DQ 2025000482- CBMS Security and Privacy Assessment REQ 9657447 PUBLISHED.pdf

GOVERNOR’S OFFICE OF INFORMATION TECHNOLOGY (OIT)

Documented Quote DQ 2025000482

HCPF/CMS MARS-E Security and Privacy Assessment Services for CBMS

Direct Inquiries To: Jamie Robledo, Purchasing Agent

E-mail: jamie.robledo@state.co.us

PROPOSAL DUE DATE – May 2, 2025, 4:00 p.m. (MST)

IMPORTANT: Vendors are urged to carefully review the entire solicitation.

SCHEDULE OF EVENTS

ACTIVITY DATE/TIME (MST)

SOLICITATION NOTICE PUBLISHED ON COLORADO’S

VENDOR SELF-SERVICE (VSS) WWW.COLORADO.GOV/VSS AND

BIDNET

4/29/2025 TBD

PROPOSAL SUBMISSION DEADLINE

PROPOSALS MUST BE SUBMITTED ON BIDNET

HTTP://WWW.BIDNETDIRECT.COM//OIT

5/2/2025 4:00PM MST

NOTICE OF AWARD TO BE DETERMINED (TBD)

Internal Reference REQ 9657447 mailto:jamie.robledo@state.co.us http://www.colorado.gov/vss http://www.bidnetdirect.com//oit

Section 1: PROJECT OVERVIEW:

This section provides the Offerors with a general overview of the requirements contained within this solicitation. Additional information regarding the specific requirements may be contained in any documents attached to this documented quote.

1. Introduction

The Governor’s Office of Information Technology (OIT) is statutorily responsible for providing all IT resources to the Colorado Executive branch and other parts of the

State government, including systems, personnel, software, hardware, storage, telecommunication, public safety radio, cyber security, and disaster recovery.

2. Overview

OIT is seeking an independent assessor to provide a Year 1 security and privacy assessment of the Colorado Benefits Management System (CBMS) system in accordance with the Centers for Medicare and Medicaid Services (CMS) MARS-E 2.2 requirements.

The assessor must attest to their independence and objectivity in completing the assessment and that neither the Administering Entity (AE) Colorado Department of

Health Care Policy & Financing, nor the assessor took any actions that might impair the objectivity of the assessment findings.

3. Key Information

Assessment should start in mid-June. As part of CMS Year 1 reporting requirements, CBMS requires the assessor to complete the Security and Privacy Assessment Plan

(SAP), Security Assessment Report (SAR), Assessor Workbook (SAW), the Annual

Attestation Memorandum, and perform Penetration Testing. The SAP must be submitted to CMS 30 days in advance of the review The final deliverables including going through the HCPF clearance process for signatures, are due to CMS by July 29, 2025. The assessment must meet the requirements of the CMS Framework for the

Independent Assessment of Security and Privacy Controls, which provides an understanding of:

● System compliance with MARS-E

● Underlying infrastructure’s security posture

● The system and data security and privacy posture

● Proper security configuration associated with the database or file structure storing the data

● Systems technical, managerial, and organizational adherence to the organization’s security and privacy program, policies, and guidance

The table below describes the information system(s) and/or application(s) scheduled for testing:

Information System Name Information System Description

Colorado Benefits Management System (CBMS) The Colorado Department of Health Care Policy &

Financing (HCPF) oversees and operates Colorado

Medicaid, Child Health Plan Plus (CHP+), and other public health care programs for Coloradans who qualify. The Colorado Department of Human

Services (CDHS) designs and delivers human services and healthcare that improves the safety, independence, and well-being of the people of

Colorado. The Colorado Benefits Management

System (CBMS) and Program Eligibility &

Application Kit (PEAK) are technologies, jointly owned by HCPF and CDHS, through which

Coloradans in need receive food, cash, and medical assistance. The Colorado Governor’s

Office of Information Technology (OIT), Colorado’s Connecting Entity, manages CBMS, PEAK, and the Colorado connection to the

Federal Data Services Hub (FDSH)

The information system components for the above system(s) and application(s) are provided below:

Login URL* Data Center Site

Name

Physical Address Description of Components https://coloradopeak.secure.forc e.com/

Salesforce.com (SFDC)

Chicago and Washington DC metropolitan areas

PEAK is the CBMS applicant and beneficiary frontend https://coloradopeak.secure.forc e.com/PRHME

Salesforce.com (SFDC)

Chicago and Washington DC metropolitan areas

PEAKPro is a professional user community frontend for PEAK https://cees.my.salesforce.com Salesforce.com (SFDC)

Chicago and Washington DC

CBMS professional user community frontend metropolitan areas FedRAMP authorized https://cbmsesbsf.cbms.cdhs.stat e.co.us/

Amazon Web Services (AWS)

US-East-1 region

FedRAMP authorized

CBMS backend

4. Key Terminology

When the below terms are used in this document, they have the meaning as outlined:

a. “Acceptance Criteria” means the standards listed in the contract which characterize the State’s specific requirements and conditions that must be satisfied by the Contractor for the State to accept the completed Deliverables.

b. “Contractor” means the Awarded Offeror following the execution of a contract resulting from this DQ.

c. “Deliverables” means the outcome to be achieved or output to be provided, in the form of tangible reports, objects, or software that would be produced as a result of the Work as described in the Offeror’s Proposal.

d. “Key Persons” means the Contractor Staff (supervisor or project manager) who will be principally responsible for managing the Services or for performance of

Work under the contract and the satisfactory completion, delivery, and acceptance of the related Deliverables.

e. “Offeror” means any entity or individual submitting a proposal in response to this

DQ.

f. “Proposal” means an Offeror’s response to this DQ. A Proposal may also be called a bid, response, or offer. If such have been requested and submitted following initial responses, an Offeror’s Proposal shall include any clarifications or any best-and-final offer.

g. “Solicitation” means a document issued by the State of Colorado agency that requests competitive offers from organizations or individuals to sell the goods or services that are specified in the document. A solicitation typically results in an award of a contract or purchase order for the goods or services, based on an award methodology defined in the solicitation. .

h. “State” means the State of Colorado.

i. “Statement of Work” means the components of the contract that include but are not limited to an introduction, project objectives, definitions, detailed tasks (and subtasks if needed), measurable Deliverables that correlate with tasks, acceptance criteria, and delivery and payment schedule.

j. “Vendor” means any organization or individual that seeks to provide, or is already providing, goods, or services.

k. “VSS” means The State of Colorado's Vendor Self Service Web site. All solicitations published by State agencies and institutions are published on VSS.

l. “Work” means all work to be performed under a Contract, as more fully described in the Exhibits, schedules, and Statements of Work, including but not limited to: related services that support computer software, data processing, know-how transfer, enhancements, business process automation systems, planning, programming, construction, analysis, design, development, project management, testing, risk analysis, quality assurance, integration, training, or implementation.

Section 2: STATEMENT OF WORK:

Project Duration:

Assessment should start in mid-June. As part of CMS Year 1 reporting requirements, CBMS requires the assessor to complete the Security and Privacy Assessment Plan

(SAP), Security Assessment Report (SAR), Assessor Workbook (SAW), the Annual

Attestation Memorandum, and perform Penetration Testing. The SAP must be submitted to CMS 30 days in advance of the review The final deliverables including going through the HCPF clearance process for signatures, are due to CMS by July 29, 2025.

Deliverables:

1. Complete the Administering Entity Security and Privacy Assessment Plan (SAP) for the

Colorado Department of Health Care Policy & Financing (HCPF) Colorado Benefits

Management System (CBMS) for submission to CMS 30 days prior to the start of the assessment.

2. Perform penetration testing of the information system components identified above in

Section 3 (to be clarified upon engagement with the vendor).

Assessment should start in mid-June. As part of CMS Year 1 reporting requirements, CBMS requires the assessor to complete the Security and Privacy Assessment Plan

(SAP), Security Assessment Report (SAR), Assessor Workbook (SAW), the Annual

Attestation Memorandum, and perform Penetration Testing. The SAP must be submitted to CMS 30 days in advance of the review The final deliverables including going through the HCPF clearance process for signatures, are due to CMS by July 29, 2025.

