Cybersecurity_Resources_RFP.pdf

STATE OF MARYLAND

DEPARTMENT OF GENERAL SERVICES (DGS)

REQUEST FOR PROPOSALS (RFP)

STATEWIDE CYBERSECURITY RESOURCES

RFP NUMBER: BPM057598

ISSUE DATE: AUGUST 4, 2026

A Prospective Offeror that has received this document from a source other than eMarylandMarketplace Advantage (eMMA) https://procurement.maryland.gov should register on eMMA https://emma.maryland.gov/

MINORITY BUSINESS ENTERPRISES ARE ENCOURAGED TO RESPOND TO THIS

SOLICITATION

https://procurement.maryland.gov/ https://emma.maryland.gov/

Statewide Cybersecurity Resources

Solicitation #: BPM057598 RFP Document

RFP for Department of General Services Page 2 of 49

STATE OF MARYLAND

DEPARTMENT OF GENERAL SERVICES (DGS)

KEY INFORMATION SUMMARY SHEET

Request for Proposals IT – Cybersecurity Resources

Solicitation Number: BPM057598

RFP Issue Date: August 4, 2026

RFP Issuing Office: Department of General Services (DGS or the "Department")

Procurement Officer: Brad Cary 45 Calvert Street Annapolis, MD 21401

Email:

Phone Number:

Bradley.cary1@maryland.gov 410-260-3975

Proposals are to be sent to: Submit on emma.maryland.gov under Solicitation Number.

To submit a proposal, offerors must first register on emma.maryland.gov. We recommend registering in advance to become acquainted with the site.

No Bid/Proposal Notice Feedback Form

*If you are not submitting a proposal for this solicitation, submit Attachment 1 with your reasons why.

Pre-Proposal Conference: August 11th 2026, 1:00 PM EST Virtual meeting via Google Meet See Section 4.3 for additional details.

See Attachment 2 to RSVP by August 10th at 10 AM EST to Attend

Scheduled Site Visit N/A

Questions Due Date and Time: August 17, 2:00 PM EST

Proposal Due (Closing) Date and Time:

September 18, 2:00 PM EST Offerors are reminded that a completed Feedback Form is requested if a no-bid/proposal decision is made (see Attachment 1 - No Bid Notice/Vendor Feedback Form).

mailto:Bradley.cary1@maryland.gov

RFP for Department of General Services Page 3 of 49

MBE Subcontracting Goal: 15% (For each Functional Area)

VSBE Subcontracting Goal: 3% (For each Functional Area)

Procurement Method: A Contract will be awarded in accordance with the Competitive Sealed Proposals method under COMAR 21.05.03.

Multiple or Alternate Bids: Multiple or alternate Proposals will not be accepted.

Contract Type: Indefinite Quantity with Firm Fixed Prices, with Labor Hour based Work Orders

Contract Duration: Ten (10) Years, with No Renewal Options

Primary Place of Performance: Various locations throughout the State of Maryland

SBR Designation: No

Federal Funding: May be applicable at the Work Order Level

RFP for Department of General Services Page 4 of 49

TABLE OF CONTENTS – RFP

1 Minimum Qualifications

1.1 Offeror Minimum Qualifications

2 Contractor Requirements: Scope of Work

2.1 Summary Statement

2.2 Background and Purpose

2.3 Contractor Responsibilities and Tasks

2.4 Experience and Personnel

2.5 Substitution of Personnel

2.6 Supplemental Category of Work Requirements and Responsibilities

2.7 Location of Services Performed

3 Standard Terms and Conditions

3.1 Contract Initiation Requirements

3.2 End of Contract/Work Order Transition

3.3 Invoicing

3.4 Liquidated Damages

3.5 Problem Escalation Procedure

3.6 Work Orders

3.7 Payments by Electronic Funds Transfer

3.8 Prompt Payment Policy

3.9 Federal Funding Acknowledgement

3.10 Conflict of Interest

3.11 Non-Disclosure Agreement

3.12 Maryland Healthy Working Families Act Requirements

3.13 The State of Maryland’s Commitment to Purchasing Environmentally Preferred Products and

Services (EPPs)

3.14 Insurance Requirements

3.15 Non-Compete Clause Prohibition

3.16 Electronic Transaction Fee

4 Proposal Submission Information and Instructions

4.1 eMaryland Marketplace Advantage (eMMA)

4.2 Electronic Means

RFP for Department of General Services Page 5 of 49

4.3 Pre-Proposal Conference

4.4 Questions

4.5 Proposal Due (Closing) Date and Time

4.6 Economy of Preparation

4.7 Public Information Act Notice

4.8 Oral Presentation

4.9 Duration of Proposals

4.10 Revisions to the RFP

4.11 Cancellations

4.12 Incurred Expenses

4.13 Protest/Disputes

4.14 Offeror Responsibilities

4.15 Acceptance of Terms and Conditions

4.16 Compliance with Laws/Arrearages

4.17 Verification of Registration and Tax Payment

4.18 False Statements

5 Proposal Format

5.1 Two Part Submission

5.2 Proposal Delivery and Packaging

5.3 Volume I - Technical Proposal

5.4 Volume II – Financial Proposal

6 Evaluation and Selection Process

6.1 Evaluation Committee

6.2 Technical Proposal Evaluation Criteria

6.3 Financial Proposal Evaluation Criteria

6.4 Reciprocal Preference

6.5 Selection Procedures

6.6 Documents Required upon Notice of Recommendation for Contract Award RFP Attachments

(Table B)

7 RFP Appendices and Exhibits

7.1 Appendices (Table C)

7.2 Exhibits (Table D)

RFP for Department of General Services Page 6 of 49

RFP for Department of General Services Page 7 of 49

1 Minimum Qualifications

1.1 Offeror Minimum Qualifications

There are no minimum qualifications for this procurement.

