BPM005734_Off_Site_Secure_Printing_Scope.pdf

PART 2: Table of Contents

Technical and Commercial

Request for Proposals

Solicitation No.

BPM005734

Description:

Off Site Secure Printing

Arizona Department of

Public Safety

2102 W. Encanto Blvd., Phoenix, Arizona 85009

PART 2 of the SOLICITATION:

TABLE OF CONTENTS:

SECTION 2-A: SCOPE OF WORK (TECHNICAL DOCUMENT) 2

1.0 Background 2

2.0 Purpose 2

2.0 General Requirements 3

3.0 Specific Requirement 4

4.0 Security 9

☐ Low Impact Data (AZRAMP 125 / NIST Low Impact) 11

☐ Moderate Impact Data (AZRAMP 325 / NIST Moderate Impact 11

5.0 Testing/Acceptance/Implementation 11

6.0 Process Flow 14

7.0 What Offeror and AZDPS Will be Responsible For 15

8.0 Warrant/ Remedies 16

9.0 Ordering Process 17

10.0 Reporting Requirements 17

11.0 Exhibits to the Scope of Work 18

SECTION 2-B: COMPENSATION DOCUMENT 19

1.0 Compensation 19

Compensation Method

2.0 Pricing 20

3.0 Invoicing 20

4.0 Payments 22

5.0 Exhibits to the Compensation Document 22

BPM005734

Description:

Off Site Secure Printing

Arizona Department of

Public Safety

2102 W. Encanto Blvd., Ste 270

SECTION 2-A: Scope of Work

Date: 10-17-23

Section 2-A:

Scope of Work

(Technical Document) Date: 10-17-23

Statement of Need Pursuant to A.R.S. § 13-3112, Title 41 Chapter 12 Article 3.1, Title 32 Chapter 24, Title 32 Chapter 26, the Arizona

Department of Public Safety (AZDPS) is required to issue concealed weapon permits (CWP), certificate of firearms proficiency (LEOSA permits), fingerprint clearance cards (FCC), and licensed security guard and private investigator (SG/PI) identification cards. AZDPS is seeking competitive proposals for card design, production, and fulfillment of physical credentials.

1.0 Background

The Arizona Department of Public Safety (AZDPS) Technical Services Division (TSD) currently provides statewide wide as well as in some cases US wide: Security Guard identification cards (SG), Private Investigator identification cards (PI), Fingerprint Clearance cards (FCC), Concealed Weapons Permit cards (CWP), and Certificate of

Firearms Proficiency cards( CFP). Current success of the AZDPS secure identification card program provide: quick response; emergency turn around for card replacement.

The Arizona Department of Public Safety, as authorized under A.R.S. § 41-2501 et seq. is seeking to establish one or more Contracts to provide Off Site Secure Printing.

In the past three years, AZDPS has issued an annual average of approximately 90,000 concealed weapons permits and certificates of firearms proficiency, 200,000 fingerprint clearance cards, and 30,000 security guard and private investigator identification cards. These averages represent a 30% increase in total credentials issued from 2019-2022.

Each issued credential is accompanied by a corresponding form letter specific to the type of credential. Approved credential requests will be sent to the Offeror to produce and mail to the customer with the appropriate accompanying letter. The solution provided shall have the capacity to support the existing volume and an annual increase of up to 20 percent. The Offeror shall also have the ability to increase printing volume due to potential unknown legislative mandates or other circumstances outside of AZDPS’s control.

2.0 Purpose

2.1. The purpose of this Solicitation is to provide sufficient guidance and information for interested parties to submit offers for off site secure printing to include card design, production, letter submission, and fulfillment of physical credentials.

2.2. It is the intent of the ADPS to award to one or more suppliers to meet the requirements of AZDPS and reserves the right to award this contract in part to multiple suppliers or partial and/or ancillary services to a single supplier. The award will depend on the quality of the bids, the suppliers qualifications, expertise and capabilities and the ability to provide the required product/service.

2.3. The Arizona Department of Public Safety (AZDPS) anticipates awarding contract(s) with the intent to secure service coverage. Whether or not it actually enters into any contracts, how many contracts it enters into, and

BPM005734

Description:

Off Site Secure Printing

Arizona Department of

Public Safety

2102 W. Encanto Blvd., how the work is awarded between those contracts are all at AZDPS’s discretion. Furthermore, AZDPS will use any awarded contracts on an as-needed basis, with no guarantee as to its actual spending under them.

2.4. AZDPS reserves the right to accept any item or combination of items specified in the Solicitation, unless the

Offeror expressly restricts an item or combination of items in its Offer, and conditions its response on receiving all items for which it provided a proposal. In the event of such restriction, AZDPS will evaluate if an award on such a basis will result in the best value and is in the best interest for AZDPS. AZDPS may otherwise determine, at its sole discretion, that such restriction is non-responsive and deem the Offeror ineligible for further evaluation.

2.5. Availability of Funds: Funds may not presently be available for performance under this Contract. No legal liability on the part of the State for any payment may arise under this Contract, until funds are made available for performance of this Contract.

2.0 General Requirements

2.1 The Offeror shall provide a solution that includes all equipment, hardware, software/firmware, facilities, material, personnel, services, security, reports, training, support and all other items required to provide credential cards and letters to authorized requestors.

2.2 The Offeror shall propose comprehensive recommendations for establishing efficient and secure data transmission channels and integration. Recommendations shall include preferred data types, formats and transmission systems.

