANSMITTAL LETTER [see Section 60.6(A)]

REVENUE FORM 10A100 KENTUCKY TAX REGISTRATION APPLICATION

[see Section 60.6 (C)]

CERTIFICATE OF AUTHORITY- REGISTRATION WITH SECRETARY OF STATE

BY A FOREIGN ENTITY [see Section 60.6 (D)]

REQUIRED ANNUAL AFFIDAVIT AND OTHER AFFIDAVIT(S) [see Attachment C]

EEO FORMS IF APPLICABLE [see Section 40.21]

*The Commonwealth defines SEALED as “a closure that must be broken to be opened and that thus reveals tampering”. (Merriam-Webster Dictionary, http://www.merriam-webster.com/dictionary/seal)

*Please see Attachment E - The Protection of Personal Information Security and Breach Investigation Procedures and Practice Act (KRS 61.931), et seq.

effective January 1, 2015.

ATTACHMENT A

Commonwealth of Kentucky Request for Proposal (RFP)

For Point of Sale System (POS) and

Customer Relationship Management System (CRM)

RFP 758 2000000153

Release Date: November 20, 2019 November 27, 2019

CLOSING DATE AND TIME: December 30, 2019 at 3:30pm EST

(See Section 10.9 of this RFP for the Estimated Schedule of RFP Activities)

Issued by

The Finance and Administration Cabinet On Behalf Of

Kentucky Historical Society (KHS)

Commonwealth Buyer:

Stacy Blank, CPPO, CPPB

Director, Division of Technology Services Procurement

COMMONWEALTH OF KENTUCKY

FINANCE AND ADMINISTRATION CABINET

Office of Procurement Services

New Capitol Annex

702 CAPITOL AVE RM 096

FRANKFORT KY 40601

(502) 564-2294 Fax: (502) 564-6013

Stacy.Blank@ky.gov

TABLE OF CONTENTS

Proposal Submission Checklist Section 10 – Purpose Section 20 – Background and Present System Summary Section 30 – Commonwealth Office of Technology Requirements Section 40 – Procurement Requirements Section 50 – Scope of Work Section 60 – Proposal Submission Section 70 – Proposal Evaluation Section 80 – Negotiations Section 90 – Attachments

SECTION 10 – INTRODUCTION AND OVERVIEW

10.1 Purpose

The purpose of this Request for Proposal (RFP) is to solicit proposals for competitive negotiations pursuant to 200 KAR 5:307.

The Kentucky Historical Society (KHS) is soliciting proposals from qualified vendors interested in providing a comprehensive point of sale (POS) and customer relationship management (CRM) system for the Frankfort, KY campuses. This system shall include online event/program registration and purchases, facility reservation/scheduling/tracking, membership management, point-of sale, payment processing, capture of information for marketing purposes and customer relationship management functions.

KHS is seeking an integrated system to capture the organization’s touchpoints with its stakeholders. KHS envisions a phased rollout of a new system that will begin with the POS and then incorporate additional customer touch points and tracking.

This solution shall:

1. Enable us to serve our customers with greater efficiency and enhanced service;

2. Allow us to make data-driven decisions to evaluate the success of our programs and events;

3. Improve our ability to analyze, market, and promote our offerings;

4. Streamline internal operations and clarify reporting;

5. Enhance visitor engagement through an improved online presence.

The priorities for this RFP are as follows:

1. Admissions desk ticket sales (POS)

2. Payment processing

3. Online admission ticket sales

4. Activity/program registration and maintenance (primarily school groups, camps and event attendance)

5. Memberships (tied to CRM)

6. Mobile ticket sales

7. Gift shop merchandise sales and inventory management

8. Ecommerce capabilities

9. Event facility rentals

10. Improved capabilities for marketing, including data analytics on visitor attendance (e.g., origin based on zip code, frequency, age, etc.)

11. Improved financial accounting and reporting

KHS seeks an integrated system with most of the functionality offered for a POS and CRM functionality, either through the system itself or integration with a 3rd party system.

10.2 Issuing Office

The Commonwealth of Kentucky, Finance and Administration Cabinet, Office of Procurement Services, is issuing this RFP on behalf of the Kentucky Historical Society. The Finance and Administration Cabinet is the only office authorized to change, modify, amend, alter, or clarify the specifications, terms and conditions of this RFP.

A contract, based on this RFP, may or may not be awarded. Any contract award from this RFP is invalid until properly approved and executed by the Finance and Administration Cabinet.

10.3 Access to Solicitation, RFP, and Addenda

The Commonwealth wants each prospective vendor to have full and complete information on which to base a proposal response. Only information presented or referred to in this RFP and any additional written information that is supplied by the Commonwealth Buyer shall be used by vendors in preparing the response.

The solicitation, addenda, and attachments shall be posted to the Kentucky Vendor Self Service site at http://emarsonline1311.state.ky.us/webapp/vssprdonline/AltSelfService It is not necessary to register to access the solicitation. Unregistered vendors can access solicitations by clicking on public access.

In the event of any conflict or variation between the solicitation or modification as issued by the Commonwealth and the vendor’s response, the version as issued shall prevail.

