CTR061120_-_Contract.pdf

PART 3 of the Solicitation Documents

Template version 2.0 (01-FEB-2017)

SECTION 3-B: Offer Forms

Page 1 of 270 3 A v a i l a b l e o n l i n e a t : P r o c u r e . A Z . g o v

Attachment 1 Offer and Acceptance Form

SUBMISSION OF OFFER: Undersigned hereby offers and agrees to provide Biometric Products and Services to in compliance with the Solicitation indicated above and our Offer indicated by the latest dated version below:

Initial Offer:

1. 08/29/2018 RC

date initial

Revised Offers:

2. 3. 4.

date #1 initial date #1 initial date #1 initial

5. 6. 7.

date #4 initial date #5 initial date #6 initial

Best and Final Offer:

8. 10/24/2018 RC

date initial

Gemalto Cogent, Inc. RC

Offeror company name Signature of person authorized to sign Offer Initials

639 North Rosemead Blvd. Robert Cimperman Vice President Sales North America

Address Printed name and title

Pasadena, CA 91107 David Mildren Proposal Manager

City | State | ZIP Contact name and title

95-4305768 CogentRFPTracking@gemalto.com 626-325-9600

Federal tax identifier (EIN or SSN) Contact Email Address Contact phone number

CERTIFICATION: By signature in the above, Offeror certifies that it:

1. will not discriminate against any employee or applicant for employment in violation of Federal Executive Order 11246, [Arizona] State Executive Order 2009-9 or A.R.S. §§ 41−1461 through 1465;

2. has not given, offered to give, nor intends to give at any time hereafter any economic opportunity, future employment, gift, loan, gratuity, special discount, trip, favor, or service to a public servant in connection with the submitted offer. Failure to provide a valid signature affirming the stipulations required by this clause will result in rejection of the Offer. Signing the Offer with a false statement will void the Offer, any resulting contract, and may be subject to legal penalties under law;

3. complies with A.R.S. § 41-3532 when offering electronics or information technology products, services, or maintenance; and

4. is not debarred from, or otherwise prohibited from participating in any contract awarded by federal, state, or local government.

ACCEPTANCE OF OFFER: State hereby accepts the initial Offer, Revised Offer, or Best and Final Offer identified by number 8 at the top of this form, and which was dated 10/24/18 (the Accepted Offer). Offeror is now bound (as Contractor) to carry out the Work under the attached Contract, of which the Accepted Offer forms a part. Contractor is cautioned not to commence any billable work or to provide any material or perform any service under the Contract until Contractor receives the applicable Order or written notice to proceed from Procurement Officer.

State’s Contract No. is: CTR040045 - The effective date of the Contract is: 11/1/18 Contract awarded: 10/31/18

Procurement Officer signature Procurement Officer printed name

Nick Perrera

Request for Proposal Solicitation No.

ADSPO18-00008040

Description:

Biometric Products and Services

Arizona Department of Administration

State Procurement Office 100 N 15th Ave., Suite 402

Phoenix, AZ 85007

PART 2 of the Solicitation Documents

Table of Contents Page 1 of 70 2

A v a i l a b l e o n l i n e a t P r o c u r e . A Z . g o v

Part 2: Scope, Pricing and Terms and Conditions

Table of Contents SECTION 2-A: Scope of Work

1.0 Purpose and Background

2.0 Scope Summary

3.0 Scope of Work –Biometric Products and Services

4.0 Technical Proposal

SECTION 2-B: Pricing Document

1.0 Compensation

2.0 Pricing

3.0 Funding

4.0 Invoicing

5.0 Payments

SECTION 2-C: Special Terms and Conditions

SECTION 2-D: Uniform Terms and Conditions https://procure.az.gov/bso/

ADSPO18-00008040

Description:

Biometric Products and Services

Arizona Department of Administration

State Procurement Office

Section 2-A: Scope of Work Page 2 of 70 2

SECTION 2-A: Scope of Work

1.0 Purpose and Background

1.1 Purpose: The State of Arizona is seeking one (1) or more qualified Contractors to provide Biometric Products and Services which include but not limited to: biometric and identification services, computer systems with related biometric identification capabilities, hardware, software, servers, cloud storage, hardware and software maintenance, customer and technical support services, licensing, and equipment used in biometric identification for: the state Automated Fingerprint Identification System (AFIS), electronic fingerprint and palm print processing, electronic fingerprint application processing (EFAP), facial recognition, iris and/or retinal scans, photo and electronic identification, tenprint, palm print, and latent print identification, electronic and biometric identification for access to buildings, computers, other devices for biometric identification and security needs.

The Contract(s) shall be on an “as needed, if needed” basis. There is no guarantee as to the amount of services purchased under any resulting Contract. Requirements shall be based on actual need. Contracts resulting from this solicitation will be used by multiple Eligible Agencies and Co-Op Buyers with locations throughout the State. Offerors may submit proposals for all or some of the products and services outlined in Section 3.0 Scope of Service and Section 4.0 Technical Proposal.

1.2 Background: The State has a need to provide a menu of biometric and electronic identification products and services statewide to all Eligible Agencies including law enforcement, criminal justice, and non-criminal justice agencies and Co-op Buyers.

