Attachment A RFP 758 2600000258 DPA Website and Trumpet Design and Configuration.pdf

ATTACHMENT A

Commonwealth of Kentucky Request for Proposal (RFP)

For

DPA WEBSITE AND TRUMPET DESIGN AND CONFIGURATION

RFP 758 2600000258

Release Date: January 21, 2026 CLOSING DATE AND TIME February 23, 2026, at 3:30pm ET

Issued by

The Finance and Administration Cabinet

Commonwealth Buyer:

Dianne Lee CPPB KCPM

Statewide Procurement Analyst II

COMMONWEALTH OF KENTUCKY

FINANCE AND ADMINISTRATION CABINET

Office of Procurement Services 200 Mero Street, 5th Floor

Frankfort, KY 40622

(502) 782-0799

Dianne.Lee@ky.gov

TABLE OF CONTENTS

Proposal Submission Checklist Section 1 – Summary Section 2 – Introduction Section 3 – Scope of Work Section 4 – Commonwealth Office of Technology Requirements Section 5 – Procurement Requirements and Instructions Section 6 – Proposal Submission Section 7 – Proposal Evaluation Section 8 – Negotiations Section 9 – Contract Requirements Section 10 – Standard Terms and Conditions Section 11 – Attachments mailto:Dianne.Lee@ky.gov

PROPOSAL SUBMISSION CHECKLIST

The vendor MUST include the following with the proposal submission.

If the items highlighted below are not submitted with the proposal submission, the Commonwealth MUST deem the proposal non-responsive and SHALL NOT consider for award.

All other items MUST be submitted prior to award.

� *PROPOSED TECHNICAL SOLUTION

� *PROPOSED COST SOLUTION

� TRANSMITTAL LETTER [see Section 6.7(A)]

� ATTACHMENT F Mandatory Requirement Checklist

� REVENUE FORM 10A100 KENTUCKY TAX REGISTRATION APPLICATION IF

APPLICABLE (see Section 6.7 (C)], � CERTIFICATE OF AUTHORITY- REGISTRATION WITH SECRETARY OF STATE BY

A FOREIGN ENTITY IF APPLICABLE [see Section 6.7 (D)]

� REQUIRED ANNUAL AFFIDAVIT AND OTHER AFFIDAVIT(S)

https://finance.ky.gov/office-of-the-secretary/FinanceForms/Annual%20Required%20Affidavit%20for%20Bidders%20Offer ors%20and%20Contractors.pdf

*Please see Attachment E - The Protection of Personal Information Security and Breach Investigation Procedures and Practice Act (KRS 61.931), et seq.

effective January 1, 2015.

https://finance.ky.gov/office-of-the-secretary/FinanceForms/Annual%20Required%20Affidavit%20for%20Bidders%20Offerors%20and%20Contractors.pdf https://finance.ky.gov/office-of-the-secretary/FinanceForms/Annual%20Required%20Affidavit%20for%20Bidders%20Offerors%20and%20Contractors.pdf https://finance.ky.gov/office-of-the-secretary/FinanceForms/Annual%20Required%20Affidavit%20for%20Bidders%20Offerors%20and%20Contractors.pdf

SECTION 1 - RFP SUMMARY

1.1 Estimated Schedule of RFP Activities

The following table presents the anticipated schedule for major activities associated with the RFP distribution, proposal submission, proposal evaluation process, and contract award. The Commonwealth reserves the right at its sole discretion to change the Schedule of Activities, including the associated dates and times.

Anticipated Schedule of Activities

Release of RFP

1/21/2026

Vendors’ Written Questions due by 12:00 PM ET

(SUBMIT QUESTIONS ON ATTACHMENT D-VENDORS’ QUESTION

FORM)

1/28/2026

Commonwealth’s Response to Vendors’ Written Questions 2/6/2026 Proposals due by 3:30 PM ET

2/23/2026

1.2 Issuing Office

The Commonwealth of Kentucky, Finance and Administration Cabinet, Office of Procurement Services, is issuing this RFP on behalf of the Department of Public Advocacy (DPA). The Finance and Administration Cabinet is the only office authorized to change, modify, amend, alter, or clarify the specifications, terms and conditions of this RFP.

A contract, based on this RFP, may or may not be awarded. Any contract award from this RFP is invalid until properly approved and executed by the Finance and Administration Cabinet.

1.3 Agencies to Be Served

This contract shall be for use by the DEPARTMENT OF PUBLIC ADVOCACY (DPA). No shipments shall be made except upon receipt by vendor of an official delivery order from the using agency.

Extending the Contract Use to Other Agencies The Office of Procurement Services reserves the right, with the consent of the vendor, to offer the Master Agreement resulting from this solicitation to other state agencies requiring the product(s) or service(s).

SECTION 2 - INTRODUCTION –

2.1 Purpose

The purpose of this Request for Proposal (RFP) is to solicit proposals for competitive negotiations pursuant to 200 KAR 5:307.

