DOR-073-22 RFQ.pdf

REQUEST FOR QUOTE (RFQ)

Hard Drive Destruction

DOR-073-22 S-15000-00003153

Issuing Office: Oregon Department of Revenue (“Agency”) Single Point of Contact (SPC): Kyle Knox Address: 955 Center St NE Salem, OR 97301 Phone: (503) 302-9436 E-mail: DOR.Procurement@dor.oregon.gov

RFQ CLOSE DATE AND TIME: Friday, May 27th at 3:00 PM

1. Description of Services:

The Oregon Department of Revenue (“Agency”) is seeking a vendor able to perform all data destruction services as described herein. As part of hardware end of life decommissioning activities, and to comply with IRS standards regarding the security of Federal Tax Information, Agency requires a vendor to ensure that all media that could still contain data are securely disposed of in a manner that adequately protects the confidentiality of sensitive data and renders it unrecoverable. To accomplish this, vendor will provide hard drive destruction services for approximately 300-400 hard drives per year.

2. Contract Term:

This RFQ will result in a 5 year contract.

3. Schedule of Events:

The table below represents a tentative schedule of events. All times are listed in Pacific Time. All dates listed are subject to change.

Event Date Time (Pacific Time) RFQ Publish May 13, 2022 8:00 AM

RFQ Closing (Quote Due) May 27, 2022 3:00 PM

Issuance of Notice of Intent to Award (approx.) June 6, 2022 TBD mailto:DOR.Procurement@dor.oregon.gov TIPTON Vickie L 3 weeks from date of posting

TIPTON Vickie L Added for easy vendor reference

4. Scope of Services:

1 Introduction

Department of Revenue (Agency) is seeking a Contractor to provide hard drive and, on occasion, associated hardware destruction in accordance with Federal and State Rules and Regulations. The Services include, but are not limited to, the following:

2 Contractor Services

2.1 All equipment from Department of Revenue is assumed to have Federal Tax Information (FTI) on the hard drive. All hard drives, and any hardware inseparable from the hard drive, shall be destroyed by shredding, pulverization, disintegration, or incineration, and a certificate of destruction provided to the Agency.

2.2 If Contractor does not destroy the hard drives with Contractor’s own equipment onsite, Contractor will coordinate with Agency in the receipt of hard drives at Contractor's facility or the pickup and transport of hard drives from Department of Revenue Salem Facility by the Contractor.

2.3 Disposal of all destroyed hard drives must be in compliance with applicable statutes, rules and policies of the State and Internal Revenue Service (IRS), including IRS Publication 1075.

3 Acceptance of Pickups

3.1 Contractor shall be responsible for the pick-up or acceptance of hard drives and upon occasion E- Waste from Agency.

3.2 Pick-ups shall be completed within three (3) business days of the Agency’s request date at the Salem Facility located at 955 Center St. NE, Salem OR 97301.

3.3 The Agency shall coordinate with Contractor to set up a delivery schedule and location for delivery of hard drives from the Agency to Contractor.

4 Security Standards For Transportation Of Assets & Storage At Contractor’s Facility

Contractor shall comply with all Federal, State, and local laws and any Oregon statewide policy governing the transportation and storage of confidential information on hardware, and disposition of E-Waste (DAS Policy No. 107-004-100). All hard drives shall be destroyed within 10 days of initial receipt.

5 Verification and Certification Of Hard Drive Destruction

Contractor shall maintain accurate and current records listing the date processed and serial number of each hard drive destroyed, and shall provide Agency with a certificate of destruction.

6 National Association for Information Destruction (NAID) Certification

Contractor shall possess and maintain for the life of the contract NAID certification. Contractor will provide Agency with a copy of the certification, and will make copies of Contractor’s current certification available to Agency upon request throughout the life of the contract.

7 Inspections

Upon request, Contractor shall submit to physical inspections of the facility(s) where work is performed;

vehicles used in the transportation of hard drives; surveillance videos; procedure manuals; destruction records; and verification of the correct application of Oregon and federal law, statute, and policy, including IRS Publication 1075.

8 Security Requirements

8.1 Contractor shall consider all Agency documents confidential, whether specifically designated as Confidential Records or Confidential Information. All Agency property, materials, and documents handled by Contractor in the performance of the Contract are not to be read or otherwise used by Contractor or Contractor's employees.

