Attachment A - Terms and Conditions - RFP 758 2300000080.pdf

ELECTRONIC PROPOSAL SUBMISSION CHECKLIST

Proposals shall be received by electronic submission in the eProcurement system.

An electronic proposal shall be authorized by the proper agent of the firm by the act of submitting it electronically through the eProcurement system.

Proposal information MUST be completed online. Response must contain all required information for the Solicitation. All bidders MUST be registered in the Commonwealth eProcurement System via the Vendor Self Service System at https://emars311.ky.gov/webapp/vssprdonline3111d/AltSelfService

Allow 24 – 48 hours to complete Vendor Registration. Vendors must be logged in to their Vendor Self Service (VSS) account in order to submit a response. Registrations completed the day of bid closing must be completed by the Vendor in the VSS portal. The Customer Resource Center is not able to complete registrations and activate accounts on the same day. Closing dates will not be extended for Vendors not registered by the date/time of the bid closing.

Vendor Self Service Registration Guides are provided at https://finance.ky.gov/eProcurement/Pages/doing-business-with-the-commonwealth.aspx

All bidders are cautioned to begin their electronic submission in sufficient time to complete before the closing date and time. Delays due to technical difficulties or document upload impediments shall not be justification for acceptance of a late bid or proposal. Vendor attention to this advisory is encouraged. If you need assistance, please contact the Customer Resource Center (CRC) by email at Finance.CRCGroup@ky.gov or phone 502-564-9641 or toll-free 877-973-HELP (4357).

Proposals shall be submitted in three (3) parts: The Technical Proposal, the Cost Proposal, and Proprietary Information. Each part shall consist of one document attachment. Do not submit multiple document attachments as Technical, Cost or Proprietary. All files shall be labeled accordingly. Attachments may not exceed 65,000

KB.

Proposals submitted online must be in an “Accepted” status and shall be assigned a date and time stamp from the eProcurement system at the time of final acceptance and formal submission by the vendor. The system will not allow submission of an online proposal after the published date and time for closing.

https://emars311.ky.gov/webapp/vssprdonline3111d/AltSelfService https://finance.ky.gov/eProcurement/Pages/doing-business-with-the-commonwealth.aspx mailto:Finance.CRCGroup@ky.gov

A proposal may be modified or withdrawn by electronic or written notice ONLY if received prior to the bid closing date and time. An electronic offer may be modified by applying the appropriate electronic signature and following the procedure in the state’s eProcurement signature.

The vendor MUST include the following with the proposal submission.

If the items highlighted below are not submitted with the proposal submission, the Commonwealth MUST deem the proposal non-responsive and SHALL NOT consider for award.

All other items MUST be submitted prior to award.

*PROPOSED TECHNICAL SOLUTION

*PROPOSED COST SOLUTION

*MANDATORY REQUIREMENTS CHECKLIST [see Attachment F]

TRANSMITTAL LETTER [see Section 60.6(A)]

REVENUE FORM 10A100 KENTUCKY TAX REGISTRATION APPLICATION [see Section 60.6 (C)]

CERTIFICATE OF AUTHORITY- REGISTRATION WITH SECRETARY OF STATE

BY A FOREIGN ENTITY [see Section 60.6 (D)]

REQUIRED ANNUAL AFFIDAVIT AND OTHER AFFIDAVIT(S) [see Attachment C]

EEO FORMS IF APPLICABLE [see Section 40.21]

*Please see Attachment E - The Protection of Personal Information Security and

Breach Investigation Procedures and Practice Act (KRS 61.931), et seq.

effective January 1, 2015.

ATTACHMENT A

Commonwealth of Kentucky Request for Proposal (RFP)

For Kentucky Department of Tourism

Welcome Center Kiosks

RFP 758 2300000080

Release Date: September 1, 2022 CLOSING DATE AND TIME: September 19, 2022, at 3:30pm ET

(See Section 10.9 of this RFP for the Estimated Schedule of RFP Activities)

Issued by

The Finance and Administration Cabinet On Behalf of

Kentucky Department of Tourism

Commonwealth Buyer:

Susan S. Noland, KCPM

Assistant Director

COMMONWEALTH OF KENTUCKY

FINANCE AND ADMINISTRATION CABINET

Office of Procurement Services

200 Mero Street, 5th Floor

FRANKFORT KY 40622

(502) 564-5951 Susan.Noland@ky.gov

TABLE OF CONTENTS

Proposal Submission Checklist Section 10 – Introduction and Overview Section 20 – Background and Present System Summary Section 30 – Commonwealth Office of Technology Requirements Section 40 – Procurement Requirements Section 50 – Scope of Work Section 60 – Proposal Submission Section 70 – Proposal Evaluation Section 80 – Negotiations Section 90 – Attachments mailto:Susan.Noland@ky.gov

SECTION 10 – INTRODUCTION AND OVERVIEW

10.1 Purpose

The purpose of this Request for Proposal (RFP) is to solicit proposals for competitive negotiations pursuant to 200 KAR 5:307 for kiosks to be placed in six (6) Welcome Centers throughout Kentucky. Those Welcome Centers are located as follows:

Route Location Mile Point Town 911 Address

I-75 North Whitley Co Rest Area 1.505 Jellico

1575 N. I-75 Williamsburg, KY 40769

I-65 South Bullitt Co Rest Area 113.539 Shepherdsville 114S-I65 Shepherdsville, KY 40165

I-65 North

Simpson Co Rest Area 0.567 Franklin 36 I-65 North Franklin, KY 42134

I-64 West Carter Co Rest Area 173.587 Grayson 173 I-64 Grayson, KY 41143

I-64 East Shelby Co Rest Area 28.354 Fisherville 2835 I-64 Simpsonville, KY 40067

I-24 West

Christian Co Rest Area 92.057 Oak Grove 9200 I-24 Oak Grove, KY 42262

The kiosk system will be utilized by all travelers at the Welcome Centers for various reasons, but the main one being when Tourism staff are not present that we do not impede the flow of information to travelers. Tourism staff members are on shift eastern standard and central standard times from 8:30am-4:30pm. This is a very effective time in catching the checkout crowd from all attractions etc., but the traveler that is looking for somewhere to overnight for lodging and something to do in the area do not have the luxury of speaking to a Tourism professional from the hours of 4:30pm-8:30am, that is a 16-hour lapse in an employee being on-site to assist the traveling public.

The kiosk system will provide wayfinding, weather, lodging, attraction location and all that a Tourism professional can provide throughout the state. The system will also have the capability to forward this information to a personal device via text or email. One of the lost facets that a Welcome Center used to utilize pre Covid-19 is the use of a Guest Register and this will be integrated within the Kiosk system as well to provide that information at a distance from staff if they are on duty. Web access to the Kentucky Tourism website only as well as a social wall to line out events and festivals in Kentucky. A camera application will also be integrated so that an accurate people count can be established when Tourism staff are not on-site in evening and overnight hours. The final application that the Kiosk system will provide is the capability of Google Translate to reach our foreign traveler that is becoming more and more prevalent as time goes on. It will provide 5 different languages to the foreign traveler to bridge the language barrier from Tourism staff to traveler as well.

The interaction from one person to another is not replaceable, but this Kiosk system will bridge that gap with the information that it can provide to domestic and foreign travelers when a friendly face is not on-site for someone to speak to.

It will provide the same information that a Tourism professional can provide and access to Kentucky like we have never experienced before.

10.2 Issuing Office

The Commonwealth of Kentucky, Finance and Administration Cabinet, Office of Procurement Services, is issuing this RFP on behalf of the Kentucky Department of Tourism. The Finance and Administration Cabinet is the only office authorized to change, modify, amend, alter, or clarify the specifications, terms and conditions of this RFP.

A contract, based on this RFP, may or may not be awarded. Any contract award from this RFP is invalid until properly approved and executed by the Finance and Administration Cabinet.

10.3 Access to Solicitation, RFP, and Addenda

The Commonwealth wants each prospective vendor to have full and complete information on which to base a proposal response. Only information presented or referred to in this RFP and any additional written information that is supplied by the Commonwealth Buyer shall be used by vendors in preparing the response.

The solicitation, addenda, and attachments shall be posted to the Kentucky Vendor Self Service link at https://emars311.ky.gov/webapp/vssprdonline3111d/AltSelfService

It is not necessary to register to access the solicitation. Unregistered vendors can access solicitations by clicking on public access.

In the event of any conflict or variation between the solicitation or modification as issued by the Commonwealth and the vendor’s response, the version as issued shall prevail.

10.4 RFP Terminology

For the purpose of this RFP, the following terms may be used interchangeably:

o Proposer, Offeror, Contractor, Provider, or Vendor o Commonwealth Buyer, Buyer, Purchaser, or Contract Officer o RFP, Solicitation, or Procurement o Bid, Proposal, or Offer https://emars311.ky.gov/webapp/vssprdonline3111d/AltSelfService o Commonwealth of Kentucky, Commonwealth, or State, Agency, KY Department of Tourism o Fiscal Year will be defined as the Commonwealth fiscal year: July 1 through June 30 o Biennium will be defined as the Commonwealth biennium: July 1 of each even numbered year through June 30 of the next even numbered year o Requirements that include the words “Shall”, “Will”, “Must” indicate a mandatory requirement

10.5 Restrictions on Communications

The Commonwealth Buyer named on the Cover Sheet of this RFP shall be the sole point of contact throughout the procurement process. All communications, oral and written (regular, express, or electronic mail,), concerning this procurement shall be addressed to the Buyer.

For violation of this provision, the Commonwealth shall reserve the right to disqualify the vendors’ proposal response.

10.6 Written Questions Regarding this RFP

Vendors are encouraged to submit written questions pursuant to Section 10.9 of this RFP. Written questions shall be submitted to the Commonwealth Buyer via email Susan.Noland@ky.gov. Vendors should submit questions on Attachment D Vendors Question Form. No questions shall be accepted after the date(s) listed in Section 10.9 unless the question(s) is considered material to the procurement. The Commonwealth shall respond to salient questions in writing by issuing an addendum to the solicitation. The addendum shall be posted to the Kentucky Vendor Self Service site.

10.7 Notification of Award of Contract

The procurement process will provide for the evaluation of proposals and selection of the successful proposal in accordance with State law and regulations. KRS Chapter 45A of the Kentucky Model Procurement Code provides the regulatory framework for the procurement of services by State agencies.