DPA is requesting proposals for website development and maintenance for the external agency site and for the internal training and information site. Following a significant internal effort in 2024, the Department of Public Advocacy successfully relaunched and modernized its external website with refreshed content, an updated page structure, integrated social media, and new photography. This work laid a strong foundation, but to take the site to the next level and fully meet the needs of our key audiences—clients, legislators, potential recruits, and the press— we need outside expertise. While we can manage routine updates, we lack the time and specialized design and technical skills to implement broader improvements such as accessibility compliance, mobile optimization, enhanced search features, SEO strategy, interactive features like a clickable map of offices, and a complete visual redesign. This also includes updating our website to be visible to AI functions, guaranteeing that the DPA will remain visible to relevant audiences as the internet changes with the evolution of AI-assisted searches.

These enhancements are critical to positioning DPA as a modern, accessible, and professional public defense agency. An upgraded site will improve public trust, increase traffic for recruitment, and make our mission and services easier to understand and navigate—delivering a better experience for every user.

2.2 Background

The Trumpet is a password-protected site that currently lives in a separate location than the website, but DPA would like for it to live beneath the public website, so it is more accessible to staff. It is an invaluable, long-standing repository of internal information DPA offers its employees. Staff rely on it weekly to access past trainings and webinars, locate motions in one of several motion banks, consult agency-created resources like the Courtroom Manual Series, and find staff-specific guidance on policies and procedures. Currently, The Trumpet is hosted as a subsite on the National Association for Public Defense’s (NAPD) learning platform. While DPA can manage basic content on our subsite, the platform is barebones, lacks modern functionality, and offers no ability to customize design, layout, or branding. DPA also wants to take advantage of emerging AI capabilities, allowing for enhanced searchability of motions and learning resources, which is not possible when confined to the NAPD subsite. Critically, when NAPD switched platforms, we lost decades of irreplaceable training and legal materials—data loss we had no control over. The transition also caused a long-standing perception that the site was non-functional, which we are still working to correct over two years later. Taking full ownership of The Trumpet would allow DPA to better safeguard our resources, control access and cost, build a more functional and user-friendly interface, and ensure our internal knowledge remains preserved and accessible moving forward.

SECTION 3 – SCOPE OF WORK

PROPOSALS THAT DO NOT MEET MANDATORY REQUIREMENTS WILL BE

DEEMED NON-RESPONSIVE AND WILL NOT BE CONSIDERED. REFER TO

ATTACHMENT F– MANDATORY REQUIREMENTS CHECKLIST.

Mandatory Requirement means a condition set out in the specifications or statement of work that must be met without exception.”

3.1 Scope of Work/Technical Requirements

A. Main Website (External Site)

1. Design and Visuals

a. Shall install and/or configure new WordPress or other platform website

b. Shall include base theme styling for site

c. Shall design home page

d. Shall include DPA branding on all pages

e. Shall assist in developing a page structure that improves useability and functionality

f. Shall include template(s) for future content entry

g. Shall produce mobile design and compatibility

h. Should ensure web design is intuitive and easy to navigate

i. On the "Find Offices" Page, should include an interactive map of KY, with clickable counties that take the user to the office page.

j. Should integrate a "Contact Us" messaging system on each office page.

This would allow the user to send a message to an office without the user needing an email address.

k. Shall redesign header menus and footer to improve clarity and design

l. Should integrate social media into the site (as appropriate) beyond just the footer

m. Should include breadcrumbs or navigation aids for users on deeper pages

n. Shall ensure consistent branding, typography, colors, and spacing is used throughout

2. Technical and Performance

a. Shall optimize site for various devices (phone, tablet, laptop/desktop)

b. Shall include SEO audit to evaluate website performance and make improvements to boost visibility in search engine

c. Should include Menu structure audit to ensure easy navigability

d. Should improve internal linking as needed

e. Shall ensure website adheres to new ADA requirements to accommodate users with disabilities (text alternatives for non-text content, sufficient color contrast, etc.)

f. Should include Options for larger text size or to toggle accessibility features, including required tagging of photographs and other visuals.

g. Language translation options should be made available

h. Should ensure PDFs and downloadable files are accessible (i.e., tagged for screen readers)

i. Should include improved search function

j. Shall include a documented backup and restore strategy, including automated scheduled backups and procedures for restoring all site data and configurations.

k. Shall provide a disaster recovery (DR) and failover plan, including geographic redundancy and defined Recovery Time Objective (RTO) and Recovery Point Objective (RPO) parameters.

l. Should establish ongoing support and maintenance requirements, including clearly defined Service Level Agreements (SLAs) for uptime, issue response, and resolution times.

