Attachment A - Revised Scope of Work.pdf

43230000-24-STC Page 1 of 17 Digital Security Solutions

Revised Attachment A Scope of Work

1. Purpose To provide Customers with statewide Digital Security Solutions, pursuant to the terms set forth in this Scope of Work. Digital Security Solutions must be provided in accordance with Chapter 282, Florida Statutes (F.S.), Rule Title 60GG, Florida Administrative Code (F.A.C.), and cybersecurity best practices. Digital Security Solutions must meet or exceed the applicable state and federal laws, regulations, and standards for cybersecurity, including the National Institute of Standards and Technology Cybersecurity Framework.

2. Definitions Definitions contained in section 287.012, F.S.; Rule 60A-1.001, F.A.C.; Attachment E, Special Contract Conditions; and the PUR 1001, General Instructions to Respondents (10/06), are incorporated by reference. In the event of a conflict, the definitions listed in this section supersede the incorporated definitions for the purposes of this Scope of Work. All definitions apply in both their singular and plural sense.

Add-On Services – Non-core or additional services available for purchase to enhance or support a Solution.

Bandwidth Usage – A Unit that may be used to measure costs.

Bandwidth Usage – A Unit that may be used to measure costs. The amount of data transmitted over a network expressed in gigabytes (GB) for purposes of this Contract.

Business Day – Monday through Friday, inclusive, except for those holidays specified in section 110.117, F.S., from 8:00 a.m. to 5:00 p.m. at the Customer’s location.

Commodity Code – The State’s numeric code for classifying commodities and contractual services which meet specific requirements, specifications, terms, and conditions herein. Florida has adopted the United Nations Standard Products and Services Code (UNSPSC) for classifying commodities and services.

Confidential Information – Information that is trade secret or otherwise confidential or exempt from disclosure under Florida or federal law.

Contract – The written agreement between the Department and the Contractor.

Contract Manager – The representative designated by the Department who will oversee all aspects of the Contract, monitor performance expectations, and serve as the primary point of contact for the Contractor.

Contractor – A Vendor that enters into a Contract with the Department.

43230000-24-STC Page 2 of 17

Criminal Justice Information Services (CJIS) – Services providing access to national or local criminal justice information.

Customer – A State agency or Eligible User.

Department - The Department of Management Services (DMS), a state agency.

Devices/Endpoints – Any computer-based equipment connected to a network, including laptops, desktops, mobile devices, and other network-connected hardware.

Digital Security Solutions(s) – The products, services, or software that meet the needs of a Service Category. May be used interchangeably with Solution.

IP Addresses – Unique identifiers for each device or node on a network, encompassing both static and dynamic IP addresses assigned to company resources.

DNS – Domain Name Server.

Eligible User – As defined in Rule 60A-1.001, F.A.C.

General Data Protection Regulation (GDPR) – A European union regulation on information privacy in the European Union and European Economic Area.

ICMP – Internet Control Message Protocol.

Identity and Access Management Systems (IAM) – A Framework that provides/controls user access to critical information within their organization.

International Organization for Standardization (ISO) – An independent, non-governmental, international standard development organization composed of representatives from the national standards organization of member countries.

Manufacturer – The producer or provider of Digital Security Solutions. May be used interchangeably with Brand Name.

Nodes – Any active, network-connected device that can send, receive, or forward information.

This includes routers, switches, gateways, and other networking hardware.

Users – User accounts or profiles that can be monitored or managed within the security environment. Includes individual user identities accessible or observable through the system.

Reseller(s) – A company that resells software, hardware, and other products and services. May be used interchangeably with Value Added Reseller (VAR).

Resources – Digital assets such as servers (including application and database servers), critical file storage systems, and any cloud-based resources essential to the organization.

RESTful APIs – An interface that two computer systems use to exchange information securely over the internet utilizing Representational State Transfer (REST) architecture.

43230000-24-STC Page 3 of 17

Service Category(ies) – The seven categories of products and services under this Contract. The Service Categories are: Endpoint-Based Asset Discovery, Network-Based Asset Discovery, Endpoint Detection and Response, External-Facing Asset Discovery, Email Security, Content Delivery Network, and Security Operations Platform.

State – The State of Florida.

Systems and Organizations Controls (SOC 2) – a voluntary compliance standard for service organizations, developed by the American Institute of CPAs, which specifies how organizations should manage customer data.

