ELECTRONIC BID SUBMISSION

Bid responses shall be received by electronic submission in the eProcurement system.

An electronic bid shall be authorized by the proper agent of the firm by the act of submitting it electronically through the eProcurement system.

Bid information MUST be completed online. Response must contain all required information for the Solicitation. A separate Bid Sheet is attached and must be included with the response. Bidders MUST enter $.01 in the Unit Price field as the electronic bid. This is the ONLY pricing that is to be entered electronically. All actual pricing must be on the Bid Sheet.

All bidders MUST be registered in the Commonwealth eProcurement System via the Vendor Self Service System at https://vss.ky.gov

Allow 24 – 48 hours to complete Vendor Registration. Vendors must be logged in to their Vendor Self Service (VSS) account in order to submit a response. Registrations completed the day of bid closing must be completed by the Vendor in the VSS portal. The Customer Resource Center is not able to complete registrations and activate accounts on the same day. Closing dates will not be extended for Vendors not registered by the date/time of the bid closing. Vendor Self Service Registration Guides are provided at https://vss.ky.gov

All bidders are cautioned to begin their electronic submission in sufficient time to complete before the closing date and time. Delays due to technical difficulties or document upload impediments shall not be justification for acceptance of a late bid or proposal. Vendor attention to this advisory is encouraged. If you need assistance, please contact the Customer Resource Center (CRC) by email at Finance.CRCGroup@ky.gov or phone 502-564-9641 or toll-free 877-973-HELP (4357).

Online bid responses must be in an “Accepted” status and shall be assigned a date and time stamp from the eProcurement system at the time of final acceptance and formal submission by the vendor. The system will not allow submission of an online response after the published date and time for closing.

An offer may be modified or withdrawn by electronic or written notice ONLY if received prior to the bid closing date and time. An electronic offer may be modified by applying the appropriate electronic signature and following the procedure in the state’s eProcurement signature.

https://vss.ky.gov/ https://vss.ky.gov/ mailto:Finance.CRCGroup@ky.gov

The following items MUST be submitted prior to award:

_____REVENUE FORM 10A100 KENTUCKY TAX REGISTRATION APPLICATION

(see Section 36)

_____CERTIFICATE OF AUTHORITY – REGISTRATION WITH SECRETARY OF

STATE BY A FOREIGN ENTITY (see Section 38)

_____REQUIRED AFFIDAVIT(S) (see Attachment C)

_____Required Proof: Prior to contract award, the vendor must submit proof of authorization for all items bid. This must be a formal letter from the manufacturer on the manufacturer’s official letterhead stating that the vendor is an authorized reseller for that specific product, or a signed authorized reseller agreement. Web screenshots, emails, or any non-official documentation shall not be approved.

_____Cybersecurity Exception: Prior to contract award, for cybersecurity products, a formal authorization letter from the specific distributor validating the vendor’s ability to resell those tools will be accepted.

ATTACHMENT A

Commonwealth of Kentucky Request for Bid (RFB)

For

NETWORK SECURITY SOFTWARE, HARDWARE, AND SERVICES

RFB 758 2700000066

Issued by The Finance and Administration Cabinet

On Behalf Of

COMMONWEALTH OFFICE OF TECHNOLOGY (COT)

Release Date: August 20, 2026 Vendors’ Written Questions Due: August 31, 2026, at 10:00AM ET

Commonwealth’s Response to Written Questions: September 8, 2026 CLOSING DATE AND TIME: September 17, 2026, 1:30PM ET

Commonwealth Buyer:

Melissa Hubbard, CPPB, KCPM

COMMONWEALTH OF KENTUCKY

FINANCE AND ADMINISTRATION CABINET

Office of Procurement Services

200 MERO STREET, 5TH FLOOR

FRANKFORT KY 40622

(502) 782-5336

Melissa.Hubbard@ky.gov mailto:stephanier.williams@mail.state.ky.us

BID READINGS

Any person wishing to hear a bid reading may call the OPS conference line at

844-603-5060, Conference ID number 240522005, and Participant Code 33957, at 1:30pm, ET on the bid closing date.

PLEASE READ THIS SOLICITATION AND ITS INSTRUCTIONS IN ITS ENTIRETY.

This is a Request for Bid (RFB).

Vendors shall comply with the terms and conditions stated in the solicitation.

Any efforts to negotiate these terms and conditions SHALL NOT be accepted and SHALL cause the bid to be deemed non-responsive.

All proposed pricing shall remain valid for a minimum of sixty (60) calendar days after the bid due date.

This Contract shall be awarded as Group All. Vendors shall bid all line items, otherwise bid shall be deemed non-responsive.