THE REMAINDER OF THIS PAGE IS INTENTIONALLY LEFT BLANK.

RFP for Department of General Services Page 8 of 49

2 Contractor Requirements: Scope of Work

2.1 Summary Statement

The State of Maryland (“State”), through the Department of General Services (DGS or the Department), is issuing this Request for Proposals (RFP) to establish a comprehensive statewide contract for cybersecurity resources. The primary objective of this solicitation is to secure highly skilled professionals and teams capable of delivering advanced cybersecurity and privacy services across multiple domains, including governance, risk management, and compliance.

This contract will enable State agencies to strengthen their cybersecurity posture, mitigate risks, and ensure compliance with federal and state regulations. This solicitation is a multiple-award Request for Proposals (RFP), with contract awards across three Functional Areas, as follows:

1. Functional Area 1: Oversight and Governance: Develop and enforce cybersecurity policies, frameworks, and standards aligned with NIST and other recognized guidelines. This area includes implementing robust risk assessment methodologies, ensuring adherence to privacy laws, and managing enterprise-wide compliance and data protection programs to safeguard sensitive information.

2. Functional Area 2: Architecture, Engineering, and Implementation: Deliver comprehensive technical expertise for the entire lifecycle of secure systems, from initial security architecture design to the hands-on implementation of security tools. This area focuses on "security by design," integrating DevSecOps into development pipelines, and the physical configuration of cloud and hybrid infrastructures.

3. Functional Area 3: Protection and Defense: Provide proactive and reactive operational support to identify, detect, and mitigate cyber threats. This area includes continuous security monitoring via Security Operations Centers (SOC), vulnerability management, penetration testing, and rapid incident response and forensics to maintain the State’s defensive posture.

The roles and responsibilities outlined in this RFP are informed by the National Initiative for Cybersecurity Education (NICE) Workforce Framework for Cybersecurity, ensuring alignment with nationally recognized work role categories. The State seeks to create a flexible, scalable mechanism for acquiring cybersecurity expertise quickly and efficiently via Work Orders tailored to specific organization needs.

It is the State’s intention to obtain goods and services, as specified in this RFP, from a contract between the selected Offeror and the State.

See RFP Section 6.5 Selection Procedures for more Contract award information.

This is a multiple award RFP. The Department intends to award up to six (6) Contracts as a result of this RFP to Offerors submitting the most advantageous Proposals. No more than two (2) awards will be made in each of Functional Area 1, Functional Area 2, and Functional Area 3.

Please Note: Offerors may only respond to one Functional Area.

The resulting contract may be used by any and all Maryland Government entities,Maryland Local Jurisdictions, and eligible non-profits organizations.

Offerors are advised that, should a solicitation or other competitive award be initiated as a result of activity or recommendations arising from this RFP, the Offeror awarded this Contract may not be

RFP for Department of General Services Page 9 of 49 eligible to compete if such activity constitutes assisting in the drafting of specifications, requirement, or design thereof.

The purpose of this solicitation is to create a pool of qualified Contractors that will be engaged through a Work Order process to provide services on an on-going, as needed basis. DGS anticipates issuing a Work Order(s) immediately upon award according to the Work Order process in Section

3.6. All resources will be requested through the Work Order process. A Work Order response may not in any way conflict with or supersede this Cybersecurity Resources Contract.

A Contract award does not ensure a Contractor will receive all or any State business under the Contract.

Maryland State and local entities as defined in State Finance and Procurement Article 13110(a)(5)(i) and not-for-profit entities with the State of Maryland may purchase from the Contractor goods or services covered by the Contract at the same prices chargeable to the State. All such purchases by non-executive branch entities, non-State governments, government agencies or non-for-profit entities:

• Shall constitute Contracts between the Contractor and that government, agency or not-for-profit entity;

• Shall not constitute purchases by the State or State agencies under the Contract;

• Shall not be binding or enforceable against the State; and

• May be subject to other terms and conditions agreed to by the Contractor and the purchaser.

All Contract prices, terms, and conditions must be provided to any Maryland local government for not-for-profit entity requesting services under the Contract. The Contractor bears the risk of determining whether or not a government, agency or organization with which the Contractor is dealing is a State entity.

2.2 Background and Purpose

The Department of General Services (DGS) will administer this statewide contract on behalf of the State of Maryland. The overarching purpose of this initiative is to strengthen the cybersecurity posture of State agencies, local governments, and eligible non-profit organizations by providing access to highly qualified resources with specialized technical, design, and governance expertise.

These resources will enable entities across Maryland to modernize, secure, and maintain critical IT systems while ensuring compliance with federal and state cybersecurity standards.

Maryland’s digital ecosystem, including state agencies, county and municipal governments, and non-profit organizations delivering essential services, faces evolving threats that demand proactive measures to safeguard sensitive data, maintain operational continuity, and protect citizen services.

