RFP 758 2700000043

This is a Re-Solicitation of RFP 758 2600000216 which closed on January 30, 2026, and was not awarded. Because an award was not made, documents requested via an Open Records Request will not be released. At such time an award is made as a result of this new RFP, an Open Records Request may be filed and documents requested for the original RFP as well as for this new RFP may be released in accordance with KRS 61.870 to 61.884.

ATTACHMENT A

Commonwealth of Kentucky Request for Proposal (RFP)

For

SECURITY AND SURVEILLANCE

HARDWARE, SOFTWARE, SYSTEMS AND SERVICES REBID

Release Date: August 18, 2026

CLOSING DATE AND TIME: September 24, 2026 at 3:30pm ET

Issued by The Finance and Administration Cabinet on behalf of The Commonwealth Office of Technology (COT)

Commonwealth Buyer:

Holly McDonald, KCPM

Statewide Procurement Consultant

COMMONWEALTH OF KENTUCKY

FINANCE AND ADMINISTRATION CABINET

Office of Procurement Services 200 Mero Street, 5th Floor

Frankfort, KY 40622

(502) 564-6523

Holly.McDonald@ky.gov

TABLE OF CONTENTS

Proposal Submission Checklist Section 1 – Summary Section 2 – Introduction Section 3 – Scope of Work Section 4 – Commonwealth Office of Technology Requirements Section 5 – Procurement Requirements and Instructions Section 6 – Proposal Submission Section 7 – Proposal Evaluation mailto:Holly.McDonald@ky.gov

Section 8 – Negotiations Section 9 – Contract Requirements Section 10 – Standard Terms and Conditions Section 11 – Attachments

PROPOSAL SUBMISSION CHECKLIST

The Vendor MUST include the following with the proposal submission.

If the items highlighted below are not submitted with the proposal submission, the Commonwealth MUST deem the proposal non-responsive and SHALL NOT consider for award.

All other items MUST be submitted prior to award.

*PROPOSED TECHNICAL SOLUTION

*PROPOSED COST SOLUTION

TRANSMITTAL LETTER [see Section 6.7(A)]

REVENUE FORM 10A100 KENTUCKY TAX REGISTRATION APPLICATION, IF

APPLICABLE [see Section 6.7 (C)]

CERTIFICATE OF AUTHORITY- REGISTRATION WITH SECRETARY OF STATE BY A

FOREIGN ENTITY, IF APPLICABLE [see Section 6.7 (D)]

REQUIRED ANNUAL AFFIDAVIT AND OTHER AFFIDAVIT(S) [see Attachment C] https://finance.ky.gov/office-of-the-secretary/FinanceForms/Annual%20Required%20Affidavit%20for%20Bidders%20Offerors%20 and%20Contractors.pdf

MANDATORY REQUIREMENTS CHECKLIST [see Attachment E] https://finance.ky.gov/office-of-the-secretary/FinanceForms/Annual%20Required%20Affidavit%20for%20Bidders%20Offerors%20and%20Contractors.pdf https://finance.ky.gov/office-of-the-secretary/FinanceForms/Annual%20Required%20Affidavit%20for%20Bidders%20Offerors%20and%20Contractors.pdf https://finance.ky.gov/office-of-the-secretary/FinanceForms/Annual%20Required%20Affidavit%20for%20Bidders%20Offerors%20and%20Contractors.pdf

SECTION 1 - RFP SUMMARY

1.1 Estimated Schedule of RFP Activities

The following table presents the anticipated schedule for major activities associated with this RFP’s distribution, proposal submission, proposal evaluation process, and contract award. The Commonwealth reserves the right at its sole discretion to change the Schedule of Activities, including the associated dates and times.

Anticipated Schedule of Activities

Release of RFP

08.18.2026

Vendors’ Written Questions due by 12:00 PM ET

(SUBMIT QUESTIONS ON ATTACHMENT D - VENDORS’

QUESTION FORM)

08.28.2026

Commonwealth’s Response to Vendors’ Written Questions 09.10.2026

Proposals due by 3:30 PM ET

09.24.2026

1.2 Issuing Office

The Commonwealth of Kentucky, Finance and Administration Cabinet, Office of Procurement Services, is issuing this RFP on behalf of the Commonwealth Office of Technology (COT). The Finance and Administration Cabinet is the only office authorized to change, modify, amend, alter, or clarify the specifications, terms and conditions of this

RFP.

A contract, based on this RFP, may or may not be awarded. Any contract award from this RFP is invalid until properly approved and executed by the Finance and Administration Cabinet.

1.3 Agencies to Be Served

The Contract shall be for use by the Commonwealth Office of Technology (COT) on behalf of All State Agencies. All executive branch agencies must submit an IT Strategic Procurement Request (SPR1) prior to using the Contract regardless of the dollar amount or scope of the purchase. No shipments shall be made except upon receipt by vendor of an official delivery order from the using agency.

Political Subdivisions Under Kentucky Statutes, political subdivisions of this State including cities of all classes, counties, and school districts may participate in All State Agency Master Agreements to the same extent as agencies of the Commonwealth.