2.0 Scope Summary

2.1 Biometric products and services are currently used by multiple State Agencies, Boards and Commissions. This solicitation will provide the ability to purchase a complete line of products and services to meet the increasing demands for biometric requirements on a statewide basis. The following products and services are being sought for this solicitation:

• AZAFIS Core System

• AZAFIS Core System Maintenance

• Hardware

• Hardware Maintenance

ADSPO18-00008040

Description:

Biometric Products and Services

Arizona Department of Administration

State Procurement Office

Section 2-A: Scope of Work Page 3 of 70 2

• Software

• Software Maintenance

• Support Services

• Training

• Solutions

• Integration / Implementation

• Labor (Services)

3.0 Scope of Work –Biometric Products and Services

Biometric service providers should identify and describe their product and/or service offerings based on the categories and sub-categories identified below. The list below does not make up a complete list but provides an overview of products (and features) and services that the State is seeking to procure.

3.1 Hardware

Fingerprint

• Livescan o Each print type must have demographics that are appropriate for the card type.

All demographics must be in NIST format for transmission to the state and FBI systems, and in accordance with the FBI EBTS, the Arizona Data Dictionary and Interface Control Document (ICD) specifications.

o The livescan demographics shall clearly indicate on the user screen which demographics are mandatory for record transmission and which fields are optional.

o The livescan will have validations in place for demographic data to ensure invalid data is not acceptable.

o The livescan, if submitted for criminal record, will maintain all local, state, tribal, and federal charges as provided by Department of Public Safety (DPS). These offense codes shall be retained at all times in the livescan. The livescan must have a validation in place to ensure that offense codes no longer active (retired) are not used if the Date of Offense (DOO) listed on the record is outside the time when the charge was active.

o The livescan, if submitted for criminal record, shall have foot pedals which allow the operator to scan and save fingerprint images.

o The livescan, if operating in a criminal justice facility, must be capable to interface with other agency Record Management Systems (RMS) and Jail Management Systems (JMS). The livescan must be able to retrieve messages

ADSPO18-00008040

Description:

Biometric Products and Services

Arizona Department of Administration

State Procurement Office

Section 2-A: Scope of Work Page 4 of 70 2 from DPS or the livescan itself on the status of a record transmitted. These statuses include:

Record transmitted Record printed (if applicable to the agency using the livescan) Record processed through the state AFIS (provide SID, if applicable) Record received a state rejection Record processed through FBI AFIS (provide UCN, if applicable) Record received an FBI rejection o Tenprint Fingerprint Process and Searches o Two-Finger Identification Searches with two-finger identification devices o Full palm print capture capabilities o Latest livescan technology which is capable of capturing the tenprint fingerprints at 500 pixels per inch (ppi) with an option to capture at 1,000ppi.

Full palm capture can be achieved through the two different methods, as approved by the FBI:

1. Segmented capture of each palm (right and left hand) by capturing the lower palm and upper palm separately. Sufficient friction ridge detail must be available and present in transmission to the state and FBI in which the two images can be stitched together (to confirm the same palm was used for both upper and lower images for both the right and the left hand respectively.)

2. Full palm captured at one time.

3. For either scenario above, the livescan must also be able to capture the writer’s palm.

o Printers (for livescan) and associated supplies o Mug Photo Cameras / Capture Devices

• Store and Forward equipment for criminal and non-criminal justice purposes

Arizona Automated Fingerprint Identification System (AZAFIS)

• AZAFIS Core System o System that utilizes latest in matching algorithm technology for the allowance of lights out processing and, if the record does not meet lights out processing thresholds, provide a list of candidates for an operator to review.

o System shall interface with the Arizona Computerized Criminal History (ACCH) for updating criminal history information.

o System shall interface with the FBI Next Generation Identification (NGI) database o System shall interface with applicant and licensing tracking databases as determined by DPS.

ADSPO18-00008040

Description:

Biometric Products and Services

Arizona Department of Administration

State Procurement Office

Section 2-A: Scope of Work Page 5 of 70 2 o System shall have the capacity to store fingerprints, demographics, mug photos, scars, marks, and tattoos (SMTs), palm prints, latent prints, latent cases, iris, and capable for expansion for any future biometric features.

• Current System Size o Persons = 4.7 Million o Incidents = 8.3 Million o Palms = 2 Million o Mugshots = 13 Million o SMTs = 1.2 Million o Unsolved Latents = 100,000 o Digital Archive System = 8.2 Million o System shall have the networking, appropriate coders, matchers, hardware, software, and other applicable applications, servers and components to maintain the current database sizes and record capacity, and sufficient storage, memory, servers and other necessary components for expansion in storage and throughput.

• Annual Tenprint Throughput = 700,000 records

• Mug Photo records can be included with a tenprint record or as a separate file without fingerprints.

• Average Daily Throughput o Tenprint to Tenprint = 1,900 records o 2-Fingerprint Identification = 500 records o Tenprint to Unknown Latent = 1,900 records o Palm Print to Unknow Palm Print = 400 records o Latent Search = 200 records

• Annual Palm Print Throughput = 200,000 records (palm print records are submitted with a corresponding tenprint record).

