Attachment A - Terms and Conditions - RFB 758 2600000672.pdf

ELECTRONIC BID SUBMISSION

Bid responses shall be received by electronic submission in the eProcurement system.

An electronic bid shall be authorized by the proper agent of the firm by the act of submitting it electronically through the eProcurement system.

Bid information MUST be completed online. Response must contain all required information for the Solicitation.

All bidders MUST be registered in the Commonwealth eProcurement System via the Vendor Self Service System at https://vss.ky.gov

Allow 24 – 48 hours to complete Vendor Registration. Vendors must be logged in to their Vendor Self Service (VSS) account in order to submit a response. Registrations completed the day of bid closing must be completed by the Vendor in the VSS portal. The Customer Resource Center is not able to complete registrations and activate accounts on the same day. Closing dates will not be extended for Vendors not registered by the date/time of the bid closing. Vendor Self Service Registration Guides are provided at https://vss.ky.gov

All bidders are cautioned to begin their electronic submission in sufficient time to complete before the closing date and time. Delays due to technical difficulties or document upload impediments shall not be justification for acceptance of a late bid or proposal. Vendor attention to this advisory is encouraged. If you need assistance, please contact the Customer Resource Center (CRC) by email at Finance.CRCGroup@ky.gov or phone 502-564-9641 or toll-free 877-973-HELP (4357).

Online bid responses must be in an “Accepted” status and shall be assigned a date and time stamp from the eProcurement system at the time of final acceptance and formal submission by the vendor. The system will not allow submission of an online response after the published date and time for closing.

An offer may be modified or withdrawn by electronic or written notice ONLY if received prior to the bid closing date and time. An electronic offer may be modified by applying the appropriate electronic signature and following the procedure in the state’s eProcurement signature.

https://vss.ky.gov/ https://vss.ky.gov/ mailto:Finance.CRCGroup@ky.gov

The following items MUST be submitted prior to award:

_____REVENUE FORM 10A100 KENTUCKY TAX REGISTRATION APPLICATION IF

APPLICABLE (see Section 36)

_____CERTIFICATE OF AUTHORITY – REGISTRATION WITH SECRETARY OF

STATE BY A FOREIGN ENTITY IF APPLICABLE (see Section 38)

_____REQUIRED AFFIDAVIT(S)

https://finance.ky.gov/office-of-the-secretary/FinanceForms/Annual%20Required%20Affidavit%20for%20Bidders%2 0Offerors%20and%20Contractors.pdf

_____ THE VENDOR SHALL HAVE A FACILITY THAT IS NOT IN AN AREA OF

FLOOD RISK. The vendor must provide documentation prior to award to demonstrate compliance with this requirement. (See Section 2.A.6)

_____ THE VENDOR SHALL HAVE A STORAGE VAULT THAT IS

ENVIRONMENTALLY CONTROLLED TO MAINTAIN A CONSTANT

TEMPERATURE (BETWEEN 60 - 75 DEGREES) AND A HUMIDITY LEVEL

(BETWEEN 50 – 55 PERCENT) SUITABLE FOR THE STORAGE OF MAGNETIC

MEDIA. The vendor must provide documentation prior to award to demonstrate compliance with this requirement. (See Section 2.A.7)

_____ THE VENDOR SHALL HAVE A FIRE SUPPRESSION SYSTEM AND/OR FIRE

DETECTION SYSTEM THAT MEETS THE NATIONAL FIRE PROTECTION

ASSOCIATION AND/OR STATE STANDARDS. The vendor must provide documentation prior to award to demonstrate compliance with this requirement. (See Section 2.A.8)

_____THE VENDOR SHALL HAVE PHYSICAL SECURITY PROCEDURES AND

ACCESS CONTROLS IN PLACE TO ENSURE THAT ONLY AUTHORIZED

INDIVIDUALS AND AUTHORIZED COMMONWEALTH STAFF ARE PERMITTED

TO ENTER THE FACILITY AND THAT THERE IS A DOCUMENTED PROCESS

TO MANAGE AND IDENTIFY THOSE INDIVIDUALS AND STAFF. The vendor must provide documentation prior to award to demonstrate compliance with this requirement and include the number of access points. (See Section 2.A.9)

_____THE VENDOR SHALL PROVIDE 24/7/365 SECURITY MONITORING. The vendor must provide documentation prior to award to demonstrate compliance with this requirement. (See Section 2.A.11)

_____THE VENDOR SHALL PROVIDE BONDED COURIERS. THE COURIERS

SHOULD BE IN-HOUSE BONDED RATHER THAN A THIRD-PARTY BONDED

COURIER SERVICE. The vendor must provide documentation prior to award to demonstrate compliance with this requirement. (See Section 2.A.13) https://finance.ky.gov/office-of-the-secretary/FinanceForms/Annual%20Required%20Affidavit%20for%20Bidders%20Offerors%20and%20Contractors.pdf https://finance.ky.gov/office-of-the-secretary/FinanceForms/Annual%20Required%20Affidavit%20for%20Bidders%20Offerors%20and%20Contractors.pdf https://finance.ky.gov/office-of-the-secretary/FinanceForms/Annual%20Required%20Affidavit%20for%20Bidders%20Offerors%20and%20Contractors.pdf