SECTION 2 - INTRODUCTION

2.1 Purpose

The purpose of this Request for Proposal (RFP) is to solicit proposals for competitive negotiations pursuant to 200 KAR 5:307. The Commonwealth is seeking to award up to two (2) contracts for SECURITY AND SURVEILLANCE HARDWARE, SOFTWARE, SYSTEMS AND SERVICES.

2.2 Background

The Commonwealth Office of Technology (COT) serves as the Commonwealth’s central information technology agency and provides technology leadership, services, solutions and oversight to the Commonwealth’s Executive Branch agencies. COT also provides enterprise governance by establishing IT policies, standards and guidelines.

In the Commonwealth, the management of information technology is a crucial aspect of ensuring efficient government operations and delivering services to the public.

SECTION 3 – SCOPE OF WORK

PROPOSALS THAT DO NOT MEET MANDATORY REQUIREMENTS WILL BE DEEMED

NON-RESPONSIVE AND WILL NOT BE CONSIDERED. REFER TO ATTACHMENT E –

MANDATORY REQUIREMENTS CHECKLIST.

“Mandatory Requirement means a condition set out in the specifications or statement of work that must be met without exception.”

3.1 Scope of Work/Technical Requirements

A. Core Systems, Hardware, and Services Vendor shall provide security and surveillance hardware, software, systems and services to include, but not limited to, the following:

1. Video Surveillance

2. Camera Hardware

3. Recording and Storage

4. Video Management Software

5. Physical Access Controls

6. Keycards

7. Fobs

8. Door Controllers

9. Door Locks

10. Intrusion Detection

11. Fencing Sensors

12. Outdoor Motion Detectors

13. Panic Buttons

14. Alarms

15. Installation Services

16. Configuration

17. Warranty/Support

18. Integration

19. Training

20. Maintenance

Additional items may be added to the Contract after award if within scope and approved by COT.

Vendor shall also provide the following:

21. Vendor shall maintain all manufacturer certifications throughout the contract term.

22. Vendor shall notify COT within five (5) business days of losing any manufacturer authorization.

23. Vendor shall comply with all applicable Kentucky building codes, NEC, NFPA 70, NFPA 72, and life safety requirements.

24. All software licensing shall clearly identify whether licensing is subscription-based or perpetual.

25. Vendor shall provide complete as-built documentation upon project completion.

26. Vendor shall provide all administrative passwords, encryption keys, and system credentials to the Commonwealth at project closeout.

27. The Commonwealth shall own all project-specific configuration files, programming, and documentation created under the contract.

B. Equipment Quality and Uptime Standards

1. All components, parts and hardware provided shall be new. Used, refurbished, or demo systems shall not be allowed unless otherwise approved in writing by COT.

2. The systems should guarantee a minimum uptime of 99%.

3. Vendor should demonstrate a proactive approach in being able to recognize the need for future security innovations and concepts and collaborate with the Commonwealth on integrating such changes in technology into Commonwealth systems.

C. System Support and Manufacturer Compatibility

1. Vendor shall provide support for the following existing systems manufacturers, including hardware and/or software.

a. Aiphone

b. Allegion

c. Avigilon

d. Hanwha

e. Hirsch

f. Honeywell

g. Velocity

h. Verint

Additional manufacturers may be proposed with the Vendor’s technical proposal response. After award of contract, additional manufacturers may be added to the Contract only if deemed within scope and approved by COT.

2. Vendor should be able to provide the following in addition to the systems outlined above. Additional systems, not listed in this RFP, may be added after the award of the contract if within scope and approved by COT:

a. Alarm and Signal Systems

b. Command Center Systems

c. Electronic Article Surveillance Systems

d. Electronic Identification Systems

e. Emergency Management Systems

f. Emergency Mass Notification Systems

g. CCTV/Surveillance Camera Systems

h. Parking Access Control Systems

i. Physical Access Control Systems

j. Inmate Radio Systems Microprocessor

k. Permanent Facility Perimeter Fencing Systems

l. Nurse Call Systems

m. Personal Alarm Systems

n. Public Address Systems

o. Traffic and Transportation CCTV/Surveillance and Monitoring System

p. Visitor Management Systems

q. Intercom Systems

D. Vendor Staff and Qualifications

1. Vendor shall be an Authorized distributor/reseller/partner of the proposed security and surveillance hardware, software, systems, and services and shall be able to sell and provide these items as well as related services statewide.

2. Vendor shall have at least three (3) years of experience in providing Security and Surveillance Hardware, Software, Systems and Services as referenced in this

RFP.

3. Vendor shall use Certified Technicians to perform all services. All certifications must be available upon request to the Commonwealth.

4. Vendor shall be responsible for obtaining and paying for all necessary permits, licenses and inspections required by federal, state and local law and shall ensure they are current and remain current.

5. No installation shall be considered complete until the final inspection, which will be scheduled by the using agency.

6. Vendor shall be responsible for everything involved in a project from the initial permit to the final inspector’s sign off.

7. Vendor’s staff shall always wear appropriate identification and appropriate uniform attire while on Commonwealth property.

8. The Commonwealth reserves the right to require a background check on any vendor staff at any time. The cost of the background check shall be the responsibility of the Vendor and not the Commonwealth.