Vendors should review and comply with the general bidding requirements listed under “Procurement Laws, Preference, Regulations and Policies” and “Response to Solicitation” located on the eProcurement Web page at https://finance.ky.gov/eProcurement/Pages/procurement-laws-regulations-and-policies.aspx and https://finance.ky.gov/eProcurement/Pages/doing-business-with-the-commonwealth.aspx respectively The vendor must comply with all applicable statutes, regulations and policies related to this procurement.

https://finance.ky.gov/eProcurement/Pages/procurement-laws-regulations-and-policies.aspx https://finance.ky.gov/eProcurement/Pages/procurement-laws-regulations-and-policies.aspx https://finance.ky.gov/eProcurement/Pages/doing-business-with-the-commonwealth.aspx https://finance.ky.gov/eProcurement/Pages/doing-business-with-the-commonwealth.aspx

Solicitation

Terms and Conditions

Master Agreement

Section 1 Scope of Contract The Office of Procurement Services issues this solicitation to establish a Master Agreement for: NETWORK SECURITY SOFTWARE, HARDWARE, AND SERVICES.

Section 2 Bid Specifications (Requirements that include the words “Shall”, “Will”, “Must” indicate a mandatory requirement)

A. Authorized Reseller Verification

1. Mandatory Status: The vendor must be an authorized reseller for all products on the contract.

2. Required Proof: Prior to contract award, the vendor must submit proof of authorization for all items bid. This must be a formal letter from the manufacturer on the manufacturer’s official letterhead stating that the vendor is an authorized reseller for that specific product, or a signed authorized reseller agreement. Web screenshots, emails, or any non-official documentation shall not be approved.

3. Cybersecurity Exception: Prior to contract award, for cybersecurity products, a formal authorization letter from the specific distributor validating the vendor’s ability to resell those tools will be accepted.

4. Future Additions: Any new products added after contract award will require the exact same proof of authorization as outlined above and the approval from COT.

B. Software Product Requirements

The vendor must provide the software necessary to establish, maintain, and secure the Commonwealth’s network and server environments, protecting them from unauthorized intrusion. This includes tools to cache, inspect, and filter content to comply with state security and business policies.

The software offerings must include, but are not limited to, tools for:

1. Firewall Management: Implementing and managing firewalls like Checkpoint, Fortinet, and Palo Alto.

2. Rule Base Analysis: Analyzing firewall rules to assess how changes impact effectiveness, efficiency, compliance, and risk (such as Algosec).

3. Web Gateways: Implementing URL caching and filtering solutions (such as

Forcepoint Secure Web Gateway).

4. Endpoint Security: Implementing desktop and laptop security solutions (such as Symantec Endpoint Security Complete).

5. SSL Certificates: Managing and implementing SSL certificate solutions

(including Microsoft PKI, DigiCert SSL Certificates).

6. Data-in-Transit Encryption: Managing the encryption of data moving across networks (such as Certes Trustnet Manager).

7. Two-Factor Authentication (2FA): Implementing multi-factor systems (including

Symantec VIP, Microsoft, RSA Authentication Manager Base Tier, and RSA SID 700).

8. Vulnerability Testing: Inspecting website/application code and conducting penetration testing (such as Tenable Nessus, OpenText Fortify, OpenText Fortify WebInspect, and Rapid7 App Spider).

Software Lifecycle Responsibilities

1. Proactive Upgrades: The vendor must actively keep the Commonwealth informed of the latest software upgrades and new technologies for each product as they become available.

2. Full Service: The vendor shall assume full operational responsibility for the delivery, installation, and ongoing maintenance of these software products.

C. Hardware Product Requirements

The vendor must provide the hardware and physical appliances required to maintain a secure computing environment and protect the Commonwealth against unauthorized access. These will be used to cache, inspect, and filter content according to state policies.

The hardware offerings must include, but are not limited to:

1. Firewall Infrastructure: Deploying physical firewalls (including Fortinet, Checkpoint, and Palo Alto).

2. Unified Threat Management (UTM): Centralized solutions to identify risks and vulnerabilities enterprise-wide and assist with mitigation strategies (such as Elastic).

3. Intrusion Protection Systems (IPS): Managing and deploying network security appliances (such as TrendMicro Tipping Point).

4. Data Protection: Encrypting data both at rest and in motion (such as Certes).

5. Email & SMTP Relays: Securing email infrastructure and routing (including

Microsoft Exchange and Proofpoint).

6. Content Performance: Deploying content caching, inspection, and filtering hardware.

Hardware Service Requirements

1. Proactive Upgrades: The vendor must actively keep the Commonwealth informed of the latest hardware upgrades and new technologies for each product as they become available.

2. End-to-End Fulfillment: The vendor shall be responsible for the physical delivery, installation, and maintenance of all hardware.

3. On-Site Support: When required, the vendor must provide highly skilled, on-site personnel for implementation, configuration, or maintenance.

4. RMA Logistics: The vendor must work collaboratively with the Commonwealth to establish Return Merchandise Authorization (RMA) procedures on a per-purchase basis.

D. Maintenance, Support, and Services

Maintenance and support are strictly required for all existing and future software and hardware procured under this contract.

1. Support Rates: The vendor must provide online and on-site software maintenance and support services billed on an hourly basis.

2. Certified Personnel: The vendor must deploy appropriately certified technicians to support all systems.

3. Existing manufacturers:

o Checkpoint Firewall o Palo Alto Firewall o TrendMicro o ProofPoint o Elastic o Symantec

E. Technical and Product Training

Training must be made available upon request for all contracted hardware, software, and services.

