CTR061783_Contract_Documents.pdf

Procurement OFFER AND ACCEPTANCE

Solicitation No: BPM004539 Available online at https://app.az.gov

Rev 04/2020

OFFER

TO THE STATE OF ARIZONA:

The undersigned hereby offers and agrees to perform in compliance with all terms, conditions, specifications and amendments of this solicitation and any written exceptions in the offer. Signature also acknowledges receipt of all pages indicated in the Table of Contents.

Offeror (Company) Name Signature of Person Authorized to Sign Offer

Address Printed Name Date

City State Zip Title

Email Address Phone Number

Company Email Address Fax Number

By signature in the Offer section above, the Offeror certifies that the submission of the Offer did not involve collusion or other anticompetitive practices.

ACCEPTANCE OF OFFER (FOR DEPARTMENT USE ONLY)

The Contractor is now bound to perform based upon Contract Number _________________________________including all terms, conditions, specifications, amendments, etc., and the Contractor's offer as accepted by the state.

The Contractor is hereby cautioned not to commence any billable work or provide any material, service or construction under this contract until contractor receives a purchase order document.

State of Arizona

Effective this day of 20

Procurement Officer Awarded Date

Thales DIS USA, Inc.

9442 CAPITAL OF TEXAS HIGHWAY NORTH, SUITE 2-400

AUSTIN, TX 78759-6426

Antonio.lobrutto@thalesgroup.com

Antonio.lobrutto@thalesgroup.com

Tony Lo Brutto

Executive Vice President, IBS NORAM

240-595-5214

N/A

7/11/2022

DocuSign Envelope ID: A62B8954-796D-459F-ACCA-BB297E57F8C5

CTR061783

22nd August

8/22/2022

Procurement

ARIZONA DEPARTMENT OF TRANSPORTATION

1739 W. Jackson Street, MD 100P

Phoenix, AZ 85007 602.712.7211

Solicitation Amendment Summary SOLICITATION NO.: BPM004539 AMENDMENT NO.: One (1) DESCRIPTION: Central Credential Issuance

Rev. 04/2020

Pursuant to the Uniform Instructions to Offerors, Item B.6, Solicitation Amendments, the above referenced solicitation shall be amended as follows:

1. Solicitation due date is hereby extended to Tuesday, July 12, 2022 at 3:00PM AZ MST.

2. Financial Questions, Method of Approach to Core Services, Card design and Samples- Physical Samples shall hereby be replaced with the following:

Card Design and Samples - Physical Samples

The Offeror shall provide card samples and a description of the samples provided. The description shall include the following:

1. Detailed descriptions of card security features, including at least one (1) security feature unique to your company.

2. Detailed description of materials used in card production, including substrate and production techniques.

3. The card samples shall be delivered at any time before the Bid Due Date and Time to the address below:

ADOT Procurement Attn: Hold For Kelly Greene Procurement Officer BPM004539 (Card Samples) 1655 W. Jackson St., Mail Drop 100P Phoenix, AZ 85007

The Offeror shall provide the Department with three sets of all proposed card samples. The samples shall consist of both horizontal and vertical samples representing the DL/ID card type or design proposed. For example, if the Contractor proposes a single DL and state ID card, the Contractor shall provide three (3) card samples of the DL and three (3) card samples of the ID.

The card samples do not have to be Arizona-specific design, but the card samples provided shall fully depict the proposed card type/construction/printing method, and shall be produced on equipment identical to that which the Offeror is proposing to use for the CCPF.

The DL/ID card samples shall include the required data fields as outlined in the current AAMVA DL/ID Card Design Standard and shall include the proposed security features. Card samples shall be produced using the materials, substrates, construction and printing methods proposed.

If the Offeror proposes optional security features, the Offeror shall provide thirty (30) separate card samples that contain the optional security features and clearly identify them as such.

SOLICITATION NO.: BPM004539 AMENDMENT NO.: One (1)

All card samples submitted shall be blind samples, meaning they must not indicate in any way which Offeror produced them.

Please provide proof of shipment as a pdf attachment (ex: shipping confirmation with address, date shipped, expected delivery date)

3. Financial Questions, Proposal Requirements for Price – an additional question shall be added under this section of the questionnaire entitled “Optional Pricing”. The question shall read as follows: As an option the Offeror may provide a narrative to describe any optional items or features available. Please include pricing for the options in the narrative. The optional pricing document will not be used for evaluation purposes.

4. Scope of Work, Specific Requirements, Paragraph 4.1.1.6. shall hereby read as follows: “Any instance where the Contractor does not meet the delivery requirements as set forth in 4.1.1.1. and 4.1.1.2. will subject the Contractor to liquidated damages as listed below:

4.1.1.6.1. Regular Delivery Penalty for Exceeding Next Day : $0.25 per DL/ID card per day.

4.1.1.6.2. Expedited Delivery Penalty for Exceeding Same-Day: $5 per DL/ID card per day.”

5. Scope of Work, Specific Requirements, Paragraph 4.2.8. shall hereby read as follows: “A single unplanned system outage for all in-scope software and hardware components shall not exceed more than four (4) consecutive hours during Standard Hours of Operation. Unplanned system outages for all in-scope software and hardware components shall not exceed a combined total of eight (8) hours during Standard Hours of Operation per calendar month. Any instance where the Contractor does not meet those requirements, the Contractor will be subject to liquidated damages as listed below:

4.2.8.1. Single unplanned outage occurrences exceeding four (4) consecutive hours: $500.00 per occurrence.

4.2.8.2. Combined unplanned outages per calendar month exceeding eight (8) hours per month:

$500.00 per hour for every hour exceeding 8 hours per month.”