8.2 Contractor acknowledges that Agency will select Contractor based on Contractor's representations that Contractor is capable of maintaining appropriate safeguards for the security of personal information, as required by the Oregon Consumer Identity Theft Protection Act. Accordingly, Contractor agrees and warrants that it will maintain, operate, and enforce, throughout the term of the Contract, an active and effective information security program under that Act.

8.3 Contractor agrees to comply with all Federal, State, and local laws governing the transportation, storage, and destruction of Confidential Records.

9 Change In Service Specifications (Amendments)

Contractor shall contact Agency at any time Contractor feels that changes or modifications in the performance specifications or requirements would result in improved Services. Agency will not be obligated to agree to any such recommendations. Further, Agency, in its sole discretion, may at any time during the term of the Contract reduce the scope of Services to be performed.

10 Contact Individuals

Contractor shall designate one or more persons Key Persons for the contract. The name, address and telephone number of Contractor or its authorized representative must be made available to Agency at all times. Contractor shall maintain an office which is staffed during the day and through which direct telephone contact is possible between the hours of 8:00 am and 5:00 pm Pacific time on business days.

11 Silence Of Specifications

The apparent silence of the specifications or any supplemental specifications as to any detail, or the apparent omission of a detailed description concerning any point, shall be regarded as meaning that only the best commercial practice is to prevail and that only materials and workmanship of first quality are to be used. If any omitted specification, however, results in ambiguity as to material characteristics of the Services or Goods, and inclusion is necessary to enable a reasonable person in the particular industry to properly identify such characteristics, Contractor shall seek a formal request for change. Failure to make such a request is at Contractor's risk, and Contractor is required to provide Services and Goods meeting the Agency’s needs with regard to any omitted specification for which change should reasonably have been sought.

5. Quotation Submittal:

Quotes must be received by the Issuing Office at the location identified on the first page of this document on or before the Closing Date and Time to be considered. Quotes will not be accepted after the Closing Date and Time. Quotes will be accepted by e-mail, or through the state procurement software OregonBuys.

Agency reserves the right to extend Closing when it is in the best interest of the State.

Agency reserves the right to reject all bids or to cancel this RFQ if in its sole determination, it is in the best interest of the State.

6. Submittal Requirements:

a. Submit Attachment B: Past Project Reference Check – Quotes must include a description, using Attachment B, of three past projects bidder has completed that are similar in scope to what is being requested. Past project information must include a contact person and valid contact information for the client whom received the services. Agency may contact any client (submitted or not) to verify Bidder’s qualifications.

b. Submit Attachment A: Pricing Sheet – Quotes must include all project costs using, Attachment A.

Pricing must be all inclusive. Additional cost or travel expenses will not be reimbursed.

c. Quotes must include a project timeline which must include the bidder’s capacity to begin work within two weeks of contract execution.

d. Quotes must include a short description of bidder’s project plan.

7. Evaluation and Award:

Quote submissions will be reviewed to determine if all Submittal Requirements have been met. Those meeting the Submittal Requirements will be evaluated to determine the “Best Fit” for the State. “Best Fit” is based solely on the evaluator’s determination of what best meets the needs of the Agency taking into account price as well as considerations including, but not limited to, experience, expertise and contractor responsibility. The evaluator’s determination is final.

Responses that are contingent upon acceptance of additional terms and conditions may be rejected.

The bidder with the most advantageous quote will be awarded a contract. The State reserves the right to negotiate contract terms and conditions with the successful bidder.

Upon Notice of Intent to Award the successful bidder will be required to complete and return the following documents. Agency will send the documents to the successful bidder with the Notice of Intent to Award.

a. W9

b. Tax Compliance Certification

c. Certificate of Insurance, with coverage levels as described in Exhibit A, listing Department of

Revenue as additionally insured.

8. Questions:

All inquiries relating to the RFQ process, administration, deadline or award, or to the substantive technical portion of this RFQ, should be directed to the Single Point of Contact listed on the first page of this RFQ. All questions regarding the intent of the work or technical aspect of the work must be submitted in writing via email or the state procurement system, OregonBuys. When appropriate, revisions substitutions, or clarifications shall be issued as addenda to this RFQ. Changes/modifications to the RFQ requirements shall ONLY be recognized if in the form of written addenda issued by Agency.