10.4 RFP Terminology

For the purpose of this RFP, the following terms may be used interchangeably:

http://emarsonline1311.state.ky.us/webapp/vssprdonline/AltSelfService o Proposer, Offeror, Contractor, Provider, or Vendor o Commonwealth Buyer, Buyer, Purchaser, or Contract Officer o RFP, Solicitation, or Procurement o Bid, Proposal, or Offer o Commonwealth of Kentucky, Commonwealth, or State, Agency, Kentucky

Historical Society o Fiscal Year will be defined as the Commonwealth fiscal year: July 1 through

June 30 o Biennium will be defined as the Commonwealth biennium: July 1 of each even numbered year through June 30 of the next even numbered year o Requirements that include the words “Shall”, “Will”, “Must” indicate a mandatory requirement

10.5 Restrictions on Communications

The Commonwealth Buyer named on the Cover Sheet of this RFP shall be the sole point of contact throughout the procurement process. All communications, oral and written (regular, express, or electronic mail, or fax), concerning this procurement shall be addressed to the Buyer.

For violation of this provision, the Commonwealth shall reserve the right to disqualify the vendors’ proposal response.

10.6 Written Questions and Deviations Regarding this RFP

Vendors are encouraged to submit written questions pursuant to Section 10.9 of this RFP. Should a vendor object to any of the Commonwealth’s standard terms and conditions or provisions of the solicitation, that vendor must specifically identify the deviation and must propose specific alternative language that could be acceptable to the Commonwealth. Vendors must include a brief statement of the purpose and impact, if any, for each proposed change in addition to the specific proposed alternate wording. General references to the vendor’s terms and conditions or attempts at complete substitutions are not acceptable.

Deviations shall not be in conflict with the basic nature of this solicitation. The Commonwealth reserves the right to reject any and/or all deviations in whole or in part. Vendors must submit deviations pursuant to the schedule in Section 10.9 of this RFP.

Written questions and deviations shall be submitted to the Commonwealth Buyer via email Stacy.Blank@ky.gov or via fax at 502-564-6013. Vendors should submit questions on Attachment D-Vendors Question Form and deviations on Attachment F-Vendors Deviation Form. No questions or deviations shall be accepted after the date(s) listed in Section 10.9 unless the question(s) or deviation(s) is considered material to the procurement. The Commonwealth shall respond to salient questions in writing by issuing an addendum to the solicitation.

Any addendum will either incorporate acceptable deviations into solicitation, indicate the deviation is negotiable with the successful offeror or indicate the deviation is unacceptable. Offerors proposals that include any deviation deemed mailto:Stacy.Blank@ky.gov unacceptable pursuant to the addendum will result in disqualification of the offerors proposal. The addendum shall be posted to the Kentucky Vendor Self Service site.

10.7 Notification of Award of Contract

The procurement process will provide for the evaluation of proposals and selection of the successful proposal in accordance with State law and regulations. KRS Chapter 45A of the Kentucky Model Procurement Code provides the regulatory framework for the procurement of services by State agencies.

All applicable statutes, regulations, policies and requirements shall become a part of an award as well as the Information Technology requirements.

To view the award of contract(s) and the contractor(s) receiving the award(s) for this solicitation, access the Kentucky Vendor Self Service site at http://emarsonline1311.state.ky.us/webapp/vssprdonline/AltSelfService.

Vendors can search for the solicitation title or number in the keyword search field, or can filter their search for only awarded solicitations by clicking on Advanced Search and changing the status to “Awarded”. The award(s) information can be accessed by clicking on the details button of the solicitation and clicking the “Notice of Award” tab. It is the vendor’s responsibility to review this information in a timely fashion. No other notification of the results of an award of contract will be provided.

10.8 Protest

Pursuant to KRS 45A.285, the Secretary of the Finance and Administration Cabinet, or his designee, shall have authority to determine protests and other controversies of actual or prospective offerors in connection with the solicitations or selection for award of a contract.

Any actual or prospective offeror or contractor, who is aggrieved in connection with solicitation or selection for award of a contract, may a file protest with the Secretary of the Finance and Administration Cabinet. A protest or notice of other controversy must be filed promptly and in any event within two (2) calendar weeks after such aggrieved person knows or should have known of the facts giving rise thereto. All protests or notices of other controversies must be in writing and shall be addressed and mailed to:

William M. Landrum III, Secretary

COMMONWEALTH OF KENTUCKY

FINANCE AND ADMINISTRATION CABINET

New Capitol Annex

702 CAPITOL AVE RM 383

FRANKFORT KY 40601

http://emarsonline1311.state.ky.us/webapp/vssprdonline/AltSelfService

The Secretary of Finance and Administration Cabinet shall promptly issue a decision in writing. A copy of that decision shall be mailed or otherwise furnished to the aggrieved party and shall state the reasons for the action taken.

The decision by the Secretary of the Finance and Administration Cabinet shall be final and conclusive.

