Attachment A - Terms and Conditions - RFB 758 2600000066.pdf

ELECTRONIC BID SUBMISSION

Bid responses shall be received by electronic submission in the eProcurement system.

An electronic bid shall be authorized by the proper agent of the firm by the act of submitting it electronically through the eProcurement system.

Bid information MUST be completed online. Response must contain all required information for the Solicitation. A separate Bid Sheet is attached and must be included with the response. Bidders MUST enter $.01 in the Unit Price field as the electronic bid. This is the ONLY pricing that is to be entered electronically. All actual pricing must be on the Bid Sheet.

All bidders MUST be registered in the Commonwealth eProcurement System via the Vendor Self Service System at https://vss.ky.gov

Allow 24 – 48 hours to complete Vendor Registration. Vendors must be logged in to their Vendor Self Service (VSS) account in order to submit a response. Registrations completed the day of bid closing must be completed by the Vendor in the VSS portal. The Customer Resource Center is not able to complete registrations and activate accounts on the same day. Closing dates will not be extended for Vendors not registered by the date/time of the bid closing. Vendor Self Service Registration Guides are provided at https://vss.ky.gov

All bidders are cautioned to begin their electronic submission in sufficient time to complete before the closing date and time. Delays due to technical difficulties or document upload impediments shall not be justification for acceptance of a late bid or proposal. Vendor attention to this advisory is encouraged. If you need assistance, please contact the Customer Resource Center (CRC) by email at Finance.CRCGroup@ky.gov or phone 502-564-9641 or toll-free 877-973-HELP (4357).

Online bid responses must be in an “Accepted” status and shall be assigned a date and time stamp from the eProcurement system at the time of final acceptance and formal submission by the vendor. The system will not allow submission of an online response after the published date and time for closing.

An offer may be modified or withdrawn by electronic or written notice ONLY if received prior to the bid closing date and time. An electronic offer may be modified by applying the appropriate electronic signature and following the procedure in the state’s eProcurement signature.

https://vss.ky.gov/ https://vss.ky.gov/ mailto:Finance.CRCGroup@ky.gov

The following items MUST be submitted prior to award:

_____REVENUE FORM 10A100 KENTUCKY TAX REGISTRATION APPLICATION

(see Section 36)

_____CERTIFICATE OF AUTHORITY – REGISTRATION WITH SECRETARY OF

STATE BY A FOREIGN ENTITY (see Section 38)

_____REQUIRED AFFIDAVIT(S) (See Attachment A)

_____ PROTECTION OF PERSONAL INFORMATION SECURITY AND BREACH

INVESTIGATION PROCEDURES AND PRACTICES ACT (See Attachment E)

_____ STANDARD FLOOD HAZARD DETERMINATION DOCUMENTATION FOR

VENDOR’S SITE (See Section 2.A.7)

_____ PROOF OF BONDED IN HOUSE COURIERS (See Section 2.A.12)

*Please see Attachment E - The Protection of Personal Information Security and Breach Investigation Procedures and Practice Act (KRS 61.931), et seq.

effective January 1, 2015.

ATTACHMENT A

Commonwealth of Kentucky Request for Bid (RFB)

For

OFF-SITE DATA AND DOCUMENT STORAGE

RFB 758 2600000066

Issued by The Finance and Administration Cabinet

On Behalf Of

COMMONWEALTH OFFICE OF TECHNOLOGY (COT)

Release Date: August 11, 2025 Vendors’ Written Questions Due: August 15, 2025, at 12:00PM ET

Commonwealth’s Response to Written Questions: August 19, 2025 CLOSING DATE AND TIME: August 26, 2025, at 1:30PM ET

Commonwealth Buyer:

Dianne Lee, KCPM

COMMONWEALTH OF KENTUCKY

FINANCE AND ADMINISTRATION CABINET

Office of Procurement Services

200 MERO STREET, 5TH FLOOR

FRANKFORT KY 40622

(502) 782-0799

Dianne.Lee@ky.gov mailto:Dianne.Lee@ky.gov

BID READINGS

Any person wishing to hear a bid reading may call the OPS conference line at

844-603-5060, Conference ID number 240522005, and Participant Code 33957, at 3:30pm, ET on the bid closing date.

PLEASE READ THIS SOLICITATION AND ITS INSTRUCTIONS IN ITS ENTIRETY.

This is a Request for Bid (RFB).

Vendors shall comply with the terms and conditions stated in the solicitation.

Any efforts to negotiate these terms and conditions SHALL NOT be accepted and SHALL cause the bid to be deemed non-responsive.

All proposed pricing shall remain valid for a minimum of sixty (60) calendar days after the bid due date.

This Contract shall be awarded as Group All. Vendors shall bid all line items, otherwise bid shall be deemed non-responsive.

