CTR064362_Contract_Documents.pdf

Procurement

ARIZONA DEPARTMENT OF TRANSPORTATION

1655 W. Jackson Street, MD 100P

Phoenix, AZ 85007 602.712.7211

Solicitation Amendment Summary SOLICITATION NO.: BPM004934 AMENDMENT NO.: One (1) DESCRIPTION: Information Technology (IT) Services Partner

Rev. 04/2020

Pursuant to the Uniform Instructions to Offerors, Item B.6, Solicitation Amendments, the above referenced solicitation shall be amended as follows:

1. Solicitation due date is hereby extended to Wednesday, December 14, 2022 at 3:00PM AZ MST.

2. All other terms, conditions and provisions of this solicitation remain unchanged.

1655 W. Jackson Street, MD 100P

602.712.7211

Solicitation Amendment Summary SOLICITATION NO.: BPM004934 AMENDMENT NO.: Two (2) DESCRIPTION: Information Technology (IT) Services Partner

Pursuant to the Uniform Instructions to Offerors, Item B.6, Solicitation Amendments, the above referenced solicitation shall be amended as follows:

1. Solicitation Financial Questions: Approach to Core and Additional Services: Core-Cybersecurity is hereby updated to allow for multiple attachments to be uploaded.

2. All other terms, conditions and provisions of this solicitation remain unchanged.

Solicitation No. BPM004934 Summary of Exceptions and Responses - Kyndryl Item # Section Referenced Original Language of Referenced Section and Paragraph Exception or Change Requested by Kyndryl ADOT Response (01/12/2023) Kyndryl Response (01/20/2023)

1 Special Terms and Conditions 12 Cancellation for Possession of Weapons

CANCELLATION FOR POSSESSION OF WEAPONS ON ADOT

PROPERTY This Contract may be cancelled if the Contractor or any subcontractors or others in the employ or under the supervision of the Contractor or subcontractors is found to be in possession of weapons.

Possession of weapons (firearms, explosive devices, knives or blades of more than three (3) inches, or any other instrument designed for lethal or disabling use) is prohibited on ADOT property.

Further, if the Contractor or any subcontractors or others in the employ of under the supervision of the Contractors or subcontractors, are asked by an ADOT official to leave the ADOT property, they are advised that failure to comply with such a request shall result in cancellation of the Contract and anyone who refuses, whether armed or not, is subject to prosecution under A.R.S. §13-1502, “Criminal trespass in the third degree: classification.”

CANCELLATION FOR POSSESSION OF WEAPONS ON ADOT

PROPERTY. This Contract may be cancelled if the Contractor or any subcontractors or others in the employ or under the supervision of the Contractor or subcontractors is found to be in possession of weapons (as defined below) on ADOT property.

Possession of weapons (firearms, explosive devices, knives or blades of more than three (3) inches, or any other instrument designed for lethal or disabling use) is prohibited on ADOT property.

Further, if the Contractor or any subcontractors or others in the employ of under the supervision of the Contractors or subcontractors, are asked by an ADOT official to leave the ADOT property, they are advised that failure to comply with such a request shall result in immediate removal of Contractor or any subcontractors or others under the supervision of the Contractor, and anyone who refuses, whether armed or not, is subject to prosecution under A.R.S. §13-1502, “Criminal trespass in the third degree: classification.”

ADOT accepts

2 Special Terms and Conditions 14 Accuracy of Work

14. ACCURACY OF WORK

The Contractor shall be responsible for the accuracy of the work and shall promptly make all the necessary revisions or corrections resulting from errors and omissions on the part of the Contractor without additional compensation. Acceptance of the work by the Department shall not relieve the Contractor of the responsibility for subsequent correction of any such errors and clarification of ambiguities.

ACCURACY OF WORK. The Contractor shall be responsible for the accuracy of the work if the Contractor has not conformed in all material respects with specifications or requirements agreed upon by the parties, and shall promptly make all the necessary revisions or corrections resulting from errors and omissions on the part of the Contractor without additional compensation.

Acceptance of the work by the Department shall not relieve the Contractor of the responsibility for subsequent correction of any such errors and clarification of ambiguities.

ADOT accepts

3 Special Terms and Conditions 15 Indemnification

15. INDEMNIFICATION

To the fullest extent permitted by law, Contractor shall defend, indemnify, and hold harmless the State of Arizona, and its departments, agencies, boards, commissions, universities, and any jurisdiction or agency issuing permits for any work included in the project, and their respective directors, officers, officials, agents and employees (hereinafter referred to as "Indemnitee") from and against any and all claims, actions, liabilities, costs, losses, or expenses, (including reasonable attorney's fees), (hereinafter collectively referred to as "Claims") arising out of actual or alleged bodily injury or personal injury of any person (including death) or loss or damage to tangible or intangible property caused, or alleged to be caused, in whole or in part, by the negligent or willful acts or omissions of Contractor or any of Contractor's directors, officers, agents, employees, volunteers or subcontractors. This indemnity includes any claim or amount arising or recovered under the Workers' Compensation Law or arising out of the failure of Contractor to conform to any federal, state or local law, statute, ordinance, rule, regulation or court decree. It is the specific intention of the parties that the Indemnitee shall, in all instances, except for Claims arising solely from the negligent or willful acts or omissions of the Indemnitee, be indemnified by Contractor from and against any and all Claims. It is agreed that Contractor will be responsible for primary loss investigation, defense and judgment costs where this indemnification is applicable. This indemnification will survive the termination of the above listed contract with the Contractor.