E. Statements of Work (SOW) and Quote Procedures

1. Vendor shall provide an SOW and/or Quote to the using agency within forty-eight

(48) hours of the request unless both parties mutually agree on a different timeframe. The SOW and/or Quote must be reviewed and approved by the agency.

The Vendor cannot start any work prior to receiving a Delivery Order (DO) from the agency.

2. Vendor shall make a pre-installation site visit prior to preparing an SOW and/or Quote unless otherwise approved by the using agency.

3. The SOW and/or Quote shall include, but not limited to:

a. Commonwealth contract number

b. Agency name

c. Description of the requested scope (hardware, software, system, or services, manufacturer name, part number, etc.) to also include any third-party partners and/or subcontractors. The Commonwealth reserves the right to reject any third-party participation.

d. Breakdown of cost to include the MSRP, the Commonwealth discount, hourly rates, etc.

4. Additional information on the SOW and/or Quote may include, but not limited to, delivery, installation and completion dates, staging requirements, personnel resources, and any recommendations, i.e. additional storage/server requirements.

5. Additional terms and conditions shall not be included in the SOW and/or Quote.

6. Vendor shall identify the need for all building penetrations, firestop, conduit and cable pathways for any exterior devices.

F. Installation Protocols

1. Vendor shall survey and review installation site prior to installation unless otherwise approved by the using agency.

2. Software installation should allow remote monitoring and control of the entire system.

3. Vendor shall install and secure cabling, wiring and equipment according to state, federal and local standards, regulations and codes and obtain all necessary and applicable permits.

4. Vendor shall install and configure hardware and all software according to the manufacturer’s specifications.

5. A certified technician shall conduct all installations and be responsible for all the work and hardware needed for the installation.

6. Vendor shall perform any drilling necessary for the physical mount and bolting required for installation.

7. Vendor shall supply all screws, fasteners, and other miscellaneous hardware required for the installation.

8. During installation, the Vendor shall be responsible for unpacking, uncrating, and installing, mechanically and electrically, all components associated and connected with the order.

9. Vendor shall supply the Commonwealth with all literature, manuals, and other documentation applicable to the hardware and software installed.

10. The using agency shall prepare the site prior to the scheduled delivery date. If the site has not been properly prepared as specified in the SOW, the Vendor may reschedule the delivery and installation.

11. The installation of the systems shall be in accordance with the manufacturer’s recommendations and specifications.

12. There may be times when new security and surveillance systems will be required to interface with existing access control systems. The Vendor shall be able to perform such interface.

13. Vendor shall label all system components to identify the device, the associated control equipment and the associated communications closet.

14. Vendor should have a representative(s) on-site during all installations.

15. Vendor shall not disable any functioning or partially functioning system(s), unless addressing a life safety issue, without prior authorization by the using agency.

Failure to obtain prior authorization may result in the Vendor being liable for incidental, consequential or punitive damages associated with the unauthorized outage.

16. All work shall comply with applicable building codes, fire codes, electrical codes, manufacturer requirements and Commonwealth standards.

G. Infrastructure, Wiring, and Engineering Restrictions

1. Infrastructure devices (procurement, ownership, support, maintenance and disposal) such as routers, switches, Wi-Fi access points, servers and storage shall fall under COT responsibilities. Vendor’s solutions shall use COT Infrastructure services where applicable.

2. COT shall provide asset tagging for COT owned hardware. Vendor shall provide asset tagging where applicable.

3. Wiring shall be installed and secured pursuant to local building and fire codes, and National Electrical Code, latest edition.

4. Vendor shall be responsible for non-network wiring and/or cabling and shall comply with the Kentucky Information Technology Standards (KITS) as outlined in Section

4.3 of this RFP

5. Network-based wiring and/or cabling shall only be conducted by COT.

6. The Finance and Administration Cabinet, Division of Engineering and Contract

Administration (DECA) has the sole authority to hire professional engineering services. The Vendor shall not hire professional engineering services under this contract at any time during the life of the contract.

H. Camera Configuration Deliverables

1. Each camera installed shall be configured to the video proxy to include at minimum the following:

a. Logical Name

b. IP Address

c. Type of camera (manufacturer)

d. Username and password

e. Media type

f. Resolution

g. Quality of compression

h. Frame rate

i. Local Storage archive loop

j. Client configuration for video viewing

k. Position and focus of camera on the appropriate field of view

2. Vendor shall maintain a Configuration Guide, available to the Commonwealth, documenting the configuration, software, and hardware of all equipment included in any given installation or system. The Configuration Guide shall include location and placement of all cameras and equipment.

I. Inspection and Testing

1. The using agency shall be responsible for the final comprehensive inspection, which must be conducted upon completion of the installation. The Vendor shall run a complete and successful systems test and acceptable checklist on the entire completed system to ensure the system was properly installed; meets state, federal and local standards, regulations and codes; and that each component of the system is compatible to best industrial standards and functions as designed and requested.

2. If any part of the system fails inspection, the Vendor shall remedy the deficiencies at no additional cost to the Commonwealth and re-inspect and re-test to verify corrections.

J. Warranty Support and SLA Requirements

1. Vendor shall provide a minimum one (1) year warranty on all parts, hardware and software installed. The warranty shall not begin until after the entire system is installed, inspected and accepted by the agency.

