CaaSM_Statewide_Final_04292026.pdf

Cloud-hosted Cyber Asset Attack Surface Management

(CAASM)

Solicitation #: BPM056393

IFB Document

IFB for Department of Information Technology Page 1 of 33

STATE OF MARYLAND

DEPARTMENT OF INFORMATION TECHNOLOGY

(DOIT)

INVITATION FOR BIDS (IFB)

CLOUD-HOSTED CYBER ASSET ATTACK SURFACE MANAGEMENT

(CAASM)

IFB NUMBER BPM056393

ISSUE DATE: APRIL 29, 2026

A Prospective Bidder that has received this document from a source other than eMarylandMarketplace

Advantage (eMMA) https://procurement.maryland.gov should register on eMMA https://emma.maryland.gov/

NOTICE TO BIDDERS

MINORITY BUSINESS ENTERPRISES ARE ENCOURAGED TO RESPOND TO THIS

SOLICITATION.

https://procurement.maryland.gov/ https://emma.maryland.gov/

IFB for Department of Information Technology Page 2 of 33

KEY INFORMATION SUMMARY SHEET (KISS)

Invitation for Bids Information Technology Cloud-hosted Cyber Asset Attack Surface

Management (CAASM)

Solicitation

Number:

BPM056393

IFB Issue Date: April 29, 2026

IFB Issuing

Office:

Department of Information Technology (DoIT or the "Department")

Procurement

Officer:

Merchelle Halsey

100 Community Place, Crownsville, MD, 21032

Email:

Phone Number:

merchelle.halsey@maryland.gov

(410) 697-9694

Bids are to be sent to:

Submit on emma.maryland.gov under Solicitation Number BPM056393

To submit a bid, Bidders must first register on emma.maryland.gov. We recommend registering in advance to become acquainted with the site.

No Bid Notice

Feedback Form

If you are not submitting a bid for this solicitation, please submit

Attachment 1 with your reasons why.

Pre-Bid

Conference:

N/A

Questions Due

Date and Time:

May 8, 2026

10:00 AM EST

Bid Due (Closing)

Date and Time:

May 21, 2026, 10:00 AM EST

Bidder’s are reminded that a completed Feedback Form is requested if a no-bid decision is made (see Attachment 1 - No Bid Notice/Vendor

Feedback Form).

Public Bid

Opening Date, Bids will be open virtually May 21, 2026, 10:00 AM EST

IFB for Department of Information Technology Page 3 of 33

Time, and

Location

MBE

Subcontracting

Goal:

An overall Minority Business Enterprise (MBE) subcontract participation goal of 0 percent of the total contract dollar amount, including all renewal option terms, if any, has been established for this procurement. The overall MBE subcontract participation goal includes the following subgoals, which have been established for this procurement:

0 % for African American MBEs;

0 % for Asian American MBEs;

0 % for Hispanic American MBEs; and

0 % for Woman-Owned MBEs.

Refer to Exhibit 1 for information on how goal setting was determined.

Also, refer to Appendix 4 for information about the MBE program and goals.

VSBE

Subcontracting

Goal:

This solicitation includes a VSBE participation Goal of 0 %

Refer to Exhibit 1 for information on how goal setting was determined. Also, refer to Appendix 5 for information about the VSBE program and goals.

Procurement

Method:

A Contract will be awarded in accordance with the Competitive Sealed

Bidding method under COMAR 21.05.02.

Multiple or

Alternate Bids:

Multiple or alternate Bids will not be accepted.

Contract Type: Fixed Price

Contract

Duration:

Three Years

Primary Place of

Performance:

Department of Information Technology

SBR Designation: No

Federal Funding: No

IFB for Department of Information Technology Page 4 of 33

Table of Contents - IFB

1 Minimum Qualifications 6

1.1 Bidder Minimum Qualifications 6

2 Contractor Requirements: Scope of Work 7

2.1 Summary Statement 7

2.2 Background and Purpose 7

2.2.1 Project Goals 7

2.2.2 State Staff and Roles 7

2.3 Functional Requirements 8

3 Standard Terms and Conditions 12

3.1 Contract Initiation Requirements 12

3.2 End of Contract Transition 12

3.3 Invoicing 12

3.3.1 Invoice Submission Schedule 13

3.3.2 Deliverable Invoicing 13

3.3.3 Travel Reimbursement 13

3.4 Liquidated Damages 13

3.5 Problem Escalation Procedure 13

3.6 Work Orders 14

3.7 Payments by Electronic Funds Transfer 14

3.8 Prompt Payment Policy 14

3.9 Federal Funding Acknowledgement 15

3.10 Non-Disclosure Agreement 15

3.11 Maryland Healthy Working Families Act Requirements 15

3.12 The State of Maryland’s Commitment to Purchasing Environmentally Preferred Products and

Services (EPPs) 15

3.13 Insurance Requirements 15

4 Bid Submission Information and Instructions 17

4.1 eMaryland Marketplace Advantage (eMMA) 17

4.2 Electronic Means 17

4.3 Pre-Bid Conference 17

4.4 Questions 18

IFB for Department of Information Technology Page 5 of 33

4.5 Bid Due (Closing) Date and Time 18

4.6 Receipt, Opening and Recording of Bids 18

4.7 Duration of Bids 18

4.8 Revisions to the IFB 19

4.9 Cancellations 19

4.10 Incurred Expenses 19

4.11 Protest/Disputes 19

4.12 Bidder Responsibilities 19

4.13 Acceptance of Terms and Conditions 20

4.14 Compliance with Laws/Arrearages 20

4.15 Verification of Registration and Tax Payment 20

4.16 False Statements 21

4.17 Confidentiality of Bids / Public Information Act Notice 21

4.18 Use of Bidder’s Form Not Binding on State 21

4.19 Attachments and Documents Required with the Bid (Table A) 21

4.20 Bid Delivery Instructions 24

4.21 Bid Evaluation Criteria and Award Basis 24

4.22 Tie Bids 25

4.23 Reciprocal Preference 25

4.24 Small Business Preference 25

4.25 Documents Required upon Notice of Recommendation for Contract Award (Table B) 25

5 IFB Appendices and Exhibits 28

5.1 Appendices (Table C) 28

5.2 Exhibits (Table D) 29

IFB for Department of Information Technology Page 6 of 33

1 Minimum Qualifications

1.1 Bidder Minimum Qualifications

The Bidder must document in its Bid that it satisfies the following Minimum Qualifications:

