DMS-2223-154.Network-Based-Asset-Disc-Sol.pdf

2555 Shumard Oak Blvd. • Tallahassee, FL 32399 • digital.fl.gov Pedro Allende, Secretary

Florida Department of Management Services

Ron DeSantis, Florida Governor

James Grant, Florida State Chief Information Officer

Request for Quotes (RFQ)

DMS-22/23-154

Network-Based Asset Discovery (Agentless) Solution

Alternate Contract Sources:

Cloud Solutions (43230000-NASPO-16-ACS)

Software Value Added Reseller (SVAR) (43230000-23-NASPO-ACS)

Technology Products, Services, Solutions, and Related Products and Services (43210000-US-16-ACS)

1.0 DEFINITIONS

The following definitions shall apply throughout this RFQ:

Agency Term Contract (ATC): The written agreement resulting from the award of this Request for Quotes between the Department and the Contractor(s).

Contractor: The vendor awarded an ATC resulting for this Request for Quotes.

Customer: Agencies as defined in section 287.012, Florida Statute (F.S.), and Eligible Users as defined in Rule 60A-1.001, Florida Administrative Code (F.A.C.).

Department: The State of Florida, Department of Management Services (DMS), on behalf of the Florida Digital Service (FL[DS]).

Purchase Order (PO): The authorization to begin providing services to a Customer under the terms of this RFQ and a resulting ATC, if applicable.

Purchaser: The agency as defined in section 287.012, F.S., or Eligible User, as defined in Rule 60A-1.001, Florida Administrative Code (F.A.C.), who issues a Purchase Order from this RFQ or a resulting ATC.

Quote: A vendor’s response to this Request for Quotes.

Solution: The network-based asset discovery (agentless) solution that aggregates and analyzes data to provide a holistic view of an organization's assets. The Solution shall

RFQ No.: DMS-22/23-154 Network Based Asset Discovery (Agentless) Solution Page 2 of 30 catalogue each device on a network without the use or installation of an agent or software onto each individual device.

2.0 OBJECTIVE

Pursuant to section 287.056(2), F.S., the Department intends to purchase a network-based asset discovery (agentless) Solution for use by the Department and Customers to identify and manage each device on a network without the use or installation of an agent or software onto each individual device as specified in this RFQ.

The Department also reserves the right to execute an Agency Term Contract (ATC), in the form attached hereto, with the awarded Contractor(s) for the commodities and services specified in this RFQ. The ATC will allow the Department and Customers to purchase the Solution at or below the pricing provided by the awarded Contractor(s) throughout the ATC term.

This RFQ is being issued under the following Alternate Contract Source (ACS) contracts:

• Cloud Solutions (43230000-NASPO-16-ACS)

• Software Value Added Reseller (43230000-23-NASPO-ACS)

• Technology Products, Services, Solutions, and Related Products and Services

(43210000-US-16-ACS)

3.0 DESCRIPTION OF PURCHASE

The Department is seeking a Contractor(s) to provide a network-based asset discovery (agentless) Solution for the Department and Customers on a statewide basis. The Solution shall include software, implementation, training, support, and integration services as described below. The Contractor will be responsible for providing the Solution to Customers.

The Contractor shall be responsible for all aspects of providing the Solution to Customers, as provided herein.

4.0 BACKGROUND INFORMATION

In accordance with section 282.318, F.S., the “State Cybersecurity Act,” the Department "is the lead entity responsible for establishing standards and processes for assessing state agency cybersecurity risks and determining appropriate security measures.” Additionally, the statute states that the Department “shall adopt rules that mitigate risks; safeguard state agency digital assets, data, information, and information technology resources to ensure availability, confidentiality, and integrity; and support a security governance framework.”

The Department is also responsible for implementing the recommendations of the February 1, 2021, Florida Cybersecurity Task Force Final Report which addresses key objectives related to the state’s cybersecurity infrastructure, governance, and operations. The resulting initiatives, projects, and efforts constitute the Enterprise Cybersecurity Resiliency Program.

Additionally, in accordance with section 282.3185, F.S., the “Local Government Cybersecurity Act,” “Each local government shall adopt cybersecurity standards that safeguard its data, information technology, and information technology resources to ensure availability, confidentiality, and integrity. The cybersecurity standards must be consistent with generally accepted best practices for cybersecurity, including the National Institute of Standards and Technology Cybersecurity Framework.” In the Fiscal Year 2022-2023 General Appropriations Act (line 2944A), the Department was tasked with administering a

Network Based Asset Discovery (Agentless) Solution Page 3 of 30 competitive grant program for local government cybersecurity technical assistance for municipalities and counties. The Department intends to provide access to solutions to equip Customers with resources compliant with the abovementioned cybersecurity standards.

5.0 TERM

Any POs issued pursuant to the RFQ will have the term identified in the PO. The ATC(s) shall have an initial term of three (3) years, subject to any limitations based on the term of the underlying ACS. The Department also reserves the right to renew the ATC(s) in accordance with section 287.057, F.S, and subject to any limitations based on the term of the underlying ACS. Renewals are also contingent upon satisfactory performance by the Contractor, as determined by the Department. Purchase Orders (PO) will be issued in accordance with the RFQ and any applicable ATC as services are needed for Customers.

