BPM005633 CyraCom Exceptions Determination 11.30.23.docx
DOCX document 50 KB Posted
- Solicitation number
- BPM005633
- Issued by
- Arizona
About this file
This document is an Exceptions Determination for solicitation BPM005633 issued by the State of Arizona for Foreign Language Interpretation and Translation Services. The document records CyraCom International, Inc.'s proposed contract exceptions and the State's responses to those exceptions as of November 30, 2023. CyraCom sought to limit or exclude coverage for multiple service categories and contractual obligations, including simultaneous interpretation services, court/legal interpretation services, document translation services, and voiceover translation services. The State denied the majority of CyraCom's proposed exceptions, permitting the contractor to exclude services from their bid scope while maintaining that those excluded sections would not apply to the contract. For example, CyraCom indicated it would not bid on simultaneous interpretation services, headset equipment provision, or certain document translation and voiceover translation requirements, and the State accepted these limitations by determining that unbid sections would not be contractually binding.
The State accepted two exceptions related to Sexual Abuse and Molestation (SAM) insurance coverage, with the condition that SAM insurance documentation must be submitted if in-person services are ever offered under the contract. The State rejected CyraCom's exceptions regarding reimbursement obligations for substitute interpreters, pro-rated fee deductions for late interpreters, Section 508 accessibility compliance, penetration testing allowances, cloud security assessments, cybersecurity framework compliance requirements, information disclosure policies, and various regulatory requirements including FERPA and DPPA. The State indicated that language related to contractor's best pricing, invoice rejection procedures, Section 508 compliance, and cybersecurity requirements were written by State Risk Management and could not be revised. CyraCom asserted ISO 27001 and ISO 9001 certifications as evidence of compliance with security and quality management standards, though the State determined additional time and coordination with the Department of Homeland Security would be necessary to confirm full compliance with all security policies and procedures.
View the file
Other files
Show 40 more
50 files listed here. See the rest on GovTribe.
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
EXCEPTIONS
Offeror: CyraCom International, Inc.
Solicitation #: BPM005633 Foreign Language Interpretation and Translation Services
Scope of Work
| Section |
| RFP Language |
| Offeror Exceptions |
| State Comments |
| Offeror Response |
| 3.2.1.2, b. |
| The Contractor shall reimburse the Requester for any additional costs incurred, in accordance with the terms and conditions of this contract if the Requester elect to procure the services of a substitute interpreter from another Contractor due to: |
1) Assigned interpreter fail to appear at the time and place specified after the Contractor has confirmed the assignment, or
2) Assigned interpreter does not meet the qualification requirements for the assignment.
Alternate language: Redline
Rationale: CyraCom does not agree to reimburse the Requester for additional costs incurred for an interpreter failing to appear at the time and place specified after the Contractor has confirmed the assignment, or if the assigned interpreter does not meet the qualification requirements for the assignment.
State Response
11/30/23
Alternative Language is denied. Approving this would be a material change of the contract
| 3.2.2.1, 5. |
| Simultaneous Interpreting: Real-time interpreting; speakers talk as they normally would, without pause, as the interpreter listens to one language and speaks in the other. This service is common when the interpreter is listening with headphones in a booth and speaking to a person or into a microphone for people with headsets. |
| Alternate language: Redline |
Rationale: CyraCom does not support simultaneous interpretation services for spoken languages, and is not bidding on this portion of the scope of work.
State Response
Alternative Language is denied. If a section is not bid, it will not apply to the contract.
| 3.2.2.4 |
| The Contractor shall provide headset equipment as requested. |
| Alternate language: Redline |
Rationale: CyraCom is not bidding on the portion of services outlined in this RFP (simultaneous interpretation) that would require headsets.
State Response
| 3.2.2.5.1 |
| An interpreter that is late on an assignment shall be paid a pro-rated fee by deducting the amount of time late from the time originally requested by the Eligible Agency. |
| Alternate language: redline |
Rationale: CyraCom does not agree to a pro-rated fee by deducting the amount of time late from the time originally requested by the Eligible Agency for an interpreter late on an assignment.