1. On-Site Training: Costs will be calculated using the hourly rate for manufacturer-specific training. This cost must include student registration fees, all training materials, and instructor travel/lodging.

o Note: Instructor travel expenses must align strictly with state travel regulation 200 KAR 2:006.

2. Off-Site Training: Costs must cover student registration fees and all physical or digital training materials.

3. Alternative Formats: The Commonwealth may also request pricing or availability for CD-based or web-based training modules.

F. Service Level Agreements (SLA) & Response Times

To ensure continuous operation, support services must meet strict response windows:

1. Initial Contact: Telephone and email responses to reported problems must not exceed one (1) hour.

2. On-Site Resolution: If a problem requires hands-on support, an on-site technician should arrive and resolve the issue within twenty-four (24) hours.

The Commonwealth understands that this is a reseller contract and some aspects of resolution may be outside the control of the reseller.

3. No Unauthorized Subcontracting: The vendor is not permitted to contract out support services to a third party unless the vendor receives prior written approval from COT or the using agency.

4. Availability Schedules:

o Technical Support: Must be available 24 hours a day, 7 days a week.

o Sales Staff: Must be available statewide during normal business hours

(8:00 a.m. to 5:00 p.m.), Monday through Friday, across both Eastern and Central time zones.

G. Pricing and Billing Requirements

1. All-Inclusive Rates: The vendor’s final pricing must reflect all operational charges. The Commonwealth will not accept any add-on charges for service establishment, installation, service modifications, deactivations, re-activations, or adding/deleting specific features for individual users.

2. No Initiation Fees: Monthly service rates cannot include separate initiation or setup fees.

3. Vendor Omissions: The Commonwealth shall not pay for any additional items or services that were omitted from your bid, whether those omissions were intentional or unintentional.

H. Data and Log Retention

1. Standard Logs: The vendor must retain system log files for a minimum of ninety

(90) days.

2. Extended Retention: The vendor must provide extended log retention options for items that fall under specific regulatory compliance requirements.

I. Contract Reporting

• Usage Reports: Upon request, the vendor must submit formal contract usage reports directly to the COT Chief Contracting Officer via email at stephanier.williams@ky.gov.

J. Dedicated Vendor Representative

1. Single Point of Contact: The vendor must assign a single, dedicated point of contact to service the Commonwealth account.

2. Toll-Free Support: The vendor must provide a dedicated toll-free number for all account servicing and support needs.

K. Shipping and Deliveries

1. Standard Delivery Window: All orders must be physically delivered to the designated Commonwealth address on the agency Delivery Order (DO) within fifteen (15) business days after you receive the order.

2. Expedited Requests: The vendor should have a mechanism to provide expedited delivery windows upon special request.

Section 2A

Commonwealth Office of Technology (COT) Requirements

1. Commonwealth Information Technology Policies and Standards A. The vendor and any subcontractors shall be required to adhere to applicable Commonwealth policies and standards.

B. The Commonwealth posts changes to COT Standards and Policies on its Commonwealth Office of Technology - Home - Commonwealth Office of Technology (Kentucky) website. Vendors and subcontractors shall ensure their solution(s) shall work in concert with all posted changes. Vendors or subcontractors that cannot comply with changes must, within thirty (30) days of the posted change, request written relief with the justification for such relief. The Commonwealth may: 1) deny the request, 2) approve an mailto:stephanier.williams@ky.gov https://technology.ky.gov/Pages/index.aspx https://technology.ky.gov/Pages/index.aspx exception to the policy/standard, or 3) consider scope changes to the contract to accommodate required changes. Vendors or subcontractors that do not provide the response within the thirty (30) day period shall be required to comply within ninety (90) days of the change.

2. Compliance with Kentucky Information Technology Standards (KITS)

The Kentucky Information Technology Standards (KITS) reflect a set of principles for information, technology, applications, and organization. These standards provide guidelines, policies, directional statements and sets of standards for information technology. It defines, for the Commonwealth, functional and information needs so that technology choices can be made based on business objectives and service delivery. The vendor shall stay knowledgeable and shall provide a solution that works in concert with these standards for all related work.

https://technology.ky.gov/about-the-agency/Pages/kits.aspx

3. Privacy, Confidentiality and Ownership of Information

The Commonwealth is the designated owner of all Commonwealth data and shall approve all access to that data. The vendor shall not have ownership of Commonwealth data at any time. The vendor shall not profit from or share Commonwealth data. The vendor shall be in compliance with privacy policies established by governmental agencies or by state or federal law. Privacy notice statements may be developed and amended from time to time by the Commonwealth and will be appropriately displayed on the Commonwealth portal (Ky.gov). The vendor should provide sufficient security to protect the Commonwealth and COT data in network transit, storage, and cache. All Commonwealth data, including backups and archives, must be maintained at all times within the contiguous United States. All Commonwealth data, classified as sensitive or higher, as defined in Enterprise Standards, must be encrypted in-transit from vendor’s network and at rest while stored on vendor’s laptops or other portable media devices.