This indemnity shall not apply if the contractor or sub-contractor(s) is/are an agency, board, commission or university of the State of Arizona.

15. INDEMNIFICATION

To the fullest extent permitted by law, Contractor shall defend, indemnify, and hold harmless the State of Arizona, and its departments, agencies, boards, commissions, universities, and any jurisdiction or agency issuing permits for any work included in the project, and their respective directors, officers, officials, agents and employees (hereinafter referred to as "Indemnitee") from and against any and all claims, actions, liabilities, costs, losses, or expenses, (including reasonable attorney's fees), (hereinafter collectively referred to as "Claims") arising out of actual or alleged bodily injury or personal injury of any person (including death) or loss or damage to tangible or intangible property caused, or alleged to be caused, in whole or in part, by the negligent or willful acts or omissions of Contractor or any of Contractor's directors, officers, agents, employees, volunteers or subcontractors. This indemnity includes any claim or amount arising or recovered under the Workers' Compensation Law or arising out of the failure of Contractor to conform to any federal, state or local law, statute, ordinance, rule, regulation or court decree. It is the specific intention of the parties that the Indemnitee shall, in all instances, except for Claims arising solely from the negligent or willful acts or omissions of the Indemnitee, be indemnified by Contractor from and against any and all Claims. It is agreed that Contractor will be responsible for primary loss investigation, defense and judgment costs where this indemnification is applicable. This indemnification will survive the termination of the above listed contract with the Contractor.

This indemnity shall not apply if the contractor or sub-contractor(s) is/are an agency, board, commission or university of the State of Arizona.

INDEMNIFICATION.

To the fullest extent permitted by law, Contractor shall defend, indemnify, and hold harmless the State of Arizona, and its departments, agencies, boards, commissions, universities, and any jurisdiction or agency issuing permits for any work included in the project, and their respective directors, officers, officials, agents and employees (hereinafter referred to as “Indemnitee") from and against any and all third-party claims, actions, liabilities, damages, costs, losses, or expenses, (including reasonable attorney's fees), (hereinafter collectively referred to as "Claims") arising out of actual or alleged bodily injury or personal injury of any person (including death) or loss or damage to tangible or intangible property caused in whole or in part, by the negligent or willful acts or omissions of Contractor. This indemnification obligation includes any claim or amount arising out of or recovered under the Workers' Compensation Law or arising out of the failure of Contractor to comply with any federal, state or local law, statute, ordinance, rule, regulation or court decree. It is agreed that Contractor will be responsible for primary loss investigation, defense and judgment costs where this indemnification is applicable.

Per Risk- we can accept changes except for the additon of the words "third party claims".

Kyndryl agrees to remove the words "third-party claims" as requested by ADOT on 01/12/2023.

4 Special Terms and Conditions 16 Insurance 16.3.4 Technology Errors & Omissions Insurance

16.3.4 Technology Professional Errors & Omissions Insurance Can you provide a reasoning for requesting the change? ADOT would prefer not to change the language as we require specific coverage for this contract and the language change could potentially change the requirements.

Kyndryl Agrees to revert this to the original language:

16.3.4 Technology Errors & Omissions Insurance

5 Special Terms and Conditions 16 Insurance 16.11 Network Security (Cyber) and Privacy Liability

16.11 Network Security (Cyber) and Privacy Cyber Liability Can you provide a reasoning for requesting the change? ADOT would prefer not to change the language as we require specific coverage for this contract and the language change could potentially change the requirements.

Kyndryl Agrees to revert this to the original language:

16.11 Network Security (Cyber) and Privacy Liability

6 Special Terms and Conditions 18 Key Personnel

18. KEY PERSONNEL

It is essential that the Contractor provides adequate experienced personnel, capable of and devoted to the successful accomplishment of work to be performed under this contract. The Contractor must agree to assign specific individuals to the key positions.

The Contractor agrees that, once assigned to work under this contract, key personnel shall not be removed or replaced without written notice to the Procurement Officer. The Contractor shall immediately notify the Procurement Officer of key personnel changes. Replacement personnel shall be of substantially equal ability and qualifications. All key personnel changes are subject to the written concurrence of the Procurement Officer prior to any billable work being performed.

KEY PERSONNEL

It is essential that the Contractor provides adequate experienced personnel, capable of and devoted to the successful accomplishment of work to be performed under this contract. The Contractor must agree to assign specific individuals to the key positions.

The Contractor agrees that, once assigned to work under this contract, key personnel shall not be removed or replaced without written notice to the Procurement Officer. The Contractor shall within 5 business days, immediately notify the Procurement Officer of key personnel changes. Replacement personnel be of substantially equal ability and qualifications. All key personnel changes are subject to the written concurrence of the Procurement Officer prior to any billable work being performed.

ADOT Accepts

7 Special Terms and Conditions 19 Subcontractors

19. SUBCONTRACTORS

It is essential that the Contractor provides adequate experienced subcontractors, capable of and devoted to the successful accomplishment of work to be performed under this contract.

