DMS-2223-161-Email-Security-Solutions.final.pdf

2555 Shumard Oak Blvd. • Tallahassee, FL 32399 • digital.fl.gov Pedro Allende, Secretary

Florida Department of Management Services

Ron DeSantis, Florida Governor James Grant, Florida State Chief Information Officer

Request for Quotes (RFQ)

DMS-22/23-161

Email Security Solution

Alternate Contract Sources:

Cloud Solutions (43230000-NASPO-16-ACS)

Software Value Added Reseller (SVAR) (43230000-23-NASPO-ACS)

Technology Products, Services, Solutions, and Related Products and Services (43210000-US-16-ACS)

1.0 DEFINITIONS

The following definitions shall apply throughout this RFQ:

Agency Term Contract (ATC): The written agreement resulting from the award of this Request for Quotes between the Department and the Contractor(s).

Contractor: The vendor awarded an ATC resulting for this Request for Quotes.

Customer: Agencies as defined in section 287.012, Florida Statute (F.S.), and Eligible Users as defined in Rule 60A-1.001, Florida Administrative Code (F.A.C.).

Department: The State of Florida, Department of Management Services (DMS), on behalf of the Florida Digital Service (FL[DS]).

Purchase Order: The authorization to begin providing services to a Customer under the terms of this RFQ and a resulting ATC, if applicable.

Purchaser: The agency as defined in section 287.012, F.S., or Eligible User, as defined in Rule 60A-1.001, Florida Administrative Code (F.A.C.), who issues a Purchase Order from this RFQ or a resulting ATC.

Quote: A vendor’s response to this Request for Quotes.

Solution: An email security solution that ensures the availability, integrity and authenticity of email communications by protecting against the risk of email threats.

DMS-22/23-161 Page 2 of 31 Email Security Solution

2.0 OBJECTIVE

Pursuant to section 287.056(2), F.S., the Department intends to purchase an email security solution for use by the Department and Customers to analyze incoming email messages and detect potential threats in real-time as specified in this RFQ.

The Department also reserves the right to execute an Agency Term Contract (ATC), in the form attached hereto, with the awarded Contractor(s) for the commodities and services specified in this RFQ. The ATC will allow the Department and Customers to purchase the Solution at or below the pricing provided by the awarded Contractor(s) throughout the ATC term.

This RFQ is being issued under the following Alternate Contract Source (ACS) contracts:

• Cloud Solutions (43230000-NASPO-16-ACS)

• Software Value Added Reseller (43230000-23-NASPO-ACS)

• Technology Products, Services, Solutions, and Related Products and Services

(43210000-US-16-ACS)

3.0 DESCRIPTION OF PURCHASE

The Department is seeking a Contractor(s) to provide an email security Solution for the Department and Customers on a statewide basis. The Solution shall include software, implementation, training, support, and integration services as described below. The Contractor will be responsible for providing the Solution to Customers. The Contractor shall be responsible for all aspects of providing the Solution to Customers, as provided herein.

4.0 BACKGROUND INFORMATION

In accordance with section 282.318, F.S., the “State Cybersecurity Act,” the Department "is the lead entity responsible for establishing standards and processes for assessing state agency cybersecurity risks and determining appropriate security measures.” Additionally, the statute states that the Department “shall adopt rules that mitigate risks; safeguard state agency digital assets, data, information, and information technology resources to ensure availability, confidentiality, and integrity; and support a security governance framework.”

The Department is also responsible for implementing the recommendations of the February 1, 2021, Florida Cybersecurity Task Force Final Report which addresses key objectives related to the state’s cybersecurity infrastructure, governance, and operations. The resulting initiatives, projects, and efforts constitute the Enterprise Cybersecurity Resiliency Program.

Additionally, in accordance with section 282.3185, F.S., the “Local Government Cybersecurity Act,” “Each local government shall adopt cybersecurity standards that safeguard its data, information technology, and information technology resources to ensure availability, confidentiality, and integrity. The cybersecurity standards must be consistent with generally accepted best practices for cybersecurity, including the National Institute of Standards and Technology Cybersecurity Framework.” In the Fiscal Year 2022-2023 General Appropriations Act (line 2944A), the Department was tasked with administering a competitive grant program for local government cybersecurity technical assistance for municipalities and counties. The Department intends to provide access to solutions to equip Customers with resources compliant with the abovementioned cybersecurity standards.

DMS-22/23-161 Page 3 of 31

5.0 TERM

The ATC(s) shall have an initial term of three (3) years, subject to any limitations based on the term of the underlying ACS. The Department also reserves the right to renew the ATC(s) in accordance with section 287.057, F.S, and subject to any limitations based on the term of the underlying ACS. Renewals are also contingent upon satisfactory performance by the Contractor, as determined by the Department. Purchase Orders (PO) will be issued in accordance with the RFQ and any applicable ATC as services are needed for Customers.

Any POs issued pursuant to the RFQ will have the term identified in the PO.

6.0 SCOPE OF WORK

The Solution proposed in any Quote must not conflict with Chapter 282, F.S., Rule Title 60GG, Florida Administrative Code (F.A.C.), and cybersecurity best practices. The Solution must meet or exceed the applicable state and federal laws, regulations, and standards for cybersecurity, including the National Institute of Standards and Technology Cybersecurity Framework. The Contractor shall provide services in the manner prescribed by this Scope of Work. The Scope of Work shall be delivered in accordance with the deliverables herein.