A. Market Presence and Organizational Maturity.

The Bidder’s proposed Cyber Asset Attack Surface Management (CAASM) platform shall have been commercially available and generally sold to customers for a minimum of five

(5) years as of the Bid due date.

Required Documentation: Acceptable evidence includes, but is not limited to, product release history, press releases announcing general availability, or other verifiable documentation.

B. State, Local, and Education (SLED) Customer References.

Required Documentation: References from three (3) SLED customers from within the past five (5) years, each of whom were or are on the proposed CAASM platform for a minimum of twelve (12) months. See Attachment L.

For each reference, the Bidder must provide the following details:

1. Client Organization: Name of the State, Local, and Education (SLED) client.

2. Point of Contact: Name, title, telephone number, and email address for a contact person at the client organization.

3. Deployment Details: Duration and scope of the CAASM deployment, including the types of assets covered (e.g., IT, OT, IoT, Cloud, SaaS).

Bidders failing to satisfy the foregoing Minimum Qualifications will be deemed not responsible and not susceptible for award and their bids will not be evaluated..

THE REMAINDER OF THIS PAGE IS INTENTIONALLY LEFT BLANK.

IFB for Department of Information Technology Page 7 of 33

2 Contractor Requirements: Scope of Work

2.1 Summary Statement

This Invitation for Bids (IFB) is issued to procure a cloud-hosted CAASM platform as specified in this Section 2 to serve as the unified system of record for digital asset inventory, vulnerability correlation, and identity mapping across State of Maryland infrastructure.

This is a single IFB award. See IFB Section 4.21 Bid Evaluation Criteria and Award Basis for more Contract award information.

It is the State’s intention to obtain goods and services, as specified in this IFB, from a contract between the selected Bidder and the State. A Contract award does not ensure a Contractor will receive all or any State business under the Contract.

2.2 Background and Purpose

The State operates a highly complex, decentralized IT environment consisting of on-premises infrastructure, hybrid cloud deployments, and varied Software-as-a-Service (SaaS) applications.

Maintaining an accurate, continuous inventory of cyber assets and their associated risk profiles is foundational to effective cybersecurity governance and aligns with the mandates of NIST 800-53

(Revision 5) security controls, and the DoIT Cybersecurity & Privacy Policy Suite, https://doit.maryland.gov/policies/ci/Documents/MD-POL-202-01-Asset-Management-Policy.pdf.

The purpose is to procure a centralized cloud-hosted CAASM platform capable of normalizing disparate data streams from existing infrastructure and security tooling to provide security analysts, IT administrators, and the Office of the Security Management with actionable intelligence regarding asset posture, vulnerability exposure, and identity correlation.

2.2.1 Project Goals

The primary goal of this procurement is to procure a CAASM platform that effectively supports the Office of Security Management's Cyber Resiliency mission. This includes equipping the State's attack surface management and vulnerability management teams with the continuous visibility and data correlation capabilities required to proactively identify and mitigate cyber risks.

2.2.2 State Staff and Roles

The Contractor is responsible for the platform’s underlying infrastructure and all maintenance, patching, and infrastructure hosting. However, to ensure successful implementation, the State’s project team, including but not limited to an onboarding engineer and a State Project Manager, will provide technical guidance and coordination to facilitate the onboarding processes to the awarded platform.

The State Project Manager is responsible for overseeing the project schedule and coordinating

State resources.

The State Onboarding Engineer is responsible for directly supporting the State Project Manager throughout the onboarding process. This includes integrating State systems into the solution and collaborating with State stakeholders to gather the necessary information for system integration.

https://doit.maryland.gov/policies/ci/Documents/MD-POL-202-01-Asset-Management-Policy.pdf.

IFB for Department of Information Technology Page 8 of 33

2.3 Functional Requirements

Scope:

This Section 2.3 identifies the functional capabilities required of a multi-tenant CAASM platform.

The platform is expected to aggregate, normalize, correlate, and present asset, vulnerability, and identity data ingested from integrated State systems. The platform is not intended to replace endpoint detection and response (EDR) tools, identity governance platforms, digital forensics tooling, or security orchestration, automation, and response (SOAR) platforms. The Contractor must provide a solution that complies with all functional and technical requirements set out in the Sections below.

Bidders shall document compliance with each requirement in Sections 2.3.1 through 2.3.6 using the

Requirements Compliance Checklist (RCC - Attachment Z). The completed RCC shall be submitted with the Bid and will be used to verify compliance with these functional requirements.