6.0 SCOPE OF WORK

The Solution proposed in any Quote must not conflict with Chapter 282, F.S., Rule Title 60GG, Florida Administrative Code (F.A.C.), and cybersecurity best practices. The Solution must meet or exceed the applicable state and federal laws, regulations, and standards for cybersecurity, including the National Institute of Standards and Technology Cybersecurity Framework. The Contractor shall provide services in the manner prescribed by this Scope of Work. The Scope of Work shall be delivered in accordance with the deliverables herein.

The Department expects the services to be completed remotely and is not requiring the Contractor to travel. Unless otherwise specified within Vendor’s quote, the Solution should include the following items within the Scope of Work, but not be limited to:

6.1. Software Solution/Specifications

The Solution shall enable the process of cataloguing each device on a network, without the use or installation of an agent or software onto each individual device.

The Solution shall provide for agentless asset identification whereby the packet and communications of a device is analyzed. The Solution shall inspect communication flows, and the application packets themselves to determine make, model, software load, and even serial numbers, all without installation of an agent. The Solution shall provide for additional enrichment of this data, and further classification by machine learning and compared to a catalog of millions of devices allows for accurate device identification and classification.

6.1.1. Multi-Tenancy Support

The Solution shall be designed to support multiple tenants, allowing the end user to manage devices and policies across different organizations or customer groups. This should include role-based access control to ensure that each tenant can only view and manage their own devices.

6.1.2. Agentless Approach

The Solution shall provide the ability to discover and query endpoints without requiring the installation of agents on each device. This can simplify deployment and reduce the impact on device performance and security. This also allows for discovery of a broad range of assets and vulnerabilities.

Network Based Asset Discovery (Agentless) Solution Page 4 of 30

6.1.3. Discovery for Multiple Endpoint Types

The Solution shall discover a wide range of endpoints, including desktops, laptops, servers, mobile devices, and IoT devices.

6.1.4. Cloud Management

The Solution shall be provided as software as a service via cloud-hosted infrastructure to keep current with the latest releases of management server and endpoint agent software. This allows capacity extensibility in the cloud with minimal impact on agent or management infrastructure.

6.1.5. Remote Management

The Solution shall provide the ability to identify all networked devices and enforce policies remotely, without the need for direct physical access. This may include tasks such as software installation, patching, and configuration management.

6.1.6. Data Security

6.1.6.1. The Solution shall enable monitoring, reporting, and management of data sharing, as well as encryption and security for data at rest and in motion.

6.1.6.2. The Solution shall offer configurable controls that extend data and transaction security and compliance to third-party platforms or hosting providers the solution uses. Documents security policies, audits, attestations, or evaluations for compliance needs.

6.1.7. Compliance and Third-Party Certification

The Solution shall comply with relevant state and federal laws and standards such as the Health Insurance Portability and Accountability Act, Family

Educational Rights and Privacy Act, Driver Privacy Protection Act, General

Data Protection Regulation, and third-party certifications such as SOC 2 and

ISO 27001.The Department, Purchaser, or Customer may require awarded

Vendors(s) to execute security agreements, including but not limited to, Criminal Justice Information System (CJIS) riders or Business Associate

Agreements as a condition of performance or purchase order issuance.

6.1.8. Security Features

The Solution shall provide the ability to work in conjunction with robust security features to protect against threats like malware, data breaches, and unauthorized access. This shall include, but not be limited to, endpoint protection, firewalls, and encryption.

Network Based Asset Discovery (Agentless) Solution Page 5 of 30

6.1.9. Reporting and Analytics

The Solution shall provide detailed reporting and analytics to help monitor device health, track compliance with policies, and identify potential issues or risks. The selected Solution shall have the capacity to provide ad- hoc repots to Purchasers and Customers.

6.1.10. Integration with Other Tools

The Solution shall support dynamic policy and contextual access and other novel authentication methods.

6.1.11. Scalability

The Solution shall provide the ability to scale to meet the needs of the organization as it grows, without diminishing the ability to adequately manage growing numbers of endpoints.

6.1.12. Network

The Solution shall leverage network technologies like software-defined wide area networks and over-the-top monitoring to ensure the optimal performance of the Solution.

6.1.13. Ease of Use

The Solution shall be easy to use and configure, with an intuitive graphical user interface and clear documentation and support resources which instruct on use of the Solution.

6.1.14. Configuration Tools and Customization

The Solution shall allow configuration of the standard offering with custom user interfaces, data tables, process components, and business logic.

6.1.15. Data Migration Services

The Solution shall provide data migration services to ensure a smooth transition of data from a Customer or Purchaser’s current system to the Contractor’s Solution.

6.1.16. Disaster Recovery Services

In the event of a disaster or system failure, the Solution shall provide disaster recovery services, including backup and a disaster recovery plan ensuring business continuity.

6.1.17. Role-Based Access

The Solution shall provide the ability to create customizable role-based personas based on responsibility.

Network Based Asset Discovery (Agentless) Solution Page 6 of 30

6.1.18. Data Export

The Solution shall provide the ability to generate a customizable export of data based on user filters for assets, services, and issues present within the platform.

6.1.19. Integration

6.1.19.1. The Solution shall integrate with the Department’s existing security tools such as firewalls, endpoint management solutions, and security information and event management (SIEM) systems.

Each Customer shall determine if the Solution is able to integrate with their security tools. The Contractor shall take any steps necessary to support Customer integration.

6.1.19.2. The Solution shall be capable of data integration through common exchange techniques and frameworks such as RESTful APIs.

6.1.19.3. The Solution shall be capable of integrating with a variety of identity and access management (IAM) systems to meet Customer current and future needs.

