DocuSign or Equal RFQ 08-20-2026.docx

Request For Quotation

ARFQ WIC2600000001

Docusign or Equal-Digital Transaction and eSignature Management

SPECIFICATIONS

1. Purpose and Scope: The West Virginia Office of Shared Administration Purchasing (OSA) is soliciting bids on behalf of The West Virginia Department of Health (WVDH), Bureau for Public Health (BPH), Office of Nutrition Services (ONS), to establish an open-end contract for DocuSign “or Equal” - Digital Transaction Management (DTM) and eSignature Management.

NOTE: The WVDH has developed an EEOP Utilization Report and it is available at: http://www.wvdhhr.org/pdfs/H1.5%20Utilization%20Report%20and%20EEO%20policy.pdf NOTE: This request is covered in part or in whole by federal funds. All bidders will be required to acknowledge and adhere to "Attachment 1 — Provisions Required for Federally Funded Procurements".

2. Definitions: The terms listed below shall have the meanings assigned to them below. Additional definitions can be found in section 2 of the General Terms and Conditions.

2.1 "Contract Service" or "Contract Services" means the list of items identified in Section 3.1 below and on the Pricing Pages.

2.2 "Pricing Pages" means the schedule of prices, estimated order quantity, and totals contained in wvOASIS or attached hereto as Exhibit A and used to evaluate the Solicitation responses.

2.3 "Solicitation" means the official notice of an opportunity to supply the State with goods or services that is published by the Purchasing Division.

2.4 "eSignature" is defined as any electronic data that carries the intent of a signature.

2.5 "Digital Signature" is defined as digital technology employed to provide a layer of validation and security for an eSignature, that provides the receiver with assurance that the message was sent by the claimed sender.

2.6 "Digital Transaction Management (DTM)" is a category of services that digitally manage document transactions in a completely electronic manner. It includes content management, e-signatures, authentication and nonrepudiation, document transfer and certification and other processes used to manage electronic transactions and the documents associated with them.

2.7 "FedRAMP" The Federal Risk and Authorization Management Program, or FedRAMP, is a government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services. https://www.fedramp.gov/

2.8 "SOAP" (Simple Object Access Protocol) is a messaging protocol that allows programs that run disparate operating system to communicate.

2.9 "REST" (Representational State Transfer) or RESTful web services are a way of providing interoperability between computer systems on the Internet.

2.10 "Single-Sign On (SSO)" is a property of access control of multiple related, yet independent, software systems.

2.11 "FIPS 140-2" The Federal Information Processing Standard (FIPS) Publication 140-2, (FIPS PUB 140-2) is a U.S. government computer security standard used to approve cryptographic modules.

2.12 "Common Criteria" The Common Criteria for Information Technology Security Evaluation (abbreviated as Common Criteria or CC) is an international standard (ISO/IEC 15408) for computer security certification.

2.13 "Evaluation Assurance Level (EAL4+)" is a level of security assigned to applications that have been methodically designed, tested and reviewed.

2.14 "SMS" (Short Message Service) is a text messaging service component of most telephone, World Wide Web, and mobile device systems.

2.15 "Application Programming Interface (API)" is a set of subroutine definitions, protocols, and tools for building application software which allows the software to interact with other software.

2.16 "ONS User" is an employee of the West Virginia Office of Nutrition Services.

2.17 "Outside User" is a person outside of the BPH/ONS included in a Digital Signature transaction.

2.18 "Software Development Kit (SDK)" is a kit that includes instructions to allow the creation of systems and applications within the software.

2.19 "Knowledge Based Authentication (KBA)" is a method to prove a user’s identity prior to granting access to certain digital services.

2.20 "Solution" means the DocuSign “or Equal” Digital Transaction Management (DTM) and eSignature Management system and related services provided by the Vendor.

3. General Requirements:

3.1 Contract Services and Mandatory Requirements: Vendor shall provide Agency with the Contract Services listed below on an open-end and continuing basis. Contract Services shall meet or exceed the mandatory requirements as shown below.

3.1.1 General:

3.1.1.1 Vendor shall provide DocuSign "or Equal" - a DTM environment that enables ONS to digitally manage document-based transactions.