Proposed Tasks/Deliverables Timeline (weeks) -vendor proposed

Security and Privacy Assessment Plan (SAP)

Penetration Testing Results

Security Assessment Report (SAR)

Security and Privacy Assessor Workbook

(SAW)

Annual Attestation Memorandum

3. As outlined in the Security and Privacy Assessment Plan (SAP), perform a CMS Year 1 assessment against the applicable MARS-E v2.2 security controls and at a minimum, the following documents should be assessed:

a. Business Agreement with Data Use Agreement (DUA)

b. Configuration Management Plan (CMP)

c. Contingency Plan and Test Results

d. Plan of Action and Milestones (POA&M)

e. Final SSP

f. Incident Response Plan (IRP) and Incident/Breach Notification and Test Plan

g. Privacy Impact Assessment (PIA) and other privacy documentation. including, but not limited to, privacy notices and agreements to collect, use, and disclose

PII and Privacy Act Statements

h. Security Awareness Training (SAT) Plan and Training Records

i. Interconnection Security Agreements (ISAs)

j. Information Security Risk Assessment (ISRA)

k. Governance documents and privacy policy documentation describing the AE privacy risk assessment process, documentation of privacy risk assessments performed by the organization

4. Complete the Security Assessment Report (SAR), Assessor Workbook (SAW), and the

Annual Attestation Memorandum, which will be submitted to CMS along with the

Privacy Impact Assessment (PIA), and the results of the Penetration Testing and

Vulnerability scans.

Considerations (optional)

Travel is not expected to be required for the scope of services included in this solicitation.

Section 3: REQUIREMENTS

Mandatory

3.1 Security and Privacy Assessment Plan (SAP)

Vendors Response:

3.2 Penetration Testing of cloud based platforms

3.3 SAR, SAW, Annual Attestation Memorandum

Section 4: PERFORMANCE MEASURES

1. Analysis, testing and deliverable preparation are completed in accordance with

CMS MARS_E guidance.

● Definition of Done (DoD) will be agreed upon by both OIT and the vendor.

○ Teams agree on the definition of “Done” (DoD) as it relates to each deliverable, milestone, or objective. These need to be accepted by the manager of the contract (OIT).

○ For any work not approved as completed, the vendor must address and resolve any and all such within 7 days; if resolution is not completed within the designated time frame, all Work will stop until the Work in question meets OIT's requirements and receives OIT approval as completed.

● Reporting & Performance:

○ The Vendor will be required to meet with the OIT Stakeholders at a predetermined cadence to report on successes or issues of the required deliverables before sign-off.

○ The Vendor will be required to provide weekly “metrics” meetings with internal OIT Stakeholders.

■ OIT is requesting that the following metrics be reported at this meeting:

● Estimates of time required to complete scheduled work upon review of specifications.

● Weekly Status Updates of existing work efforts including resolution of rework or issue.

● Discuss work in progress.

● Stop Work

○ During assessments, OIT reserves the right to stop this Work at any time without any guarantee of continued or future work at its discretion and only those hours completed to that date are to be paid upon approval of the Work to that point.

● Compliance and Confidentiality Communication

○ Address communication regarding compliance, data protection, or sensitive information.

○ Any communication regarding compliance breaches, data protection issues, or confidentiality breaches will be reported to the State within 1 hour of discovery.

● Meeting Cadences

○ OIT will establish the frequency and purpose of formal meetings or check-ins between parties.

○ If the vendor cannot attend a meeting, the vendor holds the responsibility of rescheduling.

● Acceptance will be measured --- by having the OIT CBMS Team provide feedback/acceptance. Documents should be submitted at least 2 weeks before a final due date to give time for any back/forth necessary.