ATTACHMENT A

Commonwealth of Kentucky Request for Bid (RFB)

For

OFF-SITE DATA AND DOCUMENT STORAGE

RFB 758 2600000672

(This is a re-solicitation of RFB 758 2600000066 which was not awarded)

Issued by

The Finance and Administration Cabinet On Behalf Of

COMMONWEALTH OFFICE OF TECHNOLOGY (COT)

Release Date: June 17, 2026 Vendors’ Written Questions Due: June 24, 2026, at 9:00AM ET

Commonwealth’s Response to Written Questions: June 30, 2026 CLOSING DATE AND TIME: July 10, 2026, at 1:30PM ET

Commonwealth Buyer:

Dianne Lee NIGP-CPP CPPB KCPM

COMMONWEALTH OF KENTUCKY

FINANCE AND ADMINISTRATION CABINET

Office of Procurement Services

200 MERO STREET, 5TH FLOOR

FRANKFORT KY 40622

(502) 782-0799

Dianne.Lee@ky.gov mailto:Dianne.Lee@ky.gov

BID READINGS

Any person wishing to hear a bid reading may call the OPS conference line at 844-603-5060, Conference ID number 240522005, and Participant Code 33957, at

3:30pm, ET on the bid closing date.

PLEASE READ THIS SOLICITATION AND ITS INSTRUCTIONS IN ITS ENTIRETY.

This is a Request for Bid (RFB).

Vendors shall comply with the terms and conditions stated in the solicitation.

Any efforts to negotiate these terms and conditions SHALL NOT be accepted and SHALL cause the bid to be deemed non-responsive.

All proposed pricing shall remain valid for a minimum of sixty (60) calendar days after the bid due date.

This Contract shall be awarded as Group All. Vendors shall bid all line items, otherwise bid shall be deemed non-responsive.

Vendors should review and comply with the general bidding requirements listed under “Procurement Laws, Preference, Regulations and Policies” and “Response to Solicitation” located on the eProcurement Web page at https://finance.ky.gov/eProcurement/Pages/procurement-laws-regulations-and-policies.aspx and https://finance.ky.gov/eProcurement/Pages/doing-business-with-the-commonwealth.aspx respectively. The vendor must comply with all applicable statutes, regulations and policies related to this procurement.

https://finance.ky.gov/eProcurement/Pages/procurement-laws-regulations-and-policies.aspx https://finance.ky.gov/eProcurement/Pages/procurement-laws-regulations-and-policies.aspx https://finance.ky.gov/eProcurement/Pages/doing-business-with-the-commonwealth.aspx https://finance.ky.gov/eProcurement/Pages/doing-business-with-the-commonwealth.aspx

Solicitation

Terms and Conditions

Master Agreement

Section 1 Scope of Contract The Office of Procurement Services issues this solicitation to establish a Master Agreement for Off-Site Data and Document Storage to include PHYSICAL storage and exchange services of paper, film, tapes, disks, drives, etc. Storage includes PHYSICAL storage ONLY and does not include electronic storage such as Cloud Storage, Enterprise Content Management, Digital Archive & Imaging, On-Premises, etc.

Section 2 Requirements A. Scope of Service

1) The vendor shall have at least five (5) years of experience providing the services outlined in this RFB.

2) The vendor shall provide an environmentally controlled and secure off-site data and document storage facility with a delivery and pickup exchange service. The exchange service shall be available as requested seven (7) days a week during the hours of 8:00 a.m. to 4:30 p.m. EST at the Commonwealth Office of Technology (COT), Commonwealth Data Center and as requested by other agencies located in the Frankfort, Kentucky area. The Commonwealth shall have the option to change the exchange service and times depending upon the Commonwealth's business needs.

3) The vendor shall be geographically located at least twenty (20) miles away from the Commonwealth’s Data Center located at 101 Cold Harbor Drive in Frankfort, Kentucky to ensure that the storage location will not be subjected to the same potential disaster as the Data Center.

4) The vendor shall have an off-site storage facility that shall be easily accessible and located within a two (2) hour drive of the Central Kentucky area.

5) The vendor should have a vault that is built to four (4) hour fire rated architectural specifications with no flammable or combustible material stored in the vault.

6) The vendor shall have a facility that is not in an area of flood risk. The vendor must provide documentation prior to award to demonstrate compliance with this requirement. The vendor shall be responsible for all costs associated with this requirement.

7) The vendor shall have a storage vault that is environmentally controlled to maintain a constant temperature (between 60 - 75 degrees) and a humidity level (between 50 – 55 percent) suitable for the storage of magnetic media. The vendor must provide documentation prior to award to demonstrate compliance with this requirement.

8) The vendor shall have a fire suppression system and/or fire detection system that meets the National Fire Protection Association and/or state standards. The vendor must provide documentation prior to award to demonstrate compliance with this requirement.