Vendors should review and comply with the general bidding requirements listed under “Procurement Laws, Preference, Regulations and Policies” and “Response to Solicitation” located on the eProcurement Web page at https://finance.ky.gov/eProcurement/Pages/procurement-laws-regulations-and-policies.aspx and https://finance.ky.gov/eProcurement/Pages/doing-business-with-the-commonwealth.aspx respectively. The vendor must comply with all applicable statutes, regulations and policies related to this procurement.

https://finance.ky.gov/eProcurement/Pages/procurement-laws-regulations-and-policies.aspx https://finance.ky.gov/eProcurement/Pages/procurement-laws-regulations-and-policies.aspx https://finance.ky.gov/eProcurement/Pages/doing-business-with-the-commonwealth.aspx https://finance.ky.gov/eProcurement/Pages/doing-business-with-the-commonwealth.aspx

Solicitation

Terms and Conditions

Master Agreement

Section 1 Scope of Contract The Office of Procurement Services issues this solicitation to establish a Master Agreement for Off-Site Data and Document Storage to include PHYSICAL storage of paper, film, tapes, disks, drives, etc. ONLY. This does not include Cloud Storage.

Section 2 Requirements A. Scope of Service

Vendor shall:

1) Provide an environmentally controlled and secure off-site data and document storage facility with a delivery and pickup exchange service. The exchange service shall be performed seven (7) days a week during the hours of 8:00 a.m. to 4:30 p.m. EST at the Commonwealth Office of Technology (COT), Commonwealth Data Center and as requested by other agencies located in the Frankfort, Kentucky area. The Commonwealth shall have the option to change the exchange service and times depending upon the Commonwealth's business needs.

2) Have an established off-site facility and courier service.

3) Be geographically located a minimum of twenty (20) miles away from the

Commonwealth’s Data Center located at 101 Cold Harbor Drive in Frankfort, Kentucky to ensure that the storage location will not be subjected to the same potential disaster as the Data Center.

4) Have an off-site storage facility that shall be easily accessible and located within a two (2) hour drive of the Central Kentucky area.

5) Have a vault that is built to four (4) hour fire rated architectural specifications.

6) Mandate that no flammable or combustible material be stores in the vault.

7) Standard Flood Hazard Determination for the vendor’s site is required to prove that the facility is not in an area of flood risk. The vendor must provide documentation with the bid response to prove compliance with this requirement.

The vendor shall be totally responsible for all cost involved with this requirement.

8) Have a storage vault that is environmentally controlled to maintain a constant temperature (between 60 - 75 degrees) and a humidity level (between 50 – 55 percent) suitable for the storage of magnetic media.

9) Have a fire suppression system, which activates automatically, that shall be monitored constantly and shall not result in damages to the Commonwealth’s data or documents stored in the vendor’s facility.

10) Have a physical security procedure and access control system such that:

a. Access to the storage vault is through a limited number of access points. The vendor should provide the number of access points in the bid response on Attachment B.

b. Access to the storage vault area shall be controlled by a card-key system or equivalent and/or is visually controlled by personnel only.

c. Isolate and separate Commonwealth data from other entities or customers unless otherwise agreed upon by the Commonwealth.

d. Ensure that access points to the storage vault area that are not visible by or attended by personnel on duty are monitored by a closed-circuit cable television system and the daily surveillance video shall be retained for thirty

(30) days or greater.

e. Ensure that access to the storage vault area during off-duty hours are monitored by a security service. There should be 24 x 7 guard presence. The successful vendor shall provide the name and phone number of the security company providing this service after contract award.

11) Provide all storage containers and delivery/pickup exchange service of computer and micrographic records to the Commonwealth Data Center and other agency locations in the Frankfort area. The purpose of the exchange service will be to exchange the various generations of backup and/or hardcopy documentation.

12) Provide bonded in-house couriers rather than using a third-party courier service. The vendor must provide documentation with the bid response to prove that its in-house couriers are bonded and vendor is in compliance with this requirement. Thereafter, documentation of continued proof and any changes must be submitted to the Commonwealth on the first business day of each month to stephanier.williams@ky.gov.

13) Provide for transportation of data in temperature-controlled vehicles with provisions for securing the media to protect against highway impact, unauthorized access, theft and employee security breach during storage and transport that is also in compliance with the IRS Publication 1075 concerning the safeguarding of computer media that contains Federal Tax Information. The vendor shall have a chain of custody process (i.e. Bill of Lading at pickup, etc.)

14) Provide two-way communications with vehicle operations at all times.

15) Maintain controlled access to the computer media through a system that allows access to media only by authorized Commonwealth of Kentucky personnel. The system used shall require positive identification of personnel and ensure that unauthorized access is not allowed from departments of state government or by personnel outside state government.

16) Provide the Commonwealth of Kentucky with off-hours access/pickup capability of its stored magnetic media and/or documentation. This service shall only be used in case of an actual emergency, for disaster recovery testing or for selective data recovery due to hardware or other failure. This off-hours pickup and delivery service shall also be provided for the Commonwealth’s Alternate Data Center that is located in the Northern Kentucky area. The off-site storage facility shall have computer and micrographic records accessible twenty-four (24) hours per day, three hundred and sixty-five (365) days per year.

