DMS-2223-162-Incident-Response.final.pdf

2555 Shumard Oak Blvd. • Tallahassee, FL 32399 • digital.fl.gov Pedro Allende, Secretary

Florida Department of Management Services

Ron DeSantis, Florida Governor James Grant, Florida State Chief Information Officer

Request for Quotes (RFQ)

DMS-22/23-162

Cybersecurity Incident Response Solution

Alternate Contract Sources:

Cloud Solutions (43230000-NASPO-16-ACS)

Software Value Added Reseller (SVAR) (43230000-23-NASPO-ACS)

Technology Products, Services, Solutions, and Related Products and Services (43210000-US-16-ACS)

1.0 DEFINITIONS

The following definitions shall apply throughout this RFQ:

Agency Term Contract (ATC): The written agreement resulting from the award of this Request for Quotes between the Department and the Contractor(s).

Contractor: The vendor awarded an ATC resulting for this Request for Quotes.

Customer: Agencies as defined in section 287.012, Florida Statute (F.S.), and Eligible Users as defined in Rule 60A-1.001, Florida Administrative Code (F.A.C.).

Department: The State of Florida, Department of Management Services (DMS), on behalf of the Florida Digital Service (FL[DS]).

Purchase Order: The authorization to begin providing services to a Customer under the terms of this RFQ and a resulting ATC, if applicable.

Purchaser: The agency as defined in section 287.012, F.S., or Eligible User, as defined in Rule 60A-1.001, Florida Administrative Code (F.A.C.), who issues a Purchase Order from this RFQ or a resulting ATC.

Quote: A vendor’s response to this Request for Quotes.

Solution: A cybersecurity incident response solution that includes a catalog of objectives to minimize cyber threats, detect and respond to incidents, and protect critical systems and data within the state's digital infrastructure.

DMS-22/23-162 Page 2 of 25 Cybersecurity Incident Response Solution

2.0 OBJECTIVE

Pursuant to section 287.056(2), F.S., the Department intends to purchase an incident response solution to minimize cyber threats, detect and respond to incidents, and protect critical systems and data within the state's digital infrastructure for use by the Department and Customers to respond to threats as specified in this RFQ.

The Department also reserves the right to execute an Agency Term Contract (ATC), in the form attached hereto, with the awarded Contractor(s) for the Solution specified in this RFQ.

The ATC will allow the Department and Customers to purchase the Solution at or below the pricing provided by the awarded Contractor(s) throughout the ATC term.

This RFQ is being issued under the following Alternate Contract Source (ACS) contracts:

• Cloud Solutions (43230000-NASPO-16-ACS)

• Software Value Added Reseller (43230000-23-NASPO-ACS)

• Technology Products, Services, Solutions, and Related Products and Services

(43210000-US-16-ACS)

3.0 DESCRIPTION OF PURCHASE

The Department is seeking a Contractor(s) to provide incident response to minimize cyber threats, detect and respond to incidents, and protect critical systems and data within the state's digital infrastructure for the Department and Customers on a statewide basis. The Solution shall include the scope of work as described below. The Contractor shall be responsible for all aspects of providing the Solution to Customers, as provided herein.

4.0 BACKGROUND INFORMATION

In accordance with section 282.318, F.S., the “State Cybersecurity Act,” the Department "is the lead entity responsible for establishing standards and processes for assessing state agency cybersecurity risks and determining appropriate security measures.” Additionally, the statute states that the Department “shall adopt rules that mitigate risks; safeguard state agency digital assets, data, information, and information technology resources to ensure availability, confidentiality, and integrity; and support a security governance framework.”

The Department is also responsible for implementing the recommendations of the February 1, 2021, Florida Cybersecurity Task Force Final Report which addresses key objectives related to the state’s cybersecurity infrastructure, governance, and operations. The resulting initiatives, projects, and efforts constitute the Enterprise Cybersecurity Resiliency Program.

Additionally, in accordance with section 282.3185, F.S., the “Local Government Cybersecurity Act,” “Each local government shall adopt cybersecurity standards that safeguard its data, information technology, and information technology resources to ensure availability, confidentiality, and integrity. The cybersecurity standards must be consistent with generally accepted best practices for cybersecurity, including the National Institute of Standards and Technology Cybersecurity Framework.” In the Fiscal Year 2022-2023 General Appropriations Act (line 2944A), the Department was tasked with administering a competitive grant program for local government cybersecurity technical assistance for municipalities and counties. The Department intends to provide access to solutions to equip Customers with resources compliant with the abovementioned cybersecurity standards.

DMS-22/23-162 Page 3 of 25

5.0 TERM

The ATC(s) shall have an initial term of three (3) years, subject to any limitations based on the term of the underlying ACS. The Department also reserves the right to renew the ATC(s) in accordance with section 287.057, F.S, and subject to any limitations based on the term of the underlying ACS. Renewals are also contingent upon satisfactory performance by the Contractor, as determined by the Department. Purchase Orders (PO) will be issued in accordance with the RFQ and any applicable ATC as services are needed for Customers.

Any POs issued pursuant to the RFQ will have the term identified in the PO.

