RFP 758 2700000040

ATTACHMENT A

Commonwealth of Kentucky Request for Proposal (RFP)

For

Fleet Car Wash Card Services Program

Release Date: August 12, 2026

CLOSING DATE AND TIME: September 14, 2026 at 3:30pm ET

Issued by The Finance and Administration Cabinet

Commonwealth Buyer:

Holly A. McDonald Statewide Procurement Consultant

COMMONWEALTH OF KENTUCKY

FINANCE AND ADMINISTRATION CABINET

Office of Procurement Services 200 Mero Street, 5th Floor

Frankfort, KY 40622

(502) 564-6523

Holly.McDonald@ky.gov

TABLE OF CONTENTS

Proposal Submission Checklist Section 1 – Summary Section 2 – Introduction Section 3 – Scope of Work Section 4 – Commonwealth Office of Technology Requirements Section 5 – Procurement Requirements and Instructions Section 6 – Proposal Submission Section 7 – Proposal Evaluation Section 8 – Negotiations Section 9 – Contract Requirements Section 10 – Standard Terms and Conditions Section 11 – Attachments mailto:Holly.McDonald@ky.gov

PROPOSAL SUBMISSION CHECKLIST

The Vendor MUST include the following with the proposal submission.

If the items highlighted below are not submitted with the proposal submission, the Commonwealth MUST deem the proposal non-responsive and SHALL NOT consider for award.

All other items MUST be submitted prior to award.

*PROPOSED TECHNICAL SOLUTION

*PROPOSED COST SOLUTION

TRANSMITTAL LETTER [see Section 6.7(A)]

REVENUE FORM 10A100 KENTUCKY TAX REGISTRATION APPLICATION, IF

APPLICABLE [see Section 6.7 (C)]

CERTIFICATE OF AUTHORITY- REGISTRATION WITH SECRETARY OF STATE BY

A FOREIGN ENTITY, IF APPLICABLE [see Section 6.7 (D)]

AI DISCLOSURE [see Section 10.31]

CERTIFICATE OF INSURANCE [see Section 10.32]

REQUIRED ANNUAL AFFIDAVIT AND OTHER AFFIDAVIT(S) [see Attachment C] https://finance.ky.gov/office-of-the-secretary/FinanceForms/Annual%20Required%20Affidavit%20for%20Bidders%20Offer ors%20and%20Contractors.pdf

MANDATORY REQUIREMENTS CHECKLIST [see Attachment E] https://finance.ky.gov/office-of-the-secretary/FinanceForms/Annual%20Required%20Affidavit%20for%20Bidders%20Offerors%20and%20Contractors.pdf https://finance.ky.gov/office-of-the-secretary/FinanceForms/Annual%20Required%20Affidavit%20for%20Bidders%20Offerors%20and%20Contractors.pdf https://finance.ky.gov/office-of-the-secretary/FinanceForms/Annual%20Required%20Affidavit%20for%20Bidders%20Offerors%20and%20Contractors.pdf

SECTION 1 - RFP SUMMARY

1.1 Estimated Schedule of RFP Activities

The following table presents the anticipated schedule for major activities associated with this RFP’s distribution, proposal submission, proposal evaluation process, and contract award. The Commonwealth reserves the right at its sole discretion to change the Schedule of Activities, including the associated dates and times.

Anticipated Schedule of Activities

Release of RFP

08.12.2026

Vendors’ Written Questions due by 10:00 AM ET

(SUBMIT QUESTIONS ON ATTACHMENT D-VENDORS’ QUESTION

FORM)

08.19.2026

Commonwealth’s Response to Vendors’ Written Questions

08.28.2026

Proposals due by 3:30 PM ET

09.14.2026

1.2 Issuing Office

The Commonwealth of Kentucky, Finance and Administration Cabinet, Office of Procurement Services, is issuing this RFP on behalf of the Kentucky Office of Fleet Management (Fleet). The Finance and Administration Cabinet is the only office authorized to change, modify, amend, alter, or clarify the specifications, terms and conditions of this RFP.

A contract, based on this RFP, may or may not be awarded. Any contract award from this RFP is invalid until properly approved and executed by the Finance and Administration Cabinet.

1.3 Agencies to Be Served

The Contract shall be for use by the KENTUCKY OFFICE OF FLEET MANAGEMENT. No shipments shall be made except upon receipt by vendor of an official delivery order from the using agency.

Extending the Contract Use to Other Agencies The Office of Procurement Services reserves the right, with the consent of the Vendor, to offer the Master Agreement resulting from this Solicitation to other state agencies requiring the product(s) or service(s).

SECTION 2 - INTRODUCTION –

2.1 Purpose

The purpose of this Request for Proposal (RFP) is to solicit proposals for competitive negotiations pursuant to 200 KAR 5:307. Fleet Car Wash Card Services Program for the Kentucky Office of Fleet Management (Fleet).

2.2 Background

The Kentucky Office of Fleet Management is located at 369 Warsaw Street, Frankfort, Kentucky 40601. Fleet provides technical and administrative services for state vehicle fleet administration as well as procurement support. These services include, but are not limited to, management of the state motor pool reservations system and the distribution / assignment(s) of vehicles, comprehensive vehicle maintenance and repair services, fueling options, accident repair, automated car wash options, vehicle replacement / procurement, centralized mileage reporting, and roadside assistance.

