Cybersecurity_Penetration_Testing_(Addendum_#5_Revision).pdf

Mayor Chief Procurement Officer Buddy Dyer David Billingsley, CPSM, C.P.M.

REQUEST FOR QUOTATION (RFQ)

RFQ23-0479

CYBERSECURITY PENETRATION TESTING

The City of Orlando Procurement and Contracts Division has implemented an electronic bidding system to streamline solicitation responses.

CITY OF ORLANDO PROCUREMENT AND CONTRACTS SITE

https://www.orlando.gov/Our-Government/Departments-Offices/OBFS/Procurement

City of Orlando

REQUEST FOR QUOTATION (RFQ)

CYBERSECURITY PENETRATION TESTING

TABLE OF CONTENTS

1. INTRODUCTION

2. GENERAL INFORMATION

3. SUBMITTALS

4. SCOPE OF WORK

5. STANDARD TERMS AND CONDITIONS

6. SPECIAL TERMS AND CONDITIONS

7. ELECTRONIC PRICING FORM(S) INSTRUCTIONS

8. VIRTUAL OPENING

9. VENDOR QUESTIONNAIRE

10. PRICING PROPOSAL

Cybersecurity Penetration Testing

1. INTRODUCTION

1.1. Summary

The City of Orlando (City) requests quotes from interested and qualified Bidders for

Cybersecurity Penetration Testing.

1.2. Contact Information

Direct all questions and inquiries to the following:

Varun Desai, CPP

Purchasing Agent III

400 S Orange Ave

Orlando, FL 32801

Email: varun.desai@orlando.gov

Phone: (407) 246-3874

Department:

Water Reclamation Enterprises

1.3. Timeline

Issue Date August 21, 2023

Pre-Solicitation Conference (Non-

Mandatory)

September 6, 2023, 10:00am

JOIN THE VIRTUAL PRE-SOLICITATION

CONFERENCE.

Online:

https://teams.microsoft.com/l/meetup-join/19%3ameeting_ZWQxNTU3MjktODdj

OC00NDE2LWJjY2UtODM3YTk5ODAwZ

GEw%40thread.v2/0?context=%7b%22Tid

%22%3a%227594da9b-294b-4acf-913b-d159ae921564%22%2c%22Oid%22%3a%

22bc8fa4c3-2723-4aeb-97fe-

4383f2126000%22%7d

Call into the virtual meeting by dialing this phone number: +1 321-247-7568

Once dialed-in and prompted, enter the

Conference ID: 682 884 583#

Cut-off date for Questions by

Respondent

September 11, 2023, 5:00pm mailto:varun.desai@orlando.gov tel:(407)246-3874 https://teams.microsoft.com/l/meetup-join/19%3ameeting_ZWQxNTU3MjktODdjOC00NDE2LWJjY2UtODM3YTk5ODAwZGEw%40thread.v2/0?context=%7b%22Tid%22%3a%227594da9b-294b-4acf-913b-d159ae921564%22%2c%22Oid%22%3a%22bc8fa4c3-2723-4aeb-97fe-4383f2126000%22%7d https://teams.microsoft.com/l/meetup-join/19%3ameeting_ZWQxNTU3MjktODdjOC00NDE2LWJjY2UtODM3YTk5ODAwZGEw%40thread.v2/0?context=%7b%22Tid%22%3a%227594da9b-294b-4acf-913b-d159ae921564%22%2c%22Oid%22%3a%22bc8fa4c3-2723-4aeb-97fe-4383f2126000%22%7d https://teams.microsoft.com/l/meetup-join/19%3ameeting_ZWQxNTU3MjktODdjOC00NDE2LWJjY2UtODM3YTk5ODAwZGEw%40thread.v2/0?context=%7b%22Tid%22%3a%227594da9b-294b-4acf-913b-d159ae921564%22%2c%22Oid%22%3a%22bc8fa4c3-2723-4aeb-97fe-4383f2126000%22%7d https://teams.microsoft.com/l/meetup-join/19%3ameeting_ZWQxNTU3MjktODdjOC00NDE2LWJjY2UtODM3YTk5ODAwZGEw%40thread.v2/0?context=%7b%22Tid%22%3a%227594da9b-294b-4acf-913b-d159ae921564%22%2c%22Oid%22%3a%22bc8fa4c3-2723-4aeb-97fe-4383f2126000%22%7d https://teams.microsoft.com/l/meetup-join/19%3ameeting_ZWQxNTU3MjktODdjOC00NDE2LWJjY2UtODM3YTk5ODAwZGEw%40thread.v2/0?context=%7b%22Tid%22%3a%227594da9b-294b-4acf-913b-d159ae921564%22%2c%22Oid%22%3a%22bc8fa4c3-2723-4aeb-97fe-4383f2126000%22%7d https://teams.microsoft.com/l/meetup-join/19%3ameeting_ZWQxNTU3MjktODdjOC00NDE2LWJjY2UtODM3YTk5ODAwZGEw%40thread.v2/0?context=%7b%22Tid%22%3a%227594da9b-294b-4acf-913b-d159ae921564%22%2c%22Oid%22%3a%22bc8fa4c3-2723-4aeb-97fe-4383f2126000%22%7d https://teams.microsoft.com/l/meetup-join/19%3ameeting_ZWQxNTU3MjktODdjOC00NDE2LWJjY2UtODM3YTk5ODAwZGEw%40thread.v2/0?context=%7b%22Tid%22%3a%227594da9b-294b-4acf-913b-d159ae921564%22%2c%22Oid%22%3a%22bc8fa4c3-2723-4aeb-97fe-4383f2126000%22%7d https://teams.microsoft.com/l/meetup-join/19%3ameeting_ZWQxNTU3MjktODdjOC00NDE2LWJjY2UtODM3YTk5ODAwZGEw%40thread.v2/0?context=%7b%22Tid%22%3a%227594da9b-294b-4acf-913b-d159ae921564%22%2c%22Oid%22%3a%22bc8fa4c3-2723-4aeb-97fe-4383f2126000%22%7d

Due Date and Time September 21, 2023, 2:00pm

JOIN THE VIRTUAL OPENING.