Tiered Pricing – Pricing model where greater numbers of units purchased provide discounted pricing scaling with the amount purchased.

Transactions or Logs Processed – A Unit that may be used to measure costs. The volume of logs or transaction records processed by the system, essential for services like Endpoint Detection and Response (EDR) and Security Operations Platforms. Measured by the number processed per month.

Unit – The metric used to establish the price for a Solution as selected for the submitted Attachment B, Price Proposal, as selected by the Respondent on the submitted Attachment B, Price Proposal. Units may be: device/endpoints, nodes, users, IP addresses, resources, bandwidth usage, or transactions/logs processed.

Value-Added Services - Value-added services include any additional services the Contractor offers, for no additional cost to the Customer, as part of the Contract, and which clearly exceed the minimum requirements and are within the scope of this Contract. An example of value-added services would be, “The Contractor will provide a year of 24/7 support services, at no cost to the Customer.” Any value-added service proposed by the Contractor, if accepted by the Customer, shall become a requirement and be a part of the minimum service specifications contained in any resulting Purchase Order.

3. Scope of Work

3.1 Digital Security Solutions Requirements:

All Service Categories Contractors shall include and adhere to the following minimum specifications:

3.1.1 Integration

Shall integrate with the Customer’s existing security tools such as firewalls, endpoint management solutions, and security information and event management (SIEM) systems.

Each Customer shall determine if the Solution is able to integrate with their security tools.

The Contractor shall take any steps necessary to support Customer integration. The Solution shall be capable of data integration through common exchange techniques and frameworks.

3.1.2 Integration with IAM Systems

All solutions must seamlessly integrate with existing Identity Access Management (IAM) systems to manage endpoint access in alignment with established user identities and permissions, ensuring that endpoint security configurations reflect organizational access policies.

43230000-24-STC Page 4 of 17

3.1.3 Support for Advanced Authentication Methods

Solutions should support and integrate with advanced authentication methods, including biometric verification (e.g., fingerprint and facial recognition), two-factor authentication (2FA), multi-factor authentication (MFA), and behavior-based authentication systems to enhance the security of access controls, especially for sensitive operations or data access.

3.1.4 Solution Architecture

The Solution Architecture must be designed to ensure high scalability and resilience, supporting the organization’s growing needs while maintaining high availability and performance. The Solution Shall provide as Software as a Service via cloud-hosted infrastructure to keep current with the latest releases of management server and endpoint agent software. The Solution shall allow capacity extensibility in the cloud with minimal impact on agent or management infrastructure.

The architecture should leverage modern technologies such as Software-Defined Wide Area Network (SD-WAN), Over-the-Top (OTT) Monitoring, and Multi-tenant capabilities to enhance functionality and operational efficiency.

Data must be transmitted and stored within the Continent of the United States (CONUS).

3.1.5 Compliance and Third-Party Certification

Solutions must comply with relevant standards such as CJIS, HIPAA, FERPA, PII requirements, DPPA, and must have third-party certifications like SOC 2 and ISO 27001.

Contractors may be required to execute specific security agreements as part of the performance or purchase order issuance.

3.1.6 Role-Based Access Control (RBAC)

Solutions must support RBAC by restricting system access to authorized users based on their roles within the organization.

3.1.7 Configuration Tools and Customization

Shall allow configuration of the standard deployed Solution with respect to user interfaces, data tables, process components, and business logic.

3.1.8 Reporting and Documentation

Solutions should provide comprehensive documentation including the use of ports, protocols, and services, and reporting capabilities for audits, attestations, evaluations, and compliance needs. They should support customizable and automated reporting functionalities.

3.1.9 Data Security and Encryption

Solutions must include robust data security measures, including encryption, to protect data at rest and in transit, ensuring the integrity and confidentiality of transactions and stored data.

3.1.10 Disaster Recovery

The Solution shall provide disaster recovery services, including backup and a disaster recovery plan ensuring business continuity.

3.1.11 Data Export

Shall provide the ability to generate a customizable export of data based on user filters for

43230000-24-STC Page 5 of 17 assets, services, and issues present within the platform. Examples of filters that may, but are not required to, be offered include specific time frames; types of assets; services involved; the nature of issues logged within the platform; information about hardware and software assets, their configurations, usage statistics, and associated vulnerabilities or updates; services being used or managed through the platform, such as security services, application services, and network services; and information on detected issues, incidents, or security events, including their severity, resolution status, impact analysis, and remediation steps.