2.3 The Offeror shall produce and mail credentials & accompanying letters to customers.

2.4 The Offeror shall have the capacity to support the existing credential production volume and an annual increase of up to 20 percent.

2.5 The Offeror shall provide adequate numbers of appropriately qualified and authorized personnel as necessary to carry out the Services successfully;

2.6 The Offeror shall assign, at minimum, the key personnel identified in the Accepted Offer to the positions, roles, and/or duties indicated therein;

2.7 All personnel assigned to support AZDPS are to have successfully passed background checks and fingerprint clearance.

2.8 The Offeror shall have the ability to support increased production volume resulting from potential future legislative mandates or other circumstances outside of AZDPS’s control.

2.9 The Offeror must be able to demonstrate how their solution addresses each item outlined in the

American Association of Motor Vehicle Administrators DL/ID Card Design Standard Document Pgs-42-

45 Exhibit I…. (https://www.aamva.org/getmedia/99ac7057-0f4d-4461-b0a2-3a5532e1b35c/AAMVA-

2020-DLID-Card-Design-Standard.pdf).

2.10 The Offeror shall provide all necessary printer device drivers, software necessary to produce credentials, and all other products, and/or services to effectively perform the required services in accordance with the scope of work.

2.11 The Offeror shall produce and mail Security Guard identification cards, Private Investigator identification cards, Finger Print Clearance cards, Concealed Weapons Permit cards, Certificate of

Firearms Proficiency card as well as letters from the Offeror-managed Central Card Production

Facility (CCPF) location to the Customers location.

https://www.aamva.org/getmedia/99ac7057-0f4d-4461-b0a2-3a5532e1b35c/AAMVA-2020-DLID-Card-Design-Standard.pdf https://www.aamva.org/getmedia/99ac7057-0f4d-4461-b0a2-3a5532e1b35c/AAMVA-2020-DLID-Card-Design-Standard.pdf

BPM005734

Description:

Off Site Secure Printing

Arizona Department of

Public Safety

2102 W. Encanto Blvd.,

2.12 The Offeror shall be capable of communication to receive a one way batch communication to produce the required cards and letters. The Offeror will provide an acknowledgement receipt. The one way real time batch transmission communication from AZDPS, could be continuous or could occur multiple times a day.

2.13 The Offeror shall produce and mail CWP, FCC, and SG/PI credentials & accompanying letters from the

Contractor-managed Central Card Production Facility (CCPF) location to the customers.

2.14 Offerors shall be capable of meeting or exceeding all specifications and are compelled to fulfill other requirements contained herein before any proposal will be considered. The successful offeror will have verifiable substantial experience before any proposal will be considered. The successful offeror will have verifiable substantial experience.

2.15 For evaluation purposes Offeror should submit any certifications, documentation and additional information that affirms compliance to this section with their offer.

3.0 Specific Requirement

3.1 Credential Card Production Facility (CCPF)

3.1.1 The CCPF shall be owned and operated by the Offeror. The CCPF shall be staffed and operated by personnel provided by the Offeror. The CCPF shall be accessible to the AZDPS and other staff or entities authorized by the AZDPS in an auditing and inspecting capacity with prior notice to the Offeror. The CCPF shall provide access and resources to the AZDPS to conduct back-end auditing and regular performance reviews. Per 3.13 of the Uniform T’s & C’s work shall be performed within the defined territories of the United States.

3.1.2 The CCPF shall be self-sufficient in the event of an outage. Self- sufficiency features may be of a temporary nature that must allow for continued production of credentials for short-term outages. For power outages or other issues expected to last beyond 24 hours, the provision of a self-sufficiency capacity must be utilized to ensure a smooth, uninterrupted transfer of production capacity to a backup facility or backup facilities (backup facility).

3.1.3 The Offeror’s backup facility shall meet the same requirements as the Offeror’s main facility.

The backup facility shall ensure the uninterrupted credentials manufacturing and production.

The backup facility shall have the capability of manufacturing, personalization, and mailing of credentials should the primary CCPF become inoperable.

3.1.4 The Offeror’s backup facility shall be able to receive secure personal data required for credential production and shall have sufficient consumables securely stored at this facility to meet the daily demand credential production until the primary CCPF becomes fully operable.

The facility must provide credential manufacturing and production services identical to the primary CCPF.

3.1.5 At no cost to the AZDPS, the Offeror shall periodically engage the services of a qualified third party to conduct a physical security and data security assessment of the CCPF. The first of these assessments shall be within six (6) months of the approval of implementation. Upon completion of this assessment, the third party will provide a final report to the Offeror who will review it with the AZDPS. Subsequent physical and data security assessments shall be performed every two (2) years.

3.1.6 The Offeror shall ensure the complete security and privacy of personal data utilized for credential production. Any data temporarily stored within the CCPF must be inaccessible through the theft or loss of any component including IT equipment. The Offeror shall produce a

BPM005734

Description:

Off Site Secure Printing

Arizona Department of

Public Safety

2102 W. Encanto Blvd., report certifying the date and time of deleting, destroying, and erasing all temporary stored information.

3.1.7 A single unplanned system outage for all in-scope software and hardware components resulting in a loss of production shall not exceed more than four (4) consecutive hours during

Standard Hours of Operation. Unplanned system outages for all in-scope software and hardware components shall not exceed a combined total of eight (8) hours during Standard

Hours of Operation per calendar month. Any instance where the Offeror does not meet those requirements, the Offeror will be subject to liquidated damages as listed below:

(a) Single unplanned outage occurrences exceeding four (4) consecutive hours: $500.00 per occurrence.