The Contractor agrees that, once assigned to work under this contract, subcontractors shall not be removed or replaced without written notice to the Procurement Officer. The Contractor shall immediately notify the Procurement Officer of subcontractor changes. Replacement subcontractors shall have substantially similar qualifications and experience. All subcontractor changes are subject to the written concurrence of the Procurement Officer prior to any billable work being performed.

SUBCONTRACTORS It is essential that the Contractor provides adequate experienced subcontractors, capable of and devoted to the successful accomplishment of work to be performed under this contract.

The Contractor agrees that, once assigned to work under this contract, subcontractors shall not be removed or replaced without written notice to the Procurement Officer. The Contractor shall, within 5 business days, immediately notify the Procurement Officer of subcontractor changes. Replacement subcontractors shall have substantially similar qualifications and experience. All subcontractor changes are subject to the written concurrence of the Procurement Officer prior to any billable work being performed.

ADOT accepts

8 Special Terms and Conditions 28 Non-Disclosure

• Report any security system breach, computer infection or theft of information immediately to the Department.

NON-DISCLOSURE .

• Report any security system breach, computer infection or theft of information immediately within 24 hours to the Department.

ADOT accepts

9 Special Terms and Conditions 31 Acceptance for Equipment and Software

31. ACCEPTANCE FOR EQUIPMENT AND SOFTWARE

Determination of the acceptability of product will be made by the sole judgment of the Department. Acceptance shall be in writing, verbal acceptance for product will not be allowed. All products delivered will be inspected and tested for acceptance.

Acceptance shall be 100% functionality, which will be determined by the Department. Acceptance criteria shall include but not be limited to conformity to the specifications, functionality, and quality of materials. Nonconformance to any of the acceptance criteria of the products shall result in delay for payment. Payment shall not be made until nonconformance to the criteria is corrected as determined by the Department.

ACCEPTANCE FOR EQUIPMENT AND SOFTWARE.

Equipment and Software are not included in the scope of the Core Services of this contract. The State and Kyndryl will utilize Tasks Orders for the parties to define requirements for any future scope.

ADOT accepts

10 Special Terms and Conditions 37 Access Constraints and Authorization Requirements

37. ACCESS CONSTRAINTS AND AUTHORIZATION

REQUIREMENTS

Contractor access to the Department’s information technology environment and resources shall be properly authorized, based on business need and will be restricted to least possible privilege. Upon approval of access privileges, the Contractor shall maintain strict adherence to all prescribed security policies, standards and procedures.

Failure of the Contractor, its agents or subcontractors to comply with prescribed security policies, standards and procedures including any person who commits an unlawful breach of computer security or harmful access will be subject to prosecution under appropriate state and/or federal law.

Any and all recovery costs or reconstruction costs or other direct liabilities associated with an unlawful breach of computer security or harmful access wherein the Contractor is a proximate cause shall be paid by the Contractor.

ACCESS CONSTRAINTS AND AUTHORIZATION REQUIREMENTS.

Contractor access to the Department’s information technology environment and resources shall be properly authorized, based on business need and will be restricted to least possible privilege. Upon approval of access privileges, the Contractor shall maintain strict adherence to the State’s all prescribed security policies, standards and procedures.

Failure of the Contractor, its agents or subcontractors to comply with the State’s prescribed security policies, standards and procedures including any person who commits an unlawful breach of computer security or harmful access will be subject to prosecution under appropriate state and/or federal law.

Any applicable and all recovery costs or reconstruction costs or other and direct liabilities associated with an unlawful breach of computer security or harmful access wherein the Contractor is a proximate cause shall be paid by the Contractor, subject to the section 6.6 Limitation of Liabilities (Uniform Terms and Conditions)

ADOT accepts

11 Uniform Terms and Conditions 6.2 Indemnification 6.2.3 - we do not have a section 6.2.3

Indemnification Add section 6.2.3

6.2.3 Contractor shall have control, of the defense of any

action on such claim and all negotiations for its settlement or compromise, provided, however, that when substantial principles of government or public law are involved, or when involvement of the State is otherwise mandated by law, the State may elect, in its sole and absolute discretion, to participate in such action at its own expense with respect to attorneys’ fees and costs, but not liability, and the State shall have the right to approve or disapprove any settlement, which approval shall not be unreasonably withheld or delayed. The State shall reasonably cooperate in its defense and any related settlement negotiations.

Each party to this contract is responsible for its own negligence, willful acts or omissions. If the common law or a statute provides for either a right to indemnify and/or a right to contribution to any party to this agreement, then the right to pursue one or both of these remedies is preserved.

This indemnity shall not apply if the Contractor or sub-contractor(s) is/are an agency, board, commission or university of the State of Arizona

ADOT Accepts

12 Uniform Terms and Conditions 6.3 Indemnification- Patent and Copyright

Indemnification - Patent and Copyright. The Contractor shall indemnify and hold harmless the State against any liability, including costs and expenses, for infringement of any patent, trademark or copyright arising out of Contract performance or use by the State of materials furnished or work performed under this Contract. The State shall reasonably notify the Contractor of any claim for which it may be liable under this paragraph. If the contractor is insured pursuant to A.R.S. § 41- 621 and § 35-154, this section shall not apply.