Fleet Management provides Fleet vehicles for use to Commonwealth state agencies, local government, political subdivisions, schools, and universities.

SECTION 3 – SCOPE OF WORK

PROPOSALS THAT DO NOT MEET MANDATORY REQUIREMENTS WILL BE

DEEMED NON-RESPONSIVE AND WILL NOT BE CONSIDERED. REFER TO

ATTACHMENT E – MANDATORY REQUIREMENTS CHECKLIST.

Mandatory Requirement means a condition set out in the specifications or statement of work that must be met without exception.”

3.1 Scope of Work/Technical Requirements

A. Overview of Fleet Car Wash Card Services Program

The Kentucky Office of Fleet Management (Fleet) is seeking to establish a viable, accountable, multi-year Fleet Car Wash Card Services Program for the Commonwealth of Kentucky’s government fleet vehicles, to include but not limited to, purchasing, accounting, and billing transactions services; as well as software maintenance and support.

The Vendor must establish and utilize a system for the efficient purchase and payment of car wash services for Commonwealth fleet vehicles through intrastate and interstate service providers. The Vendor must provide software, training, installation, and support to the Commonwealth for the Vendor’s web-based platform and mobile application.

The Vendor must be capable of issuing car wash credit cards to provide car wash services for individual vehicles. Fleet car wash services shall include pre-negotiated pricing for both in-network and out-of-network car wash locations.

Vendor’s cards shall be universally accepted wherever major credit cards are and accepted at the widest possible range of service locations within the Commonwealth of Kentucky. The Vendor’s card must support car wash purchases at any car wash location, including locations outside the Vendor’s network.

The Office of Fleet Management must be able to dispute transactions / fraud charges with the Vendor.

Account Holders consists of Commonwealth state agencies, local government, political subdivisions, schools, and universities. Fleet vehicles consist of passenger cars, passenger & cargo vans, SUVs, and light, medium & heavy-duty trucks.

The Kentucky Office of Fleet Management Administrators shall have full on-line access to Vendor’s web-based platform to perform tasks and address inquiries directly. At a minimum, areas of access will include billing, history, card usage, payment history, and other designated items as deemed applicable.

The Vendor’s system shall provide real-time automated on-line information through a web-based platform with login credentials. The Vendor’s web portal shall provide detailed transaction records for easy reconciliation and provide real-time reporting and analytics.

In addition to the web-based platform, the Vendor should provide a mobile software application solution that provides Account Holders with available car wash locations with directions to those locations. The Vendor programs should integrate with The Office of Fleet Management Database System. The Vendor’s application should allow Application Programming Interface (API) utilization to facilitate integration, to include integration minimally with fleet management system software to facilitate workorder creation, billing, and telematics software (such as Geotab).

Vendor should have an electronic list of all car wash sites available within Kentucky on their web-based platform that includes the following information:

State, County, City, car wash location name, street address, if it’s in network or out of network, services - such as express/automatic or self-service access, and availability (i.e. twenty-four (24)-hour and/or seven (7) days a week, etc.).

B. Fleet Car Wash Cards and Services

1. Fleet Car Wash Cards

i. Vendor shall issue and activate one (1) Card per Vehicle in the

Commonwealth’s Fleet.

ii. Vendor shall provide a minimum of four-thousand five-hundred (4,500) fleet car wash cards initially for the Commonwealth’s Fleet and deliver them all to the Office of Fleet Management within one (1) calendar month after award of the Contract.

iii. Assigned vehicle license plate number shall be printed on each card

iv. The Commonwealth’s Card Administrator(s) shall have access and capabilities of activating and deactivating car wash cards in Vendor’s system.

v. All cards shall default to car wash purchases only.

vi. Vendor’s car wash cards shall be universally accepted wherever major credit cards are and accepted at the widest range of service locations possible within the Commonwealth of Kentucky.

vii. The Vendor’s car wash cards must support car wash purchases at any car wash location, including locations outside the Vendor’s network.

viii. Cards shall be associated with department numbers when ordered in bulk for easier disbursement.

ix. Vendor will replace and deliver replacement cards that are reported lost or stolen in seven (7) business days.

x. Fleet car wash cards should be made of standard grade plastic and standard magnetic strip/embedded EMV chip technology. The cards should be capable of interfacing with standard card reader and/or smart card systems.

xi. System should have the ability to use one PIN with multiple cards or one PIN per card.

xii. A protective sleeve should be included with each car wash card issued to prevent accidental usage for goods and/or services that are not car wash services allowed under the awarded contract.

2. Fleet Car Wash Card Services Vendor shall provide the following services:

i. Vendor’s Implementation Plan and, once approved by the Commonwealth, implementation of Vendor’s system(s)

ii. System training.

iii. Standardized real-time electronic reporting (or paper if requested), exportable to multiple file formats including .pdf, .xlsx, .csv, and .txt.

iv. Reporting data through direct detail and exception reporting.

v. Implement a vehicle identification database, per information provided by the

Office of Fleet Management.

vi. Customer service.

vii. Consolidated invoicing.

viii. Direct settlement / payment with all retail sites, providers, or marketers.

ix. Account support and management services.

x. Ticket tracking and support of possible fraud inquiries / investigations.

xi. Billing support and resolution.

xii. Rebates

xiii. Commonwealth global account data management for all state agencies.