2.3.1 Platform and Governance

The platform must:

a. Support a native multi-tenant architecture allowing the creation of multiple independent child tenants under a unified parent organization.

b. Enforce logical data isolation between tenants to prevent cross-tenant data visibility by unauthorized users.

c. Support independent administrative configurations for each child tenant, including localized Role-Based Access Control (RBAC) policies.

d. Support custom data retention policies configured independently per child tenant.

e. Support tenant-specific third-party integrations configured independently per child tenant.

f. Provide a global administrative interface aggregating telemetry, risk scores, and inventory metric across all child tenants within a single operational view.

g. Enforce cross-tenant resource allocation limits to ensure data ingestion or query execution in one tenant does not degrade the performance availability of adjacent tenants.

h. Integrate with external identity providers including Microsoft Entra ID and Active

Directory, to support federated authentication.

i. Support the enforcement of Multi-Factor Authentication (MFA) either natively or through integration with the configured external identity provider.

j. Support Single-Sign On (SSO) capabilities utilizing SAML 2.0 or OIDC integration via

Microsoft Entra ID.

2.3.2 Asset Discovery and Inventory Requirements

The platform must:

a. Ingest asset telemetry from multiple authoritative systems, infrastructure and cloud systems through integration with authoritative data sources.

b. Normalize logic to ingested asset records to maintain a single authoritative asset record per discrete cyber asset.

c. Provide administrative controls for authorized users to view and configure the deduplication and reconciliation logic used to merge asset records.

IFB for Department of Information Technology Page 9 of 33

d. Natively parse and classify ingested asset records into distinct categories, including physical systems, virtual resources, cloud resources, and network infrastructure.

e. Natively parse and classify ingested asset records for Internet of Things (IoT) and

Operational Technology (OT) devices.

f. Reconcile disparate data points derived from agent-based and agentless telemetry sources into unified asset records.

g. Record and display the initial discovery timestamp (first-seen) and the most recent observation timestamp (last-seen) for all inventoried assets.

h. Extract and display open ports and active services associated with an asset based on ingested telemetry.

i. Allow administrators to apply custom tags and metadata applied to individual assets or asset groups.

j. Graphically or logically map relationships between discrete assets, including asset-to-owner and asset-to-application associations.

2.3.3 Vulnerability and Risk Correlation Requirements

The platform must:

a. Ingest vulnerability findings through integration with third-party vulnerability scanners, endpoint detection platforms, and cloud security posture management tools.

b. Correlate ingested vulnerabilities findings directly to the corresponding unified asset records.

c. Normalize vulnerability data from multiple sources to prevent the display of redundant vulnerability records on a single asset.

d. Calculate and assign risk prioritization scores to vulnerabilities based on severity metrics and asset exposure factors.

e. Allow administrators to configure the risk scoring engine to adjust the weighting of specific risk factors to align with internal organizational priorities

f. Aggregate vulnerability data to display holistic attack surface risk metrics by tenant, group, or custom tag.

g. Capture and display historical trending data regarding vulnerability posture and asset inventory changes over a configurable time period.

2.3.4 Identity and User Visibility Requirements

The platform must:

a. Ingest identity objects including users, groups, and service accounts, through integration with authoritative identity providers such as Microsoft Entra ID.

b. Ingest and display identity metadata including account status (enabled/disabled), email address, and last authentication timestamp.

c. Correlate inventoried cyber assets with associated user or administrative accounts based on ingested identity and authentication telemetry.

IFB for Department of Information Technology Page 10 of 33

d. Display the associated hostnames or device IDs mapped to specific identity objects.

e. Ingest and aggregate installed software inventories across workstations and servers through integration with endpoint management or security tooling.

f. Support multi-variable queries using asset, vulnerability, and identity parameters simultaneously.

2.3.5 Integration and Interoperability Requirements

The platform must:

a. Provide RESTful API access to enable the programmatic retrieval of unified asset, identity, and vulnerability datasets by authorized external systems.

b. Support native or API-driven data integrations with Microsoft Sentinel to allow the ingestion of platform-generated asset and identity mappings into the SIEM environment.

2.3.6 Reporting and Analytics Requirements

The platform must:

a. Generate exportable reports detailing asset inventory distributions, vulnerability compliance, and identity correlations.

b. Allow administrators to build and save custom analytical dashboards using platform-generated data widgets and visualizations.

c. Support natural language and visual query building for reporting and analytics.

2.3.7 Agentless Asset Discovery. The CSM platform shall provide agentless asset discovery capabilities that do not require the installation of proprietary software agents on managed or unmanaged devices as a prerequisite for asset identification and classification. The platform shall be capable of discovering and inventorying assets through a combination of the following methods:

1. API-based data aggregation from existing IT, security, and business tools deployed within the environment;

2. Passive network traffic monitoring and analysis for identification of managed and unmanaged devices, including IoT and OT assets; and

3. Integration with existing network infrastructure (e.g., switches, routers, firewalls, wireless controllers) to identify connected assets without requiring network topology changes.

2.3.8 Pre-Built Integration Ecosystem. The proposed CAASM platform shall include a minimum of two hundred (200) pre-built, vendor-supported API integrations (commonly referred to as “adapters” or “connectors”) with third-party IT, security, and business tools. These integrations shall enable bidirectional data exchange and shall span, at a minimum, the following solution categories:

1. Endpoint Detection and Response (EDR) / Endpoint Protection

2. Platforms.

IFB for Department of Information Technology Page 11 of 33

3. Identity and Access Management (IAM) and Directory Services.

4. Vulnerability Management and Scanning platforms.

5. Cloud Infrastructure providers (e.g., AWS, Microsoft Azure, Google Cloud Platform).

6. Security Information and Event Management (SIEM) platforms.

7. IT Service Management (ITSM) and Configuration Management Database (CMDB) systems.

8. Mobile Device Management (MDM) platforms.

9. Network infrastructure and management tools.

Bidders shall indicate compliance with each deliverable requirement in Attachment Z

(RCC). Failure to submit a completed RCC may result in the Bid being deemed non-responsive.