3.1.1.2 Vendor shall implement Digital Signature, eSignature and Workflow technology capable of being utilized as needed for appropriate business processes.

3.1.1.3 Vendor shall adhere to the West Virginia legal guidelines for digital signature and shall meet or exceed the requirements in the following mandates:

3.1.1.3.1 http://www.wvlegislature.gov/WVCODE/Code.cfm?chap=39a&art=3.

3.1.1.3.2 http://www.wvlegislature.gov/WVCODE/Code.cfm?chap=39a&art=1.

3.1.2 Forms:

3.1.2.1 Form elements shall include:

3.1.2.1.1 The ability to make calculations that can be automated based on conditions.

3.1.2.1.2 Signature and Optional Signatures.

3.1.2.1.3 Initials and Optional Initials.

3.1.2.1.4 Data Fields.

3.1.2.1.5 Radio Buttons.

3.1.2.1.6 Drop-Down Lists.

3.1.3 Mobility: Web, Mobile Applications and Integrations.

3.1.3.1 Supported Mobile Operating Systems shall include:

3.1.3.1.1 Apple iOS 7.0 and above.

3.1.3.1.2 Android 4.0 and above.

3.1.3.1.3 Microsoft Windows 10 and above.

3.1.3.2 Supported Internet browser environments shall include:

3.1.3.2.1 Internet Explorer (Windows) 11 and above.

3.1.3.2.2 Google Chrome (Windows, iOS and Android) 90 and above.

3.1.3.2.3 Firefox (latest version).

3.1.3.2.4 Safari (latest version).

3.1.3.2.5 Windows Edge (latest version).

3.1.3.2.6 Microsoft Edge (latest version).

3.1.3.3 DTM application shall be made available for download to ONS Users. Payment will be made according to the contract.

3.1.3.4 Signing application shall include the following mobile functionality:

3.1.3.4.1 Create Documents.

3.1.3.4.2 Tag Documents.

3.1.3.4.3 Send Documents.

3.1.3.4.4 Sign Documents.

3.1.3.4.5 Shall enable the use of mobile digital signatures from a mobile device.

3.1.3.4.6 Shall include the ability to work both online and offline.

3.1.4 Deployment: Installation needs and available deployment options.

3.1.4.1 Shall not require the local installation of Adobe Reader or Adobe Acrobat or other PDF reader to complete signing.

3.1.5 Signature:

3.1.5.1 Shall offer digital signatures and support digital certificates from multiple certificate authorities in the cloud.

3.1.5.2 Shall have the ability to decline signing a document with explanation.

3.1.5.3 Shall include the ability to accept disclosure language before completing the document.

3.1.5.4 Shall have the ability to issue digital certificates for signers.

3.1.5.5 Shall have the ability to sign using a digital certificate in the cloud without having to download the document to the local machine.

3.1.5.6 Shall have the ability to retain documents within the existing IT domain.

3.1.5.7 Shall supply proof of signer identity, signer intent and document integrity.

3.1.5.8 Shall create legally compliant digital records that guarantee transparency, auditability and accountability based on signature validation for signers using PDF readers.

3.1.5.9 Shall not require local installation to be used or needed to verify signed files.

3.1.5.10 Shall have the ability to include a graphical signature from a local file.

3.1.6 License Subscription, Transactions and Templates:

3.1.6.1 License subscriptions shall be configured to allow an estimated minimum of 10,000 transactions per year, with an additional charge per every 500 transactions in excess of 10,000 per year.

3.1.6.2 The license must include unlimited users.

3.1.6.3 Transaction volumes shall be shared among the unlimited user accounts and pooled at the account level for the effective life of the contract. For example: if one account utilizes 20,000 transactions, the other accounts can employ the remaining balance between the unlimited accounts.

3.1.6.4 Each transaction shall be capable of including an unlimited number of documents.

3.1.6.5 Shall be able to send documents from the following cloud repositories: Box, Drop Box, One Drive, and Google Drive.

3.1.6.6 Shall have the ability to create reusable templates that save tags and field placement, workflow routing and other standard fields.