Indemnification – Patent and Copyright. The Contractor shall indemnify and hold harmless the State against any liability, including costs and expenses infringement of the third party’s patent, trademark or copyright arising out of Contract performance or use by the State of materials furnished or work performed under this Contract. The State shall reasonably notify the Contractor of any claim for which it may be liable under this paragraph. If the contractor is insured pursuant to A.

R.S. § 41-621 and § 35-154, this section shall not apply. The State agrees to reasonably cooperate in the defense and any settlement of the claim. Contractor shall not be liable for any claim of infringement based on the State’s (i) modification of the materials furnished or work performed under the Contract other than as contemplated by the Contract; (ii) use of the materials furnished or work performed under the Contract other than as contemplated by the Contract; or (iii) use of the materials furnished or work performed under the Contract in combination with other products or services not contemplated by the Contract.

In addition, with respect to claims arising from computer hardware, software or cloud services manufactured and developed solely by a third party, Contractor shall pass through to the State such indemnity rights as it receives from such third party (the “Third Party Obligation”) and will cooperate in enforcing them.

ADOT accepts

13 Uniform Terms and Conditions New- add 6.6 none

6.6 Limitation of Liability

6.6.1 Circumstances may arise where, because of a default on

Contractor’s part or other liability, the State is entitled to recover damages from Contractor. Regardless of the basis on which the State is entitled to claim damages from Contractor (including fundamental breach, negligence, misrepresentation, or other contract or tort claim), Contractor’s entire liability for all claims in the aggregate arising therein will not exceed the amount of any actual direct damages up to the greater of $100,000 or the charges (if recurring, 12 months’ charges apply) for the product or service that is subject of the claim.

This limit applies to Contractor and its subcontractors and program developers. It is the maximum for which Contractor and its subcontractors and program developers are collectively responsible.

6.6.2. The following amounts are not subject to a cap on the

amount of damages: (i) payments referred to in the Section 6.3 (Indemnification – Patent, Trademark and Copyright); and (ii) damages for bodily injury (including death) and damage to real property and tangible personal property for which Contractor is legally liable. 6.6.3. Except as expressly required by law without the possibility of contractual waiver, under no circumstances is Contractor, its subcontractors, or program developers liable for any of the following even if informed of their possibility: (i) loss of, or damage to, data; (ii) special, incidental, exemplary, or indirect damages or for any economic consequential damages;

or (iii) lost profits, business, revenue, goodwill, or anticipated savings.

ADOT accepts

14 Uniform Terms and Conditions 7.2.1

7.2.1. Of a quality to pass without objection in the trade under the Contract description;

7.2.1. delete original language and replace with: “Free from defects in workmanship and conform to their specifications under the Contract description;”

ADOT accepts

15 Uniform Terms and Conditions New add 7.7 None

Disclaimer Other than as expressly provided in this contract, there are no express warranties and there are no implied warranties, including the implied warranties of the fitness for a particular purpose. Contractor does not warrant uninterrupted or error free operation of hardware, software, or services.

ADOT accepts

16 Uniform Terms and Conditions 9.4

Termination for Convenience. The State reserves the right to terminate the Contract, in whole or in part at any time when in the best interest of the State, without penalty or recourse.

Upon receipt of the written notice, the Contractor shall stop all work, as directed in the notice, notify all subcontractors of the effective date of the termination and minimize all further costs to the State. In the event of termination under this paragraph, all documents, data and reports prepared by the Contractor under the Contract shall become the property of and be delivered to the State upon demand. The Contractor shall be entitled to receive just and equitable compensation for work in progress, work completed and materials accepted before the effective date of the termination. The cost principles and procedures provided in A.A.C. R2-7-701 shall apply.

Termination for Convenience. The State reserves the right to terminate the Contract, with a 90-day written notice to the Contractor and paying Contractor the reasonable incremental costs incurred by Contractor in winding down its efforts under the Contract. Upon receipt of the written notice, the Contractor shall stop all work, as directed in the notice, notify all subcontractors of the effective date of the termination and minimize all further costs to the State. In the event of termination under this paragraph, all documents, data and reports prepared by the Contractor under the Contract shall become the property of and be delivered to the State upon demand. The Contractor shall be entitled to receive just and equitable compensation for work in progress, work completed and materials accepted before the effective date of the termination. The cost principles and procedures provided in A.

A.C. R2-7-701 shall apply.

ADOT accepts

17 Uniform Terms and Conditions New add 13 none

Miscellaneous GDPR The State agrees that no Confidential Information or personal data that is subject to European General Data Protection Regulations (GDPR) requirements will be provided to the Contractor under this Agreement.

Confidential Information Confidential Information disclosed orally or not marked with a restrictive legend must be identified as confidential at the time of disclosure. Each disclosure of Information is subject to this Contract for five years following the initial date of disclosure. Notwithstanding any statement to the contrary in this agreement, any information that under all of the circumstances, ought reasonably to be understood to be confidential and/or proprietary to a prudent person with knowledge of the disclosing party’s industry shall be considered Confidential Information.

ADOT Accepts

(Insert more rows as applicable)

STATE OF ARIZONA

1566 W. Jackson St., REQUEST FOR PROPOSAL

SOLICITATION NUMBER: BPM004934

DESCRIPTION: Information Technology (IT) Service Delivery Partner

QUESTIONS: Inquiries regarding the solicitation are to be submitted online through the State’s e-Procurement system, Arizona Procurement Portal (APP) (https://app.az.gov/) using the Discussion Forum tab.