(b) Combined unplanned outages per calendar month exceeding eight (8) hours per month: $500.00 per hour for every hour exceeding 8 hours per month.

3.2 Credential Production

3.2.1 The Offeror shall provide a secure CCPF and secure communication portal to electronically transfer information. that will be utilized throughout the term of the contract. The CCPF shall have the necessary personnel and equipment to produce credentials; place them in individual mailers; and sort, package and distribute them in the most efficient and economical process per United States Postal Service (USPS) requirements for First Class delivery.

(a) CCPF personnel shall produce finished credentials and then enter them in the USPS mail system for transit within one (1) calendar day of receiving the daily files AZDPS uploaded to the CCPF.

(b) Postage fees shall be processed as a pass-through cost. Prices may be adjusted per postage rate as approved by the U.S. Postal Regulatory Commission

(https://www.usps.com/business/prices.htm).

(c) On average, approximately 100 customers a year are located outside of the United

States. These customers require international shipping, which the Offeror may elect to provide at no additional cost to AZDPS. If the Offeror does not provide international services, they shall mail the credential to AZDPS.

(d) Saturdays, Sundays, and State of Arizona observed holidays will not be included in the one (1) calendar day.

(e) Failure to meet the mailing requirements set forth in this Scope and per statue, will subject the Offeror to liquidated damages of $1.00 per credential per day.

3.2.2 The Offeror’s mailing and delivery solution shall ensure the efficiency, security, and quality of the delivery of the credentials.

3.2.3 Mail return process: Offeror shall ensure that return address for all mailed credentials that are returned by USPS, has the identified AZDPS address.

3.2.4 The Offeror shall provide in-depth reports relating to card manufacturing, production, mailing of the credentials and problems encountered/corrective actions taken by the Offeror. The format of these reports to be submitted is at the discretion of AZDPS and may be subject to change.

See Exhibit II - Sample Production Report.

https://www.usps.com/business/prices.htm

BPM005734

Description:

Off Site Secure Printing

Arizona Department of

Public Safety

2102 W. Encanto Blvd.,

3.2.5 The Offeror shall collect, log and physically destroy any in error credentials as directed by the

AZDPS. The Offeror shall make available a report which lists destroyed credentials and provide certification of destruction for returned mail items.

3.2.6 The Offeror shall provide a secure portal with a log in process, by which AZDPS can retrieve and review the front and back of each printed credential and the date it was printed.

3.2.7 Throughout the card manufacturing, production and/or personalization process, the Offeror shall provide Quality Assurance methods that ensure a high level of production quality and data accuracy. The QA methods shall also ensure the quality and accuracy of printed information on accompanying letters and card carriers (envelope) with that of the card.

3.2.8 The Offeror shall create and maintain a plan to safeguard the personal information used for credential production throughout the production cycle.

3.2.9 Audit Trail Requirements

(a) The Offeror shall maintain auditable system logs regarding the general operation of the system including all printer system operation activities.

(b) The Offeror shall make printer system logs available to AZDPS for inspection in real-time.

(c) The Offeror shall store printer system logs for six (6) months using Advanced

Encryption Standard (AES) encryption, to prevent tampering and unauthorized access.

3.3 Card Design

3.3.1 Pursuant to Arizona Revised Statutes (ARS) and Arizona Administrative Codes (AAC) listed below, the Offeror must be able to accommodate all, or a combination of, the data elements listed on Exhibit 2 - Credential Data Elements on each printed credential. These required fields do not represent an exhaustive list. AZDPS may require additional information to be present on printed credentials.

(a) ARS 41-1758.04 (FCC)

(b) ARS 32-2461 (SG/PI

(c) AAC R13-2-104 (SG/PI)

(d) ARS 32-2633 (SG/PI)

(e) ACC R13-6-104 (SG/PI)

(f) ACC R-9-203 (CWP)

(g) ACC R-13-9-403 (LEOSA Permit)

3.3.2 The Offeror shall be required to comply with future changes to Arizona Revised Statutes or

Arizona Administrative Code that require provision to credential design or production.

3.3.3 The Offeror’s shall provide personal to participate and provide expertise to a card design team.

3.3.4 AZDPS will include member/s as needed to support a card design team.

3.4 Credential Design Requirements

3.4.1 This section highlights the construction and security requirements for the credentials to be produced. The descriptions and items are neither mutually exclusive nor collectively exhaustive. The material reflects considerations representative of those that may be incorporated in the Offeror designs and construction.

BPM005734

Description:

Off Site Secure Printing

Arizona Department of

Public Safety

2102 W. Encanto Blvd.,

3.4.2 One primary objective of central issuance is security and integrity of the credentials issued by

AZDPS on behalf of the State of Arizona. AZDPS therefore requires the Offeror to place a high degree of emphasis on the design of integrated security features, to create a credential with a high degree of security that earns a high level of trust and shall consider security of the proposed credentials with the highest scrutiny.

3.4.3 AZDPS and the Offeror shall establish a Credential Design Team (CDT) to remain active throughout the contract period. The Offeror shall provide at minimum one (1) subject matter expert to participate on this team that is responsible to safeguard the AZDPS’s Credentials.

The CDT shall at a minimum, be comprised of the following key personnel:

(a) The Offeror’s Representative(s)

(b) Additional AZDPS staff as needed

3.4.4 The CDT shall meet on an as needed basis.

3.4.5 If modifications are made to the card design, the Offeror shall provide AZDPS with five (5) examples of each unique credential type being modified.