6. Scope of Work, Specific Requirements, Paragraph 4.5.2. shall hereby be replaced by the following : “The Department intends the proposed solution to be operational by March 1, 2023, from and after which the offeror’s solution will be the only solution for production and fulfillment of Arizona credentials.

7. All other terms, conditions and provisions of this solicitation remain unchanged.

SOLICITATION NO.: BPM004539 AMENDMENT NO.: Two (2)

Pursuant to the Uniform Instructions to Offerors, Item B.6, Solicitation Amendments, the above referenced

1. Financial Questions, Method of Approach to Core Services, Card design and Samples- Physical Samples shall hereby be replaced with the following:

Card Design and Samples - Physical Samples

The Offeror shall provide card samples and a description of the samples provided. The description shall include the following:

1. Detailed descriptions of card security features, including at least one (1) security feature unique to your company.

2. Detailed description of materials used in card production, including substrate and production techniques.

3. The card samples shall be delivered at any time before the Bid Due Date and Time to the address below:

ADOT Procurement Attn: Hold For Kelly Greene Procurement Officer BPM004539 (Card Samples) 1655 W. Jackson St., Mail Drop 100P Phoenix, AZ 85007

The Offeror shall provide the Department with three sets of all proposed card samples. The samples shall consist of both horizontal and vertical samples representing the DL/ID card type or design proposed. For example, if the Contractor proposes a single DL and state ID card, the Contractor shall provide three (3) card samples of the DL and three (3) card samples of the ID.

The card samples do not have to be Arizona-specific design, but the card samples provided shall fully depict the proposed card type/construction/printing method, and shall be produced on equipment identical to that which the Offeror is proposing to use for the CCPF.

The DL/ID card samples shall include the required data fields as outlined in the current AAMVA DL/ID Card Design Standard and shall include the proposed security features. Card samples shall be produced using the materials, substrates, construction and printing methods proposed.

If the Offeror proposes optional security features, the Offeror shall provide three (3) separate card samples of each type, (i.e.: horizontal, vertical, DL, State ID) that contain the optional security features and clearly identify them as such.

SOLICITATION NO.: BPM004539 AMENDMENT NO.: Two (2)

All card samples submitted shall be blind samples, meaning they must not indicate in any way which Offeror produced them.

Please provide proof of shipment as a pdf attachment (ex: shipping confirmation with address, date shipped, expected delivery date). If delivering in person please provide a receipt or proof of delivery to be signed and dated with time of delivery noted by the recipient. All samples must be received before the due date and time of the solicitation regardless of delivery method.

2. All other terms, conditions and provisions of this solicitation remain unchanged.

SOLICITATION NO.: BPM004539 AMENDMENT NO.: Three (3)

Pursuant to the Uniform Instructions to Offerors, Item B.6, Solicitation Amendments, the above referenced

1. Scope of Work, Specific Requirements, Paragraph 4.2.5 shall hereby be removed from the solicitation.

2. All other terms, conditions and provisions of this solicitation remain unchanged.

STATE OF ARIZONA

1739 W. Jackson St., Ste. A

REQUEST FOR PROPOSAL

SOLICITATION NUMBER: BPM004539

QUESTIONS: Inquiries regarding the solicitation are to be submitted online through the State’s e-Procurement system, Arizona Procurement Portal (APP) (https://app.az.gov/) using the Discussion Forum tab.

OFFERORS ARE STRONGLY ENCOURAGED TO READ THE ENTIRE SOLICITATION.

Kelly Greene Procurement Officer Phone: 602-712-4879 Email: Kgreene@azdot.gov

This solicitation is issued in accordance with A.R.S. §41-2534 and A.A.C. R2-7-C301 et seq., Competitive Sealed Proposals.

“An Equal Opportunity Agency”

The Arizona Department of Transportation, in accordance with the provisions of Title VI of the Civil Rights Act of 1964 (78 Stat. 252.42 U.S.C. §§ 2000d-4) and the Americans with Disabilities Act (ADA), hereby notifies all bidders that it will affirmatively ensure that any contract entered into pursuant to this advertisement, disadvantaged business enterprises will be afforded full and fair opportunity to submit bids in response to this invitation and will not be discriminated against on the grounds of race, color, national origin in consideration for an award.

Persons that require a reasonable accommodation based on language or disability should contact ADOT’s Procurement Office by phone (602) 712-2089. Requests should be made as early as possible to ensure the State has an opportunity to address the accommodation.

Las personas que requieran asistencia (dentro de lo razonable) ya sea por el idioma o discapacidad deben ponerse en contacto con ADOT (602) 712-2089.

https://app.az.gov/

TABLE OF CONTENTS

Solicitation No: BPM004539

Available online at

SECTION PAGE

Notice 1

Table of Contents 2

Scope of Work 3

Special Terms and Conditions 18

Uniform Terms and Conditions 36

EXHIBITS

1 - Title VI/Non-Discrimination Assurances Appendix A 46

2 - Title VI/Non-Discrimination Assurances Appendix E 47

3 - Card Formats 48

4 - Sample Factory Production Report 49

SCOPE OF WORK

1. Statement of Need

1.1. Pursuant to the Arizona Procurement Code, A.R.S. §41-2501 et seq., the State of Arizona Department of Transportation (Department), has a requirement for Central Credential Issuance.