State Response
Alternative Language is denied. Approving this would be a material change of the contract.
| 3.3.1 |
| Court/Legal Interpretation Services. Court/legal interpretation is a service provided by a court-certified interpreter trained to interpret between English and one or more foreign languages. 3.3.1.1 Translation shall be performed by certified interpreters who have knowledge and experience in the United States and Arizona legal and court systems. (www.azcourts.gov/Portals/22/admorder/Orders16/2016-02.pdf) 3.3.1.2 The translator shall: 1. Be adept at simultaneous interpretation, which is the most frequent form of interpretation used in the courtroom, in consecutive interpretation and sight translation 2. Have the ability to accurately turn the message from the source language into the receptor language without any additions, omissions or other misleading factors that alter the intended meaning of the message from the speaker. 3. Have a broad legal and court-related vocabulary base in which to work. 4. Be aware of the standards and practices of the courts in which the interpreter is to appear. |
| Alternate language: redline |
Rationale: CyraCom is not bidding on the Court/Legal Interpretation Services portion of this RFP.
State Response
| 3.3.2 |
| Document Translation Services. Document translation services shall be provided for various tasks, such as general correspondence, technical or scientific materials, high level study materials, legal documents, forms, booklets, pamphlets, A/V materials, etc. 3.3.2.1 The documents that are sent to the Contractor may fall under the category of National Institute of Standards and Technology (NIST) NIST Low Impact, thus the Offeror shall (as applicable): a. Submit a completed Arizona Baseline Infrastructure Security Controls Pre-Requisite (35 questions) assessment spreadsheet (Attachment 17) as part of their proposal. b. Accept Agency documents to be transcribed via a Secure FTP connection. 3.3.2.2 Contractor shall review each translation prior to delivery to the Eligible Agency to ensure that the translated document is linguistically accurate and consistent with the formatting and technical specifications of the original document. The project will not be considered complete if any inaccuracy or inconsistency is found. 3.3.2.3 Contractor shall correct, at no cost to the Eligible Agency, any errors in formatting or translation identified by the Eligible Agency. Costs associated with mass duplication of translated documents, which are found to be materially inaccurate after mass duplication, will be the responsibility of the Contractor. 1. In the instance that a Contractor does not understand a phrase/word/technical term or if the Contractor has any questions regarding the document to be translated, the Contractor shall immediately contact the Eligible Agency for any clarifications. 3.3.2.4 For all assignments, the Contractor shall return all original documentation to the requesting Eligible Agency. 3.3.2.5 Turnaround time for standard written translations shall not exceed fourteen (14) days. Contractor shall indicate an estimated finish date of the final draft at time of request from the Eligible Agency. If a document requires special skills, considered urgent or otherwise critical to the Eligible Agency, the agency and Contractor may agree upon an acceptable delivery time. |
| Alternate language: redline |
Rationale: CyraCom is not bidding on the Document Translation Services portion of this RFP.
State Response
| 3.3.3 |
| Voiceover Translation Services. Voice over translation is an audiovisual conversion of dialogue from one language to another. The Contractor shall: 3.3.3.1 The Contractor shall first translate the original script narrative, and then have a voice talent record the translated language on to the video 3.3.3.2 Contractor shall review each translation prior to delivery to the Eligible Agency to ensure that the translated audio/video is linguistically accurate and consistent with the formatting and technical specifications of the original audio/video. The project will not be considered complete if any inaccuracy or inconsistency is found. 1. In the instance that a Contractor does not understand a phrase/word/technical term or if the Contractor has any questions regarding the audio/video to be translated, the Contractor shall immediately contact the Eligible Agency for any clarifications. 3.3.3.3 For all assignments, the Contractor shall return all original audio/video to the requesting Eligible Agency. 3.3.3.4 The agency and Contractor shall agree upon an acceptable turnaround and delivery timeframe. |
| Alternate language: redline |
Rationale: CyraCom is not bidding on the Voiceover Translation Services portion of this RFP.
State Response
Special Terms and Conditions
| 4.2 |
| Contractor’s Best Pricing. Contractor warrants that, for the term of the Contract, the prices and discounts set out in the APP Items (F) tab OR Attachments titled Pricing, including any subsequent agreed amendment to it (the “Contract Pricing”), shall be equal to or better than the lowest prices and largest discounts, both separately and in combination, at which Contractor sells equivalent services, items of equipment, and materials. |
4.2.1 That price-plus-discount equivalence (“Contractor’s Best Pricing”) is intended to be irrespective of whether or not those other sales have special purchase terms, conditions, rebates, or allowances.