10.9 Estimated Schedule of RFP Activities

The following table presents the anticipated schedule for major activities associated with the RFP distribution, proposal submission, proposal evaluation process, and contract award. The Commonwealth reserves the right at its sole discretion to change the Schedule of Activities, including the associated dates and times.

Anticipated Schedule of Activities

Release of RFP

11-20-2019

Vendors’ Written Questions due by 12:00 PM EST

(SUBMIT QUESTIONS ON ATTACHMENT D-VENDORS’ QUESTION

FORM)

12-3-2019

Vendors’ Written Deviations due by 12:00 PM EST

(SUBMIT QUESTIONS ON ATTACHMENT F -VENDORS’ DEVIATION

FORM)

12-3-2019

Commonwealth’s Response to Vendors’ Written Questions AND Deviations

12-6-2019

Proposals due by 3:30 PM EST

12-30-2019

All bidders are cautioned to be aware of security in the Capitol Annex in Frankfort. In-person or courier delivered bids/proposals in response to a Commonwealth solicitation should be delivered a minimum of thirty (30) minutes to one (1) hour earlier than the published closing date and time to allow for a security check-in. Delays due to building security checks shall not be justification for acceptance of a late bid or proposal. Vendor attention to this advisory is encouraged.

SECTION 20 – BACKGROUND AND PRESENT SYSTEM SUMMARY

20.1 Background

The Kentucky Historical Society (KHS) is based in Frankfort, Kentucky and operates under the State of Kentucky’s Tourism, Arts and Heritage Cabinet. The campus consists of three buildings: The Society’s headquarters at the Thomas D.

Clark Center for Kentucky History (CKH), the Old State Capitol (OSC), and the Kentucky Military History Museum (KMHM). Each building is located approximately a block apart. Tickets to the campus are sold at CKH, OSC and

KHHM and annual visitation averaged over 47,000 visitors in 2018, including approximately 31,000 K-12 students. KHS does not currently have a Point of Sale (POS) or Customer Relationship Management (CRM) system so many processes are done manually. For example, visitor admissions are currently tracked by county through tick marks. School group visits, camp registration, facility rentals, and program/events are all tracked using Excel spreadsheets that do not connect with any other systems.

Although based in Frankfort, KHS is a statewide organization that interacts with audiences across the state. KHS organizes programs in variety of locations, including schools, and its mobile exhibition, the “HistoryMobile (fees are charged for this service). In addition, KHS has a 501(c)(3) foundation, the Kentucky Historical Society Foundation (KHSF), that solicits donations and handles KHS’s membership records (approximately 2,000). KHSF records donors and prospects using Blackbaud’s Raiser’s Edge and has approximately 32,000 records in the system.

KHS currently tracks customer interactions through a variety of means, ranging from pen and paper tallies to spreadsheets. The potential for over/undercounting of visitors exists especially when visiting multiple sites and the origin of visitors is limited to the collection of county, state, or country, hindering our marketing efforts.

Moreover, KHS has a limited online presence: All purchases of ticket sales, program events and merchandise must be made in-person or through the mail.

This hinders our ability to effectively interact with potential customers and creates undue burden on KHS staff to process payments. KHS also does not track member or donor interactions.

The CKH includes a small gift shop and gift sales are also performed at the KMHM and OSC. The CKH gift shop uses a standalone cash register POS. Thus, inventory must be manually tracked, replenishing of stock is unduly burdensome, and tracking of sales by item is challenging. No online sales are currently being performed as well, which represents another opportunity for increased sales.

School field trips, programs/events, and children’s camps all represent a significant portion of KHS’s mission and vision to promote the importance of Kentucky’s history. However, the manual processes associated with tracking, scheduling and invoicing participants place significant burdens on staff. Camps, for example, require forms and waivers to be completed on paper and returned within a timely manner. Invoices are being manually completed and sent to the participants. KHS also has the capability of renting out spaces at all three buildings, although the vast majority of rentals occur at the CKH building. Facility and event rentals are currently tracked using paper processes, Excel and an Outlook calendar.

20.2 Project Support

In terms of staffing resources KHS has a dedicated project manager assigned to the project. Other resources from KHS will be brought in as necessary for decision making, testing and offering other subject matter expertise. At a minimum the vendor shall have a project manager assigned to the project who will work closely with the KHS project manager to successfully configure and implement the software solution.

To provide the necessary support to KHS staff a phased-in approach to the POS/CRM software is proposed. The first phase should be the online ticket sales and visitor desk services (including ticket sales and scanning admission tickets), with the second phase being the gift shop and ecommerce, and then finishing with online registration for programs/events and facility rentals. Each of these phases will have a “go-live” date separated by a few weeks to allow sufficient support for the current phase and allow preparations and training for the next phase to be implemented. KHS is agreeable to modifications with the proposed approach based on discussions with the vendor. The vendor should propose a realistic project plan and schedule along with their rationale when developing their draft project schedule. A final project schedule will be performed with the vendor and KHS to implement the POS/CRM system in a timely manner.

SECTION 30 – COMMONWEALTH OFFICE OF TECHNOLOGY (COT)

REQUIREMENTS

30.1 Commonwealth Information Technology Policies and Standards

The vendor and any subcontractors shall be required to adhere to applicable Commonwealth policies and standards.