All applicable statutes, regulations, policies and requirements shall become a part of an award as well as the Information Technology requirements.

The Commonwealth Buyer will email a Notification of Award to all vendors who submitted a proposal in response to the RFP. No other notification of the results of an award of contract will be provided.

For additional award information, vendors may email the Commonwealth Buyer.

10.8 Protest

mailto:Susan.Noland@ky.gov

Pursuant to KRS 45A.285, the Secretary of the Finance and Administration Cabinet, or his designee, shall have authority to determine protests and other controversies of actual or prospective offerors in connection with the solicitations or selection for award of a contract.

Any actual or prospective offeror or contractor, who is aggrieved in connection with solicitation or selection for award of a contract, may a file protest with the Secretary of the Finance and Administration Cabinet. A protest or notice of other controversy must be filed promptly and in any event within two (2) calendar weeks after such aggrieved person knows or should have known of the facts giving rise thereto. All protests or notices of other controversies must be in writing and shall be addressed and mailed to:

Holly M. Johnson, Secretary

COMMONWEALTH OF KENTUCKY

FINANCE AND ADMINISTRATION CABINET

200 Mero Street, 5th Floor

FRANKFORT KY 40622

The Secretary of Finance and Administration Cabinet shall promptly issue a decision in writing. A copy of that decision shall be mailed or otherwise furnished to the aggrieved party and shall state the reasons for the action taken.

The decision by the Secretary of the Finance and Administration Cabinet shall be final and conclusive.

10.9 Estimated Schedule of RFP Activities

The following table presents the anticipated schedule for major activities associated with the RFP distribution, proposal submission, proposal evaluation process, and contract award. The Commonwealth reserves the right at its sole discretion to change the Schedule of Activities, including the associated dates and times.

Anticipated Schedule of Activities

Release of RFP

September 1, 2022

Vendors’ Written Questions due by 12:00 PM ET

(SUBMIT QUESTIONS ON ATTACHMENT D-VENDORS’

QUESTION FORM)

September 7, 2022

Commonwealth’s Response to Vendors’ Written Questions

September 9, 2022

Proposals due by 3:30 PM ET

September 19, SECTION 20 – BACKGROUND AND PRESENT SYSTEM SUMMARY

20.1 Background

There are no kiosks at this time. Visitors are given information via hardcopy brochures or word of mouth from the welcome center staff. Staff are only there for certain hours, so this solution would provide 24 hour service to visitors.

SECTION 30 – COMMONWEALTH OFFICE OF TECHNOLOGY (COT)

REQUIREMENTS

30.1 Hosting

If the vendor is proposing a cloud solution, the vendor shall propose a commercial Federal Risk and Authorization Management Program (FedRAMP) compliant or HITRUST Cloud platform. The proposed solution must accommodate the Commonwealth Office of Technology (COT) oversight that includes an isolated tenant, cloud network access (peering connection) and monitoring solutions.

30.2 Commonwealth Information Technology Policies and Standards A. The vendor and any subcontractors shall be required to adhere to applicable

Commonwealth policies and standards.

B. The Commonwealth posts changes to COT Standards and Policies on its

Commonwealth Office of Technology - Home - Commonwealth Office of Technology (Kentucky) website. Vendors and subcontractors shall ensure their solution(s) shall work in concert with all posted changes. Vendors or subcontractors that cannot comply with changes must, within thirty (30) days of the posted change, request written relief with the justification for such relief. The Commonwealth may 1) deny the request, 2) approve an exception to the policy / standard, or 3) consider scope changes to the contract to accommodate required changes. Vendors or subcontractors that do not provide the response within the thirty (30) day period shall be required to comply within ninety (90) days of the change.

30.3 Compliance with Kentucky Information Technology Standards (KITS)

A. The Kentucky Information Technology Standards (KITS) reflect a set of principles for information, technology, applications, and organization. These standards provide guidelines, policies, directional statements and sets of standards for information technology. It defines, for the Commonwealth, functional and information needs so that technology choices can be made based on business objectives and service delivery. The vendor shall stay knowledgeable and shall provide a solution that works in concert with these https://technology.ky.gov/Pages/index.aspx https://technology.ky.gov/Pages/index.aspx standards for all related work resulting from this RFP. https://technology.ky.gov/about-the-agency/Pages/kits.aspx

B. The vendor and any subcontractors may be required to submit a technology roadmap for any offered solution. Additional roadmaps will be submitted upon request of the Commonwealth. The roadmap shall include, but is not limited to, planned, scheduled and projected product lifecycle dates and historical release/patch or maintenance dates for the technology. In addition, any guidance on projected release/revision/patch/maintenance schedules would be preferred.

30.4 Compliance with Commonwealth Security Standards

The software deployment and all vendor services shall abide by privacy and security standards as outlined in the Commonwealth’s Enterprise Information Technology Policies.