Sample of performance monitoring to be used by OIT:

Section 5: PERFORMANCE OUTSIDE OF THE UNITED STATES

a. Any Offeror who proposes to perform any aspect of the Work outside the United

States, or to contract with any third-party to perform any aspect of the Work outside the United States, shall identify in its proposal the Work to be performed outside the

United States and the reason why it is necessary or advantageous to perform such

Services outside the United States. To the extent that performing any Work outside the

United States will have an impact on the price of the Work or any other aspect of the

Proposal, the Offeror must provide information sufficient for the State to evaluate the costs and benefits of performing the same Work within the United States. The State, in its sole discretion, may elect to approve or deny any request to perform Work outside the United States. Failure to include information sufficient to allow the State to approve or deny any such request shall be grounds for the state to reject any

Proposal or to decline to award a contract to the Offeror.

b. Any Work performed outside the United States shall be subject to the same terms of this DQ and the purchase order, including but not limited to terms relating to personnel security and background checks, information security and subcontracting.

An Offeror proposing to perform any Work outside the United States shall provide information regarding the Offeror’s ability to comply with such provisions for Work performed at any non-US location.

Section 6: REFERENCES AND EXPERIENCE

The State reserves the right to use Colorado State Agencies and other state governments as references. In addition to these references, which will be held confidential, Vendors must include the following with their Proposal:

Requirement 6.1

a. Provide three business references, including contact names, individual titles, locations, and a current telephone number. The references provided should be associated with work completed corresponding to the nature of the work in scope and size called for in this solicitation and Statement of Work.

b. Provide examples of experience in managing and technically performing similar projects. Include entity name, point of contact, location, phone number, and brief project description along with the outcome of the project.

c. Provide any previous or current project experience with the State of Colorado, including specifically the Governor’s Office of Information Technology.

Business

Reference (1)

Relevant

Experience working w/OIT

Reference (2) working with

OIT

Reference (3) working with

OIT

Requirement 6.2

Provide company information, including the full name and address of the organization and, if applicable, the branch or other subordinate units or divisions that will perform or assist in performing the work.

Provide a list of individuals and their roles who will perform the services described in the proposal.

Company

Information

Staff

Information

Requirement 6.3

Provide a Management Summary describing the methodology including project management techniques that will be employed during the contract to ensure the coordination and timeliness of the work, managerial techniques and tools proposed to control the work, and the methodologies proposed to enhance communication.

Management Summary

Section 7: PRICE PROPOSAL

Vendors shall submit their Price Proposal with the required data and in the same format as the attached Price Sheet.

Section 8: ADMINISTRATIVE REQUIREMENTS

1. Pricing - In case of an error in extension, unit price shall prevail. Vendors must use the attached Pricing Sheet; however, a more detailed accounting of the task/deliverables may be included.

2. Evaluation and award will be based on which acceptable vendor quote is most advantageous to OIT with qualifications/cost being the primary consideration.

Other considerations may include, but are not limited to, sample quality, and lead time for delivery.

3. OIT reserves the right to reject any or all quotes, to waive informalities and minor irregularities (as determined by OIT) in quotes received, and to accept all or any portion of the quote if deemed in the best interests of OIT.

“Acceptable” means that the goods or services submitted in the Respondent’s

Quote will meet the state’s needs, and that the price is fair and reasonable.

The determination of whether a Respondent’s Quote is acceptable is solely within the State’s discretion.

4. The awarded vendor will be issued a PO for a 12 month duration, though we expect the deliverables to adhere to the project schedule noted in section 2 -

Deliverables.

5. Negotiations - The State may negotiate with any Respondent to clarify the

Respondent’s Quote or to effect modifications that will make the Quote

Acceptable or more advantageous to the State; however, any requirements identified in this solicitation may not be negotiated. Reference Procurement

Rule R-24-103-204-01(d).

6. Single Quote - If only one Quote is received in response to this solicitation, an award may be made to the single Respondent if the procurement official finds that the price submitted is fair and reasonable and that other prospective

Respondents had reasonable opportunity to respond to the solicitation. If the price submitted is not fair and reasonable and there is not adequate time for re-solicitation, the procurement official may enter into competitive negotiations in accordance with Procurement Rule R-24-103-208-02.

7. Notice of Award will be published on Bidnet and VSS.

8. Documents after Award - Prior to Contract or Purchase Order execution, the awarded Respondent must provide the State with proof of Good Standing with the Colorado Secretary of State and an insurance certificate documenting coverage as required by the Contract or Purchase Order.