Agency shall advertise the response on the OregonBuys system. Anyone who has received a copy of this RFQ from somewhere else will only be altered to the existence of any addenda by checking the OregonBuys system.

Questions regarding this RFQ will be accepted until 12:00 p.m. PST on Thursday, May 19th, 2022.

Questions from and answers to any one bidder will be posted in OregonBuys (as soon as resolved and before the submission deadline), if such questions will clarify any part of this RFQ.

9. Submission of Quotes:

With the exception of electronic or fax submissions. The original Quote shall be submitted in a sealed envelope or box, labeled “Quote to RFQ # S-15000-00003153 DOR-073-22” and delivered to the Single Point of Contact listed on the first page of this Request for Quote.

Bidders shall provide a minimum of three references (Attachment B) for equivalent services to those described in this RFQ performed within the last 48 months. Submit Attachment B- Bidder Past Project Reference to Agency prior to the closing date of this solicitation.

Agency shall not be responsible for any failure attributed to the transmission, or receipt of emailed Quotes. Bidder should confirm Agency receipt.

Agency reserves the right to accept any quote or any part or parts thereof, negotiate the statement of work, or to reject any or all quotes and cancel the RFQ. Submission of a quote does not constitute an agreement between Agency and bidder, nor does it secure or imply that bidder will be selected.

By submitting a quote to this RFQ, Bidder agrees to all terms and conditions of all exhibits Exhibit A- Insurance Requirements and Exhibit B- IRS Publication 1075, Exhibit 7. All exhibits attached hereto are incorporated herein by reference.

All costs incurred in preparing and submitting a Quote in response to the RFQ are the responsibility of the Bidder and shall not be reimbursed by Agency.

ATTACHMENT A

PRICING SHEET

RFQ # S-15000-00003153 DOR-073-22

Bidder Name: ________________________________

Federal ID No: _____________________

Address: ____________________________________________________

City, State, Zip: _____________________________________

Phone: __________________________

Email: _____________________________________

Services listed above in Section 3 - Scope of Services. Cost per unit

Hard Drive Destruction

E-Waste inseparable from Hard Drive (possible laptop or PC) $

Authorized Representative’s Signature Name and Title Date

ATTACHMENT B

PAST PROJECT/REFERENCE CHECK FORM

RFQ # S-15000-00003153 DOR-073-22

Bidder Name: __________________________________________

Reference Entity: __________________________________________

Reference Contact Name: __________________________________________

Contact Telephone Number: __________________________________________

Contact Email Address: __________________________________________

Project name: __________________________________________

Describe the scope of the project:

Project description:

Past project/REFERENCE CHECK FORM

Bidder Name: __________________________________________

Reference Entity: __________________________________________

Reference Contact Name: __________________________________________

Past project/REFERENCE CHECK FORM

Bidder Name: __________________________________________

Reference Entity: __________________________________________

Reference Contact Name: __________________________________________

EXHIBIT A

Insurance

Contractor shall obtain at Contractor’s expense the insurance specified in this Exhibit A prior to performing under this Contract, and shall maintain it in full force and at its own expense throughout the duration of this Contract, and as required by any extended reporting period or tail coverage requirements, and all warranty periods that apply. Contractor shall obtain the following insurance from insurance companies or entities that are authorized to transact the business of insurance and issue coverage in the State of Oregon and that are acceptable to Agency. Coverage must be primary and non-contributory with any other insurance and self-insurance. Contractor shall pay for all deductibles, self-insured retention and self-insurance, if any.

1. INSURANCE REQUIRED.

1.1 Workers’ Compensation & Employers’ Liability.

All employers, including Contractor, shall provide workers’ compensation insurance as required by applicable workers’ compensation laws for persons performing work under this Contract, including Employers’ Liability Insurance with limits not less than $500,000 each accident. Contractor shall require and ensure that each of its subcontractors complies with these requirements.

1.2 Professional Liability.

Contractor shall provide Professional Liability insurance including:

1. Technology Errors and Omissions related to the professional services and products provided under this Contract in an amount of not less than $1,000,000 per occurrence and $2,000,000 aggregate, and

2. Network Security/Privacy Breach of agency data in an amount of not less than $0 per occurrence and $0 aggregate, and

3. Coverage for regulatory fines and fees imposed against Agency due to failures in products and Services provided under this Contract in an amount of not less than $1,000,000 per occurrence.