Enterprise Security Policies https://technology.ky.gov/OCISO/Pages/InformationSecurityPolicies,Standardsan dProcedures.aspx

Enterprise IT Policies https://technology.ky.gov/policies-and-procedures/Pages/policies.aspx

30.5 Compliance with Industry Accepted Reporting Standards Based on Trust Service Principles and Criteria The vendor must employ comprehensive risk and threat management controls based on defined industry standards for service organizations such as ISO AICPA TSP section 100, Trust Services Principles and Criteria. The vendor must annually assert compliance and engage a third party certification registrar to examine such assertions and controls to provide a Report, such as ISO 9000, ISO 14001, AT101 SOC 2 type 2, on Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, and Privacy, which contains an opinion on whether the operating controls effectively support the assertions. All such reports, including publicly available reports (i.e. AT 101 SOC

3) shall be made available to the Commonwealth for review.

30.6 System Vulnerability and Security Assessments

The Commonwealth reserves the right to conduct, in collaboration with the vendor, non-invasive vulnerability and security assessments of the software and infrastructure used to provide services prior to implementation and periodically thereafter. Upon completion of these assessments, the Commonwealth will communicate any findings to the vendor for action. Any cost relating to the alleviation of the findings will be the responsibility of the vendor. Mitigations will be subject to re-evaluation after completion. In cases where direct mitigation cannot be achieved, the vendor shall communicate this and work closely with the Commonwealth to identify acceptable compensating controls that will reduce risk https://technology.ky.gov/about-the-agency/Pages/kits.aspx https://technology.ky.gov/OCISO/Pages/InformationSecurityPolicies,StandardsandProcedures.aspx https://technology.ky.gov/OCISO/Pages/InformationSecurityPolicies,StandardsandProcedures.aspx https://technology.ky.gov/policies-and-procedures/Pages/policies.aspx to an acceptable and agreed upon level. An accredited third party source may be selected by the vendor to address findings, provided they will acknowledge all cost and provide valid documentation of mitigation strategies in an agreed upon timeframe.

30.7 Privacy Assessments

The Commonwealth reserves the right to conduct Privacy assessments of the collection, use, maintenance and sharing of Commonwealth data by any vendor services, software, and infrastructure used to provide services prior to implementation and periodically thereafter. Upon completion of this assessment, the Commonwealth will communicate any findings to the vendor for action. Any cost relating to the alleviation of the findings will be the responsibility of the vendor. Mitigations will be subject to re-evaluation after completion. In cases where direct mitigation cannot be achieved, the vendor shall communicate this and work closely with the Commonwealth to identify acceptable compensating controls or privacy practices that will reduce risk to an acceptable and agreed upon level. An accredited third-party source may be selected by the vendor to address findings, provided they will acknowledge all cost and provide valid documentation of mitigation strategies in an agreed upon timeframe.

30.8 Privacy, Confidentiality and Ownership of Information

The Commonwealth is the designated owner of all Commonwealth data and shall approve all access to that data. The Vendor shall not have ownership of Commonwealth data at any time. The vendor shall not profit from or share Commonwealth data. The Vendor shall be in compliance with privacy policies established by governmental agencies or by state or federal law. Privacy notice statements may be developed and amended from time to time by the Commonwealth and will be appropriately displayed on the Commonwealth portal (Ky.gov). The Vendor should provide sufficient security to protect the Commonwealth and COT data in network transit, storage, and cache. All Commonwealth data, including backups and archives, must be maintained at all times within the contiguous United States. All Commonwealth data, classified as sensitive or higher, as defined in Enterprise Standards, must be encrypted in-transit from Contractor’s network and at rest while stored on Contractor’s laptops or other portable media devices.

30.9 EU GDPR Compliance

The Commonwealth of Kentucky requires all vendor contracts to comply to the extent applicable with the European Union’s General Data Privacy Regulation [Regulation (EU) 2016/679] (the “GDPR”) when the Commonwealth is a “controller” or “processor” of “personal data” from an individual “data subject” located in the European Union, as those terms are defined in the GDPR. The Contractor acknowledges and agrees that it is acting as a “processor” of “personal data” for the Commonwealth under this Agreement and that all applicable requirements of the GDPR are incorporated by reference as material terms of this Agreement. The Contractor represents and warrants that (1) it is aware of and understands its compliance obligations as a “processor” under GDPR; (2) it has adopted a GDPR compliant data privacy compliance policy/program, a summary of which has been provided to the Commonwealth;

(3) it will process “personal data” only in accordance with the Commonwealth’s instructions; and (4) with regard to its obligations under this Agreement, it shall comply with all applicable requirements of the GDPR. Additionally, the Contractor may be found liable to the Commonwealth for damages arising from any violation of applicable requirements of GDPR by the Contractor in its performance of the services hereunder, subject to Section 40.31, entitled Contractor’s Limitation of Liability.

30.10 X-as-a-Service Technical Definitions

Refer to NIST 800-145

30.11 Data Quality

Vendors shall provide proposed levels of data quality per the following dimensions.

Data Quality is the degree to which data is valid, accurate, complete, unique, timely, consistent with all requirements and business rules, and relevant for a given use. The vendor shall provide data quality definitions and metrics for any data elements. Data has to be of the appropriate quality to address the needs of the Commonwealth of Kentucky. The following dimensions can be used to assess data quality:

• Validity – The data values are in an acceptable format.

• Accuracy – The data attribute is accurate.

• Completeness – There are no null values in a data field.

• Uniqueness – There are no duplicate values in a data field.

• Timeliness – The data attribute represents information that is not out-of-date.