3.1.12 Comprehensive Metadata and Tagging

Solution should allow for the addition of custom metadata and tagging to enhance the context of application dependencies.

3.1.13 Change Management Integration

Solution must be able to integrate with change management processes and tools, facilitating coordination between the Vendor and the organization.

3.2 Service Category 1: Endpoint-Based Asset Discovery:

Endpoint-Based Asset Discovery provides organizations with real-time visibility and control over all managed endpoints, helping to ensure that devices are properly configured, secured, and updated.

The Endpoint-Based Asset Discovery Solution shall provide software and services to maintain up-to-date inventory of discovered hardware and software, improving security management and response to incidents.

The Solution shall provide a centralized console to manage discovered devices that access an organization’s network or IT environment, including laptops, desktops, servers, and mobile devices.

The Service Category 1: Endpoint-Based Asset Discovery shall include and adhere to the following minimum specifications:

3.2.1 Software Agent

The Software Agent must be a lightweight agent with minimal impact on end-point and network performance.

3.2.2 Endpoint Analytics

Shall identify, collect, and aggregate signal and telemetry data from identities, apps, devices, and connectivity. Shall be able to gain insights into endpoint device usage, performance, and security and provide reports that inform policy, automation, and related actions.

3.2.3 Centralized Management Console

Provides a centralized console for managing discovered devices.

43230000-24-STC Page 6 of 17

3.2.4 Product Usability

Shall provide easy to understand, user-friendly interfaces with intuitive designs to facilitate users with varying skill level, a lightweight agent with low impact on end-point and network performance, clear documentation and support resources which instruct on use of the Solution.

3.2.5 Client Management

Shall include a client management feature to manage agents. The primary role of the client management feature is to oversee the agents that are installed on various devices across the organization's network. These agents could be responsible for tasks such as data collection, applying configurations, and enforcing security policies. Management of these agents involves tasks such as deploying, updating, monitoring, and potentially removing or disabling agents as needed.

3.2.6 Operating System Management

The solution must be capable of working with a variety of operating systems that are commonly used across different devices in an organization. This includes not only desktop operating systems like Windows, MacOS, and Linux but also mobile operating systems such as iOS and Android. Integration means that the software should seamlessly connect with these systems without compatibility issues.

3.2.7. Performance Management

Shall provide proactive alerts on system events, as well as logging and resolution reporting on all issues. The Solution shall be able to identify unhealthy agents on endpoints and self-heal agent health issues. Any agents that cannot be self-healed must be reported through the administration console and reports, accompanied with detailed steps for resolution.

3.3 Service Category 2: Network-Based Asset Discovery:

The Network-Based Asset Discovery solution will provide Digital Security Solutions to identify devices on a specific network, helping administrators gain visibility into all network-connected assets.

The Solution shall enable the process of cataloguing each device on a network, without the use or installation of an agent or software onto each individual device. The Solution shall provide for agentless asset identification whereby the packet and communications of a device is analyzed. The Solution shall inspect communication flows and the application packets themselves to determine make, model, software load, and even serial numbers, all without installation of an agent. The Solution shall provide for additional enrichment of this data, and further classification and comparison to a robust catalog of devices which allows for accurate device identification and classification.

43230000-24-STC Page 7 of 17

The Service Category 2: Network-Based Asset Discovery shall include and adhere to the following minimum specifications:

3.3.1 Agentless Discovery

Shall provide the ability to discover and query network assets and endpoints without requiring the installation of agents on each device. This can simplify deployment and reduce the impact on device performance and security. This also allows for the discovery of a broad range of assets and vulnerabilities. Shall discover a wide range of endpoints, including desktops, laptops, servers, mobile devices, and IoT devices.

3.3.2 Remote Management and Data Security

Shall provide, with or without an agent or other form of software, the ability to identify all networked devices and enforce policies remotely, without the need for direct physical access. This may include tasks such as software installation, patching, and configuration management.

3.4 Service Category 3: Endpoint Detection and Response:

The Endpoint Detection and Response solution will provide the capability to safeguard individual devices from cyber threats by preventing and responding to malicious activities in real-time.