Online:

https://teams.microsoft.com/l/meetup-join/19%3ameeting_N2QyNjE0NmQtNWJ mNC00ZThiLWIxYmItOTBlY2YwN2U0OTc

5%40thread.v2/0?context=%7b%22Tid%2

2%3a%227594da9b-294b-4acf-913b-d159ae921564%22%2c%22Oid%22%3a%

22bc8fa4c3-2723-4aeb-97fe-

4383f2126000%22%7d

Call into the virtual meeting by dialing this phone number: +1 321-247-7568

Once dialed-in and prompted, enter the

Conference ID: : 547 632 669# https://teams.microsoft.com/l/meetup-join/19%3ameeting_N2QyNjE0NmQtNWJmNC00ZThiLWIxYmItOTBlY2YwN2U0OTc5%40thread.v2/0?context=%7b%22Tid%22%3a%227594da9b-294b-4acf-913b-d159ae921564%22%2c%22Oid%22%3a%22bc8fa4c3-2723-4aeb-97fe-4383f2126000%22%7d https://teams.microsoft.com/l/meetup-join/19%3ameeting_N2QyNjE0NmQtNWJmNC00ZThiLWIxYmItOTBlY2YwN2U0OTc5%40thread.v2/0?context=%7b%22Tid%22%3a%227594da9b-294b-4acf-913b-d159ae921564%22%2c%22Oid%22%3a%22bc8fa4c3-2723-4aeb-97fe-4383f2126000%22%7d https://teams.microsoft.com/l/meetup-join/19%3ameeting_N2QyNjE0NmQtNWJmNC00ZThiLWIxYmItOTBlY2YwN2U0OTc5%40thread.v2/0?context=%7b%22Tid%22%3a%227594da9b-294b-4acf-913b-d159ae921564%22%2c%22Oid%22%3a%22bc8fa4c3-2723-4aeb-97fe-4383f2126000%22%7d https://teams.microsoft.com/l/meetup-join/19%3ameeting_N2QyNjE0NmQtNWJmNC00ZThiLWIxYmItOTBlY2YwN2U0OTc5%40thread.v2/0?context=%7b%22Tid%22%3a%227594da9b-294b-4acf-913b-d159ae921564%22%2c%22Oid%22%3a%22bc8fa4c3-2723-4aeb-97fe-4383f2126000%22%7d https://teams.microsoft.com/l/meetup-join/19%3ameeting_N2QyNjE0NmQtNWJmNC00ZThiLWIxYmItOTBlY2YwN2U0OTc5%40thread.v2/0?context=%7b%22Tid%22%3a%227594da9b-294b-4acf-913b-d159ae921564%22%2c%22Oid%22%3a%22bc8fa4c3-2723-4aeb-97fe-4383f2126000%22%7d https://teams.microsoft.com/l/meetup-join/19%3ameeting_N2QyNjE0NmQtNWJmNC00ZThiLWIxYmItOTBlY2YwN2U0OTc5%40thread.v2/0?context=%7b%22Tid%22%3a%227594da9b-294b-4acf-913b-d159ae921564%22%2c%22Oid%22%3a%22bc8fa4c3-2723-4aeb-97fe-4383f2126000%22%7d https://teams.microsoft.com/l/meetup-join/19%3ameeting_N2QyNjE0NmQtNWJmNC00ZThiLWIxYmItOTBlY2YwN2U0OTc5%40thread.v2/0?context=%7b%22Tid%22%3a%227594da9b-294b-4acf-913b-d159ae921564%22%2c%22Oid%22%3a%22bc8fa4c3-2723-4aeb-97fe-4383f2126000%22%7d https://teams.microsoft.com/l/meetup-join/19%3ameeting_N2QyNjE0NmQtNWJmNC00ZThiLWIxYmItOTBlY2YwN2U0OTc5%40thread.v2/0?context=%7b%22Tid%22%3a%227594da9b-294b-4acf-913b-d159ae921564%22%2c%22Oid%22%3a%22bc8fa4c3-2723-4aeb-97fe-4383f2126000%22%7d

2. GENERAL INFORMATION

2.1. SOLICITATION INFORMATION

The City’s Procurement and Contracts Division is the official source to obtain information relating to City of Orlando procurements. It is incumbent on the Respondent to obtain current response/submittal and award information prior to and after the scheduled opening date of a solicitation. Information is updated as it becomes available. An award, or recommendation of award, may be made at any time after the scheduled opening date of a solicitation. You may obtain award and other solicitation information in a variety of ways, such as:

A. Solicitation documents are available for download from the City's e-Procurement

Portal ("Portal"):

You may access solicitation information by visiting the City’s Portal by clicking on the following link: https://procurement.opengov.com/portal/orlando

A. You may also contact the Procurement and Contracts Division at (407) 246-2291 or visit us during normal business hours, to obtain award information and other documents at:

City of Orlando

Procurement and Contracts Division

400 South Orange Avenue, Fourth Floor

Orlando, Florida 32801

Please remember, email notification is provided as a courtesy to our Respondents, but it is the Respondent's responsibility to check with the City of Orlando’s Portal at:

https://procurement.opengov.com/portal/orlando for current solicitations and other procurement information.