9. Modifications and/or Supplemental Information to the Solicitation - Any modifications, amendments or supplemental information to the solicitation will be published on Colorado VSS and Bidnet. A modification notice will be published on Colorado VSS and Bidnet in the event that it becomes necessary to revise any part of this solicitation.

10. It is the Respondent’s sole responsibility to check Colorado VSS and/or Bidnet on a regular basis, prior to the Quote submission deadline, as this is the primary means for communicating any clarifications or changes to solicitation content, timeline and/or requirements.

11. Solicitation Cancellation and/or Rejection of Quotes - In accordance with

§24-103-301, C.R.S., and the related Procurement Rules, the State may cancel this solicitation, or any and all Quotes may be rejected in whole or in part, without penalty, at any time before a Contract or purchase order is executed, when it is in the best interest of the State. The reason and documentation supporting the decision to cancel the solicitation or reject Quote(s) shall remain confidential for the lesser of six months or until a Contract or purchase order is awarded by the State. Reference Procurement Rule R-24-101-401-05.

If the solicitation is canceled after Quotes are received, the Quotes that have been opened shall be retained in the procurement record, or if unopened, they will be disposed of, or returned to the Respondent upon request at the

Respondents’ expense.

12. Modifications or Withdrawal of Quotes - A Respondent may modify or withdraw its Quote by written notice to the Procurement Contact prior to the established

Quote submission deadline. Withdrawal of a Respondent’s Quote following the

Quote submission deadline and prior to award, may be allowed, in the State’s discretion. Withdrawal of a Respondent’s Quote after award is not allowed.

Reference Procurement Rules R-24-103-201-08 and R-24-103-201-09.

13. Mistake and Minor Informalities in Respondent Quotes - In certain circumstances, a Respondent may correct a mistake(s) in its Quote and/or the

State may waive minor informalities. Reference Procurement Rule

R-24-103-201-08.

14. News Releases and Announcements - Respondents shall not issue any news releases, communications or announcements of any kind pertaining to this solicitation, without prior written approval by the State.

15. Not a Legally Binding Offer - Neither this solicitation nor a Respondent’s Quote submitted in response to this solicitation constitute a legally binding offer.

Reference Procurement Rule R- 24-103-204-01(b).

16. Respondent Quote Content - The contents of the Quote of the awarded

Respondent and any modifications to the Quote negotiated by the State included in the resulting Purchase Order will become contractual obligations.

Failure of the awarded Respondent to accept these obligations may result in cancellation of the award to that Respondent.

17. Quote Response Material Ownership - All material submitted in response to this solicitation becomes property of the State.

18. Certification of Independent Price Determination - By submitting a Quote, the

Respondent certifies that the prices and other terms in the Quote have been arrived at independently without any consultation, communication, agreement with, or knowledge of the contents of the Quote by any other competing

Respondent. For purposes of this paragraph, "consultation, communication, agreement with, or knowledge" does not include knowledge of prices or terms gained through availability of established price lists or catalogues made available to the public by the competing Respondents. No attempt has been made or will be made by the Respondent to induce any other person or firm to submit or not to submit a Quote for restricting competition. Reference

§6-4-101, C.R.S., et seq., (Colorado Antitrust Act of 1992) as amended.

19. Submission of Confidential or Proprietary Information - The State of Colorado is subject to the requirements of §24-72-200.1, C.R.S., et seq., Colorado Open

Records Act.

A Respondent may submit, as a part of its Quote, a written request for classification of certain portions of the Quote as a trade secret or other confidential or proprietary information. Material for which the Respondent is requesting confidentiality shall be readily identifiable and separated from other portions of the Quote to facilitate public inspection of the non-confidential portion of the Quote. Commingling of confidential and non-confidential information is not acceptable. Neither price information nor any information that will be included in a resulting Contract or purchase order will be considered confidential.

The Respondent must include the rationale for any request to classify portions as a trade secret or confidential or proprietary, including references to the authority that allows for such treatment.