• Latent Search Daily Throughput = 200 records o Utilizing the latest algorithms for providing highly accurate latent prints search results o Provide benchmark for accuracy o Lights Out (allows system to declare verification without user intervention) o Customizable threshold settings as determined by DPS o Capable to select lights out settings by Print Type and Agency (AZAFIS Sites) o Customizable to switch on and off lights out programming for both ident (hit) transactions and non-ident (no hit) transactions.

o System Reports – report on one specific transaction to how many records received in a given period of time o Ad Hoc Reports (custom) – ability to pull specialized report o Digital Fingerprint Archive System (stores all fingerprints, palm prints and mugshots)

ADSPO18-00008040

Description:

Biometric Products and Services

Arizona Department of Administration

State Procurement Office

Section 2-A: Scope of Work Page 6 of 70 2 o Ability to print and store mugshots, tenprint and palm prints cards and disposition reports in a format determined by DPS.

o Iris Identification

• Utilize the latest in matching algorithm technology for the allowance of lights out processing and, if the record does not meet lights out processing thresholds, provide a list of candidates for an operator to review.

• Throughput to be determined (DPS is currently entering a Pilot Program on Iris with the FBI) o Expandable and customizable system programming to incorporate future biometric standards and modifiable workflows based on new technology and practices as determined by DPS and FBI (e.g. Rap Back, NFF State Compliance, Voice pattern recognition, vein comparison, Rapid DNA submissions, etc.)

• Tenprint and Latent Print Workstations o Must have scanners set at 500ppi for capturing tenprint fingerprint cards and 1,000ppi for capturing latent prints. The scanner and programming must be compliant with FBI standards and the Arizona Data Dictionary (i.e. all Print Types available).

o Tenprint Workstations scanners must be upgradeable to 1,000ppi o Latent Prints Processing and Searches o Ability to store and capture major case prints

• Contactless Fingerprinting Equipment o As technology available o For fingerprinting enrollment purposes

• Multimodal (Tenprint and Latent Print Workstations)

• Must have scanners set at minimum of 1,000ppi for capturing latent prints and

500ppi for tenprint fingerprint cards. The scanner and programming must be compliant with FBI standards and the Arizona Data Dictionary (i.e. all Print Types available).

• Tenprint scanners must be upgradeable to 1,000 ppi

• Desktop Scanners (e.g., Flatbed)

• High Speed Batch Scanners

• Mobile Fingerprint Capture Devices for identification (e.g., single and/or tenprint options) o Tablets and handheld devices o Device must be useable and unattached to the PC for capturing the tenprint fingerprints

ADSPO18-00008040

Description:

Biometric Products and Services

Arizona Department of Administration

State Procurement Office

Section 2-A: Scope of Work Page 7 of 70 2 o Transmit single and/or tenprint fingerprint images at 500 ppi

• Mobile Fingerprint Capture Device for DNA check (DNA identifier current as in AFIS)

Mobile Identifications (Two-Finger Identifications) Must be:

• FBI Certified and CJIS compliant

• Interoperable with FBI NGI and AZAFIS System, as needed

• Capable of searching state biometric system and FBI Repository for Individuals of

Special Concern (RISC)

• Able to return the following information o AZAFIS Record Number (ARN) o SID (when applicable) o DNA on File Flag (when applicable) o Name o DOB o Photo o RISC Response

• Livescan Capability within Tablets for Mobility

• Same functionality as livescan specifications above

• Printers o Ability to print tenprint fingerprint and palm print cards, and disposition reports in a format determined by DPS.

• System reports – report on one specific transaction to how many records received in a given period of time

• Ad Hoc Reports (custom) – ability to pull specialized report

Facial Recognition

• Mug photo and video capturing, submission and storage o System capable of facial recognition utilizing live video o System capable of correcting images (e.g. correcting poses, eye position, background suppression, etc.)

• Investigative Workstations for Mug Photos

• System that utilizes latest in matching algorithm technology for face comparison

• System shall interface with the FBI Next Generation Identification or NGI database for the submission and retrieval of face images

• System capable of searching Scars, Marks, and Tattoos (SMTs)

ADSPO18-00008040

Description:

Biometric Products and Services

Arizona Department of Administration

State Procurement Office

Section 2-A: Scope of Work Page 8 of 70 2

• System shall include Mugshot photos, which includes the currently 13 Million images stored in the Arizona Department of Public Safety database, as well as all day forward mug photo submissions received by DPS

• System shall interface with the Arizona Department of Transportation (ADOT) Motor Vehicle Department (MVD) for the retrieval of drivers license photos and other applicable data o This will include all approximate 20 Million drivers license photos that the ADOT

MVD currently has in their database as well as all day forward photo submissions received by ADOT MVD

• System shall interface with the Arizona Department of Public Safety (DPS) for the retrieval of missing and exploited children images and other applicable data o This will include all the images that DPS contains in their current system as well as day forward image submission received by DPS

• Securely receive and transfer files of images and customer information to/from the

Department’s files server SFTP and FTPS

• Capable of supporting all future databases as determined by the Arizona

Department of Public Safety

• Mobile devices (phone, handheld devices, multimodal, and a system capable of managing a large throughput from up to 500 mobile devices operating in the field)

• System reports – report on one specific transaction to how many records received in a given period of time

System shall have the appropriate networking, coders, matchers, hardware, software, and other applicable applications, servers and components to maintain the facial recognition comparison system and workstations to the Eligible Agencies and Co-Op Buyers.