3.5 Credential Types

3.5.1 All credential types are referenced in Exhibit III– Sample of Current Credential Cards

3.5.2 AZDPS reserves the right to modify or add additional credential material, types, formats, and designs at any time during the term of the contract. AZDPS and Offeror will negotiate a fair and reasonable cost.

3.5.3 In the event of a change to a credential design, proposed credential designs and layouts of sample, AZDPS -specific designs shall be approved by AZDPS in writing prior to production.

3.5.4 Each credential shall be mailed with a designated form letter that is specific to the credential type and customer. The content and format of each letter will be determined and provided by

AZDPS.

3.6 Credential construction

3.6.1 The Offeror shall maintain a detailed description of the following:

(a) Card construction and security features.

(b) Static security features places upon or within cards.

(c) Means and methods of application of personalization data.

(d) Ability to resist tampering.

3.6.2 Offeror shall provide examples of each credential card and letter for AZDPS approval (color and or black and white on the front…black and white on the back of all cards)

3.6.3 The Offeror shall provide AZDPS with three sets of all proposed card samples. The samples shall consist of horizontal samples representing each of the credential card type or design proposed.

3.6.4 The card samples do not have to be Arizona-specific design, but the card samples provided shall fully depict the proposed card type/construction/printing method, and shall be produced on equipment identical to that which the Offeror is proposing to use for the CCPF.

BPM005734

Description:

Off Site Secure Printing

Arizona Department of

Public Safety

2102 W. Encanto Blvd.,

3.6.5 The credential card samples shall include the required data fields as outlined in The Credential

Data Elements spreadsheet (Exhibit IV) and shall include the proposed security features. Card samples shall be produced using the materials, substrates, construction and printing methods proposed.

3.6.6 If the Offeror proposes optional security features, the Offeror shall provide thirty (30) separate card samples that contain the optional security features and clearly identify them as such.

3.6.7 All card samples submitted shall be blind samples, meaning they must not indicate in any way which Offeror produced them.

3.6.8 The card samples shall be delivered at any time before the Bid Due Date and Time to the address below:

(a) AZDPS Procurement

Attention: Melanie Guyette

2102 W. Encanto Blvd.

Mail Drop 1230 PO Box 6638

Phoenix, AZ 85009

3.6.9 AZDPS will have final authority to determine card design, and acceptance of card designs.

3.6.10 Upon completion and approval of any/all card designs, customized holographic laminates, or other card security features, AZDPS shall exclusively and perpetually own all designs, diagrams, layouts, artwork or similar materials. The Offeror shall promptly provide acknowledgement or assignment in a tangible form, satisfactory to AZDPS, to evidence the

AZDPS’s sole ownership and provide information to AZDPS. The Offeror shall be required to copyright these designs or original artwork in the name of AZDPS and the State of Arizona.

3.7 Personalization Data Elements

3.7.1 Personalization fields are considered unique to the individual card holder and therefore require the utmost protection from compromise by substitution or alteration attempts. Photo images shall be regarded as personalization fields.

3.7.2 Field layout positions for the credential must provide for simplified examination and readability.

3.8 Materials Requirement

3.8.1 The Offeror shall use an inventory management system to track and report the disposition of raw materials.

3.8.2 The Offeror shall report and reconcile raw material inventory for:

1. Credentials issued

2. Credentials rejected in production

3. Credentials destroyed

4. Credentials returned

5. Credentials used in demonstrations

6. Credentials used in trainings

7. All other credential uses

BPM005734

Description:

Off Site Secure Printing

Arizona Department of

Public Safety

2102 W. Encanto Blvd.,

8. Unused raw materials inventory

3.8.3 The Offeror shall disclose in writing the manufacturer and supplier of all consumable materials.

The Offeror shall notify AZDPS in writing prior to any changes of manufacturer and/or supplier.

Any changes in consumable material shall meet or exceed AZDPS’s requirements.

3.8.4 Offeror shall provide a highly durable card that is capable of surviving a minimum 6-year life cycle.

3.8.5 The construction of the card material shall be conducted in secured facilities with adequate inventory controls and with minimum human handling.

3.8.6 Offeror will utilize the same card stock for all credential cards.

3.8.7 Offeror will provide a letter with each card utilizing basic paper and envelope.

4.0 Security

4.1 Offeror will provide the same security features for all credential cards (same impression/holograph)

4.2 As requested by AZDPS, the Offeror shall accommodate change(s) to security features during the period of the contract in an attempt to prevent compromise of card security. The ability to change security features should be done at minimal incremental cost to AZDPS.

4.3 Credential security shall be verifiably authentic through two (2) levels of inspection:

4.3.1 Level One – Easily identifiable visual or tactile features for rapid inspection at prominent of usage without tools or aids.

4.3.2 Level Two – Examination by trained inspectors with simple equipment (magnifying glass, UV light, machine reading equipment, etc.).

4.4 Offeror will inform AZDPS of any material discrepancies.

4.5 Card security features shall be counterfeit resistant and protect the information contained on the card from tampering.

4.6 Card security features may be included as durable laminate or embedded within the card body as appropriate and shall be integrated with the card design.

4.7 The Offeror’s design shall include at least one (1) proprietary security feature or material that cannot be purchased duplicated or altered by anyone attempting to make a fraudulent credential.