6.0 SCOPE OF WORK

The Solution proposed in any Quote must not conflict with Chapter 282, F.S., Rule Title 60GG, Florida Administrative Code (F.A.C.), and cybersecurity best practices. The objective must meet or exceed the applicable state and federal laws, regulations, and standards for cybersecurity, including the National Institute of Standards and Technology Cybersecurity Framework. The Contractor shall provide objectives in the manner prescribed by this Scope of Work. The Scope of Work shall be delivered in accordance with the deliverables herein. Unless otherwise specified within vendor’s Quote, the Solution should include the following items within the Scope of Work, but not be limited to:

6.1. Solution Specifications

If an objective is requested and approved by the Purchaser, the Solution shall provide a robust and proactive cybersecurity posture for the State of Florida. The Solution aims to minimize cyber threats, detect, and respond to incidents, and protect critical systems and data within the Customer's digital infrastructure rapidly based on the Service Level Agreement (SLA) per each objective.

6.1.1. Threat Monitoring and Detection Objective

6.1.1.1. The Solution shall provide continuous monitoring of the

Customer’s environment using advanced security tools and technologies during the term of the objective.

6.1.1.2. The Solution shall provide detection and analysis of potential cybersecurity threats, including malware, intrusion attempts, and suspicious activities during the term of the objective.

6.1.1.3. The Solution shall provide real-time alerting and reporting of identified threats to enable timely response and mitigation actions during the term of the objective.

6.1.2. Incident Response and Management Objective

6.1.2.1. The Solution shall provide immediate response and assistance in the event of a cybersecurity incident, following established incident response procedures and best practices during the term of the objective.

6.1.2.2. The Solution shall provide incident assessment, containment, investigation, and recovery activities to minimize the impact on critical systems and data during the term of the objective.

DMS-22/23-162 Page 4 of 25

6.1.2.3. The Solution shall provide collaboration with relevant state agencies, departments, and other stakeholders during incident response efforts during the term of the objective.

6.1.3. Vulnerability Management Objective

6.1.3.1. The Solution shall provide regular vulnerability assessments and scans to identify weaknesses and potential vulnerabilities in the state's digital infrastructure during the term of the objective.

6.1.3.2. The Solution shall provide analysis and prioritization of identified vulnerabilities, providing guidance on remediation strategies and mitigation measures during the term of the objective.

6.1.3.3. The Solution shall provide ongoing monitoring and reporting of the state's vulnerability landscape to proactively address emerging threats during the term of the objective.

6.1.4. Proactive Security Measures Objective

6.1.4.1. The Solution shall provide implementation of proactive security controls, such as firewall management, intrusion detection and prevention systems, and security information and event management (SIEM) solutions.

6.1.4.2. The Solution shall provide configuration and management of security tools and technologies to ensure optimal performance and effectiveness.

6.1.4.3. The Solution shall provide security policy development, review, and enforcement to align with industry best practices and regulatory requirements.

6.1.5. Training Objective

6.1.5.1. The Solution shall provide cybersecurity training sessions, including tabletop exercises for Customers to run situational drill(s).

6.1.5.2. The Solution shall include training content to address specific Customer needs, including incident response, security awareness, and best practices.

6.1.5.3. The Solution shall provide materials, resources, and knowledge transfer to enhance the Customer’s ability to respond to an incident.

DMS-22/23-162 Page 5 of 25

6.1.6. Cybersecurity Intel Objective

The Solution shall gather, analyze, and provide intelligence on emerging cyber threats, vulnerabilities, and trends relevant to the Customer’s environment.

6.1.7. Cybersecurity Readiness Objective

6.1.7.1. The Solution shall assess the Customer's cybersecurity readiness through comprehensive evaluations, including penetration testing.

6.1.7.2. The Solution shall conduct penetration testing to identify vulnerabilities and exploit them in a controlled manner to assess the effectiveness of security controls.

6.1.7.3. The Solution shall provide detailed reports to the Purchaser and/or the Customer, and recommendations to address the identified vulnerabilities and enhance the Customer's overall cybersecurity readiness.

6.1.8. Compliance and Third-Party Certification

The Solution shall comply with relevant standards like General Data Protection Regulation (GDPR), Criminal Justice Information Services (CJIS), Health Insurance Portability and Accountability Act (HIPAA), Family Educational Rights and Privacy Act, Personally Identifiable Information (PII) data requirements, Driver Privacy Protection Act, and third-party certifications such as Systems and Organizations Controls 2 (SOC 2) and International Organization for Standardization (ISO) 27001. The Department, Purchaser, or Customer may require Contractor(s) to execute security agreements, including but not limited to, CJIS riders or Business Associate Agreements as a condition of performance or purchase order issuance.

6.1.9. Performance and Availability

The Solution shall perform in accordance with the approved Service Level Agreement (SLA) per objective.

6.1.9.1. The performance and availability SLA shall provide information on performance and availability for each objective within the Solution to perform successfully. The vendor shall determine and assign the amount of units for each objective to be successfully accomplished and provide this information in the SLA.

6.1.9.2. The vendor shall propose meaningful financial consequences in the draft performance and availability SLA submitted with their Quote, which will be incorporated in the FL[DS]-approved financial consequences.

DMS-22/23-162 Page 6 of 25

6.2. Kickoff Meetings

6.2.1. The Contractor shall conduct an initial kickoff meeting on a date and time agreed upon with the Purchaser to further clarify PO expectations.

6.2.2. Each time an objective is activated, the Contractor shall conduct a kickoff meeting with the Purchaser to clarify expectations for the objective. If the PO covers more than just the Purchaser, the Contractor shall also include the Customer in the kickoff meeting.