IFB for Department of Information Technology Page 12 of 33

3 Standard Terms and Conditions

3.1 Contract Initiation Requirements

Once all approvals have been obtained and the Contract is fully executed, the Procurement Officer may schedule a kickoff meeting.

3.2 End of Contract Transition

The Contractor shall cooperate in the orderly transition of services from it to a subsequent contractor at the end of the contract term or upon receipt of a Notice of Termination from the State. Transition shall be provided in a prompt and timely manner and shall proceed in accordance with the schedule provided to the Contractor by the State in the Notice of Transition. Additional instructions regarding transition services may be provided in the event of a Notice of Termination issued by the State.

3.3 Invoicing

Submission of an invoice constitutes the Contractor’s verification that the information in the invoice is accurate as of the time of submission.

An invoice not satisfying the requirements of a Proper Invoice (as defined in COMAR 21.06.09) will not be processed for payment. To be considered a Proper Invoice, invoices must include the following information, without error:

A. Contractor’s name and address.

B. Remittance address.

C. Federal taxpayer identification (FEIN) number, social security number, as appropriate.

D. Invoice period (i.e. period during which services covered by invoice were performed).

E. Invoice date.

F. Invoice number.

G. State assigned Contract number.

H. State assigned (Blanket) Purchase Order number(s).

I. Goods or services provided.

J. Amount due.

K. Any additional documentation required by regulation or the Contract.

Invoices that contain both fixed price and labor hour or time and material items shall clearly identify each item as either fixed price, and labor hour, or time and material billing.

The State reserves the right to reduce or withhold Contract payment in the event the Contractor does not provide all required deliverables within the time frame specified in the Contract or otherwise breaches the terms and conditions of the Contract until such time as the Contractor brings itself into full compliance with the Contract.

IFB for Department of Information Technology Page 13 of 33

The State is generally exempt from federal excise taxes, Maryland sales and use taxes, District of

Columbia sales taxes and transportation taxes. The Contractor, however, is not exempt from such sales and use taxes and may be liable for the same.

Invoices for final payment shall be clearly marked as “FINAL” and submitted when all work requirements have been completed and no further charges are to be incurred under the Contract. In no event shall any invoice be submitted later than 60 calendar days from the Contract termination date.

3.3.1 Invoice Submission Schedule

The Contractor shall submit invoices in accordance with the following schedule:

A. For items of work for which there is one-time pricing (see Attachment B –The Price

Form), those items shall be billed in the month following the acceptance of the work by the State.

B. For Items of work for which there is annual pricing (see Attachment B–The Price

Form), those items shall be billed annually.

C. Invoices for work performed on a labor hour or time and materials basis shall be submitted on or before the 5th business day of the month following the end of the invoice period.

D. Invoices for deliverables shall be submitted upon completion and acceptance of the deliverables as defined in Section 2 of the IFB.

3.3.2 Deliverable Invoicing

Deliverable invoices shall be accompanied by a Deliverable Product Acceptance Form (DPAF) signed notice(s) of acceptance issued by the State for all invoices submitted for payment.

Payment of invoices will be withheld if a signed DPAF is not submitted (see online example at https://procurement.maryland.gov/wp-content/uploads/sites/12/2024/07/Exhibit-3.-

Deliverable-Product-Acceptance-Form-DPAF.docx

Payment for deliverables will only be made upon completion and acceptance of the deliverables as defined in Section 2 of the IFB.

3.3.3 Travel Reimbursement

Travel will not be reimbursed under this IFB.

3.4 Liquidated Damages

This section is not applicable because no MBE goal has been established for this IFB.

3.5 Problem Escalation Procedure

No later than ten (10) Business Days after notice of recommended award or after the date of the

Notice to Proceed, whichever is earlier, the Contractor must provide, and thereafter, maintain a

Problem Escalation Procedure (PEP) for both routine and emergency situations. The PEP must state how the Contractor will address problem situations as they occur during the performance of the

Contract, especially problems that are not resolved to the satisfaction of the State within appropriate timeframes and must include:

IFB for Department of Information Technology Page 14 of 33

A. Contact information

B. The process for establishing the existence of a problem.

C. Names, titles, and contact information for progressively higher levels of personnel in the Contractor’s organization who would become involved in resolving a problem.

D. For each individual listed in the Contractor’s PEP, the maximum amount of time a problem will remain unresolved with that individual before the problem escalates to the next contact person listed in the Contractor’s PEP.

E. Expedited escalation procedures and any circumstances that would trigger expediting them.

F. The method of providing feedback on resolution progress, including the frequency of feedback to be provided to the State.

G. Contact information for persons responsible for resolving issues after normal business hours (e.g., evenings, weekends, holidays) and on an emergency basis; and

H. A process for updating and notifying the Contract Monitor of any changes to the PEP.

I. The PEP must be updated within ten (10) Business Days after any change in circumstance which changes the PEP but not less than annually within ten (10)

Business Days after the start of each Contract year.

Nothing in this section shall be construed to limit any rights of the Contract Monitor or the

State which may be allowed by the Contract or applicable law.

3.6 Work Orders

This section is not applicable to this IFB.

3.7 Payments by Electronic Funds Transfer

By submitting a Bid in response to this solicitation, the Bidder, if selected for award:

Agrees to accept payments by electronic funds transfer (EFT) unless the State Comptroller’s Office grants an exemption. Payment by EFT is mandatory for contracts exceeding $200,000. The successful Bidder shall register using the COT/GAD X-10 Vendor Electronic Funds (EFT)

Registration Request Form.

Any request for exemption must be submitted to the State Comptroller’s Office for approval at the address specified on the COT/GAD X-10 form, must include the business identification information as stated on the form, and must include the reason for the exemption. The COT/GAD

X-10 form may be downloaded from the Comptroller’s website at:

http://comptroller.marylandtaxes.com/Vendor_Services/Accounting_Information/Static_Files/GA

DX10Form20150615.pdf.