9) The vendor shall have physical security procedures and access controls in place to ensure that only authorized individuals and authorized Commonwealth staff are permitted to enter the facility and that there is a documented process to manage and identify those individuals and staff. The vendor must provide documentation prior to award to demonstrate compliance with this requirement and include the number of access points.

10) The vendor should provide isolation and separation of Commonwealth storage from other entities or customers.

11) The vendor shall provide 24/7/365 security monitoring. The vendor must provide documentation prior to award to demonstrate compliance with this requirement.

12) The vendor should provide all storage containers and delivery/pickup exchange service of computer and micrographic records to the Commonwealth Data Center and other agency locations in the Frankfort area. The purpose of the exchange service will be to exchange the various generations of backup and/or hardcopy documentation.

13) The vendor shall provide bonded couriers. The couriers should be in-house bonded rather than a third-party bonded courier service. The vendor must provide documentation prior to award to demonstrate compliance with this requirement. Documentation must also be available after the award upon request.

14) Vendor should provide for transportation of data in temperature-controlled vehicles with provisions for securing the media to protect against highway impact, unauthorized access, theft and employee security breach during storage and transport. All transport shall be in compliance with the IRS Publication 1075 regarding the safeguarding of computer media that contains Federal Tax Information.

15) The vendor shall have a chain of custody process (i.e. Bill of Lading at pickup, etc.)

16) The vendor should provide two-way communications with vehicle operations at all times.

17) The vendor shall provide off-hours access/pickup capability in case of an actual emergency, for disaster recovery testing or for selective data recovery due to hardware or other failure. This off-hours pickup and delivery service shall also be provided for the Commonwealth’s Alternate Data Center that is located in the Northern Kentucky area. The off-site storage facility shall be accessible twenty-four (24) hours per day, three hundred and sixty-five (365) days per year.

18) The vendor shall maintain an accurate inventory of all stored cases/records. The inventory shall be accessible to each user.

19) The vendor shall be responsible for the proper custody and care of any Commonwealth-owned property that is stored at the vendor’s facility. The vendor shall be liable for loss or damage as a result of vendor’s negligence or failure to exercise care and regard to Commonwealth property. Normal wear and tear is exempt from this requirement.

20) The vendor shall comply with the provisions of the Privacy Act of 1974 and instruct its employees to use the same degree of care as it uses with its own data to keep confidential information concerning client data, the business of the Commonwealth, its financial affairs, its relations with its citizens and its employees, as well as any other information shall be considered very confidential.

Vendor staff may be required to sign a non-disclosure agreement at the time of award.

21) The vendor shall provide, at no additional charge to the Commonwealth, assistance in turning over all Commonwealth property to the Commonwealth or its designated agent at the end of the contract period or within thirty (30) calendar days of the Commonwealth’s request. This task shall include:

a. Preparing and providing packing containers

b. Preparing an itemized inventory listing

c. Loading materials into boxes

d. Listing volume serial ranges on boxes

e. Preparing inventory of boxes

f. Palletizing the inventory for shipment

B. Fixed Rates for Storage and Courier Service (See Attachment B)

Pricing shall be entered on Attachment B.

Section 2A Commonwealth Office of Technology (COT) Requirements

1. Commonwealth Information Technology Policies and Standards The vendor and any subcontractors shall be required to adhere to applicable Commonwealth policies and standards.

Commonwealth Office of Technology - Home - Commonwealth Office of Technology (Kentucky) https://technology.ky.gov/about-the-agency/Pages/kits.aspx

2. Compliance with Industry Accepted Reporting Standards Based on Trust Service Principles and Criteria The vendor must employ comprehensive risk and threat management controls based on defined industry standards for service organizations such as ISO AICPA TSP section 100, Trust Services Principles and Criteria. The vendor must annually assert compliance and engage a third-party certification registrar to examine such assertions and controls to provide a Report, such as ISO 9000, ISO 14001, AT101 SOC 2 type 2, on Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, and Privacy, which contains an opinion on whether the operating controls effectively support the assertions. All such reports, including publicly available reports (i.e. AT 101 SOC 3) shall be made available to the Commonwealth for review.

3. System Vulnerability and Security Assessments The Commonwealth reserves the right to conduct, in collaboration with the vendor, non-invasive vulnerability and security assessments of the software and infrastructure used to provide services prior to implementation and periodically thereafter. Upon completion of these assessments, the Commonwealth will https://technology.ky.gov/Pages/index.aspx https://technology.ky.gov/Pages/index.aspx https://technology.ky.gov/about-the-agency/Pages/kits.aspx communicate any findings to the vendor for action. Any cost relating to the alleviation of the findings will be the responsibility of the vendor. Mitigations will be subject to re-evaluation after completion. In cases where direct mitigation cannot be achieved, the vendor shall communicate this and work closely with the Commonwealth to identify acceptable compensating controls that will reduce risk to an acceptable and agreed upon level. An accredited third-party source may be selected by the vendor to address findings, provided they will acknowledge all cost and provide valid documentation of mitigation strategies in an agreed upon timeframe.

