Credential Print Solution - Final~4.docx

State of Nevada

Brian Sandoval

Department of Administration

Governor

Purchasing Division

Patrick Cates

Director

515 E. Musser Street, Suite 300 Carson City, NV 89701

Jeffrey Haag

Administrator

State of Nevada

Purchasing Division

Request for Proposal: 81DMV-S278

For

CREDENTIAL PRINT SOLUTION

Release Date: September 12, 2018

Deadline for Submission and Opening Date and Time: October 3, 2018 @ 2:00 PM

Refer to Section 20, RFP Timeline for the complete RFP schedule

For additional information, please contact:

Heather Moon, Purchasing Officer

State of Nevada, Purchasing Division

515 E. Musser Street, Suite 300

Carson City, NV 89701

Phone: 775-684-0179

Email address: hmoon@admin.nv.gov

Refer to Section 21 for instructions on submitting proposals

VENDOR INFORMATION SHEET FOR RFP 81DMV-S278

Vendor Shall:

A) Provide all requested information in the space provided next to each numbered question. The information provided in Sections V1 through V6 shall be used for development of the contract;

B) Type or print responses; and

C) Include this Vendor Information Sheet in Section III of the Technical Proposal.

including address if different than above

Name:

Title:

Address:

Email Address:

TABLE OF CONTENTS

Prospective vendors are advised to review Nevada’s ethical standards requirements, including but not limited to NRS 281A, found on the Purchasing Division’s website at: http://purchasing.nv.gov.

All applicable Nevada Revised Statutes (NRS) and Nevada Administrative Code (NAC) documentation can be found at: www.leg.state.nv.us.

PROJECT OVERVIEW

The Nevada Department of Motor Vehicles (the Department or DMV) is soliciting proposals for a contractor-provided credential print solution driver’s license and identification cards for the State of Nevada.

Please see Attachment Q – for a complete listing of Definitions and Acronyms.

GOALS AND OBJECTIVES

To solicit a full-service credential print solution with facial recognition components that will allow for technological growth of the State of Nevada at a reasonable price.

BACKGROUND

PROJECT

The DMV has been in a contract with the current vendor for seventeen (17) years. Through the years, the DMV has become increasingly aware of our outdated processes, workflows, card security and the increasing costs in keeping up with the needs of the State.

Our current card issuance process has become costly to update due to the large technological advancements made since the contracts implementation. Our card issuance processes has become confining which limits the DMV in the assistance of the residents of Nevada. Our Driver’s Licenses, Commercial Driver’s Licenses, Identification Cards, as well as a variety of other specialty cards, run a larger risk of being counterfeited the longer our card remains with outdated security features and card stock.

AGENCY

The NV DMV is comprised of seven divisions dealing with six functional areas. A copy of the organizational chart is included in Attachment P – NV DMV Department Organizational Chart. The functional areas are comprised of: fiscal, vehicle registration/title/insurance verification, driver’s license, motor vehicle industry regulation, motor carrier registration, and fuel tax collection. There are 18 field offices statewide with the largest metropolitan offices in the Las Vegas valley and in Reno. There are approximately 1,200 employees statewide with the majority within the Field Services Division.

CONCURRENT IMPACTS/PROJECTS

The DMV is undergoing a modernization project. This project will affect all aspects of the DMV as it is a complete replacement of the DMVs service system.

CURRENT COMPUTING ENVIRONMENT

Current Department environments include Microsoft Active Directory running on Server 2012 R2, other servers include Microsoft Server 2016, Microsoft SQL Server 2012 and IBM DB2. Department is considering future cloud-based progression, electronic licenses and future products.

PROJECT SOFTWARE

All software used for project management shall be approved by the State. Current desktop tools utilized by the DMV include:

Dell PC’s with Windows 7 & 10, Microsoft Office Suite 2013, Visual Studio 2015 & 2017 & .Net, Mainframe COBOL, DB2, TSO/ISPF, CICS and JCL, Microsoft Visio, Microsoft Project, Adobe.

DEVELOPMENT SOFTWARE

All proposed software used in the design, development, testing and implementation of the deliverables outlined in this RFP shall be approved by the State.

If the application software is not public domain, the awarded vendor shall provide a licensing strategy.

The State shall procure licenses for all base components and third party equipment (operating system, data base, etc.) based upon specifications provided by the awarded vendor.

The awarded contractor shall provide software licenses and formal training as necessary for all Department users.

STATE RESOURCES

The following paragraphs describe the resources the State has committed to this project.