The Department expects the services to be completed remotely and is not requiring the Contractor to travel. Unless otherwise specified within vendor’s Quote, the Solution should include the following items within the Scope of Work, but not be limited to:

6.1. Software Solution/Specifications

The Solution shall analyze incoming email messages and detect potential threats in real-time. The Solution shall be designed to be highly effective at identifying and blocking malicious emails, while minimizing false positives (legitimate emails that are mistakenly blocked). The Department is seeking the following two major solution types of email security:

Secure Email Gateway (SEG) — for both inbound and outbound email provided as a cloud service. This service must process and filter Simple Mail Transfer Protocol (SMTP) traffic and will require organizations to change their Mail Exchange (MX) record to point to the SEG. This type of solution is traditionally used for organizations that do not use cloud provided mail services such as Microsoft Office 365 and Google Workspace.

Integrated Cloud Email Security (ICES) — cloud email providers (e.g., Microsoft and Google) provide built-in email security hygiene capabilities. ICES capabilities supplement these native features. These solutions use API access to the cloud email provider to analyze email content without the need to change the MX record.

6.1.1. Multi-Tenant

The Solution shall support a multi-tenant, multi-organization architecture.

Each tenant must have its own instance and each instance must aggregate up to a single instance and view. The aggregated instance will support enterprise security operations.

6.1.2. Content Disarm and Reconstruction

The Solution shall break down files to their discrete components in real-time and reconstruct a clean version of the email, removing anything that doesn't

DMS-22/23-161 Page 4 of 31 conform with the file type specifications, an International Organization for Standardization (ISO) standard, or company policy.

6.1.3. Multi-Source Mail Traffic Analysis

The Solution shall allow Customer configurations that have the ability to analyze emails sent and received internally and externally to and from the Customer.

6.1.4. Display Name Spoof Detection

The Solution shall detect spoofed messages based on email headers and sender names, using fuzzy matching of sender names with a predetermined list of names that are likely to be targeted.

6.1.5. Anti-Phishing Capabilities

The Solution shall provide techniques and technologies that prevent and counteract phishing attempts, unauthorized access, and theft. The Solution shall include, but not be limited to, the following capabilities:

6.1.5.1. Uniform Resource Locator (URL) and Domain Analysis: The

Solution shall analyze URLs and domains in email messages to identify potential phishing attacks. This includes the ability to detect fake domains and URLs that mimic legitimate sites.

6.1.5.2. Content Analysis: The Solution shall analyze the content of email messages, including attachments and links, to identify phishing attempts. This includes the ability to detect malicious attachments and links that lead to phishing sites.

6.1.5.3. Behavioral Analysis: The Solution shall analyze the behavior of email messages, including sender behavior and user behavior, to identify potential phishing attacks. This includes the ability to detect suspicious email senders, unusual email patterns, and other anomalies that may indicate a phishing attempt.

6.1.5.4. Real-Time Threat Intelligence: The Solution shall leverage real-time threat intelligence feeds to identify and block known phishing attacks. This includes the ability to integrate with threat intelligence platforms and services to stay up-to-date with the latest threats.

6.1.6. Domain-based Message Authentication, Reporting and Conformance (DMARC) on Inbound Email

The Solution shall enforce domain-based message authentication, reporting, and conformance on inbound email traffic to protect internal users from receiving spoofed external messages.

DMS-22/23-161 Page 5 of 31

6.1.7. Product Usability

The Solution shall provide easy to understand, user-friendly interfaces with intuitive designs to facilitate user engagement, and clear documentation and support resources which instruct on use of the Solution.

6.1.8. Anomaly Detection

The Solution shall use email telemetry and analytics to detect spam and phishing, non-rule-based detection, based on metadata such as sender reputation, recipient, and envelope, email content, and communication history.

6.1.9. Lookalike Domain Detection

The Solution shall find the use of lookalike domains, also referred to as "cousin domains."

6.1.10. Remote Browser Isolation

The Solution shall reformat websites to remove security risks and provide clean rendering of the content to the client browser.

6.1.11. URL Rewriting and Time-of-Click Analysis

The Solution shall rewrite URLs to defend users by converting to non-clickable URL, replacing with plain text, or redirecting to a URL inspection service.

6.1.12. Network Sandbox

The Solution shall inspect attachments and embedded URLs in a secured sandbox and identify malware that attempts to detect being run in a virtualized sandbox environment.

6.1.13. Scalability

The Solution shall allow the mail exchange gateway to handle increased email traffic as the number of users grows over time.

6.1.14. Performance

The Solution shall allow the mail exchange gateway to process emails quickly and efficiently to ensure timely delivery.

6.1.15. Compatibility

The Solution shall have the ability to seamlessly integrate with other email systems and protocols.

DMS-22/23-161 Page 6 of 31

6.1.16. Customization

The Solution shall offer a range of customization options to meet the specific needs of the organization and a user-friendly interface that is easy to set up and manage.

6.1.17. Administration and Configuration

The Solution shall provide robust administrative capabilities that allow organizations to manage and customize their email security policies and settings. Some of the key administrative capabilities include:

6.1.17.1. Policy Management: The Solution shall provide the ability to create and enforce email security policies that align with the Customer's security requirements. This shall include policies for anti-spam, anti-phishing, anti-malware, data loss prevention, encryption, and email archiving.

6.1.17.2. User Management: The Solution shall provide the ability to manage user accounts, roles, and permissions. This shall include the ability to create and delete user accounts, manage access rights, and configure authentication mechanisms such as single sign-on (SSO).