6.1.19.4. Initial integration shall include connecting a Customer, upon request, to the State Cybersecurity Operations Center (CSOC) and validating with FL[DS] that all Solution data is properly integrated.

6.1.19.5. Integration maintenance may be required after initial integration to ensure that the Solution properly exchanges data between a Customer and the CSOC. The Contractor shall address any concerns that FL[DS] has regarding integration issues.

6.1.20. Performance and Availability

The Solution shall perform in accordance with the approved Service Level Agreement (SLA) (see Section 10.2) and be available 99.999% of the time per month.

6.1.20.1. The performance and availability SLA shall provide information on performance and availability objectives for the Solution to perform successfully and be available 99.999% of the time per month.

6.1.20.2. The Contractor shall propose meaningful financial consequences in the draft performance and availability SLA submitted with their Quote, which will be incorporated in the FL[DS]-approved financial consequences.

6.2. Training and Support

Through the Solution, the Contractor shall provide all consulting, training, and support to the Customer and FL[DS] to ensure successful implementation of the Solution and ongoing support as necessary and as defined by FL[DS] to include, but not be limited to:

Network Based Asset Discovery (Agentless) Solution Page 7 of 30

6.2.1. Consult with the Department, Purchaser, and Customer to ensure all Parties have all information necessary for decision-making.

6.2.2. Adhere to the FL[DS]-approved training SLA that specifies the objectives, description of the materials/resources provided to meet the objectives, suggested method of training (e.g., in-person, live webinar, online course), specific training suggested for each user roles.

6.2.2.1. The training SLA must specify what is included within the Initial Training (included in Item No. 1 on Attachment A, Price Sheet) provided and Ongoing Training (including scope and frequency) provided (included in Item No. 2 on Attachment A, Price Sheet).

6.2.2.2. The vendor shall propose meaningful financial consequences in the draft training SLA submitted with their Quote, which will be incorporated in the FL[DS]-approved financial consequences.

6.2.3. Adhere to the FL[DS]-approved SLA for support service which provides information on support objectives, resources, availability, response times, resolution times and issue criticality levels.

6.2.3.1. The vendor shall propose meaningful financial consequences in the draft support service SLA submitted with their Quote, which will be incorporated in the FL[DS]-approved financial consequences.

6.3. Kickoff Meeting

6.3.1. The Contractor shall conduct a kickoff meeting with the Purchaser to further clarify performance expectations.

6.3.2. If the PO covers more than just the Purchaser, the Contractor shall conduct a kickoff meeting for each Customer on a date and time agreed upon by the FL[DS] (if the Solution is being integrated into the CSOC) and the Customer.

The Contractor may hold a kickoff meeting with multiple Customers per meeting. The kickoff meeting shall be held in accordance with the deliverables herein.

6.3.3. The kickoff meeting for the Customer(s) should include a demonstration of the Solution, or prior to the kickoff meeting, a link may be provided to the Customer(s) to demonstrate the Solution.

6.4. Implementation

The Contractor shall implement the Solution with each Customer upon the Purchaser’s approval, FL[DS] approval (if the Solution is integrating with the CSOC), and the Customer’s approval of the Implementation Plan. The Contractor shall collaborate with the Customer to develop an Implementation Plan addressing all items contained in Section 6.0, Scope of Work, and submit it to the Purchaser, FL[DS] as applicable, and the Customer for approval.

The Implementation Plan must include the following at a minimum:

Network Based Asset Discovery (Agentless) Solution Page 8 of 30

6.4.1. All tasks required to fully implement and complete initial integration of the Solution.

6.4.2. Identify the entity responsible for each task (e.g., Contractor, Purchaser, FL[DS] (if applicable), or other Customer).

6.4.3. Date that each task (or group of tasks) will be completed by, identify task dependencies and tasks on the critical path to ensure timely project completion.

6.4.4. Describe necessary training, method of training (e.g., in-person, live webinar, online course), and training dates.

6.4.5. Describe the support available to ensure successful implementation and Initial Integration.

6.4.6. Provide Contractor contact information (name, title, email, and phone number) for the Contractor Representative who is assigned to oversee successful implementation and Initial Integration.

6.4.7. Document the frequency and method(s) for the Contractor to communicate the ongoing status of the Implementation Plan to the Purchaser and any other Customers.

6.5. Reporting

The Contractor shall provide the following reports to the Purchaser:

6.5.1. Quarterly Business Reviews (QBR) which will include, but not be limited to, performance reports and metrics on service level achievements. The Contractor shall schedule a quarterly meeting to review the QBR and document any financial consequences to be assessed as necessary.

6.5.2. Monthly Implementation Reports shall be provided to the Purchaser to document compliance with Final Implementation Plan(s) and document any financial consequences to be assessed as necessary.

6.5.3. Monthly Training Reports shall be provided to the Purchaser to document all training provided to the Purchaser and any other Customers and document any financial consequences to be assessed as necessary.

6.5.4. Monthly Service Reports shall be provided to the Purchaser to document Solution performance, availability, response times, and resolution times and document any financial consequences to be assessed as necessary.

6.5.5. Ad hoc reports as requested by the Purchaser.

6.6. Optional Services

6.6.1. Manage, Detect, and Respond (MDR)

If available, the vendor shall provide optional annual pricing along with an SLA to manage, detect, and respond to security issues detected by the Solution.