This statewide contract is designed to address these challenges by establishing a flexible, on-demand mechanism for deploying highly skilled cybersecurity professionals and teams. Through this contract, State agencies, local governments, and eligible non-profit organizations will have rapid access to specialized expertise to support critical cybersecurity functions, including governance, risk management, secure system design, operational support, and advanced threat defense. By leveraging this resource pool, Maryland can ensure timely response to emerging threats, accelerate modernization initiatives, and maintain compliance with federal and state security standards.

This contract will serve as a flexible procurement vehicle, enabling agencies, local governments, and non-profits to quickly acquire cybersecurity talent and services through Work Orders tailored to specific needs. By doing so, Maryland aims to reduce procurement lead times, improve agility in responding to emerging threats, and ensure that the State remains a leader in cybersecurity resilience.

RFP for Department of General Services Page 10 of 49

2.2.1 Project Goals

This RFP seeks to engage contractors that are able to provide the State with resources with proven experience in the latest methodologies, technology and software to design and implement the systems needed for all agencies. Specific projects and requirements will be identified at the Work Order level.

2.2.2 State Staff and Roles

In addition to the Procurement Officer and Contract Monitor, the State project team consists of the following:

A. A Contract Manager to coordinate all contracting activities for which a Contractor may be selected through Work Orders.

B. Additional management staff at the agency level who are responsible for the oversight, delivery, and operations of their assigned applications and/or systems, and for providing technical guidance, work assignments, local and review of completed tasks.

2.2.3 Other State Responsibilities

A. The State will provide normal office working facilities reasonably necessary for Contractor’s performance under this RFP, with details to be established at the Work Order level. Any special requirements shall be identified.

B. The State is responsible for providing required information, equipment, data, documentation, and test data to facilitate the Contractor’s performance of the work and will provide such additional assistance and services as is specifically set forth.

C. The State may provide a tool that may be used to assign work, track hours spent on a particular task, and measure completion of work for acceptance purposes. The Offeror may provide a tool and provide access to state personnel.

2.3 Contractor Responsibilities and Tasks

2.3.1 The scope of this solicitation encompasses the following three (3) Functional Areas:

A. Functional Area 1: Oversight and Governance B. Functional Area 2: Architecture, Engineering, and Implementation C. Functional Area 3: Protection and Defense

2.3.2 Functional Area 1: Oversight and Governance

Description: This area focuses on establishing and maintaining cybersecurity and privacy governance structures, policies, and compliance frameworks. It ensures alignment with federal and state regulations and industry best practices.

Key Services:

1. Develop and maintain cybersecurity policies, standards, and procedures.

2. Implement Governance, Risk, and Compliance (GRC) programs.

3. Conduct enterprise-wide risk assessments and audits.

4. Manage supply chain risk and third-party vendor security.

5. Oversee privacy compliance and data protection programs.

6. Deliver cybersecurity awareness and training initiatives.

RFP for Department of General Services Page 11 of 49

Example Deliverables:

1. Statewide cybersecurity governance framework.

2. Risk management and compliance dashboards.

3. Privacy impact assessments and remediation plans.

4. Training materials and awareness campaigns.

2.3.3 Functional Area 2: Architecture, Engineering, and Implementation

Description: This area supports the entire lifecycle of secure technical environments, from initial design to active operation. It emphasizes integrating security into the software development lifecycle (DevSecOps) while providing the hands-on technical support required to deploy and configure cybersecurity tools.

Key Services:

1. Design and develop comprehensive system security architectures that align with Zero Trust principles and State-mandated cybersecurity frameworks.

2. Integrate security protocols into the software development lifecycle by implementing DevSecOps pipelines and performing automated and manual secure code reviews.

3. Execute the physical and logical implementation of cybersecurity tools, including the installation and tuning of SIEM, IAM, and endpoint protection solutions.

4. Engineer and manage secure cloud and hybrid environments, ensuring that identity management and data encryption are consistently applied across all platforms.

5. Provide continuous technical support for the configuration and optimization of security hardware and software to ensure peak operational performance.

6. Develop automated scripts and orchestration workflows to streamline security responses and infrastructure provisioning.

Example Deliverables:

1. High-Level and Detailed Design Documents

2. Security Configuration Baselines

3. DevSecOps Pipeline Documentation

4. Tool Implementation and Tuning Reports

5. Identity and Access Management (IAM) Schemas

6. Infrastructure as Code (IaC) Scripts

7. As-Built Documentation

2.3.4 Functional Area 3: Protection and Defense

Description: This area provides advanced defensive capabilities to detect, respond to, and mitigate cybersecurity threats. It includes proactive threat hunting and incident response.

Key Services:

1. Staff Security Operations Centers (SOC) and monitor for threats.

2. Conduct vulnerability assessments and penetration testing.

3. Perform threat intelligence analysis and reporting.

4. Execute incident response and forensic investigations.

5. Develop and maintain detection content for SIEM platforms.

6. Implement insider threat and advanced persistent threat (APT) detection.

RFP for Department of General Services Page 12 of 49

Example Deliverables:

1. SOC operational reports and threat detection dashboards.

2. Penetration test results and remediation plans.

3. Threat intelligence briefs and indicators of compromise (IOCs).

4. Incident response playbooks and post-incident reports.

2.3.5 Project Methodology

Project Methodology will be identified at the Work Order level.