6.1.17.3. Configuration Management: The Solution shall provide the ability to configure email security settings such as transport rules, content filtering, quarantine settings, and notification settings.

This shall include the ability to customize the security settings based on the organization's specific requirements.

6.1.17.4. Reporting and Analytics: The Solution shall provide the ability to generate detailed reports on email traffic, security incidents, policy violations, and user activity. This shall include the ability to customize and schedule reports for compliance and auditing purposes.

6.1.17.5. Integration and Automation: The Solution shall provide the ability to integrate with other security solutions and automate routine tasks such as policy updates, threat detection, and incident response. This shall include the ability to leverage APIs and connectors to integrate with third-party security solutions.

6.1.17.6. Audit and Compliance: The Solution shall provide the ability to track and log all email-related activities and events to ensure compliance with regulatory and industry standards. This shall include the ability to generate audit trails, provide access logs, and support eDiscovery requests.

DMS-22/23-161 Page 7 of 31

6.1.18. Compliance and Third-Party Certification

The Solution shall comply with relevant standards like General Data Protection Regulation (GDPR), Criminal Justice Information Services (CJIS), Health Insurance Portability and Accountability Act (HIPAA), Family Educational Rights and Privacy Act, Personally Identifiable Information (PII) data requirements, Driver Privacy Protection Act, and third-party certifications such as Systems and Organizations Controls 2 (SOC 2) and International Organization for Standardization (ISO) 27001. The Department, Purchaser, or Customer may require Contractor(s) to execute security agreements, including but not limited to, CJIS riders or Business Associate Agreements as a condition of performance or purchase order issuance.

6.1.19. Integration

6.1.19.1. The Solution shall integrate with the Department’s existing security tools such as firewalls, antivirus software, endpoint management solutions and security information and event management (SIEM) systems. The Customer shall determine if the Solution is able to integrate with the Customer’s security tools. The Contractor shall take any steps necessary to support Customer integration.

6.1.19.2. The Solution shall be capable of data integration through common exchange techniques and frameworks such as RESTful Application Programming Interfaces (APIs).

6.1.19.3. The Solution shall be capable of integrating with a variety of identity and access management (IAM) systems, as well as with the applications and systems that require authentication, to meet Customer current and future needs.

6.1.19.4. Initial Integration shall include connecting each Customer to the state Cybersecurity Operations Center (CSOC) and validating with FL[DS] that all Solution data is properly integrated, as requested by the Customer.

6.1.19.5. Integration Maintenance may be required after initial integration to ensure that the Solution properly exchanges data between Customers and the CSOC. The Contractor shall address any concerns that FL[DS] has regarding integration issues.

6.1.20. Performance and Availability

The Solution shall perform in accordance with the approved Service Level Agreement (SLA) (see Section 10.2) and be available 99.999% of the time per month.

6.1.20.1. The performance and availability SLA shall provide information on performance and availability objectives for the Solution to perform successfully and be available 99.999% of the time per month.

DMS-22/23-161 Page 8 of 31

6.1.20.2. The vendor shall propose meaningful financial consequences in the draft performance and availability SLA submitted with their Quote, which will be incorporated in the FL[DS]-approved financial consequences.

6.2. Training and Support

Through the Solution, the Contractor shall provide all consulting, training, and support to the Customer and FL[DS] to ensure successful implementation of the Solution and ongoing support as necessary and as defined by FL[DS] to include, but not be limited to:

6.2.1. Consult with and the Department, the Purchaser, and the Customer to ensure the Department, the Purchaser, and the Customer have the information necessary for decision-making.

6.2.2. Adhere to the FL[DS]-approved training SLA that specifies the objectives, description of the materials/resources provided to meet the objectives, suggested method of training (in-person, live webinar, online course, etc.), and specific training suggested for each user roles.

6.2.2.1. The training SLA must specify Initial Training (included in Item No.

1 on Attachment A, Price Sheet) provided and Ongoing Training provided (included in Item No. 2 on Attachment A, Price Sheet).

6.2.2.2. The vendor shall propose meaningful financial consequences in the draft training SLA submitted with their Quote, which will be incorporated in the FL[DS]-approved financial consequences.

6.2.3. Adhere to the FL[DS]-approved SLA for support service which provides information on support objectives, resources, availability, response times, resolution times and issue criticality levels.

6.2.3.1. The vendor shall propose meaningful financial consequences in the draft support service SLA submitted with their Quote, which will be incorporated in the FL[DS]-approved financial consequences.

6.3. Kickoff Meeting

6.3.1. The Contractor shall conduct a kickoff meeting with the Purchaser to further clarify PO expectations.

6.3.2. If the PO covers more than just the Purchaser, the Contractor shall conduct a kickoff meeting for each Customer on a date and time agreed upon by the FL[DS] (if the Solution is being integrated into the CSOC) and the Customer.

The Contractor may hold a kickoff meeting with multiple Customers per meeting.

6.3.3. The kickoff meeting for the Customer should include a demonstration of the Solution, or prior to the kickoff meeting, a link may be provided to the Customer to demonstrate the Solution.

6.4. Implementation

The Contractor shall implement the Solution with each Customer upon the Purchaser’s approval, FL[DS] approval (if the Solution is integrating with the CSOC), DMS-22/23-161 Page 9 of 31 and the Customer’s approval of the Implementation Plan. The Contractor shall collaborate with the Customer to develop an Implementation Plan addressing all items contained in Section 6.0, Scope of Work, and submit it to the Purchaser, FL[DS] as applicable, and the Customer for approval.