A complete redacted Quote response should also be included along with an unredacted Quote and confidentiality justification.

In no event shall an entire Quote be classified as confidential. The Procurement

Official or his or her designee shall determine if the information identified in the Respondent’s request is exempt from disclosure in accordance with

§24-72-204, C.R.S., and shall inform the Respondent in writing of his or her determination. If the Respondent does not agree with the determination, the

Respondent may protest the determination in accordance with article 109 of the Colorado Procurement Code and the terms of this solicitation. Reference

Procurement Rule R-24-101-401-03.

Any additional Respondent information, which may be part of the evaluation/negotiation process and for which a Respondent claims confidentiality, is subject to the same requirements and processes identified above.

20. Modifications to the State Purchase Order

We will not be accepting any modifications to the State Purchase Order terms and conditions or Exhibit C - IT Provisions.

21. Ethics and Conflicts of Interest - The Respondent must disclose in its Quote any potential or actual conflict of interest in connection with a response to this solicitation. A conflict of interest may include, but is not limited to, access to any non-public information by the Respondent regarding the solicitation or its subject matter.

The Respondent acknowledges that even the appearance of a conflict of interest may be harmful to the State’s interests. The Respondent shall disclose in its Quote whether there currently is, or potentially could be, the appearance of a conflict of interest regarding this solicitation, its staff, any proposed subcontractors or partners, or any related business with the State.

Requirements set forth in this Section are continuing requirements throughout the solicitation process and, for the awarded Respondent, the Contract or

Purchase Order term, including any extensions. Reference §24-18-201, C.R.S., et seq. (Proscribed Acts Related to Contracts and Claims); §24-50-507, C.R.S.(Conflict of Interest); §18-8-301, C.R.S., et seq. (Bribery and Corrupt

Influence); §18-8-401, C.R.S., et seq. (Abuse of Public Office); §6-4-101, C.R.S., et seq., (Colorado Antitrust Act of 1992); §24-109-105, C.R.S .(Debarment and

Suspension); and Procurement Rule R-24-101-107-01 (Ethics).

22. Protested Solicitations and Awards - An aggrieved party may file a protest concerning a Material Issue(s), at any phase of solicitation, including but not limited to, specifications, award or a disclosure of information marked confidential in the Quote. “Material issue” means a nontrivial defect in the solicitation or award that would prejudice the outcome of the procurement.

The presence of multiple nonmaterial issues in a solicitation or award does not constitute a material issue unless the aggrieved party can establish that those nonmaterial issues together would prejudice the outcome of the procurement.”

The protest shall be submitted to OIT’s Procurement Official within three (3) business days after such aggrieved person knows, or should have known, of the facts giving rise thereto. Reference §24-109-102, C.R.S., as amended, and

Procurement Rule R-24-109-102-01, et seq. Protests should be submitted via email to jamie.robledo@state.co.us.

23. Agreements - The terms and conditions of OIT’s purchase order or contract and all Colorado Vendor Self Service website (VSS) terms and conditions apply to this procurement. Any exceptions to these terms shall not be accepted. Any applicable grant terms are incorporated by reference.

mailto:jamie.robledo@state.co.us

24. Submission Instructions -

Quotes must include the Pricing Sheet and the Signature Page.

Submit your proposal to Bidnet. Proposals will ONLY be accepted via Bidnet.

25. Colorado Vendor Self Service - This solicitation is published using the Colorado

Vendor Self Service website (VSS) and posted to Bidnet. Vendors must be registered on VSS in order to download solicitation documents and information

(including any amendments or modifications) and to be considered responsive at the time of submission of the response. VSS and registration information may be accessed via the State Purchasing Office link at:

http://www.colorado.gov/vss

26. Discrepancies in Solicitation - Should the vendor find any part of the solicitation to be discrepant, incomplete or otherwise questionable in any respect, the vendor shall be responsible to call such matters to the attention of the purchasing agent immediately. Failure to do so shall be at the vendor’s risk.

Amendments to this solicitation will be official only if published on VSS.

Vendors should not rely on verbal statements that alter this solicitation.