Steering Committee

This team of senior officials shall work with, and on behalf of the project in defining overall policy, providing top level decision making, ensuring availability of key resources and effecting key interdepartmental and contractual relationships. The Steering Committee provides leadership in promoting support for the project. Additional roles of the Steering Committee may include:

Review of proposed plans and timetables;

Provide problem resolution if issues cannot be resolved at the project team level;

Provide departmental policy as it relates to the project;

Set priorities;

Propose alternative solutions to problems encountered;

Obtain Legislative and Administrative backing; and

Provide information and involve external parties in project progress, accomplishments and challenges.

Project Sponsor

The Nevada Department of Motor Vehicles is the project sponsor. All project activities shall be conducted under the authority of the Nevada Department of Motor Vehicles.

Project Manager

A Project Manager has been appointed to coordinate the activities of all individuals and organizations involved in the project. The Project Manager shall provide on-going daily direction and oversight to the State project staff and the awarded vendor and report progress and problems to the Steering Committee. The Project Manager shall coordinate all organizations involved in the project and ensure resource requirements are identified and addressed. The Project Manager sets priorities when choices of alternatives are required.

State Project Staff

The awarded vendor shall be expected to work closely with the State project staff assigned to this project.

State project staff shall be available to attend meetings, interviews and assist assigned staff in reviewing functions with the awarded vendor.

State project staff shall be assigned to the project on an as-needed basis, as determined by project and technical management to represent the various functional and technical areas.

State project staff shall report to the Project Manager who shall act as a conduit to the awarded vendor.

Quality Assurance Monitor

A Quality Assurance (QA) monitor may be utilized and shall act as technical assistant to the State. The QA monitor shall report to the State Project Manager. Major functions shall include, but not be limited to the following.

Review of project tasks;

Validation of results;

Provide recommendations, as required;

Review of deliverables; and

Project plan monitoring.

Department Provided Services

The Department will provide the following services in support of the resulting contract:

Assign and designate a Department Contract Manager and Backup Contract Manager who shall be assigned from the start of the installation period until all new systems are installed and fully operational. The Department’s Contract Manager will serve as the Department’s liaison for technical and operational issues.

Assign and designate a Department Contract Monitor who will act on the Department’s behalf for the on-going administration of contractual matters, and who will coordinate and serve as the liaison for all contract-related activities between the Department and the Contractor, including notifications not otherwise required to be issued by or to the Department’s Project Manager.

The Department will work with the awarded vendor to establish a means of secured media file exchange whenever such items as specifications, data, or installation, etc., occurs.

The Department will provide on-site personnel and access to the Agency Sites/Field Offices and facilities for the awarded vendor’s personnel for the following:

Training - The Department will identify training location(s) upon a mutually agreed upon timeframe.

Installation – Department personnel will be on-site at each installation location and additional Department technical staff will be available in person or via electronic means to assist with any issues involving the Department’s equipment and software.

Maintenance – The Department’s Designee will collect all maintenance requests and route them to the Awarded Contractor’s Post Implementation Point of Contact (or other personnel designated in writing). The Department’s Designee will maintain records regarding calls for maintenance.

SYSTEM REQUIREMENTS

VENDOR RESPONSE TO SYSTEM REQUIREMENTS

Vendors shall explain in sufficient detail how the vendor shall satisfy the Nevada Department of Motor Vehicles project requirements described below. If subcontractors shall be used for any of the tasks, vendors shall indicate what tasks and the percentage of time subcontractor(s) shall spend on those tasks.

COMPUTING PLATFORM

All system requirements will be performed by the vendor. The vendor must be able to communicate with the DMV application.

TECHNICAL REQUIREMENTS

System Requirements and Application Software Interface

The print solution shall include all necessary software, which shall meet all of the following requirements:

Any software provided with or produced by the awarded contractor as part of the print solution must allow for programmatic integration with the printing process via a software interface.

The awarded contractor shall provide all rights necessary to grant to the Department unlimited licensure for use of the print solution, excluding sale or lease, during the entire resulting contract term including any renewal or extension period.

The awarded contractor solution will be Service Oriented Architecture compatible. Hosted software or service may be cloud based. Cloud based solutions must demonstrate strong two (2) factor authentication provided by either the awarded vendor or Department, role-based access controls, FIPS grade encryption of data at rest and in transit, and align with the State of Nevada Cloud Hosting security requirements. Contractor Service Level Agreements (hereinafter “SLA”) must conform to FEDRAMP and NIST 800-53 compliance controls.

Software and applications shall be continuously maintained throughout the contract term using qualified personnel to ensure that it operates as contemplated by this RFP, as outlined in Section 4.18, Technology Upgrade, and in compliance with the contract.

Any off premise storage of applications or data must be located within the United States.