2.3.6 Personnel Requirements

The Contractor, and all personnel selected through the Work Order process, shall comply with all State guidance regarding information controls, cybersecurity, and any other applicable requirements because of State and Federal funding. Any Personnel provided under a Work Order shall maintain any professional certifications and security clearances required by a Work Order for the duration of the Work Order.

The Labor Categories are provided in Appendix 3 of the RFP.

2.4 Experience and Personnel

2.4.1 Preferred Offeror Experience

The following experience is preferred and will be evaluated as part of the Technical Proposal (see the Offeror experience, capability and references evaluation factor from Section 6.2):

A. For Functional Area 1 (Oversight and Governance) and Functional Area 3 (Protection and Defense), accreditation through the General Services Administration (GSA) Highly Adaptive Cybersecurity Services (HACS) program.

B. Possession of a minimum of five (5) years of past performance providing cybersecurity resources to Federal, State, Local, or Tribal Governments, non-profit organizations, or enterprises with 100 or more employees on projects involving governance, risk management, compliance, secure system design, or operational defense.

C. Knowledge of project management and application development using Agile methodologies.

D. Knowledge of staffing processes, employee skills assessment and requirements development, E. Prior senior level experience in supporting State, Federal or Local Governments or Private

Industry in technology projects through both development and staff augmentation.

F. Knowledge in current software paradigms, software development life cycle, and organizational environments including both State, Federal or Local government and private industry.

Unless otherwise specified, the foregoing is applicable to all Functional Areas.

Specific for Functional Area 2:

Experience in designing and developing applications and software for government entities (Federal, State, or Local) or similarly regulated industry.

2.4.2 Personnel Experience

Required personnel experience will follow the Labor Categories and Qualifications outlined in Appendix 3. Any additional requirements or specific experience will be included in the Work Order issued under this RFP.

RFP for Department of General Services Page 13 of 49

2.4.3 Key Personnel Identified

Offeror must specify in the Technical Proposal a Point of Contact (Contractor POC) – Program Manager which is considered Key Personnel

Note: The Key Personnel Identified shall be of the Offeror in-house personnel, not from the labor categories.

2.4.4 Labor Categories

A. The Labor Categories are identified and described in Appendix 3. To be responsive to this RFP, Offerors must be capable of providing personnel meeting the minimum requirements for all the labor categories listed for the Functional Area proposed to.

Offerors shall submit a Financial Proposal Form (Attachment B – The Price Form) that provides labor rates for all labor categories for all Contract years. Actual resumes shall be provided only for Key Personnel as described in Section 2.4.4. Resumes for resources other than Key Personnel are not to be submitted with the Technical proposal, but must be provided as requested in a Work Order request.

B. Education and experience described in Appendix 3 constitute the minimum requirements the labor category. All experience required must have occurred within the most recent ten (10) years.

2.4.5 Contractor Personnel Experience Equivalency

A. A Substitution of Education for Experience: Bachelor’s Degree or higher may be substituted for the general and specialized experience for those labor categories requiring a High School Diploma. A Master’s Degree may be substituted for two years of the general and specialized experience for those labor categories requiring a Bachelor’s Degree. Substitution of education for experience may be at the discretion of the State.

B. Substitution of Experience for Education: Substitution of experience for education may be permitted at the discretion of the State.

C. Substitution of Professional Certificates for Experience: Professional certification (e.g., Microsoft Certified Solutions Expert) may be substituted for up to two (2) years for general and specialized experience at the discretion of the State.

2.4.6 Contractor Personnel Maintain Certifications

Any Contractor Personnel provided under this RFP shall maintain in good standing any required professional certifications for the duration of the applicable Work Order.

2.4.7 Work Hours

Unless otherwise specified, the following work hours requirements are applicable:

A. Business Hours Support: Contractor shall assign Contractor Personnel to support Normal State Business Hours (see definition in Appendix 1).

B. Needs beyond the hours described in paragraph A may be defined in a Work Order.

C. Contractor Personnel may also be required to provide occasional support outside of normal State Business Hours, including evenings, overnight, and weekends, to support

RFP for Department of General Services Page 14 of 49 specific efforts and emergencies, such as to resolve system repair or restoration. Hours performing activities must be billed on an actual time worked basis at the rates proposed.

D. Scheduled non-Business Hours Support: Once personnel have demonstrated an understanding of the Department infrastructure, they will also be required to participate in a rotating emergency on-call schedule, providing non-Business Hours support.

Typically, personnel assigned to Department non-Business Hours support are required to be on-call 24 hours a day for a seven-day period, one week out of every four to five weeks.

E. State-Mandated Closings: Contractor Personnel shall be required to participate in any State-mandated closings. In this event, the Contractor will be notified in writing by the Contract Monitor of these details.

F. Requests for Time Off: Requests for time off shall be submitted to the Contract Monitor at least two weeks in advance. The Contract Monitor reserves the right to request a temporary replacement if time off extends longer than one consecutive week. In cases where there is insufficient coverage, a time off request may be denied.

2.5 Substitution of Personnel

2.5.1 Continuous Performance of Key Personnel

When Key Personnel are identified for the Contract, the following apply:

A. Key Personnel shall be available to perform Contract requirements as of the NTP Date. Unless explicitly authorized by the Contract Monitor or specified in the Contract, Key Personnel shall be assigned to the State of Maryland as a dedicated resource.