17) Maintain an accurate inventory of all stored cases/records.

18) Throughout the life of the contract, maintain a Customer Inventory Website that allows all Commonwealth customer agencies to access the website (with the mailto:stephanier.williams@ky.gov proper security credentials) on an as needed basis. The website shall be available seven (7) days a week, twenty-four (24) hours a day and the minimum features of the site shall include the following:

a. Accessible through the Internet via a KITS approved Internet browser

b. Provides for the establishment of a unique user ID and password for each system user within a customer agency.

c. Provides basic instructions that describe the procedures to access/use the system and the features and functionality of the system.

d. Provides an email address and phone number to report/resolve any operational problems encountered while using the system.

e. Allows a customer agency to query the status of any stored case or item

(cartridge, etc.) per bar code number.

19) Be responsible for the proper custody and care of any Commonwealth-owned property that may be stored at the vendor facility in connection with the performance of this contract. The vendor shall reimburse the Commonwealth for any property loss or damage. Normal wear and tear is exempt.

20) Comply with the provisions of the Privacy Act of 1974 and instruct its employees to use the same degree of care as it uses with its own data to keep confidential information concerning client data, the business of the Commonwealth, its financial affairs, its relations with its citizens and its employees, as well as any other information shall be considered very confidential. Vendor personnel staffing this project may be required to sign a non-disclosure agreement at the time of contract award.

21) Provide, at no extra charge to the Commonwealth, assistance in turning over all of the Commonwealth’s property to the Commonwealth or its designated agent at the end of the contract period or within one (1) month from the Commonwealth’s request. This task shall include provision for the following:

a. Preparing and providing packing containers

b. Preparing an itemized inventory listing

c. Loading materials into boxes

d. Listing volume serial ranges on boxes

e. Preparing inventory of boxes

f. Palletizing the inventory for shipment

B. Fixed Rates for Storage and Courier Service (See Attachment B)

Pricing shall be based on fixed rates for storage and courier service per specifications on Attachment B.

Rates shall also be for archival storage of tape reels, and tape cartridges or smaller media per agency. This storage should have infrequent retrieval. Archival storage will not require the following specifications as listed in this Solicitation:

1) Twenty-four (24) hour – 365 day access

2) Vendor inventory

3) Rush delivery

The courier service rates shall be itemized for:

1) Work Week (Monday through Friday) daily pickup/delivery service to COT and other agency locations within Franklin, Jefferson and Boone Counties

2) Weekend (Saturday and Sunday) pickup/delivery service to COT and other agency locations within Franklin, Jefferson and Boone Counties

3) Emergency (Rush) pickup/delivery service (Per agency specifications 7x24) to COT and other agency locations within Franklin, Jefferson and Boone Counties

4) Disaster Recovery Delivery Services (DR Test and Real Disaster) Overnight Delivery Charge (Sterling Forest, New York and Columbus, Ohio)

5) Temporary Data Backup Storage Fee (Price per square foot)

6) Archival Data/Document Storage Fee (Price per square foot)

These courier service rates will be per exchange per agency. All courier service rates shall include the librarian filing fees (retrieval and access) and round-trip transportation to and from the Commonwealth Data Center or other agency locations regardless of the delivery/pickup total volume.

Section 2A Commonwealth Office of Technology (COT) Requirements, if applicable

1. Commonwealth Information Technology Policies and Standards A. The vendor and any subcontractors shall be required to adhere to applicable

Commonwealth policies and standards.

B. The Commonwealth posts changes to COT Standards and Policies on its Commonwealth Office of Technology - Home - Commonwealth Office of Technology (Kentucky) website. Vendors and subcontractors shall ensure their solution(s) shall work in concert with all posted changes. Vendors or subcontractors that cannot comply with changes must, within thirty (30) days of the posted change, request written relief with the justification for such relief.

The Commonwealth may: 1) deny the request, 2) approve an exception to the policy/standard, or 3) consider scope changes to the contract to accommodate required changes. Vendors or subcontractors that do not provide the response within the thirty (30) day period shall be required to comply within ninety (90) days of the change.

2. Compliance with Kentucky Information Technology Standards (KITS) A. The Kentucky Information Technology Standards (KITS) reflect a set of principles for information, technology, applications, and organization. These standards provide guidelines, policies, directional statements and sets of standards for information technology. It defines, for the Commonwealth, functional and information needs so that technology choices can be made based on business objectives and service delivery. The vendor shall stay knowledgeable and shall provide a solution that works in concert with these standards for all related work resulting from this RFB.

https://technology.ky.gov/about-the-agency/Pages/kits.aspx

B. The vendor and any subcontractors may be required to submit a technology roadmap for any offered solution. Additional roadmaps will be submitted upon request of the Commonwealth. If required, the roadmap shall include, but is not limited to, planned, scheduled and projected product lifecycle dates and https://technology.ky.gov/Pages/index.aspx https://technology.ky.gov/Pages/index.aspx https://technology.ky.gov/about-the-agency/Pages/kits.aspx historical release/patch or maintenance dates for the technology. In addition, any guidance on projected release/revision/patch/maintenance schedules would be preferred.

