IT Security Services, SON # GTA 98000-5619 – Department of Community Supervision Security Assessment

This document is protected from disclosure by OCGA § 50-18-72(a) (25) (A) (i) (2012)

Statement of Need 98000-00000-5619 Request for Qualified Contractor: 98000-00000-3088

Department of Community Supervision Security Assessment

Submit Proposal to:

Georgia Technology Authority (GTA) Procurement Management Office Via Procurement@gta.ga.gov

See section 4.0 for submission details.

Refer ALL Inquiries to:

GTA Issuing Officer, Towanda Cuthbert at Procurement@gta.ga.gov

The schedule of events set out herein represents the Georgia Technology Authority’s best estimate of the schedule that will be followed. However, delays to the procurement process may occur which may necessitate adjustments to the proposed schedule. If a component of this schedule is adjusted, the rest of the schedule may be shifted as appropriate. Any changes to the dates up to the closing date of the Statement of Need (herein after called “SON”) will be publicly posted prior to the closing date of this SON. After the close of this SON, GTA reserves the right to adjust the remainder of the proposed dates on an as needed basis with or without notice.

SON Schedule of Events

Event DATE

Release of SON January 25, 2022

Final Day to submit Questions to GTA February 3, 2022, 2:00 PM EST

Answers Distributed to Qualified Contractors February 10, 2022, 2:00 PM EST

SON Response Due to GTA February 18, 2022, 2:00 PM EST

Anticipated Award Date Approximately March 18, 2022 mailto:Procurement@gta.ga.gov

IT Security Services, SON # GTA 98000-5619 – Department of Community Supervision Assessment

This document is protected from disclosure by OCGA § 50-18-72(a) (25) (A) (i) (2012) Page 2 of 17

1.0 Purpose of Procurement

This Statement of Need (SON) is an Informal bid solicitation availed only to those awarded suppliers through the Request for Qualified Contractors (RFQC) 9800- 000000-3088. Contractors were obtained in accordance with procurement processes and polices as published in the GTA Procurement Manual . GTA publicly posted the solicitation (RFQC 9800-0000003088) to the Georgia Procurement Registry (GPR). GTA received questions, posted answers, received responses per the deadline indicated, and evaluated the responses per the criteria. A set of Qualified Contractors, that were determined to be within identified scoring range, entered successful contract negotiations, and were awarded GTA Master Agreements. This approach addresses the criteria outlined below.

The purpose of this Statement of Need is to identify and award a qualified contractor to perform assessments that will examine the status, strength, preparedness, effectiveness and maturity of the Department of Community Supervision’s on-going cybersecurity incident response efforts and their current IT security control implementations

1.1 Project Background

The Department of Community Supervision (DCS) was founded on the Tenets of Public Safety and Progress and is responsible for the effective and efficient supervision of approximately 180,000 adult felony offenders and Class A and Class B designated juvenile offenders. DCS also provides offenders the opportunity to make positive changes while in the community by providing individual support, programs, and assistance. As an integral part of the criminal justice system, DCS strives to protect and serve all Georgia citizens through effective and efficient offender supervision in our communities, while providing opportunities for successful outcomes.

Impact Rating – Moderate

Description

• Approx. 1845 users

• 65 Locations

• Google cloud enterprise – G Suite and AWS

1.2 Project Duration

Six to eight weeks post-award

This document is protected from disclosure by OCGA § 50-18-72(a) (25) (A) (i) (2012) Page 3 of 17

1.3 Scope of Services

• An assessment of the IT Security program and controls currently implemented in cloud and on-premises environments.

• An assessment of selected application systems:

1.4 Deliverables

System Description DCS Portal The Georgia Reentry Portal is a browser-based infrastructure conceived, developed, supported, and maintained by the Georgia Department of Community Supervision. It is a secure multi- agency Web Based Application that provides unique functionality related to the supervision and management of individuals on Probation or Parole.

• The assessment activities shall be conducted against the latest version of the Center for Internet Security (CIS), top 20 Controls, NIST SP 800-53*, industry best-practices and applicable laws, executive orders, directives, policies, and regulations.

• The engagement will constitute appropriate meetings, interviews, technical testing, validate processes, review artifacts/documents per CIS practices and guidelines so to provide status and assessment reporting.