B. Key Personnel shall perform continuously for the duration of the Contract, or such lesser duration as specified in the Technical Proposal. Key Personnel may not be removed by the Contractor from working under the Contract without the prior written approval of the Contract Monitor.

C. The provisions of this section apply to Key Personnel identified in any Work Order proposal and agreement, if issued, and any Work Order Request and Work Order, if issued.

2.5.2 Definitions

For the purposes of this section, the following definitions apply:

A. Extraordinary Personal Event – means time off under the Family Medical Leave Act; an Incapacitating injury or Incapacitating illness; or other circumstances that in the sole discretion of the State warrant an extended leave of absence, such as extended jury duty or extended military service that precludes the individual from performing his/her job duties under the Contract.

B. Incapacitating – means any health circumstance that substantially impairs the ability of an individual to perform the job duties described for that individual’s position in the RFP or the Contractor’s Technical Proposal.

2.5.3 Contractor Personnel General Substitution Provisions

RFP for Department of General Services Page 15 of 49

The following provisions apply to all of the circumstances of Contractor Personnel substitution described in Section 2.5.4.

A. The Contractor shall demonstrate to the Contract Monitor’s satisfaction that the proposed substitute has qualifications at least equal to those of the Contractor Personnel proposed to be replaced.

B. The Contractor shall provide the Contract Monitor with a substitution request that shall include:

1. A detailed explanation of the reason(s) for the substitution request;

2. The resume of the proposed substitute, signed by the substituting individual and his/her formal supervisor;

3. The official resume of the current personnel for comparison purposes; and

4. Evidence of any required credentials.

C. The Contract Monitor may request additional information concerning the proposed substitution and may interview the proposed substitute personnel prior to deciding whether to approve the substitution request.

D. The Contract Monitor will notify the Contractor in writing of: (i) the acceptance or denial, or (ii) contingent or temporary approval for a specified time limit, of the requested substitution. The Contract Monitor will not unreasonably withhold approval of a proposed Contractor Personnel replacement.

2.5.4 Replacement Circumstances

A. Directed Personnel Replacement

1. The Contract Monitor may direct the Contractor to replace any Contractor

Personnel who, in the sole discretion of the Contract Monitor, are perceived as being unqualified, non-productive, unable to fully perform the job duties, disruptive, or known, or reasonably believed, to have committed a major infraction(s) of law, Department policies, or Contract requirements.

Normally, a directed personnel replacement will occur only after prior notification of problems with requested remediation, as described in paragraph 2.5.4.A.2.

2. If deemed appropriate in the discretion of the Contract Monitor, the Contract Monitor may give written notice of any Contractor Personnel performance issues to the Contractor, describing the problem and delineating the remediation requirement(s). The Contractor shall provide a written response to the remediation requirements in a Remediation Plan within ten (10) days of the date of the notice and shall immediately implement the Remediation Plan upon written acceptance by the Contract Monitor. If the Contract Monitor rejects the Remediation Plan, the Contractor shall revise and resubmit the plan to the Contract Monitor within five (5) days, or in the timeframe set forth by the Contract Monitor in writing.

3. Should performance issues persist despite an approved Remediation Plan, the Contract Monitor may give written notice of the continuing performance issues and either request a new Remediation Plan within a specified time limit or direct the substitution of Contractor Personnel whose performance is at issue with a qualified substitute, including requiring the immediate removal of the Contractor Personnel at issue.

RFP for Department of General Services Page 16 of 49

4. Replacement or substitution of Contractor Personnel under this section shall be in addition to, and not in lieu of, the State’s remedies under the Contract or which otherwise may be available at law or in equity.

5. If the Contract Monitor determines to direct substitution under 2.5.4.A.1, if at all possible, at least fifteen (15) days advance notice shall be given to the Contractor. However, if the Contract Monitor deems it necessary and in the State’s best interests to remove the Contractor Personnel with less than fifteen (15) days’ notice, the Contract Monitor may direct the removal in a timeframe of less than fifteen (15) days, including immediate removal.

6. In circumstances of directed removal, the Contractor shall, in accordance with paragraph 2.5.4.A.1 of this section, provide a suitable replacement for approval within fifteen (15) days of the notification of the need for removal, or the actual removal, whichever occurs first.

B. Key Personnel Replacement To replace any Key Personnel in a circumstance other than as described in 2.5.4.C, including transfers and promotions, the Contractor shall submit a substitution request as described in Section 2.5.3 to the Contract Monitor at least fifteen (15) days prior to the intended date of change. A substitution may not occur unless and until the Contract Monitor approves the substitution in writing.

C. Key Personnel Replacement Due to Sudden Vacancy

1. The Contractor shall replace Key Personnel whenever a sudden vacancy occurs (e.g., Extraordinary Personal Event, death, resignation, termination).

A termination or resignation with thirty (30) days or more advance notice shall be treated as a replacement under Section 2.5.4.B.

2. Under any of the circumstances set forth in this paragraph B, the Contractor shall identify a suitable replacement and provide the same information and items required under Section 2.5.3 within fifteen (15) days of the actual vacancy occurrence or from when the Contractor first knew or should have known that the vacancy would be occurring, whichever is earlier.