The Solution shall detect and respond to threats on endpoint devices such as laptops, desktops, servers, and mobile devices. Endpoint Detection and Response (EDR) solutions should use a combination of techniques such as behavioral analysis, machine learning, and threat intelligence to identify and respond to security incidents in real-time. The primary purpose of EDR is to detect and respond to advanced threats that have bypassed traditional security defenses such as firewalls and antivirus software. This should be accomplished by collecting data from endpoint devices, analyzing it for signs of suspicious activity, and taking automated or manual actions to isolate and neutralize threats. EDR solutions should aim to help organizations improve their overall security posture by providing visibility into the activities taking place on endpoint devices, helping security teams respond to incidents more quickly and effectively, and providing valuable information that can be used to improve security processes and policies.

The Service Category 3: Endpoint Detection and Response shall include and adhere

3.4.1. Detection and Response

Shall record system behaviors to detect suspicious events, investigate and block malicious activity, and contain malicious activity at the endpoint. Shall use the data to investigate and provide remediation guidance for any affected systems.

43230000-24-STC Page 8 of 17

3.4.2. Endpoint Protection Platform Suite

Shall use an extended portfolio of security tools, like endpoint firewalls, device and application control, application inventory, signature matching, vulnerability and patch management and others, plus network-level tools such as secure email and sandboxing.

3.5 Service Category 4: External-Facing Asset Discovery:

The Solution shall help identify, analyze, and manage the external attack surface of Customer systems, applications, and networks. The Solution shall be a proactive approach to security that involves assessing and reducing the attack surface, which is the sum of the total of all the possible entry points and vulnerabilities that an attacker could exploit to gain access to a system or network.

The Service Category 4: External-Facing Asset Discovery shall include and adhere

3.5.1 Vulnerability Identification

The Solution shall provide the ability to enumerate the inferred vulnerability to Common Vulnerabilities and Exposures (CVEs) listed within the National Vulnerability Database tailored to the version of software or protocol that is present on the asset.

3.5.2 Device Metadata

The Solution shall assist in the utilization of device banner properties.

3.5.3 SSL/TSL Certificates

The Solution shall support querying Secure Socket Layer/Transport Layer Security (SSL/TLS) certificates for all internet connected devices attributed to Customers utilizing any field and provide internet-wide SSL/TLS certificates attributed to Customer devices.

3.5.4 Service Identification

The Solution shall support querying all identified services across all internet-connected devices across Customers and cross-correlate the queried data with information from other various security tools.

3.5.5 Scanning & Monitoring

The Solution shall support the ability to scan and monitor Customer assets visible from the public internet.

3.5.6 Banner Grabbing

The Solution shall support querying banner information across all internet-connected devices attributed to the Customer and obtain banner grab information for Threat ID/Correlation.

43230000-24-STC Page 9 of 17

3.5.7 Policy

The Solution shall provide the ability to control and issue policies of interest for the attack surface to include the ability to turn policies on or off, adjust their default priority, and their assignment status as well as provide a list of all available policies to users in a read-only format.

3.5.8 Asset Management and Ownership

The Solution shall provide the automated ability to flexibly assign network ownership supporting hierarchical network oversight relationships. The Solution shall accurately determine ownership of Customer subnetworks, domains, certificates, services, and Autonomous System Numbers (ASNs) with minimal false positives or false negatives.

3.6 Service Category 5: Email Security:

The Solution shall analyze incoming email messages and detect potential threats in real-time. The Solution shall be designed to be highly effective at identifying and blocking malicious emails, while minimizing false positives (legitimate emails that are mistakenly blocked). The Department is seeking the following two major solution types of email security:

Secure Email Gateway (SEG) - for both inbound and outbound email provided as a cloud service. This service must process and filter Simple Mail Transfer Protocol (SMTP) traffic and will require organizations to change their Mail Exchange (MX) record to point to the SEG. This type of solution is traditionally used for organizations that do not use cloud provided mail services such as Microsoft Office 365 and Google Workspace.

Integrated Cloud Email Security (ICES) - cloud email providers (e.g., Microsoft and Google) provide built-in email security hygiene capabilities. ICES capabilities supplement these native features. These solutions use API access to the cloud email provider to analyze email content without the need to change the MX record.

The Service Category 5: Email Security shall include and adhere to the following minimum specifications:

3.6.1 Content Disarm and Reconstruction

The Solution shall break down files to their discrete components in real-time and reconstruct a clean version of the email, removing anything that doesn't conform with the file type specifications, a nationally recognized standard, or company policy.