3.1.6.7 Templates shall save the name and email of all signers / approvers in the workflow.

3.1.7 Workflow:

3.1.7.1 Shall be able to sequence workflow to signers in serial, parallel, and mixed (hybrid) routing throughout the user experience.

3.1.7.2 Shall be able to format fields that allow recipients to make changes in documents during the signing process.

3.1.7.3 Shall be able to make changes to workflow recipients after the transaction is initiated.

3.1.7.4 Shall be able to send the same document(s) to a list of recipients simultaneously (parallel workflow).

3.1.7.5 Shall be able to send a package of documents through a workflow to multiple recipients and control which users can see which documents within the package.

3.1.7.6 Shall be able to allow signers and senders to comment to each other within the solution before the signing is complete.

3.1.7.7 Shall allow senders to make changes to the document or workflow after it has been sent out without having to cancel the transaction and start over.

3.1.7.8 Shall include the ability to create automated notifications and reminders that are customizable.

3.1.7.9 Shall have a method to handle multiple signers that are using digital certificates.

3.1.7.10 Sender shall have the ability to determine which type of digital certificate the signer is required to sign with.

3.1.8 Authentication:

3.1.8.1 Shall have an authentication method available to confirm signer identity.

3.1.8.2 Methods of user account authentication shall include:

3.1.8.2.1 Phone Call.

3.1.8.2.2 SMS.

3.1.8.2.3 Knowledge Based Authentication (KBA).

3.1.9 Retention:

3.1.9.1 Shall have a document security option that allows the administrator to set the number of days that completed, declined, and voided documents are retained.

3.1.9.2 Documents and Audit trail information shall by default have an indefinite retention period.

3.1.10 Platform:

3.1.10.1 Average system availability shall be more than 99.5%.

3.1.10.2 Shall have redundant and geo-dispersed data centers.

3.1.10.3 ONS shall be able to choose where their data and transactions are located and stored.

3.1.10.4 Vendor shall maintain a written business continuity and disaster recovery plan that addresses the availability of the DTM system.

3.1.10.5 Shall be capable of functioning across heterogenous computing platforms.

3.1.11 Integration:

3.1.11.1 Shall have an open published API that is easily accessible to ONS developers to integrate into DEP applications.

3.1.11.2 APIs shall be available in both REST and SOAP.

3.1.11.3 Tools available to support APIs shall:

3.1.11.3.1 Have a developer center/forum.

3.1.11.3.2 Offer certificate-based API security access for integrated applications.

3.1.11.3.3 Allow third party systems to retrieve data, documents and audit information from the solution.

3.1.11.3.4 Be able to provide real times status/event updates to third-party applications.

3.1.11.3.5 Offer a dedicated SDK for IOS mobile development.

3.1.11.3.6 Offer a dedicated SDK for Android mobile development.

3.1.11.3.7 Support embedded features for use directly in third-party applications for web and mobile.

3.1.11.3.8 Offer a testing environment for development and testing of applications.

3.1.11.3.9 Include at a minimum the following integrations/pre-built connectors/drivers that are out-of-the-box:

3.1.11.3.9.1 BlueBeam.

3.1.11.3.9.2 Adobe Reader and Adobe Acrobat.

3.1.11.3.9.3 Microsoft Office 2016 applications.

3.1.11.3.9.4 Microsoft 365 applications.

3.1.11.3.9.5 Nuance PDF.

3.1.12 Additional Requirements:

3.1.12.1 Shall include an option for document storage.

3.1.13 Scalability and Licensing:

3.1.13.1 Shall have the ability to support growing transaction volumes.

3.1.13.2 Shall have the ability to support multiple locations.

3.1.13.3 ONS shall have the ability to pool the total number of transactions so that they are available to all licensed users.

3.1.13.4 Annual unused transactions will roll over and be available for use for the life of the contract.

3.1.13.5 ONS shall have the ability to procure additional transactions for the license pool.

3.1.14 Security:

3.1.14.1 Solution shall be able to ensure sensitive customer data is encrypted at rest and in motion. Solution should follow the Health Insurance Portability and Accountability Act (HIPAA) of 1996 collectively with the Standards for Privacy of Individually Identifiable Health Information, 45 C.F.R. Part 160 and Part 164, Subpart E, and the HIPAA Security Standards, 45 C.F.R. Part 160 and Part 164, Subpart C, as amended by the Health Information Technology for Economic and Clinical Health Act and regulations promulgated thereunder.