4. Data Quality

The vendor shall provide proposed levels of data quality per the following dimensions.

Data Quality is the degree to which data is valid, accurate, complete, unique, timely, consistent with all requirements and business rules, and relevant for a given use. The vendor shall provide data quality definitions and metrics for any data elements. Data has to be of the appropriate quality to address the needs of the Commonwealth of Kentucky. The following dimensions can be used to assess data quality:

• Validity – The data values are in an acceptable format.

• Accuracy – The data attribute is accurate.

• Completeness – There are no null values in a data field.

• Uniqueness – There are no duplicate values in a data field.

• Timeliness – The data attribute represents information that is not out-of-date.

• Consistency – The data attribute is consistent with a business rule that https://technology.ky.gov/about-the-agency/Pages/kits.aspx may be based on that attribute itself, or on multiple attributes.

• Adherence to business rules – The data attribute or a combination of data attributes adheres to specified business rules.

5. License Agreements

Any proposed software agreements, i.e. license agreement, subscription agreement, end-user license agreement, etc. shall include the following language, or similar, and must be submitted to the Commonwealth Office of Technology (COT) for review and approval prior to the award of the contract:

“Governing Law shall be the Commonwealth of Kentucky, Franklin County. All terms of the vendor/subvendor agreement/EULA shall be read as applicable only to the extent permitted by Kentucky law and no term in violation of the Kentucky law, inclusive of Kentucky Procurement Law, shall be given effect.”

Any third-party software licenses and cloud resources necessary for the proposed solution may be procured via the Commonwealth’s existing contracts.

6. Software Version Requirements

All commercially supported and Commonwealth approved software components such as Operating system (OS), Database software, Application software, Web Server software, Middle Tier software, and other ancillary software must be kept current. In the event that a patch interferes with the solution, the vendor must present a plan for compliance to the Commonwealth outlining the constraints and an appropriate plan of action to bring the solution in to compliance to allow this patch to be applied in the shortest timeframe possible, not to exceed three (3) months, unless otherwise negotiated with the Commonwealth.

7. OS Requirements

A. Non-On Prem Solutions

1. No Commonwealth data shall be co-mingled with another entity, without the prior approval of the Commonwealth.

2. Vendor shall provide a solution to move data to the Commonwealth, if required by the Commonwealth.

a. At the end of the contract, the vendor shall provide all agency data in a useable standard data format (such as asci, csv, etc.) that can be converted to a subsequent system. The vendor shall cooperate to this end with the agency and/or a vendor of the agency’s choice, in a timely and efficient manner.

b. Vendor shall address the destruction of Commonwealth data as defined in CIO-092 and provide a certification of the complete and permanent deletion the Commonwealth data.

B. Infrastructure as a Service

1. Vendor shall work with the agency and COT to establish all administrative personnel engagements.

2. Vendor shall meet certification requirements for classification of data being stored.

3. Vendor shall, at COT’s request, provide appropriate access to enable the

Commonwealth to perform additional security measures in compliance with Commonwealth Enterprise Policies, Standards, and/or any Federal or State requirements.

4. Vendor shall provide an Exit Strategy, to move all data to the Commonwealth Data Center, if required by the Commonwealth.

At the end of the contract, the vendor shall provide all agency data in a form that can be converted to any subsequent system of the agency’s choice. The vendor shall cooperate to this end with the vendor of the agency’s choice, in a timely and efficient manner.

8. Project Governance

Vendor shall work with the agency and appropriate COT offices, when needed, in the cases of data governance, security aspects, hosting, integration, etc., provided that such work does not expand the scope of the services as described in this RFP absent a corresponding change order agreed to by the parties reflecting such expansion.

9. Application and Service Requirements

Current Enterprise Applications and Services

1. COT provides a number of Enterprise Shared Services to State agencies.

Vendor shall use published IT Applications and Services provided on KITS for: Enterprise Service Bus, Enterprise Content Management, Data Warehousing, Data Analytics and Reporting, Business Intelligence, Web Services, GIS, unless explicitly approved by COT.

2. Vendor provided dedicated application components (i.e., Application Servers, Databases, etc.) shall comply with KITS or if the technology is not included in KITS, the technology must be accepted by the Commonwealth for inclusion in KITS or granted a written exception to KITS according to COT Information Technology Standards Policy currently CIO-051.

3. Vendor applications must describe in detail all available features and functionality accessible via APIs.

4. All business applications must support the ability to use modern authentication for authentication and authorization. Modern authentication technologies would include SAML 2.0, WSFED, OAuth, or OpenID Connect.