2.0 Requirements

2.1 Mandatory Requirements

Qualified Contractors must comply with all mandatory requirements to remain in consideration for this Statement of Need. Contractors will receive a PASS/FAIL score for each mandatory requirement. A contractor who receives a score of “FAIL” for any requirement, will not receive further consideration.

Requirement

Number Requirement

2.1.1 Offeror must agree that if selected to perform the engagement, Offeror will accept, sign and return Attachment F: Non- Disclosure/Confidentiality of Sensitive Information Agreement, as is, prior to issuance of Purchase Order (PO).

This document is protected from disclosure by OCGA § 50-18-72(a) (25) (A) (i) (2012) Page 4 of 17

Requirement Number

Requirement

2.1.2 Offeror must agree that if selected to perform the engagement and if Offeror resources are to be subjected to background checks, each of Offeror’s engagement assigned resources shall be required, at time of engagement, to complete the Georgia Bureau of Investigations (GBI) personnel screening requirements in Policy Area 12.5.1.2. of the latest version of the CJIS Security Policy at Offeror’s expense. These requirements are listed below:

1. Fingerprint-based background check at a Georgia Applicant Processing Service (GAPS) location or utilizing approved electronic fingerprint submission services for State of Georgia applicants

2. Successful completion of GBI’s online Security Awareness training (approximately 1 hour)

3. Signed Security Awareness Statement

4. Signed FBI Security Addendum

Said personnel screening checks shall be valid for 1 year. In addition to the basic Mandatory Background Check requirements listed here, Offeror must agree to comply with any further background check rules specified at the agency engagement level.

2.1.3 Offeror must agree that ALL data accessed and/or derived from any engagement activity shall have access restricted exclusively to either “U.S. Citizens” or “Lawful U.S. Permanent Residents.” (No access rights, no physical access, no viewing, no copying, no storage, or no manipulation, etc. by personnel not receiving prior approval from GTA and/or DCS)

2.1.4 Offeror must agree that in the performance of the engagement, or at any time thereafter, Offeror will not store, transmit to or through, archive or maintain any ITSS engagement data, on any Offeror resources, to any location outside of the legal jurisdiction of the United States.

2.1.5 Offeror must agree that while in the performance of the engagement, or while under an active Purchase Order, or while any past or present ITSS engagement data is in Offeror possession, in the event of an Offeror data breach, (as defined by NIST), involving any unauthorized disclosure of any ITSS engagement data Offeror holds, Offeror shall comply with reporting to GTA within the timeframe defined under OCGA 38-3-22 (2 hours).

2.1.6 Offeror must agree that in the performance of the engagement, or at any time thereafter, any data derived from the engagement shall have appropriate data security protection measures implemented for the protection of said data. For the engagement, data either stored, transmitted, archived, manipulated, or maintained, etc., by “Offeror” shall have at a minimum of “Moderate” (as defined by NIST) data protection controls and measures implemented for such protections.

https://gbi.georgia.gov/personnel-security-requirements https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center https://ia800704.us.archive.org/22/items/gov.ga.ocga.2018/release77.2020.08.10/gov.ga.ocga.title.38.html

This document is protected from disclosure by OCGA § 50-18-72(a) (25) (A) (i) (2012) Page 5 of 17

2.2 Mandatory Scored Requirements

Qualified Contractors are required to submit responses all technical questions detailed in this section. Formatting and detail are left at the offeror’s discretion.

Responses will be evaluated and scored based on following the scoring criteria:

Requirement Number

Requirement

Offeror shall also agree to provide demonstration of said protections upon demand, in the form of system security plans or recent (within 1 year) system security assessments of said protection measures.

Offeror shall note that the response for the secure data storage/secure engagement file storage/document repository tool will additionally be scored in the “Mandatory - Scored Requirements” section.

2.1.7 Offeror must agree that if selected to perform the engagement of an agency with access to, use of, or have disclosure to any federal tax information (FTI), as defined by Internal Revenue Service code, Offeror will accept, sign, and return the IRS Publication 1075 Acknowledgment (Attachment G).

2.1.8 Offeror must agree, upon completion of the engagement, or upon GTA’s or DJJ’s request, and within the time period specified by GTA, any data identified by GTA (whether GTA-owned or agency-owned) must be either transferred to GTA or destroyed. Further, Offeror must agree to complete a data destruction or transfer certificate affirming Offeror’s transfer or destruction of data (Attachment H).