The Implementation Plan must include the following at a minimum:

6.4.1. All tasks are required to fully implement and complete Initial Integration of the Solution.

6.4.2. Identify if the Contractor, Purchaser, FL[DS] (if applicable), or other Customer is responsible for each task.

6.4.3. Dates that each task (or group of tasks) will be completed by, identify task dependencies, and tasks on the critical path to ensure timely project completion.

6.4.4. Describe necessary training, method of training (e.g., in-person, live webinar, online course), and training dates.

6.4.5. Describe the support available to ensure successful implementation and Initial Integration.

6.4.6. Provide Contractor contact information (name, title, email, and phone number) for the Contractor Representative who is assigned to oversee successful implementation and Initial Integration.

6.4.7. Document the frequency and method(s) for the Contractor to communicate the ongoing status of the Implementation Plan to the Purchaser and any other Customers.

6.5. Reporting

The Contractor shall provide the following reports to the Purchaser:

6.5.1. Quarterly Business Reviews (QBR) which will include, but not be limited to, performance reports and metrics on service level achievements. The Contractor shall schedule a quarterly meeting to review the QBR and document any financial consequences to be assessed as necessary.

6.5.2. Monthly Implementation Reports shall be provided to the Purchaser to document compliance with Final Implementation Plan(s) and document any financial consequences to be assessed as necessary.

6.5.3. Monthly Training Reports shall be provided to the Purchaser to document all training provided to the Purchaser and any other Customers and document any financial consequences to be assessed as necessary.

6.5.4. Monthly Service Reports shall be provided to the Purchaser to document Solution performance, availability, response times, and resolution times and document any financial consequences to be assessed as necessary.

6.5.5. Ad hoc reports as requested by the Purchaser.

DMS-22/23-161 Page 10 of 31

6.6. Optional Services

6.6.1. Future Integrations and Other Services

If available, the vendor shall provide optional pricing along with an SLA for Application Programming Interfaces or Other Services available for the Solution.

6.6.1.1. Adhere to the FL[DS]-approved SLA for future integrations which include services and solutions that augment, enhance, or expand the Solution in a meaningful way.

6.6.1.2. The vendor shall propose meaningful financial consequences in the draft future integrations SLA submitted with their Quote, which will be incorporated in the FL[DS]-approved financial consequences.

7.0 DELIVERABLES

Deliverables for each Purchase Order may be submitted earlier than the delivery dates listed in Table 1. All deliverables are subject to the approval and acceptance of the Purchaser. The Contractor shall provide the services identified in Section 6.0, Scope of Work, to complete the deliverables as described in Table 1 below. The Contractor will not be compensated for the kickoff meetings, or any work performed before or during the development of the Implementation Plan. Once the Implementation Plan is approved in writing by the Purchaser, FL[DS] (if applicable), and the Customer, as applicable, the Contractor shall provide the Customer with access to the software in accordance with the approved Implementation Plan (Final Implementation Plan). Once software access is granted to the Customer, and the Customer confirms receipt, the Contractor will invoice the Purchaser at the pricing established in Attachment A, Price Sheet, within thirty (30) days. The Contractor will be compensated, annually, in advance, for the Solution for each PO in accordance with this RFQ. The Purchaser may waive or amend any due dates in writing at its sole discretion.

TABLE 1

DELIVERABLES AND FINANCIAL CONSEQUENCES

No. Deliverable Time Frame Financial Consequences

The Contractor shall host a kickoff meeting with the

Purchaser individually, and kickoff meeting with each additional Customer, and

FL[DS] (if applicable) in accordance with the PO, and any applicable ATC.

The Contractor shall host the meeting within five (5) calendar days of PO issuance.

Financial consequences shall be assessed in the amount of $100 per calendar day, beginning on the first calendar day after deliverable due date.

DMS-22/23-161 Page 11 of 31

TABLE 1

DELIVERABLES AND FINANCIAL CONSEQUENCES

No. Deliverable Time Frame Financial Consequences

The Contractor shall submit the

Implementation Plan timely and in accordance with the PO and any applicable ATC.

The Contractor shall collaborate with the

Customer and submit each Customer’s

Implementation Plan to the Purchaser and each additional Customer within

10 calendar days of PO issuance.

Financial consequences shall be assessed in the amount of $100 per calendar day, beginning on the first calendar day after the deliverable due date until the

Customer Implementation Plan is received.

Financial consequences shall also be assessed for a

Customer’s Implementation Plan submitted that is not in accordance with the PO and any applicable ATC, in the amount of

$500 for each incomplete

Implementation Plan.

The Contractor shall provide

Solution access and all services in the Final Implementation

Plan in accordance with this PO and any applicable ATC.

The Contractor shall provide Solution access and complete all requirements established in the Final

Implementation Plan timely and accurately.

Financial consequences shall be assessed in the amount of $100 per calendar day, beginning on the first calendar day after any due date specified in the Final

Implementation Plan, until the requirement is accurately completed.

Financial consequences shall be assessed in the amount of $200 per requirement for each instance services are not performed, or documentation is not received, in accordance with this RFQ and the Implementation Plan.

DMS-22/23-161 Page 12 of 31

TABLE 1

DELIVERABLES AND FINANCIAL CONSEQUENCES

No. Deliverable Time Frame Financial Consequences

The Contractor shall ensure the

Solution is available in accordance with this PO and any applicable ATC.