Coverage must include errors, omissions, negligent acts, denial of service, media liability (including software copyright), dishonesty, fraudulent or criminal acts by a person or persons whether identified or not, intellectual property infringement, computer system attacks, unauthorized access and use of computer system, regulatory actions, and contractual liability.

Coverage must extend to business associates and independent contractors providing professional services on behalf of or at the direction of Contractor. A primary policy or combination of a primary policy and excess policy shall be acceptable in order to meet the limits requirement.

1.3 Commercial General Liability.

Contractor shall provide Commercial General Liability Insurance covering bodily injury, death and property damage in a form and with coverage that are satisfactory to the State. This insurance must include personal injury liability, products and completed operations, and contractual liability coverage, in each case arising out of Contractor’s negligence.

Coverage must be written on an occurrence basis in an amount of not less than $1,000,000 per occurrence and $2,000,000 aggregate.

1.4 Automobile Liability Insurance.

Contractor shall provide Automobile Liability Insurance covering all owned, non-owned, or hired vehicles with a combined single limit of not less than $1,000,000 for bodily injury and property damage.

2. ADDITIONAL INSURED.

The Professional Liability insurance and Commercial General Liability insurance required under this Contract must include the State of Oregon, its officers, employees and agents as Additional Insureds but only with respect to Contractor's activities to be performed under this Contract.

3. TAIL COVERAGE.

If any of the required insurance is on a claims-made basis and does not include an extended reporting period of at least 24 (twenty-four) months, Contractor shall maintain either tail coverage or continuous claims made liability coverage, provided the effective date of the continuous claims made coverage is on or before the Effective Date of this Contract, for a minimum of 24 (twenty-four) months following the later of (i) Contractor’s completion and Agency’s acceptance of all Services required under this Contract, or, (ii) The expiration of all Warranty Periods provided under this Contract.

4. CERTIFICATE(S) AND PROOF OF INSURANCE.

Contractor shall provide to Agency Certificate(s) of Insurance for all required insurance before delivering any goods or performing any Services required under this Contract. The Certificate(s) must list the State of Oregon, its officers, employees and agents as a Certificate holder and as Additional Insured, specify that Contractor will pay for all deductibles, self-insured retention and self-insurance, if any, that all coverage will be primary and non-contributory with any other insurance and self-insurance, and confirm that either an extended reporting period of at least 24 (twenty-four) months is provided on all claims made policies or that tail coverage is provided. As proof of insurance Agency has the right to request copies of insurance policies relating to the insurance requirements in this Contract.

5. NOTICE OF CHANGE OR CANCELLATION.

Contractor or its insurer must endeavor to provide at least 30 (thirty) Calendar Days’ written notice to Agency before cancellation of, material change to, potential exhaustion of aggregate limits of, or non-renewal of the required insurance coverage(s).

6. INSURANCE REQUIREMENT REVIEW.

Contractor agrees to periodic review of insurance requirements by Agency under this Contract and to meet updated requirements as mutually agreed upon by Contractor and Agency.

EXHIBIT B

IRS Publication 1075, Exhibit 7

I. PERFORMANCE

In performance of this contract, the Contractor agrees to comply with and assume responsibility for compliance by officers or employees with the following requirements:

(1) All work will be performed under the supervision of the contractor.

(2) The contractor and contractor’s officers or employees to be authorized access to FTI must meet background check requirements defined in IRS Publication 1075. The contractor will maintain a list of officers or employees authorized access to FTI. Such list will be provided to the agency and, upon request, to the IRS.

(3) FTI in hardcopy or electronic format shall be used only for the purpose of carrying out the provisions of this contract. FTI in any format shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of this contract. Inspection or disclosure of FTI to anyone other than the contractor or the contractor’s officers or employees authorized is prohibited.

(4) FTI will be accounted for upon receipt and properly stored before, during, and after processing. In addition, any related output and products require the same level of protection as required for the source material.

(5) The contractor will certify that FTI processed during the performance of this contract will be completely purged from all physical and electronic data storage with no output to be retained by the contractor at the time the work is completed. If immediate purging of physical and electronic data storage is not possible, the contractor will certify that any FTI in physical or electronic storage will remain safeguarded to prevent unauthorized disclosures.

