Award Letter and Synopsis 190000000058 CMS Onsite Security Assessment - posted.docx

STATE OF MICHIGAN

CENTRAL PROCUREMENT SERVICES

Department of Technology, Management & Budget

525 W. Allegan St., Lansing, MI 48933

Recommendation of Award

The Department of Technology, Management, & Budget’s Central Procurement Services office has completed the evaluation of RFP 190000000058 CMS Onsite Security Assessment and has recommended an award to Accenture, LLP. in the amount of $2,136,000.00, pending State Administrative Board approval, if applicable. More information on the State Administrative Board can be found at: State Administrative Board.

Bidders who were not recommended for the award are encouraged to schedule a debriefing session with the Solicitation Manager. The debriefing session will provide the bidder with the State’s rationale on why the bidder was not recommended for the award. The Solicitation Manager may be contacted as follows:

Lisa Spitzley, Solicitation Manager spitzleyl4@michigan.gov

(517) 249-0440

Background Information:

This Request for Proposal (RFP) was to solicit responses for selection of a Contractor to provide a Centers for Medicare and Medicaid Services (CMS) Onsite Security Assessment service on behalf of the Michigan Department of Health and Human Services (MDHHS). The term of this contract is 4 years and 3 months, with up to 3 one-year renewal options.

Bidders:

The RFP was posted on SIGMA VSS on November 13, 2018. The following bidders submitted proposals by the published due date of December 10, 2018.

City, State Zip

SDVOB*

Chicago, Illinois,60601 No

Oak Park, MI 48237 No

*SDVOB: Service-Disabled Veteran Owned Business

Version 1 Revised: 07-28-2017

Evaluation Synopsis I. Evaluation Process A Responsible Vendor is a vendor that demonstrates it has the ability to successfully perform the duties identified by the solicitation. A Responsive proposal is one that is submitted in accordance with the solicitation instructions and meets all mandatory requirements identified in the solicitation.

Solicitation Instructions, Section 6, Evaluation Process.

Proposals receiving 80 or more technical evaluation points will have pricing evaluated and considered for award.

The full evaluation process is stated in the RFP Proposal Instructions.

II. Evaluation Method Responses to this solicitation were reviewed by a Joint Evaluation Committee, which consisted of the following individuals:

Voting

Lisa Spitzley, Category Analyst DTMB – Procurement

James Bowen

DHHS

Loren DeThample

DHHS

Anjali Nair

DHHS

Non-Voting (Advisory)

Lance Kingsbury

DHHS

III. Evaluation Results A. Accenture, LLP The Evaluation Team determined that Accenture, based on a score of 98/100, did meet the requirements of this RFP. This determination was accomplished by evaluating their responses to the Technical Evaluation Criteria.

1. Schedule A; Statement of Work, Sections 1 and 2. (20/20) The Evaluation Team determined that overall the responses were satisfactory; no deficiencies in this section were noted.

2. Staffing - Schedule A; Statement of Work - Section 3 (25/25) The Evaluation Team determined that overall the responses were satisfactory; no deficiencies in this section were noted.

3. Project Plan - Schedule A; Statement of Work - Section 4 (25/25) The Evaluation Team determined that overall the responses were satisfactory; no deficiencies in this section were noted.

4. Experience - Vendor Questions Worksheet (28/30) The Evaluation Team determined that most of the responses were satisfactory, and the following deficiencies were noted:

a. Experiences Sections 1, 2, and 3 - Bidder did not list dollar amount of projects.

Total Score: 98/100

B. Global Solutions Group, Inc.

The Evaluation Team determined that Global Solutions, based on a score 72, did not meet the requirements of this RFP. This determination was accomplished by evaluating their responses to the Technical Evaluation Criteria listed in Section 6 of the Proposal Instructions.