6.3. Reporting

6.3.1. The Contractor shall document completion of each objective with a final report submitted to the Purchaser to document how the SLA requirements were successfully completed.

6.3.2. The Contractor shall provide ad hoc reports to the Purchaser as requested, for any objectives activated during the term of the Solution.

6.4. Additional Objectives (Optional)

6.4.1. Other Incident Response Objectives

If available, the vendor shall propose any other optional incident response objectives that may provide value if included in the Solution. The vendor must provide an SLA for any other incident response objectives included in the vendor’s Quote. If an SLA is provided for any other incident response objectives, the vendor shall determine and allocate the amount of units for each objective to be successfully accomplished and provide this information in the SLA.

7.0 DELIVERABLES

Deliverables for each Purchase Order may be submitted earlier than the delivery dates listed in Table 1. All deliverables are subject to the approval and acceptance of the Purchaser. The Contractor shall provide the objectives identified in Section 6.0, Scope of Work, to complete the deliverables as described in Table 1 below. The Contractor will not be compensated for the kickoff meetings, or any work performed outside of an activated objective. The Contractor will invoice the Purchaser at the pricing established in Attachment A, Price Sheet, within thirty

(30) days of PO issuance. The Contractor will be compensated, annually, in advance, for the Solution for each PO in accordance with this RFQ. The Purchaser may waive or amend any due dates in writing at its sole discretion.

TABLE 1

DELIVERABLES AND FINANCIAL CONSEQUENCES

No. Deliverable Time Frame Financial Consequences

The Contractor shall host an initial kickoff meeting with the

Purchaser in accordance with the PO, and any applicable

ATC.

The Contractor shall host the meeting within five (5) calendar days of PO issuance.

Financial consequences shall be assessed in the amount of $100 per calendar day, beginning on the first calendar day after deliverable due date.

DMS-22/23-162 Page 7 of 25

TABLE 1

DELIVERABLES AND FINANCIAL CONSEQUENCES

No. Deliverable Time Frame Financial Consequences

The Contractor shall host a kickoff meeting with the

Purchaser, and Customer if applicable, each time an objective is activated to clarify expectations.

The Contractor shall host the meeting within one (1) calendar day of PO issuance.

Financial consequences shall be assessed in the amount of $100 per calendar day, beginning on the first calendar day after deliverable due date.

The Contractor shall ensure the

Solution is provided in accordance with the FL[DS]-approved SLA per objective.

The Solution must perform in accordance with the

FL[DS]-approved SLA per objective.

Financial consequences shall be assessed in the amount of $100 per calendar day, beginning on the first calendar day after any due date specified in the FL[DS]-approved SLA, until the requirement is accurately completed, unless the

Department accepts different financial consequence in the

Contractor’s Quote.

The Contractor shall report accurate information in accordance with the PO and any applicable ATC.

All objective completion reports are due five (5) calendar days after an objective is completed.

Ad hoc reports for all objectives activated are due five (5) calendar days after the request by the

Purchaser.

Financial consequences shall be assessed in the amount of $100 per calendar day, beginning on the first calendar day after any due date, until an accurate report is received.

All deliverables are subject to the approval and acceptance of the Purchaser. Any deliverables rejected by the Purchaser will be subject to the applicable financial consequences in Table 1 until the Contractor resubmits and the Purchaser accepts the deliverable.

8.0 PERFORMANCE MEASURES

The Contractor shall perform all required objectives in a proper and satisfactory manner as determined by the Purchaser. The Contractor shall perform 100% of deliverable requirements to the satisfaction of the Purchaser, within the PO-required deadlines.

8.1 Performance Compliance

By submitting a response to this RFQ, the Contractor acknowledges and agrees that its performance under this SOW must meet the standards set forth above and that it will be bound by the conditions set forth herein. After executing an applicable financial

DMS-22/23-162 Page 8 of 25 consequence, the Purchaser may, at its sole discretion, allow additional time for the Contractor to remedy the performance issues identified by the Purchaser; or, after giving the Contractor a reasonable opportunity to cure such performance issues, may proceed with default proceedings.

The Purchaser reserves the right to perform or assign the required services to another contractor, if the awarded Contractor is not achieving the required levels of service, after the Contractor has been duly notified of their inadequacy.

Where any applicable ATC(s) and PO(s) require the generation and submission of deliverables to the Purchaser, receipt by the Purchaser will not be construed to mean or imply acceptance of those deliverables. It is specifically intended by the Purchaser that acceptance of required deliverables constitute a separate act. The Purchaser may reject deliverables as incomplete, inadequate, or unacceptable according to the parameters set forth in this SOW.

By submitting a Quote, the vendor represents and warrants that the Solution substantially conforms or exceeds the specifications herein and will continue to substantially conform or exceed the specifications provided herein throughout the duration of any resultant ATC and PO. The Solution’s failure to substantially conform or exceed these specifications may result in termination of any resultant ATC or PO(s).

9.0 FINANCIAL CONSEQUENCES

The Purchaser shall impose financial consequences upon the Contractor for failure to comply or submit evidence documenting compliance with the performance standard requirements, or deliverable deemed unacceptable by the Purchaser if the Contractor fails to resolve errors, as set forth in Section 7.0, Deliverables. If the Purchaser chooses to allow completion of Contract requirements after the time allowed, its allowance shall not act as a waiver of financial consequences. These financial consequences are not a penalty and are intended to incentivize successful performance of the specified requirements.