10. Project Management Requirements

The COT Division of Governance and Strategy (COT-DGS) is responsible for overseeing large and complex technology projects throughout the Commonwealth. The vendor shall adhere to Project Management standards and reporting requirements established by COT-DGS, which are posted at https://technology.ky.gov/services-and-support/Pages/About-the-Project- Management-Branch.aspx. These include, but are not limited to, having a documented project schedule, risk management, issue management and reporting project status to the CIO monthly in the format defined by COT-DGS. In addition to the project management standards required by COT-DGS, agency specific requirements may be defined in this RFB.

https://technology.ky.gov/services-and-support/Pages/About-the-Project-Management-Branch.aspx https://technology.ky.gov/services-and-support/Pages/About-the-Project-Management-Branch.aspx

11. Applicable Security Control Framework Compliance

The vendor must have an awareness and understanding of the NIST Special Publication 800-53 Security Control Framework and employ safeguards that meet or exceed the moderate level controls as defined within the standard. The vendor must provide sufficient safeguards to provide reasonable protections around the Commonwealth’s data to ensure that the confidentiality, integrity, and availability is maintained at an appropriate level. These include but are not limited to:

• Access Control The vendor must employ policy and process that provide for stringent control to limit physical and logical access to systems that house Commonwealth data, on a need to know basis, provide clear separation of duties, and adheres to least privilege principles.

• Awareness and Training The vendor must provide the appropriate role specific training for staff to ensure that there is awareness and understanding of roles and responsibilities as they relate to the protections around the Commonwealth’s data.

• Audit and Accountability There must be sufficient auditing capability to ensure that actions are tracked and there is individual accountability for all actions taken by vendor staff.

• Configuration Management The vendor must work within established baselines that provide minimal functionality needed to ensure service delivery without exposing unnecessary risk. The vendor must also employ structured change control processes that provide a level of coordination with the client agreed upon in a Service Level Agreement (SLA).

• Contingency Planning The vendor must employ contingent planning policy and procedures that ensure service delivery based on agreed SLA levels while maintaining all Commonwealth data within the continental Unites States.

• Identification and Authorization The vendor must employ appropriate identity and access management policies and procedures to ensure that access is appropriately authorized and managed at a level to ensure that access is provisioned and de-provisioned in a timely and efficient manner.

• Incident Response The vendor must employ policy and procedures to ensure that an appropriate response to all identified security incidents are addressed in a timely manner and are reported to the appropriate parties in an agreed upon SLA timeframe. The vendor must also ensure that all staff are sufficient trained to ensure that they can identify situations that are classified as security incidents.

• Maintenance The vendor must employ policy and procedures that ensure that all maintenance activities are conducted only by authorized maintenance staff leveraging only authorized maintenance tools.

• Media Protection The vendor must employ policy and procedure to ensure that sufficient protections exist to protect Commonwealth data on all storage media throughout the media lifecycle and maintain documentation from media creation through destruction.

• Physical and Environmental Controls The vendor must employ physical and environmental policies and procedures that ensure that the service and delivery infrastructure are located in a physically secure and environmentally protected environment to ensure the confidentiality, integrity, and availability of Commonwealth data.

• Personnel Security The vendor must employ policies and procedures to ensure that all staff that have access to systems that house, transmit, or process Commonwealth data have been appropriately vetted and have been through a background check at the time of hire and periodically thereafter.

• System and Communications Protections The vendor must employ physical and logical protection that protect system communications and communication media from unauthorized access and to ensure adequate physical protections from damage.

12. IRS Publication 1075 -Exhibit 7 Safeguarding Contract Language

Publication 1075 (Rev. 11-2021) (irs.gov)

I. PERFORMANCE

In performance of this contract, the Contractor agrees to comply with and assume responsibility for compliance by officers or employees with the following requirements:

(1) All work will be performed under the supervision of the contractor.

(2) The contractor and contractor’s officers or employees to be authorized access to FTI must meet background check requirements defined in IRS Publication 1075. The contractor will maintain a list of officers or employees authorized access to FTI. Such list will be provided to the agency and, upon request, to the

IRS.

(3) FTI in hardcopy or electronic format shall be used only for the purpose of carrying out the provisions of this contract. FTI in any format shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of this contract.

Inspection or disclosure of FTI to anyone other than the contractor or the contractor’s officers or employees authorized is prohibited.

(4) FTI will be accounted for upon receipt and properly stored before, during, and after processing. In addition, any related output and products require the same level of protection as required for the source material.

https://www.irs.gov/pub/irs-pdf/p1075.pdf

(5) The contractor will certify that FTI processed during the performance of this contract will be completely purged from all physical and electronic data storage with no output to be retained by the contractor at the time the work is completed.

If immediate purging of physical and electronic data storage is not possible, the contractor will certify that any FTI in physical or electronic storage will remain safeguarded to prevent unauthorized disclosures.

(6) Any spoilage or any intermediate hard copy printout that may result during the processing of FTI will be given to the agency. When this is not possible, the contractor will be responsible for the destruction of the spoilage or any intermediate hard copy printouts and will provide the agency with a statement containing the date of destruction, description of material destroyed, and the destruction method.

(7) All computer systems receiving, processing, storing, or transmitting FTI must meet the requirements in IRS Publication 1075. To meet functional and assurance requirements, the security features of the environment must provide for the managerial, operational, and technical controls. All security features must be available and activated to protect against unauthorized use of and access to

FTI.

(8) No work involving FTI furnished under this contract will be subcontracted without the prior written approval of the IRS.