4. Privacy Assessments The Commonwealth reserves the right to conduct privacy assessments of the collection, use, maintenance and sharing of Commonwealth data by any vendor services, software, and infrastructure used to provide services prior to implementation and periodically thereafter. Upon completion of this assessment, the Commonwealth will communicate any findings to the vendor for action. Any cost relating to the alleviation of the findings will be the responsibility of the vendor.

Mitigations will be subject to re-evaluation after completion. In cases where direct mitigation cannot be achieved, the vendor shall communicate this and work closely with the Commonwealth to identify acceptable compensating controls or privacy practices that will reduce risk to an acceptable and agreed upon level. An accredited third-party source may be selected by the vendor to address findings, provided they will acknowledge all cost and provide valid documentation of mitigation strategies in an agreed upon timeframe.

5. Privacy, Confidentiality and Ownership of Information

The Commonwealth is the designated owner of all Commonwealth data and shall approve all access to that data. The vendor shall not have ownership of Commonwealth data at any time. The vendor shall not profit from or share Commonwealth data. The vendor shall be in compliance with privacy policies established by governmental agencies or by state or federal law. Privacy notice statements may be developed and amended from time to time by the Commonwealth and will be appropriately displayed on the Commonwealth portal (Ky.gov). The vendor should provide sufficient security to protect the Commonwealth and COT data in network transit, storage, and cache. All Commonwealth data, including backups and archives, must be maintained at all times within the contiguous United States. All Commonwealth data, classified as sensitive or higher, as defined in Enterprise Standards, must be encrypted in-transit from vendor’s network and at rest while stored on vendor’s laptops or other portable media devices.

6. Applicable Security Control Framework Compliance The vendor must have an awareness and understanding of the NIST Special Publication 800-53 Security Control Framework and employ safeguards that meet or exceed the moderate level controls as defined within the standard. The vendor must provide sufficient safeguards to provide reasonable protections around the Commonwealth’s data to ensure that the confidentiality, integrity, and availability is maintained at an appropriate level. These include but are not limited to:

• Access Control The vendor must employ policy and process that provide for stringent control to limit physical and logical access to systems that house Commonwealth data, on a need to know basis, provide clear separation of duties, and adheres to least privilege principles.

• Awareness and Training The vendor must provide the appropriate role specific training for staff to ensure that there is awareness and understanding of roles and responsibilities as they relate to the protections around the Commonwealth’s data.

• Audit and Accountability There must be sufficient auditing capability to ensure that actions are tracked and there is individual accountability for all actions taken by vendor staff.

• Configuration Management The vendor must work within established baselines that provide minimal functionality needed to ensure service delivery without exposing unnecessary risk. The vendor must also employ structured change control processes that provide a level of coordination with the client agreed upon in a Service Level Agreement (SLA).

• Contingency Planning The vendor must employ contingent planning policy and procedures that ensure service delivery based on agreed SLA levels while maintaining all Commonwealth data within the continental Unites States.

• Identification and Authorization The vendor must employ appropriate identity and access management policies and procedures to ensure that access is appropriately authorized and managed at a level to ensure that access is provisioned and de-provisioned in a timely and efficient manner.

• Incident Response The vendor must employ policy and procedures to ensure that an appropriate response to all identified security incidents are addressed in a timely manner and are reported to the appropriate parties in an agreed upon SLA timeframe.

The vendor must also ensure that all staff are sufficient trained to ensure that they can identify situations that are classified as security incidents.

• Maintenance The vendor must employ policy and procedures that ensure that all maintenance activities are conducted only by authorized maintenance staff leveraging only authorized maintenance tools.

• Media Protection The vendor must employ policy and procedure to ensure that sufficient protections exist to protect Commonwealth data on all storage media throughout the media lifecycle and maintain documentation from media creation through destruction.

• Physical and Environmental Controls The vendor must employ physical and environmental policies and procedures that ensure that the service and delivery infrastructure are located in a physically secure and environmentally protected environment to ensure the confidentiality, integrity, and availability of Commonwealth data.

• Personnel Security The vendor must employ policies and procedures to ensure that all staff that have access to systems that house, transmit, or process Commonwealth data have been appropriately vetted and have been through a background check at the time of hire and periodically thereafter.

• System and Communications Protections The vendor must employ physical and logical protection that protect system communications and communication media from unauthorized access and to ensure adequate physical protections from damage.

7. IRS Publication 1075 -Exhibit 7 Safeguarding Contract Language Publication 1075 (Rev. 11-2021) (irs.gov)

I. PERFORMANCE

In performance of this contract, the Contractor agrees to comply with and assume responsibility for compliance by officers or employees with the following requirements:

(1) All work will be performed under the supervision of the contractor.

(2) The contractor and contractor’s officers or employees to be authorized access to FTI must meet background check requirements defined in IRS Publication 1075.

The contractor will maintain a list of officers or employees authorized access to FTI. Such list will be provided to the agency and, upon request, to the IRS.

(3) FTI in hardcopy or electronic format shall be used only for the purpose of carrying out the provisions of this contract. FTI in any format shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of this contract. Inspection or disclosure of FTI to anyone other than the contractor or the contractor’s officers or employees authorized is prohibited.