3.1.14.2 Vendor data centers shall be fire-wall protected with border routers configured to defend against network attacks like Distributed Denial of Service (DDoS).

3.1.14.3 ONS shall have the option of storing and managing encryption keys on-premises or in a private cloud for advanced security.

3.1.14.4 Vendor shall provide documentation that they conduct annual penetration testing by qualified third parties, annually or as directed by the ONS.

3.1.15 Monitoring and Incident Response:

3.1.15.1 Vendor shall have in place a process for monitoring fraud and malicious activities.

3.1.15.2 Vendor shall offer a Trust Center that will work with West Virginia Department of Health and the Office of Nutrition Services to remediate reported data and security issues within 24 hours.

3.1.16 Compliance:

3.1.16.1 Solution shall be ISO (International Organization for Standardization) 27001:2013 (https://www.iso.org/standard/54534.html) and SSAE (Statement of Standards for Attestation Engagements) 16 SOC (Service Order Controls) 1 and 2 (http://ssae16.com/SSAE16_overview.html) certified as an information security management system. These certifications signify that the vendor is operating a secure infrastructure and resilient environment.

3.1.16.2 Vendor shall be FedRamp authorized https://www.fedramp.gov/.

3.1.17 Enforceability:

3.1.17.1 Solution shall include an audit trail that includes message origin, author, content, and time of transmission for each transaction.

3.1.17.2 Audit trail shall contain verifiable chain of custody that includes document/transaction, meta data and history.

3.1.17.3 Solution shall provide an exportable log of transaction activities.

3.1.17.4 It shall be possible to validate the integrity of signed documents and the transaction history without needing to consult the electronic signature provider.

3.1.17.5 Vendor shall comply with the following laws/regulations:

3.1.17.5.1 U.S. ESIGN Act: https://uscode.house.gov/view.xhtml?path=/prelim@title15/chapter96&edition=prelim.

3.1.17.5.2 State Laws modeled after the 1999 UETA.

3.1.17.5.3 eIDAS Regulation.

3.1.17.5.4 EU Directive on eSignature 1999/93/EC: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:31999L0093&from=EN.

3.1.17.5.5 UK Electronic Communication Act (2000): https://www.legislation.gov.uk/ukpga/2000/7/enacted/data.xht?view=snippet&wrap=true.

3.1.17.6 Vendor shall be able to warrant compliance with the above laws and be available to testify in court to the validity of transactions created with the proposed solution.

3.1.18 Qualification: Vendor, or Vendor's staff requirements are inherently limited to individuals rather than corporate entities, shall have the following minimum qualifications:

3.1.18.1 Experience: Vendor, or Vendor's supervisory staff assigned to this project, must have successfully completed a minimum of two projects that involved work similar to that described in these specifications or the Project Plans. Compliance with this experience requirement will be determined prior to contract award by the State through references provided by the Vendor upon request, through knowledge or documentation of the Vendor's past projects, through confirmation of experience requirements from the architect assisting the State in this project, or some other method that the State determines to be acceptable. Vendor must provide any documentation requested by the State to assist in confirmation of compliance with this provision. References, documentation, or other information to confirm compliance with this experience requirement may be requested after bid opening and prior to contract award.

3.1.18.2 System shall be currently in use in situations that involve high volume transaction and multi-location environments. Agency may request list of uses prior to award.

3.1.18.3 Vendor shall have a dedicated security team.

3.1.19 Services and Support:

3.1.19.1 Professional services shall be available to assist ONS in developing templates, workflows, integration, user support, and help with other features offered with the product.

3.1.19.2 Support shall be available Monday-Friday, 8:00 a.m. to 5:00 p.m. Eastern Time, excluding West Virginia State holidays (e.g., New Year's Day, Martin Luther King Jr. Day, President's Day, Memorial Day, West Virginia Day, Independence Day, Labor Day, Columbus Day, Veterans Day, Thanksgiving, Christmas).