• Consistency – The data attribute is consistent with a business rule that may be based on that attribute itself, or on multiple attributes.

• Adherence to business rules – The data attribute or a combination of data attributes adheres to specified business rules.

30.12 Metadata Requirement

The awarded Vendor shall provide a glossary for all business terms used in this solution.

30.13 System Security Compliance Requirements

a. Session Security Lock

Vendor shall configure:

1. The system to initiate a session lock after a maximum of fifteen (15) minutes of inactivity.

2. The system session will remain locked until the user re-established identification and authentication procedures.

https://csrc.nist.gov/publications/detail/sp/800-145/final

b. Session Pattern-Hiding Displays Vendor shall configure system to conceal information previously visible on the display with a publicly viewable image or blank screen. When a session locks or times out, the system shall obfuscate or blank out the displayed screen and data at the time of the session lock as to not risk exposure after the session lock.

c. Session Termination Vendor shall configure system to terminate a user session automatically after defined conditions trigger events requiring session disconnect. Conditions or trigger events requiring automatic session termination include, but are not limited to:

1. Agency-defined periods of user inactivity,

2. Targeted responses to certain types of incidents, or

3. Time-of-day restrictions on information system use.

30.14 Software Development

Source code for software developed or modified by the vendor specifically for the Commonwealth shall become property of the Commonwealth. This is not meant to include minor modifications to the vendor software to configure the software for Commonwealth use. This is meant to include software written to add functionality to the vendor product specifically to meet the requirements of the Commonwealth where the Commonwealth bears the entire cost of creating that functionality.

30.15 License Agreements

Software provided by the vendor to the Commonwealth should contain a provision for perpetual licensing with all upgrade options. License agreements should also contain a provision for the Commonwealth to maintain a version of the software in escrow in the event the vendor is unable to continue business for financial or other business reasons.

Any escrow agreement shall be negotiated by all parties.

Any third-party software licenses and cloud resources necessary for the proposed solution may be procured via the Commonwealth’s existing contracts.

30.16 Software Version Requirements

All commercially supported and Commonwealth approved software components such as Operating system (OS), Database software, Application software, Web Server software, Middle Tier software, and other ancillary software must be kept current. In the event that a patch interferes with the solution, the vendor must present a plan for compliance to the Commonwealth outlining the constraints and an appropriate plan of action to bring the solution in to compliance to allow this patch to be applied in the shortest timeframe possible, not to exceed three months, unless otherwise negotiated with the Commonwealth.

The Vendors shall keep software in compliance with industry standards to support third party products such as Java, Microsoft Edge, Mozilla Firefox, etc. at latest supported version, release, and patch levels, when such dependencies exist. In the event that a third party dependency interferes with the solution, the vendor must present a plan for compliance to the Commonwealth outlining the constraints and an appropriate plan of action to bring the solution into compliance to allow this third party dependency to be updated in the shortest timeframe possible, not to exceed three months, unless otherwise negotiated with the Commonwealth.

30.17 No Surreptitious Code Warranty

The contractor represents and warrants that no copy of licensed Software provided to the Commonwealth contains or will contain any Self-Help Code or any Unauthorized Code as defined below. This warranty is referred to in this contract as the "No Surreptitious Code Warranty”.

As used in this contract, "Self-Help Code" means any back door, time bomb, drop-dead device, or other software routine designed to disable a computer program automatically with the passage of time or under the positive control of a person other than the licensee of the software. Self-Help Code does not include Software routines in a computer program, if any, designed to permit an owner of the computer program (or other person acting by authority of the owner) to obtain access to a licensee's computer system(s) (e.g. remote access) for purposes of maintenance or technical support.

As used in this contract, "Unauthorized Code" means any virus, Trojan horse, spyware, worm or other Software routines or components designed to permit unauthorized access to disable, erase, or otherwise harm software, equipment, or data; or to perform any other such actions. The term Unauthorized Code does not include Self-Help Code.

In addition, contractor will use up-to-date commercial virus detection software to detect and remove any viruses from any software prior to delivering it to the Commonwealth.

The vendor shall defend the Commonwealth against any claim, and indemnify the Commonwealth against any loss or expense arising out of any breach of the No Surreptitious Code Warranty.

30.18 Network Connection Requirements

A. Vendor shall work with COT to establish any network connections. If a secure site-to-site connection is required, the vendor shall employ a secure site-to-site connection procured by the Agency from COT.

B. Vendor shall notify COT of network bandwidth requirements and if caching is required for implementation vendor shall resolve caching requirements, in coordination with COT.

C. Vendor shall, at COT’s discretion, provide appropriate access to enable the

Commonwealth to perform additional security measures, such as decryption of the network traffic if required for inspection. If the proposed solution does not have the ability to meet this requirement, the vendor must provide an alternative such as audit reporting of this function.

D. Vendor shall provide notifications to the Commonwealth Service Desk for unplanned outages within 5 minutes.

E. Vendor shall notify COT Change Management, through the Commonwealth

Services Desk, a minimum of two (2) business days prior to any planned outage.

F. Vendor, in conjunction with the agency, shall provide a Business Impact

Assessment (BIA) to appropriately classify all data before production/go-live.

G. Vendor shall include a Web Application Firewall when application houses any data classified as sensitive or higher as defined in KITS standards.