C. Car Wash Card Security

The Vendor shall have established security for services and card control mechanisms to ensure fraud prevention, and the ability to only use the card to purchase car wash services with the use of merchant coding. If card is lost or stolen, the Office of Fleet Management (or other utilizing agencies) shall have the ability to terminate the card immediately and issue a new card to be delivered within seven (7) business days.

Vendor’s security procedures/measures should preserve data integrity and include a process for identifying and correcting missing or invalid data elements for electronic transaction data.

Vendor should have controls and measures in place to prevent, detect, and track fraudulent charges from outside sources, including a process for notifying the Commonwealth of such charges and the limits of liability for fraudulent use of the Car Wash Card issued under the contract. Vendor should also provide the amount of insurance they carry to cover fraudulent charges, both per event and total per card. The Commonwealth shall have the ability to dispute or question charge(s) on car wash cards.

Personal Identification Number (PIN) The Vendor shall assign a unique Personal Identification Number (PIN) of no less than four (4) digits and shall not be the plate number. The PIN must allow for unique identification of each vehicle or individual. Total management of PIN shall be by the Commonwealth. The PIN shall provide security for the use of the car wash card. The Vendor’s system must allow lockout of any individual card or PIN number by a Fleet System Administrator.

Vendor’s proposed Card Security Plan should include the following:

1. Process for deactivating a card due to loss or theft.

2. Methods used to prevent & address unauthorized card use.

3. Prevention of a data breach in card security (hacking, cyber-attacks, etc.)

4. Card user information verification and authentication

5. Process for preventing, tracking, and resolving fraudulent charges.

D. Training

The Vendor shall provide training for the Office of Fleet Management Employees, as well as any state agency, local government, political subdivision, school, or university participating in the car wash card services program, on how to use the web-based platform and mobile applications, at no additional cost. The Office of Fleet Management shall receive training once vendor completed implementation of system but prior to Go-Live.

The Vendor should provide available training materials to the Commonwealth users. Any ongoing training for upgrades or updates will be on an as needed basis. Training for any state agency, local government, political subdivision, school, or university is on an as needed basis once enrolled in the car wash card services program.

E. Coordination with Fleet’s Administrators

The Vendor should coordinate the activities of the participants by providing a central point for authorization, data collection and storage, and billing to the Commonwealth’s Fleet administrator(s). The Vendor should provide a single point of contact for handling inquiries, disputed transactions, and other interactions with representatives from each of the different fleet locations maintained by the Kentucky Office of Fleet Management.

Customer Service Representative (CSR) The Vendor should assign an authorized & trained Customer Service Representative (CSR) to address and correct any issues related to the implementation for the resulting Master Agreement from this RFP. The Vendor should notify the Kentucky Office of Fleet Management Administrator(s), the Commonwealth Buyer, and political subdivision contact(s) within three (3) business days of assigning a new CSR.

The Vendor should provide a dedicated customer support team/person within the eastern time zone to assist with inquiries and support.

F. Implementation Plan

Vendor’s Implementation Plan for the Fleet car wash card services program should:

1. Include the process of implementation and projected dates for phase-in and completion.

2. Outline the process and necessary information required for creating a new driver/vehicle/PIN assignment.

3. Outline the training program(s) details proposed with Vendor’s solution.

This should include, but not limited to, the initial implementation training(s) with location(s), frequency of training(s), length of training time (4 hours, 8 hours, etc.), and any ongoing or as-needed training for upgrades and updates.

The Vendor is responsible for ensuring the comprehensive and practical content of their Implementation Plan submitted with their proposal. The Vendor should not expect the Commonwealth of Kentucky to provide extensive drafting, revisions, or negotiation prior to approval.

G. Monthly Invoice(s) and Report Package

The Vendor will provide monthly invoices and supporting documentation per the requirements of this RFP. The invoice and report package documentation shall provide standard commercial credit card level III billing data to show detailed performance and cost information on vehicles by agency or other governmental entity.

The Commonwealth’s tax exemption will be applied and reflected on all invoices. At a minimum, The Vendor’s invoice must include, but not limited to, the following:

1. Item/Service Description

2. Vehicle Plate Number

3. Quantity of Service

4. Cost of Service

5. Date of Service

6. Location of Service

H. Payments for Services

Payments from the Commonwealth for card services performed under the awarded contract will be paid to the Vendor. The awarded Vendor is solely responsible for all communication and rendering payment to their retail sites or other participants. The Office of Fleet Management will direct all payment inquiries from sub-contractors to the Vendor.

The Vendor will collect transactions from retail sites/participants (car wash locations) for consolidated billing. The Vendor will settle billings / payments with car wash locations. The manner of settlement is solely between the Vendor and the car wash location participants

I. Web-Based Reporting

The Vendor shall provide comprehensive reporting capabilities through a web-based platform that supports the Kentucky Office of Fleet Management’s continuous monitoring, reconciliation, and analysis of fleet activity. Reporting shall be available through modern electronic formats and delivery methods approved by the Office of Fleet Management administrator(s), which may include secure digital file transfer, API-based data exchange, web-based dashboards, EDI transmission, encrypted email, and downloadable PDF or Excel files.