3.6.2 Multi-Source Mail Traffic Analysis

The Solution shall allow Customer configurations that have the ability to analyze emails sent and received internally and externally to and from the Customer.

3.6.3 Display Name Spoof Detection

The Solution shall detect spoofed messages based on email headers and sender names, using fuzzy matching of sender names with a predetermined list of names that are likely to be targeted.

3.6.4 Anti-Phishing Capabilities

The Solution shall provide techniques and technologies that prevent and counteract

43230000-24-STC Page 10 of 17 phishing attempts, unauthorized access, and theft. The Solution shall include, but not be limited to, the following capabilities:

o Uniform Resource Locator (URL) and Domain Analysis: The Solution shall analyze URLs and domains in email messages to identify potential phishing attacks. This includes the ability to detect fake domains and URLs that mimic legitimate sites.

o Content Analysis: The Solution shall analyze the content of email messages, including attachments and links, to identify phishing attempts. This includes the ability to detect malicious attachments and links that lead to phishing sites.

o Behavioral Analysis: The Solution shall analyze the behavior of email messages, including sender behavior and user behavior, to identify potential phishing attacks. This includes the ability to detect suspicious email senders, unusual email patterns, and other anomalies that may indicate a phishing attempt.

o Real-Time Threat Intelligence: The Solution shall leverage real-time threat intelligence feeds to identify and block known phishing attacks. This includes the ability to integrate with threat intelligence platforms and services to stay up-to-date with the latest threats.

3.6.5 Domain-Based Message Authentication, Reporting and Conformance (DMARC) on Inbound Email The Solution shall enforce domain-based message authentication, reporting, and conformance on inbound email traffic to protect internal users from receiving spoofed external messages.

3.7 Service Category 6: Content Delivery Network:

The Solution shall be designed to improve the performance, reliability, and scalability of delivering content over the internet. Its main purpose is to efficiently distribute web content, such as images, videos, files, and other static or dynamic resources, to end-users across different geographical locations. A Solution aims to deliver content faster, more reliably, and securely to end-users by leveraging a network of geographically distributed servers, reducing latency, enhancing availability, scaling bandwidth, and optimizing content delivery.

43230000-24-STC Page 11 of 17

The Service Category 6: Content Delivery Network shall include and adhere to the following minimum specifications:

3.7.1 Security

The Solution must be designed and implemented to comply with Florida cybersecurity statutes and rules. The Solution shall have multiple layers of security, including but not limited to network and application firewalls, Distributed Denial-of-Service (DDoS) protection, Secure Sockets Layer (SSL) encryption, Secure Domain Name System (DNS), Web Application Firewall, Bot Detection and real-time threat detection and response mechanisms.

3.7.2 Performance

The Solution must be able to deliver content quickly and efficiently to end-users. The Solution shall have multiple points of presence (POPs) to ensure that content is delivered from the closest server to the end-user.

3.7.3 Customization

The Solution must allow for customization of caching rules, SSL certificates, and other settings to meet the specific needs of the enterprise.

3.7.4 User Management

The Solution shall have a robust user management system that allows administrators to control access to the Solution, set permissions, and manage user accounts.

3.7.5 Content Delivery

The Solution shall be able to deliver a wide range of content types, including but not limited to static content, dynamic content, and streaming media.

3.7.6 Caching

The Solution shall be able to cache content at the edge to reduce origin server load and improve performance.

3.7.7 DDoS Protection

The Solution shall be able to protect against DDoS attacks by filtering out malicious traffic and redirecting legitimate traffic to the origin server.

3.7.8 SSL Encryption

The Solution shall support SSL encryption to ensure that content is delivered securely.

3.7.9 Load Balancing

The Solution shall have the ability to balance traffic across multiple origin servers to ensure that no single server is overloaded.

3.7.10 Real-Time Monitoring

The Solution shall provide real-time monitoring of traffic, usage, and security incidents.

3.7.11 Content Optimization

The Solution shall have tools to optimize content delivery, such as image compression and minification of HyperText Markup Language (HTML), Cascading Style Sheets (CSS), and JavaScript.

43230000-24-STC Page 12 of 17

3.7.12 Onboarding

The Solution shall include a staging environment for onboarding and changes.

3.7.13 Prevention

The Solution shall block malware pre-execution using the Solution's anti-malware prevention program.