H. Vendor shall provide Recovery Time Objective (RTO) and Recovery Point

Objective (RPO) services. Vendor shall provide those services to achieve those SLAs.

30.19 OS Requirements

a. Non-On Prem Solutions

1. No Commonwealth data shall be co-mingled with another entity, without the prior approval of the Commonwealth.

2. Vendor shall provide a solution to move data to the Commonwealth, if required by the Commonwealth.

a. At the end of the contract, the Vendor shall provide all agency data in a useable standard data format (such as asci, csv, etc.) that can be converted to a subsequent system. The Vendor shall cooperate to this end with the Agency and/or a Vendor of the agency’s choice, in a timely and efficient manner.

b. Vendor shall provide all agency data in a form that can be converted to any subsequent system of the agency’s choice. The vendor shall cooperate to this end with the vendor of the agency’s choice, in a timely and efficient manner.

c. Vendor shall provide address the destruction of Commonwealth data as defined in CIO-092 and provide a certification of the complete and permanent deletion the Commonwealth data.

B. Infrastructure As A Service

1. Vendor shall work with the Agency and COT to establish all administrative personnel engagements.

2. All virtual environments must run on VMC (VMWare Cloud) with OS version compliant with KITS, unless explicitly approved by COT.

3. VMC shall provide an enterprise class malicious code protective solution that is currently supported by the vendor and up to date

4. Vendor shall meet certification requirements for classification of data being stored.

5. Vendor shall, at COT’s request, provide appropriate access to enable the

Commonwealth to perform additional security measures in compliance with Commonwealth Enterprise Policies, Standards, and/or any Federal or State requirements.

6. Vendor shall provide an Exit Strategy, to move all data to the Commonwealth Data Center, if required by the Commonwealth.

a. At the end of the contract, the Vendor shall provide all agency data in a form that can be converted to any subsequent system of the agency’s choice. The Vendor shall cooperate to this end with the Vendor of the agency’s choice, in a timely and efficient manner.

b. Vendor shall provide certification of the complete and permanent deletion of Commonwealth data and backups from all vendor storage.

30.20 Project Governance

Vendor shall work with the Agency and appropriate COT offices, when needed, in the cases of data governance, security aspects, hosting, integration, etc., provided that such work does not expand the scope of the services as described in Section 50 absent a corresponding change order agreed to by the parties reflecting such expansion.

30.21 Monitoring Requirements for On Premise and Cloud (SaaS) Vendor shall work with the Agency and COT to establish a monitoring solution.

Vendors shall provide a view into their environment either by providing a COT approved comprehensive dashboard or allow COT to install their KITS compliant monitoring solution; to include but not limited to performance and availability.

30.22 Application and Service Requirements

A. Current Enterprise Applications and Services

1. COT provides a number of Enterprise Shared Services to State agencies.

Vendor shall use published IT Applications and Services provided on KITS for: Enterprise Service Bus, Enterprise Content Management, Data Warehousing, Data Analytics and Reporting, Business Intelligence, Web Services, GIS, unless explicitly approved by COT.

2. Vendor provided dedicated application components (i.e., Application Servers, Databases, etc.) shall comply with KITS or if the technology is not included in KITS, the technology must be accepted by the Commonwealth for inclusion in KITS or granted a written exception to

KITS according to COT Information Technology Standards Policy currently

CIO-051.

3. Vendor applications must describe in detail all available features and functionality accessible via APIs.

4. All business applications must support the ability to use modern authentication for authentication and authorization. Modern authentication technologies would include SAML 2.0, WSFED, OAuth, or OpenID Connect.

B. Vendor shall comply with Commonwealth of Kentucky fingerprint requirements for PII/FTI/HIPAA data systems hosted outside Central Data Center. The current standard is included in the IRS publication 1075 which can be found here: https://www.irs.gov/pub/irs-pdf/p1075.pdf

30.23 Project Management Requirements

The COT Division of Governance and Strategy (COT-DGS) is responsible for overseeing large and complex technology projects throughout the Commonwealth. The vendor shall adhere to Project Management standards and reporting requirements established by COT-DGS, which are posted at https://technology.ky.gov/services-and-support/Pages/About-the-Project- Management-Branch.aspx. These include, but are not limited to, having a documented project schedule, risk management, issue management and reporting project status to the CIO monthly in the format defined by COT-DGS. In addition to the project management standards required by COT-DGS, agency specific requirements may be defined in Section 50 of this RFP.

30.24 Applicable Security Control Framework Compliance

The vendor must have an awareness and understanding of the NIST Special Publication 800-53 Security Control Framework and employ safeguards that meet or exceed the moderate level controls as defined within the standard. The respondent must provide sufficient safeguards to provide reasonable protections around the Commonwealth’s data to ensure that the confidentiality, integrity, and availability is maintained at an appropriate level. These include but are not limited to:

• Access Control The vendor must employ policy and process that provide for stringent control to limit physical and logical access to systems that house Commonwealth data, on a need to know basis, provide clear separation of duties, and adheres to least privilege principles.

• Awareness and Training The vendor must provide the appropriate role specific training for staff to ensure that there is awareness and understanding of roles and responsibilities as they relate to the protections around the Commonwealth’s data.