Software maintenance must include up-to-date 3rd party security patches and version upgrades. Critical vulnerabilities must be patched within thirty (30) calendar days of vendor release; High and medium patches applied within ninety (90) calendar days of vendor release. Failure to resolve vulnerabilities in the respective thirty (30) or ninety (90) days may result in liquidated damages as defined in Section 28, Performance Standards and Liquidated Damages.

The awarded contractor’s engineering team and technical leads assigned to the Contract shall have sufficient expertise to make recommendations for awarded vendor-supplied software configurations. All awarded vendors accessing DMV data, systems, or remote management, must pass DMV background checks, which includes Federal Bureau of Investigation fingerprint and REAL ID clearance.

At a minimum, the solution must be compatible with the Department’s current operating systems detailed in Section 2.4 through 2.7. The awarded contractor must be capable of working with all current and future operating systems and must allow for all operating systems to function continuously with Service Packs, Security Patches, and Hot Fixes. Major releases of the Microsoft Operating System are made available and deployed as part of the Department’s software management lifecycle. Critical third-party vulnerabilities must be patched within thirty (30) calendar days from Awarded vendors release. All other vulnerabilities must be patched within sixty (60) calendar days. If vulnerabilities are not patched within the required time periods liquidated damages may be applied as defined in Section 28, Performance Standards and Liquidated Damages.

Any operating systems used throughout the life of the contract must be kept up to date with the most current version; and all updates and patches must be performed monthly, at a minimum. If these conditions are not met, liquidated damages may be applied as defined in Section 28, Performance Standards and Liquidated Damages.

Awarded contractor must have a UAT region to test all patches and software updates before moving any changes to the Production region. Environment needs to be active Monday through Friday 8:00am to 5:00pm Pacific Time. The UAT infrastructure must be separate from the production infrastructure. Cards and retrieval from the non-production region are done at no cost to the Department.

Awarded contractor shall develop a process flow and provide a schedule of all software updates and patches. Preferred advanced notice should be given at least thirty (30) calendar days, if possible, on all updates and patches. All updates and patches must follow the Department’s change control process from development to production.

During the contract term, if updates to awarded contractor-supplied software and equipment are required as a result of operating system patches, the awarded contractorr-supplied software and equipment must be updated at no cost to the Department.

Software updates must be provided to the Department whenever they become available, and must meet the following:

Software documentation shall be provided upon delivery of updated software releases.

Documentation will include a system security plan design document (following Federal Risk and Authorization Management Program (hereinafter “FEDRAMP”) templates), used to identify, describe, and define the system security baseline, and include NIST 800-53 control test cases, with current vulnerability scans and defined Plan Of Action and Milestones (hereinafter “POAM”) as necessary.

If functionality is changed as a result of any updates, the awarded contractor must provide training within software documentation.

Updated software will be compatible with all application software and equipment installed at any time during the contract term.

The awarded contractor shall provide a system for acceptance and non-acceptance, by the Department, of any software updates.

Awarded contractor must provide at least thirty (30) calendar days notification, or another mutually agreed upon period, before any software updates are performed, at no additional cost to the Department. Failure to properly communicate with the Department may result in liquidated damages as defined in Section 28, Performance Standards and Liquidated Damages.

The awarded contractor shall, at least annually, review and update technical bulletins, user guides, and provide any updates to the Department’s Contract Manager or designee, in a mutually agreed-upon format.

The awarded contractor shall correct, remedy, and produce a detailed report of any programming error attributed to the awarded C=contractor, in a time-frame agreed to by the Department.

In meeting the above specifications, as well as any other requirements of the Contract, additional software (i.e., software that was not included in Awarded vendor’s reply or Best and Final Offer (hereinafter “BAFO”) and software incorporated in the Contract, or that was not known or identified at the time of Contract finalization, or otherwise referenced in the Contract) is required during the contract term. All such software shall be supplied and updated by the awarded contractor at no additional cost to the Department.

Application Programming Interface

The following software-related requirements for the application programming interface (hereinafter “API”) must be met to ensure service delivery as contemplated in this RFP:

The API must be accessible using a secure web transport layer secure Hyper Text Transfer Protocol Secure (HTTPS) or similar technology as agreed to and/or approved by the Department.

The API must be implemented as a Representational State Transfer (hereinafter “REST”) web service or similar technology as agreed to and/or approved by the Department.

API solution must provide security and integrity in all facets of transportation of information.

The API must provide the following functionalities as service operations:

Print Job Status Reporting: The API must allow for reporting the status, including changes of status, of a print job in real-time.

Mailing Job Status Reporting: The API must allow for real-time reporting for the status of mailed credentials.