Network Based Asset Discovery (Agentless) Solution Page 9 of 30

6.6.1.1. Adhere to the FL[DS]-approved MDR SLA which provides information on MDR objectives, resources, availability, response times, resolution times, and issue criticality levels.

6.6.1.2. The vendor shall propose meaningful financial consequences in the draft MDR SLA submitted with their Quote, which will be incorporated in the FL[DS]-approved financial consequences.

6.6.2. Future Integrations

If available, the vendor shall provide optional pricing along with an SLA for Application Programming Interfaces available for the Solution.

6.6.2.1. The vendor shall adhere to the FL[DS]-approved SLA for future integrations which include services and solutions that augment, enhance, or expand the Solution in a meaningful way.

6.6.2.2. The vendor shall propose meaningful financial consequences in the draft future integrations SLA submitted with their Quote, which will be incorporated in the FL[DS]-approved financial consequences.

7.0 DELIVERABLES

Deliverables for each Purchase Order may be submitted earlier than the delivery dates listed in Table 1. All deliverables are subject to the approval and acceptance of the Purchaser. The Contractor shall provide the services identified in Section 6.0, Scope of Work, to complete the deliverables as described in Table 1 below. The Contractor will not be compensated for the kickoff meetings, or any work performed before or during the development of the Implementation Plan. Once the Implementation Plan is approved in writing by the Purchaser, FL[DS] (if applicable), and the Customer, as applicable, the Contractor shall provide the Customer with access to the software in accordance with the approved Implementation Plan (Final Implementation Plan). Once software access is granted to the Customer, and the Customer confirms receipt, the Contractor will invoice the Purchaser at the pricing established in Attachment A, Price Sheet, within thirty (30) days. The Contractor will be compensated, annually, in advance, for the Solution for each PO in accordance with this RFQ. The Purchaser may waive or amend any due dates in writing at its sole discretion.

TABLE 1

DELIVERABLES AND FINANCIAL CONSEQUENCES

No. Deliverable Time Frame Financial Consequences

The Contractor shall host a kickoff meeting with the

Purchaser individually, and kickoff meeting with each additional Customer, and

FL[DS] (if applicable) in accordance with the PO, and any applicable ATC.

The Contractor shall host the meeting within five (5) calendar days of PO issuance.

Financial consequences shall be assessed in the amount of $100 per calendar day, beginning on the first calendar day after deliverable due date.

Network Based Asset Discovery (Agentless) Solution Page 10 of 30

No. Deliverable Time Frame Financial Consequences

The Contractor shall submit the

Implementation Plan timely and in accordance with the PO and any applicable ATC.

The Contractor shall collaborate with the

Customer and submit each Customer’s

Implementation Plan to the Purchaser and each additional Customer within

10 calendar days of PO issuance.

Financial consequences shall be assessed in the amount of $100 per calendar day, beginning on the first calendar day after the deliverable due date until the

Customer Implementation Plan is received.

Financial consequences shall also be assessed for a

Customer’s Implementation Plan submitted that is not in accordance with the PO and any applicable ATC, in the amount of

$500 for each incomplete

Implementation Plan.

The Contractor shall provide

Solution access and all services in the Final Implementation

Plan in accordance with this PO and any applicable ATC.

The Contractor shall provide Solution access and complete all requirements established in the Final

Implementation Plan timely and accurately.

Financial consequences shall be assessed in the amount of $100 per calendar day, beginning on the first calendar day after any due date specified in the Final

Implementation Plan, until the requirement is accurately completed.

Financial consequences shall be assessed in the amount of $200 per requirement for each instance services are not performed, or documentation is not received, in accordance with this RFQ and the Implementation Plan.

Network Based Asset Discovery (Agentless) Solution Page 11 of 30

No. Deliverable Time Frame Financial Consequences

The Contractor shall ensure the

Solution is available in accordance with this PO and any applicable ATC.

The Solution must be available 99.999% of the time per month in accordance with the

FL[DS]-approved SLA and. Compliance is calculated on a monthly basis for each Customer.

Financial Consequences shall be assessed against the Contractor in the amount of $100 for each negative deviation from the thousandth decimal point. For example, a Customer’s monthly uptime of 99.997% will result in a financial consequence of $200, unless the Department accepts different financial consequence in the Contractor’s Quote.

The Contractor shall ensure the

Solution performs in accordance with the FL[DS]-approved SLA.

The Solution must perform in accordance with the

FL[DS]-approved SLA.

Financial consequences shall be assessed in the amount of $100 per calendar day, beginning on the first calendar day after any due date specified in the FL[DS]-approved SLA, until the requirement is accurately completed, unless the

Department accepts different financial consequence in the

Contractor’s Quote.

The Contractor shall ensure training and support are provided in accordance with the

FL[DS]-approved SLA.

Training and support must be provided in accordance with Section 6.2. of this

RFQ and the FL[DS]-approved SLA for training and support.

Financial consequences shall be assessed in the amount of $100 per calendar day, beginning on the first calendar day after any due date specified in the FL[DS]-approved SLA, until the requirement is accurately completed, unless the

Department accepts different financial consequence in the

Contractor’s Quote.

Network Based Asset Discovery (Agentless) Solution Page 12 of 30

No. Deliverable Time Frame Financial Consequences

The Contractor shall report accurate information in accordance with the PO and any applicable ATC.

QBRs are due 15 calendar days after the end of the quarter (January - March, April - June, July -

September, and October -

December).