4.2.2 If Contractor’s Best Pricing for equivalent services, items of equipment, and materials is better than the Contract Pricing, then Contractor agrees to adjust the Contract Pricing to match the Contractor’s Best Pricing for all sales related to the Contractor made after the date when the Contractor’s Best Pricing was first better than the Contract Pricing.
4.2.3 For clarification of intent, that date is intended to be the date when the difference first occurred, which might have been before the difference was first identified. If the difference occurred before it was identified, then Supplier agrees to charge less than the Contract Pricing until the extended difference that would have been realized (i.e. if the Contractor’s Best Pricing had been applied when it should have been) has been settled.
Alternate language: Remove verbiage.
Rationale: CyraCom strives to provide the best possible rates to its clients based on their specific requirements. We have developed a competitive rate package for the State of Arizona relative to the current market environment.
State Response
Alternative Language is denied. This language is written by the State Risk Management and it cannot be revised.
| 4.8.5.2 |
| Invoices will be deemed automatically rejected upon delivery if they: are sent to an incorrect address, do not reference the correct State contract and Purchase Order number, or are payable to any Person other than the Contractor. |
Alternate language: Remove verbiage.
Rationale: Invoices shouldn’t be automatically rejected for these reasons. We would need to know if an invoice is rejected along with the reasons why so we can fix it.
State Response
Alternative Language is denied. This language is written by the State Risk Management and it cannot be revised.
| 15.10 |
| Section 508 Compliance. Unless specifically authorized in the Contract, any electronic or information technology offered to the State of Arizona under this Contract shall comply with A.R.S. §18-131 and §18-132 and Section 508 of the Rehabilitation Act of 1973, which requires that employees and members of the public shall have access to and use of information technology that is comparable to the access and use by employees and members of the public who are not individuals with disabilities. |
Alternate language: Redline
Rationale: CyraCom does not comply with section 508 of the Rehabilitation Act of 1973 incorporate accessibility features to the applications that we develop and use to provide interpretation services (Interpreter app, CyraCom VRI portal, etc.) ensuring that this technology is accessible to employees and members of the public with disabilities to the extent it does not pose an “undue burden.”
State Response
Alternative Language is denied. This language is written by the State Risk Management and it cannot be revised.
| 15.11 |
| Cloud Applications. The following are required for Contractor of any cloud solution that hosts State data outside of the State’s network or transmits and/or receives State data. |
15.11.1 Submit a completed Arizona Baseline Infrastructure Security Controls assessment spreadsheet as found at: https://azdohs.gov/information-security- policies-standards-and-procedures, and mitigate or install compensating controls for any issues of concern identified by State. Contractor is required to provide any requested documentation supporting the review of the assessment. The assessment shall be re-validated on a minimum annual basis.
15.11.2 State reserves the right to conduct penetration tests or hire a third party to conduct penetration tests of the Contractor’s application. Contractor will be alerted in advance and arrangements made for an agreeable time. Contractor shall respond to all serious flaws discovered by providing an acceptable timeframe to resolve the issue and/or implement a compensating control.
15.11.3 Contractor must submit a copy of system logs from the cloud system to the State of Arizona security team on a regular basis to be added to the State SIEM (Security Information Event Monitor) or IDS (Intrusion Detection System).
15.11.4 Contractor must employ a government-rated cloud compartment to better protect sensitive or regulated State data.
Alternate Language: None
Rationale: At this time this section is not applicable because CyraCom does not use Cloud based solutions.
State Response
Alternative Language is denied. Please work with Homeland Security after award to confirm these are not applicable.
| 15.11.2 |
| State reserves the right to conduct penetration tests or hire a third party to conduct penetration tests of the Contractor’s application. Contractor will be alerted in advance and arrangements made for an agreeable time. Contractor shall respond to all serious flaws discovered by providing an acceptable timeframe to resolve the issue and/or implement a compensating control. |
Alternate language: Redline
Rationale: CyraCom does not allow clients to conduct penetration testing to our applications and/or environment.
State Response
Alternative Language is denied. This language is written by the State Risk Management and it cannot be revised.
| Addendum B, 1.2 |
| Contractor shall follow the correct, current version of these policies, standards, and procedures. The current website for some of these policies, standards, and procedures is: Information Technology Policies, Standards and Procedures. Note that this link is provided for convenience only. |
Alternate language: None (comment)
Rationale: More time is needed to determine compliance with all information security policies, standards and procedures located in the AZ Department of Homeland Security Information website.