4.8 The Offeror shall provide a security plan documenting security methods to have zero precent fraudulent use of all hardware, software, consumable and license documents. Included in this plan will be the

Offeror’s security recommendations. Once the plan is finalized to the satisfaction of AZDPS, performance of the Offeror that is not consistent with the plan shall be considered a material breach of contract.

4.9 To support standardized, interoperable IT environments, the state developed enterprise architecture

(EA). The EA and subsequent standards can be accessed through the Arizona Strategic Enterprise

Technology (ASET) web page at http://aset.azdoa.gov/security/policies-standards-and-procedures.

Technical solutions developed by the Offeror shall conform to AZDPS standards and to ASET EA standards.

4.10 Statewide IT Policies, Standards, and Procedures located at https://aset.az.gov/policies- standards-and-procedures https://aset.az.gov/resources/policies-standards-and-procedures https://aset.az.gov/policies-standards-and-procedures https://aset.az.gov/policies-standards-and-procedures https://aset.az.gov/policies-standards-and-procedures

BPM005734

Description:

Off Site Secure Printing

Arizona Department of

Public Safety

2102 W. Encanto Blvd.,

4.11 The Offeror shall create and maintain administrative security procedures to prevent unauthorized dissemination of PII.

4.12 Directory Services or Federated Authorization shall be utilized by Offeror’s authorized personnel for authentication if supported by the system.

4.13 Credential/template design and configuration functions must be secured independently from the printer operation/management console. The printer operator shall not have access to the printer configuration, credential configuration and design objects.

4.14 Remote Administrative Access for Offeror Personnel: If the printer supports a web-based interface that allows administrators to view or change status or configuration information, the interface shall:

(a) Use AES encryption.

(b) Authenticate authorized users based upon user ID and a strong password, and through the use of two factor authentication managed by the AZDPS.

(c) Use SSL/TLS (https) encryption.

(d) Offeror shall not connect to the system from outside AZDPS’s network except for approved remote access from AZDPS.

4.15 Logging into the web interface of the printer without HTTPS is not permitted.

4.16 Insecure protocols such as Telnet, FTP, and TFTP shall not be enabled to access to the printer.

4.17 Offeror shall provide their security plan/process for AZDPS review and approval.

4.18 Any incident or event that affects the confidentiality, integrity, and/or availability of AZDPS information or business essential infrastructure shall be reported to the AZDPS immediately as required by federal regulations and state statutes, policies and standards.

4.19 Application Security: The ID printer software application must support role-based access control and provide for separation of duties. The Offeror shall provide the details of the system’s security access controls.

4.20 Disk Encryption: If the printer solution contains any non-volatile storage drives, the drives shall support and be configured for full disk encryption such that if the hard disk is removed from the system the encrypted information on the disk shall not be readable. The encryption that shall be used is the AES

Algorithm either 128 or 256 bit, as specified in Federal Information Processing Standard Publication

197, AES.

4.21 Automatic Disk Wiping: The storage drives shall enable automatic disk wiping where the printer will automatically delete resident data after an administrator configured interval.

4.22 Personnel: AZDPS must approve and authorize all Offeror’s personnel requiring access to the printer, consumables, printer control and administrative logons,

(a) The Offereor’s personnel, as well as any sub-contractor personnel, who have administrative access to AZDPS’s computing resources, AZDPS information or proximity access to sensitive IT areas shall be subject to the following at no cost to

AZDPS:

i. Background checks: Criminal History Report with fingerprints per 2.7

(background/fingerprint).

BPM005734

Description:

Off Site Secure Printing

Arizona Department of

Public Safety

2102 W. Encanto Blvd.,

ii. Identity and Address Verification: Verifies the employee is who he or she claims to be including verification of the candidate’s present and previous addresses.

iii. Employment eligibility check. Reference check.

(b) Mandatory security training provided or approved by the AZDPS shall be completed on a bi-annual basis.

(c) The Offeror shall provide supporting evidence of their compliance with the Personnel requirements listed above to AZDPS annually.

4.23 Physical Security: The primary and Disaster Recovery CCPF locations must engage in a high level of physical security

4.24 AZDPS and the Offeror shall establish a Card Design Security Program (CDSP) in addition to the

Credential Design Team (CDT) that will remain active throughout the contract period and that is responsible for the following:

4.24.1 A quarterly assessment of returned card that failed the intended card life and preparing a report of the findings. The report must include the number of cards failed and an explanation for the failure.

4.24.2 An annual review of the card design to determine resistance to compromise and fraudulent activity attempts.

4.24.3 Maintaining card security and modifying security features.

4.25 At a minimum the CDSP will follow the requirements of the Credential Design team outlined in 3.4.3.

4.26 Offerors are required to complete and pass the Arizona Mandatory Control Baseline Prerequisite

Assessment (https://azdohs.gov/file/4357) and submit as part of their Offer. Arizona Department of

Homeland Security (AZDOHS) Cyber Command will evaluate and rank submitted Arizona Baseline

Infrastructure Security Controls for completeness, attention to detail, and understanding of NIST security controls and framework. AZDOHS Cyber Command will forward assessment results and recommendations to the Procurement Officer. Results of these IT security control reviews are for internal use only and will not be shared with responding bidders, though the results may be used by the

Procurement Officer to determine Offeror susceptibility for award.