2.1.9 Offeror must agree that if selected to perform engagement of an agency with HIPAA data requirements, Offeror will accept, sign, and return Attachment I - HIPAA BAA (Business Associate Agreement) as-is, prior to issuance of PO.

2.1.10 Offeror must affirm they have successfully completed at least one (1) engagement of a CIS 20 Critical Controls assessment, within the past 48 months. Offeror will provide verifiable Name and contact phone number of contacts at each entity cited as references to this requirement. A Maximum of 5 engagements will be accepted. GTA reserves the right to verify at GTA discretion.

Entity 1: XXXXXXXXXX Contact Name: XXXXXXXXXXXX Contact Number: XXX.XXX.XXXX

2.1.11 Offeror must agree that if selected to perform the engagement, offeror will begin on-site engagement activities within a week of receiving a purchase order.

This document is protected from disclosure by OCGA § 50-18-72(a) (25) (A) (i) (2012) Page 6 of 17

DO NOT INCLUDE ANY COST INFORMATION IN YOUR RESPONSE TO THESE

QUESTIONS

2.2.1 Mandatory Scored #1

A Statement of Work (SOW) Narrative, containing a high-level engagement Security Assessment Plan (SAP), must be provided as part of the bid response. Offeror will provide a SOW Narrative, in the Offeror’s own words, detailing the Offeror’s understanding of the project objectives, of GTA’s project expectations, deliverables to be provided, and the approach and methodologies that the Offeror will implement to address the required work activities.

The SOW Narrative shall include, preferably at the end, a high-level Security Assessment Plan (SAP)s, for each agency assessment.

Task Description:

It is GTA’s intent to receive the SAP plan(s) which contain tasking alignment with the submitted Resumes/Titles/staff description thus presenting a cohesive road map/picture. GTA will evaluate said plans on their clarity of demonstrating how the WBS tasks will be performed, and by employing whom/resource types to do so and the expected scheduling/timeline to complete each necessary activity.

The SOW Narrative and each SAP will be evaluated upon how they identify and document:

1. The detailed listing of work activities, scheduling details, staffing assignments, milestones, deliverables, and artifacts necessary for a comprehensive and successful evaluation engagement execution.

2. The anticipated timelines to complete each work activity item and each agency engagement.

This document is protected from disclosure by OCGA § 50-18-72(a) (25) (A) (i) (2012) Page 7 of 17

That appropriate staffing resources are to be assigned to complete individual work activity items and the overall engagement. Staffing assignments in each SAP are to match the staff resource resumes or skill set types that are identified within the Resumes for Planned Engagement Staffing Resources response (*MS-2).

3. 3. Clearly identify all software tool(s) that will be used to complete any work activity that will require performing analysis, technical testing, data capture or any technical assessment functionalities in the SAP.

Response Limited to 10 pages

2.2.2 Mandatory Scored #2

Resumes must demonstrate the proposed staff has sufficient experience and appropriate skill sets to successfully complete engagement activities, per the SON conditions.

The Offeror is to produce in their bid proposal, the resumes for the planned engagement staffing resources. The Engagement Staffing Resources Resumes will be evaluated upon:

(Staffing assignments are also to be documented, for evaluation, in the SAP (as stated in *MS-1). Each staff resume listed will show their proposed activity assignments on each SAP. If a staff resource proposed in the Offeror bid response is not available for engagement assignment, GTA reserves the right to have Offeror provide an equivalent or higher qualified staff resource replacement for the engagement. Resumes for any replacement must be submitted and approved by either GTA or DCS prior to any work commences.

Response Limited to 2 pages per staff resume

2.2.3 Mandatory Scored #3

The Offeror is to produce in their bid proposal, samples of one each of the following:

• Risk Assessment Report (RAR)

• Security Assessment Report with embedded Gap Analysis (SAR & GAP)

• Remediation Plan of Action with Milestones (POAM) cross-referenced to SAR and

This document is protected from disclosure by OCGA § 50-18-72(a) (25) (A) (i) (2012) Page 8 of 17

• Agency Exit Reporting - Executive Summary Report containing summary data with graphical representations and detail control findings for in compliance and GAP results.

The sample reports will be evaluated upon:

1. Comprehensiveness and clarity.

2. Demonstration that artifacts are aligned with NIST for reporting content and detail.

3. Demonstration that technical testing and analysis was performed against applicable technical controls.

4. Ability to be easily leverage report artifacts into working documents.

GTA requires that report samples provided for evaluation be actual artifacts (redacted) submitted by Offeror from a previous engagement that was performed within the last 48 months. These samples are to correspond to the jobs referenced and cited in “MAN-4”. Template samples found on internet are not acceptable.