3. Compliance with Industry Accepted Reporting Standards Based on Trust Service Principles and Criteria The vendor must employ comprehensive risk and threat management controls based on defined industry standards for service organizations such as ISO AICPA TSP section 100, Trust Services Principles and Criteria. The vendor must annually assert compliance and engage a third-party certification registrar to examine such assertions and controls to provide a Report, such as ISO 9000, ISO 14001, AT101 SOC 2 type 2, on Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, and Privacy, which contains an opinion on whether the operating controls effectively support the assertions. All such reports, including publicly available reports (i.e. AT 101 SOC

3) shall be made available to the Commonwealth for review.

4. System Vulnerability and Security Assessments The Commonwealth reserves the right to conduct, in collaboration with the vendor, non-invasive vulnerability and security assessments of the software and infrastructure used to provide services prior to implementation and periodically thereafter. Upon completion of these assessments, the Commonwealth will communicate any findings to the vendor for action. Any cost relating to the alleviation of the findings will be the responsibility of the vendor. Mitigations will be subject to re-evaluation after completion. In cases where direct mitigation cannot be achieved, the vendor shall communicate this and work closely with the Commonwealth to identify acceptable compensating controls that will reduce risk to an acceptable and agreed upon level. An accredited third-party source may be selected by the vendor to address findings, provided they will acknowledge all cost and provide valid documentation of mitigation strategies in an agreed upon timeframe.

5. Privacy Assessments The Commonwealth reserves the right to conduct privacy assessments of the collection, use, maintenance and sharing of Commonwealth data by any vendor services, software, and infrastructure used to provide services prior to implementation and periodically thereafter. Upon completion of this assessment, the Commonwealth will communicate any findings to the vendor for action. Any cost relating to the alleviation of the findings will be the responsibility of the vendor. Mitigations will be subject to re-evaluation after completion. In cases where direct mitigation cannot be achieved, the vendor shall communicate this and work closely with the Commonwealth to identify acceptable compensating controls or privacy practices that will reduce risk to an acceptable and agreed upon level. An accredited third-party source may be selected by the vendor to address findings, provided they will acknowledge all cost and provide valid documentation of mitigation strategies in an agreed upon timeframe.

6. Privacy, Confidentiality and Ownership of Information

The Commonwealth is the designated owner of all Commonwealth data and shall approve all access to that data. The vendor shall not have ownership of Commonwealth data at any time. The vendor shall not profit from or share Commonwealth data. The vendor shall be in compliance with privacy policies established by governmental agencies or by state or federal law. Privacy notice statements may be developed and amended from time to time by the Commonwealth and will be appropriately displayed on the Commonwealth portal (Ky.gov). The vendor should provide sufficient security to protect the Commonwealth and COT data in network transit, storage, and cache. All Commonwealth data, including backups and archives, must be maintained at all times within the contiguous United States. All Commonwealth data, classified as sensitive or higher, as defined in Enterprise Standards, must be encrypted in-transit from vendor’s network and at rest while stored on vendor’s laptops or other portable media devices.

7. Applicable Security Control Framework Compliance The vendor must have an awareness and understanding of the NIST Special Publication 800-53 Security Control Framework and employ safeguards that meet or exceed the moderate level controls as defined within the standard. The vendor must provide sufficient safeguards to provide reasonable protections around the Commonwealth’s data to ensure that the confidentiality, integrity, and availability is maintained at an appropriate level. These include but are not limited to:

• Access Control The vendor must employ policy and process that provide for stringent control to limit physical and logical access to systems that house Commonwealth data, on a need to know basis, provide clear separation of duties, and adheres to least privilege principles.

• Awareness and Training The vendor must provide the appropriate role specific training for staff to ensure that there is awareness and understanding of roles and responsibilities as they relate to the protections around the Commonwealth’s data.

• Audit and Accountability There must be sufficient auditing capability to ensure that actions are tracked and there is individual accountability for all actions taken by vendor staff.

• Configuration Management The vendor must work within established baselines that provide minimal functionality needed to ensure service delivery without exposing unnecessary risk. The vendor must also employ structured change control processes that provide a level of coordination with the client agreed upon in a Service Level Agreement (SLA).

• Contingency Planning The vendor must employ contingent planning policy and procedures that ensure service delivery based on agreed SLA levels while maintaining all Commonwealth data within the continental Unites States.

• Identification and Authorization

The vendor must employ appropriate identity and access management policies and procedures to ensure that access is appropriately authorized and managed at a level to ensure that access is provisioned and de-provisioned in a timely and efficient manner.

• Incident Response The vendor must employ policy and procedures to ensure that an appropriate response to all identified security incidents are addressed in a timely manner and are reported to the appropriate parties in an agreed upon SLA timeframe.