2. No labor cost shall be charged to correct documented defects within that one (1) year warranty.

3. All replacement parts during the warranty shall be tested to perform as new per industry standard.

4. Vendor shall provide extended warranties, if requested. Such warranty shall be negotiated.

5. Vendor shall provide 24/7 premier support which is beyond basic support, if required by the agency. Such support shall be negotiated and may include 24/7 monitoring, rapid incident response, etc.

6. Vendor shall provide telephone support to diagnose warranty issues for both critical and non-critical components.

K. Operations, Support, and Customer Service

1. Vendor shall provide a contact person for all communications related to the contract.

2. Vendor shall provide a toll-free number and an email address for Help Desk/Customer Support which shall be available Monday through Friday from 8:00 am - 5:00 pm Eastern Time.

3. Maintenance/Service support shall be available Monday through Friday from 8:00 am - 5:00 pm Eastern time. Requests for service shall be acknowledged within two

(2) hours, technicians on-site within six (6) hours, and problems resolved within twenty-four (24) hours. If the time limit expires outside a service window, then the acknowledgement, on-site arrival, or resolution shall be within one (1) hour of the beginning of the following service window.

4. Some governmental agencies provide 24/7 mission critical services. The Vendor should extend customer service to weekends and holidays if requested.

5. Vendor shall assign a Project Manager for projects. That person(s) shall be responsible for working with the Commonwealth from start to finish on the project/installation.

6. Vendor shall provide emergency response service with a guaranteed response time, location of dispatch by responding party, and process to be followed for a system outage.

7. Vendor should maintain a centralized web-based service management and/or call tracking system for all service requests to be logged as unique “tickets”. The customer should be able to view the status of tickets, response times, resolution notes, etc.

8. Service/repair personnel should carry adequate hardware inventory to replace, repair, and/or maintain each system at the time dispatched and should be prepared to provide an immediate replacement for defective equipment. A defective unit should not be removed without an immediate replacement.

9. Vendor must coordinate any anticipated service disruptions with the Commonwealth at a minimum of twenty-four (24) hours’ notice.

L. Site Cleanup and Repairs

1. The Vendor shall, at all times, keep the premises and surrounding area free from the accumulation of waste materials or rubbish caused by Vendor’s operations in connection with the Project.

2. Cleanup and job site conditions shall comply with all applicable regulatory mandates.

3. Post installation and prior to final inspection and acceptance, the vendor shall immediately remove all remaining waste materials, rubbish, construction equipment, tools, machinery, surplus materials, cardboard boxes and packaging material from the using agency’s facility leaving the area clean. The Vendor shall not use internal trashcans, external trashcans, or hallways for trash. Trash shall be completely removed from the premises. If the Vendor fails to clean up as required, the using agency may perform or hire a third party to perform the cleaning tasks and charge the cost to the vendor.

4. Vendor shall repair and/or replace damaged facilities caused by work performed under the contract.

M. Training Services Vendor must provide training and training materials to the using agency at no additional cost to the agency. On-site training shall be provided for any new or updated equipment and/or software.

N. Prohibited Financing Options Leasing and rental options shall not be offered and shall not be accepted.

O. Monthly Reports Vendor shall submit monthly reports of all Commonwealth usage and projects to the COT Chief Contracting Officer at stephanier.williams@ky.gov. These reports shall be emailed on the 15th of each month. Reports content shall be negotiated with the awarded vendor.

P. Site Hazardous Materials and Safety

1. In the event the vendor unexpectedly encounters onsite material that is reasonably believed to be asbestos, polychlorinated biphenyl (PCB) or other classified hazardous substances/materials which have not been rendered harmless, the vendor shall immediately stop work in the area affected and report the condition to the using agency. The work in the affected area shall not thereafter be resumed except by written approval of the using agency and the vendor if in fact the material is asbestos, polychlorinated biphenyl (PCB), or other classified hazardous substances/materials which have not been rendered harmless. The work in the affected area shall be resumed in the absence of any classified hazardous substances/materials or when it or they have been rendered harmless.

2. Vendor must be cognizant of safety at all times and shall practice acceptable safety precautions so as not to cause harm to any persons or property while performing services under the resulting contract.

a. Vendor shall follow industry safety standards and use only industry approved safety equipment in accordance with the manufacturer’s specifications in the performance of all duties.

b. Vendor shall maintain at all times all equipment in proper and safe operating conditions in accordance with the manufacturer's specifications.

c. Vendor shall exercise extreme caution around pedestrians and parked cars.

Vendor shall clearly mark all work areas that might endanger the health and safety of building occupants, guests, or any other persons. Vendor shall provide such signs, markers and barricades as required to identify all work areas and minimize inherent dangers.

Q. Product Recall Procedure

Vendor shall provide product recall notifications, regardless of level, in writing to the using agency i.e. by phone or by email. The notification shall include a complete product description and disposition instructions. Upon notification, the vendor shall replace, pick up and/or accept agency returned item(s), test, destroy or return recalled products to the manufacturer at no expense to the using agency. Vendor shall agree to issue replacement of product or credit for any product that is recalled, giving the purchasing agency the option of accepting either credit or replacement in exchange for the recalled products.