(6) Any spoilage or any intermediate hard copy printout that may result during the processing of FTI will be given to the agency. When this is not possible, the contractor will be responsible for the destruction of the spoilage or any intermediate hard copy printouts and will provide the agency with a statement containing the date of destruction, description of material destroyed, and the destruction method.

(7) All computer systems receiving, processing, storing, or transmitting FTI must meet the requirements in IRS Publication 1075. To meet functional and assurance requirements, the security features of the environment must provide for the managerial, operational, and technical controls. All security features must be available and activated to protect against unauthorized use of and access to FTI.

(8) No work involving FTI furnished under this contract will be subcontracted without the prior written approval of the IRS.

(9) Contractor will ensure that the terms of FTI safeguards described herein are included, without modification, in any approved subcontract for work involving FTI.

(10) To the extent the terms, provisions, duties, requirements, and obligations of this contract apply to performing services with FTI, the contractor shall assume toward the subcontractor all obligations, duties and responsibilities that the agency under this contract assumes toward the contractor, and the subcontractor shall assume toward the contractor all the same obligations, duties and responsibilities which the contractor assumes toward the agency under this contract.

(11) In addition to the subcontractor’s obligations and duties under an approved subcontract, the terms and conditions of this contract apply to the subcontractor, and the subcontractor is bound and obligated to the contractor hereunder by the same terms and conditions by which the contractor is bound an obligated to the agency under this contract.

(12) For purposes of this contract, the term “contractor” includes any officer or employee of the contractor with access to or who uses FTI, and the term “subcontractor” includes any officer or employee of the subcontractor with access to or who uses FTI.

(13) The agency will have the right to void the contract if the contractor fails to meet the terms of FTI safeguards described herein.

II. CRIMINAL/CIVIL SANCTIONS

(1) Each officer or employee of a contractor to whom FTI is or may be disclosed shall be notified in writing that FTI disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any FTI for a purpose not authorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution.

(2) Each officer or employee of a contractor to whom FTI is or may be accessible shall be notified in writing that FTI accessible to such officer or employee may be accessed only for a purpose and to the extent authorized herein, and that access/inspection of FTI without an official need-to-know for a purpose not authorized herein constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution.

(3) Each officer or employee of a contractor to whom FTI is or may be disclosed shall be notified in writing that any such unauthorized access, inspection or disclosure of FTI may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each unauthorized access, inspection, or disclosure, or the sum of actual damages sustained as a result of such unauthorized access, inspection, or disclosure, plus in the case of a willful unauthorized access, inspection, or disclosure or an unauthorized access/inspection or disclosure which is the result of gross negligence, punitive damages, plus the cost of the action. These penalties are prescribed by IRC sections 7213, 7213A and 7431 and set forth at 26 CFR 301.6103(n)-1.

(3) Additionally, it is incumbent upon the contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000.

(4) Granting a contractor access to FTI must be preceded by certifying that each officer or employee understands the agency’s security policy and procedures for safeguarding FTI. A contractor and each officer or employee must maintain their authorization to access FTI through annual recertification of their understanding of the agency’s security policy and procedures for safeguarding FTI. The initial certification and recertifications must be documented and placed in the agency's files for review. As part of the certification and at least annually afterwards, a contractor and each officer or employee must be advised of the provisions of IRC sections 7213, 7213A, and 7431 (see Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure). The training on the agency’s security policy and procedures provided before the initial certification and annually thereafter must also cover the incident response policy and procedure for reporting unauthorized disclosures and data breaches. (See Section 10) For the initial certification and the annual recertifications, the contractor and each officer or employee must sign, either with ink or electronic signature, a confidentiality statement certifying their understanding of the security requirements.

III. INSPECTION

The IRS and the Agency, with 24 hour notice, shall have the right to send its inspectors into the offices and plants of the contractor to inspect facilities and operations performing any work with FTI under this contract for compliance with requirements defined in IRS Publication 1075. The IRS’ right of inspection shall include the use of manual and/or automated scanning tools to perform compliance and vulnerability assessments of information technology (IT) assets that access, store, process or transmit FTI. Based on the inspection, corrective actions may be required in cases where the contractor is found to be noncompliant with FTI safeguard requirements.