The vendor must also ensure that all staff are sufficient trained to ensure that they can identify situations that are classified as security incidents.

• Maintenance The vendor must employ policy and procedures that ensure that all maintenance activities are conducted only by authorized maintenance staff leveraging only authorized maintenance tools.

• Media Protection The vendor must employ policy and procedure to ensure that sufficient protections exist to protect Commonwealth data on all storage media throughout the media lifecycle and maintain documentation from media creation through destruction.

• Physical and Environmental Controls The vendor must employ physical and environmental policies and procedures that ensure that the service and delivery infrastructure are located in a physically secure and environmentally protected environment to ensure the confidentiality, integrity, and availability of Commonwealth data.

• Personnel Security The vendor must employ policies and procedures to ensure that all staff that have access to systems that house, transmit, or process Commonwealth data have been appropriately vetted and have been through a background check at the time of hire and periodically thereafter.

• System and Communications Protections The vendor must employ physical and logical protection that protect system communications and communication media from unauthorized access and to ensure adequate physical protections from damage.

8. IRS Publication 1075 -Exhibit 7 Safeguarding Contract Language Publication 1075 (Rev. 11-2021) (irs.gov)

I. PERFORMANCE

In performance of this contract, the Contractor agrees to comply with and assume responsibility for compliance by officers or employees with the following requirements:

(1) All work will be performed under the supervision of the contractor.

(2) The contractor and contractor’s officers or employees to be authorized access to FTI must meet background check requirements defined in IRS Publication 1075. The contractor will maintain a list of officers or employees authorized https://www.irs.gov/pub/irs-pdf/p1075.pdf access to FTI. Such list will be provided to the agency and, upon request, to the

IRS.

(3) FTI in hardcopy or electronic format shall be used only for the purpose of carrying out the provisions of this contract. FTI in any format shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of this contract.

Inspection or disclosure of FTI to anyone other than the contractor or the contractor’s officers or employees authorized is prohibited.

(4) FTI will be accounted for upon receipt and properly stored before, during, and after processing. In addition, any related output and products require the same level of protection as required for the source material.

(5) The contractor will certify that FTI processed during the performance of this contract will be completely purged from all physical and electronic data storage with no output to be retained by the contractor at the time the work is completed.

If immediate purging of physical and electronic data storage is not possible, the contractor will certify that any FTI in physical or electronic storage will remain safeguarded to prevent unauthorized disclosures.

(6) Any spoilage or any intermediate hard copy printout that may result during the processing of FTI will be given to the agency. When this is not possible, the contractor will be responsible for the destruction of the spoilage or any intermediate hard copy printouts and will provide the agency with a statement containing the date of destruction, description of material destroyed, and the destruction method.

(7) All computer systems receiving, processing, storing, or transmitting FTI must meet the requirements in IRS Publication 1075. To meet functional and assurance requirements, the security features of the environment must provide for the managerial, operational, and technical controls. All security features must be available and activated to protect against unauthorized use of and access to

FTI.

(8) No work involving FTI furnished under this contract will be subcontracted without the prior written approval of the IRS.

(9) Contractor will ensure that the terms of FTI safeguards described herein are included, without modification, in any approved subcontract for work involving

FTI.

(10) To the extent the terms, provisions, duties, requirements, and obligations of this contract apply to performing services with FTI, the contractor shall assume toward the subcontractor all obligations, duties and responsibilities that the agency under this contract assumes toward the contractor, and the subcontractor shall assume toward the contractor all the same obligations, duties and responsibilities which the contractor assumes toward the agency under this contract.

(11) In addition to the subcontractor’s obligations and duties under an approved subcontract, the terms and conditions of this contract apply to the subcontractor, and the subcontractor is bound and obligated to the contractor hereunder by the same terms and conditions by which the contractor is bound and obligated to the agency under this contract.

(12) For purposes of this contract, the term “contractor” includes any officer or employee of the contractor with access to or who uses FTI, and the term “subcontractor” includes any officer or employee of the subcontractor with access to or who uses FTI.

(13) The agency will have the right to void the contract if the contractor fails to meet the terms of FTI safeguards described herein.

II. CRIMINAL/CIVIL SANCTIONS

(1) Each officer or employee of a contractor to whom FTI is or may be disclosed shall be notified in writing that FTI disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any FTI for a purpose not authorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution.

(2) Each officer or employee of a contractor to whom FTI is or may be accessible shall be notified in writing that FTI accessible to such officer or employee may be accessed only for a purpose and to the extent authorized herein, and that access/inspection of FTI without an official need-to-know for a purpose not authorized herein constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution.

(3) Each officer or employee of a contractor to whom FTI is or may be disclosed shall be notified in writing that any such unauthorized access, inspection or disclosure of FTI may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each unauthorized access, inspection, or disclosure, or the sum of actual damages sustained as a result of such unauthorized access, inspection, or disclosure, plus in the case of a willful unauthorized access, inspection, or disclosure or an unauthorized access/inspection or disclosure which is the result of gross negligence, punitive damages, plus the cost of the action. These penalties are prescribed by IRC sections 7213, 7213A and 7431 and set forth at 26 CFR 301.6103(n)-1.