(9) Contractor will ensure that the terms of FTI safeguards described herein are included, without modification, in any approved subcontract for work involving

FTI.

(10) To the extent the terms, provisions, duties, requirements, and obligations of this contract apply to performing services with FTI, the contractor shall assume toward the subcontractor all obligations, duties and responsibilities that the agency under this contract assumes toward the contractor, and the subcontractor shall assume toward the contractor all the same obligations, duties and responsibilities which the contractor assumes toward the agency under this contract.

(11) In addition to the subcontractor’s obligations and duties under an approved subcontract, the terms and conditions of this contract apply to the subcontractor, and the subcontractor is bound and obligated to the contractor hereunder by the same terms and conditions by which the contractor is bound and obligated to the agency under this contract.

(12) For purposes of this contract, the term “contractor” includes any officer or employee of the contractor with access to or who uses FTI, and the term “subcontractor” includes any officer or employee of the subcontractor with access to or who uses FTI.

(13) The agency will have the right to void the contract if the contractor fails to meet the terms of FTI safeguards described herein.

II. CRIMINAL/CIVIL SANCTIONS

(1) Each officer or employee of a contractor to whom FTI is or may be disclosed shall be notified in writing that FTI disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any FTI for a purpose not authorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution.

(2) Each officer or employee of a contractor to whom FTI is or may be accessible shall be notified in writing that FTI accessible to such officer or employee may be accessed only for a purpose and to the extent authorized herein, and that access/inspection of FTI without an official need-to-know for a purpose not authorized herein constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution.

(3) Each officer or employee of a contractor to whom FTI is or may be disclosed shall be notified in writing that any such unauthorized access, inspection or disclosure of FTI may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each unauthorized access, inspection, or disclosure, or the sum of actual damages sustained as a result of such unauthorized access, inspection, or disclosure, plus in the case of a willful unauthorized access, inspection, or disclosure or an unauthorized access/inspection or disclosure which is the result of gross negligence, punitive damages, plus the cost of the action. These penalties are prescribed by IRC sections 7213, 7213A and 7431 and set forth at 26 CFR 301.6103(n)-1.

(3) Additionally, it is incumbent upon the contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000.

(4) Granting a contractor access to FTI must be preceded by certifying that each officer or employee understands the agency’s security policy and procedures for safeguarding FTI. A contractor and each officer or employee must maintain their authorization to access FTI through annual recertification of their understanding of the agency’s security policy and procedures for safeguarding FTI. The initial certification and recertifications must be documented and placed in the agency's files for review. As part of the certification and at least annually afterwards, a contractor and each officer or employee must be advised of the provisions of IRC sections 7213, 7213A, and 7431 (see Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training on the agency’s security policy and procedures provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches. (See Section 10) For the initial certification and the annual recertifications, the contractor and each officer or employee must sign, either with ink or electronic signature, a confidentiality statement certifying their understanding of the security requirements.

III. INSPECTION

The IRS and the Agency, with 24 hour notice, shall have the right to send its inspectors into the offices and plants of the contractor to inspect facilities and operations performing any work with FTI under this contract for compliance with requirements defined in IRS Publication 1075. The IRS’ right of inspection shall include the use of manual and/or automated scanning tools to perform compliance and vulnerability assessments of information technology (IT) assets that access, store, process or transmit FTI. Based on the inspection, corrective actions may be required in cases where the contractor is found to be noncompliant with FTI safeguard requirements.

13. Protection of Personal Information Security and Breach Investigation Procedures and Practices Act Vendors that receive Personal Information as defined by and in accordance with Kentucky’s Personal Information Security and Breach Investigation Procedures and Practices Act, KRS 61.931, et seq., (the “Act”), shall secure and protect the Personal Information by, without limitation, complying with all requirements applicable to non-affiliated third parties set forth in the Act.

“Personal Information” is defined in accordance with KRS 61.931(6) as “an individual’s first name or first initial and last name; personal mark; or unique biometric or genetic print or image, in combination with one (1) or more of the following data elements:

a) An account, credit card number, or debit card number that, in combination with any required security code, access code or password, would permit access to an account;

b) A Social Security number;

c) A taxpayer identification number that incorporates a Social Security number;

d) A driver’s license number, state identification card number or other individual identification number issued by an agency;

e) A passport number or other identification number issued by the United States government; or

f) Individually Identifiable Information as defined in 45 C.F.R. sec. 160.013 (of the Health Insurance Portability and Accountability Act), except for education records covered by the Family Education Rights and Privacy Act, as amended 20 U.S.C. sec 1232g.”

As provided in KRS 61.931(5), a “non-affiliated third party” means “any person or entity that has a contract or agreement with the Commonwealth and receives (accesses, collects or maintains) personal information from the Commonwealth pursuant to the contract or agreement.”

The vendor hereby agrees to cooperate with the Commonwealth in complying with the response, mitigation, correction, investigation, and notification requirements of the Act.

The vendor shall immediately notify as soon as possible, but not to exceed seventy-two (72) hours, the contracting agency, the Office of Procurement Services, and the Commonwealth Office of Technology of a determination of or knowledge of a breach, unless the exception set forth in KRS 61.932(2)(b)2 applies and the vendor abides by the requirements set forth in that exception.