The Solution must be available 99.999% of the time per month in accordance with the

FL[DS]-approved SLA and. Compliance is calculated on a monthly basis for each Customer.

Financial Consequences shall be assessed against the Contractor in the amount of $100 for each negative deviation from the thousandth decimal point. For example, a Customer’s monthly uptime of 99.997% will result in a financial consequence of $200, unless the Department accepts different financial consequence in the Contractor’s Quote.

The Contractor shall ensure the

Solution performs in accordance with the FL[DS]-approved SLA.

The Solution must perform in accordance with the

FL[DS]-approved SLA.

Financial consequences shall be assessed in the amount of $100 per calendar day, beginning on the first calendar day after any due date specified in the FL[DS]-approved SLA, until the requirement is accurately completed, unless the

Department accepts different financial consequence in the

Contractor’s Quote.

The Contractor shall ensure training and support are provided in accordance with the

FL[DS]-approved SLA.

Training and support must be provided in accordance with Section 6.2. of this

RFQ and the FL[DS]-approved SLA for training and support.

Financial consequences shall be assessed in the amount of $100 per calendar day, beginning on the first calendar day after any due date specified in the FL[DS]-approved SLA, until the requirement is accurately completed, unless the

Department accepts different financial consequence in the

Contractor’s Quote.

DMS-22/23-161 Page 13 of 31

TABLE 1

DELIVERABLES AND FINANCIAL CONSEQUENCES

No. Deliverable Time Frame Financial Consequences

The Contractor shall report accurate information in accordance with the PO and any applicable ATC.

QBRs are due 15 calendar days after the end of the quarter (January - March, April - June, July -

September, and October -

December).

Monthly Implementation

Reports are due five (5) calendar days after the end of the month.

Monthly Training Reports are due five (5) calendar days after the end of the month.

Monthly Service Reports are due five (5) calendar days after the end of the month.

Ad hoc reports are due five (5) calendar days after the request by the

Purchaser.

Financial consequences shall be assessed in the amount of $100 per calendar day, beginning on the first calendar day after any due date, until an accurate report is received.

All deliverables are subject to the approval and acceptance of the Purchaser. Any deliverables rejected by the Purchaser will be subject to the applicable financial consequences in Table 1 until the Contractor resubmits and the Purchaser accepts the deliverable.

8.0 PERFORMANCE MEASURES

The Contractor shall perform all required services in a proper and satisfactory manner as determined by the Purchaser. The Contractor shall perform 100% of deliverable requirements to the satisfaction of the Purchaser, within the PO-required deadlines.

8.1 Performance Compliance

By submitting a response to this RFQ, the Contractor acknowledges and agrees that its performance under this SOW must meet the standards set forth above and that it will be bound by the conditions set forth herein. After executing an applicable financial consequence, the Purchaser may, at its sole discretion, allow additional time for the

DMS-22/23-161 Page 14 of 31

Contractor to remedy the performance issues identified by the Purchaser; or, after giving the Contractor a reasonable opportunity to cure such performance issues, may proceed with default proceedings.

The Purchaser reserves the right to perform or assign the required services to another contractor, if the awarded Contractor is not achieving the required levels of service, after the Contractor has been duly notified of their inadequacy.

Where any applicable ATC(s) and PO(s) require the generation and submission of deliverables to the Purchaser, receipt by the Purchaser will not be construed to mean or imply acceptance of those deliverables. It is specifically intended by the Purchaser that acceptance of required deliverables constitute a separate act. The Purchaser may reject deliverables as incomplete, inadequate, or unacceptable according to the parameters set forth in this SOW.

By submitting a Quote, the vendor represents and warrants that the Solution substantially conforms or exceeds the specifications herein and will continue to substantially conform or exceed the specifications provided herein throughout the duration of any resultant ATC and PO. The Solution’s failure to substantially conform or exceed these specifications may result in termination of any resultant ATC or PO(s).

9.0 FINANCIAL CONSEQUENCES

The Purchaser shall impose financial consequences upon the Contractor for failure to comply or submit evidence documenting compliance with the performance standard requirements, or deliverable deemed unacceptable by the Purchaser if the Contractor fails to resolve errors, as set forth in Section 7.0, Deliverables. If the Purchaser chooses to allow completion of Contract requirements after the time allowed, its allowance shall not act as a waiver of financial consequences. These financial consequences are not a penalty and are intended to incentivize successful performance of the specified requirements.

The financial consequences assessed will result in a payment or an automatic credit to the Purchaser, at the Purchaser’s discretion. In the event the Purchaser disagrees with a financial consequence assessment by the Contractor, the Purchaser will make the final determination on the Contractor’s compliance with the deliverables and financial consequence assessment.

10.0 RESPONSE CONTENT AND FORMAT

10.1 Responses are due by the date and time shown in Section 11.0, Timeline.

10.2 Quotes shall be concise, in an electronic Adobe PDF format, and prepared using the following outline:

1) Documentation to describe the email security Solution proposed and how it meets the requirements of this RFQ to include the following at a minimum:

a. A draft SLA for Solution performance and availability which adheres to all provisions of this RFQ.

b. A draft SLA for training and support which adheres to all provisions of this

RFQ.