30.2 Compliance with Kentucky Information Technology Standards (KITS)

A. The Kentucky Information Technology Standards (KITS) reflect a set of principles for information, technology, applications, and organization. These standards provide guidelines, policies, directional statements and sets of standards for information technology. It defines, for the Commonwealth, functional and information needs so that technology choices can be made based on business objectives and service delivery. The vendor shall stay knowledgeable and shall abide by these standards for all related work resulting from this RFP.

http://technology.ky.gov/Governance/Pages/KITS.aspx

B. The vendor and any subcontractors shall be required to submit a technology roadmap for any offered solution. Additional roadmaps will be submitted upon request of the Commonwealth. The Roadmap shall include, but is not limited to, planned, scheduled and projected product lifecycle dates and historical release/ patch or maintenance dates for the technology. In addition, any guidance on projected release/revision/patch/maintenance schedules would be preferred.

30.3 Compliance with Commonwealth Security Standards

The software deployment and all vendor services shall abide by privacy and security standards as outlined in the Commonwealth’s Enterprise Information Technology Policies.

Enterprise Security Policies http://technology.ky.gov/ciso/Pages/InformationSecurityPolicies,StandardsandProcedures.aspx

Enterprise IT Policies http://technology.ky.gov/policy/pages/policies.aspx

Finance and Administration Cabinet Commonwealth Office of Technology http://finance.ky.gov/services/policies/Pages/default.aspx

30.4 Compliance with Industry Accepted Reporting Standards Based on Trust Service Principles and Criteria The vendor must employ comprehensive risk and threat management controls based on defined industry standards for service organizations such as AICPA TSP section 100, Trust Services Principles and Criteria. The vendor must annually assert compliance and engage a third party to examine such assertions and controls to provide a Report, such as AT101 SOC 2 type 2, on Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, and Privacy, which contains an opinion on whether the operating controls effectively support the assertions. All such reports, including publicly available reports (i.e. AT 101 SOC 3) shall be made available to the Commonwealth for review.

30.5 System Vulnerability and Security Assessments

The Commonwealth reserves the right to conduct, in collaboration with the vendor, non-invasive vulnerability and security assessments of the software and infrastructure used to provide services prior to implementation and periodically thereafter. Upon completion of these assessments, the Commonwealth will communicate any findings to the vendor for action. Any cost relating to the alleviation of the findings will be the responsibility of the vendor. Mitigations will be subject to re-evaluation after completion. In cases where direct mitigation cannot be achieved, the vendor shall communicate this and work closely with the Commonwealth to identify acceptable compensating controls that will reduce risk to an acceptable and agreed upon level. An accredited third party source may be selected by the vendor to address findings, provided they will acknowledge all cost and provide valid documentation of mitigation strategies in an agreed upon timeframe.

30.6 Privacy, Confidentiality and Ownership of Information

http://technology.ky.gov/ciso/Pages/InformationSecurityPolicies%2CStandardsandProcedures.aspx

The Commonwealth Office of Technology (COT) is the designated owner of all data and shall approve all access to that data. The vendor shall not have ownership of Commonwealth data at any time. The vendor shall be in compliance with privacy policies established by governmental agencies or by state or federal law. Privacy policy statements may be developed and amended from time to time by the Commonwealth and will be appropriately displayed on the Commonwealth portal (Ky.gov). The vendor should provide sufficient security to protect the Commonwealth and COT data in network transit, storage, and cache. All data, including backups and archives, must be maintained at all times within the contiguous United States. All sensitive data, as defined in Enterprise Standards, must be encrypted in-transit and at rest.

30.7 Privacy Assessments

The Commonwealth reserves the right to conduct Privacy assessments of the collection, use, maintenance and sharing of Commonwealth data by any vendor services, software, and infrastructure used to provide services prior to implementation and periodically thereafter. Upon completion of this assessment, the Commonwealth will communicate any findings to the vendor for action. Any cost relating to the alleviation of the findings will be the responsibility of the vendor.

Mitigations will be subject to re-evaluation after completion. In cases where direct mitigation cannot be achieved, the vendor shall communicate this and work closely with the Commonwealth to identify acceptable compensating controls or privacy practices that will reduce risk to an acceptable and agreed upon level. An accredited third party source may be selected by the vendor to address findings, provided they will acknowledge all cost and provide valid documentation of mitigation strategies in an agreed upon timeframe.

30.8 Privacy, Confidentiality and Ownership of Information

The Commonwealth is the designated owner of all Commonwealth data and shall approve all access to that data. The Vendor shall not have ownership of Commonwealth data at any time. The Vendor shall be in compliance with privacy policies established by governmental agencies or by state or federal law. Privacy notice statements may be developed and amended from time to time by the Commonwealth and will be appropriately displayed on the Commonwealth portal (Ky.gov). The Vendor should provide sufficient security to protect the Commonwealth and COT data in network transit, storage, and cache. All Commonwealth data, including backups and archives, must be maintained at all times within the contiguous United States. All Commonwealth data, classified as sensitive or higher, as defined in Enterprise Standards, must be encrypted in-transit and at rest.