3.8 Prompt Payment Policy

This procurement and the Contract(s) to be awarded pursuant to this solicitation are subject to the

Prompt Payment Policy Directive issued by the Governor’s Office of Small, Minority & Women

Business Affairs (GOSBA) and dated August 1, 2008. Promulgated pursuant to Md. Code Ann., State Finance and Procurement Article, §§ 11-201, 13-205(a), and Title 14, Subtitle 3, and COMAR

21.01.01.03 and 21.11.03.01, the Directive seeks to ensure the prompt payment of all subcontractors on non-construction procurement contracts. The Contractor shall comply with the prompt payment requirements outlined in the Contract, Section 31 “Prompt Pay Requirements” (see Exhibit 2 -

IFB for Department of Information Technology Page 15 of 33

Sample Contract). Additional information is available on GOSBA’s website at https://gomdsmallbiz.maryland.gov/Documents/Resources/Prompt%20Payment%20Guide_09.202

4_Finalv2.pdf

3.9 Federal Funding Acknowledgement

This Contract does not contain federal funds.

3.10 Non-Disclosure Agreement

This solicitation and any Contract(s) are subject to the terms of the Non-Disclosure Agreement (NDA) contained in this solicitation as Attachment S. This Agreement must be provided within five (5)

Business Days of notification of recommended award; however, to expedite processing, it is suggested that this document be completed and submitted with the Bid.

3.11 Maryland Healthy Working Families Act Requirements

On February 11, 2018, the Maryland Healthy Working Families Act went into effect. All Bidders should be aware of how this Act could affect your potential contract award with the State of

Maryland. See the Department of Labor, Licensing and Regulations website for Maryland Healthy

Working Families Act Information: https://dllr.state.md.us/paidleave/.

3.12 The State of Maryland’s Commitment to Purchasing Environmentally

Preferred Products and Services (EPPs)

Maryland’s State Finance & Procurement Article §14-410 defines environmentally preferable purchasing as “the procurement or acquisition of goods and services that have a lesser or reduced effect on human health and the environment when compared with competing goods or services that serve the same purpose.” Accordingly, Bidder s are strongly encouraged to offer EPPs to fulfill this contract, to the greatest extent practicable.

3.13 Insurance Requirements

The Contractor shall maintain, at a minimum, the insurance coverages outlined below, or any minimum requirements established by law if higher, for the duration of the Contract, including option periods, if exercised:

3.13.1 The following type(s) of insurance and minimum amount(s) of coverage are required:

A. Commercial General Liability - One million dollars ($1,000,000) combined single limit per occurrence for bodily injury, property damage, and personal and advertising injury and three million dollars ($3,000,000) annual aggregate. The minimum limits required herein may be satisfied through any combination of primary and umbrella/excess liability policies.

B. Worker’s Compensation - The Contractor shall maintain such insurance as necessary or as required under Workers’ Compensation Acts, the Longshore and Harbor Workers’

Compensation Act, and the Federal Employers’ Liability Act, to not be less than. one million dollars ($1,000,000) per occurrence (unless a state’s law requires a greater amount of coverage). Coverage must be valid in all states where work is performed.

https://gomdsmallbiz.maryland.gov/Documents/Resources/Prompt%20Payment%20Guide_09.2024_Finalv2.pdf https://gomdsmallbiz.maryland.gov/Documents/Resources/Prompt%20Payment%20Guide_09.2024_Finalv2.pdf https://dllr.state.md.us/paidleave/ https://trackbill.com/bill/maryland-house-bill-629-environmentally-preferable-procurement-maryland-green-purchasing-committee/647077/

IFB for Department of Information Technology Page 16 of 33

3.13.2 The State shall be listed as an additional insured on the faces of the certificates associated with the coverages listed above, including umbrella policies, excluding Workers’

Compensation Insurance and professional liability.

3.13.3 All insurance policies shall be endorsed to include a clause requiring the insurance carrier to provide the Procurement Officer, by certified mail, not less than 30 days’ advance notice of any non-renewal, cancellation, or expiration. The Contractor shall notify the

Procurement Officer in writing, if policies are canceled or not renewed within five (5) days of learning of such cancellation or nonrenewal. The Contractor shall provide evidence of replacement insurance coverage to the Procurement Officer at least 15 days prior to the expiration of the insurance policy then in effect.

3.13.4 Any insurance furnished as a condition of the Contract shall be issued by a company authorized to do business in the State.

3.13.5 The recommended awardee must provide current certificate(s) of insurance with the prescribed coverages, limits and requirements set forth in this section within five (5)

Business Days from notice of recommended award. During the period of performance for multi-year contracts, the Contractor shall provide certificates of insurance annually, or as otherwise directed by the Contract Monitor.

3.13.6 Subcontractor Insurance

The Contractor shall require any subcontractors to obtain and maintain comparable levels of coverage and shall provide the Contract Monitor with the same documentation as is required of the

Contractor.

IFB for Department of Information Technology Page 17 of 33

4 Bid Submission Information and Instructions

4.1 eMaryland Marketplace Advantage (eMMA) eMMA is the electronic commerce system for the State of Maryland. The IFB, Pre-Bid Conference

(Conference) summary and attendance sheet, Bidders’ questions and the Procurement Officer’s responses, addenda, and other solicitation-related information will be made available via eMMA.

To receive a contract award, a Bidder must be registered on eMMA. Registration is free. Go to emma.maryland.gov, click on “New Vendor? Register Now” to begin the process and then follow the prompts.