(4) FTI will be accounted for upon receipt and properly stored before, during, and after processing. In addition, any related output and products require the same level of protection as required for the source material.

(5) The contractor will certify that FTI processed during the performance of this contract will be completely purged from all physical and electronic data storage with no output to be retained by the contractor at the time the work is completed.

If immediate purging of physical and electronic data storage is not possible, the contractor will certify that any FTI in physical or electronic storage will remain safeguarded to prevent unauthorized disclosures.

(6) Any spoilage or any intermediate hard copy printout that may result during the processing of FTI will be given to the agency. When this is not possible, the contractor will be responsible for the destruction of the spoilage or any intermediate hard copy printouts and will provide the agency with a statement containing the date of destruction, description of material destroyed, and the destruction method.

https://www.irs.gov/pub/irs-pdf/p1075.pdf

(7) All computer systems receiving, processing, storing, or transmitting FTI must meet the requirements in IRS Publication 1075. To meet functional and assurance requirements, the security features of the environment must provide for the managerial, operational, and technical controls. All security features must be available and activated to protect against unauthorized use of and access to FTI.

(8) No work involving FTI furnished under this contract will be subcontracted without the prior written approval of the IRS.

(9) Contractor will ensure that the terms of FTI safeguards described herein are included, without modification, in any approved subcontract for work involving FTI.

(10) To the extent the terms, provisions, duties, requirements, and obligations of this contract apply to performing services with FTI, the contractor shall assume toward the subcontractor all obligations, duties and responsibilities that the agency under this contract assumes toward the contractor, and the subcontractor shall assume toward the contractor all the same obligations, duties and responsibilities which the contractor assumes toward the agency under this contract.

(11) In addition to the subcontractor’s obligations and duties under an approved subcontract, the terms and conditions of this contract apply to the subcontractor, and the subcontractor is bound and obligated to the contractor hereunder by the same terms and conditions by which the contractor is bound and obligated to the agency under this contract.

(12) For purposes of this contract, the term “contractor” includes any officer or employee of the contractor with access to or who uses FTI, and the term “subcontractor” includes any officer or employee of the subcontractor with access to or who uses FTI.

(13) The agency will have the right to void the contract if the contractor fails to meet the terms of FTI safeguards described herein.

II. CRIMINAL/CIVIL SANCTIONS

(1) Each officer or employee of a contractor to whom FTI is or may be disclosed shall be notified in writing that FTI disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any FTI for a purpose not authorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution.

(2) Each officer or employee of a contractor to whom FTI is or may be accessible shall be notified in writing that FTI accessible to such officer or employee may be accessed only for a purpose and to the extent authorized herein, and that access/inspection of FTI without an official need-to-know for a purpose not authorized herein constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution.

(3) Each officer or employee of a contractor to whom FTI is or may be disclosed shall be notified in writing that any such unauthorized access, inspection or disclosure of FTI may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each unauthorized access, inspection, or disclosure, or the sum of actual damages sustained as a result of such unauthorized access, inspection, or disclosure, plus in the case of a willful unauthorized access, inspection, or disclosure or an unauthorized access/inspection or disclosure which is the result of gross negligence, punitive damages, plus the cost of the action. These penalties are prescribed by IRC sections 7213, 7213A and 7431 and set forth at 26 CFR 301.6103(n)-1.

(3) Additionally, it is incumbent upon the contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000.

(4) Granting a contractor access to FTI must be preceded by certifying that each officer or employee understands the agency’s security policy and procedures for safeguarding FTI. A contractor and each officer or employee must maintain their authorization to access FTI through annual recertification of their understanding of the agency’s security policy and procedures for safeguarding FTI. The initial certification and recertifications must be documented and placed in the agency's files for review. As part of the certification and at least annually afterwards, a contractor and each officer or employee must be advised of the provisions of IRC sections 7213, 7213A, and 7431 (see Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training on the agency’s security policy and procedures provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches. (See Section 10) For the initial certification and the annual recertifications, the contractor and each officer or employee must sign, either with ink or electronic signature, a confidentiality statement certifying their understanding of the security requirements.

III. INSPECTION

The IRS and the Agency, with 24 hour notice, shall have the right to send its inspectors into the offices and plants of the contractor to inspect facilities and operations performing any work with FTI under this contract for compliance with requirements defined in IRS Publication 1075. The IRS’ right of inspection shall include the use of manual and/or automated scanning tools to perform compliance and vulnerability assessments of information technology (IT) assets that access, store, process or transmit FTI. Based on the inspection, corrective actions may be required in cases where the contractor is found to be noncompliant with FTI safeguard requirements.

8. Protection of Personal Information Security and Breach Investigation Procedures and Practices Act Vendors that receive Personal Information as defined by and in accordance with Kentucky’s Personal Information Security and Breach Investigation Procedures and Practices Act, KRS 61.931, et seq., (the “Act”), shall secure and protect the Personal Information by, without limitation, complying with all requirements applicable to non-affiliated third parties set forth in the Act.