However, CyraCom is ISO 27001 certified.
State Response
Alternative Language is denied. This language is written by the State Risk Management and it cannot be revised.
| Addendum B, 2.1 |
| The State of Arizona information security policies and standards follow the National Institute of Standards and Technology (NIST) Cyber Security Framework (CSF) and NIST SP 800-53 Rev. 5 Security and Privacy Guidelines may currently be located at: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf. |
Alternate language: None (comment)
Rationale: More time is needed to determine compliance with the National Institute of Standards and Technology (NIST) Cyber Security Framework (CSF) and NIST SP 800-53 Rev. 5 Security and Privacy Guidelines However, CyraCom is ISO 27001 certified.
State Response
Alternative Language is denied. This language is written by the State Risk Management and it cannot be revised.
| Addendum B, 2.4 |
| Other forms of Cybersecurity Frameworks (CSF), Trust Documents, Self-Attestations, including, but not limited to, ISO/IEC, SOC 2 & 3, PCI, or HIPAA reports of compliance, may be reviewed as part of the State’s risk assessment, but are not exclusive or conclusive evidence that the Contractor has met the State’s risk assessment requirements. |
Alternate language: redline “reports of compliance”
Rationale: Reports of Compliance are proprietary and confidential. CyraCom provides redacted reports current certifications to as evidence of compliance with frameworks requirements.
State Response
Alternative Language is denied. This language is written by the State Risk Management and it cannot be revised.
| Addendum B, 3.2.3.1 |
| The State of Arizona seeks a partnership with our supporting vendors, therefore, Non-Disclosure Agreements (NDA) for release to review submitted SSP’s, WISP ’s, or written IT policies will not be considered. |
| Alternate language: Redline |
Rationale: CyraCom deems its internal policies, procedures, standards, etc. proprietary and confidential. CyraCom will make these available via video conferencing as needed. CyraCom requires a fully sign NDA between CyraCom and third-parties to share proprietary information/documents.
State Response
Alternative Language is denied. This language is written by the State Risk Management and it cannot be revised.
| Addendum B, 3.3 |
| The State reserves the right to conduct risk assessments, vulnerability assessments, black-box penetration tests or hire a third party to conduct risk assessments, vulnerability assessments, and black-box penetration tests of the Contractor’s environment. Contractor will be alerted in advance and arrangements made for an agreeable time. Contractor shall respond to all flaws deemed serious by the State when discovered by providing an acceptable timeframe to resolve the issue and/or implement a compensating control(s). |
Alternate language: Redline
Rationale: CyraCom does not allow clients to conduct penetration testing to our applications and/or environment.
State Response
Alternative Language is denied. This language is written by the State Risk Management and it cannot be revised.
| Addendum B, 3.5.1, 3.5.2, 3.5.3, 3.5.4, 3.5.10, 3.5.11, 3.5.13, 3.5.14, 3.5.15, 3.5.16, 3.5.19, 3.5.20 |
| 3.5.1 State of Arizona statewide policies, standards and procedures: https://azdohs.gov/information-technology-it-policies-standards-and-procedures |
3.5.2 Federal Information Security Modernization Act of 2014 (FISMA): https://csrc.nist.gov/topics/laws-and-regulations/laws/fisma
3.5.3 OMB Circular A-130: https://www.federalregister.gov/documents/2016/07/28/2016-17872/revision-of-omb-circular-no-a-130-managing-information-as-a-strategic-resource
3.5.4 National Cyber Strategy of the United States of America: https://www.cisa.gov/executive-order-strengthening-cybersecurity-federal- networks-and-critical-infrastructure;
3.5.10 A.R.S. §18-104 - Arizona Department of Administration, Arizona Strategic Enterprise Technology (ADOA-ASET), Powers and duties of the agency: https://www.azleg.gov/arsDetail/?title=18
3.5.11 A.R.S. §18-105 - Statewide Information Security and Privacy Office (SISPO): https://www.azleg.gov/viewdocument/?docName=http%3A//www.azleg.gov/ars/18/00105.htm
3.5.13 A.R.S. §18-552 - Notification of security system breaches; requirements; enforcement; civil penalty; preemption; exceptions: https://www.azleg.gov/ars/18/00552.htm
3.5.14 Arizona Executive Order 2008-10 – Mitigating Cyber Security Threats: https://aset.az.gov/node/192
3.5.15 SIPC Memorandum of Understanding (MOUhttps://www.sipc.org/about-sipc/
3.5.16 State Environmental policies: https://azdeq.gov/LawsAndRules
3.5.19 Incident Response Reporting program and system: https://aset.az.gov/sites/default/files/P8240 Incident Response Planning_Sept2018_0.pdf
3.5.20 Privacy Incident Reporting policy and standards: https://aset.az.gov/sites/default/files/STANDARD 8240 INCIDENT RESPONSE PLANNING.pdf Alternate language: None (comment)
Rationale: More time is needed to determine compliance with all the requirements of section 3.5.