3. Content

a. Should provide recommendations on improving jargon and call-to-actions

b. Should include more photos throughout website (we can provide photos as directed)

c. Should include Improved Contact Forms with confirmation messages

d. Should include incorporation of database (or other system) to allow for easy changing of photos and associated blurbs

4. Miscellaneous

a. Shall create and provide a content update guide for staff

b. Should set up and configure Google Analytics (e.g., for most visited pages, search terms, internal search terms, user behavior, etc.)

c. Should provide general recommendations on improvement

B. Trumpet (Internal Site)

1. Design

a. Shall install and/or configure new WordPress (or other platform) website as a subsite of the external DPA website

b. Shall include base theme styling for site

c. Shall design login landing page

d. Shall design home page

e. Should include DPA branding on all pages

f. Shall include homepage with direct access to different categories on the site (categories will be determined beforehand); this can include a directory, menu, and/or sidebar

g. Should assist in developing a page structure that improves useability and functionality

h. Should include template(s) for future content entry

i. Shall include mobile design and compatibility

j. Shall take primary role in building out and designing the new motion bank and learning materials database

2. Data Migration

a. Shall transfer all existing content from KY's current Trumpet site to new site

b. Should ensure Page hierarchies will be preserved

c. Should ensure current links to existing content will continue to work as expected

3. User accounts

a. Shall include initial setup of user accounts (we will provide an up-to-date list of logins needed)

b. Should provide Roster management for owners/admins, including creation of new accounts, password resets, edits to user accounts, ability to delete or inactivate user accounts)

c. Should provide user profile management

d. Shall integrate with established DPA user accounts, leveraging existing

Active Directory (AD) identities for authentication.

e. Should support Single Sign-On (SSO) using the organization’s Active

Directory infrastructure.

f. Should enforce Multi-Factor Authentication (MFA) in alignment with current security policies and standards.

g. Should provide role-based access controls (RBAC) to ensure users only have access to appropriate areas of the intranet (owners, admins, and others to be determined).

C. Technical Functionality:

1. Search

a. The solution should provide a unified search function that indexes and retrieves only content from the external website and the Trumpet internal platform.

b. Search should support semantic retrieval so that users find relevant documents even without exact keyword matches.

c. The search system should support filtering by metadata such as date, author, practice area, and document category.

d. Administrators should be able to configure custom relevance ranking to prioritize official resources.

e. The internal search should enforce permissions, so users only see what they are authorized to access.

f. Results should display snippets with highlighted keywords or phrases.

g. Search should provide auto-suggest and synonym expansion features.

h. Every search result should include a link or citation to the source.

i. The index should refresh at least daily (ideally hourly).

j. The system should capture search queries, zero-result searches, and click-through rates.

2. AI tools

a. The AI chatbot should only use content from our external site and internal Trumpet platform.

b. Shall ensure that any proposed use of AI or Large Language Models

(LLMs) complies with all COT ethics rules regarding AI, and shall work with DPA to obtain required signoff, including providing documentation demonstrating clean, properly governed data inputs.

c. The solution should use vector embeddings or equivalent for semantic search combined with an LLM for answer generation.

d. Solution should allow blacklisting or de-prioritizing of specific pages or categories.

e. The chatbot should retain conversational context within sessions.

f. Answers should include citations to the source page or document.

g. The index should refresh at least nightly, preferably hourly, detecting content changes automatically.

h. The chatbot should enforce internal permissions so staff only see allowed motions/documents.

i. Should detect low-confidence or ambiguous responses (e.g., below a defined confidence threshold) and, when encountered, respond with “I don’t know” and provide a clear option for human escalation.

j. The solution should log chatbot queries, unanswered questions, and satisfaction feedback.

k. The system should guarantee fast response times and 99.9% uptime.

3. Analytics

a. The system should provide dashboards summarizing chatbot usage, search queries, and site engagement.

b. Analytics should capture top queries, zero-result queries, and click-through behavior.

c. The solution should log chatbot queries, fallback instances, and user feedback.

d. Reports should show frequently accessed motions/resources/videos and unused content.

e. Analytics should capture anonymized user paths and drop-off points.

f. Website analytics should include demographics, geolocation, and device/browser type.

g. Internal analytics should show staff login frequency, time on site, and training usage.

h. Analytics should report uptime, page load times, and error rates with alerts.

i. Should support exports (CSV, Excel, PDF) and scheduled reporting.

j. All analytics should comply with internal privacy policies.

4. Content Structure

a. The solution should provide logical grouping of categories and consistent navigation.

b. Content should support metadata such as type, topic, author, and date.

c. Content management system should support reusable templates for common page types.

d. Content should be stored independently of design elements.

e. The system should support version control and content expiry workflows.

f. System should support explicit designation of content as internal-only vs public-facing.

g. The external site should use schema.org markup for key content (or other recommended site by bidder).

h. Content should follow WCAG 2.2 AA guidelines for headings, alt text, and links.

i. Content management system should support linking related documents and resources.

j. Content structure should allow new content types and metadata fields.

k. Content management system should support role-based workflows for draft, review, and publish.

5. UX Enhancements

a. The solution should provide a mobile-first design with consistent functionality.

b. Trumpet should support role-based personalized dashboards and saved searches

c. UX should include breadcrumbs, clear menus, and contextual navigation aids.

d. The interface should allow filtering, sorting, and previewing motions/documents.

e. UX should meet WCAG 2.2 AA standards with keyboard navigation and screen reader support.

f. Design should use a cohesive style guide for typography, colors, and spacing.

g. Solution should support accordions, tabs, and tooltips for structured navigation.

h. UX should include user feedback options like ratings or surveys.

i. Pages should load within 2 seconds, following best performance practices.

j. External and internal sites should use a consistent UX framework.

k. Trumpet should support configurable user alerts for new motions or updates.

l. UX should be modular and scalable for new sections and content types.