30.9 Technical Definitions

Software as a Service (SaaS) – Software as a service is the capability to provide to the consumer the use of the provider’s applications running on a cloud infrastructure. The applications are accessible from various client devices through either a thin client interface, such as a web browser (e.g., web-based email), or a program interface. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings.

Platform as a Service (PaaS) – Platform as a service (PaaS) is a complete development and deployment environment in the cloud, with resources that enable entity to deliver everything from simple cloud-based apps to sophisticated, cloud-enabled enterprise applications. The entity will purchase the resources needed from a cloud service provider on a pay-as-you-go basis and access them over a secure Internet connection.

Infrastructure as a Service (IaaS) – Infrastructure as a service (IaaS) is a cloud service that provides an entity with instant computing infrastructure, provisioned and managed over the internet.

30.10 Data Quality

Vendors shall provide proposed levels of data quality per the following dimensions.

Data Quality is the degree to which data is valid, accurate, complete, unique, timely, consistent with all requirements and business rules, and relevant for a given use. The vendor shall provide data quality definitions and metrics for any data elements. Data has to be of the appropriate quality to address the needs of the Commonwealth of Kentucky. The following dimensions can be used to assess data quality:

Validity - The data values are in an acceptable format.

Accuracy - The data attribute is accurate.

Completeness - There are no null values in a data field.

Uniqueness - There are no duplicate values in a data field.

Timeliness - The data attribute represents information that is not out-of-date.

Consistency - The data attribute is consistent with a business rule that may be based on that attribute itself, or on multiple attributes.

Adherence to business rules - The data attribute or a combination of data attributes adheres to specified business rules.

30.11 System Development

A. Session Security Lock Vendor shall configure:

1. The system to initiate a session lock after a maximum of 15 minutes of inactivity.

2. The system session will remain locked until the user re-established identification and authentication procedures.

B. Session Pattern-Hiding Displays

Vendor shall configure system to conceal information previously visible on the display with a publicly viewable image or blank screen.

C. Session Termination Vendor shall configure system to terminate a user session automatically after defined conditions trigger events requiring session disconnect. Conditions or trigger events requiring automatic session termination include, but are not limited to:

1. Agency-defined periods of user inactivity,

2. Targeted responses to certain types of incidents, or

3. Time-of-day restrictions on information system use.

30.12 EU GDPR Compliance

The Commonwealth of Kentucky requires all vendor contracts to comply with the European Union’s General Data Privacy Regulation [Regulation (EU) 2016/679] (the “GDPR”) when the Commonwealth is a “controller” or “processor” of “personal data” from an individual “data subject” located in the European Union, as those terms are defined in the GDPR. The Contractor acknowledges and agrees that it is acting as a “processor” of “personal data” for the Commonwealth under this Agreement and that all applicable requirements of the GDPR are incorporated by reference as material terms of this Agreement. The Contractor represents and warrants that (1) it is aware of and understands its compliance obligations as a “processor” under GDPR; (2) it has adopted a GDPR compliance policy/program, a copy of which has been provided to the Commonwealth; (3) it will process “personal data” only in accordance with the Commonwealth’s instructions; and (4) with regard to its obligations under this Agreement, it shall comply with all applicable requirements of the GDPR to the same extent as adopted by the Commonwealth. Additionally, the Contractor shall indemnify and hold harmless the Commonwealth, and its employees from and against any claims, demands, suits, damages, penalties, fines, or costs arising from any violation of GDPR by the Contractor.

30.13 Software Development

Any source code for software developed or modified by the vendor specifically for the Commonwealth for a non-license fee according to the Commonwealth's specifications shall be the sole property of the Commonwealth subject, however, to the requirements of any applicable federal grant or funding governing the development or modification of the source code. Any changes made specific for the Commonwealth and paid for by the Commonwealth shall be Commonwealth property and cannot be distributed or replicated without the Commonwealth's approval. Upon the written request of the selected vendor, the Commonwealth, in its sole discretion, may license the source or object code of the developed or modified software to the vendor according to the terms and conditions of a separate, mutually acceptable agreement.

30.14 License Agreements

Software provided by the vendor to the Commonwealth should contain a provision for perpetual licensing with all upgrade options. License agreements should also contain a provision for the Commonwealth to maintain a version of the software in escrow in the event the vendor is unable to continue business for financial or other business reasons.

Vendor shall coordinate with the requesting agency and COT to arrange for the purchase off existing contracts for the competitive solicitation of software and cloud resources for the installation/use of in the solution.

30.15 Software Version Requirements

All commercially supported and Commonwealth approved software components such as Operating system (OS), Database software, Application software, Web Server software, Middle Tier software, and other ancillary software must be kept current. In the event that a patch interferes with the solution, the vendor must present a plan for compliance to the Commonwealth outlining the constraints and an appropriate plan of action to bring the solution in to compliance to allow this patch to be applied in the shortest timeframe possible, not to exceed three months, unless otherwise negotiated with the Commonwealth.