The Department is seeking competitive proposals for card design, production, and fulfillment of physical credentials.

2. Introduction and Background

2.1. The Department processes credential applications for new credentials, renewals, and duplicates, for about 160,000 customers per month. These requests will be sent to the Central Credential Issuance Contractor to produce and mail the credentials to the customers. Currently over 1.9 million credentials are issued annually. The solution provided shall have the capacity to support the existing volume and an annual increase of up to two (2) percent.

3. General Requirements

3.1. The Contractor shall produce and mail Arizona Driver Licenses, Identification credentials, and Instruction Permits (DL/ID) Cards from the Contractor-managed Central Card Production Facility (CCPF) location to the Customers.

3.2. The Contractor-owned CCPF shall be capable of communicating with the Department’s MAX Database to receive web service and batch transmission to produce DL/IDs. Real-time/batch bi-directional communications with the Department could be continuous or could occur multiple times per day. The Department expects an overview for the solution to be as follows:

3.3. The Contractor designed DL/ID cards must meet or exceed all standards contained in the American Association of Motor Vehicle Administrators (AAMVA’s) DL/ID Card Design Standard document (https://www.aamva.org/getmedia/99ac7057-0f4d-4461-b0a2- 3a5532e1b35c/AAMVA-2020-DLID-Card-Design-Standard.pdf). DL/ID cards shall adhere to all applicable AAMVA standards as amended from time to time to include all ISO/IEC recommendations.

3.4. The Contractor shall provide all necessary printer device drivers, software necessary to produce credentials, and all other products, and/or services to effectively perform the required services in accordance with the scope of work.

4. Specific Requirements

4.1. DL/ID Production

4.1.1. The Contractor shall provide a secure CCPF that will be utilized throughout the term of the contract. The CCPF shall have the necessary personnel and equipment to produce DL/ID cards; place them in individual mailers; and sort, package and distribute them in the most efficient and economical process per United States Postal Service (USPS) requirements for First Class delivery.

4.1.1.1. CCPF personnel shall produce finished DL/ID cards and then enter them in the USPS mail system for transit within one (1) calendar day of receiving the daily files the Department uploaded to the CCPF.

4.1.1.2. Expedited delivery may also be included at the discretion of the Department. The Contractor shall establish and maintain the relationship with an express delivery carrier and provide the Department access to delivery tracking information. For expedited delivery requests received by 3:30pm MST each day, the finished DL/ID cards shall be produced and received by the designated express delivery carrier within the same day for next day delivery.

4.1.1.3. Postage fees shall be processed as a pass-through cost. Prices may be adjusted per postage rate as approved by the U.S. Postal Regulatory Commission (https://www.usps.com/business/prices.htm).

4.1.1.4. On average, 90 customers a year are located outside of the United States.

These customers require international shipping, which the Contractor may elect to provide at no additional cost to the Department. If the Contractor does not provide international services, they shall mail the DL/ID to the Department.

4.1.1.5. Saturdays, Sundays, and State of Arizona observed holidays will not be included in the one (1) calendar day.

4.1.1.6. Any instance where the Contractor does not meet the delivery requirements as set forth in 4.1.1.1. and 4.1.1.2. will subject the Contractor to liquidated damages as listed below:

https://www.usps.com/business/prices.htm

4.1.1.6.1. Regular Delivery Penalty for Exceeding Next Day: $0.25 per DL/ID card per day.

4.1.1.6.2. Expedited Delivery Penalty for Exceeding Same-Day: $5 per DL/ID card per day.

4.1.2. The Contractor’s mailing and delivery solution shall ensure the efficiency, security, and quality of the delivery of the DL/ID cards.

4.1.3. The Contractor shall implement a mail return process for all mailed credentials that are returned by USPS or express mail. This process shall include a re-mailing of the credential that was returned. The Contractor shall be responsible for keeping the data received, credentials processed, first time mailing, returned, second time mailing and final return status of the credentials. The status will need to be made available in real time on the Department’s MAX database. A daily log/report of all returns and re-mailed attempts shall be provided to the Department electronically. The format and frequency of this log/report may change, at the discretion of the Department.

4.1.4. The DL/ID solution shall provide in-depth reports relating to card manufacturing, production, mailing of the DL/IDs and problems encountered/corrective action taken by the Contractor. The format of these reports to be submitted is at the discretion of the Department and may be subject to change. See Exhibit 4, Sample Factory Production Report, which provides a daily breakdown of credentials issued for the month.

4.1.5. The Contractor shall collect, log and physically destroy returned credentials as directed by the Department. The Contractor shall make available a report which lists returned credentials and provide certification of destruction for returned mail items.

4.1.6. The Contractor shall provide a means by which the Department can retrieve and review the front and back of each printed credential and the date it was printed.

4.1.7. Throughout the card manufacturing, production and/or personalization process, the Contractor shall provide Quality Assurance methods that ensure a high level of production quality and data accuracy. The QA methods shall also ensure the quality and accuracy of printed information on card carriers (envelope) with that of the card.

4.1.8. The Contractor shall create and maintain a plan to safeguard the personal information used for card production throughout the production cycle.

4.1.9. Audit Trail Requirements

4.1.9.1. The Contractor shall maintain auditable system logs regarding the general operation of the system including all printer system operation activities.