Production Reporting: The API must allow for real-time reporting of production data such as, but not limited to quantity printed during specific time periods, quantities printed by credential type and daily production logs.

Provide Inventory Control Number: The API must provide the inventory control number after each print.

Change Job Status of Credentials: The API must allow a credential to be held from printing and subsequently provide the option to cancel or resume the print job.

Reprint of Credentials: The API must allow for the ability for credentials to be reprinted without conducting a new transaction.

Delete Print Jobs: The API must allow pending print jobs to be deleted/cancelled.

The Software must implement a Callback Method to a Department Web Service upon the status change of a print job.

The CIPS will have sufficient processing power to accommodate a total of 100,000 retrievals per day by any custom retrieval application implemented by the Department.

Credential Production Data

The transfer of information to and from each CIPS facility must be over secure channels and all data in transport must be encrypted.

The Department will provide credential data to the awarded contractor, at a mutually agreed-upon scheduled time, which will indicate standard printing and expedited printing and mailing.

The Department will work with the awarded contractor to determine the best way to transfer data between the Department and the awarded contractor. At a minimum, the awarded contractor must be able to use SFTP and Web-Service Communications.

Test Environment, User Acceptance Testing Environment and Compliance Review

CIPS Integration and Test Environment

The awarded contractor will begin integration with the Department’s network and programs in a TEST environment.

The awarded contractor’s engineering team shall be available to work with the Department to integrate the awarded contractor’s CIPS print solution, to include any equipment and software interface(s). This integration will precede the required CIPS TEST Compliance Review. CIPS Integration must be completed within forty-five (45) business days from being granted access into the Department system for integration. Integration is deemed completed by demonstrating the ability to print all card designs with appropriate security features and returning the required information to the Department’s CIPS application.

The awarded contractor must be ready to submit and pass the CIPS TEST Compliance Review within forty-five (45) business days after access into the Department’s system for integration is granted. If the awarded contractor has not successfully passed the CIPS TEST Compliance Review at the expiration of the TEST Compliance Review period, the awarded contractor may request an extension for up to an additional thirty (30) business days in writing to the Department. The written extension notice will identify all deficiencies and requirements that must still be met. The awarded contractor must notify the Department in writing of readiness for re-evaluation within twenty-four (24) hours of the last-noted deficiency correction. If the awarded contractor cannot thereafter pass the CIPS TEST Compliance Review, within the stated time frame, the contract with the awarded contractor may be terminated.

CIPS Integration will be subject to and must pass a Department conducted CIPS TEST Compliance Review. The CIPS TEST Compliance Review must verify the Awarded vendor’s CIPS print solution integration successfully operates and functions with the Department’s CIPS application, and is in accordance with all of the following:

The specifications set forth in the RFP; all specifications and operational requirements established by the respective manufacturers;

The awarded contractor’s Reply and BAFO, as incorporated in the Contract;

All requirements set forth in the resulting Contract are fulfilled; and

Able to demonstrate and produce all card designs with appropriate security features from the Awarded vendor provided capture software.

Within five (5) business days after the successful CIPS Integration, the awarded contractor must contact the Department’s Contract Manager, IT designee, Contract Monitor and ISO to request CIPS TEST Compliance Review. The Department will begin the review within five (5) business days of receiving this request and complete the Compliance Review within ten (10) business days. Results of the TEST Compliance Review will be provided to the Awarded vendor in writing; stating a “pass” or “fail” result, listing any deficiencies, if there are any.

Within fifteen (15) calendar days after successfully passing the TEST Compliance Review, the awarded contractor must notify the Department it is ready to move to the Department’s UAT environment.

CIPS Integration and User Acceptance Testing (UAT)

Upon notification to the Department of CIPS UAT integration readiness, the Awarded vendor’s engineering team shall be available to work with the Department to integrate the awarded contractor’s CIPS print solution, to include any equipment and software interface(s), with the Department’s CIPS application. This integration will precede the required CIPS UAT Compliance Review. CIPS Integration must be completed within twenty-five (25) business days of CIPS UAT Integration Compliance Review readiness notification. Integration is deemed complete by demonstrating the ability to print all card designs with appropriate security features and returning the required information to the Department’s CIPS application.

The awarded contractor must be ready to submit and pass the UAT Compliance Review within twenty-five (25) business days after the Department allows integration access into the Department’s UAT environment. If the awarded contractor has not successfully passed the UAT Compliance Review at the expiration UAT Compliance Review period, and the review period falls outside of the twenty-five (25) business day period, the Department, at its discretion, may extend the UAT period for up to an additional thirty (30) business days with a written extension notice. The written extension notice will identify all deficiencies and all UAT requirements that must still be met with a time-frame for corrections and compliance with UAT requirements. The awarded contractor must notify the Department in writing of readiness for re-evaluation within twenty-four (24) hours of the last-noted deficiency correction. If the awarded contractor cannot thereafter pass the UAT Compliance Review, within the stated time-frame, the contract with the awarded contractor may be terminated.