We appreciate your interest in doing business with the City of Orlando.

2.2. CONTRACT TERM

It is the intent of the City to award a Contract for a one-time purchase.

2.3. SCHEDULE

The Timeline Section of this solicitation contains the scheduled calendar of events with important dates and times for this Solicitation. Dates and times are subject to change by the City’s Chief Procurement Officer (CPO) or designee, at their sole discretion. If the

Procurement and Contracts Division determines that it is necessary to change these dates or times prior to the Solicitation Due Date, the change will be announced via an addendum.

https://procurement.opengov.com/governments/4073/portal/orlando https://procurement.opengov.com/governments/4073/portal/orlando

2.4. PRE-SOLICITATION CONFERENCE

The purpose of a Pre-Solicitation Conference is to review and discuss the solicitation (and any addenda) as published. A representative from the Procurement and Contracts

Division and a technical representative from the using department will be present to discuss the solicitation.

3. SUBMITTALS

Respondents are solely responsible for ensuring that their submittals are complete, uploaded and submitted in the e-procurement Portal by the Due Date and time. The City shall not be responsible for any submission delays or failures caused by any occurrence. Respondents are expected to examine this solicitation, specifications, associated drawings, if any, and all instructions. Failure to do so will be at the

Respondent's risk.

Each Respondent shall furnish the information required on each response/submittal form and each accompanying sheet thereof on which an entry is made.

The following items must be completed and uploaded as part of your electronic submittal and are contained in the Vendor Questionnaire Section. Failure to complete and return required forms may result in your response being deemed non-responsive and not considered for award.

A. Pricing - All prices shall be entered online through the City's e-Procurement portal.

B. Attachment A - References. This form must be downloaded, completed, and uploaded as a part of the submittal.

C. Attachment B - Respondent's Certification Form. This form must be downloaded, completed, signed, notarized, and uploaded as a part of the submittal.

D. Attachment C - Contract and Acceptance Form. This form must be downloaded, completed, signed, notarized, and uploaded as a part of the submittal.

E. Attachment D - Conflict of Interest Disclosure Form. This form must be downloaded, completed, signed, and uploaded as a part of the submittal.

F. Attachment E - Confidential and/or Proprietary Information Exemption Form.

This form must be downloaded, completed, signed, and uploaded as a part of the submittal.

G. Attachment F - Minority/Women-Owned Business Enterprise Participation Form.

This form must be downloaded, completed, and uploaded as a part of the submittal.

H. Attachment G - Veteran Business Enterprise Participation Form. This form must be downloaded, completed, and uploaded as a part of the submittal.

I. Proof of CREST (Council of Registered Ethical Security Testers) Testing, ISO (Information

Security Management Systems), OSCP (Offensive Security Certified

Professional), OSCE (Offensive Security Certified Expert), ISACRB CSSA https://procurement.opengov.com/governments/4073/portal/orlando/projects/53801?section=454127

(Certified SCADA (Supervisory Control and Data Acquisition) Security

Architect), ISACRB CEPT (Certified Expert Penetration Tester) certifications as defined under section 4.1 Vendor Qualifications of the Scope of Work.

J. Copy of Respondent's current W-9 is to be signed and uploaded as a part of the submittal.

K. Bid Security, if applicable.

L. Proof of insurance - If applicable, please refer to Section 5 – Insurance

Requirements

Respondents shall register on the City’s e-Procurement Portal. Once registered, Respondents may view and click "Follow" to be a Prospective Respondent for this solicitation and will appear on the Follower’s list. Respondents that fail to Follow this project will not receive automated Addenda notifications, nor will they be able to submit a response in the Portal, and therefore will be unable to participate, nor be considered for this solicitation. Respondents must click “Draft Response” to properly begin and submit a response in the Portal.

The City will accept responses to this solicitation electronically via the e-Procurement

Portal until 2:00 PM on Thursday, September 21, 2023. Responses received after the scheduled due date and time for submission will not be accepted. Responses submitted in any other format other than via the City's e-Procurement Portal, including but not limited to, hard copy (mailed or hand delivered), facsimile, or emailed submittals, will not be accepted, nor considered. The scheduled due date and time for submission will be scrupulously observed.

Neither the City, nor the Software Administrator will be held responsible for untimely submissions due to personal or company internet or hardware limitations, settings or restrictions, internet speed, power outage, network connection, use of a malfunctioning electronic device, or the like. Respondents shall be solely responsible for ensuring the capability of their computer system while responding to this solicitation, and for the stability of their internet service. Uploading large documents may take significant time depending on the size of the file(s) and the Internet connection speed that the

Respondent is using to submit a response. Failure of the Respondent to successfully submit an electronic response before the deadline indicated herein shall be at the

Respondent’s sole risk, and no relief will be given for late and/or improperly submitted response. Once file(s) have been uploaded and the Submission Status shows as

“Submitted” the submission is complete. At that point, the Respondent will also receive an email confirmation from the Portal.

Respondents may withdraw their submittal electronically via the Portal at any time prior to the scheduled due date and time for submission.

4. SCOPE OF WORK

4.1. Preferred Vendor's Qualifications:

• At least five (5) to ten (10) years in continuous business.

• Preferred: CREST Penetration Testing accreditation.

• Preferred: ISO 27001 certified.

• The technician(s) that conduct the test should be OSCP certified (Offensive Security Certified

Professional) and OSCE (Offensive Security Certified Expert).

• The technician(s) that conduct the test should be IACRB Certified SCADA Security Architect

(CSSA).

• The technician(s) that conduct the test should be IACRB Certified Expert Penetration Tester

(CEPT).