GTA requires that the Security Assessment Report (SAR) and Gap Analysis (GAP) is to be a combined single report containing all appropriate data elements from each discipline.

GTA understands and respects the confidentiality rights of others. Offeror shall redact all identifiable company specific information, for any of the sample reports within this requirement.

GTA expects that the sample reports will contain sufficient detail to demonstrate comprehensive reporting. A simple “Table of Contents” will be viewed as not satisfactory.

Response Limited to 10 pages per each report sample

2.2.4 Mandatory Scored #4

The Offeror is to produce in their bid proposal:

• A listing of ALL the software tools planned to be used to perform the engagement. A service and utilization description for each tool must identify what the tool does and where that tool will be utilized to perform the assessment. The service and utilization description for other tool(s) should only be detailed enough to clearly describe planned use within the engagement.

This document is protected from disclosure by OCGA § 50-18-72(a) (25) (A) (i) (2012) Page 9 of 17

• A descriptive information response of the workflow messaging, file management, file storage, file transfer tool/platform to be utilized for the engagement. The response will describe capabilities of workflow messaging, where data is stored, how it is securely accessed, how it is secured in-transit and at rest, and the data classification capability of tool/platform (as described within FIPS 199). This description response will be considered part of the “Engagement Tool” scoring.

GTA expects the offeror’s response contain the following:

1. A listing of all engagement tool(s) that will be applied to work activities, so to demonstrate the capability to complete the assessment comprehensively and successfully.

2. A service and utilization description for each tool(s) listed. Service and utilization description are to include:

A. A general service description of the tool describing the tool capabilities and use.

B. A utilization description identifying the engagement work area(s) (technical assessment, compliance assessment, port scanning, code testing, data capture, compliance analysis and review, project management, document storage, etc.) where the tool is to be applied. (Example: Tool - Nessus: Is a remote security scanning tool which scans a computer to discover any vulnerability. Nessus will be used for testing of technical controls to identify items such as server configuration errors, patch level inconsistencies, general vulnerabilities, and open ports, etc.)

3. A descriptive information response of the workflow messaging, file management, storage, transfer tool/platform to be utilized for the engagement. The response will describe where data is stored, how it is securely accessed, how it is secured in-transit and at rest, and the data classification capability level of the tool/platform (as described within FIPS 199). This description response will be considered part of the “Engagement Tool” scoring.

For GTA to appropriately evaluate the *MS-4 bid response, the Contractor needs to address ALL the stated response areas. Failure to provide a full listing of ALL proposed engagement tools, a clear general service description for EACH TOOL and a clear identification of the work area(s) where EACH TOOL will be used will negatively impact the scoring for the “MS-4” requirement.

This document is protected from disclosure by OCGA § 50-18-72(a) (25) (A) (i) (2012) Page 10 of 17

GTA understands and respects the privacy rights of others. Should Contractor deem it appropriate to utilize a proprietary tool or tool sets, it is permissible to do so, but the service and utilization description for said tool or tool sets must be provided so to evaluate the capabilities and applicability of said tool(s) per the engagement needs. Failure to provide said descriptions, will negatively impact the scoring for the “MS-4” requirement.

Response Limited to 10 pages

2.3 Price Proposal Requirement

Offeror must submit cost bid for all services and products related to this response.

Offeror response is required to be completed on ATTACHMENT C: Qualified Contractor’s Price Response Worksheet per the instructions provided. The mixing of pricing information with any of the requirement’s responses will result in proposal disqualification.

2.4 Questions Concerning Proposal

The Offeror must direct all written questions concerning the preparation or clarification of intent of this proposal to the GTA Issuing Officer contact as specified in the “Instructions to Offeror” of this Statement of Need and no later than the date and time specified in the Schedule of Events on the cover page.

All questions concerning this SON must be submitted via Procurement@gta.ga.gov . No questions outside of Procurement@gta.ga.gov will be accepted. No response other than written will be binding upon the State.