Iris equipment

• Mobile devices (phone, handheld devices, multimodal)

• System reports – report on one specific transaction to how many records received in a given period of time

3.2 Hardware Maintenance

• Tiers of maintenance by equipment (type)

ADSPO18-00008040

Description:

Biometric Products and Services

Arizona Department of Administration

State Procurement Office

Section 2-A: Scope of Work Page 9 of 70 2

• End of life notifications (preferably 2 years in advance)

• Maintenance increases that exceed 5% require justification for increasing costs year over year. Offeror shall propose a cap based on equipment useful lifespan

• Maintenance Agreement must be detailed and outline all services to be provided during the term

• Tracking program in order to monitor the vendor in addressing items (dashboard with open tickets, second level, etc.)

• Preventative Maintenance – vendor will provide detailed reports on services performed upon completion of maintenance

• Offeror to explain how issues are tracked and the process for clients to report and track problems (e.g., describe tool used and internal problem resolution system)

• Regular Quarterly Reporting (Offeror should be able to provide to the State an up-to-date listing of Eligible Agency and Co-op Buyers for equipment and associated maintenance)

3.3 Software

• Compatible with internal and external hardware and software (receiving and sending out data) accurately; to enable agencies (e.g. public safety agencies) to effectively capture, store, and reference captured data

• Integrate with existing system that can interface with State of Arizona’s ACIJS system, as well as the FBI’s systems

• Third party accepting fees – method for accounting for collection

Reports and Notifications:

• State agencies and DPS to receive notifications and reports on a weekly basis, transmission of data sent by encrypted communications o Applicant and application status o Access to a secured portal on vendor website for information o Reconciliation of payment

3.4 Software Maintenance

• Offeror to provide end of life notifications at a minimum of 1 year in advance (preferably 2 years)

• Offeror will outline organization’s security and updates for anti-virus and other security protections

• For any services, Offeror ensures operating systems are up-to-date; need to provide formal advanced notification (no less than 2 years in advance) prior to expiring operating systems (e.g. Windows 10)

ADSPO18-00008040

Description:

Biometric Products and Services

Arizona Department of Administration

State Procurement Office

Section 2-A: Scope of Work Page 10 of 70 2

• Tracking program in order to monitor the vendor in addressing items (dashboard with open tickets, second level, etc.)

• Offeror to provide policy and procedure for addressing software upgrades and bug fixes. The State requires the vendor to provide a detailed report on services performed upon completion of maintenance

• Offeror to describe approach to addressing upgrades and environments for stage, UAT and production environments

• Regular Quarterly Reporting (Offeror should be able to provide to the State an up-to-date listing of Eligible Agency and Co-op Buyers for equipment and associated maintenance)

• Maintenance increases that exceed 3% require justification for increasing costs year over year. Offeror shall propose a cap based on equipment useful lifespan

3.5 Support Services for Biometrics

• 24/7/365 Customer Service Center and Help Desk Support

• Timeframe for escalating issues (2 hours / 4 hours / call and follow up / dispatch technician)

• Ability to support all rural and metro areas

• Equipped to reconcile issues, system planned and unplanned outages and disputes

• Monitoring system virtual map that shows all devices showing for each unit so we know when equipment is down (Active Dashboard).

• Complete and accurate documentation representing system functionality with updates at no cost.

• SLA credit approach.

• Fee increases that exceed 3% require justification for increasing costs year over year. Offeror shall propose a cap based on equipment useful lifespan

3.6 Training

• Offeror to provide a Training Plan on new systems, timing, UAT, and production environment

• Offeror to provide a customized Training Plan.

• On enhancements and new products and/or services, Offeror to provide up to date

Training Manuals that reflect the AZ system (hard and soft copy).

• Training Manuals must be updated automatically, as needed, to reflect current system

3.7 System Requirements

Offerors shall provide method for complying with the following system requirements. If not applicable to your solution, please provide explanation.

ADSPO18-00008040

Description:

Biometric Products and Services

Arizona Department of Administration

State Procurement Office

Section 2-A: Scope of Work Page 11 of 70 2

Federal Bureau of Investigation (FBI) and Criminal Justice Information Services

(CJIS):

• Application and/or systems must meet FBI CJIS Security Policy for any criminal justice information that will be transmitted (FBI CJIS Policy Resource Center, version 5.6, dated 6/05/2017)

• FBI CJIS Security Policy FIPS 140-2 encryption standards, applies to all data that is at rest, in transit on all data backup, cloud compute, and cloud storage environments, and two-factor authentication

• National Institute of Standards of Technology (NIST) and American National Standard for Information Systems (ANSI) – ANSI/NIST-ITL-1-2011 Compliant

• Electronic Biometric Transmission Specification (EBTS) 10.0 compliant

• Vendor shall keep the customer up-to-date on the latest biometric technology that is offered by their company. As the need for biometric advancements are made at the FBI, the vendor will work with the Eligible Agencies and/or Co-op Buyer to ensure that the new technology is offered for Arizona to meet or exceed the new biometric technology. The vendor will also ensure that any updates are made to the state biometric system which coincide with changes/updates made to the FBI’s Electronic Biometric Transmission Specifications (EBTS). This includes any Technical and Operational Updates (TOU).