(3) Additionally, it is incumbent upon the contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of

1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000.

(4) Granting a contractor access to FTI must be preceded by certifying that each officer or employee understands the agency’s security policy and procedures for safeguarding FTI. A contractor and each officer or employee must maintain their authorization to access FTI through annual recertification of their understanding of the agency’s security policy and procedures for safeguarding FTI. The initial certification and recertifications must be documented and placed in the agency's files for review. As part of the certification and at least annually afterwards, a contractor and each officer or employee must be advised of the provisions of IRC sections 7213, 7213A, and 7431 (see Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training on the agency’s security policy and procedures provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches. (See Section 10) For the initial certification and the annual recertifications, the contractor and each officer or employee must sign, either with ink or electronic signature, a confidentiality statement certifying their understanding of the security requirements.

III. INSPECTION

The IRS and the Agency, with 24 hour notice, shall have the right to send its inspectors into the offices and plants of the contractor to inspect facilities and operations performing any work with FTI under this contract for compliance with requirements defined in IRS Publication 1075. The IRS’ right of inspection shall include the use of manual and/or automated scanning tools to perform compliance and vulnerability assessments of information technology (IT) assets that access, store, process or transmit FTI. Based on the inspection, corrective actions may be required in cases where the contractor is found to be noncompliant with FTI safeguard requirements.

Section 3 Purpose The purpose of this solicitation is to request vendor responses in order to provide these items under contract to agencies as needed.

Section 4 General This solicitation specifies requested items. It is not the intention of this solicitation to eliminate vendors or manufacturers of similar or equal equipment of the types specified.

It should be noted, however, that these requested items are written around specific needs of State agencies. The Commonwealth reserves the right to consider bids non-responsive if they do not comply with the specifications contained herein.

Section 5 Initial Contract Period The contract established from this solicitation shall be for the initial period of one (1) year from the date of award.

Section 6 Renewal Clause – Optional Renewal Period This contract may be extended at the completion of the initial contract period for five (5) additional one (1) year periods. This extension must have the written approval by all parties. If the contract resulting from this solicitation provides for an optional renewal period, the Commonwealth of Kentucky reserves the right to renegotiate any terms and/or conditions as may be necessary to meet requirements for the extended period.

The vendor will be advised of any proposed revisions prior to the renewal periods. In the event proposed revisions cannot be agreed upon, either party shall have the right to withdraw without prejudice from either exercising the option or continuing the contract in an extended period.

Section 7 Exceptions to Specifications Vendors are cautioned that changes made to the solicitation other than in the designated fields for response shall render the response invalid and result in a non-responsive bid. Otherwise, it will be considered that items/services offered are in strict compliance with these specifications, and the successful bidder shall be held responsible for delivering materials/services that meet these specifications. Any exceptions shall be marked as such within the body of the bid and explained on a separate page. The Commonwealth is not bound to accept any exceptions.

Section 8 Alternate Brands/Specifications Unless otherwise specified, brands and specifications referenced in this solicitation are meant to establish a minimum standard of quality only. Bidders may bid brands/specifications they consider to be equal by specifying the brand(s)/specifications and inserting the brand name(s), model number(s), etc. on which they are bidding. Bids offering “equal” products/specifications will be considered for award if such products are clearly identified in the bid and are determined by the State to meet or exceed fully the minimum essential specifications and salient characteristics referenced in the Solicitation. Bids that contain products/specifications that fail to meet the minimum essential requirements shall be deemed non-responsive.

Bidders who propose alternate brands/specifications should enclose descriptive literature with their bids so that the equality can be verified. Failure to enclose sufficient literature may result in a non-responsive bid. If the brands are not changed, the contract will be written accordingly and the successful bidder shall be required to deliver the brands/specifications stated in the solicitation.

Section 9 Recycle Requirements Prospective bidders are required to comply with Recycle Requirements for the purchase of goods, supplies, equipment, materials and printing with a minimum recycled content to the extent practicable per 200 KAR 5:330. This regulation can be viewed on the Internet at https://apps.legislature.ky.gov/law/kar/200/005/330.pdf

Section 10 Acknowledgment of Addenda It is the vendor's responsibility to check the web site for any modifications to this solicitation. Electronic Bid submittal is the vendor’s agreement to be bound by the terms of all addenda issued.

Section 11 Agencies to be Served This contract shall be for use by the following agency of the Commonwealth of Kentucky:

Commonwealth Office of Technology on behalf of All State Agencies

Political Subdivisions Under Kentucky Statutes, political subdivisions of this State including cities of all classes, counties, and school districts may participate in All State Agency Master Agreements to the same extent as agencies of the Commonwealth.

Section 12 Solicitation Submission Requirements Paper Bids are NOT acceptable for this RFB and shall be considered non-responsive.