4.1.9.2. The Contractor shall make printer system logs available to the Department for inspection in real-time.

4.1.9.3. The Contractor shall store printer system logs for six (6) months using Advanced Encryption Standard (AES) encryption, to prevent tampering and unauthorized access.

4.1.10. Consumables

4.1.10.1. The Contractor shall use an inventory management system to track and report the disposition of raw materials.

4.1.10.2. The Contractor shall report and reconcile raw material inventory for:

4.1.10.2.1. Cards issued

4.1.10.2.2. Cards rejected in production

4.1.10.2.3. Cards destroyed

4.1.10.2.4. Cards returned

4.1.10.2.5. Cards used in demonstrations

4.1.10.2.6. Cards used in training

4.1.10.2.7. All other card usages

4.1.10.2.8. Unused raw materials inventory

4.1.10.3. Consumables Source Information

4.1.10.3.1. The Contractor shall disclose in writing the manufacturer and supplier of all consumable materials. The Contractor shall notify the Department in writing prior to any changes of manufacturer and/or supplier. Any changes in consumable material shall meet or exceed the Department’s requirements.

4.2. Central Card Production Facility (CCPF)

4.2.1. The CCPF shall be owned and operated by the Contractor. The CCPF shall be staffed and operated by personnel provided by the Contractor. The CCPF shall be accessible to the Department and other staff or entities authorized by the Department in an auditing and inspecting capacity with prior notice to the Contractor. The CCPF shall provide access and resources to the Department to conduct back-end auditing and regular performance reviews.

4.2.2. The CCPF shall be self-sufficient in the event of an outage. Self- sufficiency features may be of a temporary nature that must allow for continued production of cards for short-term outages. For power outages or other issues expected to last beyond 24 hours, the provision of a self-sufficiency capacity must be utilized to ensure a smooth, uninterrupted transfer of production capacity to a backup facility or backup facilities (backup facility).

4.2.3. The Contractor’s backup facility shall meet the same requirements as the Contractor’s main facility. The backup facility shall ensure the uninterrupted card manufacturing and production. The backup facility shall have the capability of manufacturing, personalization, and mailing of DL/ID cards should the primary CCPF become inoperable.

4.2.4. The Contractor’s backup facility shall be able to receive secure personal data required for card production and shall have sufficient consumables securely stored at this facility to meet the daily demand for DL/ID card production until the primary CCPF becomes fully operable. The facility must provide card manufacturing and production services identical to the primary CCPF.

4.2.5. N/A

4.2.6. At no cost to the Department, the Contractor shall periodically engage the services of a qualified third party to conduct a physical security and data security assessment of the CCPF. The first of these assessments shall be within six (6) months of the approval of implementation. Upon completion of this assessment, the third party will provide a final report to the Contractor who will review it with the Department. Subsequent physical and data security assessments shall be performed every two (2) years.

4.2.7. The Contractor shall ensure the complete security and privacy of personal data utilized for card production. Any data temporarily stored within the CCPF must be inaccessible through the theft or loss of any component including IT equipment. The Contractor shall produce a report certifying the date and time of deleting/destroying/erasing all temporary stored information.

4.2.8. A single unplanned system outage for all in-scope software and hardware components resulting in a loss of production shall not exceed more than four (4) consecutive hours during Standard Hours of Operation. Unplanned system outages for all in-scope software and hardware components shall not exceed a combined total of eight (8) hours during Standard Hours of Operation per calendar month. Any instance where the Contractor does not meet those requirements, the Contractor will be subject to liquidated damages as listed below:

4.2.8.1. Single unplanned outage occurrences exceeding four (4) consecutive hours:

$500.00 per occurrence.

4.2.8.2. Combined unplanned outages per calendar month exceeding eight (8) hours per month: $500.00 per hour for every hour exceeding 8 hours per month.

4.3. Card Design and Requirements

4.3.1. This section highlights the construction and security requirements for the DL/IDs to be produced. The descriptions and items are neither mutually exclusive nor collectively exhaustive. The material reflects considerations representative of those that may be incorporated in the Contractor designs and construction.

4.3.2. One primary objectives of central issuance is security and integrity of DL/IDs issued by the Department on behalf of the State of Arizona. The Department therefore requires the Contractor to place a high degree of emphasis on the design of integrated security features, to create a card with a high degree of security that earns a high level of trust and shall consider security of the proposed cards with the highest scrutiny.

4.3.3. The Department and the Contractor shall establish a Credential Design Team (CDT) to remain active throughout the contract period. The Contractor shall provide at minimum one (1) subject matter expert to participate on this team that is responsible to safeguard the State of Arizona DL/ID cards. The CDT shall at a minimum, be comprised of the following key personnel:

4.3.3.1. The Contractor Representative(s)

4.3.3.2. The Department DL/ID Project Liaison

4.3.3.3. Any additional Department staff as determined

4.3.4. Current State Statutes and Requirements

4.3.4.1. The following statutes dictate what information must be on MVD Credentials (Driver License, Non-operating License, Commercial Driver License and the Special Interlock Driver License). A full description of each of these statutes can be found here under Chapter 8:

http://www.azleg.gov/ArizonaRevisedStatutes.asp

4.3.4.1.1. A.R.S. §28-3006. Driver license and non-operating

identification license applications; organ or tissue donation preference; reimbursement; definition

4.3.4.1.2. A.R.S. §28-3166. Driver license content and application;

marked licenses; emancipated minors

4.3.4.1.3. A.R.S. §28-3167. Medical code information on license; rules;

immunity

4.3.4.1.4. A.R.S. §28-3221. Commercial Driver License

4.3.4.1.5. A.R.S. §28-3224. Nonresident commercial driver license

4.3.4.1.6. A.R.S. §28-3165. Non-operating identification license;

immunity; rules; emancipation minors

4.3.4.1.7. A.R.S. §28-3159. Restricted license

4.3.4.2. If the State adopts legislation in the future to implement provisions of an enhanced DL, the successful Contractor will be required to bring its secure credential system into compliance with the terms of such legislation.