“Personal Information” is defined in accordance with KRS 61.931(6) as “an individual’s first name or first initial and last name; personal mark; or unique biometric or genetic print or image, in combination with one (1) or more of the following data elements:

a) An account, credit card number, or debit card number that, in combination with any required security code, access code or password, would permit access to an account;

b) A Social Security number;

c) A taxpayer identification number that incorporates a Social Security number;

d) A driver’s license number, state identification card number or other individual identification number issued by an agency;

e) A passport number or other identification number issued by the United States government; or

f) Individually Identifiable Information as defined in 45 C.F.R. sec. 160.013 (of the Health Insurance Portability and Accountability Act), except for education records covered by the Family Education Rights and Privacy Act, as amended 20 U.S.C. sec 1232g.”

As provided in KRS 61.931(5), a “non-affiliated third party” means “any person or entity that has a contract or agreement with the Commonwealth and receives (accesses, collects or maintains) personal information from the Commonwealth pursuant to the contract or agreement.”

The vendor hereby agrees to cooperate with the Commonwealth in complying with the response, mitigation, correction, investigation, and notification requirements of the Act.

The vendor shall immediately notify as soon as possible, but not to exceed seventy-two (72) hours, the contracting agency, the Office of Procurement Services, and the Commonwealth Office of Technology of a determination of or knowledge of a breach, unless the exception set forth in KRS 61.932(2)(b)2 applies and the vendor abides by the requirements set forth in that exception.

The vendor hereby agrees that the Commonwealth may withhold payment(s) owed to the vendor for any violation of the Identity Theft Prevention Reporting Requirements.

The vendor hereby agrees to undertake a prompt and reasonable investigation of any breach as required by KRS 61.933.

Upon conclusion of an investigation of a security breach of Personal Information as required by KRS 61.933, the vendor hereby agrees to an apportionment of the costs of the notification, investigation, and mitigation of the security breach.

In accordance with KRS 61.932(2)(a) the vendor shall implement, maintain, and update security and breach investigation procedures that are appropriate to the nature of the information disclosed, that are at least as stringent as the security and breach investigation procedures and practices established by the Commonwealth Office of Technology:

https://technology.ky.gov/OCISO/Pages/InformationSecurityPolicies,Standardsan dProcedures.aspx

Section 3 Purpose The purpose of this solicitation is to request vendor responses in order to provide these items under contract to agencies as needed.

Section 4 General This solicitation specifies requested items. It is not the intention of this solicitation to eliminate vendors or manufacturers of similar or equal equipment of the types specified.

It should be noted, however, that these requested items are written around specific needs of State agencies. The Commonwealth reserves the right to consider bids non-responsive if they do not comply with the specifications contained herein.

Section 5 Initial Contract Period The contract established from this solicitation shall be for the initial period of one (1) year from the date of award.

Section 6 Renewal Clause – Optional Renewal Period This contract may be extended at the completion of the initial contract period for five (5) additional one (1) year periods. This extension must have the written approval by all parties. If the contract resulting from this solicitation provides for an optional renewal period, the Commonwealth of Kentucky reserves the right to renegotiate any terms and/or conditions as may be necessary to meet requirements for the extended period.

The vendor will be advised of any proposed revisions prior to the renewal periods. In the event proposed revisions cannot be agreed upon, either party shall have the right to https://technology.ky.gov/OCISO/Pages/InformationSecurityPolicies,StandardsandProcedures.aspx https://technology.ky.gov/OCISO/Pages/InformationSecurityPolicies,StandardsandProcedures.aspx withdraw without prejudice from either exercising the option or continuing the contract in an extended period.

Section 7 Exceptions to Specifications Vendors are cautioned that changes made to the solicitation other than in the designated fields for response shall render the response invalid and result in a non-responsive bid. Otherwise, it will be considered that items/services offered are in strict compliance with these specifications, and the successful bidder shall be held responsible for delivering materials/services that meet these specifications. Any exceptions shall be marked as such within the body of the bid and explained on a separate page. The Commonwealth is not bound to accept any exceptions.

Section 8 Alternate Brands/Specifications Unless otherwise specified, brands and specifications referenced in this solicitation are meant to establish a minimum standard of quality only. Bidders may bid brands/specifications they consider to be equal by specifying the brand(s)/specifications and inserting the brand name(s), model number(s), etc. on which they are bidding. Bids offering “equal” products/specifications will be considered for award if such products are clearly identified in the bid and are determined by the State to meet or exceed fully the minimum essential specifications and salient characteristics referenced in the Solicitation. Bids that contain products/specifications that fail to meet the minimum essential requirements shall be deemed non-responsive.

Bidders who propose alternate brands/specifications should enclose descriptive literature with their bids so that the equality can be verified. Failure to enclose sufficient literature may result in a non-responsive bid. If the brands are not changed, the contract will be written accordingly and the successful bidder shall be required to deliver the brands/specifications stated in the solicitation.