D. Key Personnel Replacement Due to an Indeterminate Absence

1. If any Key Personnel has been absent from his/her job for a period of ten

(10) days and it is not known or reasonably anticipated that the individual will be returning to work within the next twenty (20) days to fully resume all job duties, before the 25th day of continuous absence, the Contractor shall identify a suitable replacement and provide the same information and items to the Contract Monitor as required under Section 2.5.3.

2. However, if this person is available to return to work and fully perform all job duties before a replacement has been authorized by the Contract Monitor the Contract Monitor may, at his/her sole discretion, authorize the original personnel to continue to work under the Contract, or authorize the replacement personnel to replace the original personnel, notwithstanding the original personnel’s ability to return.

RFP for Department of General Services Page 17 of 49

2.5.5 Substitution Prior to and Within 30 Days After Contract Execution

Prior to Contract execution or within thirty (30) days after Contract execution, the Offeror may not substitute proposed Key Personnel except under the following circumstances (a) for actual full-time personnel employed directly by the Offeror: the vacancy occurs due to the sudden termination, resignation, or approved leave of absence due to an Extraordinary Personal Event, or the death of such personnel; and (b) for any temporary staff, subcontractors or 1099 contractors:

the vacancy occurs due to an Incapacitating event or the death of such personnel. To qualify for such substitution, the Offeror must demonstrate to the State's satisfaction the event necessitating substitution. Proposed substitutions shall be of equal caliber or higher, in the State's sole discretion. Proposed substitutes deemed by the State to be less qualified than the originally proposed individual may be grounds for pre-award disqualification or post-award termination.

2.6 Supplemental Category of Work Requirements and Responsibilities See the attached Cybersecurity Resources IT Supplemental associated with this solicitation.

2.7 Location of Services Performed

A. State data may not be processed, transferred, or stored outside of the United States (“U.S.”) or

U.S. territories. The Contractor shall provide its services to the State and the State’s end users solely from data centers in the U.S. Unless granted an exception in writing by the State, the Contractor shall not allow Contractor Personnel to store State data on portable devices, including personal computers, except for devices that are used and kept only at its U.S. data centers. Contractor Personnel may access State data remotely only as required to provide technical support and with the prior approval of the State.

B. Contractor Personnel shall not connect any of their own equipment to State IT assets without prior written approval by the State. Any such approval may be revoked, rescinded, or curtailed at any time for any reason. The Contractor shall coordinate requests for approval with the Contract Monitor and is subject to all State approval processes as they may be revised from time to time.

RFP for Department of General Services Page 18 of 49

3 Standard Terms and Conditions

3.1 Contract Initiation Requirements

Once all approvals have been obtained and the Contract is fully executed, the Procurement Officer may schedule a kickoff meeting to be held prior to commencement of Contract performance.

3.2 End of Contract/Work Order Transition

The Contractor shall cooperate in the orderly transition of services at the end of the Contract or Work Order term or upon receipt of a Notice of Termination from the State. Transition shall be provided in a prompt and timely manner and shall proceed in accordance with the schedule provided to the Contractor by the State in the Notice of Transition. Additional instructions regarding transition services may be provided in the event of a Notice of Termination issued by the State.

3.3 Invoicing

Submission of an invoice constitutes the Contractor’s verification that the information in the invoice is accurate as of the time of submission.

An invoice not satisfying the requirements of a Proper Invoice (as defined in COMAR 21.06.09) will not be processed for payment. To be considered a Proper Invoice, invoices must include the following information, without error:

A. Contractor name and address;

B. Remittance address;

C. Federal taxpayer identification (FEIN) number, social security number, as appropriate;

D. Invoice period (i.e. time period during which services covered by invoice were performed);

E. Invoice date;

F. Invoice number;

G. State assigned Contract number;

H. State assigned (Blanket) Purchase Order number(s);

I. Goods or services provided;

J. Amount due; and K. Any additional documentation required by regulation or the Contract.

Invoices that contain both fixed price and labor hour or time and material items shall clearly identify each item as either fixed price, and labor hour, or time and material billing.

The State reserves the right to reduce or withhold Contract payment in the event the Contractor does not provide all required deliverables within the time frame specified in the Contract or otherwise fails to satisfy the terms and conditions of the Contract until such time as the Contractor brings itself into full compliance with the Contract.

The State is generally exempt from federal excise taxes, Maryland sales and use taxes, District of Columbia sales taxes and transportation taxes. The Contractor, however, is not exempt from such sales and use taxes and may be liable for the same.

Invoices for final payment shall be clearly marked as “FINAL” and submitted when all work requirements have been completed and no further charges are to be incurred under the Contract. In no event shall any invoice be submitted later than 60 calendar days from the Contract termination date.

RFP for Department of General Services Page 19 of 49

3.3.1 Invoice Submission Schedule

The Contractor shall submit invoices in accordance with the following schedule:

A. The Contractor shall send the original of each invoice and signed authorization to invoice to the Contract Manager/designee.

B. Invoices for work performed on a labor hour or time and materials basis shall be submitted on or before the 5th business day of the month following the end of the invoice period.

C. Items of work for which there is annual pricing (based on hourly labor rates), (see Attachment B– Financial Proposal Form), shall be billed in equal monthly installments for the applicable Contract year in the month following the performance of the services.

3.3.2 Labor Hour/Time and Materials Invoicing

All labor hour/time and material invoices shall be accompanied by a timesheet signed by the Contract Monitor as described below.