The vendor hereby agrees that the Commonwealth may withhold payment(s) owed to the vendor for any violation of the Identity Theft Prevention Reporting Requirements.

The vendor hereby agrees to undertake a prompt and reasonable investigation of any breach as required by KRS 61.933.

Upon conclusion of an investigation of a security breach of Personal Information as required by KRS 61.933, the vendor hereby agrees to an apportionment of the costs of the notification, investigation, and mitigation of the security breach.

In accordance with KRS 61.932(2)(a) the vendor shall implement, maintain, and update security and breach investigation procedures that are appropriate to the nature of the information disclosed, that are at least as stringent as the security and breach investigation procedures and practices established by the Commonwealth Office of Technology:

https://technology.ky.gov/OCISO/Pages/InformationSecurityPolicies,Standardsan dProcedures.aspx

Section 3 Purpose The purpose of this solicitation is to request vendor responses in order to provide these items under contract to agencies as needed.

Section 4 General This solicitation specifies requested items. It is not the intention of this solicitation to https://technology.ky.gov/OCISO/Pages/InformationSecurityPolicies,StandardsandProcedures.aspx https://technology.ky.gov/OCISO/Pages/InformationSecurityPolicies,StandardsandProcedures.aspx eliminate vendors or manufacturers of similar or equal equipment of the types specified.

It should be noted, however, that these requested items are written around specific needs of State agencies. The Commonwealth reserves the right to consider bids non-responsive if they do not comply with the specifications contained herein.

Section 5 Initial Contract Period The contract established from this solicitation shall be for the initial period of two (2) years from the date of award.

Section 6 Renewal Clause – Optional Renewal Period This contract may be extended at the completion of the initial contract period for six (6) additional one-year periods. This extension must have the written approval by all parties. If the contract resulting from this solicitation provides for an optional renewal period, the Commonwealth of Kentucky reserves the right to renegotiate any terms and/or conditions as may be necessary to meet requirements for the extended period.

The vendor will be advised of any proposed revisions prior to the renewal periods. In the event proposed revisions cannot be agreed upon, either party shall have the right to withdraw without prejudice from either exercising the option or continuing the contract in an extended period.

Section 7 Exceptions to Specifications Vendors are cautioned that changes made to the solicitation other than in the designated fields for response shall render the response invalid and result in a non-responsive bid. Otherwise, it will be considered that items/services offered are in strict compliance with these specifications, and the successful bidder shall be held responsible for delivering materials/services that meet these specifications. Any exceptions shall be marked as such within the body of the bid and explained on a separate page. The Commonwealth is not bound to accept any exceptions.

Section 8 Alternate Brands/Specifications Unless otherwise specified, brands and specifications referenced in this solicitation are meant to establish a minimum standard of quality only. Bidders may bid brands/specifications they consider to be equal by specifying the brand(s)/specifications and inserting the brand name(s), model number(s), etc. on which they are bidding. Bids offering “equal” products/specifications will be considered for award if such products are clearly identified in the bid and are determined by the State to meet or exceed fully the minimum essential specifications and salient characteristics referenced in the Solicitation. Bids that contain products/specifications that fail to meet the minimum essential requirements shall be deemed non-responsive.

Bidders who propose alternate brands/specifications should enclose descriptive literature with their bids so that the equality can be verified. Failure to enclose sufficient literature may result in a non-responsive bid. If the brands are not changed, the contract will be written accordingly and the successful bidder shall be required to deliver the brands/specifications stated in the solicitation.

Section 9 Recycle Requirements Prospective bidders are required to comply with Recycle Requirements for the purchase of goods, supplies, equipment, materials and printing with a minimum recycled content to the extent practicable per 200 KAR 5:330. This regulation can be viewed on the Internet at https://apps.legislature.ky.gov/law/kar/200/005/330.pdf

Section 10 Acknowledgment of Addenda It is the vendor's responsibility to check the web site for any modifications to this solicitation. Electronic Bid submittal is the vendor’s agreement to be bound by the terms of all addenda issued.

Section 11 Agencies to be Served This contract shall be for use by the following agency of the Commonwealth of Kentucky:

Commonwealth Office of Technology (COT) on behalf of All State Agencies

Political Subdivisions Under Kentucky Statutes, political subdivisions of this State including cities of all classes, counties, and school districts may participate in All State Agency Master Agreements to the same extent as agencies of the Commonwealth.

Section 12 Solicitation Submission Requirements Paper Bids are NOT acceptable for this RFB and shall be considered non-responsive.

All electronic documents submitted in response to this RFB shall be submitted in Microsoft Word, Microsoft Excel or PDF format ONLY.

Section 13 Method of Award Best Value – Ranking Approach The Commonwealth intends to award a contract to the vendor, whose offer, conforming to the solicitation, is the most advantageous on the basis of "best value" for all products, services, and requirements contained herein.