All reports should include the following data elements:

1. Transaction details

2. Types of services purchased

3. Quantities

4. Unit and total costs

5. Date of service (MM/DD/YYYY)

6. Vehicle plate number

7. Location information

8. Any other data points requested for agency-level or enterprise-level analysis

Reporting tools should support real-time or near real-time updates, customizable queries, and export functionality to promote transparency and efficient reconciliation.

J. Batch Reporting

The Vendor must submit electronic billing data in fixed record American Standard Code for Information Interchange (ASCII) format for each individual’s service(s) purchased with each statement.

K. Interim Reports

The Vendor shall provide interim reports and additional billing information in, between the monthly statements, including cumulative data for Fleet billings and costs, upon request by the Commonwealth. These requests should be made available to the Kentucky Office of Fleet Management Administrator(s), Commonwealth Buyer, or political subdivision contract(s) within five (5) business days of written request.

L. Electronic Online Access

The Vendor shall provide online access for the Kentucky Office of Fleet Management administrator(s) and agency card administrator(s) to use in accessing and/or updating accounts, vehicles and driver information. Fleet Management Administrators must have access to extract key information from the car wash card database into a flat file of agreed upon format for utilization by Administrators for ad hoc purposes including electronic testing and auditing of billing statement-supporting documentation. Access will also include internet-based card management procedures, including but not limited to:

1. Ability to order replacement car wash cards

2. Ability to assign PINs

3. Access to view and/or update user accounts

4. Control car wash options and card usage

5. Real-time viewing of current and past spending

6. Real-time reporting on current and past spending

7. Set spending limits per vehicle, per transaction and per month – ability to change/reset at any time

8. Set occurrence limits per vehicle – ability to change/reset at any time

9. Manage drivers, vehicles, and cards

10. Set up users and assign administrators

M. Fleet Car Wash Card Acceptance and Authorization

The Vendor must provide electronic authorization of a transaction through a Point of Sale (POS) device, which is linked directly on-line to the Primary Vendor. The transaction should provide authorization through a toll-free number or direct link to the Vendor at the time of sale. Each on-site purchase authorization must be conducted through an on-line connection to a database maintained by the Vendor and NOT a batch load authorization. Additionally, the Vendor’s authorization at the point of sale shall track lost and stolen cards with an immediate usage cut-off. The Kentucky Office of Fleet Management shall hold no responsibility for sales made by cards that have been reported lost, stolen, or revoked.

N. Tax Exemptions

The Vendor shall be responsible for handling and/or addressing ALL tax exemptions (including local) that are allowed by law. All billing documents and statements sent to the Kentucky Office of Fleet Management and agencies must be the net of all taxes. The Kentucky Office of Fleet Management is fully tax-exempt, and the Vendor is responsible for all transactions of collections, reimbursement, and details regarding taxes.

O. Remittance

The Vendor should accept remittance processing from an Electronic Funds Transfer (EFT), Automated Clearing House (ACH) or EDI 820 link, as well as manually, if necessary. The Vendor must be able to accept single or multiple payments per account and maintain detailed payment history information for each area.

P. Toll-Free Telephone Number Access

The Vendor should provide a toll-free telephone number for use by the Commonwealth on all inquiries concerning the car wash services processing and payment system.

3.2 Value Added Services

Value-added services may be added to the contract with prior approval by the Commonwealth Office of Technology (COT) and the Office of Procurement Services (OPS), Buyer of Record. Upon approval, a formal modification will be made to add the service(s). No work shall begin until a contract modification is completed and notice provided by the OPS Buyer that work may begin.

SECTION 4 – COMMONWEALTH OFFICE OF TECHNOLOGY (COT)

REQUIREMENTS

4.1 Hosting

The Commonwealth is seeking a vendor who can provide a solution per the RFP requirements. The Vendor can use servers stood up by COT to house the solution or the vendor may propose a cloud-hosted solution. If the vendor is proposing a cloud solution, the Commonwealth prefers the proposed cloud solution to be hosted on an established Commonwealth Office of Technology (COT) managed cloud tenant. If a COT managed cloud tenant is not proposed, the vendor shall propose a commercial Federal Risk and Authorization Management Program (FedRAMP) - certified or HITRUST Cloud platforms. The proposed solution must accommodate COT oversight that includes an isolated tenant, cloud network access (peering connection) and monitoring solutions.

The Commonwealth reserves the right to host any proposed solution, at any time, if deemed in the best interest of the Commonwealth.

If vendor is using any type of Artificial Intelligence (AI) please indicate this in the RFP response.

Vendor shall comply with Section 10.31 regarding Artificial Intelligence

4.2 Commonwealth Information Technology Policies and Standards

A. The Vendor and any subcontractors shall be required to adhere to applicable Commonwealth policies and standards.

B. The Commonwealth posts changes to COT Standards and Policies on its Commonwealth Office of Technology - Home - Commonwealth Office of Technology (Kentucky) website. Vendors and subcontractors shall ensure their solution(s) shall work in concert with all posted changes. Vendors or subcontractors that cannot comply with changes must, within thirty (30) days of the posted change, request written relief with the justification for such relief.