4.3.5. Card formats

4.3.5.1. All card formats are referenced in Exhibit 3. Card Formats. Card formats include Driving and Non-Operating Identification Credentials.

4.3.5.2. The Department reserves the right to modify or add additional card material/types/formats/designs at any time during the term of the contract.

The Department and the Contractor will negotiate a fair and reasonable cost.

4.3.5.3. In the event of a change to the card design, proposed card designs and layouts of sample Arizona-specific designs shall be approved by the Department in writing prior to production.

4.3.6. Card Construction

4.3.6.1. The Contractor shall maintain a detailed description of the following:

4.3.6.1.1. Card construction and security features solution(s).

4.3.6.1.2. Static security features placed upon or within the cards.

4.3.6.1.3. Means and methods of application of personalization data.

4.3.6.1.4. Ability to resist tampering.

http://www.azleg.gov/ArizonaRevisedStatutes.asp

4.3.6.2. The Contractor shall demonstrate how the card provides the maximum resistance to compromise attempts including, but not limited to:

4.3.6.2.1. Counterfeit/simulation

4.3.6.2.2. Alteration

4.3.6.2.3. Photo/Signature substitution

4.3.6.2.4. Counterfeit from cannibalized cards

4.3.6.3. The Department will have final authority to determine card design, and acceptance of card designs.

4.3.6.4. Upon completion and approval of any/all card designs, customized holographic laminates, or other card security features, the Department shall exclusively and perpetually own all designs, diagrams, layouts, artwork, or similar materials. The Contractor shall promptly provide an acknowledgement or assignment in a tangible form, satisfactory to the Department, to evidence the Department’s sole ownership and provide information to the Department. The Contractor shall be required to copyright these designs or original artwork in the name of the Department and the State of Arizona.

4.3.7. Personalization Data Elements

4.3.7.1. Personalization fields are considered unique to the individual cardholder and therefore require utmost protection from compromise by substitution or alteration attempts. The photo image, 2D barcode, and the signature shall be regarded as personalization fields.

4.3.7.2. Both the DL and state ID card may have a redundant application of the photo image personalization fields.

4.3.7.3. The credentials shall adhere to the field positioning requirements of the current AAMVA standard. Field layout positions for the credential must provide for simplified examination and readability and shall be used for all card formats listed in Driving and Non-Operating Identification Credentials Exhibit 3. Card Formats.

4.3.8. Card Material and Printing Method

4.3.8.1. The Contractor shall provide a highly durable card that is capable of surviving a 12-year card life.

4.3.8.2. The construction of the card material shall be conducted in secured facilities with adequate inventory controls and with minimal human handling.

4.3.9. Card Security Features

4.3.9.1. As requested by the Department, the Contractor shall accommodate change(s) to security features during the period of the contract in an attempt to prevent compromise of card security. The ability to change security features should be done at minimal incremental cost to the Department.

4.3.9.2. Credential security shall be verifiably authentic through three (3) additional levels of inspection:

4.3.9.2.1. Level One — Easily identifiable visual or tactile features for rapid inspection at point of usage without tools or aids.

4.3.9.2.2. Level Two — Examination by trained inspectors with simple equipment (magnifying glass, UV light, machine reading equipment, etc.).

4.3.9.2.3. Level Three — In-depth evaluation may require special equipment to provide true certification by forensic specialists conducting detailed examination.

4.3.9.3. The following is a non-exhaustive list of permissible security features:

4.3.9.3.1. Security Printing

4.3.9.3.2. Laser Printing

4.3.9.3.3. Irreversible Personalization

4.3.9.3.4. Rainbow Printing

4.3.9.3.5. Fine Line Printing

4.3.9.3.6. Ultraviolet (Static)

4.3.9.3.7. Ultraviolet (Variable)

4.3.9.3.8. Deliberate Error

4.3.9.3.9. Redundant Data

4.3.9.3.10. Overlapping Data

4.3.9.3.11. Micro lettering (Static)

4.3.9.3.12. Micro lettering (Variable)

4.3.9.3.13. Hologram

4.3.9.3.14. Micro perforation

4.3.9.3.15. Diffractive optically variable image device with custom, optically brilliant design

4.3.9.4. Card security features shall be counterfeit resistant and protect the information contained on the card from tampering.

4.3.9.5. Card security features may be included as a durable laminate or embedded within the card body as appropriate, and shall be well integrated with the card design and maintain the integrity of the primary photograph

4.3.9.6. The Contractor’s design shall include at least one (1) proprietary security feature or material that cannot be purchased, duplicated or altered by anyone attempting to make a fraudulent credential.

4.3.9.7. At the post award meeting, the Contractor shall provide a security plan documenting security methods to prevent the fraudulent use of all hardware, software, consumables and license documents. Once the plan is finalized to the satisfaction of the Department, performance of the

Contractor that is not consistent with the plan shall be considered a material breach of the contract.