4.2 Electronic Means

The following transactions related to this procurement and any Contract awarded pursuant to it are not authorized to be conducted by electronic means:

A. Submission of Bond documents determined by the State to require original signatures; or

B. Any transaction, submission, or communication where the Procurement Officer has specifically directed that a response from the Contractor or Bidder be provided in writing or hard copy.

Any e-mail transmission is only authorized to the email addresses for the identified person as provided in the solicitation, the Contract, or in the direction from the Procurement Officer or Contract Monitor.

“Electronic means” refers to exchanges or communications using electronic, digital, magnetic, wireless, optical, electromagnetic, or other means of electronically conducting transactions. Electronic means includes e-mail, internet-based communications, electronic funds transfer, specific electronic bidding platforms (e.g., https://procurement.maryland.gov), and electronic data interchange.

4.3 Pre-Bid Conference

If a Conference will be held, the date, time, and location is indicated on the Key Information

Summary Sheet. Attendance at the Conference is not mandatory, but all interested parties are encouraged to attend in order to facilitate better preparation of their Bids. If the solicitation includes an

MBE participating goal, failure to attend the Conference will be taken into consideration as part of the evaluation of a Bidder’s good faith efforts if there is a waiver request.

It is highly recommended that all Prime Contractors bring their intended subcontractors to the

Conference/Site Visit to ensure that all parties understand the IFB requirements and the socio-economic goals for this solicitation.

MBE subcontractors are encouraged to attend the Conference to market their participation to potential prime contractors.

To assure adequate accommodations at the Conference, please email the completed Attachment 2 for those expected to attend the Conference to the Procurement Officer no later than the time and date indicated on the Key Information Summary Sheet. In addition, if there is a need for sign language interpretation or other special accommodations due to a disability, please notify the Procurement

Officer at least five (5) Business Days prior to the Conference date. Reasonable effort will be made to provide such special accommodation.

https://emma.maryland.gov/page.aspx/en/usr/login?ReturnUrl=%2fpage.aspx%2fen%2fbuy%2fhomepage https://procurement.maryland.gov/

IFB for Department of Information Technology Page 18 of 33

If the Conference is in person, attendees should bring a copy of the solicitation and a business card to help facilitate the sign-in process.

4.4 Questions

All questions, including concerns regarding any applicable MBE or VSBE participation goals, shall identify in the subject line the Solicitation Number and Title for this IFB and must be submitted in writing via e-mail or eMMA to the Procurement Officer no later than the date and time specified in the

Key Information Summary Sheet. The Procurement Officer, based on the availability of time to research and communicate an answer, shall decide whether an answer can be given before the Bid due date.

Answers to all questions that are not clearly specific only to the requestor will be distributed via the same mechanism as for IFB amendments and posted on eMMA.

The statements and interpretations contained in responses to any questions, whether responded to verbally or in writing, are not binding on the State unless it issues an amendment to the solicitation in writing.

4.5 Bid Due (Closing) Date and Time

Bids must be received by the Procurement Officer no later than the Bid due date and time indicated on the Key Information Summary Sheet to be considered. Except as provided in COMAR 21.05.02.10.

Bids received after that date will not be considered. Requests for an extension of this date or time shall not be granted.

Bids may be modified or withdrawn by written notice received by the Procurement Officer before the time and date set forth in the Key Information Summary Sheet for receipt of Bids.

Potential Bidders not responding to this solicitation are requested to submit the “No Bid/Proposal

Notice/Vendor Feedback” form Attachment 1, which includes company information and the reason for not responding (e.g., too busy, cannot meet mandatory requirements).

4.6 Receipt, Opening and Recording of Bids

Upon receipt, each Bid and any timely modification(s) to a Bid shall be stored in a secure place until the time and date set for Bid opening. Before Bid opening, the State may not disclose the identity of any Bidder.

Bids shall be opened publicly at the time, date and place designated in the Key Information Summary

Sheet.

The name of each Bidder, the Total Bid Price, and such other information as is deemed appropriate shall be read aloud or otherwise made available and recorded at the time of Bid opening.

4.7 Duration of Bids

Bids submitted in response to this IFB are irrevocable for the latest of the following: 120 days following the Bid due date and time or the date any protest concerning this IFB is finally resolved. This period may be extended at the Procurement Officer’s request only with the Bidder’s written agreement.

IFB for Department of Information Technology Page 19 of 33

4.8 Revisions to the IFB

4.8.1 All revisions to the IFB before the due date for Bids will be published in an addendum to the IFB and posted on eMMA and reasonable effort will be made to provide such addenda to all prospective Bidders that were sent this IFB or are otherwise known by the

Procurement Officer to have obtained this IFB. It is the responsibility of all prospective

Bidders to check eMMA for any addenda issued prior to the submission of Bids.

4.8.2 Bidders shall acknowledge in the Bid the receipt of all addenda to this IFB issued before the Bid due date.

4.8.3 Failure to acknowledge receipt of an addendum does not relieve the Bidder from complying with the terms, additions, deletions, or corrections set forth in the addendum, and may cause the Bid to be deemed not responsive.

4.9 Cancellations

4.9.1 This IFB may be cancelled as provided in COMAR 21.06.02.02

4.9.2 The State reserves the right to cancel this IFB, accept or reject any and all Bids, in whole or in part, received in response to this IFB and to waive or permit the cure of minor irregularities.

4.9.3 In the event a government entity proposes and receives the recommendation for award, this procurement may be canceled, and the award processed in accordance with COMAR

21.01.03.01.A(4).

4.9.4 If the services that are the subject of the IFB are currently being provided under an interagency agreement with a public institution of higher education and the State determines that the services can be provided more cost effectively by the public institution of higher education, then the IFB may be canceled in accordance with Md. Code Ann., State Finance and Procurement Art., § 3-207(b)(2).