3.0 Evaluation

Offeror must affirm “yes” for all Mandatory Requirements for this SON, or the offer will be rejected. Those Offerors that successfully affirm compliance with all Mandatory Requirements will then have their Mandatory - Scored Requirements evaluated using the Offeror’s submission to the SON. All Proposals shall be evaluated in accordance with the criteria set forth in this SON by an Evaluation Committee appointed by the GTA.

Weighing Metrics Area Weighting Mandatory Scored #1 200 Mandatory Scored #2 150 Mandatory Scored #3 200 mailto:Procurement@gta.ga.gov

This document is protected from disclosure by OCGA § 50-18-72(a) (25) (A) (i) (2012) Page 11 of 17

Mandatory Scored #4 150 Price Proposal 300 Total 1000

3.1 Methodology

3.1.1 Administrative/Preliminary Review: First, the proposals will be reviewed by the Issuing Officer to determine the proposal’s compliance with the following requirements:

1. Proposal was submitted by deadline in accordance with Section 2

2. Proposal is complete and contains all required documents

3. Technical Proposal does not include any pricing from the Cost Proposal

3.1.2 The Mandatory-Scored Requirements will be evaluated by the GTA Evaluation Committee using the Offeror submitted responses.

3.1.3 Review of Mandatory and Mandatory Scored Questions - The Evaluation Team will review each proposal in detail to determine its compliance with mandatory requirements. Responses to both “Mandatory” and “Mandatory Scored” Questions will be evaluated on a pass/fail basis. If a proposal fails to meet a mandatory and/or mandatory scored requirement, GTA will determine if the deviation is material. A material deviation will be cause for rejection of the proposal. An immaterial deviation will be processed as if no deviation had occurred. All proposals which meet the requirements of the “Mandatory” and “Mandatory Scored” Questions are considered “Responsive Proposals” at this point in time and will be scored in accordance with the point allocation in Section 3.0 – Weighing Matrix

3.1.4 The scoring value will be between 1 and 4 for each deliverable, which will then be totaled and converted per the weighted percentages in the table provided in Section 3.0. The review criteria by the GTA evaluation committee for Offeror bid submission will be based upon the conditions stated within this SON.

The GTA evaluation team will utilize Consensus Scoring to determine which Qualified Contractor’s response best meets the needs and requirements associated with this SON. Scores will be determined based on the degree to which the Qualified Contractor’s experience and skill coincide with the demands of this effort, as described in the proposal, and demonstrated a high-quality approach throughout the Statement of Need that is likely to produce the best solution with the ability to timely complete the deliverables required with the proposed team.

3.2 Cost Evaluation

This document is protected from disclosure by OCGA § 50-18-72(a) (25) (A) (i) (2012) Page 12 of 17

Each Qualified Contractors is required to submit a cost proposal as part of its response. Only those Qualified Contractors that are responsive and responsible will then be evaluated on price.

The responsive and responsible Qualified Contractor(s) with the lowest price will receive the maximum number of points allocated for the price component per Agency.

All other responsible Qualified Contractors price proposals deemed to be responsive and responsible will receive a prorated score calculated using the following formula:

L/R x M x W= Z

Where:

L = Price of the Proposal with the lowest cost R = Price of the Proposal being ranked M = Maximum number of points W = Weight of pricing component Z = Assigned points

3.3 Rejection of Proposals

GTA reserves the right to reject any Proposal if:

A. A Proposal fails to address and satisfy all Mandatory and Mandatory-Project Management Requirements stated in this SON.

B. A Proposal does not conform to the required proposal response methodology and format discussed in this SON.

C. The Qualified Contractor does not adhere to the Restrictions on Communications with Staff provision (Section 6.1).

GTA reserves the right to waive minor irregularities in the Proposal. Minor irregularities are defined as those that have no adverse effect on GTA’s interest.

4.0 Submission

GTA recognizes the amount of effort necessary to prepare a response to this SON and allows the offeror to determine the exact level of detail necessary to display their prior experience and capabilities to perform up to GTA expectations.

GTA anticipates that each Offeror ’s proposal will be prepared simply and economically, providing straightforward, concise delineation of their capabilities to satisfy the requirements of this SON. Emphasis on each proposal must be on completeness and clarity of content. Further, GTA will only accept proposals and other information by email noted on the cover page of this solicitation. All other material received will be discarded without review.

This document is protected from disclosure by OCGA § 50-18-72(a) (25) (A) (i) (2012) Page 13 of 17

4.1 Preparation of Submission of Requirements

The submission for this SON must be to Procurement@gta.ga.gov .