• Ability to program the submission of the electronic tenprint fingerprints using the provided Interface Control Document (ICD) and the Arizona Data Dictionary by the FBI requirements listed above

• Interoperability and compatibility with the FBI Next Generation Identification (NGI) System

State and Federal Standard for Quality and Compliance:

• Offerors should have plan and ability to implement system programing for continuous updating to maintain compliance with the state of Arizona legislative and FBI changing requirements

• Database systems that maintain compliance with all FBI and DPS computer security requirements, including connection to the Internet by any computer connected to State local area networks or mainframe systems;

that prevents unauthorized access to facilities, equipment, hardware, firmware and software; that maintains centralized identity management for use accounts, network and host intrusion measures and a centralized security model to secure information in the least amount of systems as practical; and that at a minimum contains all industry standard security measures to insure that access to personal and financial information and systems are limited to only those personnel requiring access.

ADSPO18-00008040

Description:

Biometric Products and Services

Arizona Department of Administration

State Procurement Office

Section 2-A: Scope of Work Page 12 of 70 2

3.8 Electronic Fingerprint Application Processing (EFAP)

3.8.1 Definitions:

“Agency system” means an information system operated and hosted by an agency or by the agency’s authorized business partner.

“Applicant” means an individual whose criminal history needs to be investigated and reported through the processing of the individual’s fingerprints by the Arizona Department of Public Safety (DPS) and the Federal Bureau of Investigation (FBI).

“EFAP” means electronic fingerprint application processing.

3.8.2 Electronic Fingerprint Application Processing (EFAP) Background

Legislation at the state and federal level requires a greater portion of applicants from the general public be fingerprinted to have criminal history background checks performed by the state for many types of employment, volunteer and licensing decisions. These include those seeking employment or volunteer jobs such as teachers, school bus drivers, child care providers, security guards, security system contractors, health care providers, financial service providers, and a host of other professions (hereinafter collectively referred to as “applicants”). Arizona Revised Statutes § 41-1080 and other laws also require some applicants to provide evidence that they are lawfully present in the United States. DPS anticipates an estimated 5% overall increase of these applications/licenses annually.

Each Offeror shall provide a solution that includes all equipment, hardware/software (firmware), maintenance, facilities, personnel, security, training and support along with a secure payment processing and transfer method. The solutions will verify applicant’s proof of lawful presence, during the contract term. In addition to offering fixed locations for EFAP, an Offeror may propose mobile services, as long as the mobile services meet all specifications for services delivered from a fixed location.

3.8.3 Other Technical and Security Capabilities – Electronic Fingerprint Application Processing (“EFAP”) Services:

• A Publicly Accessible Website o Single point o Secure o Easily searchable site o Maintains proper security measures

ADSPO18-00008040

Description:

Biometric Products and Services

Arizona Department of Administration

State Procurement Office

Section 2-A: Scope of Work Page 13 of 70 2 o Has Secure Socket Layer protocol (SSL) industry standard encryption algorithms to ensure the safety of application’s personal and financial information o Contains general program information, instructions, application services, fingerprint appointment scheduling, directions, and safe/secure payment services 24 hours per day, 7 days per week, 365 days per year (less approved system downtime for upgrade, repairs, or scheduled maintenance) o Allows applicants to book, cancel, and change scheduled appointments without additional rescheduling cost o Capable of electronically collecting associated fees and tracking transactions o Tracks and reports website transaction statistics monthly for first year and bi-monthly for each subsequent year o State agency access to view applicant information and status of applications received, including in prescribed cases transmission of notifications to agency systems upon receipt of fingerprints/fee payments and upon fulfillment of an applicant’s requirement to prove lawful presence in the United States.

3.8.3.1 Fingerprint Scanning Equipment at EFAP locations must be in and must maintain compliance with the latest version(s) of applicable FBI CJIS security policies

• Maintain compliance with all FBI EBTS and IQS certification standards

• Equipment must capture standard tenprint fingerprint roll and slap images

• Captures applicant records in compliance with the State of Arizona ICD and

NIST standards

• Equipped with all associated software/firmware, computer/technology interfaces, cable/wiring and connectivity to securely transmit all applicant information to DPS

• Maintain collaboration in accordance with FBI standards

• Captures applicant demographic information, fingerprint images and includes edit checks for valid information for both size and content, as well as performing quality checks of fingerprint images (shall be subject to periodic inspection for compliance by DPS)

• Maintain a 3% or lower applicant record/fingerprint reject rate

• Any equipment not meeting these standards shall be repaired and/or replaced within 24 hours of non-performance

• Server hardware, firmware and software that continuously processes and stores electronic demographic and fingerprint image from the EFAP service locations

ADSPO18-00008040

Description:

Biometric Products and Services

Arizona Department of Administration

State Procurement Office

Section 2-A: Scope of Work Page 14 of 70 2

3.8.3.2 Electronic Submission for Applicant Processing

• Verification of applicant identity

• Collection of evidence of lawful presence in the United States per ARS § 41-

1080 and other applicable laws

• Ability to submit electronic tenprint fingerprints and corresponding application to DPS for applicants