3.2 Value Added Services

Value-added services may be added to the contract with prior approval by the Commonwealth Office of Technology (COT) and the Office of Procurement Services (OPS) Buyer of Record. Upon approval, a formal modification will be made to add the service(s). No work shall begin until a contract modification is completed and notice provided by the OPS Buyer that work may begin.

mailto:stephanier.williams@ky.gov

SECTION 4 – COMMONWEALTH OFFICE OF TECHNOLOGY (COT)

REQUIREMENTS

4.1 Hosting

The Commonwealth is seeking a vendor who can provide a solution per the RFP requirements. The Vendor can use servers stood up by COT to house the solution or the Vendor may propose a cloud-hosted solution. If the Vendor is proposing a cloud solution, the Commonwealth prefers the proposed cloud solution to be hosted on an established Commonwealth Office of Technology (COT) managed cloud tenant. If a COT managed cloud tenant is not proposed, the Vendor shall propose a commercial Federal Risk and Authorization Management Program (FedRAMP) - certified or HITRUST Cloud platforms.

The proposed solution must accommodate COT oversight that includes an isolated tenant, cloud network access (peering connection) and monitoring solutions.

The Commonwealth reserves the right to host any proposed solution, at any time, if deemed in the best interest of the Commonwealth.

If Vendor is using any type of Artificial Intelligence (AI) please indicate this in the RFP response.

The Vendor shall comply with Section 10.31 regarding Artificial Intelligence.

4.2 Commonwealth Information Technology Policies and Standards A. The Vendor and any subcontractors shall be required to adhere to applicable

Commonwealth policies and standards.

B. The Commonwealth posts changes to COT Standards and Policies on its Commonwealth Office of Technology - Home - Commonwealth Office of Technology (Kentucky) website. Vendors and subcontractors shall ensure their solution(s) shall work in concert with all posted changes. Vendors or subcontractors that cannot comply with changes must, within thirty (30) days of the posted change, request written relief with the justification for such relief. The Commonwealth may: 1) deny the request, 2) approve an exception to the policy/standard, or 3) consider scope changes to the contract to accommodate required changes. Vendors or subcontractors that do not provide the response within the thirty (30) day period shall be required to comply within ninety (90) days of the change.

4.3 Compliance with Kentucky Information Technology Standards (KITS)

A. The Kentucky Information Technology Standards (KITS) reflect a set of principles for information, technology, applications, and organization. These standards provide guidelines, policies, directional statements and sets of standards for information technology. It defines, for the Commonwealth, functional and information needs so that technology choices can be made based on business objectives and service delivery. The Vendor shall stay knowledgeable and shall provide a solution that works in concert with these standards for all related work resulting from this RFP.

https://technology.ky.gov/about-the-agency/Pages/kits.aspx https://technology.ky.gov/Pages/index.aspx https://technology.ky.gov/Pages/index.aspx https://technology.ky.gov/about-the-agency/Pages/kits.aspx

B. The Vendor and any subcontractors may be required to submit a technology roadmap for any offered solution. Additional roadmaps will be submitted upon request of the Commonwealth. If required, the roadmap shall include, but is not limited to, planned, scheduled and projected product lifecycle dates and historical release/patch or maintenance dates for the technology. In addition, any guidance on projected release/revision/patch/maintenance schedules would be preferred.

4.4 Compliance with Industry Accepted Reporting Standards Based on Trust Service Principles and Criteria (if Cloud Hosting is Involved) The Vendor must employ comprehensive risk and threat management controls based on defined industry standards for service organizations such as ISO AICPA TSP section 100, Trust Services Principles and Criteria. The vendor must annually assert compliance and engage a third-party certification registrar to examine such assertions and controls to provide a Report, such as ISO 9000, ISO 14001, AT101 SOC 2 type 2, on Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, and Privacy, which contains an opinion on whether the operating controls effectively support the assertions. All such reports, including publicly available reports (i.e.

AT 101 SOC 3) shall be made available to the Commonwealth for review.

4.5 System Vulnerability and Security Assessments

The Commonwealth reserves the right to conduct, in collaboration with the vendor, non-invasive vulnerability and security assessments of the software and infrastructure used to provide services prior to implementation and periodically thereafter. Upon completion of these assessments, the Commonwealth will communicate any findings to the Vendor for action. Any cost relating to the alleviation of the findings will be the responsibility of the Vendor. Mitigations will be subject to re-evaluation after completion. In cases where direct mitigation cannot be achieved, the vendor shall communicate this and work closely with the Commonwealth to identify acceptable compensating controls that will reduce risk to an acceptable and agreed upon level. An accredited third-party source may be selected by the vendor to address findings, provided they will acknowledge all cost and provide valid documentation of mitigation strategies in an agreed upon timeframe.

4.6 Privacy Assessments

The Commonwealth reserves the right to conduct privacy assessments of the collection, use, maintenance and sharing of Commonwealth data by any vendor services, software, and infrastructure used to provide services prior to implementation and periodically thereafter. Upon completion of this assessment, the Commonwealth will communicate any findings to the vendor for action. Any cost relating to the alleviation of the findings will be the responsibility of the Vendor. Mitigations will be subject to re-evaluation after completion. In cases where direct mitigation cannot be achieved, the Vendor shall communicate this and work closely with the Commonwealth to identify acceptable compensating controls or privacy practices that will reduce risk to an acceptable and agreed upon level. An accredited third-party source may be selected by the Vendor to address findings, provided they will acknowledge all cost and provide valid documentation of mitigation strategies in an agreed upon timeframe.