Section 9 Recycle Requirements Prospective bidders are required to comply with Recycle Requirements for the purchase of goods, supplies, equipment, materials and printing with a minimum recycled content to the extent practicable per 200 KAR 5:330. This regulation can be viewed on the Internet at https://apps.legislature.ky.gov/law/kar/200/005/330.pdf

Section 10 Acknowledgment of Addenda It is the vendor's responsibility to check the web site for any modifications to this solicitation. Electronic Bid submittal is the vendor’s agreement to be bound by the terms of all addenda issued.

https://apps.legislature.ky.gov/law/kar/200/005/330.pdf

Section 11 Agencies to be Served This contract shall be for use by the following agency of the Commonwealth of Kentucky:

Commonwealth Office of Technology (COT) on behalf of All State Agencies

Political Subdivisions Under Kentucky Statutes, political subdivisions of this State including cities of all classes, counties, and school districts may participate in All State Agency Master Agreements to the same extent as agencies of the Commonwealth.

Section 12 Solicitation Submission Requirements Paper Bids are NOT acceptable for this RFB and shall be considered non-responsive.

All electronic documents submitted in response to this RFB shall be submitted in Microsoft Word, Microsoft Excel or PDF format ONLY.

Section 13 Method of Award Best Value – Ranking Approach The Commonwealth intends to award a contract to the vendor, whose offer, conforming to the solicitation, is the most advantageous on the basis of "best value" for all products, services, and requirements contained herein.

An evaluation committee, or a designated individual, will evaluate the information provided by the vendor in response to the established measurable criteria contained in the solicitation.

Measurable Criteria:

Price 80 Points Years in Service 20 Points

TOTAL POINTS 100 Points

Each vendor is responsible for submitting all relevant, factual and correct information with their offer to enable the evaluator(s) to afford each vendor the maximum score based on the available data submitted by the Vendor.

A bidder shall submit one (1) response to a solicitation and shall not propose more than one (1) model/brand for each item listed in the solicitation, except for requested tier pricing. Multiple or alternate bids offering more than one (1) bid price in total or by line item shall be rejected.

Vendors responding with the minimum Best Value requirements in this solicitation shall not be credited with Best Value points. Vendors responding with greater than the minimum requirements shall receive Best Value points. Failure to provide adequate information will impact the evaluated points awarded to the vendor.

A. PRICE (80 points)

The bidder with the lowest Price receives the maximum score. The bidder with the next lowest Price receives points by dividing the lowest Price by the next lowest price and multiplying that percentage by the available points. For example, 80 points is allocated to the lowest Price criteria for this procurement, bidder “A” bids $3.00 as the lowest bidder and receives the maximum 80 points ($3.00 / $3.00 = 1.00 x 80 = 80).

Assume bidder “B” is the next lowest bidder at $4.00, then “B” receives 60 points ($3.00 / $4.00) = .75 x 80 = 60).

Vendor shall enter the price on the Bid Sheet, Attachment B, otherwise the bid shall be deemed non-responsive.

B. EXPERIENCE (20 points)

A minimum of five (5) years experience providing the services outlined in the RFB is required for this bid. Bids offering less than five (5) years shall be considered non-responsive and eliminated from the bid evaluation. Bidders who meet the five (5) year requirement shall not receive any points. Bidders who exceed the five (5) year requirement shall receive points. The bidder with the greatest number years (not to exceed twenty (20) years) receives the maximum points.

The bidder with the highest number of years in service, not to exceed 20 years, receives the maximum score. The bidder with the next highest number of years receives points by dividing the next highest number by the highest number and multiplying that percentage by the available points. For example, 20 points is allocated to the highest number of years for this procurement, bidder “A” bids 20 years as the highest number and receives the maximum 20 points (20 / 20 = 1.00 x 20 = 20). Assume bidder “B” is the next highest bidder at 10 years, then “B” receives 10 points (10 / 20) = .5 x 20 = 10).

Vendor shall enter the number of years on the Bid Sheet, Attachment B, otherwise the bid shall be deemed non-responsive.

Best Value scoring is subject to Reciprocal preference for Kentucky resident bidders and Preferences for a Qualified Bidder or the Department of Corrections, Division of Prison Industries

(KAR 200 5:410).

KRS 45A.490 Definitions for KRS 45A.490 to 45A.494.

As used in KRS 45A.490 to 45A.494:

(1) "Contract" means any agreement of a public agency, including grants and orders, for the purchase or disposal of supplies, services, construction, or any other item; and

(2) "Public agency" has the same meaning as in KRS 61.805.

KRS 45A.492 Legislative declarations.

The General Assembly declares:

(1) A public purpose of the Commonwealth is served by providing preference to Kentucky residents in contracts by public agencies; and

(2) Providing preference to Kentucky residents equalizes the competition with other states that provide preference to their residents.

KRS 45A.494 Reciprocal preference to be given by public agencies to resident bidders -- List of states -- Administrative regulations.

(1) Prior to a contract being awarded to the lowest responsible and responsive bidder on a contract by a public agency, a resident bidder of the Commonwealth shall be given a preference against a nonresident bidder registered in any state that gives or requires a preference to bidders from that state. The preference shall be equal to the preference given or required by the state of the nonresident bidder.