Monthly Implementation

Reports are due five (5) calendar days after the end of the month.

Monthly Training Reports are due five (5) calendar days after the end of the month.

Monthly Service Reports are due five (5) calendar days after the end of the month.

Ad hoc reports are due five (5) calendar days after the request by the

Purchaser.

Financial consequences shall be assessed in the amount of $100 per calendar day, beginning on the first calendar day after any due date, until an accurate report is received.

All deliverables are subject to the approval and acceptance of the Purchaser. Any deliverables rejected by the Purchaser will be subject to the applicable financial consequences in Table 1 until the Contractor resubmits and the Purchaser accepts the deliverable.

8.0 PERFORMANCE MEASURES

The Contractor shall perform all required services in a proper and satisfactory manner as determined by the Purchaser. The Contractor shall perform 100% of deliverable requirements to the satisfaction of the Purchaser, within the PO-required deadlines.

8.1 Performance Compliance

By submitting a response to this RFQ, the Contractor acknowledges and agrees that its performance under this SOW must meet the standards set forth above and that it will be bound by the conditions set forth herein. After executing an applicable financial consequence, the Purchaser may, at its sole discretion, allow additional time for the

Network Based Asset Discovery (Agentless) Solution Page 13 of 30

Contractor to remedy the performance issues identified by the Purchaser; or, after giving the Contractor a reasonable opportunity to cure such performance issues, may proceed with default proceedings.

The Purchaser reserves the right to perform or assign the required services to another contractor, if the awarded Contractor is not achieving the required levels of service, after the Contractor has been duly notified of their inadequacy.

Where any applicable ATC(s) and PO(s) require the generation and submission of deliverables to the Purchaser, receipt by the Purchaser will not be construed to mean or imply acceptance of those deliverables. It is specifically intended by the Purchaser that acceptance of required deliverables constitute a separate act. The Purchaser may reject deliverables as incomplete, inadequate, or unacceptable according to the parameters set forth in this SOW.

By submitting a Quote, the vendor represents and warrants that the Solution substantially conforms or exceeds the specifications herein and will continue to substantially conform or exceed the specifications provided herein throughout the duration of any resultant ATC and PO. The Solution’s failure to substantially conform or exceed these specifications may result in termination of any resultant ATC or PO(s).

9.0 FINANCIAL CONSEQUENCES

The Purchaser shall impose financial consequences upon the Contractor for failure to comply or submit evidence documenting compliance with the performance standard requirements, or deliverable deemed unacceptable by the Purchaser if the Contractor fails to resolve errors, as set forth in Section 7.0, Deliverables. If the Purchaser chooses to allow completion of Contract requirements after the time allowed, its allowance shall not act as a waiver of financial consequences. These financial consequences are not a penalty and are intended to incentivize successful performance of the specified requirements.

Financial consequences assessed will result in a payment or an automatic credit to the Purchaser, at the Purchaser’s discretion. In the event the Purchaser disagrees with a financial consequence assessment by the Contractor, the Purchaser will make the final determination on the Contractor’s compliance with the deliverables and financial consequence assessment.

10.0 RESPONSE CONTENT AND FORMAT

10.1 Responses are due by the date and time shown in Section 11.0, Timeline.

10.2 Quotes shall be concise, in an electronic Adobe PDF format, and prepared using the following outline:

1) Documentation to describe the network-based asset discovery (agentless)

Solution proposed and how it meets the requirements of this RFQ to include the following at a minimum:

a. A draft SLA for Solution performance and availability which adheres to all provisions of this RFQ.

Network Based Asset Discovery (Agentless) Solution Page 14 of 30

b. A draft SLA for training and support which adheres to all provisions of this

RFQ.

i. The training SLA must specify initial training (included in Item No. 1 on Attachment A, Price Sheet) provided and ongoing training provided (included in Item No. 2 on Attachment A, Price Sheet).

c. A draft implementation plan for a Customer which adheres to all provisions of this RFQ.

d. A draft MDR SLA, if applicable, per section 6.6.1 with annual pricing.

e. A draft SLA for future integrations, if applicable, per section 6.6.2 with pricing.

f. A draft disaster recovery plan per section 30.5.

2) Documentation describing any experience providing the Solution, or similar

Solution, on a statewide basis or across a large geographic region.

3) Documentation describing the vendor’s capacity and ability to implement the

Solution on a statewide basis.

4) Document any substantial deviations within Vendor’s Solution from the Scope of

Work.

5) Detail regarding any value-added services.

6) Attachment A, Price Sheet, containing pricing for all items and completed in accordance with the instructions provided in this RFQ.

7) Attachment B, Contact Information Sheet, containing the contacts for the Quote and the resulting ATC(s) and PO(s).

8) Non-Disclosure Agreement executed by the vendor.

If the vendor is utilizing subcontractors, the vendor shall identify all subcontractors the vendors will utilize to provide the services required by this RFQ and what services each subcontractor will provide.

10.3 All Quotes should be submitted via email to the Department’s Procurement Officer, identified in Section 12.0. Quotes must remain valid for at least 180 calendar days.

Note: If the vendor considers any part of its response to the RFQ to be trade secret or otherwise confidential or exempt from disclosure under Florida or federal law (“Confidential Information”), it shall provide the Department with a copy of its response with such Confidential Information redacted in accordance with Section 19.