Include for each person covered by the invoice the following, individually listed per person:

name, hours worked, hourly labor rate, invoice amount and a copy of each person’s timesheet for the period signed by the Contract Monitor.

A. Timesheet Reporting

1. Within three (3) Business Days after the 15th and last day of the month, the Contractor shall submit a semi-monthly timesheet for the preceding half month providing data for all Contractor Personnel / employees / resources working under the Contract.

2. At a minimum, each semi-monthly timesheet shall show:

a. Title: “Time Sheet for <<xxxxx>>”;

b. Issuing company name, address, and telephone number;

c. For each Contractor employee /resource:

i. Contractor employee / resource name, and

ii. For each period ending date, e.g., “Period Ending:

mm/dd/yyyy” (Periods run 1st through 15th, and 16th through last day of the month.):

iii. Tasks completed that week and the associated deliverable names and ID#s;

iv. Number of hours worked each day;

v. Total number of hours worked that Period;

vi. Period variance above or below 40 hours;

vii. Annual number of hours planned under the Task Order;

viii. Annual number of hours worked to date; and

ix. Balance of hours remaining;

3. Annual variance to date (Sum of periodic variances); and

4. Signature and date lines for the Contract Monitor.

5. Time sheets shall be submitted to the Contract Monitor prior to invoicing.

The Contract Monitor’s signature on the invoice constitutes authorization to invoice.

3.3.3 Travel Reimbursement

RFP for Department of General Services Page 20 of 49

Travel will not be reimbursed under this RFP.

3.4 Liquidated Damages

3.4.1 MBE Liquidated Damages

MBE liquidated damages are identified in Exhibit 2 – Sample Contract.

3.4.2 Liquidated Damages other than MBE

This section is inapplicable to this RFP.

3.5 Problem Escalation Procedure

No later than ten (10) Business Days after notice of recommended award or after the date of the Notice to Proceed, whichever is earlier, the Contractor must provide, and thereafter, maintain a Problem Escalation Procedure (PEP) for both routine and emergency situations. The PEP must state how the Contractor will address problem situations as they occur during the performance of the Contract, especially problems that are not resolved to the satisfaction of the State within appropriate timeframes and must include:

A. Contact information B. The process for establishing the existence of a problem;

C. Names, titles, and contact information for progressively higher levels of personnel in the

Contractor’s organization who would become involved in resolving a problem;

D. For each individual listed in the Contractor’s PEP, the maximum amount of time a problem will remain unresolved with that individual before the problem escalates to the next contact person listed in the Contractor’s PEP;

E. Expedited escalation procedures and any circumstances that would trigger expediting them;

F. The method of providing feedback on resolution progress, including the frequency of feedback to be provided to the State;

G. Contact information for persons responsible for resolving issues after normal business hours (e.g., evenings, weekends, holidays) and on an emergency basis; and

H. A process for updating and notifying the Contract Monitor of any changes to the PEP.

I. The PEP must be updated within ten (10) Business Days after any change in circumstance which changes the PEP but not less than annually within ten (10) Business Days after the start of each Contract year.

Nothing in this section shall be construed to limit any rights of the Contract Monitor or the State which may be allowed by the Contract or applicable law.

3.6 Work Orders

A. All work being performed under this Contract shall be pursuant to a Work Order process.

Work shall not begin in advance of a fully executed Work Order. Work Orders shall be issued in accordance with pre-approved Labor Categories with the fully loaded rates proposed in Attachment B.

B. Work Order Requests (see Appendix 7 for sample) for the provision of services or resources that are within the scope of this RFP shall be issued on a Right-Of-First-Refusal (ROFR) basis.

RFP for Department of General Services Page 21 of 49

C. Work Order Assignment: The basis for assignments will be as follows:

1. The Department will initially issue a Work Order request to the highest overall ranked Contractor with a written scope of objectives inclusive of the known technical requirements and description of the service or resources needed, including all applicable timeframes and schedules, performance objectives and/or deliverables within timeframes and schedules, as applicable.

2. The overall top ranked Contractor shall have five (5) business days to acknowledge that it will submit a response to the Work Order request and, after such acknowledgement, must submit a response within the timeframe set forth in the Work Order request, generally, seven (7) to fourteen (14) calendar days unless special circumstances require a longer timeline, at the sole discretion of the State Contract Manager.

3. If the overall top ranked Contractor refuses a Work Order request or fails to timely submit an acknowledgement, response, or acceptable candidate, the State reserves the right to issue the Work Order to the next ranked Contractor. Acceptability of an offered resource or service is at the State’s sole discretion.

4. If the overall top ranked Contractor is only able to partly fulfill the State’s request for resources, the portion of the unfulfilled request becomes a new Work Order request; and the new request may be sent to the next ranked Contractor, at the Contract Manager’s discretion.

5. The overall lowest ranked Contractor in a given Functional Area does not possess a right of refusal and may not decline a Work Order request. If, at the State’s discretion, no Contractors in a Functional Area are able to provide acceptable resources or services satisfying the State’s requirements, the Work Order may be cancelled or modified at the Contract Manager’s discretion.