3.7.14 State CSOC Integration

Initial integration shall include connecting each Customer to the state Cybersecurity Operations Center (CSOC) and validating with Florida Digital Service (FL[DS]) that all Solution data is properly integrated, as requested by the Customer. Integration maintenance may be required after initial integration to ensure that the Solution properly exchanges data between Customers and the CSOC. The Contractor shall address any concerns that FL[DS] has regarding integration issues.

3.8 Service Category 7: Security Operations Platform:

The Solution shall combine multiple security technologies and tools into a single integrated platform. The Solution must be designed to provide a comprehensive view of security posture, by consolidating security data from across the entire IT infrastructure.

This enables security teams to quickly detect, investigate, and respond to security threats, with the goal of minimizing the impact of security incidents and reducing overall risk. In addition to integrating multiple security technologies, extended detection and response platforms typically leverage AI and machine learning to analyze large volumes of security data and automate threat detection and response processes. This can help reduce the burden on security teams and improve the speed and accuracy of security operations.

The Service Category 7: Security Operations Platform shall include and adhere to the following minimum specifications:

3.8.1 Detection and Response

The Solution shall have the ability to detect and respond to a wide range of security threats, including malware, phishing, insider threats, and zero-day attacks.

3.8.2 Automation

The Solution shall have the ability to automate responses to threats, including containment, isolation, and remediation.

3.8.3 Incident Reporting

The Solution must allow for customization of caching rules, SSL certificates, and other settings to meet the specific needs of the enterprise. Examples of customizations that may, but are not required to, be offered include cache duration, content, types, cache locations, and priority levels.

3.8.4 Cloud Reporting

The Solution shall support multi-cloud deployments.

43230000-24-STC Page 13 of 17

3.8.5 Threat Intelligence

The Solution shall leverage threat intelligence to provide contextual information about threats and enable faster, more accurate response.

3.8.6 Incident Response

The Solution shall support incident response workflows, including playbooks and case management, to enable efficient and effective response to security incidents.

3.8.7 State CSOC Integration

Initial integration shall include connecting each Customer to the state Cybersecurity Operations Center (CSOC) and validating with FL[DS] that all Solution data is properly integrated, as requested by the Customer. Integration maintenance may be required after initial integration to ensure that the Solution properly exchanges data between Customers and the CSOC. The Contractor shall address any concerns that FL[DS] has regarding integration issues.

3.9 Optional Add-On Services

Only Add-on Services on the Price Sheet may be purchased with a Solution under a purchase order. Add-On Services without a corresponding entry on the Price Sheet shall be free of charge and considered a Value-Added Service if included on a resultant purchase order. Suggested, but not required, Add-On Services or Value-Added Services include:

3.9.1 Implementation (Optional)

Support for the initial implementation and successful deployment of the Solution for the Customer, including initial training and integration with existing systems.

3.9.2 Managed Security Services (Optional)

Shall deploy and maintain managed security services to support Customers, particularly with advanced administration of the Solution to support cybersecurity and incident response.

3.9.3 Application Management (Optional)

Shall distribute and manage native applications, provide stand-alone management for applications on unmanaged devices and application and data containment, and differentiate or isolate personal and corporate data.

3.9.4 On-Going Training (Optional)

Shall include any Solution training.

3.10 Value-Added Services

Contractors may offer additional services which clearly exceed the minimum requirements and are within the scope of this Contract, at no additional cost to the Customer. If the Contractor proposes value-added services and are accepted by the Customer, the value-added services shall become a requirement and be a part of the minimum service specifications contained in any resulting Purchase Order.

43230000-24-STC Page 14 of 17

4. Request for a Quote Requirement Customers shall issue a Request for Quote (RFQ) to all Contractors in the applicable Service Category. Prior to issuing an RFQ for Service Categories 6: Content Delivery Network and 7:

Security Operations Platform, agencies within the Enterprise shall consult with FL[DS] at purchasing@digital.fl.gov to determine if the RFQ complies with the Enterprise Architecture, as those terms are defined in section 282.0041(15), F.S. Agencies within the Enterprise shall comply with Rule 60GG-5.002, F.A.C.