4.10 Incurred Expenses

The State will not be responsible for any costs incurred by any Bidder in preparing and submitting a

Bid or performing any other activities related to submitting a Bid in response to this solicitation.

4.11 Protest/Disputes

Any protest or claim related to this IFB, or the Contract award hereunder shall be subject to the provisions of COMAR 21.10 (Administrative and Civil Remedies).

4.12 Bidder Responsibilities

4.12.1 The Bidder, either directly or through its subcontractor(s), must be able to provide all goods and services and meet all of the requirements requested in this solicitation and the successful Bidder (the Contractor) shall remain responsible for Contract performance regardless of subcontractor participation in the work.

4.12.2 If applicable, subcontractors utilized in meeting the established MBE or VSBE participation goal(s) for this solicitation shall be identified using Attachment D or

IFB for Department of Information Technology Page 20 of 33

Attachment E as appropriate. Guidance for completing the Attachments is provided in the appropriate appendix to this IFB.

4.12.3 If the Bidder is the subsidiary of another entity, all information submitted by the Bidder , including but not limited to references, financial reports, or experience and documentation

(e.g., insurance policies, bonds, letters of credit) used to meet minimum qualifications, if any, shall pertain exclusively to the Bidder, unless the parent organization will guarantee the performance of the subsidiary. If applicable, the Bidder’s Bid shall contain an explicit statement, signed by an authorized representative of the parent organization, stating that the parent organization will guarantee the performance of the subsidiary.

4.12.4 A parental guarantee of the performance of the Bidder under this section will not automatically result in crediting the Bidder with the experience or qualifications of the parent under any evaluation criteria pertaining to the actual Bidder’s experience and qualifications. Instead, the Bidder’s responsibility will be assessed to the extent to which the State determines that the experience and qualifications of the parent are applicable to and shared with the Bidder, any stated intent by the parent to be directly involved in the performance of the Contract, and the value of the parent’s participation as determined by the State.

4.13 Acceptance of Terms and Conditions

By submitting a Bid in response to this IFB, the Bidder, if selected for award, is deemed to have accepted the terms and conditions of this IFB and the Contract, attached hereto as Exhibit 2 – Sample

Contract. Any questions or exceptions to this IFB or the Contract must be submitted by the “Questions

Due Date and Time” prior to Bid submission. Changes to the solicitation, including the Bid Form or

Contract, made by the Bidder may result in Bid rejection.

4.14 Compliance with Laws/Arrearages

By submitting a Bid in response to this IFB, the Bidder, if selected for award, agrees that it will comply with all federal, State, and local laws applicable to its activities and obligations under the Contract.

By submitting a response to this solicitation, each Bidder represents that it is not in arrears in the payment of any obligations due and owing the State, including the payment of taxes and employee benefits, and shall not become so in arrears during the term of the Contract if selected for Contract award.

4.15 Verification of Registration and Tax Payment

Before a business entity can do business in the State, it must be registered with the State Department of Assessments and Taxation (SDAT). SDAT is located at State Office Building, Room 803, 301 West

Preston Street, Baltimore, Maryland 21201. For registration information, visit https://egov.maryland.gov/BusinessExpress/.

It is strongly recommended that any potential Bidder complete registration prior to the Bid due date and time. The Bidder’s failure to complete registration with SDAT may disqualify an otherwise responsive successful Bidder from final consideration and recommendation for Contract award.

https://egov.maryland.gov/BusinessExpress/

IFB for Department of Information Technology Page 21 of 33

4.16 False Statements

Bidders are advised that Md. Code Ann., State Finance and Procurement Article, § 11-205.1 provides as follows:

In connection with a procurement contract a person may not willfully:

A. Falsify, conceal, or suppress a material fact by any scheme or device.

B. Make a false or fraudulent statement or representation of a material fact; or

C. Use a false writing or document that contains a false or fraudulent statement or entry of a material fact.

A person may not aid or conspire with another person to commit an act under this section.

A person who violates any provision of this section is guilty of a felony and on conviction is subject to a fine not exceeding $20,000 or imprisonment not exceeding five (5) years or both.

4.17 Confidentiality of Bids / Public Information Act Notice

The Bidder should give specific attention to the clear identification of those portions of its Bid that it considers to contain confidential and/or proprietary commercial information or trade secrets, and provide justification why such materials, upon request, should not be disclosed by the State under the

Public Information Act, Md. Code Ann., General Provisions Article, Title 4. This information should be identified by page number and placed in the Transmittal Letter with the Bid.

The Bids shall be tabulated or a Bid abstract made. The opened Bids shall be available for public inspection at a reasonable time after Bid opening, but in any case before contract award, except to the extent the Bidder designates trade secrets or other proprietary data to be confidential as set forth in this solicitation. Material so designated as confidential shall accompany the Bid and shall be readily separable from the Bid to facilitate public inspection of the non-confidential portion of the Bid, including the Total Bid Price.

For requests for information made under the PIA, the Procurement Officer shall examine the Bids to determine the validity of any requests for nondisclosure. Nondisclosure is permissible only if approved by the Office of the Attorney General.

4.18 Use of Bidder’s Form Not Binding on State

The Bidder may not substitute, modify, or provide any other document in lieu of the documents provided with this Bid. Only those forms and documents provided with this solicitation and by the

Procurement Officer will be considered acceptable as bid submission.

4.19 Attachments and Documents Required with the Bid (Table A)

Bidders must submit a single Bid Package containing all required attachments. Please refer to the specific criteria for each attachment to determine if it is required for your submission.