4.3.10. The Department and the Contractor shall establish a Card Design Security Program (CDSP) that will remain active throughout the contract period and that is responsible for the following:

4.3.10.1. A quarterly assessment of returned cards that failed the intended card life and preparing a report of the findings. The report must include the number of cards failed and an explanation for the failure.

4.3.10.2. An annual review of the card designs to determine resistance to compromise and fraudulent activity attempts.

4.3.10.3. Maintaining card security and modifying security features.

4.3.10.4. At a minimum the CDSP Team shall be comprised of the following key personnel:

4.3.10.4.1. Department Project Liaison

4.3.10.4.2. Department Investigators and/or Audit

4.3.10.4.3. Department Fraud Document Specialist

4.3.10.4.4. The Contractor Representative(s): one (1) subject matter expert who is responsible for safeguarding the State DL/ID cards.

4.3.11. Card Testing/Compliance

4.3.11.1. If modifications are made to the card design, the Contractor shall provide the Department with thirty (30) produced DL/ID card samples. The samples shall consist of both horizontal and vertical samples representing the DL/ID card type or design proposed. For example, if the Contractor proposes a single DL and state ID card, the Contractor shall provide fifteen (15) card samples of the DL and fifteen (15) card samples of the ID (30 cards). The card samples shall include the Arizona-specific design.

4.3.11.2. AAMVA Compliance

4.3.11.2.1. The Contractor’s DL/ID card solution must fully comply with the AAMVA Card Design Standards (https://www.aamva.org/getmedia/99ac7057-0f4d-4461-b0a2-3a5532e1b35c/AAMVA-2020-DLID-Card-Design- Standard.pdf).

4.3.11.2.2. Proposed card designs may be submitted by the State to the AAMVA DL/ID Card Verification Program for review.

4.3.11.3. The DL/ID card solution must comply with:

4.3.11.3.1. The AAMVA standard and compliance with standards

referenced therein to include all ISO/IEC recommendations.

4.3.11.4. The cards shall meet the specified durability and testing criteria. Cards may be tested for general physical characteristics in accordance with ISO/IEC 10373 standard test methods.

4.3.11.5. The card testing is divided into three areas as follows:

4.3.11.5.1. ISO general physical characteristics and ANSI INCITS 322 card durability

4.3.11.5.2. AAMVA compliance

4.3.11.5.3. Card security and integrity

4.3.12. Card Failure and Related Adjustment

4.3.12.1. The Contractor shall warrant DL/ID cards against failure for 12 years from the date of issuance, even if beyond the term of the Contract.

4.3.12.2. Active DL/ID cards are expected to remain intact and in acceptable physical condition for up to 12 years under normal use. DL/ID cards that are determined to have failed and are returned to the Department shall be directed to the CDSP team. The CDSP team at their quarterly meeting shall examine failed cards and determine whether the cards have failed as a result of misuse, willful destruction, or other methods beyond what may be considered normal use.

4.3.12.3. The Contractor representative(s) for the CDSP team shall be present for the failed DL/ID cards determination meetings.

4.3.12.4. The Contractor shall produce and deliver replacement cards for failed cards at no cost to the Department or to the cardholder.

4.3.12.5. Cards that fail in manufacturing, personalization or prior to being considered active shall be considered spoilage and not invoiced to the Department. The Department shall pay only for cards that have met or surpassed all Quality Assurance processes and have been delivered to the cardholder in good condition.

4.4. Security and Privacy

4.4.1. To support standardized, interoperable IT environments, the state developed enterprise architecture (EA). The EA and subsequent standards can be accessed through the Arizona Strategic Enterprise Technology (ASET) web page at http://aset.azdoa.gov/security/policies‐standards‐and-procedures. Technical solutions developed by the Contractor shall conform to Department standards and to ASET EA standards.

4.4.2. Statewide IT Policies, Standards, and Procedures located at https://aset.az.gov/policies-standards-and-procedures.

4.4.3. The Contractor shall not connect to the system from outside of the Department’s network except for approved remote access from the Department.

https://app.az.gov/ https://aset.az.gov/resources/policies-standards-and-procedures https://aset.az.gov/policies-standards-and-procedures https://aset.az.gov/policies-standards-and-procedures

4.4.4. The Contractor is prohibited from accessing personal identifying information (PII) that is stored, transported or transmitted by the Department.

4.4.5. The Contractor shall create and maintain administrative security procedures to prevent unauthorized dissemination of PII.

4.4.6. Directory Services or Federated Authorization shall be used for authentication if supported by the system.

4.4.7. Credential/template design and configuration functions must be secured independently from the printer operation/management console. The printer operator shall not have access to the printer configuration, credential configuration and design objects.

4.4.8. Remote Administrative Access: If the printer supports a web-based interface that allows administrators to view or change status or configuration information, the interface shall:

4.4.8.1. Use AES encryption.

4.4.8.2. Authenticate authorized users based upon user ID and a strong password, and through the use of two factor authentication managed by the Department.

4.4.8.3. Use SSL/TLS (https) encryption.

4.4.9. Logging into the web interface of the printer without HTTPS is not permitted.

4.4.10. Insecure protocols such as Telnet, FTP, and TFTP shall not be enabled to access to the printer.

4.4.11. Any incident or event that affects the confidentiality, integrity, and/or availability of Department information or business essential infrastructure shall be reported to the Department immediately as required by federal regulations and state statutes, policies and standards.