(2) A resident bidder is an individual, partnership, association, corporation, or other business entity that, on the date the contract is first advertised or announced as available for bidding:

(a) Is authorized to transact business in the Commonwealth; and

(b) Has for one (1) year prior to and through the date of the advertisement, filed Kentucky corporate income taxes, made payments to the Kentucky unemployment insurance fund established in KRS 341.490, and maintained a Kentucky workers' compensation policy in effect.

(3) A nonresident bidder is an individual, partnership, association, corporation, or other business entity that does not meet the requirements of subsection (2) of this section.

(4) If a procurement determination results in a tie between a resident bidder and a nonresident bidder, preference shall be given to the resident bidder.

(5) This section shall apply to all contracts funded or controlled in whole or in part by a public agency.

(6) The Finance and Administration Cabinet shall maintain a list of states that give to or require a preference for their own resident bidders, including details of the preference given to such bidders, to be used by public agencies in determining resident bidder preferences. The cabinet shall also promulgate administrative regulations in accordance with KRS Chapter 13A establishing the procedure by which the preferences required by this section shall be given.

(7) The preference for resident bidders shall not be given if the preference conflicts with federal law.

(8) Any public agency soliciting or advertising for bids for contracts shall make KRS 45A.490 to 45A.494 part of the solicitation or advertisement for bids.

The reciprocal preference as described in KRS 45A.490-494 above shall be applied in accordance with 200

KAR 5:400.

Determining the residency of a bidder for purposes of applying a reciprocal preference Any individual, partnership, association, corporation, or other business entity claiming resident bidder status shall submit along with its response the attached Required Annual Affidavit for Bidders, Offerors, and Contractors Claiming Resident Bidder Status, unless a valid, Annual Affidavit is already on file with the Commonwealth. The BIDDING AGENCY reserves the right to request documentation supporting a bidder’s claim of resident bidder status. Failure to provide such documentation upon request shall result in disqualification of the bidder or contract termination.

A nonresident bidder shall submit, along with its response, its certificate of authority to transact business in the Commonwealth as filed with the Commonwealth of Kentucky, Secretary of State. The location of the principal office identified therein shall be deemed the state of residency for that bidder. If the bidder is not required by law to obtain said certificate, the state of residency for that bidder shall be deemed to be that which is identified in its mailing address as provided in its bid.

Preferences for a Qualified Bidder or the Department of Corrections, Division of Prison Industries

(KAR 200 5:410).

Pursuant to 200 KAR 5:410, and KRS 45A.470, Kentucky Correctional Industries will receive a preference equal to twenty (20) percent of the maximum points awarded to a bidder in a solicitation. In addition, the following “qualified bidders” will receive a preference equal to fifteen (15) percent of the maximum points awarded to a bidder in a solicitation: Kentucky Industries for the Blind, any nonprofit corporation that furthers the purposes of KRS Chapter 163 and any qualified nonprofit agencies for individuals with severe disabilities as defined in KRS 45A.465(3). Other than Kentucky Industries for the Blind, a bidder claiming “qualified bidder” status shall submit along with its response to the solicitation a notarized annual affidavit, which affirms that it meets the requirements to be considered a qualified bidder- annual affidavit form included. The annual affidavit form is not required if a valid, annual affidavit is already on file with the Commonwealth. If requested, failure to provide documentation to a public agency proving qualified bidder status may result in disqualification of the bidder or contract termination.

Past Vendor Performance may be considered in the award of this Contract. Vendors with a record of poor performance in the last 12 months may be found non-responsible and ineligible for award.

Section 14 Tax Exempt Status Do not include Federal Excise Tax, Kentucky Sales or Use Tax in prices quoted in response to this solicitation.

Section 15 Basis of Price Revisions PRICE ADJUSTMENTS: Unless otherwise specified, the prices established by the contract resulting from this solicitation shall remain firm for the contract period subject to the following:

A: Price Increases: A price increase shall not occur during the first twelve (12) months of the contract. A vendor may request a price increase after twelve (12) months of the contract, which may be granted or denied by the Commonwealth. Any such price increase shall be based on industry wide price changes. The contract holder must request in writing a price increase at least thirty (30) days prior to the effective date, and shall provide firm proof that the price increase(s) is justified. The Office of Procurement Services may request additional information or justification. If the price increase is denied, the contract holder may withdraw from the contract without prejudice upon written notice and approval by the Office of Procurement Services.

Provided, however, that the vendor must continue service, at the contract prices, until a new contract can be established (usually within sixty (60) days).

B: Price Decreases: The contract price shall be reduced to reflect any industry wide price decreases. The contract holder is required to furnish the Office of Procurement Services with notice of any price decreases as soon as such decreases are available.

C: Extended Contract Periods: If the contract provides for an optional renewal period, a price adjustment may be granted at the time the contract is renewed, subject to price increase justification as required in Paragraph A “Price Increases” as stated above.

Section 16 Vendor Terms and Conditions Solicitation or quotation forms that include terms and conditions not in conformity with the terms and conditions of this solicitation or the Statutes of the Commonwealth of Kentucky may be deemed non-responsive.

The Commonwealth of Kentucky shall not be bound by any part(s) of the bidder’s response to this solicitation that contains information,…