The UAT site will be subject to and must pass a Department conducted UAT Compliance Review. The Lab and Development sites are excluded from the UAT Compliance Review requirement. The UAT Compliance Review must verify the installed equipment has been successfully integrated, operates, and functions in accordance with the following:

The specifications set forth in the RFP; all specifications and operational requirements established by the respective manufacturers;

The awarded contractor’s Reply and BAFO, as incorporated in the Contract;

All requirements set forth in the resulting contract are fulfilled; and

Able to demonstrate and produce all card designs with appropriate security features from the Department’s Capture software.

Within five (5) business days after the successful integration of the print solution, the awarded contractor must contact the Department’s Contract Manager, IT Designee, Contract Monitor and ISO to request UAT Compliance Review. The Department will begin and complete the review within five (5) business days of receiving this request. Results of the UAT Compliance Review will be provided to the awarded contractor in writing; stating a “pass” or “fail” result, listing any deficiencies.

Within fifteen (15) calendar days after successfully passing the UAT Compliance Review, the Awarded Contractor must notify the Department it is ready for CIPS integration (i.e., awarded contractor’s CIPS print solution is prepared to successfully integrate with the Department’s CIPS application.

Within fifteen (15) calendar days after successfully passing the UAT Compliance Review, the Awarded Contractor must notify the Department it is ready to move to the Department’s Production environment.

Disaster Preparedness; Disaster Recovery Plan; And Return to Service

Disaster Preparedness Plan

The Awarded contractor shall provide to the Department’s Contract Manager, Contract Monitor and Information Security Officer (hereinafter “ISO”) a Disaster Preparedness Plan as part of the Final Project Plan detailed in Section 8, Implementation and Project Plan Finalization Requirements. The Disaster Preparedness Plan must address the steps to be taken at each CIPS facility in response to an impending disaster (e.g., hurricane, flood, etc.) and outline procedures for securing all equipment, consumables, and maintaining the secure status of all records and data. The plan shall also address transfer of operations to the Secondary CIPS Facility in the event the Primary CIPS Facility is destroyed or not capable of meeting production requirements.

The Disaster Preparedness Plan must be approved by the Department in writing following the same approval and revision periods established in Section 8, Implementation and Project Plan Finalization Requirements, Disaster Preparedness Plan, Subsection 8.1.3. The plan shall be updated as needed during the term of the contract.

The functionality of the CIPS secondary facility must be tested at least annually. After testing, a statement must be provided to the Department that details the capability for the CIPS secondary facility to transfer operations without a lapse of service and the ability to meet all credential production volumes. Failure to comply with testing at least once a year or failure to provide the statement detailing CIPS secondary facility capabilities may result in liquidated damages as defined in Section 28, Performance Standards and Liquidated Damages.

Disaster Recovery Plan

As part of the Final Project Plan detailed in Section 8, Implementation and Project Plan Finalization Requirements, the Awarded contractor shall provide to the Department’s Contract Manager, Contract Monitor and ISO, a Disaster Recovery Plan outlining the procedures for returning card production services to a fully-operational status at the Primary CIPS Facility following a disaster event. (Note: “Disaster event” includes any unplanned occurrence, whether caused by natural forces or due to action or inaction by the Awarded contractor or any other person that disrupts, damages, or otherwise negatively impacts Awarded contractor’s facility and service delivery under the Contract.) The plan should, at a minimum, include detailed procedures for transferring service within twenty-four (24) hours to the Secondary CIPS Facility, if the Primary CIPS Facility is completely off-line or not capable of meeting production requirements as outlined in Section 8, Print Solution Requirements, subsection 4.1.2, Credential/Equipment Quantities. Liquidated damages may be applied as defined in Section 21, Performance Standards and Liquidated Damages if transferring service does not occur within twenty-four (24) hours, where the Secondary CIPS Facility meets all production requirements, of the Primary CIPS Facility becoming off-line or not meeting production requirements.

The Disaster Recovery Plan must be approved by the Department in writing following the same approval and revision periods established in Section 8, Implementation and Project Plan Finalization Requirements, Disaster Preparedness Plan, Subsection 8.1.3.

The Awarded contractor shall review and/or update the Disaster Recovery Plan annually, at a minimum, during the term of the resulting contract. Any proposed updates to the Disaster Recovery Plan must be provided to the Department’s Contract Manager, Contract Monitor and ISO within thirty (30) calendar days, or a time mutually agreed upon by the Department, of the update, for written approval.