4.7 Privacy, Confidentiality and Ownership of Information

The Commonwealth is the designated owner of all Commonwealth data and shall approve all access to that data. The Vendor shall not have ownership of Commonwealth data at any time. The Vendor shall not profit from or share Commonwealth data. The Vendor shall be in compliance with privacy policies established by governmental agencies or by state or federal law. Privacy notice statements may be developed and amended from time to time by the Commonwealth and will be appropriately displayed on the Commonwealth portal (Ky.gov). The Vendor should provide sufficient security to protect the Commonwealth and COT data in network transit, storage, and cache. All Commonwealth data, including backups and archives, must be maintained at all times within the contiguous United States. All Commonwealth data, classified as sensitive or higher, as defined in Enterprise Standards, must be encrypted in-transit from Vendor’s network and at rest while stored on vendor’s laptops or other portable media devices.

4.8 Data Quality

The Vendor shall provide proposed levels of data quality per the following dimensions.

Data Quality is the degree to which data is valid, accurate, complete, unique, timely, consistent with all requirements and business rules, and relevant for a given use. The Vendor shall provide data quality definitions and metrics for any data elements. Data has to be of the appropriate quality to address the needs of the Commonwealth of Kentucky.

The following dimensions can be used to assess data quality:

• Validity – The data values are in an acceptable format.

• Accuracy – The data attribute is accurate.

• Completeness – There are no null values in a data field.

• Uniqueness – There are no duplicate values in a data field.

• Timeliness – The data attribute represents information that is not out-of-date.

• Consistency – The data attribute is consistent with a business rule that may be based on that attribute itself, or on multiple attributes.

• Adherence to business rules – The data attribute or a combination of data attributes adheres to specified business rules.

4.9 License Agreements

Any proposed software agreements, i.e. license agreement, subscription agreement, end-user license agreement, etc. shall include the following language, or similar, and must be submitted to the Commonwealth Office of Technology (COT) for review and approval prior to the award of the contract:

“Governing Law shall be the Commonwealth of Kentucky, Franklin County. All terms of the Vendor/subvendor agreement/EULA shall be read as applicable only to the extent permitted by Kentucky law and no term in violation of the Kentucky law, inclusive of Kentucky Procurement Law, shall be given effect.”

Any third-party software licenses and cloud resources necessary for the proposed solution may be procured via the Commonwealth’s existing contracts.

4.10 Software Version Requirements

All commercially supported and Commonwealth approved software components such as Operating system (OS), Database software, Application software, Web Server software, Middle Tier software, and other ancillary software must be kept current. In the event that a patch interferes with the solution, the vendor must present a plan for compliance to the Commonwealth outlining the constraints and an appropriate plan of action to bring the solution in to compliance to allow this patch to be applied in the shortest timeframe possible, not to exceed three (3) months, unless otherwise negotiated with the Commonwealth.

4.11 No Surreptitious Code Warranty

The Vendor represents and warrants that no copy of licensed software provided to the Commonwealth contains or will contain any Self-Help Code or any Unauthorized Code as defined below. This warranty is referred to in this contract as the "No Surreptitious Code Warranty”.

As used in the contract, "Self-Help Code" means any back door, time bomb, drop-dead device, or other software routine designed to disable a computer program automatically with the passage of time or under the positive control of a person other than the licensee of the software. Self-Help Code does not include Software routines in a computer program, if any, designed to permit an owner of the computer program (or other person acting by authority of the owner) to obtain access to a licensee's computer system(s) (e.g.

remote access) for purposes of maintenance or technical support.

As used in the contract, "Unauthorized Code" means any malware designed to permit unauthorized access to disable, erase, or otherwise harm software, equipment, or data;

or to perform any other such actions. The term Unauthorized Code does not include Self- Help Code.

In addition, Vendor will use up-to-date commercial virus detection software to detect and remove any viruses from any software prior to delivering it to the Commonwealth.

The Vendor shall defend the Commonwealth against any claim and indemnify the Commonwealth against any loss or expense arising out of any breach of the No Surreptitious Code Warranty.

4.12 Network Connection Requirements

A. Vendor shall work with COT to establish any network connections. If a secure site-to-site connection is required, the Vendor shall employ a secure site-to-site connection procured by the Agency from COT.

B. Vendor shall, at COT’s discretion, provide appropriate access to enable the Commonwealth to perform additional security measures, such as decryption of the network traffic if required for inspection. If the proposed solution does not have the ability to meet this requirement, the Vendor must provide an alternative such as audit reporting of this function.

C. Vendor should provide notifications to the Commonwealth Service Desk for unplanned outages within fifteen (15) minutes.

D. Vendor shall notify COT Change Management, through the Commonwealth Services

Desk, a minimum of two (2) business days prior to any planned outage.

E. Vendor, in conjunction with the agency, shall provide a Business Impact Assessment

(BIA) to appropriately classify all data before production/go-live.