• Provide two previous customers that the City can interview to verify the experience and quality of the tests performed and the technician’s experience.

• The bidder will have to sign a Non Disclosure Agreement (NDA) prior to start any exchange of information with the City of Orlando Water Reclamation Department.

• Documentation of your certifications should be submitted with your bid response.

4.2. SCADA Testing Methodology:

• Before the engagement or testing begins in each facility, a meeting is needed to be informed of the types of testing (i.e., internal, external, application-layer or network-layer) to be performed, how testing will be performed, and what the testing will target specifically. The City has three facilities where the testing will be done: Iron Bridge, Water Conserv I, Water Conserv II (WCII)

Water Reclamation Facilities, and the Water Reclamation Administration Facility. This last facility is part of the WCII network.

• As part of this pre-engagement meeting, the contractor will gain understanding of the core architecture, input/output devices, the automation and control systems, communication protocols and master/supporting systems in place. This will be done though the review of network diagrams and interviews.

• A physical walk through of the environments is required prior to testing. The contractor should conduct a physical assessment of the environment which may include reviewing substation and remote location security.

• The City will not be performing an external penetration test.

• Perform Internal Penetration Test. This aims to expose what damage could be done if an attacker is already inside the target system. This also covers malicious insiders. This test should include, but not limited to:

o Network Security Test: these tests unveil vulnerabilities that could exist in our networks, as well as associated devices like routers, switches, and network hosts. The contractor should review ARP tables from switches to allow for discovery of IP addresses and devices MAC addresses. Seeking lateral movement through the network. Primary concern is in attempting to obtain elevated or domain admin privileges.

o Application Tests: These tests focus on the overall security and potential risks of applications and internal websites, including coding errors, broken authentication or authorization, and injection vulnerabilities. Performing a privilege escalation or gaining Application Administrator access. Gaining access to the server that hosts the application, or in gaining access to the associated database.

• The contractor should utilize tools such as GRASSMARLIN, Nmap, or Nessus for device discovery and vulnerability discovery.

• The contractor should not run exploit code on HMI, PLCs, or RTUs. The contractor should not interfere with the regular operations of the SCADA system while conducting the penetration test unless is it approved by the City of Orlando Water Reclamation. The contractor will be able to interface with certain devices, previously identified, to display proof of concept access.

4.3. Reporting:

• Penetration test reports should include a discussion of the steps, vectors, and exploited vulnerabilities that lead to penetration during testing for which remediation and retesting are required.

• The following reports should be provided:

• Executive Report o This report shall summarize the findings geared toward company executives.

o This should be written in non-technical language so that non-security professionals can comprehend the significance of the discovered vulnerabilities and what the organization must do to fix them.

o This report shall include the scope, date, and overall description of the vulnerabilities found and the severity of the vulnerabilities that the City of

Orlando can use this information to prioritize repairs. Include recommended priority of actions.

o This report focuses less on the technical detail and more on the risk and impact of the findings.

o Please use tablets and charts as much as possible to understand better the information provided.

• Technical Report.

o This report shall include the scope, date, and describe in detail each of the vulnerabilities discovered, how they were discovered, and how an adversary can exploit them.

o This report shall include how the tester discovered and exploited each flaw.

Provide a distinct rating for exploitability, such as Easy, Medium, or Hard. In conjunction with the severity of the vulnerabilities, the organization can use this information to prioritize repairs.

o Provide screenshots and evidence for the vulnerabilities to enable the City of

Orlando Water Reclamation to reproduce them.

o This report shall include in-depth recommendations on how to fix each vulnerability. Testers must provide detailed remediation instructions for all affected systems.

o Use tablets and charts as much as possible, to better understand the information provided.

• Summary Report:

o This report shall include the environments and dates tested, the name of the tester, the methodology used for each test, and a list of the vulnerability category and ratings identified.

• The contractor should meet with the City of Orlando to go over each one of these reports after contract is awarded. This can be a virtual meeting.

• Bid price must include a retest to be performed at the end of 2024.

End of Section

5. STANDARD TERMS AND CONDITIONS

5.1. COMMUNICATIONS; QUESTIONS REGARDING SPECIFICATIONS OR

SUBMITTAL PROCESS

A. All communication and contact regarding this solicitation shall be directed to the

Purchasing Agent referenced on the cover page of this solicitation.

B. To protect the integrity of the solicitation process and ensure fair consideration of all respondents, a prohibited communication period is hereby established commencing as of the time of the issuance of this solicitation and terminating upon execution of a contract (or, if the solicitation is cancelled, upon cancellation of the solicitation).

1. Except for communication with the City’s designated point of contact set forth in this solicitation or as otherwise authorized by the City’s Chief Procurement

Officer, during the prohibited communication period, the City prohibits communication regarding the solicitation by a Respondent or potential

Respondent (or on a Respondent or potential Respondent's behalf) to or with any officer, elected official (including the Mayor and City Council), department, division, office, or employee of the City, or any other person or entity providing advice to the City related to this solicitation.

2. During the prohibited communication period, all contacts and communications regarding the solicitation by a Respondent, or potential Respondent, including their agents, representatives and others on their behalf, shall be directed to the City’s Procurement and Contract Services Division in the manner provided below in this solicitation, unless otherwise authorized by the City’s

Chief Procurement Officer.

3. Prohibited contact or communications during the prohibited communication period may result in disqualification from the solicitation process, rejection of the solicitation, or termination of any resulting contract as determined by the

Chief Procurement Officer. In addition, prohibited contact or communications may also be grounds for suspension and debarment of a Respondent or potential Respondent under the City’s Procurement Code.