OFFERORS ARE STRONGLY ENCOURAGED TO READ THE ENTIRE SOLICITATION.

Kelly Greene Procurement Officer Phone: 602-712-4879 Email: Kgreene@azdot.gov

This solicitation is issued in accordance with A.R.S. §41-2534 and A.A.C. R2-7-C301 et seq., Competitive Sealed Proposals.

“An Equal Opportunity Agency”

The Arizona Department of Transportation, in accordance with the provisions of Title VI of the Civil Rights Act of 1964 (78 Stat. 252.42 U.S.C. §§ 2000d-4) and the Americans with Disabilities Act (ADA), hereby notifies all bidders that it will affirmatively ensure that any contract entered into pursuant to this advertisement, disadvantaged business enterprises will be afforded full and fair opportunity to submit bids in response to this invitation and will not be discriminated against on the grounds of race, color, national origin in consideration for an award.

Persons that require a reasonable accommodation based on language or disability should contact ADOT’s Procurement Office by phone (602) 712-2089. Requests should be made as early as possible to ensure the State has an opportunity to address the accommodation.

Las personas que requieran asistencia (dentro de lo razonable) ya sea por el idioma o discapacidad deben ponerse en contacto con ADOT (602) 712-2089.

https://app.az.gov/

TABLE OF CONTENTS

Solicitation No: BPM004934 Available online at

SECTION PAGE

Notice 1

Table of Contents 2

Scope of Work 3

Special Terms and Conditions 20

Uniform Terms and Conditions 39

Federal Provisions 49

EXHIBITS

1 - Title VI/Non-Discrimination Assurances Appendix A 75

2 - Title VI/Non-Discrimination Assurances Appendix E 76

3- Usage Report 77

4- 310PS Certification of Final Disadvantaged Business Enterprise (DBE) Payment 78

SCOPE OF WORK

1. Statement of Need

1.1. Pursuant to the Arizona Procurement Code, A.R.S. §41-2501 et seq., the State of Arizona Department of Transportation (Department), has a requirement for an Information Technology (IT) Service Delivery Partner.

1.2. The Department is seeking the services of a qualified firm(s) or individual(s) (hereinafter referred to as the Contractor) to provide supportive services and technology solutions.

2. Introduction and Background

2.1. The Department is a multimodal transportation agency serving one of the fastest-growing areas of the country. The Department is responsible for planning, building and operating a complex highway system in addition to providing vehicle title, registration and driver-license services to the general public throughout the state of Arizona.

2.2. The Department has multiple divisions. The Department's Transportation Systems Management and Operations (TSMO) Division is responsible for planning, building and maintaining the State’s transportation system. The Traffic Operations Center (TOC) provides freeway cameras, dynamic message signs, 511 road advisory system and wrong way driver detection. The Motor Vehicle Division (MVD) provides title, registration, and driver-license services to the general public throughout the state of Arizona. The Enforcement and Compliance Division (ECD) is composed of approximately 200 officers that monitor the ports of entry in the State (both international and interstate), handles permitting, inspections, commercial vehicle enforcement, safety and compliance, as well as investigations. Equipment Services maintains and manages the State fleet of approximately 10,000 vehicles, heavy equipment and emergency response units; and has more than 20 equipment shops throughout the state including 51 fuel sites. Facilities Management maintains all of the Department’s buildings, including but not limited to MVD offices, maintenance yards and ports-of-entries state-wide.

2.3. The Department’s Information Technology Group (ITG) is responsible for Information Technology

(IT) oversight, strategy and implementation. ITG has a headcount of 161 personnel that support approximately 3,600 Department employees and 2,400 contractors in the Department’s locations state-wide. The scope of IT services includes help desk, application development and support, data management, cybersecurity, disaster recovery and cloud services. ITG provides technical support to all business divisions within the Department. On an annual basis ITG processes 71,000 service desk tickets, purchases and maintains 26,000 software licenses and manages approximately 80 IT projects. ITG teams support 365 computer applications, 7,500 PCs and laptops, 900 servers and over 3,000 databases. In addition, ITG's security team monitors and responds to ongoing cyber threats and provides a 24x7 incident response capability.

3. General Requirements

3.1. Core Services- The Contractor shall be required to provide all core services as listed in the chart below and as described in the Specific Requirements, Paragraph 4.1.

3.2. Additional Services (as required)

The Contractor shall provide a response for Additional Services as part of their proposal. The Contractor will be required to state in their proposal if they do not intend to provide all or some of the Additional Services. Additional Services are listed in the chart below, and detailed descriptions can be found in the Specific Requirements paragraph 4.2 of this solicitation. Responses to Additional Services will be used for evaluation purposes.

3.2.1. The Department plans to deploy the Additional Services. However, some may be done internally, some may continue using existing solutions, and some may be superseded by other higher priority initiatives.