• Audit and Accountability There must be sufficient auditing capability to ensure that actions are tracked and there is individual accountability for all actions taken by vendor staff.

https://www.irs.gov/pub/irs-pdf/p1075.pdf https://technology.ky.gov/services-and-support/Pages/About-the-Project-Management-Branch.aspx https://technology.ky.gov/services-and-support/Pages/About-the-Project-Management-Branch.aspx

• Configuration Management The vendor must work within established baselines that provide minimal functionality needed to ensure service delivery without exposing unnecessary risk. The vendor must also employ structured change control processes that provide a level of coordination with the client agreed upon in a Service Level Agreement (SLA).

• Contingency Planning The vendor must employ contingent planning policy and procedures that ensure service delivery based on agreed SLA levels while maintaining all Commonwealth data within the continental Unites States.

• Identification and Authorization The vendor must employ appropriate identity and access management policies and procedures to ensure that access is appropriately authorized and managed at a level to ensure that access is provisioned and de-provisioned in a timely and efficient manner.

• Incident Response The vendor must employ policy and procedures to ensure that an appropriate response to all identified security incidents are addressed in a timely manner and are reported to the appropriate parties in an agreed upon SLA timeframe.

The vendor must also ensure that all staff are sufficient trained to ensure that they can identify situations that are classified as security incidents.

• Maintenance The vendor must employ policy and procedures that ensure that all maintenance activities are conducted only by authorized maintenance staff leveraging only authorized maintenance tools.

• Media Protection The vendor must employ policy and procedure to ensure that sufficient protections exist to protect Commonwealth data on all storage media throughout the media lifecycle and maintain documentation from media creation through destruction.

• Physical and Environmental Controls The vendor must employ physical and environmental policies and procedures that ensure that the service and delivery infrastructure are located in a physically secure and environmentally protected environment to ensure the confidentiality, integrity, and availability of Commonwealth data.

• Personnel Security The vendor must employ policies and procedures to ensure that all staff that have access to systems that house, transmit, or process Commonwealth data have been appropriately vetted and have been through a background check at the time of hire and periodically thereafter.

• System and Communications Protections The vendor must employ physical and logical protection that protect system communications and communication media from unauthorized access and to ensure adequate physical protections from damage.

SECTION 40 – PROCUREMENT REQUIREMENTS

40.1 Procurement Requirements

Procurement requirements are listed under “Procurement Laws, Preference, Regulations and Policies” and “Response to Solicitation” located on the eProcurement Web page at https://finance.ky.gov/eProcurement/Pages/procurement-laws-regulations-and-policies.aspx and https://finance.ky.gov/eProcurement/Pages/doing-business-with-the-commonwealth.aspx respectively. The vendor must comply with all applicable statutes, regulations and policies related to this procurement.

40.2 Contract Components and Order of Precedence

The Commonwealth’s acceptance of the contractor’s offer in response to the solicitation, indicated by the issuance of a contract award by the Office of Procurement Services, shall create a valid contract between the Parties consisting of the following:

Procurement Statutes, Regulations and Policies

1. Any written Agreement between the Parties;

2. Any Addenda to the Solicitation;

3. The Solicitation and all attachments

4. Any Best and Final Offer;

5. Any clarifications concerning the Contractor’s proposal in response to the

Solicitation;

6. The Contractor’s proposal in response to the Solicitation.

In the event of any conflict between or among the provisions contained in the contract, the order of precedence shall be as enumerated above.

40.3 Final Agreement

The contract represents the entire agreement between the parties with respect to the subject matter hereof. Prior negotiations, representations, or agreements, either written or oral, between the parties hereto relating to the subject matter hereof shall be of no effect upon this contract.

40.4 Contract Provisions

If any provision of this contract (including items incorporated by reference) is declared or found to be illegal, unenforceable, or void, then both the Commonwealth and the contractor shall be relieved of all obligations arising under such provision. If the remainder of this contract is capable of performance, it shall not be affected by such declaration or finding and shall be fully performed.

40.5 Type of Contract

The contract proposed in response to this solicitation shall be on the basis of a firm fixed unit price for the elements listed in this solicitation. This solicitation is specifically not intended to solicit proposals for contracts on the basis of cost-plus, open-ended rate schedule, nor any non-fixed price arrangement.

https://finance.ky.gov/eProcurement/Pages/procurement-laws-regulations-and-policies.aspx https://finance.ky.gov/eProcurement/Pages/procurement-laws-regulations-and-policies.aspx

40.6 Contract Usage

As a result of this RFP, the contractual agreement with the selected vendor will in no way obligate the Commonwealth of Kentucky to purchase any services or equipment under this contract. The Commonwealth agrees, in entering into any contract, to purchase only such services in such quantities as necessary to meet the actual requirements as determined by the Commonwealth.

40.7 Addition or Deletion of Items or Services

The Office of Procurement Services reserves the right to add new and similar items, by issuing a contract modification, to this contract with the consent of the vendor. Until such time as the vendor receives a modification, the vendor shall not accept delivery orders from any agency referencing such items or services.