However, CyraCom can provide its ISO 9001 and ISO 27001 certifications as evidence of compliance with ISO Standards for Quality Management Systems requiring compliance with all statutory requirements and Information Security Management Systems demonstrating compliance with industry best practices for confidentiality, integrity, and availability of data.
State Response
Alternative Language is denied. This language is written by the State Risk Management and it cannot be revised.
| Addendum B, 3.5.17 | |
| Family Education | Rights Privacy Act (FERPA): https://www2.ed.gov/policy/gen/guid/fpco/ferpa/index.html?src=rn; |
| Alternate language: Redline |
Rationale: This section is not applicable to CyraCom’s provision of services.
State Response
Alternative Language is denied. This language is written by the State Risk Management and it cannot be revised.
| Addendum B, 3.5.18 |
| Driver’s Privacy Protection Act (DPPA): https://azdot.gov/motor- vehicles/driver-services/driver-license-information/motor-vehicle-records; |
| Alternate language: Redline |
Rationale: This section is not applicable to CyraCom’s provision of services.
State Response
Alternative Language is denied. This language is written by the State Risk Management and it cannot be revised.
| Addendum B, 3.5.21 |
| State of Arizona Library, Archives and Public Records, Records Management Division, General Retention Schedules https://azlibrary.gov/arm/policies |
| Alternate language: None (comment) |
Rationale: The link to the State of Arizona Library, Archives and Public Records, Records Management Division, General Retention Schedules requires permission from site administrators. Therefore, the requirement could not be reviewed. However, CyraCom can provide its ISO 9001 and ISO 27001 certifications as evidence of compliance with ISO Standards for Quality Management Systems requiring compliance with all statutory requirements.
State Response
Alternative Language is denied. This language is written by the State Risk Management and it cannot be revised.
| Addendum B, 3.5.22 |
| Payment Card Industry (PCI) Security Standards including but not limited to Supplemental Documents, Information Supplements and Validation Requirements: https://www.pcisecuritystandards.org. |
| Alternate language: Redline |
Rationale: This section is not applicable to CyraCom’s provision of services.
State Response
Alternative Language is denied. This language is written by the State Risk Management and it cannot be revised.
Uniform Terms and Conditions
| Exhibit A, 1.3.1, a and b |
| a. The policy shall include coverage for Sexual Abuse and Molestation (SAM). This coverage may be sub-limited to no less than $500,000. The limits may be included within the General Liability limit or provided by separate endorsement with its own limits. If you are unable to obtain SAM coverage under your General Liability because the insurance market will not support it, it should it be included with the Professional Liability. |
b. Contractor must provide the following statement on their Certificate(s) of Insurance: “Sexual Abuse and Molestation coverage is included” or “Sexual Abuse and Molestation coverage is not excluded.”
Alternate language: Remove verbiage
Rationale: CyraCom does not have this insurance.
State Response
11/30/23
Alternative Language is accepted.
Please Note that if in-person services are ever offered, this insurance must be submitted.
| Exhibit A, 1.3.4, a. |
| a. If SAM coverage is being provided under this policy then Contractor must provide the following statement on their Certificate(s) of Insurance: “Sexual Abuse and Molestation coverage is included” or “Sexual Abuse and Molestation coverage is not excluded.” This coverage may be sub-limited to no less than $500,000. |
Alternate language: Remove verbiage
Rationale: CyraCom not have Sexual and Molestation insurance. If this is mandatory then we will not be able to offer OSI. OPI and VRI wouldn’t need this coverage.
State Response
11/30/23
Alternative Language is accepted.
Please Note that if in-person services are ever offered, this insurance must be submitted.
| X |
| X |
| Alternate language: X |
Rationale: X
File details come from the government source that posted it. Updated .