D. Work Order Requests: A Work Order Request for resources or teams will include the following:

1. A written scope of work inclusive of the technical requirements and description of the services or resources needed;

2. All applicable timeframes and schedules;

3. Performance objectives and/or deliverables within timeframes and schedules, as applicable;

4. Due date and time for submitting a response to the request; and

5. Required place(s) where work must be performed.

E. Contractor’s Work Order Response: The Contractor shall e-mail a response to the Contract

Manager/Designee by the specified due date and time, including at a minimum:

1. A response that details the Contractor’s understanding of the work;

RFP for Department of General Services Page 22 of 49

2. A price to complete the Work Order Request (in the case of a Work Order request for resources, pricing may not exceed the price proposed for the labor category in Attachment B);

3. An explanation of how tasks will be completed. This description shall include proposed subcontractors and related tasks;

4. Contractor’s expectations for State-furnished information, work site, and/or access to equipment, facilities, or personnel; and

5. The proposed personnel resources and resumes for each, including any subcontractor personnel, to complete the task, with labor categories listed in accordance with Attachment B.

6. If the Contractor is unsure of what the using agency (stakeholder) is requesting, the Contractor before submitting the request, may meet with the Contract Manager to obtain clarity and tell them what service alternatives exist, or get them to tailor expectations within scope of the RFP.

F. Work Order Review:

Proposed resources or services on any Work Order are subject to the requesting agency’s approval. The requesting agency may choose to interview proposed personnel. Regardless of whether an interview is conducted, the Contractor will be provided formal notice of acceptance or denial. In the event the requesting agency, in its sole discretion, finds the Work Order response to be unacceptable, then the Work Order request may be sent to the next overall ranked Contractor in that Functional Area The requesting agency may request a Best and Final Offer from the Contractor.

Regardless, if the requesting agency, in its sole discretion, does not agree to the contractor's proposed price then the Work Order request may be sent to the next overall ranked Contractor in that Functional Area.

Notice to Proceed: The execution of all signatures on the Work Order is the notice to proceed with the performance of services under a Work Order. The fully executed Work Order shall be inclusive of the scope of work, commencement and completion dates, milestones, deliverables, and price.

The Blanket Purchase Order (BPO) issued as a result of this solicitation, and any subsequent amendments, modifications or options issued relevant to this solicitation or BPO, complies with all the terms, conditions and specifications issued with this solicitation and is incorporated in and made part of the Contract – see Exhibit 2 - Sample Contract.

3.7 Payments by Electronic Funds Transfer

By submitting a Proposal in response to this solicitation, the Offeror, if selected for award:

Agrees to accept payments by electronic funds transfer (EFT) unless the State Comptroller’s Office grants an exemption. Payment by EFT is mandatory for contracts exceeding $200,000. The successful Offeror shall register using the COT/GAD X-10 Vendor Electronic Funds (EFT) Registration Request Form.

Any request for exemption must be submitted to the State Comptroller’s Office for approval at the address specified on the COT/GAD X-10 form, must include the business identification information as stated on the form, and must include the reason for the exemption. The COT/GAD X-10 form

RFP for Department of General Services Page 23 of 49 may be downloaded from the Comptroller’s website at:

http://comptroller.marylandtaxes.com/Vendor_Services/Accounting_Information/Static_Files/GAD X10Form20150615.pdf.

3.8 Prompt Payment Policy

This procurement and the Contract(s) to be awarded pursuant to this solicitation are subject to the Prompt Payment Policy Directive issued by the Governor’s Office of Small, Minority & Women Business Affairs (GOSBA) and dated August 1, 2008. Promulgated pursuant to Md. Code Ann., State Finance and Procurement Article, §§ 11-201, 13-205(a), and Title 14, Subtitle 3, and COMAR

21.01.01.03 and 21.11.03.01, the Directive seeks to ensure the prompt payment of all subcontractors on non-construction procurement contracts. The Contractor shall comply with the prompt payment requirements outlined in the Contract, Section 30 “Prompt Pay Requirements” (see Exhibit 2 - Sample Contract). Additional information is available on GOSBA’s website at:

http://www.gomdsmallbiz.maryland.gov/documents/legislation/promptpaymentfaqs.pdf.

3.9 Federal Funding Acknowledgement

There may be programmatic conditions that apply to the Contract due to federal funding (see Attachment H). These will be identified in each Work Order Request.

3.10 Conflict of Interest

A Contractor has an ongoing obligation to ensure that it and all Contractor Personnel are without conflicts of interest on individual work orders issued under the Contract. For policies and procedures applying specifically to Conflict of Interests, the Contract is governed by COMAR 21.05.08.08.

Participation in Drafting of Specifications: Disqualifying Event: Offerors are advised that Md. Code Ann. State Finance and Procurement Article §13-212.1(a) provides generally that “an individual who assists an executive unit in the drafting of specifications, an invitation for bids, a request for proposals for a procurement, or the selection or award made in response to an invitation for bids or a request for proposals, or a person that employs the individual, may not: (1) submit a bid or proposal for that procurement; or (2) assist or represent another person, directly or indirectly, who is submitting a bid or proposal for that procurement.” Any Offeror submitting a Bid in violation of this provision shall be classified as “not responsible.”

3.11 Non-Disclosure Agreement

3.11.1 Non-Disclosure Agreement (Bidder/Offeror)

A Non-Disclosure Agreement (Bidder/Offeror) is not required for this procurement.

3.11.2 Non-Disclosure Agreement (Contractor)

This solicitation and any Contract(s) are subject to the terms of the Non-Disclosure Agreement (NDA) contained in this solicitation as Attachment S.