40.8 Changes and Modifications to the Contract

Pursuant to KRS 45A.210 (1) and 200 KAR 5:311, no modification or change of any provision in the contract shall be made, or construed to have been made, unless such modification is mutually agreed to in writing by the contractor and the Commonwealth, and incorporated as a written amendment to the contract and processed through the Office of Procurement Services and approved by the Finance and Administration Cabinet prior to the effective date of such modification or change pursuant to KRS 45A.210(1) and 200 KAR 5:311.

Memorandum of understanding, written clarification, and/or correspondence shall not be construed as amendments to the contract.

If the contractor finds at any time that existing conditions made modification of the contract necessary, it shall promptly report such matters to the Commonwealth Buyer for consideration and decision.

40.9 Changes in Scope

The Commonwealth may, at any time by written order, make changes within the general scope of the contract. No changes in scope are to be conducted except at the approval of the Commonwealth.

40.10 Contract Conformance

If the Commonwealth Buyer determines that deliverables due under the contract are not in conformance with the terms and conditions of the contract and the mutually agreed-upon project plan, the Buyer may request the contractor to deliver assurances in the form of additional contractor resources and to demonstrate that other major schedules will not be affected. The Commonwealth shall determine the quantity and quality of such additional resources and failure to comply may constitute default by the contractor.

40.11 Assignment

The contract shall not be assigned in whole or in part without the prior written consent of the Commonwealth Buyer.

40.12 Payment

The Commonwealth will make payment within thirty (30) working days of receipt of contractor's invoice or of acceptance of goods and/or services in accordance with KRS 45.453 and KRS 45.454.

Payments are predicated upon successful completion and acceptance of the described work, services, supplies, or commodities, and delivery of the required documentation. Invoices for payment shall be submitted to the agency contact person or his representative.

40.13 Contractor Cooperation in Related Efforts

The Commonwealth of Kentucky may undertake or award other contracts for additional or related work, services, supplies, or commodities, and the contractor shall fully cooperate with such other contractors and Commonwealth employees.

The contractor shall not commit or permit any act that will interfere with the performance of work by any other contractor or by Commonwealth employees.

40.14 Contractor Affiliation

"Affiliate" shall mean a branch, division or subsidiary that is effectively controlled by another party. If any affiliate of the contractor shall take any action that, if done by the contractor, would constitute a breach of this agreement, the same shall be deemed a breach by such party with like legal effect.

40.15 Commonwealth Property

The contractor shall be responsible for the proper custody and care of any Commonwealth-owned property furnished for contractor's use in connections with the performance of this contract. The contractor shall reimburse the Commonwealth for its loss or damage, normal wear and tear excepted.

40.16 Confidentiality of Contract Terms

The contractor and the Commonwealth agree that all information communicated between them before the effective date of the contract shall be received in strict confidence and shall not be necessarily disclosed by the receiving party, its agents, or employees without prior written consent of the other party. Such material will be kept confidential subject to Commonwealth and Federal public information disclosure laws.

Upon signing of the contract by all parties, terms of the contract become available to the public, pursuant to the provisions of the Kentucky Revised Statutes.

The contractor shall have an appropriate agreement with its subcontractors extending these confidentiality requirements to all subcontractors’ employees.

40.17 Confidential Information

The contractor shall comply with the provisions of the Privacy Act of 1974 and instruct its employees to use the same degree of care as it uses with its own data to keep confidential information concerning client data, the business of the Commonwealth, its financial affairs, its relations with its citizens and its employees, as well as any other information which may be specifically classified as confidential by the Commonwealth in writing to the contractor. All Federal and State Regulations and Statutes related to confidentiality shall be applicable to the contractor. The contractor shall have an appropriate agreement with its employees, and any subcontractor employees, to that effect, provided however, that the foregoing will not apply to:

A. Information which the Commonwealth has released in writing from being maintained in confidence;

B. Information which at the time of disclosure is in the public domain by having been printed an published and available to the public in libraries or other public places where such data is usually collected;

or

C. Information, which, after disclosure, becomes part of the public domain as defined above, thorough no act of the contractor.

40.18 Advertising Award

The contractor shall not refer to the award of contract in commercial advertising in such a manner as to state or imply that the firm or its services are endorsed or preferred by the Commonwealth of Kentucky without the expressed written consent of the agency technical contact person. (see Section 50.4)

40.19 Patent or Copyright Infringement

The contractor shall report to the Commonwealth promptly and in reasonable written detail, each notice of claim of patent or copyright infringement based on the performance of this contract of which the contractor has knowledge.

The Commonwealth agrees to notify the contractor promptly, in writing, of any such claim, suit or proceeding, and at the contractor's expense give the contractor proper and full information needed to settle and/or defend any such claim, suit or proceeding.

If, in the contractor's opinion, the equipment, materials, or information mentioned in the paragraphs above is likely to or does become the subject of a claim or infringement of a United States patent or copyright, then without diminishing the contractor's obligation to satisfy any final award, the contractor may, with the Commonwealth's written consent, substitute other equally suitable equipment, materials, and information, or at the contractor's options and expense, obtain the right for the Commonwealth to continue the use of such equipment, materials, and information.

The Commonwealth agrees that the contractor has the right to defend, or at its option, to settle and the contractor agrees to defend at its own expense, or at its option to settle, any claim, suit or proceeding brought against the Commonwealth on the issue of infringement of any United States patent or copyright or any product, or any part thereof, supplied by the contractor to the Commonwealth under this agreement.