3.2.2. Services Table

Core Services

1. Cybersecurity

2. Hardware Refresh, Configuration and Deployment Services

3. MSA for ITG Staffing and Consulting Services

4. IT Services Payment Agent

Additional Services

1. Hosting, Development, and Maintenance

2. Network Operations

3. Transportation Systems Modernization

4. Call Center/Help Desk Support

5. Project Management and Governance Support Services

3.3. Work Assignment

3.3.1. The services described in this solicitation shall be provided by both the Department and the Contractor. The assignments of duties are at the direction of the Department. The Department may at its discretion direct the Contractor to use a specific supplier or technology. This may occur where unique technologies exist in ever-changing technology markets, such as with transportation systems providers. Also, this may occur in best-of-breed solutions whereby a certain supplier leads in this industry. The Contractor may subcontract with other companies to offer services they do not normally offer or to supplement their expertise or capabilities. The Department requires the Contractor to serve as the Prime Contractor and directly subcontract with the other companies with the same terms and conditions to which the Contractor agrees with the Department. When the Department specifies the supplier or technology to use, the Department is responsible for that project’s deliverables. In this situation the Contractor will be primarily acting as the paying agent role.

3.3.2. Remote work may be permitted at the discretion of the Department. The Contractor must be available to work onsite upon the request of the Department. Hardware deployment must be onsite at the selected Department’s offices.

3.4. Volumes

3.4.1. Current Budget Statistics Table

Technology Expenditures by Year Totals by Year

FY2022 FY2021 FY2020

Cybersecurity $1,058,000 $903,000 $888,000

Hardware Refresh (services only) $275,400 $165,000 n/a

ITG Contractor Staffing and Consulting $5,800,000 $5,850,000 $6,130,000

Total Expenditures $6,858,000 $6,753,000 $7,018,000

4. Specific Requirements

4.1. Core Services

The Department has identified Four (4) Core Services as described below. The Contractor must provide these Core services either directly or with subcontractors.

4.1.1. Cybersecurity (Core)

The Department requires a number of cyber security services. The Contractor shall provide a Security Operations Center service (SOC) and four (4) “embedded” personnel.

Embedded means a person that is employed by the Contractor but is dedicated full time to working under the direction of the Department to fulfill a specific job role. Job role requirements are prescribed by the Department and must be met by the person assigned its duties. Embedded personnel must be senior engineers with a high level of skill, experience and expertise with the associated discipline (i.e., Firewall and Proxy administration, IT Security Risk Management, Security Information & Event Management (SIEM), and Cloud Security. A detailed listing of all cyber services required by the Department is provided in Managed Security Service Provider Statement of Work (MSSP SOW) Table 1 Requirements. The requirements for core cyber service roles include but are not limited to the following sections 4.1.1.1 through 4.1.1.6. The terms resources and support resources as mentioned below refer to personnel that are provided by the Contractor to support the core team.

4.1.1.1. Firewall management

4.1.1.1.1. Requires an embedded engineer dedicated to managing Palo Alto firewall pairs (x3), on premise and cloud based via Panorama.

4.1.1.1.2. Engineers must be experienced and skilled in supporting VPN and other capabilities within Palo Alto service offerings.

4.1.1.1.3. Engineers must be experienced and skilled in complex troubleshooting, networking, and routing, on premise and within cloud platforms.

4.1.1.1.4. Support resources must comply with firewall architecture, policy, and configuration that adhere to regulatory compliance requirements (e.g., IRS 1075, PCI, Social Security Administration).

4.1.1.1.5. Full time resources are required to complete ongoing customer service request tickets and project based service tickets.

4.1.1.1.6. Resources are required to attend internal IT support, coordination and project meetings.

4.1.1.1.7. Resources are required to immediately attend incident response and resolution conference calls 24x7 to address Production outages.

4.1.1.2. Cloud Proxy & Content Filter Management

4.1.1.2.1. Requires an embedded engineer dedicated to managing an agent based cloud proxy and content filter.

4.1.1.2.2. Engineers must be experienced and skilled in supporting agents on all Department endpoints and other capabilities within ZScaler service offerings.

4.1.1.2.3. Engineers must be experienced and skilled in complex troubleshooting and networking, on premise and within cloud platforms.

4.1.1.2.4. Support resources must comply with cloud proxy and agent based architecture, policy, and configuration that adhere to regulatory compliance requirements (e.g., IRS 1075, PCI, Social Security Administration).

4.1.1.2.5. Full time resources are required to complete ongoing customer service request tickets and project based service tickets.

4.1.1.2.6. Resources are required to attend internal IT support, coordination and project meetings.

4.1.1.2.7. Resources are required to immediately attend incident response and resolution conference calls 24x7 to address Production outages.

4.1.1.3. IT Security Risk Management

4.1.1.3.1. Requires an embedded engineer dedicated to attending project meetings and other coordination efforts to ensure security policy and standards are met for all new or changing technology deployments.

4.1.1.3.2. Resources must have experience and an in depth understanding of networking architectures and routing protocols. Experience and in depth understanding of application programming and scripting is required.

4.1.1.3.3. Experience with, and full understanding of, regulatory security frameworks and guidelines (e.g., NIST 800-53, PCI, IRS 1075, SSA, CIS) is required.

4.1.1.3.4. Resources are required to fully document system security plans (e.g., logical network diagrams, full data flow diagrams, and compliance documentation for authentication, access control, auditing, logging, etc.) for all new or changing technology deployments.