3.1.20 Training and Education:

3.1.20.1 Online Self-Paced Classes and Training shall be included.

3.1.20.2 Online Self-Paced General User instruction shall be available for all ONS and Outside Users that are included in the transaction process. This can be through videos or online content.

3.1.20.3 This training shall be available throughout the life of the contract.

3.1.20.4 Online Instructor Lead Training shall be optional at the Agency's discretion if offered.

3.1.21 Cost:

3.1.21.1 Vendor shall provide monthly pricing as indicated on Pricing Page (Exhibit A) for all services that are to be provided under this contract.

3.1.21.2 Vendor shall provide the price for all software products necessary to meet the requirements included in this solicitation. All costs shall be included in the Pricing Page (Exhibit A).

4. Contract Award:

4.1 Contract Award: The Contract is intended to provide Agency with a purchase price for Contract Services. The Contract shall be awarded to the Vendor that provides the Contract Services meeting the required specifications for the lowest overall total cost amount as shown on the Pricing Page in wvOasis.

4.2 Pricing Pages (Exhibit A): Vendor should complete the Pricing Page (Exhibit A) by electronically entering the pricing information into the commodity section of wvOasis. Failure to complete the Pricing Page (Exhibit A) in its entirety may result in Vendor's bid being disqualified. The Pricing Page (Exhibit A) contains a list of the Contract Services and estimated purchase volume. The estimated purchase volume for each item represents the approximate volume of anticipated purchases only. No future use of the Contract or any individual item is guaranteed or implied. Grand Total bid sum shall be the sum of Year One Annual Subscription costs and Year One Basic Support costs.

5. Performance: Vendor and Agency shall agree upon a schedule for performance of Contract Services and Contract Services Deliverables, unless such a schedule is already included herein by Agency. In the event that this Contract is designated as an open-end contract, Vendor shall perform in accordance with the release orders that may be issued against this Contract.

6. Payment: Agency shall pay for services monthly upon invoicing by the Vendor, as shown on the Pricing Page (Exhibit A), for all Contract Services performed and accepted under this Contract. Vendor shall accept payment in accordance with the payment procedures of the State of West Virginia.

7. Travel: Vendor shall be responsible for all mileage and travel costs, including travel time, associated with performance of this Contract. Any anticipated mileage or travel costs may be included in the flat fee or hourly rate listed on Vendor's bid, but such costs will not be paid by the Agency separately.

8. Facilities Access: Performance of Contract Services may require access cards and/or keys to gain entrance to Agency's facilities. In the event that access cards and/or keys are required:

8.1 Vendor must identify principal service personnel which will be issued access cards and/or keys to perform service.

8.2 Vendor will be responsible for controlling cards and keys and will pay replacement fee, if the cards or keys become lost or stolen.

8.3 Vendor shall notify Agency immediately of any lost, stolen, or missing card or key.

8.4 Anyone performing under this Contract will be subject to Agency's security protocol and procedures.

8.5 Vendor shall inform all staff of Agency's security protocol and procedures.

9. Vendor Default:

9.1 The following shall be considered a vendor default under this Contract:

9.1.1 Failure to provide Contract Services in accordance with the requirements contained herein.

9.1.2 Failure to comply with other specifications and requirements contained herein.

9.1.3 Failure to comply with any laws, rules, and ordinances applicable to the Contract Services provided under this Contract.

9.1.4 Failure to remedy deficient performance upon request.

9.2 The following remedies shall be available to Agency upon default:

9.2.1 Immediate cancellation of the Contract.

9.2.2 Immediate cancellation of one or more release orders issued under this Contract.

9.2.3 Any other remedies available in law or equity.

10. Miscellaneous:

10.1 No Substitutions: Vendor shall supply only Contract Services submitted in response to the Solicitation unless a contract modification is approved in accordance with the provisions contained in this Contract.

10.2 Contract Manager: During its performance of this Contract, Vendor must designate and maintain a primary contract manager responsible for overseeing Vendor's responsibilities under this Contract. The Contract manager must be available during normal business hours to address any customer service or other issues related to this Contract. Vendor should list its Contract manager and his or her contact.

Contract Manager Name and Title : ___________________________ Telephone Number: ________________________ Fax Number: _______________ Email Address: ____________________________