C. Any questions by a Respondent relative to the interpretation of specifications or the submittal process shall be addressed in writing as indicated below. In order to be answered prior to the submittal deadline, questions must be received by the

Procurement and Contracts Division ten (10) days prior to the date set for the receipt of submittals. Any interpretation made to prospective Respondent with respect to questions submitted prior to the cut-off date for questions to be answered prior to the submittal deadline will be expressed in the form of an

Addendum to the specifications which, if issued, will be conveyed to all prospective Respondents no later than five (5) days before the date set for receipt of submittals. Oral answers and written answers not answered in an

Addendum issued by the Procurements and Contracts Division will not be binding.

D. Openings shall be public, on the date and at the time specified on the

Solicitation, with the total submittal amount being read aloud. It is the

Respondents responsibility to assure that their submittal has been entered online no later than the due date and time of the opening. The Respondent's name and verification of bond submittal, if applicable, will be publicly announced aloud at the opening.

5.2. RESPONDENT QUALIFICATION

Submittals will be considered from Respondents who have adequate personnel and equipment and who are so situated as to perform prompt service or provide required goods. The City reserves the right to request information or conduct an inspection of the

Respondent's facility and equipment prior to the award of the contract.

Submittals will be considered only from Respondents which are regularly engaged in the business as described in this solicitation; with a record of performance for a reasonable period of time, which have sufficient financial support, equipment, and organization to ensure that they can satisfactorily execute the service if awarded a contract under the terms and conditions herein stated.

The terms "equipment and organization" as used herein shall be construed to mean a fully equipped and well established company in line with the best business practice in the industry and as determined by the City.

5.3. ALTERATIONS/CHANGES TO PRICE FORM(S)

Respondent shall not change or otherwise alter the quantity or unit designations on the

Price Form(s). The unit price and total extensions must correspond to these designations.

Each line item will be extended as indicated (quantity x unit price). The unit price shall prevail.

5.4. ADDENDA

It is the Respondent's responsibility to contact the Procurement and Contracts Division prior to submitting a response to ascertain if any Addenda have been issued, to obtain all such Addenda, and return executed Addenda with the response, if applicable. All addenda information will be posted on the City's website

(https://procurement.opengov.com/portal/orlando). The failure of a Respondent to submit acknowledgment of any Addenda that affects the price(s), is considered a major irregularity and will be cause for rejection of the response.

5.5. UNBALANCED PRICING

As determined by the City's Chief Procurement Officer in the CPO’s discretion, the City may consider a solicitation response irregular and reject it if any of the prices are excessively unbalanced (either above or below the amount of a reasonable response) to the potential detriment of the City. The City further reserves the right to require backup documentation from the respondent if, in the Chief Procurement Officer's opinion, the prices are, or appear to be, excessively unbalanced.

5.6. WITHDRAWAL

After opening, no changes in prices or other provisions shall be permitted. Respondents may withdraw or correct a submittal prior to the stipulated date and time for the opening of the Solicitation.

5.7. SELECTION/REJECTION OF OPTIONS

The City of Orlando reserves the right to select/reject options which are submitted, based on price and other considerations as deemed to be in the best interests of the City.

5.8. IRREVOCABLE OFFER

The submission of a response shall constitute an irrevocable offer to the City by the

Respondent for a period of ninety (90) days from the date of opening to provide the goods and services set forth in this solicitation upon the terms, conditions, and provisions of this solicitation, at the pricing set forth in the submittal.

5.9. QUANTITIES

The quantities for the items listed in this solicitation are estimated annual quantities for evaluation purposes only and should not be construed as representing actual quantities to be purchased. Moreover, it is understood by all Respondents that the City is not obligated to purchase any minimum or maximum amount during the life of a contract resulting from this solicitation.

5.10. RESPONDENT'S CERTIFICATION FORM

Each Respondent shall complete the "Respondent's Certification Form” included with this

Solicitation. The form should be acknowledged before a Notary Public with notary seal affixed on the document. The failure of a Respondent to include this document with their submittal will be cause for rejection of the submittal.

5.11. SUBMITTALS

Submittals shall be submitted utilizing the form(s) provided herein. All submittals shall be properly executed with all blank spaces filled in. The signatures of all persons signing https://procurement.opengov.com/governments/portal/orlando shall be in longhand. Erasures, interlineations, or other corrections shall be authenticated by affixing in the margin immediately opposite the correction the initials of a person signing the submittal. If the unit price and the total amount provided by a Respondent for any item are not in agreement, the unit price alone shall be considered as representing the Respondent's intention, and the totals shall be corrected to conform thereto.

5.12. INSPECTION, ACCEPTANCE, AND TITLE

Inspection and acceptance will be at destination unless otherwise stipulated. Title and risk of loss or damage to all items shall be the responsibility of the Respondent.

5.13. EXCEPTIONS TO TERMS AND CONDITIONS

When completing your submittal, do not attach any forms which may contain terms and conditions that conflict with those listed in the City’s solicitation document(s). Inclusion of additional terms and conditions, such as those which may be on your company’s standard forms, may result in your submittal being declared non-responsive.

5.14. SPECIFICATIONS

A. The specifications shown in the Solicitation are intended to represent items of a quality level known to meet City’s requirements. While the City endeavors to promulgate written specifications that are accurate and nonrestrictive for submittal purposes, they may also reference an item by manufacturer’s name and model number. Respondents are cautioned that in the event of a discrepancy therein, such difference must be timely questioned in writing. Any written question must be received by the Procurement and Contracts Division at the address on the cover of this solicitation no later than ten (10) days prior to the opening.