The financial consequences assessed will result in a payment or an automatic credit to the Purchaser, at the Purchaser’s discretion. In the event the Purchaser disagrees with a financial consequence assessment by the Contractor, the Purchaser will make the final determination on the Contractor’s compliance with the deliverables and financial consequence assessment.

10.0 RESPONSE CONTENT AND FORMAT

10.1 Responses are due by the date and time shown in Section 11.0, Timeline.

10.2 Quotes shall be concise, in an electronic Adobe PDF format, and prepared using the following outline:

1) Documentation to describe the cybersecurity incident response Solution proposed and how it meets the requirements of this RFQ to include the following at a minimum:

a. A draft SLA for performance and availability for each objective within the

Solution.

DMS-22/23-162 Page 9 of 25

b. Detail regarding any other optional incident response objectives that may provide value if included in the Solution, if applicable, per section 6.4.1, including a draft SLA for each objective.

c. A draft disaster recovery plan per section 32.5.

2) Documentation describing any experience providing the Solution, or similar

Solution, on a statewide basis or across a large geographic region.

3) Documentation describing the vendor’s capacity and ability to implement the

Solution on a statewide basis.

4) Detail regarding any value-added services.

5) Attachment A, Price Sheet, containing pricing for all items and completed in accordance with the instructions provided in this RFQ.

6) Attachment B, Contact Information Sheet, containing the contacts for the Quote and the resulting ATC(s) and PO(s).

7) Non-Disclosure Agreement executed by the vendor.

If the vendor is utilizing subcontractors, the vendor shall identify all subcontractors the vendors will utilize to provide the objectives required by this RFQ and what objectives each subcontractor will provide.

10.3 All Quotes should be submitted via email to the Department’s Procurement Officer, identified in Section 12.0. Quotes must remain valid for at least 180 calendar days.

Note: If the vendor considers any part of its response to the RFQ to be trade secret or otherwise confidential or exempt from disclosure under Florida or federal law (“Confidential Information”), it shall provide the Department with a copy of its response with such Confidential Information redacted in accordance with Section 19.

11.0 TIMELINE

EVENT DATE

Release of the RFQ May 19, 2023

Pre-Quote Conference

Registration Link:

https://us02web.zoom.us/meeting/register/tZAqdeCqrzMoEtB

LEJEkh6kxpNAJyViwmhr9

May 30, 2023, at 2:00 p.m., Eastern Time

Responses Due to the Procurement Officer, via email June 5, 2023, by 5:00 p.m., Eastern Time

Solution Demonstrations and Quote Negotiations June 6-9, 2023

Anticipated Award, via email June 9, 2023 https://us02web.zoom.us/meeting/register/tZAqdeCqrzMoEtBLEJEkh6kxpNAJyViwmhr9 https://us02web.zoom.us/meeting/register/tZAqdeCqrzMoEtBLEJEkh6kxpNAJyViwmhr9

DMS-22/23-162 Page 10 of 25

12.0 PROCUREMENT OFFICER

The Procurement Officer for this RFQ is:

Alisha Morgan Department of Management Services 4050 Esplanade Way Tallahassee, FL 32399-0950 DMS.Purchasing@dms.fl.gov

13.0 PRE-QUOTE CONFERENCE

The Department will hold a Pre-Quote Conference as indicated in Section 11.0, Timeline, above to answer vendor questions. The Department will use its best efforts to answer vendor questions during the Pre-Quote Conference.

14.0 SOLUTION DEMONSTRATIONS

If the Department requests a demonstration of the Solution, the vendor must be available to demonstrate the Solution to the Department during the timeframe specified in Section 11.0, Timeline.

15.0 QUOTE NEGOTIATIONS

The Department may schedule negotiation sessions with vendors to discuss the Quote if any aspects of the Quote are not in the best interest of the Department. These negotiations will be scheduled in the timeframe specified in Section 11.0, Timeline. The Department does not anticipate exceeding these timeframes. The Department may require the vendors to revise any terms and conditions in the vendor’s Quote, including any SLAs, during this timeframe.

16.0 SELECTION OF AWARD

The Department intends to select one (1) or more vendor(s) that provide the overall best value to the State. The Department will consider all aspects of submitted Quotes when making a selection, including the proposed Solution, how it meets the requirements, benefits to the State, and price.

17.0 RFQ HIERARCHY

The ATC(s) and PO(s) resulting from this RFQ will include the following Attachments which set forth the entire understanding of the Customer, the Contractor, and the Department and supersede all prior agreements. All Attachments listed below will be incorporated in their entirety into, and form part of any ATC(s) or PO(s) issued. In the event of a conflict between the documents that make up any ATC(s) and PO(s), priority shall be in the order listed:

1) The PO(s);

2) The ATC(s);

3) The Department’s Non-Disclosure Agreement (NDA) or other Purchaser’s NDA;

4) This RFQ;

5) Department’s Purchase Order Terms and Conditions;

6) The ACS contract the vendor submitted their Quote in accordance with [ACS:

Cloud Solutions (43230000-NASPO-16-ACS), Software Value Added Reseller (SVAR) (43230000-23-NASPO-ACS), or Technology Products, Services, Solutions, and Related Products and Services (43210000-US-16-ACS); and