All electronic documents submitted in response to this RFB shall be submitted in Microsoft Word, Microsoft Excel or PDF format ONLY.

Section 13 Method of Award Best Value – Ranking Approach The Commonwealth intends to award a contract to the vendor, whose offer, conforming to the solicitation, is the most advantageous on the basis of "best value" for all products, services, and requirements contained herein.

An evaluation committee, or a designated individual, will evaluate the information provided by the vendor in response to the established measurable criteria contained in the solicitation.

Measurable Criteria:

Price 80 Points Years in Service 20 Points

TOTAL POINTS 100 Points https://apps.legislature.ky.gov/law/kar/200/005/330.pdf

Each vendor is responsible for submitting all relevant, factual and correct information with their offer to enable the evaluator(s) to afford each vendor the maximum score based on the available data submitted by the Vendor. VENDOR SHALL ENTER UNIT

PRICE AND TOTAL PRICE ON THE BID SHEET ONLY.

A bidder shall submit one (1) response to a solicitation and shall not propose more than one (1) model/brand for each item listed in the solicitation, except for requested tier pricing. Multiple or alternate bids offering more than one (1) bid price in total or by line item shall be rejected.

Vendors responding with the minimum Best Value requirements in this solicitation shall not be credited with Best Value points. Vendors responding with greater than the minimum requirements shall receive Best Value points. Failure to provide adequate information will impact the evaluated points awarded to the vendor.

A. PRICE (80 points)

The bidder with the lowest Price receives the maximum score. The bidder with the next lowest Price receives points by dividing the lowest Price by the next lowest price and multiplying that percentage by the available points. For example, 80 points is allocated to the lowest Price criteria for this procurement, bidder “A” bids $3.00 as the lowest bidder and receives the maximum 80 points ($3.00 / $3.00 =

1.00 x 80 = 80). Assume bidder “B” is the next lowest bidder at $4.00, then “B” receives 60 points ($3.00 / $4.00) = .75 x 80 = 60).

Vendor shall enter the price on the Bid Sheet, Attachment B, otherwise the bid shall be deemed non-responsive.

B. YEARS IN SERVICE (20 points)

A minimum of five (5) years in service is required for this bid. Bids offering less than five (5) years shall be considered non-responsive and eliminated from the bid evaluation. Bidders who meet the five (5) year requirement shall not receive any points. Bidders who exceed the five (5) year requirement shall receive points. The bidder with the greatest number years (not to exceed twenty (20) years) receives the maximum points.

The bidder with the highest number of years in service, not to exceed 20 years, receives the maximum score. The bidder with the next highest number of years receives points by dividing the next highest number by the highest number and multiplying that percentage by the available points. For example, 20 points is allocated to the highest number of years for this procurement, bidder “A” bids 20 years as the highest number and receives the maximum 20 points (20 / 20 = 1.00 x 20 = 20). Assume bidder “B” is the next highest bidder at 10 years, then “B” receives 10 points (10 / 20) = .5 x 20 = 10).

Vendor shall enter the number of years in service on the Bid Sheet, Attachment B, otherwise the bid shall be deemed non-responsive.

Best Value scoring is subject to Reciprocal preference for Kentucky resident bidders and Preferences for a Qualified Bidder or the Department of Corrections, Division of Prison Industries

(KAR 200 5:410).

KRS 45A.490 Definitions for KRS 45A.490 to 45A.494.

As used in KRS 45A.490 to 45A.494:

(1) "Contract" means any agreement of a public agency, including grants and orders, for the purchase or disposal of supplies, services, construction, or any other item; and

(2) "Public agency" has the same meaning as in KRS 61.805.

KRS 45A.492 Legislative declarations.

The General Assembly declares:

(1) A public purpose of the Commonwealth is served by providing preference to Kentucky residents in contracts by public agencies; and

(2) Providing preference to Kentucky residents equalizes the competition with other states that provide preference to their residents.

KRS 45A.494 Reciprocal preference to be given by public agencies to resident bidders -- List of states -- Administrative regulations.

(1) Prior to a contract being awarded to the lowest responsible and responsive bidder on a contract by a public agency, a resident bidder of the Commonwealth shall be given a preference against a nonresident bidder registered in any state that gives or requires a preference to bidders from that state. The preference shall be equal to the preference given or required by the state of the nonresident bidder.

(2) A resident bidder is an individual, partnership, association, corporation, or other business entity that, on the date the contract is first advertised or announced as available for bidding:

(a) Is authorized to transact business in the Commonwealth; and

(b) Has for one (1) year prior to and through the date of the advertisement, filed Kentucky corporate income taxes, made payments to the Kentucky unemployment insurance fund established in KRS 341.490, and maintained a Kentucky workers' compensation policy in effect.

(3) A nonresident bidder is an individual, partnership, association, corporation, or other business entity that does not meet the requirements of subsection (2) of this section.

(4) If a procurement determination results in a tie between a resident bidder and a nonresident bidder, preference shall be given to the resident bidder.