4.26.1 Pursuant to State Data Classification Policy P8110, and the Data classification defined in the

Special Terms and Conditions, the Contractor will have access to the following type of

Data as part of its work under the Contract:

☐ Low Impact Data (AZRAMP 125 / NIST Low Impact)

☐ Moderate Impact Data (AZRAMP 325 / NIST Moderate Impact

5.0 Testing/Acceptance/Implementation

5.1 Offeror will provide a proposed project implementation plan for review and acceptance by AZDPS. The proposed implementation plan is to be presented to AZDPS within 2 weeks after contract award.

5.2 Project plan will include schedule for tasks to be completed and implementation milestones including card design timeline.

5.3 AZDPS and Offeror shall each assign a project manager responsible for coordinating the implementation of the solution.

https://azdohs.gov/file/4357 https://azdohs.gov/information-security-policies-standards-and-procedures

BPM005734

Description:

Off Site Secure Printing

Arizona Department of

Public Safety

2102 W. Encanto Blvd.,

5.4 Implementation shall include acquisition, installation, setup, and configuration of the CCPF, including all hardware, software, production and mailing equipment, and materials. It shall also include, but is not limited to, card design, testing, and the Final Acceptance Test.

5.5 Offeror shall provide AZDPS with status reports and status meetings on a mutually agreed regular schedule.

5.6 Offeror and AZDPS will jointly test and complete an operational changeover, if required, that will ensure a minimum disruption to AZDPS’s customers, both internal and external.

5.7 AZDPS intends the proposed Offeror’s solution to be operational 180 days or sooner, from and after award, for the production and fulfillment of AZDPS’s credentials.

5.8 Solution Testing – All Phases

5.8.1 The following are the various levels of testing that may be required for this contract. Each level of testing (except final acceptance testing) shall only be deemed acceptable upon written documentation provided by the Project Manager. During any time of any testing period regardless of level, any corrections or remedies shall be provided and performed by the

Offeror at no cost to AZDPS.

5.8.2 System level testing/integration testing is to be performed upon deployment of any modifications.

5.8.3 Testing shall demonstrate that the product(s) operate as agreed upon and warranted and that the product is compatible within AZDPS’s technical environment.

5.8.4 Testing of the basic functionality and operation of the proposal.

5.8.5 User testing: Once initial planning, design and installation have been completed, user testing shall commence.

5.9 Final Acceptance Testing (FAT)

5.9.1 Upon successful completion of the above mentioned tests, the FAT shall be started and will be conducted as part of the pilot rollout. This test shall consist of a 30-day test period including at least two reiterations of testing and possibly more pending results of operations without major failure of the Offeror-supplied goods or services. The purpose of the test is to demonstrate that the total system (hardware, software, materials and installation) is properly installed, is free from identified problems, exhibits stable and reliable performance, and complies with the contract documents.

5.9.2 This test shall fully demonstrate all functions required in this SOW. The Offeror may choose to suggest tests and shall be responsible for all testing. The Offeror shall demonstrate successful interface of all equipment with AZDPS-managed computer interfaces. During the FAT, the

Offeror shall ensure that all equipment is in operable condition. The Offeror shall troubleshoot, diagnose, identify, and isolate hardware and software problems and inconsistencies. The

Offeror shall formulate possible solutions and implement all corrections required in the Offeror furnished goods. AZDPS shall make corrections of problems in software and/or equipment not furnished by the Offeror.

5.9.3 The Offeror shall provide on-site personnel (at Offeror’s printing location) to operate the system “exercising” all functions. The Offeror shall provide test equipment and labor needed to test, isolate, correct, and repair all deficiencies found during the test. Key technical personnel familiar with the design and installation of each major system component shall resolve all as specified below:

BPM005734

Description:

Off Site Secure Printing

Arizona Department of

Public Safety

2102 W. Encanto Blvd.,

(a) Trouble Repair and Resolution Time: For all in-scope software and hardware components, the Offeror shall analyze the problem, isolate the trouble to the affected component, and complete the required repair(s) within (4) four hours from the time the initial problem was reported. The Offeror shall track repair progress and escalate problems with the respective provider/distributor if not cleared by the commitment time. The Offeror shall case manage the trouble through resolution and will contact the authorized AZDPS representative(s) with progress reports, verify that repairs are complete, and close the trouble report(s) with AZDPS.

5.9.4 All system documentation errors, omissions, and changes occurring prior to and during the

FAT shall be corrected and resubmitted before acceptance is complete.

5.9.5 Test failures of the FAT shall be distinguished as either “minor” or “major” as described below.

In the event of a minor failure, the testing will be halted until such time that the failure is corrected. Once the failure is corrected, the test will resume for the remainder of the thirty (30) day period. For each restart, the 30-day test shall be extended by one (1) day after the remediation is complete. In the event of a major failure, the testing will be halted until such time that the failure is corrected. Once the failure is corrected, the test will recommence but will be reinitialized to Day One (1). AZDPS reserves the right to categorize any failure mode not specifically addressed here as it sees fit.

5.9.6 Minor Failures:

(a) Interference with project operations due to any force majeure event (refer to Section 02

– Uniform Terms and Conditions, paragraph 6.4 Force Majeure), power failure, communications circuit failure, or lightning strike.

(b) Failure of equipment or software supplied by others. AZDPS shall make the necessary correction to any AZDPS-managed equipment or software.

(c) Failure to complete the objective of any test scenario due to lack of adequate documentation for equipment supplied by the Offeror. Failed tests shall be re- tested with revised documentation.

5.9.7 Major Failures:

(a) Any significant failure of data exchange or major hardware component.