DMS-22/23-161 Page 15 of 31

i. The training SLA must specify initial training (included in Item No. 1 on Attachment A, Price Sheet) provided and ongoing training provided (included in Item No. 2 on Attachment A, Price Sheet).

c. A draft implementation plan for a Customer which adheres to all provisions of this RFQ.

d. A draft SLA for future integrations and/or other services, if applicable, per section 6.6.1 with pricing.

e. A draft disaster recovery plan per section 32.5.

2) Documentation describing any experience providing the Solution, or similar

Solution, on a statewide basis or across a large geographic region.

3) Documentation describing the vendor’s capacity and ability to implement the

Solution on a statewide basis.

4) Detail regarding any value-added services.

5) Attachment A, Price Sheet, containing pricing for Section III for Secure Email

Gateway (SEG) and/or Section IV for Integrated Cloud Email Security (ICES), and completed in accordance with the instructions provided in this RFQ.

6) Attachment B, Contact Information Sheet, containing the contacts for the Quote and the resulting ATC(s) and PO(s).

7) Non-Disclosure Agreement executed by the vendor.

If the vendor is utilizing subcontractors, the vendor shall identify all subcontractors the vendors will utilize to provide the services required by this RFQ and what services each subcontractor will provide.

10.3 All Quotes should be submitted via email to the Department’s Procurement Officer, identified in Section 12.0. Quotes must remain valid for at least 180 calendar days.

Note: If the vendor considers any part of its response to the RFQ to be trade secret or otherwise confidential or exempt from disclosure under Florida or federal law (“Confidential Information”), it shall provide the Department with a copy of its response with such Confidential Information redacted in accordance with Section 21.

11.0 TIMELINE

EVENT DATE

Release of the RFQ May 15, 2023

Pre-Quote Conference

Registration Link:

https://us02web.zoom.us/j/89727892578?pwd=REEwZUwrMmIyVF lDbHZVRTlzbUZHUT09

May 18, 2023, at 2:00 p.m., Eastern Time

Responses Due to the Procurement Officer, via email May 24, 2023, by 5:00 p.m., Eastern Time

Solution Demonstrations and Quote Negotiations May 25-30, 2023

Anticipated Award, via email May 30, 2023 https://us02web.zoom.us/j/89727892578?pwd=REEwZUwrMmIyVFlDbHZVRTlzbUZHUT09 https://us02web.zoom.us/j/89727892578?pwd=REEwZUwrMmIyVFlDbHZVRTlzbUZHUT09

DMS-22/23-161 Page 16 of 31

12.0 PROCUREMENT OFFICER

The Procurement Officer for this RFQ is:

Alisha Morgan Department of Management Services 4050 Esplanade Way Tallahassee, FL 32399-0950 DMS.Purchasing@dms.fl.gov

13.0 PRE-QUOTE CONFERENCE

The Department will hold a Pre-Quote Conference as indicated in Section 11.0, Timeline, above to answer vendor questions. The Department will use its best efforts to answer vendor questions during the Pre-Quote Conference.

14.0 SOLUTION DEMONSTRATIONS

If the Department requests a demonstration of the Solution, the vendor must be available to demonstrate the Solution to the Department during the timeframe specified in Section 11.0, Timeline.

15.0 QUOTE NEGOTIATIONS

The Department may schedule negotiation sessions with vendors to discuss the Quote if any aspects of the Quote are not in the best interest of the Department. These negotiations will be scheduled in the timeframe specified in Section 11.0, Timeline. The Department does not anticipate exceeding these timeframes. The Department may require the vendors to revise any terms and conditions in the vendor’s Quote, including any SLAs, during this timeframe.

16.0 SELECTION OF AWARD

The Department intends to select one (1) or more vendor(s) that provide the overall best value to the State. The Department will consider all aspects of submitted Quotes when making a selection, including the proposed Solution, how it meets the requirements, benefits to the State, and price.

17.0 RFQ HIERARCHY

The ATC(s) and PO(s) resulting from this RFQ will include the following Attachments which set forth the entire understanding of the Customer, the Contractor, and the Department and supersede all prior agreements. All Attachments listed below will be incorporated in their entirety into, and form part of any ATC(s) or PO(s) issued. In the event of a conflict between the documents that make up any ATC(s) and PO(s), priority shall be in the order listed:

1) The PO(s);

2) The ATC(s);

3) The Department’s Non-Disclosure Agreement (NDA) or other Purchaser’s NDA;

4) This RFQ;

5) Department’s Purchase Order Terms and Conditions;

6) The ACS contract the vendor submitted their Quote in accordance with [ACS:

Cloud Solutions (43230000-NASPO-16-ACS), Software Value Added Reseller (SVAR) (43230000-23-NASPO-ACS), or Technology Products, Services, Solutions, and Related Products and Services (43210000-US-16-ACS); and

7) The vendor’s Quote.

mailto:DMS.Purchasing@dms.fl.gov

DMS-22/23-161 Page 17 of 31

18.0 DEPARTMENT’S CONTRACT MANAGER

The Department’s Contract Manager who will oversee the Contractor’s performance of its duties and obligations pursuant to the terms of any applicable ATC and any resultant PO and serve as a liaison with the Contractor, will be as follows:

To Be Determined Florida Department of Management Services Florida Digital Service 2555 Shumard Oak Blvd Tallahassee, FL 32399 purchasing@digital.fl.gov

19.0 PAYMENT

19.1 The Contractor will be compensated in advance, annually, for all Deliverables per PO.

Once the Implementation Plan is approved by the Purchaser, FL[DS] (if applicable) and the Customer in writing, the Contractor shall provide the Customer with access to the software in accordance with the Final Implementation Plan. Once software access is granted to the Customer, and the Customer confirms receipt, the Contractor will submit one (1) invoice to the Contract Manager specified in the PO indicating the date the Customer received the software access.