4.1 Customer Specific Scope of Work

Customers may develop a Customer Specific SOW which establishes additional customer specific preferences, other requirements, or minimum service levels. If applicable, Customers shall include the Customer Specific SOW in the RFQ issued to the Contractors in a Service Category, and the Customer SOW shall be incorporated into any purchase order or customer order issued by the Customer. Customers are permitted to negotiate terms and conditions which supplement those contained in this Contract. The Customer SOW may include, but is not limited to the following information:

• Service Category

• Customer-specific scope of work requirements/service level agreement

• Customer-specific payment terms

• Customer-specific financial consequences for non-performance

• Customer-specific terms and conditions

• Anticipated timeline for work to be performed

• Additional Contractor responsibilities

• Kick off meeting requirements

• Reporting requirements

• Implementation plan, if applicable

• Security agreements, if applicable

• FL[DS] consultation, if applicable

5. Punchout Catalog and Electronic Invoicing The Contractor is encouraged to provide an MFMP punchout catalog. The punchout catalog provides an alternative mechanism for suppliers to offer the State access to Products awarded under the Contract. The punchout catalog also allows for direct communication between the MFMP eProcurement System and a supplier’s Enterprise Resource Planning (ERP) system, which can reflect real-time Product inventory/availability information.

The punchout catalog enables, Florida buyer to “punch out” to a supplier’s website. Using the search tools on the supplier’s Florida punchout catalog site, the user selects the desired Products.

When complete, the user exits the supplier’s punchout catalog site and the shopping cart (full of Products) is “brought back” to MFMP. No orders are sent to a supplier when the user exits the supplier’s punchout catalog site. Instead, the chosen Products are “brought back” to MFMP as line items in a purchase order. The user can then proceed through the normal workflow steps, which may include adding, deleting, and editing Products (i.e., line items) in the purchase order.

An order is not submitted to a supplier until the user approves and submits the purchase order, at which point the supplier receives an email with the order details.

The Contractor may supply electronic invoices in lieu of paper-based invoices for those transactions processed through MFMP. Electronic invoices may be submitted to the agency mailto:purchasing@digital.fl.gov

43230000-24-STC Page 15 of 17 through one of the mechanisms as listed below:

1) EDI (Electronic Data Interchange) This standard establishes the data contents of the Invoice Transaction Set (EDI 810) for use within the context of an Electronic Data Interchange (EDI) environment. This transaction set can be used for invoicing via the Business Network (formerly known as Ariba Network) for catalog and non-catalog goods and services.

2) PO Flip via BN This online process allows Contractors to submit invoices via the BN for catalog and non-catalog goods and services. Contractors are able to create an invoice directly from their inbox in their BN account by simply "flipping" the PO into an invoice. This option does not require any special software or technical capabilities.

The Contractor warrants and represents that it is authorized and empowered to and hereby grants the State and the third-party provider of MFMP, a State contractor, the right and license to use, reproduce, transmit, distribute, and publicly display within MFMP. In addition, the Contractor warrants and represents that it is authorized and empowered to and hereby grants the State and the third-party provider the right and license to reproduce and display within MFMP the Contractor's trademarks, system marks, logos, trade dress, or other branding designation that identifies the products made available by the Contractor under the Contract.

6. MFMP Transaction Fee Report The Contractor is required to submit complete monthly MFMP Transaction Fee Reports to the Department. Reports are due 15 calendar days after the end of each month. Information on how to submit MFMP Transaction Fee Reports online can be located at Transaction Fee and Reporting / MFMP Vendors / MyFloridaMarketPlace / State Purchasing / Business Operations / Florida Department of Management Services - DMS. Assistance with transaction fee reporting is also available by email at feeprocessing@myfloridamarketplace.com or telephone at 866-FLA-EPRO (866-352-3776) from 8:00 a.m. to 6:00 p.m. Eastern Time.

https://www.dms.myflorida.com/business_operations/state_purchasing/myfloridamarketplace/mfmp_vendors/transaction_fee_and_reporting https://www.dms.myflorida.com/business_operations/state_purchasing/myfloridamarketplace/mfmp_vendors/transaction_fee_and_reporting https://www.dms.myflorida.com/business_operations/state_purchasing/myfloridamarketplace/mfmp_vendors/transaction_fee_and_reporting mailto:feeprocessing@myfloridamarketplace.com

43230000-24-STC Page 16 of 17

7. Quarterly Sales Reports Contract Quarterly Sales Reports. The Contractor shall submit Quarterly Sales Reports in the manner and format required by the Department within 30 calendar days after the close of each State fiscal quarter (the State’s fiscal quarters close on September 30, December 31, March 31, and June 30).