The Vendors shall keep software in compliance with industry standards to support third party products such as Java, Adobe Flash, Internet Explorer, Mozilla Firefox, etc. at currently supported version, release, and patch levels, when such dependencies exist. In the event that a third party dependency interferes with the solution, the vendor must present a plan for compliance to the Commonwealth outlining the constraints and an appropriate plan of action to bring the solution into compliance to allow this third party dependency to be updated in the shortest timeframe possible, not to exceed three months, unless otherwise negotiated with the Commonwealth.

30.16 Section 508 Compliance

All user interfaces to the solution(s) provided, shall be warranted by the vendor to comply with Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) and the World Wide Web Consortium’s (W3C) Web Content Accessibility Guidelines (WCAG) 2.0, conformance level Double-A or greater.

30.17 No Surreptitious Code Warranty

The contractor represents and warrants that no copy of licensed Software provided to the Commonwealth contains or will contain any Self-Help Code or any Unauthorized Code as defined below. This warranty is referred to in this contract as the "No Surreptitious Code Warranty”.

As used in this contract, "Self-Help Code" means any back door, time bomb, drop-dead device, or other software routine designed to disable a computer program automatically with the passage of time or under the positive control of a person other than the licensee of the software. Self-Help Code does not include Software routines in a computer program, if any, designed to permit an owner of the computer program (or other person acting by authority of the owner) to obtain access to a licensee's computer system(s) (e.g. remote access) for purposes of maintenance or technical support.

As used in this contract, "Unauthorized Code" means any virus, Trojan horse, spyware, worm or other Software routines or components designed to permit unauthorized access to disable, erase, or otherwise harm software, equipment, or data; or to perform any other such actions. The term Unauthorized Code does not include Self-Help Code.

In addition, contractor will use up-to-date commercial virus detection software to detect and remove any viruses from any software prior to delivering it to the Commonwealth.

The vendor shall defend the Commonwealth against any claim, and indemnify the Commonwealth against any loss or expense arising out of any breach of the No Surreptitious Code Warranty.

30.18 Database Approach and Toolset Requirement

In conjunction with the partnership that shall be formed between the Commonwealth and the Vendor the awarded Vendor shall supply the Commonwealth with the logical and physical data model of the proposed solution and the associated data dictionary.

30.19 Network Connection Requirements

A. Vendor shall work with COT to establish any network connections. If a secure site-to-site connection is required, the vendor shall employ a secure site-to-site connection procured by the Agency from COT.

B. Vendor shall notify COT of network bandwidth requirements and if caching is required for implementation vendor shall resolve caching requirements, in coordination with COT.

C. Vendor shall, at COT’s discretion, provide appropriate access to enable the

Commonwealth to perform additional security measures, such as decryption of the network traffic if required for inspection.

D. Vendor shall provide notifications to the Commonwealth Service Desk for unplanned outages within 5 minutes.

E. Vendor shall notify COT Change Management, through the Commonwealth

Services Desk, for planned outages notification with a minimum of two (2) business days notice.

F. Vendor-hosted solutions, cloud services (or change from on-premise to cloud or SaaS), cloud offerings such as Software as a Service (SaaS), Platform as a Service (PaaS), and Infrastructure as a Service (IaaS) are NOT PERMITTED under this contract unless explicit approval is granted by COT through the appropriate process. Subscription services are NOT PERMITTED under this contract, unless explicit approval is granted by COT through the appropriate process.

For the purpose of procuring Subscription services, the Commonwealth hereby designates Non-Executive Branch State Agencies as the ONLY authorized Participating Entity(ies) under this contract. Executive Branch State Agencies are only permitted to procure Subscription services if COT grants an approval.

If the Vendor enters into an agreement with an Executive Branch State Agency that has not been granted approval as indicated above, the Commonwealth reserves the right to terminate the contract in its entirety.

Vendor-hosted solutions, cloud services (or change from on-premise to cloud or SaaS), and Infrastructure as a Service (IaaS) are NOT PERMITTED under this contract unless explicit approval is granted by the Commonwealth Office of Technology through the appropriate process. Salesforce cloud offerings are the only Software as a Service (SaaS), Platform as a Service (PaaS), and Subscription services PERMITTED under this contract unless explicit approval is granted by the Commonwealth Office of Technology through the appropriate process.

For the purpose of procuring Subscription services, the Commonwealth hereby designates Non-Executive Branch State Agencies as the ONLY authorized Participating Entity(ies) under this contract. Executive Branch State Agencies are only permitted to procure Subscription services if the Commonwealth Office of Technology grants an approval. If the Vendor enters into an agreement with an Executive Branch State Agency that has not been granted approval as indicated above, the Commonwealth reserves the right to terminate the contract in its entirety.

G. Vendor, in conjunction with the agency, shall provide a Business Impact

Assessment (BIA) to appropriately classify all data before production/go-live.

H. Vendor shall include a Web Application Firewall when application houses any data classified as sensitive or higher as defined in KITS standards.

I. Vendor shall provide Recovery Time Objective (RTO) and Recovery Point

Objective (RPO) services. Vendor shall provide those services to achieve those SLAs.