(b) Failure of any hardware or data exchange for eight (8) consecutive hours. Two (2) or more system crashes requiring manual user intervention such as rebooting computers or invoking task manager functions to close and restart tasks.

(c) Failure to respond to any problem within four (4) hours of notification, during regular business hours.

(d) Three (3) separate minor failures at any time during the test.

5.9.8 All modifications, revisions and replacements shall be documented and provided to AZDPS for approval prior to acceptance of test results. AZDPS reserves the right to reject any proposed repairs or modifications that are not in the best interest of the AZDPS’s ability to operate or maintain said components.

5.9.9 One (1) copy of test documentation shall be furnished to AZDPS

5.9.10 AZDPS may make modifications to the card design or production process. In the event changes are needed; testing requirements must be as listed above.

BPM005734

Description:

Off Site Secure Printing

Arizona Department of

Public Safety

2102 W. Encanto Blvd.,

5.9.11 Offeror shall also include, but is not limited to, card design, testing, and the Final Acceptance

Test.

5.10 Card Testing/Compliance

5.10.1 If modifications are made to the card design, the Contractor shall provide the AZDPS with thirty

(30) produced card credential samples. The samples shall consist of horizontal samples representing each the credential card type or design proposed. The card samples shall include the Arizona-specific design.

5.10.2 The cards shall meet the specified durability and testing criteria. Cards may be tested for general physical characteristics in accordance with ISO/IEC 10373 standard test methods.

5.10.3 The card testing is divided into three areas as follows:

i. ISO general physical characteristics and ANSI INCITS 322 card durability

ii. AAMVA compliance 4.3.11.5.3.

iii. Card security and integrity

5.11 Card Failure and Related Adjustment

5.11.1 The Offeror shall warrant credentials against failure for a minimum of six (6) years from date of issuance, even if beyond the term of the Contract.

5.11.2 Active credentials are expected to remain intact and in acceptable physical condition for a minimum of 6 years under normal use. Credentials that re determined to have failed and are returned to AZDPS shall be directed to the CDSP team. The CDSP team at their quarterly meeting shall examine failed cards, determine whether the cards have failed as a result of misuse, willful destruction, other methods beyond what may be considered normal use.

5.11.3 The Offeror’s representative(s) for the CDSP team shall be present for the failed credential determination meetings.

5.11.4 The Offeror shall produce and deliver replacement cards for failed cards at no cost to AZDPS or to the cardholder.

5.11.5 Credentials that fail in manufacturing, personalization or prior to being considered active shall be considered spoilage and not invoiced to AZDPS. AZDPS shall pay for only credentials that have met or surpassed all Quality Assurance processes and gave been delivered to the cardholder in good condition.

6.0 Process Flow

BPM005734

Description:

Off Site Secure Printing

Arizona Department of

Public Safety

2102 W. Encanto Blvd.,

6.1 Diagram

6.2 AZDPS will submit files one way “real time” batch transmission which could be continuous or could occur multiple times a day.

6.3 Offeror will submit credential cards and letters daily via USPS mail

7.0 What Offeror and AZDPS Will be Responsible For

7.1 AZDPS Responsible for:

7.1.1 Provide daily/multiple batch files

7.1.2 AZDPS will work with the Offeror to finalize card designs and letter formats that the Offeror shall create.

7.1.3 AZDPS shall appoint a program manager responsible for the administration of the central credential issuance program and who will serve as a point of contact for the Offeror regarding

BPM005734

Description:

Off Site Secure Printing

Arizona Department of

Public Safety

2102 W. Encanto Blvd., the solution implemented. The program manager may delegate subject matter experts as points of contact regarding specific areas of the program.

7.1.4 AZDPS will engage its communications team to participate in the development of a communication plan regarding the rollout of the new credentials. This will include notifying the public, law enforcement partners, and other parties who use the Security Guard identification cards, Private Investigator identification cards, Fingerprint Clearance cards, Concealed

Weapons Permit cards, and Certificate of Firearms Proficiency cards.

7.1.5 AZDPS reserves the right to request material inventory levels and Offeror process for maintaining and controlling inventory.

7.1.6 AZDPS will review and approve Offeror employee/sub contactor background checks

7.2 Offeror Responsibilities

7.2.1 Offeror provides the requested credential and letter together daily

7.2.2 Offeror shall provide an implementation project plan

7.2.3 Offeror shall provide training

7.2.4 Offeror to contact AZDPS within 24hrs if no record is found.

7.2.5 Offeror shall provide a portal for AZDPS access to required reports

7.2.6 Offeror shall be responsible for remaking and submitting cards/letters with errors

7.2.7 The Offeror shall adhere to all current standards, statutes, rules and regulations aforementioned. Should any modifications be made to any of these, the Offeror shall make modifications to adhere to future standards and requirements.

7.2.8 The Offeror shall have appointed at all times a program manager who will serve as a single point of contact for AZDPS to engage regarding the solution implemented.

7.2.9 The Offeror shall have technical support available to the AZDPS via a “Help Desk” Mondays through Fridays (excluding State Holidays) from the hours of 7:00 AM – 6:00 PM. The standard response time shall be less than four (4) hours.

7.2.10 The Offeror’s mailing and delivery solution shall ensure the efficiency, security, and quality of the delivery of the credential cards and letters.