The Quarterly Sales Report template can be found here: Quarterly Sales Report Format / Vendor Resources / State Purchasing / Business Operations / Florida Department of Management Services - DMS (myflorida.com). Initiation and submission of the most recent version of the Quarterly Sales Report posted on the DMS website is the responsibility of the Contractor without prompting or notification from the Department. Sales will be reviewed on a quarterly basis. If no sales are recorded in two consecutive quarters, the Contractor may be placed on probationary status, or the Department may terminate the Contract. Failure to provide the Quarterly Sales Report, or other reports requested by the Department, will result in the imposition of financial consequences and may result in the Contractor being found in default and the termination of the Contract.

Quarter 1 – (July-September) – due 30 calendar days after the close of the period.

Quarter 2 – (October-December) – due 30 calendar days after the close of the period.

Quarter 3 – (January-March) – due 30 calendar days after the close of the period.

Quarter 4 – (April-June) – due 30 calendar days after the close of the period.

8. Certified and Minority Business Enterprises Reports Upon Customer request, the Contractor shall report to each Customer, spend with certified and other minority business enterprises in the provision of commodities or services related to the Customer orders. These reports shall include the period covered, the name, minority code, and Federal Employer Identification Number of each minority business utilized during the period;

commodities and services provided by the minority business enterprise, and the amount paid to each minority business enterprise on behalf of the Customer.

9. Ad Hoc Reports The Department may require additional Contract sales information such as copies of purchase orders or ad hoc sales reports. The Contractor shall submit these documents and reports in the form acceptable to the Department within the timeframe specified by the Department.

10. Financial Consequences The Department reserves the right to impose financial consequences when the Contractor fails to comply with the requirements of the Contract. The following financial consequences will apply for the Contractor’s non-performance under the Contract. The Customer fand the Contractor may agree to add additional Financial Consequences on an as-needed basis beyond those stated herein to apply to that Customer’s resultant contract or purchase order. The State of Florida reserves the right to withhold payment or implement other appropriate remedies, such as Contract termination or nonrenewal, when the Contractor has failed to comply with the provisions of the Contract. The Contractor and the Department agree that financial consequences for non-performance are an estimate of damages which are difficult to ascertain and are not penalties.

The financial consequences below will be paid and received by the Department of Management Services within 30 calendar days from the due date specified by the Department. These financial consequences below are individually assessed for failures over each target period beginning with the first full month or quarter of the Contract performance and every month or quarter, respectively, thereafter.

https://www.dms.myflorida.com/business_operations/state_purchasing/vendor_resources/quarterly_sales_report_format https://www.dms.myflorida.com/business_operations/state_purchasing/vendor_resources/quarterly_sales_report_format https://www.dms.myflorida.com/business_operations/state_purchasing/vendor_resources/quarterly_sales_report_format

43230000-24-STC Page 17 of 17

Failure to timely provide Quarterly Sales Reports, transaction fee reports, or other reports as required will result in the imposition of financial consequences and repeated failures or non- payment of financial consequences owed under this Contract may result in the Contractor being found in default and the termination of the Contract.

No favorable action will be considered when Contractor has outstanding Contract Quarterly Sales Reports, MFMP Transaction Fee Reports, or any other documentation owed to the Department or Customer, to include fees / monies, that is required under this Contract.

11. Business Review Meetings Both the Department and Customer reserve the right to schedule business review meetings, which Contractor shall attend either virtually or in person. The Department or Customer may specify the format or agenda for the meeting. At a minimum, the Business Review Meeting may include the following topics:

a. Contract compliance.

b. Contract savings (in dollar amount and cost avoidance)

c. Spend reports by Customer

d. Recommendations for improved compliance and performance

Deliverable Performance Metric Performance Due Date

Financial Consequence for Non-Performance

Contractor will timely submit complete Quarterly Sales Reports

All Quarterly Sales Reports will be submitted timely with the required information

Completed reports are due on or before the 30th calendar day after the close of each State fiscal quarter

$250 per day late

Contractor will timely submit complete MFMP Transaction Fee Reports

All MFMP Transaction Fee Reports will be submitted timely with the required information

Completed reports are due on or before the 15th calendar day after the close of each month

$100 per day late