An evaluation committee, or a designated individual, will evaluate the information provided by the vendor in response to the established measurable criteria contained in the solicitation.

https://apps.legislature.ky.gov/law/kar/200/005/330.pdf

MEASURABLE CRITERIA

Criteria Maximum Points

A. Software Pricing 300

B. Hardware Pricing 300

C. Services Hourly Rate (Fully Loaded Not to Exceed)

D. Training 100

E. Best Delivery Time 100

TOTAL 1000

Each vendor is responsible for submitting all relevant, factual and correct information with their offer to enable the evaluator(s) to afford each vendor the maximum score based on the available data submitted by the Vendor. VENDOR SHALL ENTER UNIT

PRICE AND TOTAL PRICE ON THE BID SHEET ONLY.

A bidder shall submit one (1) response to a solicitation and shall not propose more than one (1) model/brand for each item listed in the solicitation, except for requested tier pricing. Multiple or alternate bids offering more than one (1) bid price in total or by line item shall be rejected.

Vendors responding with the minimum Best Value requirements in this solicitation shall not be credited with Best Value points. Vendors responding with greater than the minimum requirements shall receive Best Value points. Failure to provide adequate information will impact the evaluated points awarded to the vendor.

A. Software Pricing (300 points)

The bidder with the lowest average Price receives the maximum score. The bidder with the next lowest average Price receives points by dividing the lowest average Price by the next lowest average price and multiplying that percentage by the available points. For example, 300 points is allocated to the lowest average Price criteria for this procurement, bidder “A” bids $3.00 as the lowest bidder and receives the maximum 300 points ($3.00 / $3.00 = 1.00 x 300 = 300). Assume bidder “B” is the next lowest bidder at $6.00, then “B” receives 150 points ($3.00 / $6.00) = .5 x 300 = 150).

B. Hardware Pricing (300 points)

The bidder with the lowest average Price receives the maximum score. The bidder with the next lowest average Price receives points by dividing the lowest average Price by the next lowest average price and multiplying that percentage by the available points. For example, 300 points is allocated to the lowest average Price criteria for this procurement, bidder “A” bids $3.00 as the lowest bidder and receives the maximum 300 points ($3.00 / $3.00 = 1.00 x 300 = 300). Assume bidder “B” is the next lowest bidder at $6.00, then “B” receives 150 points ($3.00 / $6.00) = .5 x 300 = 150).

C. Services Pricing Hourly Rate (200 points) with the next lowest average Price receives points by dividing the lowest average Price by the next lowest average price and multiplying that percentage by the available points. For example, 200 points is allocated to the lowest average Price criteria for this procurement, bidder “A” bids $3.00 as the lowest bidder and receives the maximum 200 points ($3.00 / $3.00 = 1.00 x 200 = 200). Assume bidder “B” is the next lowest bidder at $6.00, then “B” receives 100 points ($3.00 / $6.00) = .5 x 200 = 100).

D. Training Services (100 points) with the next lowest average Price receives points by dividing the lowest average Price by the next lowest average price and multiplying that percentage by the available points. For example, 100 points is allocated to the lowest average Price criteria for this procurement, bidder “A” bids $3.00 as the lowest bidder and receives the maximum 50 points ($3.00 / $3.00 = 1.00 x 100 = 100). Assume bidder “B” is the next lowest bidder at $6.00, then “B” receives 25 points ($3.00 / $4.00) = .5 x 100 = 50).

E. Best Delivery Time (100 points) Fifteen (15) business days is the requirement. Vendors who bid the requirement shall not receive any points. Only those vendors who bid less than fifteen (15) business days will receive points.

The bidder with the best Delivery Time receives the maximum score. The bidder with the next best Delivery Time receives points by dividing the best Delivery Time by the next best Delivery Time and multiplying that percentage by the available points. For example, 100 points is allocated to the best Delivery Time criteria for this procurement, bidder “A” bids 5 days as the best delivery and receives the maximum 100 points (5/5 = 1.00 x 100 = 100). Assume bidder “B” is the next best delivery at 10 days, then “B” receives 50 points (5/10) = .5 x 100 = 50).

The bidder shall clearly state the delivery time for this procurement. Delivery time must be specific and such phrases as, “as required”, “as soon as possible”, or “prompt” have no meaning and may result in a non-responsive bid.

The vendor agrees that when delivery is not made within the contracted due date, one percent (1%) per day shall be deducted from the vendor’s invoice for each day the vendor fails to meet the contracted delivery date.

Best Value scoring is subject to Reciprocal preference for Kentucky resident bidders and Preferences for a Qualified Bidder or the Department of Corrections, Division of Prison Industries (KAR 200 5:410).

KRS 45A.490 Definitions for KRS 45A.490 to 45A.494.

As used in KRS 45A.490 to 45A.494:

(1) "Contract" means any agreement of a public agency, including grants and orders, for the purchase or disposal of supplies, services, construction, or any other item; and

(2) "Public agency" has the same meaning as in KRS 61.805.

KRS 45A.492 Legislative declarations.

The General Assembly declares:

(1) A public purpose of the Commonwealth is served by providing preference to Kentucky residents in contracts by public agencies; and

(2) Providing preference to…