8.0 Warrant/ Remedies

8.1 Offeror will provide AZDPS outage recovery plans

8.2 Offeror guarantees and/or warranties that Card credential information is only provided to authorized requestors.

8.3 Any attempts to represent any material and/or service not specifically awarded as being under contract is a breach of the contract and a violation of the Arizona Procurement Code. Any such action is subject to the legal and contractual remedies available to the State inclusive of but not limited to contract cancellation, suspension and/or debarment of the Contractor.

BPM005734

Description:

Off Site Secure Printing

Arizona Department of

Public Safety

2102 W. Encanto Blvd.,

8.4 A single unplanned system outage for all in-scope software and hardware components resulting in a loss of production shall not exceed more than four (4) consecutive hours during Standard Hours of

Operation. Unplanned system outages for all in-scope software and hardware components shall not exceed a combined total of eight (8) hours during Standard Hours of Operation per calendar month.

Any instance where the Offeror does not meet those requirements, the Offeror will be subject to liquidated damages as listed below:

(a) Single unplanned outage occurrences exceeding four (4) consecutive hours: $500.00 per occurrence.

(b) Combined unplanned outages per calendar month exceeding eight (8) hours per month: $500.00 per hour for every hour exceeding 8 hours per month.

9.0 Ordering Process

9.1 DPS may purchase services through contract direct release purchase orders issued by DPS to the

Offeror. No deliveries or work shall be performed without a duly authorized/issued purchase order(s). .

10.0 Reporting Requirements

10.1 Project Plan with assigned Project Manager and weekly updates

10.2 Offeror to provide reports thru a portal interface.

10.3 Nightly mailing reports - counts with type, auto-generated, excel format

10.4 Interface status – weekly and as issues occur - PDF

10.5 The Offeror shall provide a means by which ADSP can retrieve and review the front and back of each printed card and the date it was printed. – on demand, PDF

10.6 Problem reports: mailing processes/issues, problems and corrective actions sufficient for AZDPS to perform audits and quality control on the processes – weekly, Excel

10.7 The Offeror will submit reports on a AZDPS-specified timeline certifying the date and time of deleting/destroying/erasing all temporary stored information. - monthly

10.8 Physical security and data security assessment reports annually

10.9 Failed card reporting – daily

10.10 Reports on demand – monthly/annual/quarterly counts

10.11 The Offeror shall provide in-depth reports relating to card manufacturing, production, mailing of the credentials and problems encountered/corrective actions taken by the Offeror. The format of these reports to be submitted is at the discretion of AZDPS and may be subject to change. See Exhibit II –

Sample Production Report.

BPM005734

Description:

Off Site Secure Printing

Arizona Department of

Public Safety

2102 W. Encanto Blvd.,

11.0 Exhibits to the Scope of Work

Exhibit I AAMVA Annex C pgs 42-45 .................................................................... dd-Mmm-yyyy

Exhibit II Sample Production Report ..................................................................... dd-Mmm-yyyy

Exhibit III Sample of Current Credential Cards ..................................................... dd-Mmm-yyyy

Exhibit IV Credential Spreadsheet Data Elements ................................................ dd-Mmm-yyyy

Exhibit V Sample of Letters .................................................................................... dd-Mmm-yyyy

Exhibit .................................................................................................................. dd-Mmm-yyyy

Exhibit …. ……………………………………………………………………..………..……dd-Mmm-yyyy

Exhibit …………………………………………………………………………………… dd-Mmm-yyyy

Exhibit .................................................................................................................. dd-Mmm-yyyy

Exhibit …………………. ............................................................................................. dd-Mmm-yyyy

Exhibit ……………… ............................................................................................... dd-Mmm-yyyy

Exhibit ................................................................................................................. dd-Mmm-yyyy

Exhibit .................................................................................................................. dd-Mmm-yyyy

Exhibit .................................................................................................................. dd-Mmm-yyyy

End of Section 2-A

BPM005734

Description:

Off Site Secure Printing

Arizona Department of

Public Safety

2102 W. Encanto Blvd., SECTION 2-B: Commercial Document

Section 2-B:

Compensation Document

1.0 Compensation

Compensation Method.

1.1 Offeror will be compensated for the satisfactorily carrying out its obligations under the Contract by the method indicated by the “” mark below:

Firm-Fixed-Price (refer to paragraph 1.2 below)

Unit Prices

Contracted Labor Rates

Cost Reimbursable

Discount Off List or Catalog

1.2 FIXED-PRICE. The firm-fixed price (interchangeably referred to as lump sum or stipulated sum) is the amount or amounts shown or scheduled as such in the Pricing Document (Exhibit 1 to this Commercial

Document), each of which (a) will be Offeror’s complete and total compensation for carrying out the relevant portion of the Work that it covers and (b) will not be subject to any adjustment on the basis of

Offeror’s cost experience in performing under the Contract. Any cost overruns are the responsibility of the Offeror.

1.2.1 Except as expressly stated otherwise in the Solicitation, Offeror is, on the basis in subparagraph 1.2.2, deemed to have allowed in each firm-fixed price correct and sufficient amounts to cover all its obligations under or arising from the Contract, at law, or otherwise, and to have allowed the necessary resources to enable it to carry out the relevant portion of the

Work that it covers within any time for performance specified in the Scope of Work.

1.2.2 Offeror acknowledges that it has had the opportunity to visit those physical locations where the priced work is to be carried out and to understand and account for local conditions that might affect the Work, and has reviewed, verified, and interpreted for itself the necessary documents and information relevant to access, communications, climactic conditions, likelihood or risk of damage to adjacent property and occupants, possibility of interference by Persons other than