4.1.1 Administrative Package Proposal

GTA’s expectation is to receive in this “Package,” the set of completed administrative documents as follows:

o Contact Information Worksheet (Attachment A) o Statement of Responsibility Certification (Attachment A) o SOW Proposal Certification (Attachment A) o Mandatory Requirement Worksheet (Attachment D)

Modifications by the Offeror are not allowed and will result in immediate disqualification from further review.

4.1.2 Technical Package Proposal

The Offeror’s is expected to submit this “Package,” in the described format that properly addresses the requirements set forth in Section 2.2.

4.1.3 Cost Package Proposal

The Offeror is expected to submit their completed Qualified Contract’s Price Response Worksheet (ATTACHMENT C) which includes all pricing for all proposed services.

5.0 Award

5.1 Apparent Successful Contractor(s)

The resulting total Cost Proposal score will be added to the total Technical Proposal score to identify the apparent successful contractor(s). The assignment to an identified agency will be determined at GTA’s sole discretion.

5.2 Purchase Order Issuance

After all proposals have been evaluated by GTA, GTA will issue a Purchase Order (PO) to the Qualified Contractor(s) to which the engagement is then awarded.

No engagement activities may begin until GTA issuance of a Purchase Order is complete.

mailto:Procurement@gta.ga.gov

This document is protected from disclosure by OCGA § 50-18-72(a) (25) (A) (i) (2012) Page 14 of 17

5.3 Authorization of Payment

GTA will authorize Contractor payment(s) only after GTA acknowledges acceptance of all deliverables, in the approved deliverable formats (Section 6. Item: L), and then by signing and returning an ATTACHMENT E: Sample Deliverables Completion Form (that does not have “Sample” as a watermark) for each and all deliverable (s).

Contractor then submits their invoice to GTA for payment. Contractor submission of invoice will clearly indicate the amount due, and the services and deliverables being invoiced as indicated in the Cost proposal.

Note: The total amount of submitted invoices shall not exceed the GTA accepted Offeror(s) total proposal amount.

6.0 Additional Terms and Conditions

Offerors should familiarize themselves with the procedures set forth in the GTA Procurement Policies and Procedures Manual. The informal bid process (“SON”) is solicited informally to the selected qualified contractors and is exempt from formal protest pursuant to Section 8.6.1

- Protest Procedures, Subsection 1.2. In the event of a protest, the resolution of such protest will be resolved by the GTA Procurement Director whose findings will be final.

6.1 Restrictions on Communications with Staff

From the issue date of this SON until the final award is announced (or the SON is officially cancelled), Offerors are not allowed to communicate for any reason with any State staff except through the Issuing Officer named herein, or during the Bidders/Offerors’ conference (if any), or as defined in this SON or as provided by existing work agreement(s). Prohibited communication includes all contact or interaction, including but not limited to telephonic communications, emails, texts, letters, or personal meetings, such as lunch, entertainment, or otherwise. GTA reserves the right to reject the response of any supplier violating this provision.

6.2 Qualified Contractor’s Responsibilities

6.2.1 Qualified Contractor:

o Provides its employee(s) and/or consultant(s) with computing equipment and/or any necessary software licenses, and tools needed to complete the work.

o Responsible for all costs associated with Qualified Contractor’s supplied equipment. If the Qualified Contractor brings computer equipment and/or peripherals to the State offices, the Qualified Contractor will be responsible for the equipment and all associated items and supplies.

o All expenses, including for travel and long-distance phone calls, must be included in the price of the Proposal that is submitted. No additional charges will apply. All charges must follow State policy.

This document is protected from disclosure by OCGA § 50-18-72(a) (25) (A) (i) (2012) Page 15 of 17

6.2.2 Qualified Contractor’s Project Manager:

o Maintain project communication through the GTA Project Manager and Entity site contact as necessary.

o Create a project plan - obtain approval of the GTA Project Manager for document prior to beginning work on the project.

o Keep the project plan updated throughout the project.

o Work with GTA Project Manager to resolve deviations from the agreed upon work plan.

o Coordinate and manage the activities of project team members.

o Submit project deliverables to the GTA Project Manager for GTA review, approval, and signature as per agreed schedule within Project Plan.

o Secure and protect state-furnished property and/or materials provided about this SON.

o Attend project review and update meetings as requested by the GTA Project

Manager.

o Complete and submit project status reports.

o Complete and submit timesheets for all project team members allocated to this contract.