The Awarded contractor must notify the Department’s Contract Manager or designee, within one (1) hour, by phone and email, of any event requiring execution of the Awarded contractor’s Disaster Recovery Plan. Lack of communication may result in liquidated damages as defined in Section 28, Performance Standards and Liquidated Damages.

Return to Service Plan

Following any event during which the Awarded contractor’s Disaster Recovery Plan is executed, the Awarded contractor shall have up to fourteen (14) calendar days (depending upon the nature and extent of the disaster) to submit the Return to Service Plan to the Department’s Contract Manager, Contract Monitor and ISO. If the Awarded contractor is not able to submit a Return to Service Plan within the fourteen (14) calendar day period, Awarded contractor shall notify the Department of its inability to timely submit the plan, in writing, as soon as possible, but in no event later than noon, Pacific Time on the fourteenth (14) calendar day. The Department may, at its sole discretion and upon a showing of good cause, extend the time period for submission of the plan. Such extension shall be in writing from the Department. Failure to submit the Return to Service plan within the expected time or failure to coordinate a mutually agreed upon date may result in liquidated damages as defined in Section 28, Performance Standards and Liquidated Damages.

The plan shall outline all Awarded contractor steps to return to complete operational status at its Primary CIPS facility and the time frames for doing so. The plan should demonstrate steps sufficient to support a return of its Primary CIPS facility to full service delivery as quickly as possible, but not longer than six (6) calendar months after the Department’s approval of the Return to Service Plan. The Department will have ten (10) business days, or a time mutually agreed upon by the Awarded Contractor and the Department, after receipt of the Return to Service Plan to approve the plan in writing or notify the Awarded contractor that changes are required. The Awarded contractor shall submit a revised Return to Service Plan within ten (10) calendar days, or a time mutually agreed upon by the Awarded Contractor and the Department. The six (6) calendar month time period for returning to complete operational status may be extended at the sole discretion of the Department. Such extension shall be issued in writing by the Department. Failure to return to service as agreed upon in the Return to Service Plan may result in liquidated damages as defined in Section 28, Performance Standards and Liquidated Damages.

FUNCTIONAL REQUIREMENTS

Mandatory Service Delivery Requirements

By executing a contract resulting from this RFP, the Awarded Contractor agrees to be held responsible for providing, and shall ensure successful installation, implementation, operation, updating and maintenance of all equipment, software, applications, patches and updates associated with, and contemplated by, this RFP during the term of the resulting Contract, including any optional renewal or extension term.

The vendor must be able to seamlessly integrate with the DMV’s Modernization project. The Modernization project is an ongoing project that will affect all aspects of the DMV. All qualified vendors must be capable of interacting with both the Department and any Modernization project to assure that the vendor’s product and services can operate in unison with the new DMV system. The vendor must provide a solution that will work with our current system and future system that Modernization project will deliver, whether the system is implemented in phases, all at once, or parallel.

Consumables for CIPS Facilities

Consumables used in credentials production at either secure CIPS facility will be the sole responsibility of the Awarded contractor.

Costs for all consumables provided during the contract term will be the responsibility of the Awarded contractor.

The Awarded contractor shall keep an appropriate amount of consumables in stock at each CIPS facility during the entire contract term to ensure no interruption of service related to shortages or unavailability of consumable materials.

In the event any consumable needed for the production of any credential for the Department is identified by the Awarded contractor that it will become unavailable during the contract term, either temporarily or entirely (e.g., due to its discontinuance), the Awarded contractor must contact the Department by the next business day of making this discovery. The Awarded contractor must work with the Department to identify acceptable replacement materials and to implement the use of the Department-approved, replacement materials by a mutually agreed-upon time, which in no event may exceed 120 calendar days of the item(s) becoming unavailable, at no additional cost to the Department. The Awarded contractor must guarantee no interruption of service due to shortage or unavailability of acceptable replacement consumables. Failure to notify or replace materials as outlined in this section causing the interruption of service may result in liquidated damages as defined in Section 28, Performance Standards and Liquidated Damages.

SECURITY STANDARDS

System shall meet State security standards for transmission of personal information as outlined in NRS 205.4742 and NRS 603A.

Protection of sensitive information shall include the following:

Sensitive information in existing legacy applications shall encrypt data as is practical.

Confidential personal data shall be encrypted.

Any electronic transmission of personal information shall comply with NRS 603A.215 (2 & 3).

Sensitive data shall be encrypted in all newly developed applications.