7) The vendor’s Quote.

mailto:DMS.Purchasing@dms.fl.gov

DMS-22/23-162 Page 11 of 25

18.0 DEPARTMENT’S CONTRACT MANAGER

The Department’s Contract Manager who will oversee the Contractor’s performance of its duties and obligations pursuant to the terms of any applicable ATC and any resultant PO and serve as a liaison with the Contractor, will be as follows:

To Be Determined

Florida Digital Service 2555 Shumard Oak Blvd Tallahassee, FL 32399 purchasing@digital.fl.gov

19.0 PAYMENT

19.1 The Contractor will be compensated in advance, annually, for the Solution per PO.

Once a PO is issued the Contractor will submit one (1) invoice to the Contract Manager specified in the PO for all objectives included in the Solution.

19.2 On each invoice, the Contractor shall certify that all costs and fees claimed in the invoice statement for payment are accurate and were performed in furtherance of the

PO.

19.3 Contractor compensation will be exclusively made in accordance with the terms of this RFQ, any applicable ATC, and the PO. The Purchaser will not reimburse the Contractor for any other expenses associated with, or related to, any applicable ATC or resultant PO(s). For example, travel related expenses, including lodging, mileage, vehicle rental, and food, will not be subject to reimbursement.

19.4 Purchasers shall pay invoices in accordance with their governing laws and regulations, which shall govern the rights and obligations of the Purchaser and the Contractor. The Department shall pay invoices submitted by the Contractor in accordance with the provisions of section 215.422, F.S., which shall govern the rights and obligations of the Department and the Contractor.

19.5 The Contractor is responsible for the performance of all tasks and deliverables contained in any applicable ATC or PO.

20.0 PUBLIC RECORDS AND DOCUMENT MANAGEMENT

20.1 Access to Public Records

The Department may unilaterally cancel any applicable ATC or PO for failure by the Contractor to comply with this section by not allowing access to all public records, as defined in Chapter 119, F.S., made or received by the Contractor in conjunction with any applicable ATC or PO.

20.2 Contractor as Agent

Solely for the purposes of this section, the Contract Manager specified in the PO is the custodian of public records. If under the PO, the Contractor is providing services and is acting on behalf of a public agency, as provided by section 119.0701, F.S., the Contractor shall:

1) Keep and maintain public records required by the public agency to perform the service.

2) Upon request from the public agency’s custodian of public records, provide the public agency with a copy of the requested records or allow the records to be mailto:Karen.Milicic@digital.fl.gov

DMS-22/23-162 Page 12 of 25 inspected or copied within a reasonable time and at a cost that does not exceed the cost provided in Chapter 119, F.S., or as otherwise provided by law.

3) Ensure that public records that are exempt or confidential and exempt from public records disclosure are not disclosed except as authorized by law for the duration of the PO term and following the completion of the PO if the Contractor does not transfer the records to the public agency.

4) Upon completion of the PO, transfer, at no cost, to the public agency all public records in possession of the Contractor or keep and maintain public records required by the public agency to perform the service. If the Contractor transfers all public records to the public agency upon completion of the PO, the Contractor shall destroy any duplicate public records that are exempt or confidential and exempt from public records disclosure requirements. If the Contractor keeps and maintains public records upon completion of the PO, the Contractor shall meet all applicable requirements for retaining public records. All records stored electronically must be provided to the Purchaser, upon request from the Purchaser’s custodian of public records, in a format that is compatible with the information technology systems of the Purchaser.

5) IF THE CONTRACTOR HAS QUESTIONS REGARDING THE

APPLICATION OF CHAPTER 119, F.S., TO THE

CONTRACTOR’S DUTY TO PROVIDE PUBLIC RECORDS

RELATING TO THE PURCHASE ORDER, CONTACT THE

FOLLOWING CONTACTS:

DEPARTMENT:

CUSTODIAN OF PUBLIC RECORDS

PHONE NUMBER: 850-487-1082

EMAIL: PublicRecords@dms.fl.gov

MAILING ADDRESS: 4050 ESPLANADE WAY, SUITE 160

TALLAHASSEE, FL 32399.

OTHER PURCHASER:

CONTRACT MANAGER SPECIFIED ON THE PO

20.3 Public Records Exemption

The Contractor may have access to cybersecurity information classified as confidential and exempt under section 119.0725, F.S. In the event that the Contractor has access to confidential and exempt information, the Contractor agrees to maintain the confidentiality as required in section 119.0725, F.S.

20.4 Document Management

The Contractor must retain sufficient documentation to substantiate claims for payment under the PO and all other records, electronic files, papers, and documents that were made in relation to the PO. The Contractor must retain all documents related to the PO for five (5) years after the expiration of the PO, or, if longer, the period required by the General Records Schedules maintained by the Florida mailto:PublicRecords@dms.fl.gov

DMS-22/23-162 Page 13 of 25

Department of State available at the Department of State’s Records Management website.