4.4.12. Application Security: The DL/ID printer software application must support role-based access control and provide for separation of duties. The Contractor shall provide the details of the system’s security access controls.

4.4.13. Disk Encryption: If the printer solution contains any non-volatile storage drives, the drives shall support and be configured for full disk encryption such that if the hard disk is removed from the system the encrypted information on the disk shall not be readable. The encryption that shall be used is the AES Algorithm either 128 or 256 bit, as specified in Federal Information Processing Standard Publication 197, AES.

4.4.14. Automatic Disk Wiping: The storage drives shall enable automatic disk wiping where the printer will automatically delete resident data after an administrator configured interval.

4.4.15. Personnel: The Department must approve and authorize all users requiring access to the printer, consumables, printer control and administrative logons.

4.4.15.1. The Contractor personnel, as well as any sub-contractor personnel, who have administrative access to the Department’s computing resources or proximity access to sensitive IT areas shall be subject to the following at no cost to the Department:

4.4.15.1.1. Background checks: Criminal History Report with fingerprints.

4.4.15.1.2. Identity and Address Verification: Verifies the employee is who he or she claims to be including verification of the candidate’s present and previous addresses.

4.4.15.1.3. Employment eligibility check.

4.4.15.1.4. Reference check.

4.4.15.2. Mandatory security training provided or approved by the Department shall be completed on a bi-annual basis.

4.4.15.3. The Contractor shall provide supporting evidence of their compliance with the Personnel requirements listed above to the Department annually.

4.4.16. Physical Security: The primary and Disaster Recovery CCPF locations must engage in a high level of physical security.

4.5. Solution Implementation/Modifications to Card Design/Production Process

4.5.1. The Contractor and the Department will jointly test and complete an operational changeover, if required, that will ensure a minimum disruption to the Department's Motor Vehicle Division customers, both internal and external.

4.5.2. The Department intends the proposed solution to be operational by March 1, 2023, from and after which the offeror’s solution will be the only solution for production and fulfillment of Arizona credentials.

4.5.3. Implementation shall include acquisition, installation, setup, and configuration of the CCPF, including all hardware, software, production and mailing equipment, and materials. It shall also include, but is not limited to, card design, testing, and the Final Acceptance Test.

4.5.4. The Contractor shall provide a detailed proposed project plan leading to the implementation of the proposed solution no later than two (2) weeks of contract award.

4.5.5. Project plan will include schedule for tasks to be completed and implementation milestones including card design timeline.

4.5.6. Department and Contractor shall each assign a project manager responsible for coordinating the implementation of the solution.

4.5.7. Contractor shall provide the Department with status reports and status meetings on a mutually agreed regular schedule.

4.5.8. Solution Testing – All Phases

4.5.8.1. The following are the various levels of testing that may be required for this contract. Each level of testing (except final acceptance testing) shall only be deemed acceptable upon written documentation provided by the Project Manager. During any time of any testing period regardless of level, any corrections or remedies shall be provided and performed by the Contractor at no cost to the Department.

4.5.8.2. System level testing/integration testing is to be performed upon deployment of any modifications.

4.5.8.3. Testing shall demonstrate that the product(s) operate as agreed upon and warranted and that the product is compatible within the Department’s technical environment.

4.5.8.4. Application software testing: Testing of the basic functionality and operation of the application.

4.5.8.5. User testing: Once initial planning, design and installation have been completed, user testing shall commence.

4.5.9. Final Acceptance Test (FAT)

4.5.9.1. Upon successful completion of the above mentioned tests, the FAT shall be started and will be conducted as part of the pilot rollout. This test shall consist of a 30-day test period of operations without major failure of the Contractor-supplied goods or services. The purpose of the test is to demonstrate that the total system (hardware, software, materials and installation) is properly installed, is free from identified problems, exhibits stable and reliable performance, and complies with the contract documents.

4.5.9.2. This test shall fully demonstrate all functions required in this SOW. The Contractor may choose to suggest tests and shall be responsible for all testing. The Contractor shall demonstrate successful interface of all equipment with the Department-managed computer interfaces. During the FAT, the Contractor shall ensure that all equipment is in operable condition.

The Contractor shall troubleshoot, diagnose, identify, and isolate hardware and software problems and inconsistencies. The Contractor shall formulate possible solutions and implement all corrections required in the Contractor-furnished goods. The Department shall make corrections of problems in software and/or equipment not furnished by the Contractor.

4.5.9.3. The Contractor shall provide on-site personnel to operate the system “exercising” all functions. The Contractor shall provide test equipment and labor needed to test, isolate, correct, and repair all deficiencies found during the test. Key technical personnel familiar with the design and installation of each major system component shall resolve all as specified below:

4.5.9.3.1. Trouble Repair and Resolution Time: For all in-scope software and hardware components, the Contractor shall analyze the problem, isolate the trouble to the affected component, and complete the required repair(s) within (4) four hours from the time the initial problem was reported. The Contractor shall track repair progress and escalate problems with the respective provider/distributor if not cleared by the commitment time. The Contractor shall case manage the trouble through resolution and will contact the authorized Department representative(s) with progress reports, verify that repairs are complete, and close the trouble report(s) with the Department.

4.5.9.4. All system documentation errors, omissions, and changes occurring prior to and during the FAT shall be corrected and resubmitted before acceptance is complete.