All information technology services and systems developed or acquired by agencies shall have documented security specifications that include an analysis of security risks and recommended controls (including access control systems and contingency plans).

Security requirements shall be developed at the same time system planners define the requirements of the system. Requirements shall permit updating security requirements as new threats/vulnerabilities are identified and/or new technologies implemented.

Security requirements and evaluation/test procedures shall be included in all solicitation documents and/or acquisition specifications.

Systems developed by either internal State or contracted system developers shall not include back doors, or other code that would cause or allow unauthorized access or manipulation of code or data.

Security specifications shall be developed by the system developer for approval by the agency owning the system at appropriate points of the system development or acquisition cycle.

All system development projects shall include a documented change control and approval process and shall address the security implications of all changes recommended and approved to a particular service or system. The responsible agency shall authorize all changes.

Application systems and information that become obsolete and no longer used shall be disposed of by appropriate procedures. The application and associated information shall be preserved, discarded, or destroyed in accordance with Electronic Record and Record Management requirements defined in NRS and NAC 239, Records Management.

Software development projects shall comply with State Information Security Consolidated Policy 100, Section 4.7, Software Development and Maintenance and State Standard 131, “Security for System Development”.

Separate development, test and production environments shall be established on State systems.

Processes shall be documented and implemented to control the transfer of software from a development environment to a production environment. New hardware/software is not introduced into a production environment until it is fully tested and accepted by the State.

Development of software and tools shall be maintained on computer systems isolated from a production environment.

Access to compilers, editors and other system utilities shall be removed from production systems.

Controls shall be established to issue short-term access to development staff to correct problems with production systems allowing only necessary access.

Security requirements and controls shall be identified, incorporated in and verified throughout the planning, development, and testing phases of all software development projects. Security staff shall be included in all phases of the System Development Lifecycle (SDLC) from the requirement definitions phase through implementation phase.

Security and Fraud Prevention

Any system used or data stored, collected, or transmitted outside of the Department’s network or physical premises, must be encrypted in transit and at rest. Any system used or data stored, collected, or transmitted, must be secured in compliance with the REAL ID Act, applicable Nevada Laws, Department policies, and must be protected from unauthorized access or modification with appropriate levels of security logging for audit purposes.

The awarded contractor must ensure each piece of equipment having a data storage mechanism, provided, and maintained under the resulting Contract, is properly sanitized to ensure data cannot be retrieved from media prior to disposal, replacement, reuse, or removal. Acceptable methods of sanitization include software to overwrite data on computer media, degaussing, or physical destruction. File deletion and formatting media are not acceptable methods of sanitization. Failure in properly sanitizing equipment before disposal, replacement, reuse, or removal may result in liquidated damages as defined in Section 28, Performance Standards and Liquidated Damages.

The Awarded contractor is responsible for the protection and security of all information provided by the Department. The Awarded contractor or subcontractor provided Department information shall:

Provide physical and logical protection for all related hardware, software, applications and data that meet or exceed industry standards and requirements as detailed in this RFP;

Maintain network, system, and application security, which includes network firewalls, intrusion detection, and at a minimum, security testing will be conducted once per calendar year. Failure to conduct security testing may result in liquidated damages as defined in Section 28, Performance Standards and Liquidated Damages;

Comply with State and federal regulations and guidelines related to security, confidentiality and auditing as mutually agreed upon;

Ensure that security is not compromised by unauthorized access to computers, programs, software, databases, or other electronic environments; and

The Awarded contractor shall promptly report all incidents to the Department’s Contract Manager or designee, Contract Monitor, and ISO of all attempted incidents as detailed in Subsection 3.5.12.13.

Disclosure of Department information by the Awarded contractor or any Subcontractor for any reason may be cause for legal action by third parties against the Awarded contractor, the Department or their respective agents. Awarded contractor shall indemnify, save, and hold harmless the Department, its employees and agents against any and all third party claims, damages, liability and court awards including costs, expenses, and attorney fees incurred as a result of any act or omission by the awarded contractor, or its employees, agents, subcontractors, or assignees. Notwithstanding any other provision of this Contract, the Awarded contractor shall be liable to the Department for all consequential and incidental damages arising from an incident caused by the Awarded contractor or its subcontractors.

Data no longer viable or required under the contract will be securely destroyed in a manner that ensures it cannot be retrieved or accessed by unauthorized persons. The awarded contractor will provide an annual statement to the Contract Manager identifying the data that was destroyed during the year, the manner in which it was destroyed, and certifying the method utilized prevents, to the utmost extent possible, retrieval or access by unauthorized persons.