21.0 IDENITIFICATION AND PROTECTION OF CONFIDENTIAL INFORMATION

Article 1, section 24, Florida Constitution, guarantees every person access to all public records, and section 119.011, F.S., provides a broad definition of “public records.” As such, records submitted to an Agency as defined in section 119.011, F.S. (referred to for purposes of this Section 19 as “Agency”) are public records and are subject to disclosure unless exempt from disclosure by law. If the vendor considers any portion of records it provides to an Agency (including those submitted in response to this RFQ) to be trade secret or otherwise confidential or exempt from disclosure under Florida or federal law (“Confidential Information”), the vendor shall mark the document as “confidential” and simultaneously provide that Agency with a separate, redacted copy of the record. For each portion redacted, the vendor should briefly describe in writing the grounds for claiming exemption, including the specific statutory citation for such exemption. The vendor shall only redact portions of records that it claims are Confidential Information.

In the event of a request for public records pursuant to Chapter 119, F.S., the Florida Constitution, or other authority, to which records that are marked as “confidential” are responsive, the Agency will provide the vendor-redacted copy to the requestor. If a requestor asserts a right to the redacted Confidential Information, the Agency will notify the vendor such an assertion has been made. It is the vendor’s responsibility to take the appropriate legal action to assert that the information in question is exempt from disclosure under Chapter 119, F.S., or other applicable law.

If the Agency becomes subject to a demand for discovery or disclosure of documents that are marked as “confidential” in a legal proceeding, the Agency will give the vendor notice of the demand or request. The vendor shall take the appropriate legal action in response to the demand and to defend its claims of confidentiality. If the vendor fails to take appropriate and timely action to protect the records it has designated as Confidential Information, the Agency will provide the unredacted records to the requester.

The vendor shall protect, defend, and indemnify the Agency and any applicable Customer for all claims, costs, fines, and attorneys’ fees arising from or relating to the vendor’s determination that the redacted portions of its records are Confidential Information. If the vendor fails to submit a redacted copy in accordance with this section, of information it claims is Confidential Information, the Agency is authorized to produce the entire record submitted to the Agency in response to a public records request for, or demand for discovery or disclosure of, these records.

22.0 USE OF SUBCONTRACTORS

In providing services under the PO(s) and any applicable ATC, the Contractor is permitted to utilize subcontractors identified in its Quote. The Contractor shall notify the Contract Manager specified on the PO in writing of any subcontractors not identified in the Contractor’s Quote who will be engaged to provide services for a PO 10 calendar days prior to their engagement.

During the term of the PO, subcontractors may be substituted with the prior written approval of the Contract Manager specified on the PO. The Purchaser reserves the right to reject a subcontractor with 10 calendar days advance notification to the Contractor.

The Contractor is fully responsible for the satisfactory completion of all subcontracted work and is required to ensure subcontractor’s adherence to the terms set forth any PO.

DMS-22/23-162 Page 14 of 25

The Contractor shall make all payments to subcontractors. If the Contractor utilizes a subcontractor, the Contractor shall pay the subcontractor within seven (7) Business Days after any payment is received from the Purchaser, per section 287.0585, F.S. It is understood, and agreed upon, that the Department shall not be held accountable to any subcontractor for any expenses or liabilities incurred under the subcontract, and that the Contractor is solely responsible to the subcontractor for all expenses and liabilities under the Contract. If the Contractor fails to pay the subcontractor within seven (7) Business Days, the Contractor shall pay the penalty to the subcontractor in the amount of one-half (1/2) of one percent (1%) of the amount due, per Calendar Day, from the expiration of the period allowed herein for payment. Such penalty shall be in addition to actual payments owed and shall not exceed 15% of the outstanding balance due.

23.0 LEGISLATIVE APPROPRIATION

Pursuant to section 287.0582, F.S., the State of Florida’s performance and obligation to pay under any PO is contingent upon an annual appropriation by the Legislature.

24.0 MODIFICATIONS

The Department reserves the right to change, add or delete any requirement from this RFQ if the Department deems it to be in the best interest of the State of Florida. In addition, the Department reserves the right to withdraw and cancel this RFQ at any time, prior to a duly authorized and executed ATC or PO.

25.0 CONFLICT OF INTEREST

It is essential that the vendor and any subcontractors are independent and impartial and that the implementation of decisions made as it relates to consultation and services is not used for private gain or other remuneration. The Contractor shall not receive any monies for services provided under the PO aside from those paid pursuant to the PO.

26.0 DISCRIMINATIORY, CONVICTED AND ANTITRUST VENDORS LISTS

The vendor is hereby informed of the provisions of sections 287.133(2)(a), 287.134(2)(a), and 287.137(2)(a), F.S., that identify the impacts to the vendor 's ability or its affiliates’ ability to respond to the competitive solicitations of a public entity; to be awarded or perform work as a contractor, supplier, subcontractor, or consultant under a contract with a public entity;

or to transact business with a public entity if it, or its affiliates, are placed on the Convicted Vendor, Discriminatory Vendor, or Antitrust Violator Vendor Lists of the Department of Management Services. The Contractor shall promptly notify the Purchaser if it or its suppliers, subcontractors, or consultants under any POs are placed on any such lists.

27.0 E-VERIFY

The Contractor (and its subcontractors) has an obligation to utilize the U.S. Department of Homeland Security’s (DHS) E-Verify system for all newly hired employees in accordance with section 448.095, F.S. By accepting the ATC or any PO(s), the Contractor certifies that it is registered with, and uses, the E-Verify system for all newly hired employees in accordance with section 448.095, F.S. The Contractor must obtain an affidavit from its subcontractors in accordance with paragraph (2)(b) of section 448.095, F.S., and maintain a copy of such affidavit for the duration of any applicable ATC(s) and any PO(s). The Contractor shall provide a copy of its DHS Memorandum of Understanding (MOU) to the Contract Manager specified on the PO within five (5) business days of issuance of the ATC or any PO(s). The Contract Manager will be designated on any applicable ATC and PO.