11.0 TIMELINE

EVENT DATE

Release of the RFQ May 8, 2023

Pre-Quote Conference

Link:

https://us02web.zoom.us/meeting/register/tZ0ufu2gqzIpGdQ3U_xd

CXnrvsiRQ2XSXqu_

May 11, 2023, at 9:00 a.m., Eastern Time

Responses Due to the Procurement Officer, via email May 17, 2023, by 5:00 p.m., Eastern Time https://us02web.zoom.us/meeting/register/tZ0ufu2gqzIpGdQ3U_xdCXnrvsiRQ2XSXqu_ https://us02web.zoom.us/meeting/register/tZ0ufu2gqzIpGdQ3U_xdCXnrvsiRQ2XSXqu_

Network Based Asset Discovery (Agentless) Solution Page 15 of 30

EVENT DATE

Solution Demonstrations and Quote Negotiations May 18-22, 2023

Anticipated Award, via email May 22, 2023

12.0 PROCUREMENT OFFICER

The Procurement Officer for this RFQ is:

Alisha Morgan Department of Management Services 4050 Esplanade Way Tallahassee, FL 32399-0950 DMS.Purchasing@dms.fl.gov

13.0 PRE-QUOTE CONFERENCE

The Department will hold a Pre-Quote Conference as indicated in Section 11.0, Timeline, above to answer vendor questions. The Department will use its best efforts to answer vendor questions during the Pre-Quote Conference.

14.0 SOLUTION DEMONSTRATIONS

If the Department requests a demonstration of the Solution, the vendor must be available to demonstrate the Solution to the Department during the timeframe specified in Section 11.0, Timeline.

15.0 QUOTE NEGOTIATIONS

The Department may schedule negotiation sessions with vendors to discuss the Quote if any aspects of the Quote are not in the best interest of the Department. These negotiations will be scheduled in the timeframe specified in Section 11.0, Timeline. The Department does not anticipate exceeding these timeframes. The Department may require the vendors to revise any terms and conditions in the vendor’s Quote, including any SLAs, during this timeframe.

16.0 SELECTION OF AWARD

The Department intends to select one (1) or more vendor(s) that provide the overall best value to the State. The Department will consider all aspects of submitted Quotes when making a selection, including the proposed Solution, how it meets the requirements, benefits to the State, and price.

17.0 RFQ HIERARCHY

The ATC(s) and PO(s) resulting from this RFQ will include the following Attachments which set forth the entire understanding of the Customer, the Contractor, and the Department and supersede all prior agreements. All Attachments listed below will be incorporated in their entirety into, and form part of any ATC(s) or PO(s) issued. In the event of a conflict between the documents that make up any ATC(s) and PO(s), priority shall be in the order listed:

1) The PO(s);

2) The ATC(s);

3) The Department’s Non-Disclosure Agreement (NDA) or other Purchaser’s NDA;

4) This RFQ;

5) Department’s Purchase Order Terms and Conditions;

mailto:DMS.Purchasing@dms.fl.gov

Network Based Asset Discovery (Agentless) Solution Page 16 of 30

6) The ACS contract the vendor submitted their Quote in accordance with [ACS:

Cloud Solutions (43230000-NASPO-16-ACS), Software Value Added Reseller (SVAR) (43230000-23-NASPO-ACS), or Technology Products, Services, Solutions, and Related Products and Services (43210000-US-16-ACS)\]; and

7) The vendor’s Quote.

18.0 DEPARTMENT’S CONTRACT MANAGER

The Department’s Contract Manager who will oversee the Contractor’s performance of its duties and obligations pursuant to the terms of any applicable ATC and any resultant PO and serve as a liaison with the Contractor, will be as follows:

To Be Determined Florida Department of Management Services Florida Digital Service 2555 Shumard Oak Blvd Tallahassee, FL 32399 purchasing@digital.fl.gov

19.0 PAYMENT

19.1 The Contractor will be compensated in advance, annually, for all Deliverables per PO.

Once the Implementation Plan is approved by the Purchaser, FL[DS] (if applicable) and the Customer in writing, the Contractor shall provide the Customer with access to the software in accordance with the Final Implementation Plan. Once software access is granted to the Customer, and the Customer confirms receipt, the Contractor will submit one (1) invoice to the Contract Manager specified in the PO indicating the date the Customer received the software access.

19.2 On each invoice, the Contractor shall certify that all costs and fees claimed in the invoice statement for payment are accurate and were performed in furtherance of the

PO.

19.3 Contractor compensation will be exclusively made in accordance with the terms of this RFQ, any applicable ATC, and the PO. The Purchaser will not reimburse the Contractor for any other expenses associated with, or related to, any applicable ATC or resultant PO(s). For example, travel related expenses, including lodging, mileage, vehicle rental, and food, will not be subject to reimbursement.

19.4 Purchasers shall pay invoices in accordance with their governing laws and regulations, which shall govern the rights and obligations of the Purchaser and the Contractor. The Department shall pay invoices submitted by the Contractor in accordance with the provisions of section 215.422, F.S., which shall govern the rights and obligations of the Department and the Contractor.

19.5 The Contractor is responsible for the performance of all tasks and deliverables contained in any applicable ATC or PO.

20.0 PUBLIC RECORDS AND DOCUMENT MANAGEMENT

20.1 Access to Public Records

The Department may unilaterally cancel any applicable ATC or PO for failure by the Contractor to comply with this section by not allowing access to all public records, as mailto:Karen.Milicic@digital.fl.gov

Network Based Asset Discovery (Agentless) Solution Page 17 of 30 defined in Chapter 119, F.S., made or received by the Contractor in conjunction with any applicable ATC or PO.