(5) This section shall apply to all contracts funded or controlled in whole or in part by a public agency.

(6) The Finance and Administration Cabinet shall maintain a list of states that give to or require a preference for their own resident bidders, including details of the preference given to such bidders, to be used by public agencies in determining resident bidder preferences. The cabinet shall also promulgate administrative regulations in accordance with KRS Chapter 13A establishing the procedure by which the preferences required by this section shall be given.

(7) The preference for resident bidders shall not be given if the preference conflicts with federal law.

(8) Any public agency soliciting or advertising for bids for contracts shall make KRS 45A.490 to 45A.494 part of the solicitation or advertisement for bids.

The reciprocal preference as described in KRS 45A.490-494 above shall be applied in accordance with 200

KAR 5:400.

Determining the residency of a bidder for purposes of applying a reciprocal preference Any individual, partnership, association, corporation, or other business entity claiming resident bidder status shall submit along with its response the attached Required Annual Affidavit for Bidders, Offerors, and Contractors Claiming Resident Bidder Status, unless a valid, Annual Affidavit is already on file with the Commonwealth. The BIDDING AGENCY reserves the right to request documentation supporting a bidder’s claim of resident bidder status. Failure to provide such documentation upon request shall result in disqualification of the bidder or contract termination.

A nonresident bidder shall submit, along with its response, its certificate of authority to transact business in the Commonwealth as filed with the Commonwealth of Kentucky, Secretary of State. The location of the principal office identified therein shall be deemed the state of residency for that bidder. If the bidder is not required by law to obtain said certificate, the state of residency for that bidder shall be deemed to be that which is identified in its mailing address as provided in its bid.

Preferences for a Qualified Bidder or the Department of Corrections, Division of Prison Industries

(KAR 200 5:410).

Pursuant to 200 KAR 5:410, and KRS 45A.470, Kentucky Correctional Industries will receive a preference equal to twenty (20) percent of the maximum points awarded to a bidder in a solicitation. In addition, the following “qualified bidders” will receive a preference equal to fifteen (15) percent of the maximum points awarded to a bidder in a solicitation: Kentucky Industries for the Blind, any nonprofit corporation that furthers the purposes of KRS Chapter 163 and any qualified nonprofit agencies for individuals with severe disabilities as defined in KRS 45A.465(3). Other than Kentucky Industries for the Blind, a bidder claiming “qualified bidder” status shall submit along with its response to the solicitation a notarized annual affidavit, which affirms that it meets the requirements to be considered a qualified bidder- annual affidavit form included. The annual affidavit form is not required if a valid, annual affidavit is already on file with the Commonwealth. If requested, failure to provide documentation to a public agency proving qualified bidder status may result in disqualification of the bidder or contract termination.

Past Vendor Performance may be considered in the award of this Contract. Vendors with a record of poor performance in the last 12 months may be found non-responsible and ineligible for award.

Section 14 Tax Exempt Status Do not include Federal Excise Tax, Kentucky Sales or Use Tax in prices quoted in response to this solicitation.

Section 15 Basis of Price Revisions PRICE ADJUSTMENTS: Unless otherwise specified, the prices established by the contract resulting from this solicitation shall remain firm for the contract period subject to the following:

A: Price Increases: A price increase shall not occur during the first twelve (12) months of the contract. A vendor may request a price increase after twelve (12) months of the contract, which may be granted or denied by the Commonwealth. Any such price increase shall be based on industry wide price changes. The contract holder must request in writing a price increase at least thirty (30) days prior to the effective date, and shall provide firm proof that the price increase(s) is justified. The Office of Procurement Services may request additional information or justification. If the price increase is denied, the contract holder may withdraw from the contract without prejudice upon written notice and approval by the Office of Procurement Services.

Provided, however, that the vendor must continue service, at the contract prices, until a new contract can be established (usually within sixty (60) days).

B: Price Decreases: The contract price shall be reduced to reflect any industry wide price decreases. The contract holder is required to furnish the Office of Procurement Services with notice of any price decreases as soon as such decreases are available.

C: Extended Contract Periods: If the contract provides for an optional renewal period, a price adjustment may be granted at the time the contract is renewed, subject to price increase justification as required in Paragraph A “Price Increases” as stated above.

Section 16

Vendor Terms and Conditions Solicitation or quotation forms that include terms and conditions not in conformity with the terms and conditions of this solicitation or the Statutes of the Commonwealth of Kentucky may be deemed non-responsive.

The Commonwealth of Kentucky shall not be bound by any part(s) of the bidder’s response to this solicitation that contains information, options, conditions, terms, or prices neither requested nor required in the solicitation. In the event of any conflicts between the specifications, terms and conditions indicated by the Commonwealth and those indicated by the contractor, those of the Commonwealth take precedence. The contract supersedes all bids or other prior agreements, oral or written, and all other communications between the parties relating to this subject.

Section 17 Post Contract Agreements The resulting…