4.1.1.3.5. Resources are required to fully document risk analysis templates to identify each IT security risk (in detail), impact of each risk, likelihood rating, and appropriate countermeasures (for each technology implementation or change).

4.1.1.3.6. Support resources must complete ongoing service tickets for software, plugin and application requests via policy compliance review.

4.1.1.3.7. Full time resources are required to complete ongoing customer service request tickets and project based service tickets.

4.1.1.3.8. Resources are required to attend internal IT support meetings.

4.1.1.4. Security Information & Event Management (SEIM)

4.1.1.4.1. Requires an embedded engineer dedicated to managing Splunk instances, on premise and within cloud platforms. Splunk is an application that is used for monitoring and searching through big data.

4.1.1.4.2. Engineers must be skilled and experienced in Splunk application and infrastructure.

4.1.1.4.3. Engineers must manage and support leading practices and strategy for Splunk architecture and configuration, participate in technical governance, identify core data, integrations, and the overall health of the Splunk solution.

4.1.1.4.4. Configure Splunk instances, including dashboards, based on industry best practice.

4.1.1.4.5. Tuning Splunk traffic and monitoring the infrastructure health of associated components is required. This includes analyzing the growth rate and determining an appropriate scaling plan.

4.1.1.4.6. Continually interfacing the Security Operations Center to ensure log traffic is received and meets specified standards is required.

4.1.1.4.7. Support resources must complete ongoing service tickets for software, plugin and application requests.

4.1.1.4.8. Full time resources are required to complete ongoing customer service

4.1.1.4.9. Resources are required to attend internal IT support meetings.

4.1.1.5. Cloud Security

4.1.1.5.1. Requires an embedded engineer dedicated to Cloud security oversight and compliance.

4.1.1.5.2. Engineers must be skilled and experienced in Amazon Web Services (AWS) architecture, security, scripting, network, and infrastructure services.

4.1.1.5.3. Engineers are required to provide ongoing consulting (i.e., architecture decisions, network and infrastructure configuration) within AWS tenants.

4.1.1.5.4. Resources must analyze security alerts (e.g., GuardDuty, Inspector, Detective, Macie, Security Hub) to identify and mitigate actionable events and incidents, based on criticality.

4.1.1.5.5. Engineers must deploy log aggregation pipelines to ingest any type of event;

and utilize S3, Simple Que service (SQS), and Lambdas to collect and process events from specific AWS tenant.

4.1.1.5.6. The use of cloud formation templates is required. Events must correlate to custom security rules that trigger notification (e.g., Public access to internal S3, etc.).

4.1.1.5.7. Events and notifications triggered from security rules must be integrated into Security Operations center (SOC) standard procedure.

4.1.1.5.8. Resources are required to continually audit the Department's AWS environment for cyber weaknesses and vulnerabilities (e.g., Identity Access Management (IAM) roles, security groups, Cloud Formation Technology (CFT), etc.).

4.1.1.5.9. Red, blue and purple team cyber assessment exercises are required on a scheduled basis. Identified gaps from each assessment must be identified and corrected.

4.1.1.5.10. Full time resources are required to complete ongoing customer service

4.1.1.5.11. Resources are required to attend internal IT support meetings.

4.1.1.6. Security Operations Center (SOC)

4.1.1.6.1. Must monitor security event logs, via 24x7 operations center, to detect malicious or abnormal activities and alert on events that may lead to security threat or breach.

4.1.1.6.2. Must provide log baselines for all platforms under the scope that are required to be monitored.

4.1.1.6.3. The SOC platform must have capability to collect logs from standard platforms like Windows, Linux, firewall, network and other security devices or solutions.

4.1.1.6.4. Must be able to collect logs from standard network, security devices, databases, web servers and cloud services (AWS/Azure), SAAS Solutions, Google Suite, etc.

4.1.1.6.5. Must detect both internal and external attacks, including security attacks on IT infrastructure, databases, servers, etc.

4.1.1.6.6. Must correlate logs from multiple sources to detect events that may represent cyber threat. Events must be analyzed and converted to incidents based on preset criteria. Incidents must be categorized based on impact and likelihood.

4.1.1.6.7. MSSP must provide workflows and solutions required to automate the majority of incident response activities (e.g., false positive management, managing white lists, escalation workflow, SLA management etc.).

4.1.1.6.8. Must alert the Department only after proper triage process. Alerts from the Contractor’s SIEM must be enriched with context data, environmental data, vulnerability data, historical data, threat intelligence, etc. Historical parameters must include but are not limited to attack volume, attacker volume, and destination volume for every alert.

4.1.2. Hardware Refresh, Configuration, and Deployment Services (Core)

4.1.2.1. ITG provides hardware refresh/replacement for all employees and selected contractors on a pre-planned three (3) or five (5) year refresh cycle. Hardware includes but shall not be limited to desktop PCs, laptops, tablets, smartphones, and related peripherals (printers, scanners, etc.).

4.1.2.2. The Department has standard configurations for each hardware item. ITG shall continue to procure all hardware through existing State of Arizona contracts. The Contractor shall be responsible for receipt, setup, imaging, and configuration of the computers based on standard ITG configurations.

4.1.2.3. The Contractor shall be responsible for deployment of the computers and peripherals in end-user locations. The Department has 428 locations statewide.