DMS-22/23-162 Page 15 of 25

This section serves as notice to the Contractor regarding the requirements of section 448.095, F.S., specifically sub-paragraph (2)(c)1, and the Department’s obligation to terminate the ATC and any other Purchaser’s obligation to terminate any PO(s) if it has a good faith belief that the Contractor has knowingly violated section 448.09(1), F.S. If terminated for such reason, the Contractor will not be eligible for award of a public contract for at least one (1) year after the date of such termination. The Department or any other applicable Purchaser will promptly notify the Contractor and order the immediate termination of any contract between the Contractor and a subcontractor performing work on its behalf under the ATCs and any PO(s) should the Department or any other applicable Purchaser develop a good faith belief that the subcontractor has knowingly violated section 448.095(1), F.S.

28.0 COOPERATION WITH INSPECTOR GENERAL

Pursuant to section 20.055(5), F.S., Contractor, and its subcontractors (if any), understand and will comply with their duty to cooperate with the Department’s or any Purchaser’s Inspector General in any investigation, audit, inspection, review, or hearing.

29.0 ACCESSIBILITY

The Contractor will comply with section 508 of the Rehabilitation Act of 1973, as amended and 29 U.S.C. s. 794(d), including the regulations set forth under 36 C.F.R. part 1194. Section 282.601(1), F.S., states that “state government shall, when developing, competitively procuring, maintaining, or using electronic information or information technology acquired on or after July 1, 2006, ensure that State employees with disabilities have access to and are provided with information and data comparable to the access and use by State employees who are not individuals with disabilities.”

30.0 PRODUCTION AND INSPECTION

In accordance with section 216.1366, F.S., any public agency is authorized to inspect the:

(a) financial records, papers, and documents of the contractor that are directly related to the performance of the contract or the expenditure of state funds; and (b) programmatic records, papers, and documents of the contractor which the public agency determines are necessary to monitor the performance of the contract or to ensure that the terms of the PO are being met. The Contractor shall provide such records, papers, and documents requested by the public agency within 10 business days after the request is made.

31.0 SCRUTINIZED COMPANIES

In accordance with the requirements of section 287.135(5), F.S., the vendor certifies that it is not participating in a boycott of Israel. At the Department’s or Purchaser’s option, any applicable ATC or PO may be terminated if the Contractor is placed on the Quarterly List of Scrutinized Companies that Boycott Israel (referred to in statute as the “Scrutinized Companies that Boycott Israel List”) or becomes engaged in a boycott of Israel. The State Board of Administration maintains the “Quarterly List of Scrutinized Companies that Boycott Israel” at the following link:

https://www.sbafla.com/fsb/FundsWeManage/FRSPensionPlan/GlobalGovernanceMandate s.aspx.

32.0 BACKGROUND SCREENING

All Contractor employees and their subcontractors and agents performing work under the Contract must comply with all security and administrative requirements of the Department and the Purchaser.

https://www.sbafla.com/fsb/FundsWeManage/FRSPensionPlan/GlobalGovernanceMandates.aspx https://www.sbafla.com/fsb/FundsWeManage/FRSPensionPlan/GlobalGovernanceMandates.aspx

DMS-22/23-162 Page 16 of 25

32.1 Background Check

In addition to any background screening required by the Contractor as a condition of employment, the Contractor warrants that it will conduct a criminal background screening of, or ensure that such a screening is conducted for, each of its employees, subcontractor personnel, independent contractors, leased employees, volunteers, licensees or other person, hereinafter referred to as “Person” or “Persons,” operating under their direction who directly perform services under the Contract, whether or not the Person has access to State of Florida Data, as well as those who have access, including indirect access, to State of Florida Data, whether or not they perform services under the PO. The Contractor warrants that all Persons will have passed the Background Screening described herein before they have Access to Data or begin performing services under the Contract. The look-back period for such background screenings shall be for a minimum of six years where six years of historical information is available.

“Access” means to review, inspect, approach, instruct, communicate with, store data in, retrieve data from, or otherwise make use of any data, regardless of type, form, or nature of storage. Access to a computer system or network includes local and remote access.

“Data” means a representation of information, knowledge, facts, concepts, computer software, computer programs or instructions, whether it is exempt, confidential, or personal health information. Data may be in any form, including but not limited to, storage media, computer memory, in transit, presented on a display device, or in physical media such as paper, film, microfilm, or microfiche. Data includes the original form of the Data and all metadata associated with the Data.

The minimum background check process will include a check of the following databases through a law enforcement agency or a Professional Background Screener accredited by the National Association of Professional Background Screeners or a comparable standard:

1) Social Security Number Trace; and

2) Criminal Records (Federal, State and County criminal felony and misdemeanor, national criminal database for all states which make such data available).

32.2 Disqualifying Offenses

If at any time it is determined that a Person has a criminal misdemeanor or felony record regardless of adjudication (e.g., adjudication withheld, a plea of guilty or nolo contendere, or a guilty verdict) within the last six years from the date of the court’s determination for the crimes listed below, or their equivalent in any jurisdiction, the Contractor is required to immediately remove that Person from any position with access to State of Florida Data or directly performing services under the Contract.