• Ability to provide at least one or more fingerprinting (mobile and non-mobile) locations in each of the counties in Arizona for statewide availability of service:

o State of Arizona Counties: Apache, Cochise, Coconino, Gila, Graham, Greenlee, La Paz, Maricopa, Mohave, Navajo, Pima, Pinal, Santa Cruz, Yavapai, and Yuma

• Electronic Fingerprint Application Processing (EFAP) location shall be those established, maintained, and located throughout the state in both rural and metropolitan areas of Arizona that provide application (including proof of lawful presence) processing, electronic fingerprinting and payment services, that are accessible to people with disabilities in accordance with the Americans with Disabilities Act (ADA); that comply with all application state and local laws, rules and regulations for these types of facilities; that have all other equipment, supplies and personnel necessary for successful operations under a resultant contract, and that have sufficient signage for applicants to easily locate service area(s); that have days and hours of operation that provide reasonable access to EFAP services; and that are located in accessible locations. EFAP location may be located within existing business/facilities and/or as stand-alone locations.

• Offeror shall notify Agency at least four (4) week in advance of adding, moving or eliminating an EFAP site, or in advance of changing the hours of operation of a site.

• Service delivery through agency business partners: Administer EFAP and proof-of lawful-presence services that meet all specifications from existing locations of agency authorized business partners that provide pre-license examination services or license application processing services.

3.9 Support Services

3.9.1 Support Services for EFAP

• Accepts customer calls between 8:00 AM to 5:00 PM MST, Monday through Friday, excluding state holidays.

• Equipped with a single, toll-free, program-specific phone number and a single and separate toll-free hearing-impaired service phone number

ADSPO18-00008040

Description:

Biometric Products and Services

Arizona Department of Administration

State Procurement Office

Section 2-A: Scope of Work Page 15 of 70 2

• Equipped to answer general public and customer/applicant questions

• Equipped to reconcile issues, system planned and unplanned outages and disputes

• Ability to provide directions to service facilities and schedule appointments for all service locations used under the contract

• Capable of answering customer/applicant calls within five (5) minutes

• Capable of assisting customers/applicants in the English and Spanish languages

• Maintains ability to collect associated fees and track transactions

• Allows applicants to book, cancel, and change scheduled appointments without additional rescheduling cost

• Tracks and reports statistics on incoming calls received and accepted on a monthly basis for the 1st year and bi-monthly for each subsequent year.

3.9.2 EFAP Livescan and Fingerprinting Processing Services

3.9.2.1 Tenprint Fingerprint Equipment, Software, Server and Maintenance

• 10 fingerprint roll and slap images with associated demographics

• Latest livescan technology which is capable of capturing the fingerprints 500 pixels per inch (ppi) with an option to capture fingerprints at 1,000ppi.

• Must have quality control process built in to the livescan to ensure the overall quality of the fingerprints are acceptable. This includes prints that are rolled out of sequence, too dark, too light, smudged, insufficiently rolled (for rolled impressions only).

• Capable of capturing applicant photographs for electronic submission with the fingerprints and associated demographics.

• Must have quality control process built in to ensure the captured applicant photographs meet or exceed DPS standards. This includes photographs that are too dark, too light, face captured too close or too far from camera.

• Data transmission hardware, firmware and software (such as API) that continuously processes and transmits applicant information from the Electronic Fingerprint Application Processing location equipment to DPS AFIS portal; that maintains automated method of processing and reporting transaction results; that utilizes a database to record transactional data, applicant information, transaction configurations and other information necessary for the proper tracking, execution, and result dissemination of all transactions and system functions; by email or paper letter, or a combination of both; that provides email conformation of provided services to applicants; and that provides applicant information in DPS and state agency approved formats.

• Server hardware, firmware and software that continuously processes and stores electronic demographic and fingerprint image information from the EFAP locations fingerprint scanning equipment that maintains a secure communication line in accordance with the ICD standards to the DPS

ADSPO18-00008040

Description:

Biometric Products and Services

Arizona Department of Administration

State Procurement Office

Section 2-A: Scope of Work Page 16 of 70 2 network allowing for secure submission of applicant submission information until confirmation of successful transmission to DPS.

3.10 Solutions

• All solution equipment must be compatible with the core biometric system/state AFIS system by third-party ICD

• Access Control Systems (e.g., badge readers)

• Database to adequately store and secure information

• Data storage and guarantee that only requested data is pulled and stored

• Database system that complies with FBI and DPS (NIST, EBTS) computer security requirements Secure web (cloud) based storage solution; Provide whether vendor has Cloud based services available and what is included in a Cloud Solution

• Exit strategy in the event of a cloud based solution

• Transmit encrypted data to host licensing system confirming receipt of fingerprints from individual

• Automated notification if fingerprinted individual is later involved in criminal prosecution

• Collection and proof of lawful presence such as a driver’s license and/or other authorized proof of identification as required by law prior to issuing a license.

• Provide information on how internal controls, reconciliation and reporting would function in the collection and transmission of fees charged to law enforcement agencies based on processing fingerprints.

3.11 Integration / Implementation

• Offeror to provide detailed, itemized proposals and quotes on any hardware or software solution requested by Eligible Agencies and Co-op Buyers. The proposals and quotes shall be broken down by their software, hardware, and professional service components.