F. Vendor shall include a Web Application Firewall when application houses any data classified as sensitive or higher as defined in KITS standards.

G. Vendor shall provide Recovery Time Objective (RTO) and Recovery Point Objective

(RPO) services. Vendor shall provide those services to achieve those SLAs.

4.13 OS Requirements

A. Non-On Prem Solutions

1. No Commonwealth data shall be co-mingled with another entity, without the prior approval of the Commonwealth.

2. Vendor shall provide a solution to move data to the Commonwealth, if required by the Commonwealth.

a. At the end of the contract, the vendor shall provide all agency data in a useable standard data format (such as asci, csv, etc.) that can be converted to a subsequent system. The Vendor shall cooperate to this end with the agency and/or a vendor of the agency’s choice, in a timely and efficient manner.

b. Vendor shall address the destruction of Commonwealth data as defined in CIO- 092 and provide a certification of the complete and permanent deletion the Commonwealth data.

B. Infrastructure as a Service

1. Vendor shall work with the agency and COT to establish all administrative personnel engagements.

2. Vendor shall meet certification requirements for classification of data being stored.

3. Vendor shall, at COT’s request, provide appropriate access to enable the

Commonwealth to perform additional security measures in compliance with Commonwealth Enterprise Policies, Standards, and/or any Federal or State requirements.

4. Vendor shall provide an Exit Strategy, to move all data to the Commonwealth Data Center, if required by the Commonwealth.

At the end of the contract, the Vendor shall provide all agency data in a form that can be converted to any subsequent system of the agency’s choice. The vendor shall cooperate to this end with the vendor of the agency’s choice, in a timely and efficient manner.

4.14 Project Governance

Vendor shall work with the agency and appropriate COT offices, when needed, in the cases of data governance, security aspects, hosting, integration, etc., provided that such work does not expand the scope of the services as described in this RFP absent a corresponding change order agreed to by the parties reflecting such expansion.

4.15 Monitoring Requirements for On Premise and Cloud (SaaS)

Vendor shall work with the agency and COT to establish a monitoring solution. Vendors shall provide a view into their environment either by providing a COT and agency approved comprehensive dashboard or allow COT to install their KITS compliant infrastructure and application monitoring solution; to include but not limited to performance and availability. For a Cloud solution, Vendor is expected to provide a monitoring solution.

4.16 Application and Service Requirements

Current Enterprise Applications and Services

1. COT provides a number of Enterprise Shared Services to State agencies. Vendor shall use published IT Applications and Services provided on KITS for: Enterprise Service Bus, Enterprise Content Management, Data Warehousing, Data Analytics and Reporting, Business Intelligence, Web Services, GIS, unless explicitly approved by COT.

2. Vendor provided dedicated application components (i.e., Application Servers, Databases, etc.) shall comply with KITS or if the technology is not included in KITS, the technology must be accepted by the Commonwealth for inclusion in KITS or granted a written exception to KITS according to COT Information Technology Standards Policy currently CIO-051.

3. Vendor applications must describe in detail all available features and functionality accessible via APIs.

4. All business applications must support the ability to use modern authentication for authentication and authorization. Modern authentication technologies would include SAML 2.0, WSFED, OAuth, or OpenID Connect.

4.17 Project Management Requirements

The COT Division of Governance and Strategy (COT-DGS) is responsible for overseeing large and complex technology projects throughout the Commonwealth. The Vendor shall adhere to Project Management standards and reporting requirements established by COT-DGS, which are posted at https://technology.ky.gov/services-and-support/Pages/About-the-Project-Management-Branch.aspx. These include, but are not limited to, having a documented project schedule, risk management, issue management and reporting project status to the CIO monthly in the format defined by COT-DGS. In addition to the project management standards required by COT-DGS, agency specific requirements may be defined in this RFP.

4.18 Applicable Security Control Framework Compliance

The Vendor must have an awareness and understanding of the NIST Special Publication 800-53 Security Control Framework and employ safeguards that meet or exceed the moderate level controls as defined within the standard. The Vendor must provide https://technology.ky.gov/services-and-support/Pages/About-the-Project-Management-Branch.aspx https://technology.ky.gov/services-and-support/Pages/About-the-Project-Management-Branch.aspx sufficient safeguards to provide reasonable protections around the Commonwealth’s data to ensure that the confidentiality, integrity, and availability is maintained at an appropriate level. These include but are not limited to:

• Access Control The Vendor must employ policy and process that provide for stringent control to limit physical and logical access to systems that house Commonwealth data, on a need to know basis, provide clear separation of duties, and adheres to least privilege principles.

• Awareness and Training The Vendor must provide the appropriate role specific training for staff to ensure that there is awareness and understanding of roles and responsibilities as they relate to the protections around the Commonwealth’s data.

• Audit and Accountability There must be sufficient auditing capability to ensure that actions are tracked and there is individual accountability for all actions taken by Vendor staff.

• Configuration Management The Vendor must work within established baselines that provide minimal functionality needed to ensure service delivery without exposing unnecessary risk. The Vendor must also employ structured change control processes that provide a level of coordination with the client agreed upon in a Service Level Agreement (SLA).