The Commonwealth may: 1) deny the request, 2) approve an exception to the policy/standard, or 3) consider scope changes to the contract to accommodate required changes. Vendors or subcontractors that do not provide the response within the thirty (30) day period shall be required to comply within ninety (90) days of the change.

4.3 Compliance with Kentucky Information Technology Standards (KITS)

The Kentucky Information Technology Standards (KITS) reflect a set of principles for information, technology, applications, and organization. These standards provide guidelines, policies, directional statements and sets of standards for information technology. It defines, for the Commonwealth, functional and information needs so that technology choices can be made based on business objectives and service delivery. The vendor shall stay knowledgeable and shall provide a solution that works in concert with these standards for all related work resulting from this RFP.

https://technology.ky.gov/about-the-agency/Pages/kits.aspx

4.4 Compliance with Industry Accepted Reporting Standards Based on Trust

Service Principles and Criteria The Vendor must employ comprehensive risk and threat management controls based on defined industry standards for service organizations such as ISO AICPA TSP section 100, Trust Services Principles and Criteria. The Vendor must annually assert compliance and engage a third-party certification registrar to examine such assertions and controls to provide a Report, such as ISO 9000, ISO 14001, AT101 SOC 2 type 2, on Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, and Privacy, which contains an opinion on whether the operating controls effectively support the assertions. All such reports, including publicly available reports (i.e. AT 101 SOC 3) shall be made available to the Commonwealth for review.

4.5 System Vulnerability and Security Assessments

The Commonwealth reserves the right to conduct, in collaboration with the vendor, non-invasive vulnerability and security assessments of the software and infrastructure used to provide services prior to implementation and periodically thereafter. Upon completion of these assessments, the Commonwealth will https://technology.ky.gov/Pages/index.aspx https://technology.ky.gov/Pages/index.aspx https://technology.ky.gov/about-the-agency/Pages/kits.aspx communicate any findings to the vendor for action. Any cost relating to the alleviation of the findings will be the responsibility of the Vendor. Mitigations will be subject to re-evaluation after completion. In cases where direct mitigation cannot be achieved, the Vendor shall communicate this and work closely with the Commonwealth to identify acceptable compensating controls that will reduce risk to an acceptable and agreed upon level. An accredited third-party source may be selected by the vendor to address findings, provided they will acknowledge all cost and provide valid documentation of mitigation strategies in an agreed upon timeframe.

4.6 Privacy Assessments

The Commonwealth reserves the right to conduct privacy assessments of the collection, use, maintenance and sharing of Commonwealth data by any vendor services, software, and infrastructure used to provide services prior to implementation and periodically thereafter. Upon completion of this assessment, the Commonwealth will communicate any findings to the vendor for action. Any cost relating to the alleviation of the findings will be the responsibility of the vendor.

Mitigations will be subject to re-evaluation after completion. In cases where direct mitigation cannot be achieved, the vendor shall communicate this and work closely with the Commonwealth to identify acceptable compensating controls or privacy practices that will reduce risk to an acceptable and agreed upon level. An accredited third-party source may be selected by the Vendor to address findings, provided they will acknowledge all cost and provide valid documentation of mitigation strategies in an agreed upon timeframe.

4.7 Privacy, Confidentiality and Ownership of Information

The Commonwealth is the designated owner of all Commonwealth data and shall approve all access to that data. The Vendor shall not have ownership of Commonwealth data at any time. The Vendor shall not profit from or share Commonwealth data. The Vendor shall be in compliance with privacy policies established by governmental agencies or by state or federal law. Privacy notice statements may be developed and amended from time to time by the Commonwealth and will be appropriately displayed on the Commonwealth portal (Ky.gov). The Vendor should provide sufficient security to protect the Commonwealth and COT data in network transit, storage, and cache. All Commonwealth data, including backups and archives, must be maintained at all times within the contiguous United States. All Commonwealth data, classified as sensitive or higher, as defined in Enterprise Standards, must be encrypted in-transit from vendor’s network and at rest while stored on vendor’s laptops or other portable media devices.

4.8 Data Quality

The Vendor shall provide proposed levels of data quality per the following dimensions.

Data Quality is the degree to which data is valid, accurate, complete, unique, timely, consistent with all requirements and business rules, and relevant for a given use. The Vendor shall provide data quality definitions and metrics for any data elements. Data has to be of the appropriate quality to address the needs of the Commonwealth of Kentucky. The following dimensions can be used to assess data quality:

• Validity – The data values are in an acceptable format.

• Accuracy – The data attribute is accurate.

• Completeness – There are no null values in a data field.

• Uniqueness – There are no duplicate values in a data field.

• Timeliness – The data attribute represents information that is not out-of-date.

• Consistency – The data attribute is consistent with a business rule that may be based on that attribute itself, or on multiple attributes.

• Adherence to business rules – The data attribute or a combination of data attributes adheres to specified business rules.