• Offeror to describe full cycle process for integration of an existing system (hardware and software solution) include staffing, project plan development, discovery phase, testing for redundancy and final integration to new system. Must have testing schedules and plans and make available to Eligible Agencies and Co-ops Buyers.

• Verification that no criminal data history lost during integration (must maintain all existing records)

• Data migration – plan of action, validation, completeness/accuracy assuredness

• Ability to access and information from other Eligible Agencies and Co-op Buyers.

• AZAFIS system must interact with other agency databases (RMS)

ADSPO18-00008040

Description:

Biometric Products and Services

Arizona Department of Administration

State Procurement Office

Section 2-A: Scope of Work Page 17 of 70 2

• Virtual test and system upgrades require UAT Testing on actual Eligible Agencies and Co-op Buyers system prior to deployment into production environment

3.11.1 Payments:

• Payment Card Industry/Personal Identifiable Information (PCI/PII) compliance for credit cards, debit cards, and personal information

• Verify identity of applicant with identification

• Collections of fees may vary with each Eligible Agencies and Co-op Buyers

Applicant fee collection and transfer services that maintain the ability to securely collect and transfer into an assigned bank account, all applicable State and FBI mandated fees prior to or upon providing applicant services via acceptance of applicant credit/debit cards, money orders, business or personal checks, or direct billing accounts (for use by participating state agencies or employees); that securely transfers and/or makes available for state agency collection, all collected applicant fees from the transfer and/or makes fees available for state agency collection, all collected applicant fees from the assigned bank account upon completion of applicant services and transmission of data to the state agencies. The resultant Contractor(s) and the state agencies shall exchange necessary bank routing and account number information for this purpose. Non- reconcilable situations (i.e. bad checks, credit cards, etc.) resulting in applicant non-payments shall be borne by the resultant Contractor. Current applicant fee structure will vary by state agency.

o Applicant to pay at time of service

3.12 Labor (Services)

3.12.1 Contractor and prospective personnel:

• Contractor personnel and prospective contractor personnel who will be working at or with the Arizona Department of Public Safety (DPS) or are required to visit any law enforcement, criminal justice, or other state agencies for the purpose of performing maintenance on the secured systems including Arizona Automated Fingerprint Identification System (AZAFIS) equipment, installing or removing AZAFIS equipment, or are required to access the AZAFIS network, either directly or remotely via a Virtual Private Network (VPN), shall be required to submit fingerprints to DPS for a state and federal background check. The background check must be completed and the results approved by DPS prior to allowing the prospective employee access to the AZAFIS network or its system components. The vendor is responsible for submitting with the fingerprints

ADSPO18-00008040

Description:

Biometric Products and Services

Arizona Department of Administration

State Procurement Office

Section 2-A: Scope of Work Page 18 of 70 2 all documentation, forms, and payment required by DPS to complete the background check.

• Personnel hiring practices and training programs needed to maintain personal identity security and financial information security.

• Security classes may be required for contractor personnel that may have access to sensitive or confidential information.

• Security classes for CJIS certifications must be completed for any law enforcement access.

• On-site maintenance, programming, and technical support option

• Offeror to provide a list of authorized technicians, the coverage area and estimated time to dispatch and address issues.

• Offeror should propose higher-level programming labor service options

4.0 Technical Proposal

If applicable to an Offeror’s Solutions, an Offeror must provide a point by point response to each technical requirement demonstrating its technical capabilities. If a technical requirement is not applicable to an Offeror’s Solution then the Offeror must explain why the technical requirement is not applicable.

In responding to this RFP, Offerors shall identify and describe all of the products and/or services that are contained in their proposals.

4.1 Technical Requirements

Offeror may bid on the products and/or services outlined in Section 3.0, Scope of Work.

A separate proposal for each item is not required but Offeror must clearly identify each product and/or service offered in their response.

4.1.1 Offeror must identify for each service category(ies) the subcategories for each service that it plans to offer.

4.1.2 As applicable to an Offeror’s proposal, Offeror must describe its willingness to comply with, the requirements of this Scope of Work and Technical Proposal.

4.1.3 As applicable to an Offeror’s proposal, Offeror must describe how its offerings adhere to the functionality, services, solutions, definitions, etc. identified in this

RFP.

4.2 Subcontractors

4.2.1 Offerors must explain whether they intend to provide all products and services directly or through the use of Subcontractors. Higher points may be earned by providing all services directly or by providing details of highly qualified Subcontractors; lower scores may be earned for failure to provide detailed plans

ADSPO18-00008040

Description:

Biometric Products and Services

Arizona Department of Administration

State Procurement Office

Section 2-A: Scope of Work Page 19 of 70 2 for providing services or failure to provide details regarding specific Subcontractors. Any Subcontractor that an Offeror chooses to use in fulfilling the requirements of the RFP must also meet all Administrative, Business and Technical Requirements of the RFP.

4.2.2 Offeror must describe the extent to which it intends to use Subcontractors to perform contract requirements. Include each position providing service and provide a detailed description of how the Subcontractors are anticipated to be involved under the Contract.

4.2.3 If the Subcontractor is known, provide the qualifications of the Subcontractor to provide the services; if not, describe how you will guarantee selection of a Subcontractor that meets the experience requirements of the RFP. Include a description of how the Offeror will ensure that all Subcontractors and their employees will meet all Statement of Work requirements.