D. Design & Accessibility:

1. Modern design

a. The solution should provide a clean, modern interface with updated typography, layouts, and iconography that reflect current design best practices.

b. The design should prioritize usability, ensuring intuitive navigation, clear hierarchy of information, and minimal clutter.

c. The design should use modular components that allow for future enhancements without requiring a full redesign.

2. Consistent branding (colors, fonts, logos, layouts)

a. The solution should follow established brand guidelines, including approved logos, color palettes, fonts, and layouts across all pages and platforms.

b. Both the external website and internal Trumpet platform should use a consistent design framework, while allowing for role-appropriate branding differences.

c. The content management system should support a centralized style guide and enforce use of standardized templates, typography, and layout grids.

3. Mobile responsiveness

a. The design should adapt seamlessly to different devices (desktop, tablet, mobile), ensuring consistent access to all features.

b. Interactive elements should be touch-friendly, with sufficient spacing and tap targets for mobile usability.

c. The solution should optimize images, scripts, and layouts for fast loading on mobile networks, with pages loading in under 2 seconds on a standard 4G connection.

4. ADA/WCAG compliance

a. The design should fully comply with ADA standards and WCAG 2.2 AA guidelines, including keyboard navigation, color contrast ratios, and alt text for images.

b. The site should be compatible with assistive technologies such as screen readers (JAWS, NVDA), voice dictation software, and captioning tools.

5. Translation tools

a. The content management system should support multilingual content, with the ability to store and display translations linked to the original source document or page.

b. The system should integrate with translation tools (e.g., Google Translate API, DeepL, or equivalent) to assist in creating and maintaining multilingual content.

c. The site should include a user-facing option to switch languages at any time, with clear and accessible controls.

d. All translated content should maintain compliance with accessibility guidelines, including screen reader compatibility and proper formatting.

E. Security & Compliance:

1. Implementation of secure logins

a. The system should support secure login protocols including strong password policies, session timeouts, and optional multi-factor authentication (MFA).

b. The platform shall integrate with our existing SSO/identity provider (e.g., Azure AD) to streamline authentication across systems.

c. All credentials and authentication tokens should be transmitted using TLS 1.2+ and stored using industry-standard encryption.

2. User access levels

a. The system should implement role-based access controls, allowing assignment of permissions by role (e.g., admin, editor, staff, public user).

b. The platform should support granular access controls at the page, folder, or document level.

c. All user access and permission changes should be logged, timestamped, and available for audit.

3. Content restrictions

a. The system should support explicit designation of content as internal-only vs public-facing, with access enforced at the platform level.

b. The content management system should allow administrators to restrict access to sensitive categories (e.g., draft motions, case documents) to authorized roles only.

c. The platform should allow admins to disable downloads, printing, or external sharing of restricted content.

4. Prevention of unauthorized access or AI leakage

a. The AI/chatbot should only reference indexed internal or external site content and should not pull from outside sources or expose restricted data.

b. The system should implement DLP features to prevent copying, exporting, or exposing sensitive content through the chatbot, search, or APIs.

c. The solution should include monitoring and alerting for unauthorized access attempts, anomalous queries, or AI responses that attempt to disclose restricted content.

d. Vendors should implement safeguards to prevent any form of data leakage during development, testing, and deployment, covering both AI and non-AI systems. This should include red-team exercises or equivalent testing to validate the effectiveness of security controls.

F. Content & Search System:

1. Search functions

a. The solution should provide a unified search capability across designated sources (external website and Trumpet), while respecting content boundaries.

b. Search should support both keyword and semantic (natural language) queries to return relevant results.

c. The system should prioritize official templates, current motions, and frequently accessed content in search results.

d. Search results should display contextual snippets with highlighted matching terms.

e. The search index should refresh at least daily, detecting edits and new content automatically.

2. Filters

a. The search should support filters such as content type, practice area, author, and date range.

b. Users should be able to apply multiple filters simultaneously (e.g., motions + 2024 + appellate).

c. Administrators should be able to configure filter categories for internal vs external audiences.

d. The system should allow users to save and reuse frequently applied filter sets.

3. Tagging

a. The content management system should support metadata tagging for all content (document type, practice area, author, date, keywords).

b. Administrators should be able to create, edit, merge, and retire tags to maintain a clean taxonomy.

c. Authors should be able to apply approved tags when drafting or uploading content.

d. The platform should provide optional AI-assisted suggestions for tagging new content.

4. Draft/publish system

a. The content management system should support draft, revision history, and rollback capabilities for all content.

b. The system should provide configurable workflows (draft → review → approve → publish).

c. Only designated roles (e.g., editors, admins) shall approve or publish content.

d. The system should support scheduled publishing and automatic expiration/archival of outdated content.

e. Draft content should have the ability to be previewed in its final format before publishing.

5. Restricted content access

a. The system should allow content to be designated as public-facing or internal-only, with strict enforcement of access boundaries.

b. The content management system should allow restrictions at the page, folder, or document level, enforceable by role or user group.

c. Access rules should be inheritable (e.g., subfolders inherit parent restrictions) with override options.

d. The system should log all attempts to access restricted content, including successful and failed attempts.

e. Restricted content should not be surfaced or summarized by the chatbot for unauthorized users.