4.9 License Agreements

Any proposed software agreements, i.e. license agreement, subscription agreement, end-user license agreement, etc. shall include the following language, or similar, and must be submitted to the Commonwealth Office of Technology (COT) for review and approval prior to the award of the contract:

“Governing Law shall be the Commonwealth of Kentucky, Franklin County. All terms of the Vendor/subvendor agreement/EULA shall be read as applicable only to the extent permitted by Kentucky law and no term in violation of the Kentucky law, inclusive of Kentucky Procurement Law, shall be given effect.”

Any third-party software licenses and cloud resources necessary for the proposed solution may be procured via the Commonwealth’s existing contracts.

4.10 Software Version Requirements

All commercially supported and Commonwealth approved software components such as Operating system (OS), Database software, Application software, Web Server software, Middle Tier software, and other ancillary software must be kept current. In the event that a patch interferes with the solution, the vendor must present a plan for compliance to the Commonwealth outlining the constraints and an appropriate plan of action to bring the solution in to compliance to allow this patch to be applied in the shortest timeframe possible, not to exceed three (3) months, unless otherwise negotiated with the Commonwealth.

4.11 No Surreptitious Code Warranty

The Vendor represents and warrants that no copy of licensed software provided to the Commonwealth contains or will contain any Self-Help Code or any Unauthorized Code as defined below. This warranty is referred to in this contract as the "No Surreptitious Code Warranty”.

As used in this contract, "Self-Help Code" means any back door, time bomb, drop-dead device, or other software routine designed to disable a computer program automatically with the passage of time or under the positive control of a person other than the licensee of the software. Self-Help Code does not include Software routines in a computer program, if any, designed to permit an owner of the computer program (or other person acting by authority of the owner) to obtain access to a licensee's computer system(s) (e.g. remote access) for purposes of maintenance or technical support.

As used in this contract, "Unauthorized Code" means any malware designed to permit unauthorized access to disable, erase, or otherwise harm software, equipment, or data; or to perform any other such actions. The term Unauthorized Code does not include Self-Help Code.

In addition, Vendor will use up-to-date commercial virus detection software to detect and remove any viruses from any software prior to delivering it to the Commonwealth.

The Vendor shall defend the Commonwealth against any claim and indemnify the Commonwealth against any loss or expense arising out of any breach of the No Surreptitious Code Warranty.

4.12 Network Connection Requirements

A. Vendor shall work with COT to establish any network connections. If a secure site-to-site connection is required, the vendor shall employ a secure site-to-site connection procured by the Agency from COT.

B. Vendor shall, at COT’s discretion, provide appropriate access to enable the Commonwealth to perform additional security measures, such as decryption of the network traffic if required for inspection. If the proposed solution does not have the ability to meet this requirement, the vendor must provide an alternative such as audit reporting of this function.

C. Vendor should provide notifications to the Commonwealth Service Desk for unplanned outages within fifteen (15) minutes.

D. Vendor shall notify COT Change Management, through the Commonwealth

Services Desk, a minimum of two (2) business days prior to any planned outage.

E. Vendor, in conjunction with the agency, shall provide a Business Impact

Assessment (BIA) to appropriately classify all data before production/go-live.

F. Vendor shall include a Web Application Firewall when application houses any data classified as sensitive or higher as defined in KITS standards.

G. Vendor shall provide Recovery Time Objective (RTO) and Recovery Point

Objective (RPO) services. Vendor shall provide those services to achieve those SLAs.

4.13 OS Requirements

A. Non-On Prem Solutions

1. No Commonwealth data shall be co-mingled with another entity, without the prior approval of the Commonwealth.

2. Vendor shall provide a solution to move data to the Commonwealth, if required by the Commonwealth.

a. At the end of the contract, the Vendor shall provide all agency data in a useable standard data format (such as asci, csv, etc.) that can be converted to a subsequent system. The Vendor shall cooperate to this end with the agency and/or a vendor of the agency’s choice, in a timely and efficient manner.

b. Vendor shall address the destruction of Commonwealth data as defined in CIO-092 and provide a certification of the complete and permanent deletion the Commonwealth data.

B. Infrastructure as a Service

1. Vendor shall work with the agency and COT to establish all administrative personnel engagements.

2. Vendor shall meet certification requirements for classification of data being stored.

3. Vendor shall, at COT’s request, provide appropriate access to enable the Commonwealth to perform additional security measures in compliance with Commonwealth Enterprise Policies, Standards, and/or any Federal or State requirements.

4. Vendor shall provide an Exit Strategy, to move all data to the Commonwealth Data Center, if required by the Commonwealth.

At the end of the contract, the vendor shall provide all agency data in a form that can be converted to any subsequent system of the agency’s choice. The Vendor shall cooperate to this end with the Vendor of the agency’s choice, in a timely and efficient manner.

4.14 Project Governance

Vendor shall work with the agency and appropriate COT offices, when needed, in the cases of data governance, security aspects, hosting, integration, etc., provided that such work does not expand the scope of the services as described in this RFP absent a corresponding change order agreed to by the parties reflecting such expansion.

4.15 Monitoring Requirements for On Premise and Cloud (SaaS)

Vendor shall work with the agency and COT to establish a monitoring solution.

Vendors shall provide a view into their environment either by providing a COT and agency approved comprehensive dashboard or allow COT to install their KITS compliant infrastructure and application monitoring solution; to include but not limited to performance and availability. For a Cloud solution, Vendor is expected to provide a monitoring solution.