6.2.3 Qualified Contractor’s Staff:

o Maintain project communication through the Qualified Contractor’s Project Manager.

o Follow all established GTA personnel policies.

o Submit project deliverables to the Qualified Contractor’s Project Manager for

GTA’s review, approval, and signature.

o Secure and protect state-furnished property and/or materials provided about this SON.

o Attend project review and update meetings as requested by the Qualified

Contractor’s Project Manager and/or GTA Project Manager.

6.3 SON Key Assumptions

A. Some of the work may be performed at the Offeror location, the GTA designated facility or the Agency site.

B. GTA will not provide the Offeror with software / hardware required to complete the work of this SON except for conference room facilities and network connectivity.

C. Offeror personnel will follow all established GTA personnel and Enterprise Security policies, including the dress code.

D. Offeror will provide the project staff, identified in its Proposal and confirm that this staff will be available from the issuance of the purchase order to the completion of the work stated in this SON.

E. All personnel selected and assigned by Offeror shall have the required skills, ability, willingness and experience (collectively “requisite qualifications”) to perform the services of this Statement of Need. It is GTA’s expectation that the personnel assigned to perform the engagement will be the resources identified in the Offerors bid proposal. If, at any time, based upon GTA

This document is protected from disclosure by OCGA § 50-18-72(a) (25) (A) (i) (2012) Page 16 of 17 evaluation of the Offeror progress and performance, the GTA determines that any of the Offeror assigned personnel are unacceptable to GTA, the GTA may request, and the Offeror shall, replace such personnel. If Offeror is unwilling or unable to replace such personnel with suitable replacements, the GTA may terminate the purchase order without further obligation as of the date of such termination.

F. All proposed deliverables will be reviewed by GTA. All deliverables to be approved by GTA for them to be considered complete and accepted. In all cases, the payment to the service provider shall be contingent upon GTA approval of all project deliverables. No review will be considered complete until the approved documentation is delivered to and accepted by GTA. GTA will utilize the “Deliverables Completion Form (ATTACHMENT E: SAMPLE Deliverables Completion Form) for this purpose. This document will be agreed upon by GTA and Offeror at Purchase Order issuance and updated throughout the project as required to reflect all contracted deliverables.

G. GTA will review engagement deliverables received from Offeror and will make final rejection or approval decision within 10 business days of receipt.

H. The GTA must approve, in writing, any changes to milestones, deliverables or other material changes to the SOW/PO prior to implementation of changes.

The Project Management Plan must be updated by Offeror to reflect any accepted changes and re- distributed by Offeror to GTA.

I. GTA reserves the right to modify proposal requirements should Offeror Proposal identify a change that is in the best interest of GTA. Any changes to the proposed deliverables must be in writing.

J. The proposal should be submitted on the most favorable terms that the Contractor can provide.

K. All responses, documents, and material pertaining to this SON shall become and remain in perpetuity, the property of the GTA and are to be kept confidential to protect the interests of the public. The Offeror is hereby warned that no part of its Proposal or any other material submitted might be marked as confidential, proprietary, or as trade secrets and GTA shall exercise sole authority over the use and distribution of said materials.

L. All documentation for this proposal is to be provided as per the submittal instructions. All documents are to use the following software standards (or higher convertible versions):

M. GTA is not liable for any costs incurred by the Qualified Contractor in the preparation, delivery, or presentation of submissions to this SON.

N. Payment is to occur after engagement is fully completed, Qualified Contractor has submitted a completed ATTACHMENT E: SAMPLE Deliverables

DOCUMENT TYPE FORMAT

Word Processing Microsoft Word 2016 Spreadsheets Microsoft Excel 2016 Graphics Microsoft PowerPoint 2016 Project Management Microsoft Project 2016 Scanned Documents Adobe 5.0 or greater

This document is protected from disclosure by OCGA § 50-18-72(a) (25) (A) (i) (2012) Page 17 of 17

Completion Form for all contracted deliverable items and GTA has accepted all contracted deliverable items. At that point GTA OIS will authorize release of funding for full and final payment.

O. GTA reserves the right to seek clarification of Qualified Contractor’s SOW responses.

GTA reserves the right to expand and/or shrink the submitted engagement timeframe to comply with State, Federal or other recognized requirements.