4.5.9.5. Test failures of the FAT shall be distinguished as either “minor” or “major” as described below. In the event of a minor failure, the testing will be halted until such time that the failure is corrected. Once the failure is corrected, the test will resume for the remainder of the thirty (30) day period. For each restart, the 30-day test shall be extended by one (1) day after the remediation is complete. In the event of a major failure, the testing will be halted until such time that the failure is corrected. Once the failure is corrected, the test will recommence but will be reinitialized to Day One (1).

The Department reserves the right to categorize any failure mode not specifically addressed here as it sees fit.

4.5.9.6. Minor Failures:

4.5.9.6.1. Interference with project operations due to any force majeure event (refer to Section 02 – Uniform Terms and Conditions, paragraph 6.4 Force Majeure), power failure, communications circuit failure, or lightning strike.

4.5.9.6.2. Failure of equipment or software supplied by others. The Department shall make the necessary correction to any Department-managed equipment or software.

4.5.9.6.3. Failure to complete the objective of any test scenario due to lack of adequate documentation for equipment supplied by the Contractor. Failed tests shall be re-tested with revised documentation.

4.5.9.7. Major Failures:

4.5.9.7.1. Any significant failure of the software or major hardware component.

4.5.9.7.2. Failure of any hardware or software for eight (8) consecutive hours. Two (2) or more system crashes requiring manual user intervention such as rebooting computers or invoking task manager functions to close and restart tasks.

4.5.9.7.3. Failure to respond to any problem within four (4) hours of notification, during regular business hours.

4.5.9.7.4. Three (3) separate minor failures at any time during the test.

4.5.10. All modifications, revisions and replacements shall be documented and provided to the Department for approval prior to acceptance of test results. The Department reserves the right to reject any proposed repairs or modifications that are not in the best interest of the Department’s ability to operate or maintain said components.

4.5.11. One (1) copy of test documentation shall be furnished to the Department.

4.5.12. The Department may make modifications to the card design or production process. In the event changes are needed; testing requirements must be as listed above.

5. Contractor’s Responsibilities

5.1. The Contractor shall adhere to all current standards, statutes, rules and regulations aforementioned. Should any modifications be made to any of these, the Contractor shall make modifications to adhere to future standards and requirements.

5.2. The Contractor shall have appointed at all times a program manager who will serve as a single point of contact for the Department to engage regarding the solution implemented.

5.3. The Contractor shall have technical support available to the Department Mondays through Fridays (excluding State Holidays) from the hours of 7:00 AM – 6:00 PM. The standard response time shall be less than four (4) hours.

6. Department’s Responsibilities

6.1. The Department will work with the Contractor to finalize card designs that the Contractor shall create.

6.2. The Department shall appoint a program manager responsible for the administration of the central credential issuance program and who will serve as a point of contact for the Contractor regarding the solution implemented. The program manager may delegate subject matter experts as points of contact regarding specific areas of the program.

6.3. The Department will engage its communications team to participate in the development of a communication plan regarding the rollout of the new credential design. This will include notifying the public, law enforcement partners, and other parties who use the Arizona DL/ID card to confirm a person’s identity, both within the state and outside the state, of the rollout of a newly designed Arizona credential.

SPECIAL TERMS AND CONDITIONS

1. CONTRACT TERM

1.1. The term of any resultant contract shall commence on the effective date of award and shall continue for a period of three (3) years thereafter, unless terminated, cancelled or extended as otherwise provided herein.

2. CONTRACT EXTENSION

2.1. By mutual written contract amendment, any resultant contract may be extended for supplemental periods of up to a maximum of 48 months.

3. ELIGIBLE AGENCIES

3.1. This contract shall be for the exclusive use of the Arizona Department of Transportation.

4. NON-EXCLUSIVE CONTRACT

4.1. This contract shall be for the sole convenience of the Department. The Department reserves the right to obtain like goods or services from another source when necessary. The Off- Contract Purchase Authorization and subsequent procurement shall be consistent with the Arizona Procurement Code.

5. ORDERING PROCESS

5.1. The Department shall issue a purchase order to the Contractor. Each purchase order must cite the contract number. This purchase order shall be the only document required for the Department to order and the Contractor to deliver the material and/or service.

5.2. Any attempts to represent any material and/or service not specifically awarded as being under contract is a breach of the contract and a violation of the Arizona Procurement Code.

Any such action is subject to the legal and contractual remedies available to the State inclusive of but not limited to contract cancellation, suspension and/or debarment of the Contractor.

6. INVOICING AND PAYMENT

6.1. Separate invoices are required for each delivery of service and shall include at a minimum:

• Department Location’s Name and Address

• Vendor Name, Remit to Address and Contact Information

• Contract Number

• Purchase Order Number

• Invoice Number and Date

• Date the items were shipped to the Department

• Contract Line Item Number

• Line Item Description or Item or Service

• Quantity Purchased

• Line Item Unit of Measure

• Price per Unit and Total per Unit

• Catalog or Other Discount (if applicable)

• Net Unit Price and Total per Unit (if applicable)

• Applicable taxes

• Applicable Shipping/Freight Charges

• Total Invoice Amount Due

6.2. Invoices not sent to the proper address, or not containing the necessary and required information may delay payment. A Contractor whose payments are delayed due to improper invoicing shall make no claim against the Department or the State for late or finance charges.

6.3. The Department will make every effort to process payment within thirty (30) calendar days after acceptance of services. Delivery of the service to the Department does not constitute acceptance.

6.4. The date the Department accepts delivery of services shall be the valid date for starting the thirty (30)…