1. Schedule A; Statement of Work, Sections 1 and 2. (13/20) The Evaluation Team determined that overall the responses were mostly satisfactory; but the following deficiencies were noted:

a. Section 1.B., Project Execution: The JEC notes that overall the response lacked detail. Bidder did not explain how they would conduct the security assessment and security controls testing.

b. Section 1.C., Project Completion: The JEC notes that overall the response lacked detail. Bidder did not explain in detail how they would incorporate the separate sections of the Security Assessment Report (SAR) requirements; bidder only provided a chart. Bidder did not explain how they would direct the SOM on necessary steps for completion of security control documentation nor how they would provide guidance to SOM on leading best practices or CMS expectations during the annual assessment.

c. Section 1.D., Deliverables for 1.C. Project Completion: The JEC notes that overall the response lacked detail. Bidder did not explain how they would include the separate sections required in the Security Assessment Report (SAR) but they sited they would include an overview of penetration testing in the report, but penetration testing is not part of the assessment.

d. Section 1.F., Functional Requirements Detail: Bidder did not explain how they would evaluate the full spectrum of the MARS-E control framework. The JEC notes Bidder addressed, in whole or part, five of the eighteen control families required for the entire assessment.

2. Staffing - Schedule A; Statement of Work - Section 3 (21/25) The Evaluation Team determined that overall the responses were mostly satisfactory, but the following deficiencies were noted:

a. Section 3.1., Staffing: Bidder did not list a Contract Representative as requested.

b. Section 3.4., Key Personnel: The JEC notes that the overall experience listed is not in alignment with scope of project, there is not sufficient Assessment Experience, most of the experience listed fulfils the Project Management requirement.

3. Project Plan - Schedule A; Statement of Work - Section 4 (19/25) The Evaluation Team determined that overall the responses were mostly satisfactory, but the following deficiencies were noted:

a. Section 4.1., The JEC notes that overall the Project Plan lacked detail, it did not include adequate details of their methodology beyond communication management and issue management.

4. Experience - Vendor Questions Worksheet (19/30) The Evaluation Team determined that the responses were unsatisfactory, and the following deficiencies were noted:

a. Vendor Questions Worksheet: Bidder stated that they did not anticipate the revenue from this project would increase their income by more than 25%. According to annual income Bidder reported and their bid on the project, a resulting contract for this project would increase their income by 25% or more and bidder did not state how they would manage increase.

b. Section Vendor Questions Worksheet, Experiences 1 and 3: Bidder’s listed experiences 1 and 3 were not similar size or scope to this project. The scope of the Bidders listed experience in #1 focused on Network security, Incident response and Server configurations, these cover whole or in part, five of the eighteen total control families under the MARS-E framework. Experience 3 covered seven of the eighteen control families.

Total Score: 72/100

IV. Technical Evaluation Summary [Read and delete: insert evaluation criteria and resulting scores for each bidder. The table below is an example, modify to meet the evaluation.

VI. Pricing Summary Pricing was evaluated for the bidder who passed technical. The following is a summary of the price proposal:

Accenture’s pricing is based on effort estimates for two (2) hours per control, including planning, evidence gathering, review, follow up discussions, final control disposition, and tracking & reporting as well as 60 hours for SAR report (total of seven SAR reports). A series of formal checkpoints will be conducted during the project term to determine project status and required course correction if needed.

Per Schedule A, Section 6.2 Payment Methods, payment will be made based on the successful completion of the Milestones as described below:

VII. Negotiations:

Second Round Pricing was requested from the passing Bidder and their final pricing is reflected in the table above. The Bidder provided reduced rates, resulting in a 5-Year cost avoidance of $20,000.

VIII. Award Recommendation:

Award recommendation is made to the responsive and responsible Bidder who offers the best value to the State of Michigan. Best value is based on the proposal meeting the minimum point threshold and offering the best combination of factors stated in Technical Evaluation Criteria, Section 6 Evaluation Process, and price. Accenture, LLP provided the best value to the State. Award Recommendation is made to Accenture, LLP in the amount of $2,136,000.

image1.jpeg