G. Account/User Management:

1. Tools and workflows for account creation

a. The system should support admin-only user account creation.

b. The platform should integrate with the organization’s existing identity provider (e.g., Azure AD) for account provisioning and deactivation.

c. Administrators should be able to bulk-import and provision accounts using CSV upload or API integration.

d. The system should allow collection of custom account attributes (e.g., office location, role, practice area).

2. Password resets

a. The platform should provide a secure, self-service password reset process via email or SMS verification.

b. Administrators should be able to reset user passwords manually and enforce credential updates on next login.

c. Password reset workflows should include multi-factor identity verification

(security questions, codes, or tokens).

d. The system should enforce password complexity rules, expiration policies, and lockouts after repeated failed attempts.

3. Role-based permissions

a. The platform should support role-based access control, with the ability to restrict permissions down to page, folder, or document level.

b. The system should include default roles (admin, editor, staff, public user) and allow creation of custom roles tailored to organizational needs.

c. Roles should allow or restrict key functions (view, edit, publish, delete, manage users) independently.

d. All role changes and permission assignments should be logged and available for audit.

4. Admin-level roster management

a. Administrators should have access to a centralized roster of all active, inactive, and pending accounts.

b. Admins should be able to update or deactivate multiple user accounts simultaneously.

c. The roster interface should include filters (role, office, status, last login) to quickly locate accounts.

d. Admin roster tools should display last login date, activity status, and provide exportable audit logs.

e. The system should support assigning limited admin rights (e.g., office-level roster management) without granting full system control.

3.2 Value Added Services

Value-added services may be added to the contract with the prior approval by the Commonwealth Office of Technology and the Office of Procurement Services Buyer of Record. Upon approval, a formal modification will be made to add the service(s). No work shall begin until a contract modification is completed and notice provided by the OPS Buyer that work may begin.

SECTION 4 – COMMONWEALTH OFFICE OF TECHNOLOGY (COT)

REQUIREMENTS

4.1 Hosting

The Commonwealth is seeking a vendor who can provide a solution per the RFP requirements. The Vendor can use servers stood up by COT to house the solution or the vendor may propose a cloud-hosted solution. If the vendor is proposing a cloud solution, the Commonwealth prefers the proposed cloud solution to be hosted on an established Commonwealth Office of Technology (COT) managed cloud tenant. If a COT managed cloud tenant is not proposed, the vendor shall propose a commercial Federal Risk and Authorization Management Program (FedRAMP) - certified or HITRUST Cloud platforms. The proposed solution must accommodate COT oversight that includes an isolated tenant, cloud network access (peering connection) and monitoring solutions.

The Commonwealth reserves the right to host any proposed solution, at any time, if deemed in the best interest of the Commonwealth.

If vendor is using any type of Artificial Intelligence (AI) please indicate this in the RFP response.

4.2 Commonwealth Information Technology Policies and Standards A. The vendor and any subcontractors shall be required to adhere to applicable

Commonwealth policies and standards.

B. The Commonwealth posts changes to COT Standards and Policies on its Commonwealth Office of Technology - Home - Commonwealth Office of Technology (Kentucky) website. Vendors and subcontractors shall ensure their solution(s) shall work in concert with all posted changes. Vendors or subcontractors that cannot comply with changes must, within thirty (30) days of the posted change, request written relief with the justification for such relief.

https://technology.ky.gov/Pages/index.aspx https://technology.ky.gov/Pages/index.aspx

The Commonwealth may: 1) deny the request, 2) approve an exception to the policy/standard, or 3) consider scope changes to the contract to accommodate required changes. Vendors or subcontractors that do not provide the response within the thirty (30) day period shall be required to comply within ninety (90) days of the change.

4.3 Compliance with Kentucky Information Technology Standards (KITS)

A. The Kentucky Information Technology Standards (KITS) reflect a set of principles for information, technology, applications, and organization. These standards provide guidelines, policies, directional statements and sets of standards for information technology. It defines, for the Commonwealth, functional and information needs so that technology choices can be made based on business objectives and service delivery. The vendor shall stay knowledgeable and shall provide a solution that works in concert with these standards for all related work resulting from this RFP.

https://technology.ky.gov/about-the-agency/Pages/kits.aspx

B. The vendor and any subcontractors may be required to submit a technology roadmap for any offered solution. Additional roadmaps will be submitted upon request of the Commonwealth. If required, the roadmap shall include, but is not limited to, planned, scheduled and projected product lifecycle dates and historical release/patch or maintenance dates for the technology. In addition, any guidance on projected release/revision/patch/maintenance schedules would be preferred.

4.4 Compliance with Industry Accepted Reporting Standards Based on Trust Service Principles and Criteria The vendor must employ comprehensive risk and threat management controls based on defined industry standards for service organizations such as ISO AICPA TSP section 100, Trust Services Principles and Criteria. The vendor must annually assert compliance and engage a third-party certification registrar to examine such assertions and controls to provide a Report, such as ISO 9000, ISO 14001, AT101 SOC 2 type 2, on Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, and Privacy, which contains an opinion on whether the operating controls effectively support the assertions. All such reports, including publicly available reports (i.e. AT 101 SOC 3) shall be made available to the Commonwealth for review.

