CNBCCC_RFQ_SOW_ManagedITSupport_ITT72.pdf

REQUEST FOR QUOTES – STATEMENT OF WORK

Statewide Contract: ITT72 RFQ Name/Title: Managed IT Support Services

Description or Purpose of Engagement The Cannabis Control Commission, established by St. 2017, c. 55, An Act to Ensure Safe Access to Marijuana (amending St. 2016, c. 334, The Regulation and Taxation of Marijuana Act), is responsible for implementing and administering the laws governing the medical- and adult-use marijuana industries in the Commonwealth.

The Commission seeks a vendor under Statewide Contract ITT72 to provide fully managed IT support services, identical to the services currently provided, including 24x7x365 monitoring and support, managed security services, remote support, quarterly business reviews, application and hardware support, and optional vCISO and vulnerability testing services.

Commission Project Lead Name: Danielle Freeman Title: Director of IT and Security Email: Danielle.Freeman@cccmass.com Phone Number: (774) 415-0200

Requirements Contractor Type ☒Single Contractor ☐Multiple Contractors ☐Either Single or Multiple

Skills/Expertise Specific skills/expertise required for this engagement:

• Managed Security and XDR/SOC support

• Service Desk/NOC operations

• Remote Monitoring & Management (RMM) mailto:Danielle.Freeman@cccmass.com

• Application and hardware support coordination

• Patch and change management

• Quarterly business reviews and planning

• Compliance with cybersecurity and privacy standards

Data and Application Confidentiality As part of its work efforts under this SOW, the vendor may have access to Commonwealth data and IT resources. For purposes of this work effort, “Commonwealth data” shall mean data provided by the Commission to the vendor, which may physically reside at a Commission location or the vendor’s location. In connection with Commonwealth data, the vendor will implement commercially reasonable safeguards necessary to:

(1) prevent unauthorized access to Commonwealth data from any public or private network;

(2) prevent unauthorized access to any Commonwealth information technology resources;

and

(3) prevent interception and manipulation of Commonwealth data during transmission to and from any servers.

In addition, the vendor may be required to use Commonwealth personal data, as defined in M.G.L. c 66A, and/or personal information, as defined in M.G.L. c. 93H, or to work on or with information technology systems that contain such data in order to fulfill part of its specified tasks. For purposes of this work effort, electronic personal data and personal information include data provided by Commission to the vendor which may physically reside at a location owned and/or controlled by the Commonwealth or Commission or the vendor.

The vendor should demonstrate understanding of and compliance with all federal and state laws and regulations relating to confidentiality and privacy, and security of personal information, including but not limited to G.L. c. 93H, G.L. c. 66A. In connection with electronic personal data and personal information, the vendor shall implement the maximum feasible safeguards reasonably needed to:

(1) Ensure the security, confidentiality, and integrity of electronic personal data and personal information;

(2) Prevent unauthorized access to electronic personal data or personal information from any public of private network;

Scope of Services The vendor will provide:

• 24/7 remote monitoring and management of network devices, firewalls, servers, and workstations

• Email, phone, and chat-based service desk support

• Incident alerting, response, and remediation

• Next-gen antivirus and managed security tools (BitDefender preferred)

• Optional: vCISO services, vulnerability scans, penetration testing

• Application and hardware coordination with third-party support

• Windows server and workstation patching

• Quarterly business reviews and user count adjustments

All services must comply with the requirements and pricing terms of Statewide Contract

ITT72.

The vendor will work with Commission to provide the following deliverables:

Key Deliverables

Deliverable Name

Description Delivery Schedule (i.e.

number of weeks from start of engagement)

Onboarding & Transition

Environment setup and access 2 weeks from execution

Remote Monitoring

24/7 monitoring setup and ongoing support

Continuous

Managed Security

Deployment of security tools, active monitoring

Continuous

Patch Management

Scheduled and emergency patching

As scheduled

Quarterly Review

Environment status, updates, and roadmap planning

Quarterly

Response Format Responses should include the following elements:

1. Executive summary

2. Narrative response

3. Estimated timeline and approach for each deliverable

4. Resumes for key project staff

5. Cost proposal (aligned with ITT72 ceiling rates or lower)

Evaluation Criteria Responses will be reviewed and evaluated according to the criteria set by the Commission, adherence to the submission requirements, experience working with state regulatory agencies, and proven ability to manage time-sensitive projects. Specific criteria include:

1. Experience providing managed IT services to state agencies (20 points)

2. Technical approach and ability to meet scope (30 points)

3. Key Personnel (20 points)

4. Cost proposal and value (30 of points)

Note: Preference may be given to a Small Business Purchasing Program (SBPP)-certified vendor if they meet the Commission’s best value criteria, in alignment with best practices recommended by OSD.

Engagement Performance Monitoring To ensure performance, the selected vendor will provide weekly updates to the Commission via email or call.

Contract Award and Execution The Commission may select the response that is determined to offer the Best Value overall.

Upon successful execution, the Commission will announce the contract award on

COMMBUYS.

Expected Duration of Engagement:

The contract will commence upon full execution and remain in effect through the expiration of Statewide Contract ITT72 on June 30, 2026. No renewals or extensions are anticipated beyond this date.

Questions and Answers All questions must be submitted via COMMBUYS by 5:00 PM on April 3, 2025

The commission will post responses to these questions by 5:00 PM on April 10, 2025.

Instructions for Submissions of Responses:

All responses must be submitted electronically via COMMBUYS by 5:00 PM on April 17, 2025.

Bidders should allow adequate time for submission, accounting for possible internet or technical delays. The Commission is not responsible for submission issues related to bidder systems or hardware.

Costs Vendors must submit itemized pricing aligned with the services and deliverables outlined in this RFQ. Pricing must reflect a service-based structure, including per-user, per-hour, or per-scan rates where applicable. Vendors should clearly identify unit costs and the associated billing frequency (e.g., monthly, quarterly, one-time). All time and materials rates for ad-hoc services must comply with or be below the ITT72 ceiling rates.

Compensation will be based on actual services delivered and accepted by the Commission.

Any costs not clearly defined in the vendor’s response and not accepted by the Commission at the time of contract execution will not be reimbursed. Costs not specifically identified in the bidder’s response and accepted by the Commission will not be compensated under any awarded contract.

The Commission is not responsible for any costs incurred by bidders in response to this RFQ.

Payments are subject to the Commonwealth’s bill payment policy, including any prompt payment discount terms established under Statewide Contract ITT72. The Commission is a tax-exempt entity and will provide an ST-2 tax exemption form upon contract execution.

File Format PDF, Word, Excel. Scanned documents must be clearly legible on a monitor and printable on 8½” x 11” paper. Zipped files must be saved in .zip format.

Public Records All information, documents, and attachments submitted as a response to this RFQ are considered a public document subject to the Massachusetts Public Records Law, M.G.L. c. 66, § 10, and M.G.L. c. 4, § 7, cl. 26. Please be aware that checking the “confidential” box in COMMBUYS does not preclude these documents from being released as a public record pursuant to these statutes once the procurement is awarded, unless statutorily exempt from disclosure.

Deadline for Responses:

Deadline Date: April 17, 2025 Deadline Time: 5:00 PM