4.16 Application and Service Requirements

Current Enterprise Applications and Services

1. COT provides a number of Enterprise Shared Services to State agencies.

Vendor shall use published IT Applications and Services provided on KITS for: Enterprise Service Bus, Enterprise Content Management, Data Warehousing, Data Analytics and Reporting, Business Intelligence, Web Services, GIS, unless explicitly approved by COT.

2. Vendor provided dedicated application components (i.e., Application Servers, Databases, etc.) shall comply with KITS or if the technology is not included in KITS, the technology must be accepted by the Commonwealth for inclusion in KITS or granted a written exception to KITS according to COT Information Technology Standards Policy currently CIO-051.

3. Vendor applications must describe in detail all available features and functionality accessible via APIs.

4. All business applications must support the ability to use modern authentication for authentication and authorization. Modern authentication technologies would include SAML 2.0, WSFED, OAuth, or OpenID Connect.

4.17 Project Management Requirements

The COT Division of Governance and Strategy (COT-DGS) is responsible for overseeing large and complex technology projects throughout the Commonwealth.

The Vendor shall adhere to Project Management standards and reporting requirements established by COT-DGS, which are posted at https://technology.ky.gov/services-and-support/Pages/About-the-Project- Management-Branch.aspx. These include, but are not limited to, having a documented project schedule, risk management, issue management and reporting project status to the CIO monthly in the format defined by COT-DGS. In addition to the project management standards required by COT-DGS, agency specific requirements may be defined in this RFP.

4.18 Applicable Security Control Framework Compliance

The Vendor must have an awareness and understanding of the NIST Special Publication 800-53 Security Control Framework and employ safeguards that meet or exceed the moderate level controls as defined within the standard. The vendor must provide sufficient safeguards to provide reasonable protections around the Commonwealth’s data to ensure that the confidentiality, integrity, and availability is maintained at an appropriate level. These include but are not limited to:

• Access Control The Vendor must employ policy and process that provide for stringent control to limit physical and logical access to systems that house Commonwealth data, https://technology.ky.gov/services-and-support/Pages/About-the-Project-Management-Branch.aspx https://technology.ky.gov/services-and-support/Pages/About-the-Project-Management-Branch.aspx on a need to know basis, provide clear separation of duties, and adheres to least privilege principles.

• Awareness and Training The Vendor must provide the appropriate role specific training for staff to ensure that there is awareness and understanding of roles and responsibilities as they relate to the protections around the Commonwealth’s data.

• Audit and Accountability There must be sufficient auditing capability to ensure that actions are tracked and there is individual accountability for all actions taken by vendor staff.

• Configuration Management The Vendor must work within established baselines that provide minimal functionality needed to ensure service delivery without exposing unnecessary risk. The Vendor must also employ structured change control processes that provide a level of coordination with the client agreed upon in a Service Level Agreement (SLA).

• Contingency Planning The Vendor must employ contingent planning policy and procedures that ensure service delivery based on agreed SLA levels while maintaining all Commonwealth data within the continental Unites States.

• Identification and Authorization The Vendor must employ appropriate identity and access management policies and procedures to ensure that access is appropriately authorized and managed at a level to ensure that access is provisioned and de-provisioned in a timely and efficient manner.

• Incident Response The Vendor must employ policy and procedures to ensure that an appropriate response to all identified security incidents are addressed in a timely manner and are reported to the appropriate parties in an agreed upon SLA timeframe.

The vendor must also ensure that all staff are sufficient trained to ensure that they can identify situations that are classified as security incidents.

• Maintenance The Vendor must employ policy and procedures that ensure that all maintenance activities are conducted only by authorized maintenance staff leveraging only authorized maintenance tools.

• Media Protection The Vendor must employ policy and procedure to ensure that sufficient protections exist to protect Commonwealth data on all storage media throughout the media lifecycle and maintain documentation from media creation through destruction.

• Physical and Environmental Controls The Vendor must employ physical and environmental policies and procedures that ensure that the service and delivery infrastructure are located in a physically secure and environmentally protected environment to ensure the confidentiality, integrity, and availability of Commonwealth data.

• Personnel Security The Vendor must employ policies and procedures to ensure that all staff that have access to systems that house, transmit, or process Commonwealth data have been appropriately vetted and have been through a background check at the time of hire and periodically thereafter.

• System and Communications Protections The Vendor must employ physical and logical protection that protect system communications and communication media from unauthorized access and to ensure adequate physical protections from damage.

4.19 Protection of Personal Information Security and Breach Investigation Procedures and Practices Act Vendors that receive Personal Information as defined by and in accordance with Kentucky’s Personal Information Security and Breach Investigation Procedures and Practices Act, KRS 61.931, et seq., (the “Act”), shall secure and protect the Personal Information by, without limitation, complying with all requirements applicable to non-affiliated third parties set forth in the Act.

“Personal Information” is defined in accordance with KRS 61.931(6) as “an individual’s first name or first initial and last name; personal mark; or unique biometric or genetic print or image, in combination with one (1) or more of the following data elements:

a) An account, credit card number, or debit card number that, in combination with any required security code, access code or password, would permit access to an account;

b) A Social Security number;

c) A taxpayer identification number that incorporates a Social Security number;

d) A driver’s license number, state identification card number or other individual identification number issued by an agency;

e) A passport number or other identification number issued by the United States government; or

f) Individually Identifiable Information as defined in 45 C.F.R. sec. 160.013 (of the

Health Insurance Portability and Accountability Act), except for education records covered by the Family Education Rights and Privacy Act, as amended 20 U.S.C. sec 1232g.”