19.2 On each invoice, the Contractor shall certify that all costs and fees claimed in the invoice statement for payment are accurate and were performed in furtherance of the

PO.

19.3 Contractor compensation will be exclusively made in accordance with the terms of this RFQ, any applicable ATC, and the PO. The Purchaser will not reimburse the Contractor for any other expenses associated with, or related to, any applicable ATC or resultant PO(s). For example, travel related expenses, including lodging, mileage, vehicle rental, and food, will not be subject to reimbursement.

19.4 Purchasers shall pay invoices in accordance with their governing laws and regulations, which shall govern the rights and obligations of the Purchaser and the Contractor. The Department shall pay invoices submitted by the Contractor in accordance with the provisions of section 215.422, F.S., which shall govern the rights and obligations of the Department and the Contractor.

19.5 The Contractor is responsible for the performance of all tasks and deliverables contained in any applicable ATC or PO.

20.0 PUBLIC RECORDS AND DOCUMENT MANAGEMENT

20.1 Access to Public Records

The Department may unilaterally cancel any applicable ATC or PO for failure by the Contractor to comply with this section by not allowing access to all public records, as defined in Chapter 119, F.S., made or received by the Contractor in conjunction with any applicable ATC or PO.

20.2 Contractor as Agent

Solely for the purposes of this section, the Contract Manager specified in the PO is the custodian of public records. If under the PO, the Contractor is providing services and is acting on behalf of a public agency, as provided by section 119.0701, F.S., the Contractor shall:

mailto:Karen.Milicic@digital.fl.gov

DMS-22/23-161 Page 18 of 31

1) Keep and maintain public records required by the public agency to perform the service.

2) Upon request from the public agency’s custodian of public records, provide the public agency with a copy of the requested records or allow the records to be inspected or copied within a reasonable time and at a cost that does not exceed the cost provided in Chapter 119, F.S., or as otherwise provided by law.

3) Ensure that public records that are exempt or confidential and exempt from public records disclosure are not disclosed except as authorized by law for the duration of the PO term and following the completion of the PO if the Contractor does not transfer the records to the public agency.

4) Upon completion of the PO, transfer, at no cost, to the public agency all public records in possession of the Contractor or keep and maintain public records required by the public agency to perform the service. If the Contractor transfers all public records to the public agency upon completion of the PO, the Contractor shall destroy any duplicate public records that are exempt or confidential and exempt from public records disclosure requirements. If the Contractor keeps and maintains public records upon completion of the PO, the Contractor shall meet all applicable requirements for retaining public records. All records stored electronically must be provided to the Purchaser, upon request from the Purchaser’s custodian of public records, in a format that is compatible with the information technology systems of the Purchaser.

5) IF THE CONTRACTOR HAS QUESTIONS REGARDING THE

APPLICATION OF CHAPTER 119, F.S., TO THE

CONTRACTOR’S DUTY TO PROVIDE PUBLIC RECORDS

RELATING TO THE PURCHASE ORDER, CONTACT THE

FOLLOWING CONTACTS:

DEPARTMENT:

CUSTODIAN OF PUBLIC RECORDS

PHONE NUMBER: 850-487-1082

EMAIL: PublicRecords@dms.fl.gov

MAILING ADDRESS: 4050 ESPLANADE WAY, SUITE 160

TALLAHASSEE, FL 32399.

OTHER PURCHASER:

CONTRACT MANAGER SPECIFIED ON THE PO

20.3 Public Records Exemption

The Contractor may have access to cybersecurity information classified as confidential and exempt under section 119.0725, F.S. In the event that the Contractor has access to confidential and exempt information, the Contractor agrees to maintain the confidentiality as required in section 119.0725, F.S.

20.4 Document Management

The Contractor must retain sufficient documentation to substantiate claims for payment under the PO and all other records, electronic files, papers, and documents that were made in relation to the PO. The Contractor must retain all documents mailto:PublicRecords@dms.fl.gov

DMS-22/23-161 Page 19 of 31 related to the PO for five (5) years after the expiration of the PO, or, if longer, the period required by the General Records Schedules maintained by the Florida Department of State available at the Department of State’s Records Management website.

21.0 IDENITIFICATION AND PROTECTION OF CONFIDENTIAL INFORMATION

Article 1, section 24, Florida Constitution, guarantees every person access to all public records, and section 119.011, F.S., provides a broad definition of “public records.” As such, records submitted to an Agency as defined in section 119.011, F.S. (referred to for purposes of this Section 19 as “Agency”) are public records and are subject to disclosure unless exempt from disclosure by law. If the vendor considers any portion of records it provides to an Agency (including those submitted in response to this RFQ) to be trade secret or otherwise confidential or exempt from disclosure under Florida or federal law (“Confidential Information”), the vendor shall mark the document as “confidential” and simultaneously provide that Agency with a separate, redacted copy of the record. For each portion redacted, the vendor should briefly describe in writing the grounds for claiming exemption, including the specific statutory citation for such exemption. The vendor shall only redact portions of records that it claims are Confidential Information.