30.20 OS Requirements

A. Non-On Prem Solutions

1. No Commonwealth data shall be co-mingled with another entity, without the prior approval of the Commonwealth.

2. Vendor shall provide a solution to move data to the Commonwealth, if required by the Commonwealth.

a. At the end of the contract, the Vendor shall provide all agency data in a useable standard data format (such as asci, csv, etc.) that can be converted to a subsequent system. The Vendor shall cooperate to this end with the Agency and/or a Vendor of the agency’s choice, in a timely and efficient manner.

b. Vendor shall provide all agency data in a form that can be converted to any subsequent system of the agency’s choice. The vendor shall cooperate to this end with the vendor of the agency’s choice, in a timely and efficient manner.

c. Vendor shall provide address the destruction of Commonwealth data as defined in CIO-092 and provide a certification of the complete and permanent deletion the Commonwealth data.

B. Infrastructure As A Service

1. Vendor shall work with the Agency and COT to establish all administrative personnel engagements.

2. All virtual environments must run on VMC (VMWare Cloud) with OS version compliant with KITS, unless explicitly approved by COT.

3. VMC shall provide an enterprise class malicious code protective solution that is currently supported by the vendor and up to date

4. Vendor shall meet certification requirements for classification of data being stored.

5. Vendor shall, at COT’s request, provide appropriate access to enable the Commonwealth to perform additional security measures in compliance with Commonwealth Enterprise Policies, Standards, and/or any Federal or State requirements.

6. Vendor shall provide an Exit Strategy, to move all data to the Commonwealth Data Center, if required by the Commonwealth.

a. At the end of the contract, the Vendor shall provide all agency data in a form that can be converted to any subsequent system of the agency’s choice. The Vendor shall cooperate to this end with the Vendor of the agency’s choice, in a timely and efficient manner.

b. Vendor shall provide certification of the complete and permanent deletion of Commonwealth data and backups from all vendor storage.

30.21 Monitoring Requirements for On Premise and Cloud (SaaS)

Vendor shall work with the Agency and COT to establish a monitoring solution.

Vendors shall provide a view into their environment either by providing a COT approved comprehensive dashboard or allow COT to install their KITS compliant monitoring solution; to include but not limited to performance and availability.

30.22 Application and Service Requirements

A. Current Enterprise Applications and Services

1. COT provides a number of Enterprise Shared Services to State agencies.

Vendor shall use published IT Applications and Services provided on KITS for: Enterprise Service Bus, Enterprise Content Management, Data Warehousing, Data Analytics and Reporting, Business Intelligence, Web Services, GIS, unless explicitly approved by COT.

2. Vendor provided dedicated application components (i.e., Application Servers, Databases, etc.) shall comply with KITS.

3. Vendor applications must describe in detail all available features and functionality accessible via APIs.

4. Vendor shall provide a Disaster Recovery plan for the proposed solution.

Cloud based solutions should have DR replication included in their proposal.

5. All business applications must use the Commonwealth of Kentucky Single Sign On (SSO), the Kentucky Online Gateway (KOG)

30.23 Security/Privacy Requirements

A. CoK finger print requirements for PII/FTI/HIPAA data systems hosted outside

CDC.

30.24 Project Management Requirements

The COT Office of Project Management (OPM) is responsible for overseeing large and complex technology projects throughout the Commonwealth. The vendor shall adhere to Project Management standards and reporting requirements established by OPM, which are posted at https://technology.ky.gov/oet/Pages/epmo.aspx.

These include, but are not limited to having a documented project schedule, risk management, issue management and reporting project status to the CIO monthly in the format defined by OPM. In addition to the project management standards required by OPM, agency specific requirements may be defined in Section 50 of this RFP.

30.25 Applicable Security Control Framework Compliance

The vendor must have an awareness and understanding of the NIST Special Publication 800-53 Security Control Framework and employ safeguards that meet or exceed the moderate level controls as defined within the standard. The respondent must provide sufficient safeguards to provide reasonable protections around the Commonwealth’s data to ensure that the confidentiality, integrity, and availability is maintained at an appropriate level. These include but are not limited to:

1. Access Control

The vendor must employ policy and process that provide for stringent control to limit physical and logical access to systems that house Commonwealth data, on a need to know basis, provide clear separation of duties, and adheres to least privilege principles.

2. Awareness and Training The vendor must provide the appropriate role specific training for staff to ensure that there is awareness and understanding of roles and responsibilities as they relate to the protections around the Commonwealth’s data.

https://technology.ky.gov/oet/Pages/epmo.aspx

3. Audit and Accountability There must be sufficient auditing capability to ensure that actions are tracked and there is individual accountability for all actions taken by vendor staff.

4. Configuration Management The vendor must work within established baselines that provide minimal functionality needed to ensure service delivery without exposing unnecessary risk. The vendor must also employ structured change control processes that provide a level of coordination with the client agreed upon in a Service Level Agreement (SLA).

5. Contingency Planning The vendor must employ contingent planning policy and procedures that ensure service delivery based on agreed SLA levels while maintaining all Commonwealth data within the continental Unites States.