4.1.2.4. Contractor deployment includes physical delivery, setup, networking, and testing in the respective Department user locations.

4.1.2.5. FY2022 volumes:

Hardware Item # of Units # of Locations 5-Year Cycle Desktop PCs 668 89 X Laptop PCs 564 44 X Tablets 31 9 X

4.1.3. MSA for ITG Staffing and Consulting Services (Core)

4.1.3.1. The Contractor shall provide a Master Services Agreement (MSA) for ITG staffing and consulting services. The Contractor shall be responsible for resourcing, staffing and payroll support functions as well as payment of the ITG contractors on behalf of the Department. Reimbursement to the Contractor for contractor costs will come from ITG’s budget.

4.1.3.2. Such contractor roles may be project managers, developers, maintenance programmers, network specialists, DevOps specialists, help desk specialists, and other technical roles.

4.1.3.3. The Department’s objective of this service is to partner with a Contractor who would provide the sourcing, assignment and management for all assignments regardless of personnel class or project duration. There shall not be limitations to the size, scope, or duration of individual contractor assignments.

4.1.3.4. The Department shall have oversight and consistent input regarding subcontractor selection and any selection criteria for the recruitment of any subcontractor into the

Vendor Network. Further, the Contractor would provide additional value-added services such as a web-based Vendor Management System (VMS). This focus will provide greater accountability, as well as allowing the Department to focus on more strategic initiatives rather than administrative tasks. The Contractor may provide directly or may partner with another vendor.

4.1.3.5. This contract shall be in place solely for obtaining project personnel for the

Department’s ITG projects and related functions and shall not be used for any other purpose. It is understood by all parties that no personnel placed under the terms of this Contract is considered to be in “State Service” or a “Seasonal” or “Temporary” appointment (as defined in Arizona Administrative Code, Title 2, Chapter 5, Personnel Administration Rule R2-5-101). It is also understood by all parties that the Contractor’s personnel are not eligible for any benefits as provided in Arizona Administrative Code, Title 2, Chapter 5, Personnel Administration Article 4.

4.1.3.6. The Department reserves the right to recommend individuals and Subcontractors to the Vendor Network. Further, the Contractor shall accept into the Network an individual or Firm that is approved by the Department, and that complies with the Department approved Subcontractor network joining process, including agreeing to the Contract’s standard terms and conditions as a Subcontractor and meeting specified performance criteria.

4.1.3.7. The Contractor shall work with the Department’s incumbent contractor and

Department personnel to transition seated resources to the new Contractor. If an incumbent vendor elects to be an active participant in the Vendor’s Vendor Network and it agrees to the terms and conditions and rates as set forth, its resource(s) will be transitioned upon award of this Contract. If an incumbent vendor elects not to participate in any capacity, the ITG Project Manager may hire a staff augmentation resource for a knowledge transfer before the incumbent vendor’s contract is terminated. The Department business unit may be required to replace the existing resource with a new candidate through the Contractor’s Vendor Network.

4.1.3.8. Any interested staffing and consulting business that is recommended and approved by the Department may request to join the Contractor’s Vendor Network by placing a telephone call or sending an email to the Contractor’s Account Manager or Business Development Personnel. The Contractor shall provide the interested party a general overview of the Contract and, at the interested party’s request, will send a “new vendor packet” via email. The new vendor packet contains all required documentation to register with the Contractor. Depending on availability and technical expertise, the Contractor may invite the interested party for a face-to-face meeting. Once the interested party and the Contractor have completed all required documentation and have met the requirements of the State-approved Subcontractor network joining process, the interested party shall be deemed pre-qualified and shall be placed on the Contractor maintained list of potential subcontractors for future consideration.

4.1.3.9. In addition to the MSA for contractor staffing, the Department may require the Contractor to provide, directly or indirectly through a partner or subcontractor, miscellaneous consulting projects. These typically would be fixed price, limited duration, and limited scope specific projects in addition to staffing. The Contractor would provide project management and delivery of these consulting projects. ITG would provide oversight, business and technical expertise as required, and approval of all deliverables.

4.1.3.10. ITG and the Contractor shall work together to define the scope, timing, and approach for these miscellaneous consulting projects. The Contractor will then provide the cost. If agreed, the project will be documented in a separate Task Order under this contract.

4.1.4. IT Services Payment Agent (Core)

4.1.4.1. The Contractor shall serve as IT Services Payment Agent for select services as designated by the Department. The Contractor will have two different roles, depending on the situation, as follows:

4.1.4.1.1. "Paying Agent" – The Contractor acts as the distributor of funds from the Department to vendor(s) as instructed by the Department. The Paying Agent has no delivery affiliation with or performance responsibilities over the Department-directed vendor. The Department supervises the performance of the vendor and instructs the Paying Agent as to the payment terms and amounts of the distribution to the vendor.

4.1.4.1.2. "Contracting Agent" - The Contractor engages the vendor specified by the Department to provide certain temporary staffing and/or consulting, project services, or other technologies. As contracting agent, the Contractor has no delivery affiliation with or performance responsibilities over the Department-directed vendor. The Department supervises the performance of the vendor and instructs the Contractor as to the payment terms and amounts of the distribution to the vendor.

4.1.4.2. Payments will…