In the event of a request for public records pursuant to Chapter 119, F.S., the Florida Constitution, or other authority, to which records that are marked as “confidential” are responsive, the Agency will provide the vendor-redacted copy to the requestor. If a requestor asserts a right to the redacted Confidential Information, the Agency will notify the vendor such an assertion has been made. It is the vendor’s responsibility to take the appropriate legal action to assert that the information in question is exempt from disclosure under Chapter 119, F.S., or other applicable law.

If the Agency becomes subject to a demand for discovery or disclosure of documents that are marked as “confidential” in a legal proceeding, the Agency will give the vendor notice of the demand or request. The vendor shall take the appropriate legal action in response to the demand and to defend its claims of confidentiality. If the vendor fails to take appropriate and timely action to protect the records it has designated as Confidential Information, the Agency will provide the unredacted records to the requester.

The vendor shall protect, defend, and indemnify the Agency and any applicable Customer for all claims, costs, fines, and attorneys’ fees arising from or relating to the vendor’s determination that the redacted portions of its records are Confidential Information. If the vendor fails to submit a redacted copy in accordance with this section, of information it claims is Confidential Information, the Agency is authorized to produce the entire record submitted to the Agency in response to a public records request for, or demand for discovery or disclosure of, these records.

22.0 USE OF SUBCONTRACTORS

In providing services under the PO(s) and any applicable ATC, the Contractor is permitted to utilize subcontractors identified in its Quote. The Contractor shall notify the Contract Manager specified on the PO in writing of any subcontractors not identified in the Contractor’s Quote who will be engaged to provide services for a PO 10 calendar days prior to their engagement.

During the term of the PO, subcontractors may be substituted with the prior written approval of the Contract Manager specified on the PO. The Purchaser reserves the right to reject a subcontractor with 10 calendar days advance notification to the Contractor.

DMS-22/23-161 Page 20 of 31

The Contractor is fully responsible for the satisfactory completion of all subcontracted work and is required to ensure subcontractor’s adherence to the terms set forth any PO.

The Contractor shall make all payments to subcontractors. If the Contractor utilizes a subcontractor, the Contractor shall pay the subcontractor within seven (7) Business Days after any payment is received from the Purchaser, per section 287.0585, F.S. It is understood, and agreed upon, that the Department shall not be held accountable to any subcontractor for any expenses or liabilities incurred under the subcontract, and that the Contractor is solely responsible to the subcontractor for all expenses and liabilities under the Contract. If the Contractor fails to pay the subcontractor within seven (7) Business Days, the Contractor shall pay the penalty to the subcontractor in the amount of one-half (1/2) of one percent (1%) of the amount due, per Calendar Day, from the expiration of the period allowed herein for payment. Such penalty shall be in addition to actual payments owed and shall not exceed 15% of the outstanding balance due.

23.0 LEGISLATIVE APPROPRIATION

Pursuant to section 287.0582, F.S., the State of Florida’s performance and obligation to pay under any PO is contingent upon an annual appropriation by the Legislature.

24.0 MODIFICATIONS

The Department reserves the right to change, add or delete any requirement from this RFQ if the Department deems it to be in the best interest of the State of Florida. In addition, the Department reserves the right to withdraw and cancel this RFQ at any time, prior to a duly authorized and executed ATC or PO.

25.0 CONFLICT OF INTEREST

It is essential that the vendor and any subcontractors are independent and impartial and that the implementation of decisions made as it relates to consultation and services is not used for private gain or other remuneration. The Contractor shall not receive any monies for services provided under the PO aside from those paid pursuant to the PO.

26.0 DISCRIMINATIORY, CONVICTED AND ANTITRUST VENDORS LISTS

The vendor is hereby informed of the provisions of sections 287.133(2)(a), 287.134(2)(a), and 287.137(2)(a), F.S., that identify the impacts to the vendor 's ability or its affiliates’ ability to respond to the competitive solicitations of a public entity; to be awarded or perform work as a contractor, supplier, subcontractor, or consultant under a contract with a public entity;

or to transact business with a public entity if it, or its affiliates, are placed on the Convicted Vendor, Discriminatory Vendor, or Antitrust Violator Vendor Lists of the Department of Management Services. The Contractor shall promptly notify the Purchaser if it or its suppliers, subcontractors, or consultants under any POs are placed on any such lists.

27.0 E-VERIFY

The Contractor (and its subcontractors) has an obligation to utilize the U.S. Department of Homeland Security’s (DHS) E-Verify system for all newly hired employees in accordance with section 448.095, F.S. By accepting the ATC or any PO(s), the Contractor certifies that it is registered with, and uses, the E-Verify system for all newly hired employees in accordance with section 448.095, F.S. The Contractor must obtain an affidavit from its subcontractors in accordance with paragraph (2)(b) of section 448.095, F.S., and maintain a copy of such affidavit for the duration of any applicable ATC(s) and any PO(s). The Contractor shall provide a copy of its DHS Memorandum of Understanding (MOU) to the Contract Manager

DMS-22/23-161 Page 21 of 31 specified on the PO within five (5) business days of issuance of the ATC or any PO(s). The Contract Manager will be designated on any applicable ATC and PO.

This section serves as notice to the Contractor regarding the requirements of section 448.095, F.S., specifically sub-paragraph (2)(c)1, and the Department’s obligation to terminate the ATC and any other Purchaser’s obligation to terminate any PO(s) if it has a good faith belief that the Contractor has knowingly violated section 448.09(1), F.S. If terminated for such reason, the Contractor will not be eligible for award of a public contract for at least one (1) year after the date of such termination.