B. If any proprietary, trade, brand, or manufacturers' name or part number is used herein in describing the required equipment or materials, it shall be understood to indicate the minimum standard of composition and quality desired, and shall not be construed to exclude equipment or goods that equals or exceeds the functional capability and quality of the named equipment. The City, in its sole discretion, shall determine whether equipment or goods are equivalent in capability and quality.

C. In cases where an item is identified by a manufacturer's name, trade name, catalog number, or reference, it is understood that the Respondent proposes to furnish the item so identified and does not propose to furnish an "EQUAL" unless the proposed "EQUAL" is definitely indicated therein by the Respondent. The reference to a name brand is intended to be descriptive but not restrictive and only to indicate to the prospective Respondent articles that will be satisfactory.

Submittals on other makes and catalogs will be considered provided each respondent clearly states in their submittal exactly what he proposes to furnish and forwards with their submittal a cut illustration or other descriptive matter which will clearly indicate the character of the article covered by their submittal.

The City hereby reserves the right to approve as an equal, or to reject as not being equal, any article the Respondent proposes to furnish which contains major or minor variations from the specification requirements but may comply substantially therewith. If no particular brand, model, or make is specified and if no data is required to be submitted with the submittal, the successful contractor after award and before manufacture or shipment may be required to submit working drawings or detailed descriptive data sufficient to enable the City to judge if such requirement of the specification is being complied with.

D. Respondents are strongly encouraged to submit equivalent equipment or materials for consideration during the question and answer period. If equivalent equipment or materials is proposed, indicate the manufacturer's name and model number for the equipment and include any literature or other explanation of the equipment's quality or performance with your submittal.

E. The equipment herein shall be new and shall be of the current production model.

If applicable, detailed equipment specifications for make and model offered shall be provided with submittal.

F. Respondents may be required, at no expense or liability to the City, to make available for test/demonstration, equipment equal in all aspects to the equipment quoted, and/or equal equipment that may be seen under operating conditions in the Central Florida area.

5.15. SILENCE OF SPECIFICATIONS

The apparent silence of these specifications or any supplemental specifications as to details or the omission from same of any detailed description concerning any point, shall be regarded as meaning that only the best commercial practices are to prevail and that only materials of first quality and correct type, size, and design are to be used. All workmanship shall be first quality. All interpretations of specifications shall be made upon the basis of this statement.

5.16. PRICES AND TERMS

All prices must be firm for the delivery schedule quoted herein. All prices shall be F.O.B.

Destination delivered to any City of Orlando Department unless otherwise stipulated in the Solicitation.

5.17. TAXES

The City of Orlando does not pay Federal excise and State sales taxes. Our tax exemption number is 85-8015427957C-9 and is also stipulated on all our Purchase Orders.

5.18. POLITICAL SUBDIVISIONS

Under Florida Law, prices contained in State Contracts shall be available to the City of

Orlando, who might wish to purchase under a State Purchase Contract. The City of

Orlando therefore reserves the right to purchase any commodities from a State Purchase

Contract if in the best interest of the City.

5.19. MISTAKES

Respondents are expected to examine the specifications, delivery schedules, prices, and all instructions pertaining to supplies and services. Failure to do so will be at the

Respondent's risk.

5.20. SAFETY STANDARDS

Unless otherwise stipulated in the Solicitation, all manufactured items and fabricated assemblies shall comply with applicable requirements of Occupational Safety and Health

Act and any standards thereunder.

5.21. MARKING

Each individual container shall be marked with the brand name of the product, quantity and the name and address of the manufacturer. Each shipping container shall include the name of the Respondent and must also clearly indicate the City of Orlando Purchase

Order Number and/or City Contract Number.

5.22. INVOICING AND PAYMENT

The Contractor shall be paid in accordance with Florida Statutes, upon submission of invoices to: AP_Invoices@orlando.gov or PO Box 4990, Orlando, FL 32802-4990.

Invoices are to be billed at the prices stipulated on the purchase order and/or as outlined in this solicitation. All invoices must show the Purchase Order Number and/or City

Contract Number.

5.23. DISCOUNTS

Respondents may offer a discount for prompt payment; however, such discounts shall not be considered in determining the lowest net price for evaluation purposes. Discounts will be computed from the date of satisfactory delivery at place of acceptance or from receipt of correct invoice at the office specified, whichever is later.

Respondent is requested to offer price discount for prompt invoice payment. It is the policy of the City of Orlando to make payments of invoices in time to earn any offered discounts.

Discount time will be computed from the date of satisfactory delivery at place of acceptance or from receipt of correct invoice at the Accounts Payable Office, whichever is later.

mailto:AP_Invoices@cityoforlando.net

5.24. PROMPT PAYMENT ACT

Payment by the City shall be made in accordance with Sections 218.70. et sq. Florida

Statutes, Local Government Prompt Payment Act.

A. Proper Invoice

1. For purposes of billing submission and payment procedures, a "proper invoice" by a Contractor or other invoicing party shall consist of at least all of the following:

a. a description (including quantity) of the goods and/or services provided to the City (or a party on behalf of the City) reasonably sufficient to identify it

(or them);

b. the unit pricing, quantity and total amount due in accordance with the contract terms and conditions and applicable discount(s);

c. the full name of the Contractor or other party who is supplying the goods and/or services including a mailing address in case of a dispute and a mailing address for payment purposes (if they are different) and a telephone number;

d. the Purchase Order or contract number as supplied by the City; and

e. an identification by Division, Office or Department of the party(ies) to whom the goods were delivered or services provided.

f. Finally, in addition to all of the above, in order to be considered a proper invoice, it must be based on a proper delivery, installation, or provision of the goods and/or services to and acceptance by the City (or party on behalf of the City); the Contractor or other party who is supplying the goods and/or services has otherwise complied with all of the contract's terms and conditions and is not in default of any of them; and if the contract requires any subcontractors or other parties to be bound by similar other "flow-down" requirements that those requirements have been complied with.