4.5 System Vulnerability and Security Assessments

The Commonwealth reserves the right to conduct, in collaboration with the vendor, non-invasive vulnerability and security assessments of the software and infrastructure used to provide services prior to implementation and periodically thereafter. Upon completion of these assessments, the Commonwealth will communicate any findings to the vendor for action. Any cost relating to the alleviation of the findings will be the responsibility of the vendor. Mitigations will be subject to re-evaluation after completion. In cases where direct mitigation https://technology.ky.gov/about-the-agency/Pages/kits.aspx cannot be achieved, the vendor shall communicate this and work closely with the Commonwealth to identify acceptable compensating controls that will reduce risk to an acceptable and agreed upon level. An accredited third-party source may be selected by the vendor to address findings, provided they will acknowledge all cost and provide valid documentation of mitigation strategies in an agreed upon timeframe.

4.6 Privacy Assessments

The Commonwealth reserves the right to conduct privacy assessments of the collection, use, maintenance and sharing of Commonwealth data by any vendor services, software, and infrastructure used to provide services prior to implementation and periodically thereafter. Upon completion of this assessment, the Commonwealth will communicate any findings to the vendor for action. Any cost relating to the alleviation of the findings will be the responsibility of the vendor.

Mitigations will be subject to re-evaluation after completion. In cases where direct mitigation cannot be achieved, the vendor shall communicate this and work closely with the Commonwealth to identify acceptable compensating controls or privacy practices that will reduce risk to an acceptable and agreed upon level. An accredited third-party source may be selected by the vendor to address findings, provided they will acknowledge all cost and provide valid documentation of mitigation strategies in an agreed upon timeframe.

4.7 Privacy, Confidentiality and Ownership of Information

The Commonwealth is the designated owner of all Commonwealth data and shall approve all access to that data. The vendor shall not have ownership of Commonwealth data at any time. The vendor shall not profit from or share Commonwealth data. The vendor shall be in compliance with privacy policies established by governmental agencies or by state or federal law. Privacy notice statements may be developed and amended from time to time by the Commonwealth and will be appropriately displayed on the Commonwealth portal (Ky.gov). The vendor should provide sufficient security to protect the Commonwealth and COT data in network transit, storage, and cache. All Commonwealth data, including backups and archives, must be maintained at all times within the contiguous United States. All Commonwealth data, classified as sensitive or higher, as defined in Enterprise Standards, must be encrypted in-transit from vendor’s network and at rest while stored on vendor’s laptops or other portable media devices.

4.8 EU GDPR Compliance

The Commonwealth of Kentucky requires all vendor contracts to comply to the extent applicable with the European Union’s General Data Privacy Regulation [Regulation (EU) 2016/679] (the “GDPR”) when the Commonwealth is a “controller” or “processor” of “personal data” from an individual “data subject” located in the European Union, as those terms are defined in the GDPR. The vendor acknowledges and agrees that it is acting as a “processor” of “personal data” for the Commonwealth under this Agreement and that all applicable requirements of the GDPR are incorporated by reference as material terms of this Agreement. The vendor represents and warrants that (1) it is aware of and understands its compliance obligations as a “processor” under GDPR; (2) it has adopted a GDPR compliant data privacy compliance policy/program, a summary of which has been provided to the Commonwealth; (3) it will process “personal data” only in accordance with the Commonwealth’s instructions; and (4) with regard to its obligations under this Agreement, it shall comply with all applicable requirements of the GDPR. Additionally, the vendor may be found liable to the Commonwealth for damages arising from any violation of applicable requirements of GDPR by the vendor in its performance of the services hereunder.

4.9 Data Quality

The vendor shall provide proposed levels of data quality per the following dimensions.

Data Quality is the degree to which data is valid, accurate, complete, unique, timely, consistent with all requirements and business rules, and relevant for a given use. The vendor shall provide data quality definitions and metrics for any data elements. Data has to be of the appropriate quality to address the needs of the Commonwealth of Kentucky. The following dimensions can be used to assess data quality:

• Validity – The data values are in an acceptable format.

• Accuracy – The data attribute is accurate.

• Completeness – There are no null values in a data field.

• Uniqueness – There are no duplicate values in a data field.

• Timeliness – The data attribute represents information that is not out-of-date.

• Consistency – The data attribute is consistent with a business rule that may be based on that attribute itself, or on multiple attributes.

• Adherence to business rules – The data attribute or a combination of data attributes adheres to specified business rules.

4.10 License Agreements

Any proposed software agreements, i.e. license agreement, subscription agreement, end-user license agreement, etc. shall include the following language, or similar, and must be submitted to the Commonwealth Office of Technology (COT) for review and approval prior to the award of the contract:

“Governing Law shall be the Commonwealth of Kentucky, Franklin County. All terms of the vendor/subvendor agreement/EULA shall be read as applicable only to the extent permitted by Kentucky law and no term in violation of the Kentucky law, inclusive of Kentucky Procurement Law, shall be given effect.”