As provided in KRS 61.931(5), a “non-affiliated third party” means “any person or entity that has a contract or agreement with the Commonwealth and receives (accesses, collects or maintains) personal information from the Commonwealth pursuant to the contract or agreement.”

The Vendor hereby agrees to cooperate with the Commonwealth in complying with the response, mitigation, correction, investigation, and notification requirements of the Act.

The Vendor shall immediately notify as soon as possible, but not to exceed seventy-two (72) hours, the contracting agency, the Office of Procurement Services, and the Commonwealth Office of Technology of a determination of or knowledge of a breach, unless the exception set forth in KRS 61.932(2)(b)2 applies and the Vendor abides by the requirements set forth in that exception.

The Vendor hereby agrees that the Commonwealth may withhold payment(s) owed to the Vendor for any violation of the Identity Theft Prevention Reporting Requirements.

The Vendor hereby agrees to undertake a prompt and reasonable investigation of any breach as required by KRS 61.933.

Upon conclusion of an investigation of a security breach of Personal Information as required by KRS 61.933, the Vendor hereby agrees to an apportionment of the costs of the notification, investigation, and mitigation of the security breach.

In accordance with KRS 61.932(2)(a) the Vendor shall implement, maintain, and update security and breach investigation procedures that are appropriate to the nature of the information disclosed, that are at least as stringent as the security and breach investigation procedures and practices established by the Commonwealth Office of Technology:

http://technology.ky.gov/ciso/Pages/InformationSecurityPolicies,StandardsandPr ocedures.aspx

4.20 IRS Publication 1075 -Exhibit 7 Safeguarding Contract Language

Publication 1075 (Rev. 11-2021) (irs.gov)

I. PERFORMANCE

In performance of this contract, the Contractor agrees to comply with and assume responsibility for compliance by officers or employees with the following requirements:

(1) All work will be performed under the supervision of the contractor.

(2) The contractor and contractor’s officers or employees to be authorized access to FTI must meet background check requirements defined in IRS Publication 1075.

The contractor will maintain a list of officers or employees authorized access to FTI. Such list will be provided to the agency and, upon request, to the IRS.

(3) FTI in hardcopy or electronic format shall be used only for the purpose of carrying out the provisions of this contract. FTI in any format shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of this contract. Inspection or disclosure of FTI to anyone other than the contractor or the contractor’s officers or employees authorized is prohibited.

http://technology.ky.gov/ciso/Pages/InformationSecurityPolicies%2CStandardsandProcedures.aspx http://technology.ky.gov/ciso/Pages/InformationSecurityPolicies%2CStandardsandProcedures.aspx https://www.irs.gov/pub/irs-pdf/p1075.pdf

(4) FTI will be accounted for upon receipt and properly stored before, during, and after processing. In addition, any related output and products require the same level of protection as required for the source material.

(5) The contractor will certify that FTI processed during the performance of this contract will be completely purged from all physical and electronic data storage with no output to be retained by the contractor at the time the work is completed.

If immediate purging of physical and electronic data storage is not possible, the contractor will certify that any FTI in physical or electronic storage will remain safeguarded to prevent unauthorized disclosures.

(6) Any spoilage or any intermediate hard copy printout that may result during the processing of FTI will be given to the agency. When this is not possible, the contractor will be responsible for the destruction of the spoilage or any intermediate hard copy printouts and will provide the agency with a statement containing the date of destruction, description of material destroyed, and the destruction method.

(7) All computer systems receiving, processing, storing, or transmitting FTI must meet the requirements in IRS Publication 1075. To meet functional and assurance requirements, the security features of the environment must provide for the managerial, operational, and technical controls. All security features must be available and activated to protect against unauthorized use of and access to FTI.

(8) No work involving FTI furnished under this contract will be subcontracted without the prior written approval of the IRS.

(9) Contractor will ensure that the terms of FTI safeguards described herein are included, without modification, in any approved subcontract for work involving FTI.

(10) To the extent the terms, provisions, duties, requirements, and obligations of this contract apply to performing services with FTI, the contractor shall assume toward the subcontractor all obligations, duties and responsibilities that the agency under this contract assumes toward the contractor, and the subcontractor shall assume toward the contractor all the same obligations, duties and responsibilities which the contractor assumes toward the agency under this contract.

(11) In addition to the subcontractor’s obligations and duties under an approved subcontract, the terms and conditions of this contract apply to the subcontractor, and the subcontractor is bound and obligated to the contractor hereunder by the same terms and conditions by which the contractor is bound and obligated to the agency under this contract.

(12) For purposes of this contract, the term “contractor” includes any officer or employee of the contractor with access to or who uses FTI, and the term

“subcontractor” includes any officer or employee of the subcontractor with access to or who uses FTI.

(13) The agency will have the right to void the contract if the contractor fails to meet the terms of FTI safeguards described herein.

I…