27. Performance/Remedies - Awarded vendor(s) and its subcontractor(s) shall comply with the requirements as stated in this solicitation. If the awarded vendor and or its subcontractor(s) fails to perform, OIT reserves the right to take remedial action (upon written notice), including canceling the original award, in whole or in part, for cause. Cause is defined as failure to meet the requirements stated in this solicitation, failure to correct deficiencies upon receipt of notice, or failure to maintain satisfactory performance after notice.

Awarded vendor shall be responsible for the performance of its subcontractor(s).

28. Reciprocal Preference - Per Colorado Revised Statutes, Section 8-19-101, a resident vendor shall be allowed a preference against a non-resident vendor equal to the preference given or required by the state in which the non-resident vendor is a resident.

29. Payments and Invoice - Payments shall be due 45 days following receipt of proper invoice. A proper invoice must include the Purchase Order number, if awarded, on all documents.

Please note that tasks, milestones, and deliverables should only be invoiced http://www.colorado.gov/vss upon their full completion and acceptance by the OIT Point of Contact. The vendor will have five days to address any issues with a deliverable to achieve full acceptance and can submit their invoice on or after the date of that acceptance by OIT.

30. Accessibility Requirements - All work performed as a result of this solicitation must comply with all applicable provisions of §§24-85-101, C.R.S., et seq., and the Accessibility Standards for Individuals with a Disability, as established by the Office Of Information Technology pursuant to §24-85-103 (2.5), C.R.S. and

3) all State of Colorado technology standards related to technology accessibility and with Level AA of the most current version of the Web Content Accessibility

Guidelines (WCAG), incorporated in the State of Colorado technology standards.

31. Insurance Requirements - The awarded Respondent will be required to submit a certificate(s) of insurance evidencing insurance coverage for the types and amounts of insurance as required by the Insurance provision in the Contract or

Purchase Order Terms and Conditions.

32. Timeliness of Quote Submission - Late quotes will not be accepted.

PLEASE RETURN THIS PAGE WITH YOUR QUOTE TO:

Attn: Jamie Robledo, Purchasing Agent

HTTP://WWW.BIDNETDIRECT.COM//OIT

PRICING SHEET

Vendor Name:

Proposed Tasks/Deliverables Timeline (weeks) Fixed Cost

Security and Privacy Assessment Plan (SAP)

Penetration Testing Results

Security Assessment Report (SAR)

Security and Privacy Assessor Workbook

(SAW)

Annual Attestation Memorandum

Total Cost

Pricing: All pricing must be listed on this Pricing Sheet. You may attach a detailed description of each phase / task in addition to but not in place of this pricing sheet. At a minimum, pricing must remain firm for 60 days after submission.

PLEASE RETURN THIS PAGE WITH YOUR QUOTE TO:

Attn: Jamie Robledo, Purchasing Agent

HTTP://WWW.BIDNETDIRECT.COM//OIT

DQ 2025000482 - SIGNATURE PAGE and T&C Acknowledgement

All quotes must be submitted on this form and signed in ink by an authorized officer or agent of the company.

VENDOR INFORMATION

Company Name:

Address:

Phone:

E-mail Address:

VSS Customer ID#: ______________________________________________________________________

TERMS & CONDITIONS ACCEPTANCE FORM

NOTE: No redlines will be accepted to OIT’s purchase order terms and conditions, OIT Exhibit C IT Provisions or the State of Colorado DQ template - additional provisions.

Purchase Order Terms and Conditions

OIT Exhibit C Terms and Conditions

Acknowledgement:

By signing below, you are affirming that the Vendor/Offeror takes no exceptions to the terms and conditions of the DQ, Exhibit C - IT Provisions and purchase order terms and conditions.

Signature of authorized officer/agent of company Title of authorized officer/agent of company

Print name of authorized officer/agent of company Date https://docs.google.com/document/d/163tsdL-HL3aALGtSuB8n37nDs0jVdrlk/edit?usp=sharing&ouid=106945869294772001374&rtpof=true&sd=true https://drive.google.com/file/d/1qoiYRK7O-0zS3vCeRIp3Qzxp0ERLMdO8/view?usp=drive_link