Any third-party software licenses and cloud resources necessary for the proposed solution may be procured via the Commonwealth’s existing contracts.

4.11 Software Version Requirements

All commercially supported and Commonwealth approved software components such as Operating system (OS), Database software, Application software, Web Server software, Middle Tier software, and other ancillary software must be kept current. In the event that a patch interferes with the solution, the vendor must present a plan for compliance to the Commonwealth outlining the constraints and an appropriate plan of action to bring the solution in to compliance to allow this patch to be applied in the shortest timeframe possible, not to exceed three (3) months, unless otherwise negotiated with the Commonwealth.

4.12 No Surreptitious Code Warranty

The vendor represents and warrants that no copy of licensed software provided to the Commonwealth contains or will contain any Self-Help Code or any Unauthorized Code as defined below. This warranty is referred to in this contract as the "No Surreptitious Code Warranty”.

As used in this contract, "Self-Help Code" means any back door, time bomb, drop-dead device, or other software routine designed to disable a computer program automatically with the passage of time or under the positive control of a person other than the licensee of the software. Self-Help Code does not include Software routines in a computer program, if any, designed to permit an owner of the computer program (or other person acting by authority of the owner) to obtain access to a licensee's computer system(s) (e.g. remote access) for purposes of maintenance or technical support.

As used in this contract, "Unauthorized Code" means any malware designed to permit unauthorized access to disable, erase, or otherwise harm software, equipment, or data; or to perform any other such actions. The term Unauthorized Code does not include Self-Help Code.

In addition, vendor will use up-to-date commercial virus detection software to detect and remove any viruses from any software prior to delivering it to the Commonwealth.

The vendor shall defend the Commonwealth against any claim and indemnify the Commonwealth against any loss or expense arising out of any breach of the No Surreptitious Code Warranty.

4.13 Network Connection Requirements

A. Vendor shall work with COT to establish any network connections. If a secure site-to-site connection is required, the vendor shall employ a secure site-to-site connection procured by the Agency from COT.

B. Vendor shall, at COT’s discretion, provide appropriate access to enable the Commonwealth to perform additional security measures, such as decryption of the network traffic if required for inspection. If the proposed solution does not have the ability to meet this requirement, the vendor must provide an alternative such as audit reporting of this function.

C. Vendor should provide notifications to the Commonwealth Service Desk for unplanned outages within fifteen (15) minutes.

D. Vendor shall notify COT Change Management, through the Commonwealth

Services Desk, a minimum of two (2) business days prior to any planned outage.

E. Vendor, in conjunction with the agency, shall provide a Business Impact

Assessment (BIA) to appropriately classify all data before production/go-live.

F. Vendor shall include a Web Application Firewall when application houses any data classified as sensitive or higher as defined in KITS standards.

G. Vendor shall provide Recovery Time Objective (RTO) and Recovery Point

Objective (RPO) services. Vendor shall provide those services to achieve those SLAs.

4.14 OS Requirements

A. Non-On Prem Solutions

1. No Commonwealth data shall be co-mingled with another entity, without the prior approval of the Commonwealth.

2. Vendor shall provide a solution to move data to the Commonwealth, if required by the Commonwealth.

a. At the end of the contract, the vendor shall provide all agency data in a useable standard data format (such as asci, csv, etc.) that can be converted to a subsequent system. The vendor shall cooperate to this end with the agency and/or a vendor of the agency’s choice, in a timely and efficient manner.

b. Vendor shall address the destruction of Commonwealth data as defined in CIO-092 and provide a certification of the complete and permanent deletion the Commonwealth data.

B. Infrastructure as a Service

1. Vendor shall work with the agency and COT to establish all administrative personnel engagements.

2. Vendor shall meet certification requirements for classification of data being stored.

3. Vendor shall, at COT’s request, provide appropriate access to enable the Commonwealth to perform additional security measures in compliance with Commonwealth Enterprise Policies, Standards, and/or any Federal or State requirements.

4. Vendor shall provide an Exit Strategy, to move all data to the Commonwealth Data Center, if required by the Commonwealth.

At the end of the contract, the vendor shall provide all agency data in a form that can be converted to any subsequent system of the agency’s choice. The vendor shall cooperate to this end with the vendor of the agency’s choice, in a timely and efficient manner.

4.15 Project Governance

Vendor shall work with the agency and appropriate COT offices, when needed, in the cases of data governance, security aspects, hosting, integration, etc., provided that such work does not expand the scope of the services as described in this RFP absent a corresponding change order agreed to by the parties reflecting such expansion.

4.16 Monitoring Requirements for On Premise and Cloud (SaaS)

Vendor shall work with the agency and COT to establish a monitoring solution.

Vendors shall provide a view into their environment either by providing a COT and agency approved comprehensive dashboard or allow COT to install their KITS compliant infrastructure and application monitoring solution; to include but not limited to performance and availability. For a Cloud solution, Vendor is expected to provide a monitoring solution.