The disqualifying offenses are:

1) Computer related or information technology crimes;

2) Fraudulent practices, false pretenses and frauds, and credit card crimes;

3) Forgery and counterfeiting;

4) Violations involving checks and drafts;

5) Misuse of medical or personnel records; or

6) Felony theft.

DMS-22/23-162 Page 17 of 25

If the Contractor finds a Disqualifying Offense for a Person within the last six years from the date of the court’s disposition, it may obtain information regarding the incident and determine whether that Person should continue providing services under the Contract or have access to State of Florida Data. The Contractor will consider the following factors only in making the determination: i.) nature and gravity of the offense, ii.) the amount of time that has elapsed since the offense, iii.) the rehabilitation efforts of the person, and iv.) relevancy of the offense to the job duties of the Person. If the Contractor determines that the Person should be allowed access to State of Florida Data, then Contractor shall maintain all criminal background screening information and the rationale for such access in the Person’s employment file.

32.3 Refresh Screening

The Contractor will ensure that all background screening will be refreshed every five

(5) years from the time initially performed for each Person during the Term of the Contract.

32.4 Self-Disclosure

The Contractor shall ensure that all Persons have a responsibility to self-report within three calendar days to the Contractor any updated court disposition regarding any disqualifying offense, regardless of adjudication (adjudication withheld, a plea of guilty or nolo contendere, or a guilty verdict). The Contractor shall immediately reassess whether to disallow that Person access to any State of Florida premises or from directly performing services under the Contract. Additionally, the Contractor shall require that the Person complete an annual certification that they have not received any additional criminal misdemeanor or felony record regardless of adjudication (adjudication withheld, a plea of guilty or nolo contendere, or a guilty verdict) for the Disqualifying Offenses and shall maintain that certification in the employment file.

In addition, the Contractor shall ensure that all Persons have a responsibility to self-report to the Contractor within three calendar days, any arrest for any Disqualifying Offense. The Contractor shall notify the Contract Manager specified on the PO and any applicable ATC within 24 hours of all details concerning any reported arrest.

32.5 Duty to Provide Security Data

The Contractor will maintain the security of State of Florida Data including, but not limited to, a secure area around any display of such Data or Data that is otherwise visible. The Contractor will also comply with all state and federal rules and regulations regarding security of information, including HIPPA when applicable. Data cannot be disclosed to any person or entity that is not directly approved to participate in the SOW set forth in any resulting ATC or PO.

The Contractor must deliver an attestation describing the classification of Customer data consumed by the Solution to ensure suitable controls are considered for classified data. Additionally, the Contractor will provide documentation and evidence describing the technical security controls commensurate with the data’s classification as defined in Chapter 60GG-2, F.A.C. For any data identified as uniquely valuable to the Customer, the Contractor must provide a disaster recovery plan which must be approved by the Customer.

DMS-22/23-162 Page 18 of 25

32.6 Screening Compliance Audits and Security Inspections

The Purchaser reserves the right to audit the Contractor’s background screening process upon two (2) business days prior written notice to the Contractor during the Term of the PO and any applicable ATC. In the event of an incident as defined in section 282.0041, F.S., the Department will have the right to inspect to meet all applicable state and federal rules and regulations upon two (2) business days prior written notice to the Contractor to ensure that access to the State of Florida Data is secure and in compliance with any PO or applicable ATC.

32.7 Record Retention

The Customer will maintain ownership of all data consumed by the Solution. For all such data, Contractor shall comply with and grant all rights in Section 18.2 to each Customer.

The Contractor shall retain a list of all persons with Access to Data, including a statement confirming that each person has passed the background screening required herein. Such a statement shall not include the substance of the screening results, only that the person has passed the screening.

The Contractor shall create a written policy for the protection of Data, including a policy and procedure for Access to Data. The Contractor shall document and record, with respect to each instance of Access to Data:

1) The identity of all individual(s) who accessed data in any way, whether those individuals are authorized persons or not.

2) The duration of the individual(s)’ access to Data, including the time and date at which the access began and ended.

3) The identity, form, and extent of Data accessed, including, but not limited to, whether the individual accessed partial or redacted versions of Data, read-only versions of Data, or editable versions of Data.

4) The nature of the access to Data, including whether Data was edited or shared with any other individual or entity during the duration of the access, and, if so, the identity of the individual or entity.

The Contractor shall retain the written policy and information required in this section for the duration of the Contract and a period of no less than five (5) years from the date of termination of the Contract and any Contract extensions. The written policy and information required in this section shall be included in Department’s or the Purchaser’s audit and screening abilities as defined in Section 30.6, Screening Compliance Audits and Security Inspections. The written policy and information required in this section shall also be subject to immediate disclosure upon written or oral demand at any time by the Department, the Purchaser, or its designated agents or auditors.

Failure to compile, retain, and disclose the written policy and information as required in this section shall be considered a breach of any ATC(s) and PO(s). The resulting damages to the Department from a breach of this section are by their nature impossible to ascertain presently and will be difficult to ascertain in the future. The issues involved in determining such damages will be numerous, complex, and unreasonably burdensome to prove. The Contractor, the Customer, and the

DMS-22/23-162 Page 19 of 25

Department acknowledge that these financial consequences are liquidated damages, exclusive of any other right to damages, not intended to…