4.3 Working with Eligible Agencies and Co-Op Buyers

4.3.1 Offeror must describe how it will work with Eligible Agencies and Co-Op Buyers, include information such as:

• Personnel who will be involved at various stages, include detail on how these individuals will be involved;

• Response times;

• Processes and timelines;

• Methods of communication and assistance; and

• Other information vital to understanding the service you provide.

4.3.2 Offeror must describe how it will not engage in nor permit its agents to push adware, software, or marketing not explicitly authorized by the Eligible Agencies or Co-Op Buyers.

4.3.3 Offeror must describe (if applicable) whether its application-hosting environments support a user test/staging environment that is identical to production.

4.3.4 Offeror must describe whether or not its computer applications are accessible to people with disabilities, and must comply with Eligible Agencies and Co-Op Buyers accessibility policies and the Americans with Disability Act, as applicable.

4.3.5 Offeror must describe whether or not its applications and content delivered through Web browsers are accessible using current released versions of multiple browser platforms (such as Internet Explorer, Firefox, Chrome, and Safari) at minimum.

4.3.6 Offeror must describe how it will, prior to the execution of a Service Level Agreement, meet with the Eligible Agencies or Co-Op Buyers and cooperate and hold a meeting to determine whether any sensitive or personal information will be stored or used by the Offeror that is subject to any law, rule or regulation providing for specific compliance obligations.

ADSPO18-00008040

Description:

Biometric Products and Services

Arizona Department of Administration

State Procurement Office

Section 2-A: Scope of Work Page 20 of 70 2

4.3.7 Offeror must describe any project schedule plans or work plans that Offerors use in implementing their Services/Solutions with customers. Offerors should include sample timelines for developing, testing, and implementing Services/Solutions for customers.

4.3.8 Offeror is expected to update the services periodically as technology changes.

Offeror must describe:

• How Offeror’s patches, bug fixes, updates and upgrades are addressed?

4.4 Customer Service

4.4.1 Offeror must describe how it ensures excellent customer service is provided to Eligible Agencies and Co-Op Buyers. Include:

• Quality assurance measures;

• Escalation plans for addressing problems and/or complaints; and

• Service level Agreement (SLA).

4.4.2 Offer must describe its ability to comply with the following customer service requirements:

a) You must have one lead representative for the State. Contact information shall be kept current.

b) Customer Service Representative(s) must be available by phone or email

24/7 (i.e., Help Desk contact for on-call service representative).

c) Customer Service Representative will respond to inquiries within one hour after initial contact.

4.5 Security of Information

4.5.1 Offeror must describe the measures it takes to protect data. Include a description of the method by which you hold, protect, and dispose of data following completion of any contract services.

4.5.2 Offeror must describe how it intends to comply with all application laws related to data privacy and security.

4.5.3 Offeror must describe how it will not access an Eligible Agency’s user accounts or data, except in the course of data center operations, response to service or technical issues, as required by the express terms of the Special and Uniform Terms and Conditions of this RFP and/or the applicable Service Level Agreement.

4.6 Privacy and Security

4.6.1 Offeror must describe its commitment for its Solutions to comply with NIST and any other relevant industry standards, as it relates to the Scope of Work, including supporting the different types of data that you may receive.

4.6.2 Offer must list all government or standards organization security certifications it currently holds that apply specifically to the Offeror’s proposal, as well as those

ADSPO18-00008040

Description:

Biometric Products and Services

Arizona Department of Administration

State Procurement Office

Section 2-A: Scope of Work Page 21 of 70 2 in process at time of response. Specifically include HIPAA, FERPA, CJIS Security Policy, PCI Data Security Standards (DSS), IRS Publication 1075, FISMA, NIST 800- 53, NIST SP 800-171, and FIPS 200 if they apply

4.6.3 Offeror must describe its security practices in place to secure data and applications, including threats from outside the service center as well as other customers co-located within the same service center.

4.6.4 Offeror must describe its data confidentiality standards and practices that are in place to ensure data confidentiality. This must include not only prevention of exposure to unauthorized personnel, but also managing and reviewing access that administrators have to stored data. Include information on your hardware policies (laptops, mobile, etc.).

4.6.5 Offeror must provide a detailed list of the third-party attestations, reports, security credentials (e.g., FedRamp), and certifications relating to data security, integrity, and other controls.

4.6.6 Offeror must describe its logging process including the types of services and devices logged; the event types logged; and the information fields. You should include detailed response on how you plan to maintain security certifications.

4.6.7 Offeror must describe whether it can restrict visibility of data and documents to specific users or groups.

4.6.8 Offeror must describe its notification process in the event of a security incident, including relating to timing, incident levels. Offeror should take into consideration that Eligible Agencies and Co-Op Buyers may have different notification requirements based on applicable laws and the categorization type of the data being processed or stored.

4.6.9 Offeror must describe and identify whether or not it has any security controls, both physical and virtual Zones used to isolate hosted servers, if applicable.

4.6.10 Describe security procedures (background checks, etc.) which are in place regarding Offeror’s employees who have access to sensitive data.

4.6.11 Describe the security measures and standards (i.e. NIST) which the Offeror has in place to secure the confidentiality of data at rest and in transit.

4.6.12…