4.17 Application and Service Requirements

Current Enterprise Applications and Services

1. COT provides a number of Enterprise Shared Services to State agencies.

Vendor shall use published IT Applications and Services provided on KITS for: Enterprise Service Bus, Enterprise Content Management, Data Warehousing, Data Analytics and Reporting, Business Intelligence, Web Services, GIS, unless explicitly approved by COT.

2. Vendor provided dedicated application components (i.e., Application Servers, Databases, etc.) shall comply with KITS or if the technology is not included in KITS, the technology must be accepted by the Commonwealth for inclusion in KITS or granted a written exception to KITS according to COT Information Technology Standards Policy currently CIO-051.

3. Vendor applications must describe in detail all available features and functionality accessible via APIs.

4. All business applications must support the ability to use modern authentication for authentication and authorization. Modern authentication technologies would include SAML 2.0, WSFED, OAuth, or OpenID Connect.

4.18 Project Management Requirements

The COT Division of Governance and Strategy (COT-DGS) is responsible for overseeing large and complex technology projects throughout the Commonwealth.

The vendor shall adhere to Project Management standards and reporting requirements established by COT-DGS, which are posted at https://technology.ky.gov/services-and-support/Pages/About-the-Project- Management-Branch.aspx. These include, but are not limited to, having a documented project schedule, risk management, issue management and reporting project status to the CIO monthly in the format defined by COT-DGS. In addition to the project management standards required by COT-DGS, agency specific requirements may be defined in this RFP.

4.19 Applicable Security Control Framework Compliance

The vendor must have an awareness and understanding of the NIST Special Publication 800-53 Security Control Framework and employ safeguards that meet or exceed the moderate level controls as defined within the standard. The vendor must provide sufficient safeguards to provide reasonable protections around the Commonwealth’s data to ensure that the confidentiality, integrity, and availability is maintained at an appropriate level. These include but are not limited to:

• Access Control

The vendor must employ policy and process that provide for stringent control to limit physical and logical access to systems that house Commonwealth data, on a need to know basis, provide clear separation of duties, and adheres to least privilege principles.

• Awareness and Training The vendor must provide the appropriate role specific training for staff to ensure that there is awareness and understanding of roles and responsibilities as they relate to the protections around the Commonwealth’s data.

• Audit and Accountability There must be sufficient auditing capability to ensure that actions are tracked and there is individual accountability for all actions taken by vendor staff.

• Configuration Management The vendor must work within established baselines that provide minimal functionality needed to ensure service delivery without exposing unnecessary risk. The vendor must also employ structured change control processes that provide a level of coordination with the client agreed upon in a Service Level Agreement (SLA).

• Contingency Planning The vendor must employ contingent planning policy and procedures that ensure service delivery based on agreed SLA levels while maintaining all Commonwealth data within the continental Unites States.

• Identification and Authorization The vendor must employ appropriate identity and access management policies and procedures to ensure that access is appropriately authorized and managed at a level to ensure that access is provisioned and de-provisioned in a timely and efficient manner.

• Incident Response The vendor must employ policy and procedures to ensure that an appropriate response to all identified security incidents are addressed in a timely manner and are reported to the appropriate parties in an agreed upon SLA timeframe.

https://technology.ky.gov/services-and-support/Pages/About-the-Project-Management-Branch.aspx https://technology.ky.gov/services-and-support/Pages/About-the-Project-Management-Branch.aspx

The vendor must also ensure that all staff are sufficient trained to ensure that they can identify situations that are classified as security incidents.

• Maintenance The vendor must employ policy and procedures that ensure that all maintenance activities are conducted only by authorized maintenance staff leveraging only authorized maintenance tools.

• Media Protection The vendor must employ policy and procedure to ensure that sufficient protections exist to protect Commonwealth data on all storage media throughout the media lifecycle and maintain documentation from media creation through destruction.

• Physical and Environmental Controls The vendor must employ physical and environmental policies and procedures that ensure that the service and delivery infrastructure are located in a physically secure and environmentally protected environment to ensure the confidentiality, integrity, and availability of Commonwealth data.

• Personnel Security The vendor must employ policies and procedures to ensure that all staff that have access to systems that house, transmit, or process Commonwealth data have been appropriately vetted and have been through a background check at the time of hire and periodically thereafter.

• System and Communications Protections The vendor must employ physical and logical protection that protect system communications and communication media from unauthorized access and to ensure adequate physical protections from damage.

4.20 IRS Publication 1075 -Exhibit 7 Safeguarding Contract Language Publication 1075 (Rev. 11-2021) (irs.gov)

I. PERFORMANCE

In performance of this contract, the Contractor agrees to comply with and assume responsibility for compliance by officers or employees with the following requirements:

(1) All work will be performed under the supervision of the contractor.

(2) The contractor and contractor’s officers or employees to be authorized access to FTI must meet background check requirements defined in IRS Publication 1075.

The contractor will maintain a list of officers or employees authorized access to FTI. Such list will be provided to the agency and, upon request, to the IRS.

(3) FTI in hardcopy or electronic format shall be used only for the purpose of carrying out the provisions of this contract. FTI in any format shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of this contract.