20.2 Contractor as Agent

Solely for the purposes of this section, the Contract Manager specified in the PO is the custodian of public records. If under the PO, the Contractor is providing services and is acting on behalf of a public agency, as provided by section 119.0701, F.S., the Contractor shall:

1) Keep and maintain public records required by the public agency to perform the service.

2) Upon request from the public agency’s custodian of public records, provide the public agency with a copy of the requested records or allow the records to be inspected or copied within a reasonable time and at a cost that does not exceed the cost provided in Chapter 119, F.S., or as otherwise provided by law.

3) Ensure that public records that are exempt or confidential and exempt from public records disclosure are not disclosed except as authorized by law for the duration of the PO term and following the completion of the PO if the Contractor does not transfer the records to the public agency.

4) Upon completion of the PO, transfer, at no cost, to the public agency all public records in possession of the Contractor or keep and maintain public records required by the public agency to perform the service. If the Contractor transfers all public records to the public agency upon completion of the PO, the Contractor shall destroy any duplicate public records that are exempt or confidential and exempt from public records disclosure requirements. If the Contractor keeps and maintains public records upon completion of the PO, the Contractor shall meet all applicable requirements for retaining public records. All records stored electronically must be provided to the Purchaser, upon request from the Purchaser’s custodian of public records, in a format that is compatible with the information technology systems of the Purchaser.

5) IF THE CONTRACTOR HAS QUESTIONS REGARDING THE

APPLICATION OF CHAPTER 119, F.S., TO THE

CONTRACTOR’S DUTY TO PROVIDE PUBLIC RECORDS

RELATING TO THE PURCHASE ORDER, CONTACT THE

FOLLOWING CONTACTS:

DEPARTMENT:

CUSTODIAN OF PUBLIC RECORDS

PHONE NUMBER: 850-487-1082

EMAIL: PublicRecords@dms.fl.gov

MAILING ADDRESS: 4050 ESPLANADE WAY, SUITE 160

TALLAHASSEE, FL 32399.

OTHER PURCHASER:

CONTRACT MANAGER SPECIFIED ON THE PO

mailto:PublicRecords@dms.fl.gov

Network Based Asset Discovery (Agentless) Solution Page 18 of 30

20.3 Public Records Exemption

The Contractor may have access to cybersecurity information classified as confidential and exempt under section 119.0725, F.S. In the event that the Contractor has access to confidential and exempt information, the Contractor agrees to maintain the confidentiality as required in section 119.0725, F.S.

20.4 Document Management

The Contractor must retain sufficient documentation to substantiate claims for payment under the PO and all other records, electronic files, papers, and documents that were made in relation to the PO. The Contractor must retain all documents related to the PO for five (5) years after the expiration of the PO, or, if longer, the period required by the General Records Schedules maintained by the Florida Department of State available at the Department of State’s Records Management website.

21.0 IDENITIFICATION AND PROTECTION OF CONFIDENTIAL INFORMATION

Article 1, section 24, Florida Constitution, guarantees every person access to all public records, and section 119.011, F.S., provides a broad definition of “public records.” As such, records submitted to an Agency as defined in section 119.011, F.S. (referred to for purposes of this Section 19 as “Agency”) are public records and are subject to disclosure unless exempt from disclosure by law. If the vendor considers any portion of records it provides to an Agency (including those submitted in response to this RFQ) to be trade secret or otherwise confidential or exempt from disclosure under Florida or federal law (“Confidential Information”), the vendor shall mark the document as “confidential” and simultaneously provide that Agency with a separate, redacted copy of the record. For each portion redacted, the vendor should briefly describe in writing the grounds for claiming exemption, including the specific statutory citation for such exemption. The vendor shall only redact portions of records that it claims are Confidential Information.

In the event of a request for public records pursuant to Chapter 119, F.S., the Florida Constitution, or other authority, to which records that are marked as “confidential” are responsive, the Agency will provide the vendor-redacted copy to the requestor. If a requestor asserts a right to the redacted Confidential Information, the Agency will notify the vendor such an assertion has been made. It is the vendor’s responsibility to take the appropriate legal action to assert that the information in question is exempt from disclosure under Chapter 119, F.S., or other applicable law.

If the Agency becomes subject to a demand for discovery or disclosure of documents that are marked as “confidential” in a legal proceeding, the Agency will give the vendor notice of the demand or request. The vendor shall take the appropriate legal action in response to the demand and to defend its claims of confidentiality. If the vendor fails to take appropriate and timely action to protect the records it has designated as Confidential Information, the Agency will provide the unredacted records to the requester.

The vendor shall protect, defend, and indemnify the Agency and any applicable Customer for all claims, costs, fines, and attorneys’ fees arising from or relating to the vendor’s determination that the redacted portions of its records are Confidential Information. If the vendor fails to submit a redacted copy in accordance with this section, of information it claims is Confidential Information, the Agency is authorized to produce the entire record submitted to the Agency in response to a public records request for, or demand for discovery or disclosure of, these records.

Network Based Asset Discovery (Agentless) Solution Page 19 of 30

22.0 USE OF SUBCONTRACTORS

In providing services under the PO(s) and any applicable ATC, the Contractor is permitted to utilize subcontractors identified in its Quote. The Contractor shall notify the Contract Manager specified on the PO in writing of any subcontractors not identified in the Contractor’s Quote who will be engaged to provide services for a PO 10 calendar days prior to their engagement.