CIPS Facilities

General Security Requirements

The Factory will meet strict physical security requirements, including compliance with the physical security requirements of the REAL ID Act and NASPO security standards. Failure to comply with such security standards may result in liquidated damages as defined in Section 28, Performance Standards and Liquidated Damages.

All PII must be protected from theft and securely stored at all stages of production.

Security components, card design, and card materials will be protected from theft and loss during all phases of the manufacturing and packaging process.

The Awarded Contractor shall ensure that only authorized individuals access any CIPS facility at any time. All guests must sign-in and provide identification.

The Factory must be protected with physical securities such as, but not limited to, alarm systems, camera surveillance, and zone-specific access controls.

All secure production materials will be stored in a vault area and only removed for the purpose of card production.

No material or DL/ID cards will be stored outside of the vault after hours.

The Department, or agent of the Department, may visit or conduct a security audit of the Factory with or without advance notification. All costs associated with a security audit are the responsibility of the Department. Third Party security auditors must sign a Non-Disclosure Agreement (hereinafter “NDA”) with the awarded vontractor and comply with the awarded contractor’s security policies.

All equipment and software necessary for the operation of the secure CIPS facilities, including any upgrades, shall be provided by the awarded contractor. Such equipment, software, and any future upgrades shall be provided, at no additional cost to the Department.

Each facility must be capable of communicating with Enterprise Information Technology Services (hereinafter “EITS”) through secure methods as determined by the Department, and at a minimum, using SFTP and web-services.

Servers in the CIPS facilities must be redundant with failover and load balancing.

The awarded contractor shall be responsible for complete management of each CIPS facility, which shall include providing all staff and meeting all staffing and operational needs in order to ensure timely, quality credential production.

The awarded contractor shall report both physical and logical breaches to the Department’s Contract Manager or designee and Contract Monitor, within fifteen (15) minutes of identifying the breach, by phone and e-mail. The Awarded Contractor must follow-up with breach details in writing within seven (7) business days to identify solutions enacted, provide a resolution timeline, if the breach has not already been resolved, and identify any future preventive measures.

The Awarded contractor shall be solely responsible for all building maintenance, upkeep, and repair of the CIPS facility.

Primary CIPS Facility

The primary secure CIPS facility must be a Certified NASPO facility.

The awarded contractor shall provide, operate, and manage a primary secure facility (a primary facility within the contiguous United States) which will house a CIPS for credential production.

Secondary CIPS Facility

Secondary CIPS facilities will be utilized by the Awarded contractor as a Disaster Recovery Site and must be NASPO certified.

The Awarded contractor shall have a secondary CIPS facility, equally secured and able to handle the same volume and credential services of the primary CIPS facility. The secondary facility must also be located in the contiguous United States and must be located at a separate facility from the primary facility, at a far enough distance to not allow for a catastrophe to affect both facilities simultaneously. The secondary facility does not need to be operational until needed, however, it must not cause a lapse in service if secondary facility use is required.

REPORTING AND RECORDS REQUIREMENTS

Reporting

Weekly Status Reports

The Awarded contractor shall provide Weekly Status Reports through the entire installation, roll-out period, and shall continue to provide this report until the Department determines less frequent reporting is needed. Weekly Status Reports shall include; summaries of all current and completed activities and must be submitted in writing to the Department’s Designee, on a mutually agreed-upon day each week and in an agreed-upon format. E-mail delivery of the Weekly Status Report is acceptable. Each Weekly Status Report shall include, at a minimum, the following information:

Activities/tasks worked on or completed during the week;

Upcoming major activities/tasks;

Apparent, current, and future risks; and

Important issues and project barriers.

Project Status Meetings

The Awarded contractor’s Project Manager and other appropriate personnel shall be available for weekly, at a minimum, Project Status Meetings, by phone, electronic means, (e.g., web-ex meetings, internet meetings, etc.) or in person during normal business hours or outside business hours upon request. The Awarded contractor’s Project Manager should be available to meet more than once a week during any period in which issues occur that warrant more frequent meetings.

The weekly meetings may be reduced (i.e., occur less than weekly) after the first year of the contract, based on a mutual written agreement. All meetings/conferences will be held on an agreed-upon day and time. The Awarded contractor’s Project Manager shall work closely and collaboratively with the Department’s Contract and Project Managers for scheduling status meetings and presenting issues for discussion at these meetings.

If a meeting is to be conducted in person by both parties, the Department will designate a meeting location. All meetings conducted in person will be at no additional cost to the Department.

Monitoring

During the contract term, the Department’s Designee will monitor the Awarded contractor’s performance in accordance with the terms and conditions set forth in the RFP, the Awarded contractor’s Reply and Best and Final Offer.

Performance Review Meetings to be held with awarded contractor personnel both in-person and by…