Attachments A through C; the Bid will be rejected if a required Attachment is not submitted or is incomplete.

Attachments D through R; the Bid may be rejected if a required Attachment is not submitted or is incomplete.

IFB for Department of Information Technology Page 22 of 33

TABLE A - Attachments and Documents Required with the Bid

Attachment Attachment Name

A

Bid/Proposal Affidavit

A Bid submitted by the Bidder must be accompanied by a completed Bid/Proposal

Affidavit.

https://procurement.maryland.gov/wp-content/uploads/sites/12/2024/07/Attachment-A.-Bid-Proposal-Affidavit.pdf

B

The Price Form (as specified within eMMA)

Do not alter this Price Form or the Bid may be determined to be not responsive.

The Price Form must be signed and dated, where requested, by an individual who is authorized to bind the Bidder to the prices entered on the Bid Form.

(See Appendix 2 for specific Price Form Instructions.)

C Bid Bond

N/A

D MBE Forms D-1A

N/A

E Veteran-Owned Small Business Enterprise (VSBE) Form E-1A

N/A

F

Bidder Information Sheet https://procurement.maryland.gov/wp-content/uploads/sites/12/2024/07/Attachment-F.-Offeror-Offeror-Information-

Sheet.pdf

G

Maryland Living Wage Requirements Affidavit of Agreement

(for Services and Facilities Maintenance Contracts - See Appendix 6 for

Details)

N/A

H Federal Funds Attachments

N/A

I Conflict of Interest Affidavit and Disclosure

N/A

J

Mercury Affidavit

N/A https://procurement.maryland.gov/wp-content/uploads/sites/12/2024/07/Attachment-A.-Bid-Proposal-Affidavit.pdf https://procurement.maryland.gov/wp-content/uploads/sites/12/2024/07/Attachment-A.-Bid-Proposal-Affidavit.pdf https://procurement.maryland.gov/wp-content/uploads/sites/12/2024/07/Attachment-F.-Bidder-Offeror-Information-Sheet.pdf https://procurement.maryland.gov/wp-content/uploads/sites/12/2024/07/Attachment-F.-Bidder-Offeror-Information-Sheet.pdf https://procurement.maryland.gov/wp-content/uploads/sites/12/2024/07/Attachment-F.-Bidder-Offeror-Information-Sheet.pdf https://procurement.maryland.gov/wp-content/uploads/sites/12/2024/07/Attachment-H.-Federal-Funds-Attachment.pdf

IFB for Department of Information Technology Page 23 of 33

TABLE A - Attachments and Documents Required with the Bid

K

Location of the Performance of Services Disclosure https://procurement.maryland.gov/wp-content/uploads/sites/12/2024/07/Attachment-K.-Location-of-the-Performance-of-

Services-Disclosure.pdf

L

Reference Checks

(Each reference shall be from a customer for whom the Bidder has provided goods or services within the most recent past five years) https://procurement.maryland.gov/wp-content/uploads/sites/12/2024/07/Attachment-L.-Reference-Checks.pdf

M

List of Current or Prior State Contracts https://procurement.maryland.gov/wp-content/uploads/sites/12/2024/07/Attachment-M.-List-of-Current-or-Prior-State-

Contracts.pdf

N

Legal Action Summary https://procurement.maryland.gov/wp-content/uploads/sites/12/2024/07/Attachment-N.-Legal-Action-Summary.pdf

O Payment of Employee Healthcare Expenses Certification

N/A

P

Prime Contractor List of ALL Subcontractors

Anticipated/Used During Contract

N/A

Q Labor Resume Form

N/A

R

Corporate Diversity Addendum https://procurement.maryland.gov/wp-content/uploads/sites/12/2024/07/Attachment-R.-Corporate-Diversity-

Addendum.pdf

This addendum is required to be submitted with a BID or PROPOSAL when the contract award is estimated to be $1,000,000 or more.

Note: This document is for data collection only.

Z Requirements Compliance Checklist https://procurement.maryland.gov/wp-content/uploads/sites/12/2024/07/Attachment-K.-Location-of-the-Performance-of-Services-Disclosure.pdf https://procurement.maryland.gov/wp-content/uploads/sites/12/2024/07/Attachment-K.-Location-of-the-Performance-of-Services-Disclosure.pdf https://procurement.maryland.gov/wp-content/uploads/sites/12/2024/07/Attachment-K.-Location-of-the-Performance-of-Services-Disclosure.pdf https://procurement.maryland.gov/wp-content/uploads/sites/12/2024/07/Attachment-L.-Reference-Checks.pdf https://procurement.maryland.gov/wp-content/uploads/sites/12/2024/07/Attachment-L.-Reference-Checks.pdf https://procurement.maryland.gov/wp-content/uploads/sites/12/2024/07/Attachment-M.-List-of-Current-or-Prior-State-Contracts.pdf https://procurement.maryland.gov/wp-content/uploads/sites/12/2024/07/Attachment-M.-List-of-Current-or-Prior-State-Contracts.pdf https://procurement.maryland.gov/wp-content/uploads/sites/12/2024/07/Attachment-M.-List-of-Current-or-Prior-State-Contracts.pdf https://procurement.maryland.gov/wp-content/uploads/sites/12/2024/07/Attachment-N.-Legal-Action-Summary.pdf https://procurement.maryland.gov/wp-content/uploads/sites/12/2024/07/Attachment-N.-Legal-Action-Summary.pdf https://procurement.maryland.gov/wp-content/uploads/sites/12/2024/07/Attachment-O.-Payment-of-Employee-Healthcare-Expenses-Certification.pdf https://procurement.maryland.gov/wp-content/uploads/sites/12/2024/07/Attachment-R.-Corporate-Diversity-Addendum.pdf…