B. Dispute Resolution

In the event a dispute occurs between a Contractor or other invoicing party ("invoicing party") and the City concerning payment of an invoice, the City Department, Office or

Division which has the dispute along with a representative of the City's Procurement and

Contracts Division and the invoicing party shall meet to consider the disputed issues. The invoicing party shall provide to the City such material and information as the City may reasonably require. Any such procedure shall be initiated by either party notifying the other in writing of a dispute and stating with specificity its nature. This procedure shall commence not later than forty-five (45) days, and be resolved not later than sixty (60) days, after the date on which the proper invoice was received by the City. Any decision by the City’s Chief Procurement Officer shall constitute the final decision of the City regarding these matters and shall be communicated in writing to the invoicing party within three business days after such decision. If no decision is rendered within the time period as set out above, then a decision against the invoicing party shall be deemed to have been issued.

5.25. INSPECTION OF PUBLIC RECORDS

Respondent may request copies of the solicitation records in person or by written request to the City Records and Archive Management Services located at 400 South Orange

Avenue, 2nd Floor, Orlando, Florida, 32801 or by calling (407) 246-2148. You may also email your request to records@orlando.gov. Pursuant to Florida State Statute Chapter

119.07, sealed submittals or replies are exempt from public inspection until such time as the City provides Notice of Intended Action or until thirty (30) days after opening, whichever is earlier.

5.26. IRREGULAR SUBMITTALS

Submissions made on documents other than the ones furnished by the Procurement and

Contracts Division may not be considered. Changes in phraseology, additions, or limiting provisions made on the Solicitation may render the submittal irregular and may cause rejection. The City’s Chief Procurement Officer, however, has the authority to waive minor irregularities.

5.27. CONTINGENT FEES

The Respondent warrants that no City official or employee was paid a fee, commission, gift, or other consideration contingent upon receipt of an award for the services and/or supplies specified herein.

5.28. EVALUATION OF AWARD

The City reserves the right to award the Solicitation to the responsive and responsible

Respondent who submits the lowest submittal meeting specifications. For purposes of this solicitation, the determination of the responsive and responsible Respondent submitting the lowest submittal shall be made after the application of all applicable programs and preferences established by the City, including but not limited to the City’s

MBE/WBE program and VBE preference. In determining whether a Respondent is responsible, the City reserves the right to consider matters such as, but not be limited to, quality offered, delivery terms, and service reputation of the Respondent.

5.29. AWARD OR REJECTION OF SUBMITTALS

The City’s Chief Procurement Officer reserves the right to accept any, all or part of any submittal, to waive minor irregularities, or to reject any, all or part of any submittal, and to advertise for new opportunities, as the interest of the City may require. The City’s Chief mailto:records@cityoforlando.net

Procurement Officer also reserves the right to reject the submittal of a Respondent who has previously failed to perform properly or complete on time contracts of a similar nature, or a submittal of a Respondent who investigation shows is not in a position to perform the contract. In determining responsibility, the following other qualifications, in addition to price, may be considered by the City’s Chief Procurement Officer:

A. The ability, capacity, and skill of the Respondent to perform the service required.

B. Whether the Respondent can perform the contract or provide the service promptly, or within the time specified, without delay or interference.

C. The character, integrity, reputation, judgment, experience, and efficiency of the

Respondent.

D. The quality of performance of previous contracts or services.

E. The previous and existing compliance by the Respondent with laws and ordinances relating to the contract or service.

F. The sufficiency of the financial resources and ability of the Respondent to perform the contract or provide the service.

G. The quality, availability, and adaptability of the supplies, or services, to the particular use required.

H. The ability of the Respondent to provide future maintenance and service for the use of the subject of the contract.

I. Whether the Respondent is in arrears to the City on a debt or contract or is a defaulter on surety to the City, or whether the Respondent's taxes or assessments are delinquent.

J. Such other information as may be relevant or secured.

5.30. AWARDS

As the best interest of the City of Orlando may require, the right is reserved to make award(s) by individual items, group of items, all or none, or a combination thereof, with one or more suppliers; to reject any or all submittals or waive any informality or technicality in submittals received.

5.31. MULTIPLE AWARDS

The City reserves the right in its sole discretion after evaluation of all responsive submittals, to award the work described herein to more than one responsive and responsible Respondent. In such cases where an award is made to more than one responsive and responsible Respondent, the City shall apportion the work among the various primary, secondary and alternate providers in such manner and at such time as it deems appropriate under the circumstances in its sole discretion and no minimum amount or proportion of work is guaranteed to any single provider or class of providers irrespective of such provider’s designation as primary, secondary or alternate.

5.32. PRICING AND ORDERING

The awarded Respondent shall honor all orders in accordance with the terms and conditions of the solicitation and their pricing and discounts terms as listed in their submittal. Unless otherwise specified, the awarded Respondent shall stock sufficient quantities of supplies to meet the requirements of the City on an "as-needed" basis within seventy-two (72) hours after being notified of such requirements by the City.

5.33. RETURN OF PRODUCTS/EQUIPMENT

All items delivered must meet the Specifications herein. Items delivered not as specified will be returned at no expense by the City of Orlando. The City may return, for full credit, any unused items received which fail to meet the City’s performance standards.