During the term of the PO, subcontractors may be substituted with the prior written approval of the Contract Manager specified on the PO. The Purchaser reserves the right to reject a subcontractor with 10 calendar days advance notification to the Contractor.

The Contractor is fully responsible for the satisfactory completion of all subcontracted work and is required to ensure subcontractor’s adherence to the terms set forth any PO.

The Contractor shall make all payments to subcontractors. If the Contractor utilizes a subcontractor, the Contractor shall pay the subcontractor within seven (7) Business Days after any payment is received from the Purchaser, per section 287.0585, F.S. It is understood, and agreed upon, that the Department shall not be held accountable to any subcontractor for any expenses or liabilities incurred under the subcontract, and that the Contractor is solely responsible to the subcontractor for all expenses and liabilities under the Contract. If the Contractor fails to pay the subcontractor within seven (7) Business Days, the Contractor shall pay the penalty to the subcontractor in the amount of one-half (1/2) of one percent (1%) of the amount due, per Calendar Day, from the expiration of the period allowed herein for payment. Such penalty shall be in addition to actual payments owed and shall not exceed 15% of the outstanding balance due.

23.0 LEGISLATIVE APPROPRIATION

Pursuant to section 287.0582, F.S., the State of Florida’s performance and obligation to pay under any PO is contingent upon an annual appropriation by the Legislature.

24.0 MODIFICATIONS

The Department reserves the right to change, add or delete any requirement from this RFQ if the Department deems it to be in the best interest of the State of Florida. In addition, the Department reserves the right to withdraw and cancel this RFQ at any time, prior to a duly authorized and executed ATC or PO.

25.0 CONFLICT OF INTEREST

It is essential that the vendor and any subcontractors are independent and impartial and that the implementation of decisions made as it relates to consultation and services is not used for private gain or other remuneration. The Contractor shall not receive any monies for services provided under the PO aside from those paid pursuant to the PO.

26.0 DISCRIMINATIORY, CONVICTED AND ANTITRUST VENDORS LISTS

The vendor is hereby informed of the provisions of sections 287.133(2)(a), 287.134(2)(a), and 287.137(2)(a), F.S., that identify the impacts to the vendor 's ability or its affiliates’ ability to respond to the competitive solicitations of a public entity; to be awarded or perform work as a contractor, supplier, subcontractor, or consultant under a contract with a public entity;

or to transact business with a public entity if it, or its affiliates, are placed on the Convicted Vendor, Discriminatory Vendor, or Antitrust Violator Vendor Lists of the Department of Management Services. The Contractor shall promptly notify the Purchaser if it or its suppliers, subcontractors, or consultants under any POs are placed on any such lists.

Network Based Asset Discovery (Agentless) Solution Page 20 of 30

27.0 E-VERIFY

The Contractor (and its subcontractors) has an obligation to utilize the U.S. Department of Homeland Security’s (DHS) E-Verify system for all newly hired employees in accordance with section 448.095, F.S. By accepting the ATC or any PO(s), the Contractor certifies that it is registered with, and uses, the E-Verify system for all newly hired employees in accordance with section 448.095, F.S. The Contractor must obtain an affidavit from its subcontractors in accordance with paragraph (2)(b) of section 448.095, F.S., and maintain a copy of such affidavit for the duration of any applicable ATC(s) and any PO(s). The Contractor shall provide a copy of its DHS Memorandum of Understanding (MOU) to the Contract Manager specified on the PO within five (5) business days of issuance of the ATC or any PO(s). The Contract Manager will be designated on any applicable ATC and PO.

This section serves as notice to the Contractor regarding the requirements of section 448.095, F.S., specifically sub-paragraph (2)(c)1, and the Department’s obligation to terminate the ATC and any other Purchaser’s obligation to terminate any PO(s) if it has a good faith belief that the Contractor has knowingly violated section 448.09(1), F.S. If terminated for such reason, the Contractor will not be eligible for award of a public contract for at least one (1) year after the date of such termination. The Department or any other applicable Purchaser will promptly notify the Contractor and order the immediate termination of any contract between the Contractor and a subcontractor performing work on its behalf under the ATCs and any PO(s) should the Department or any other applicable Purchaser develop a good faith belief that the subcontractor has knowingly violated section 448.095(1), F.S.

28.0 COOPERATION WITH INSPECTOR GENERAL

Pursuant to section 20.055(5), F.S., Contractor, and its subcontractors (if any), understand and will comply with their duty to cooperate with the Department’s or any Purchaser’s Inspector General in any investigation, audit, inspection, review, or hearing.

29.0 ACCESSIBILITY

The Contractor will comply with section 508 of the Rehabilitation Act of 1973, as amended and 29 U.S.C. s. 794(d), including the regulations set forth under 36 C.F.R. part 1194. Section 282.601(1), F.S., states that “state government shall, when developing, competitively procuring, maintaining, or using electronic information or information technology acquired on or after July 1, 2006, ensure that State employees with disabilities have access to and are provided with information and data comparable to the access and use by State employees who are not individuals with disabilities.”

30.0 PRODUCTION AND INSPECTION

In accordance with section 216.1366, F.S., any public agency is authorized to inspect the:

(a) financial records, papers, and documents of the contractor that are directly related to the performance of the contract or the expenditure of state funds; and (b) programmatic records, papers, and documents of the contractor which the public agency…