6. Identification and Authorization The vendor must employ appropriate identity and access management policies and procedures to ensure that access is appropriately authorized and managed at a level to ensure that access is provisioned and de-provisioned in a timely and efficient manner.

7. Incident Response The vendor must employ policy and procedures to ensure that an appropriate response to all identified security incidents are addressed in a timely manner and are reported to the appropriate parties in an agreed upon SLA timeframe. The vendor must also ensure that all staff are sufficient trained to ensure that they can identify situations that are classified as security incidents.

8. Maintenance The vendor must employ policy and procedures that ensure that all maintenance activities are conducted only by authorized maintenance staff leveraging only authorized maintenance tools.

9. Media Protection The vendor must employ policy and procedure to ensure that sufficient protections exist to protect Commonwealth data on all storage media throughout the media lifecycle and maintain documentation from media creation through destruction.

10. Physical and Environmental Controls The vendor must employ physical and environmental policies and procedures that ensure that the service and delivery infrastructure are located in a physically secure and environmentally protected environment to ensure the confidentiality, integrity, and availability of Commonwealth data.

11. Personnel Security The vendor must employ policies and procedures to ensure that all staff that have access to systems that house, transmit, or process Commonwealth data have been appropriate vetted and have been through a background check at the time of hire and periodically thereafter.

12. System and Communications Protections The vendor must employ physical and logical protection that protect system communications and communication media from unauthorized access and to ensure adequate physical protections from damage.

30.1 Hosting

The Commonwealth is seeking a Contractor who can provide a solution per the RFP requirements. The proposed solution should be available for on-premises or hybrid implementation, during the turnover phases at the end of the contract term or termination of the contract. The Commonwealth prefers any proposed cloud solution to be hosted on either on AWS or Azure government cloud platforms. The Contractor may choose other Government Cloud platforms if necessary. Contractors proposing solution must accommodate the

Commonwealth Office of Technology (COT) oversight into their proposed solution that includes: an isolated tenant, cloud network access (peering connection) and monitoring solutions. During the negotiation phase, the Commonwealth reserves the right to host any proposed COTS solutions on-premises if it is determined in the best interest of the Commonwealth.

30.2 Commonwealth Information Technology Policies and Standards A. The vendor and any subcontractors shall be required to adhere to applicable

Commonwealth policies and standards.

B. The Commonwealth posts changes to COT Standards and Policies on its technology.ky.gov website. Vendors and subcontractors shall ensure their solution(s) comply with all posted changes. Vendors or subcontractors that cannot comply with changes must, within thirty (30) days of the posted change, request written relief with the justification for such relief. The Commonwealth may 1) deny the request, 2) approve an exception to the policy / standard, or

3) consider scope changes to the contract to accommodate required changes.

Vendors or subcontractors that do not provide the response within the thirty

(30) day period shall be required to comply within ninety (90) days of the change.

30.3 Compliance with Kentucky Information Technology Standards (KITS)

A. The Kentucky Information Technology Standards (KITS) reflect a set of principles for information, technology, applications, and organization.

These standards provide guidelines, policies, directional statements and sets of standards for information technology. It defines, for the Commonwealth, functional and information needs so that technology choices can be made based on business objectives and service delivery.

The vendor shall stay knowledgeable and shall abide by these standards for all related work resulting from this RFP.

B. The vendor and any subcontractors shall be required to submit a technology roadmap for any offered solution. Additional roadmaps will be submitted upon request of the Commonwealth. The Roadmap shall include, but is not limited to, planned, scheduled and projected product lifecycle dates and historical release/patch or maintenance dates for the technology. In addition, any guidance on projected release/revision/patch/maintenance schedules would be preferred.

30.4 Compliance with Commonwealth Security Standards

The software deployment and all vendor services shall abide by privacy and security standards as outlined in the Commonwealth’s Enterprise Information Technology Policies.

Enterprise Security Policies http://technology.ky.gov/Pages/default.aspx http://technology.ky.gov/ciso/Pages/InformationSecurityPolicies,StandardsandProcedures.aspx

Finance and Administration Cabinet Commonwealth Office of Technology

30.5 Compliance with Industry Accepted Reporting Standards Based on Trust Service Principles and Criteria

The vendor must employ comprehensive risk and threat management controls based on defined industry standards for service organizations such as AICPA TSP section 100, Trust Services Principles and Criteria. The vendor must annually assert compliance and engage a third party to examine such assertions and controls to provide a Report, such as AT101 SOC 2 type 2, on Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, and Privacy, which contains an opinion on whether the operating controls effectively support the assertions. All such reports, including publicly available reports (i.e. AT 101 SOC 3) shall be made available to the Commonwealth for review.

30.6 System Vulnerability and Security Assessments

The Commonwealth reserves the right to conduct, in collaboration with the vendor, non-invasive vulnerability and security assessments of the software and infrastructure used to provide services prior to implementation and periodically thereafter. Upon completion of these assessments, the Commonwealth will communicate any findings to the vendor for action. Any cost relating to the alleviation of the findings will be the responsibility of the vendor. Mitigations will be subject to re-evaluation after completion.