• Contingency Planning The Vendor must employ contingent planning policy and procedures that ensure service delivery based on agreed SLA levels while maintaining all Commonwealth data within the continental Unites States.

• Identification and Authorization The Vendor must employ appropriate identity and access management policies and procedures to ensure that access is appropriately authorized and managed at a level to ensure that access is provisioned and de-provisioned in a timely and efficient manner.

• Incident Response The Vendor must employ policy and procedures to ensure that an appropriate response to all identified security incidents are addressed in a timely manner and are reported to the appropriate parties in an agreed upon SLA timeframe. The Vendor must also ensure that all staff are sufficient trained to ensure that they can identify situations that are classified as security incidents.

• Maintenance The Vendor must employ policy and procedures that ensure that all maintenance activities are conducted only by authorized maintenance staff leveraging only authorized maintenance tools.

• Media Protection The Vendor must employ policy and procedure to ensure that sufficient protections exist to protect Commonwealth data on all storage media throughout the media lifecycle and maintain documentation from media creation through destruction.

• Physical and Environmental Controls The Vendor must employ physical and environmental policies and procedures that ensure that the service and delivery infrastructure are located in a physically secure and environmentally protected environment to ensure the confidentiality, integrity, and availability of Commonwealth data.

• Personnel Security The Vendor must employ policies and procedures to ensure that all staff that have access to systems that house, transmit, or process Commonwealth data have been appropriately vetted and have been through a background check at the time of hire and periodically thereafter.

• System and Communications Protections The Vendor must employ physical and logical protection that protect system communications and communication media from unauthorized access and to ensure adequate physical protections from damage.

4.19 IRS Publication 1075 -Exhibit 7 Safeguarding Contract Language Publication 1075 (Rev. 11-2021) (irs.gov)

I. PERFORMANCE

In performance of this contract, the Contractor agrees to comply with and assume responsibility for compliance by officers or employees with the following requirements:

(1) All work will be performed under the supervision of the contractor.

(2) The contractor and contractor’s officers or employees to be authorized access to FTI must meet background check requirements defined in IRS Publication 1075. The contractor will maintain a list of officers or employees authorized access to FTI. Such list will be provided to the agency and, upon request, to the IRS.

(3) FTI in hardcopy or electronic format shall be used only for the purpose of carrying out the provisions of this contract. FTI in any format shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of this contract. Inspection or disclosure of FTI to anyone other than the contractor or the contractor’s officers or employees authorized is prohibited.

(4) FTI will be accounted for upon receipt and properly stored before, during, and after processing. In addition, any related output and products require the same level of protection as required for the source material.

(5) The contractor will certify that FTI processed during the performance of this contract will be completely purged from all physical and electronic data storage with no output to be retained by the contractor at the time the work is completed. If immediate purging of physical and electronic data storage is not possible, the contractor will certify that any FTI in physical or electronic storage will remain safeguarded to prevent unauthorized disclosures.

(6) Any spoilage or any intermediate hard copy printout that may result during the processing of FTI will be given to the agency. When this is not possible, the contractor will be responsible for the destruction of the spoilage or any intermediate hard copy https://www.irs.gov/pub/irs-pdf/p1075.pdf printouts and will provide the agency with a statement containing the date of destruction, description of material destroyed, and the destruction method.

(7) All computer systems receiving, processing, storing, or transmitting FTI must meet the requirements in IRS Publication 1075. To meet functional and assurance requirements, the security features of the environment must provide for the managerial, operational, and technical controls. All security features must be available and activated to protect against unauthorized use of and access to FTI.

(8) No work involving FTI furnished under this contract will be subcontracted without the prior written approval of the IRS.

(9) Contractor will ensure that the terms of FTI safeguards described herein are included, without modification, in any approved subcontract for work involving FTI.

(10) To the extent the terms, provisions, duties, requirements, and obligations of this contract apply to performing services with FTI, the contractor shall assume toward the subcontractor all obligations, duties and responsibilities that the agency under this contract assumes toward the contractor, and the subcontractor shall assume toward the contractor all the same obligations, duties and responsibilities which the contractor assumes toward the agency under this contract.

(11) In addition to the subcontractor’s obligations and duties under an approved subcontract, the terms and conditions of this contract apply to the subcontractor, and the subcontractor is bound and obligated to the contractor hereunder by the same terms and conditions by which the contractor is bound and obligated to the agency under this contract.

(12) For purposes of this contract, the term “contractor” includes any officer or employee of the contractor with access to or who uses FTI, and the term “subcontractor” includes any officer or employee of the subcontractor with access to or who uses FTI.

(13) The agency will have the right to void the contract if the contractor fails to meet the terms of FTI safeguards described herein.

II. CRIMINAL/CIVIL SANCTIONS

(1) Each officer or employee of a contractor to whom FTI is or may be disclosed shall be notified in writing that FTI disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any FTI for a purpose not authorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution.

(2) Each officer or employee of a contractor to whom FTI is or may be accessible shall be notified in writing that FTI accessible to such officer or employee may be accessed only for a purpose and to the extent authorized herein, and that access/inspection of FTI without an official need-to-know for a purpose not authorized herein constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution.

(3) Each officer or employee of a contractor to whom FTI is or may be disclosed shall be notified in writing that any such…