Replacement items meeting Specifications must be submitted within a reasonable time after rejection of the non-conforming items. Unless a different time period is specified, the

Contractor is to accept for full credit, any merchandise returned by the City within ninety

(90) days from the delivery or pick up date. All merchandise to be acceptable for full credit is to be returned in a condition to allow for resale by the contractor and include reference to an applicable Contractor Invoice or Packing List. Full credit is to include all costs paid by the City related to the subject merchandise as determined by the appropriate

Contractor Invoice or Packing List.

5.34. FAMILIARITY WITH SITE WORK AND CONDITIONS

The responsibility for the determination of accurate measurements, the extent of work to be performed, and the conditions surrounding the performance thereof shall be the

Respondent's. Submission of a submittal shall constitute acknowledgment by the

Respondent that it is familiar with all such conditions. The failure or neglect of a

Respondent to familiarize itself with the site of the proposed work, shall in no way relieve it from any obligations with respect to its submittal.

5.35. RIGHT TO AUDIT RECORDS

The City shall be entitled to audit the books and records of a Contractor or any subcontractor to the extent that such books and records relate to the performance of the contract or any subcontract. The Contractor and its subcontractors shall retain and maintain financial records and other records relating to the contract for a period of five (5) years from the date of final payment under the contract and by the subcontractor for a period of five (5) years from the date of final payment under the subcontract unless a shorter period is otherwise authorized in writing by the City. If any litigation, claim, negotiation, audit or other action involving the records has been started before the expiration of the 5-year period, the records must be retained until completion of the action and resolution of all issues which arise from it, or until the end of the regular 5-yearperiod, whichever is later.

5.36. ASSIGNMENT

The Contractor shall not sell, assign, or transfer any of its rights, duties, or obligations under the contract or under any purchase order issued pursuant to the contract, without the prior written consent of the City. The Contractor shall give full attention to the contract, to the faithful execution of the contract, and shall keep the same under its control.

5.37. FISCAL YEAR FUNDING APPROPRIATION

A. Specified Period

1. Unless otherwise provided by law, a contract for supplies or services may be entered into for any period of time deemed to be in the best interest of the

City provided funds are available for the first fiscal period at the time of contract. Payment and performance obligations for succeeding fiscal periods shall be subject to appropriation by City Council of funds therefor.

B. Cancellation Due to Unavailability of Funds in Succeeding Fiscal Periods

1. When funds are not appropriated or otherwise made available to support continuation of performance in a subsequent fiscal period, the contract shall be cancelled and the Contractor shall be entitled to reimbursement for the reasonable value of any nonrecurring cost incurred but not amortized in the price of the supplies or services delivered under the contract or otherwise recoverable.

5.38. APPLICABLE LAW AND APPEALS

This solicitation is issued in accordance with and shall be governed by the provisions and procedures of Chapter 7 of the City of Orlando’s Code which can be accessed online at:

https://www.municode.com/library/fl/orlando/codes/code_of_ordinances?nodeId=TITIICI

CO_CH7PRCO or by contacting the Procurement and Contracts Division. Any appeal of matters relating to this solicitation must be filed in accordance with the requirements of

Chapter 7 of the City Code.

5.39. WARRANTY

Respondent warrants that all equipment, materials and workmanship, whether furnished by Respondent or its subcontractor(s), will comply with the City's specifications, drawings and other requirements. The Contractor warrants that the Work including equipment and materials provided shall conform to professional standards of care and practice in effect at the time the Work is performed, be of the highest quality, and be free from all faults, defects or errors. Whenever required by the specifications of the Request for Quotation, the Contractor warrants that all equipment and materials provided shall be new. If the

Contractor is notified in writing of a fault, deficiency or error in the Work provided within one (1) year from completion of the Work, the Contractor shall, at the City's option, either reperform such portions of the Work to correct such fault, defect or error, at no additional https://www.municode.com/library/fl/orlando/codes/code_of_ordinances?nodeId=TITIICICO_CH7PRCO https://www.municode.com/library/fl/orlando/codes/code_of_ordinances?nodeId=TITIICICO_CH7PRCO cost to the City, or refund to the City, the charge paid by the City, which is attributable to such portions of the faulty, defective or erroneous Work, including the costs for reperformance of the work provided by other Contractors.

5.40. CONTRACT AND ACCEPTANCE FORM

In order to expedite the contracting process after opening and preclude delays occasioned by subsequent contract execution, Respondents are requested to sign the

Contract and Acceptance Form included with this solicitation and return the form with their submittal. In the event that a successful Respondent fails to properly execute the Contract and Acceptance Form or return said form (or, if necessary, a letter of authorization) with their submittal, the City shall notify the Respondent of the City’s intent to make an award and the Respondent shall submit such form properly executed (together with a letter of authorization, if necessary, as set forth below) within fifteen (15) calendar days of receipt of notice from the City. Unless such time is extended by the City, the failure of a

Respondent to submit a properly executed form (and, where necessary, a letter of authorization) within said time period shall because for cancellation of the intended award by the City in its sole discretion. In the event that an intended award is cancelled, the award may then be made to the next lowest responsive and responsible Respondent or the City’s Chief Procurement Officer may decline to make an award.

Successful Respondent who default in properly executing the Contract and Acceptance

Form after notification of the City’s intent to make an award shall forfeit any bid security, if applicable, to the City and are subject to suspension and/or debarment by the City.

Unless otherwise agreed by the City in its sole discretion, the Contract and Acceptance form shall be executed and notarized as follows:

A. If the Contractor is a corporation, the Contract and Acceptance Form shall be signed by an authorized corporate officer (i.e., President, Vice President, C.E.O, or C.O.O.).

B. If Contractor is a Partnership, the Contract and Acceptance Form shall be signed by a general or managing partner.

C. If the Contractor is a limited liability company, the Contract and…