EINF72324_-_RFQ-ITS.pdf

MALIA M. COHEN

CALIFORNIA STATE CONTROLLER

December 30, 2024

REQUEST FOR QUOTE for INFORMATION TECHNOLOGY (IT) SERVICES (RFQ-ITS) EINF72324

QualysGuard Software-as-a-Service (SaaS) Renewal

Bidders are invited to review and respond to the State Controller's Office (SCO) Request for Quote for Information Technology (IT) Services (RFQ-ITS) Number EINF72324. To submit a bid for these services, the Bidder must comply with the instructions contained in this document. By submitting a bid, the bidding firm agrees to the terms and conditions stated in this RFQ-ITS.

Read the attached document carefully. The Bidder is solely responsible for ensuring that the complete bid is received by SCO in accordance with the Bid requirements, prior to the date and time specified in the solicitation. Bids received after the specified deadline will not be considered for review. SCO shall not be responsible for any delays in submittal, to include misdelivery. SCO reserves the right to cancel this RFQ-ITS without cause, at any time prior to award.

Bidders are advised to check the Cal eProcure website for addendums, modifications, and updates to the Bid documents. SCO is not responsible for failure of the prospective bidder to check for any bid document updates, changes, or answers to questions posted on Cal eProcure. Failure to check the website periodically will be at the Bidder’s sole risk.

If a discrepancy occurs between the information in the advertisement appearing on the Department of General Services (DGS), California State Contracts Register (CSCR) on the Cal eProcure website:

https://caleprocure.ca.gov/pages/Events-BS3/event-search.aspx and the information in the herein RFQ- ITS, the information in the attached RFQ-ITS shall take precedence.

Note that all Information Technology (IT) Agreements entered into with the State of California will include by reference General Services Procurement Division - Information Technology General Provisions – Cloud Computing Services – GSPD-ITGP (Cloud) (Revised and Effective 11/12/2024) version available here: https://www.dgs.ca.gov/~/media/Divisions/PD/Acquisitions/Solicitation- Document-Attachments/GSPDITGP-CloudRevised-and-Effective-111224.docx. If you do not have internet access, a hard copy can be provided.

Additional Bidder Instructions (DGS PD 451) may be viewed and downloaded from the following website: https://www.documents.dgs.ca.gov/dgs/FMC/GS/PD/DGSPD%20451.pdf. If you do not have Internet access, a hard copy can be provided.

In the opinion of SCO, this RFQ-ITS is complete and without need of explanation. However, if you have questions, or should you need any clarifying information, please send an email to admcpu@sco.ca.gov by the Written Questions Submittal Deadline in Section I, General Information, Item B. Key Action Dates.

Please note that no verbal information given will be binding upon SCO unless such information is issued in writing through an official addendum.

https://caleprocure.ca.gov/pages/Events-BS3/event-search.aspx https://www.dgs.ca.gov/%7E/media/Divisions/PD/Acquisitions/Solicitation-Document-Attachments/GSPDITGP-CloudRevised-and-Effective-111224.docx https://www.dgs.ca.gov/%7E/media/Divisions/PD/Acquisitions/Solicitation-Document-Attachments/GSPDITGP-CloudRevised-and-Effective-111224.docx https://www.documents.dgs.ca.gov/dgs/FMC/GS/PD/DGSPD%20451.pdf mailto:admcpu@sco.ca.gov

State Controller’s Office RFQ-ITS Number EINF72324

TABLE OF CONTENTS

SECTION I. GENERAL INFORMATION

A. Description of Services B. Key Action Dates C. Written Questions and Answers D. RFQ-ITS Bid Guidelines E. RFQ-ITS Bid Content

1. Administrative Requirements

2. Licenses and Certifications

F. RFQ-ITS Bid Submission G. Participation, Preference and Incentive Programs H. Award and Protest

SECTION II. EVALUATION INFORMATION

A. Evaluation Process B. Evaluation Criteria C. Tie Break Process Attachment 1 Required Attachment Checklist Attachment 2 Bidder Certification Sheet Attachment 3 Contractor Point of Contact Attachment 4 Payee Data Record (STD 204) and Payee Data Record Supplement (STD 205)* Attachment 5 Bidder Declaration (Written) (GSPD-05-105) Attachment 6 Disabled Veteran Business Enterprise (DVBE) Declarations (DGS PD 843)* Attachment 7 Generative Artificial Intelligence (GenAI) Disclosure & Factsheet (STD 1000) Attachment 8 Target Area Contract Preference Act Preference Request for Goods and Services Solicitations

(STD 830)*

Attachment 9 Bidder’s Summary of Contract Activities and Labor Hours (DGS PD 526)* Attachment 10 Bidding Preferences and Incentives Attachment 11 Acknowledgement of Agreement Exhibits and Policies Attachment 12 California Civil Rights Laws Certification (DGS OLS 04) Attachment 13 Contractor/Consultant Confidentiality and Non-Disclosure Acknowledgement (ISO-004b) . 22 Attachment 14 Contractor/Consultant Organization Information Security Agreement (ISO-004c) Attachment 15 Cost Worksheet

Standard Agreement (STD 213)

Sample Agreement Exhibit A – Scope of Work Exhibit B – Budget Detail and Payment Provisions Exhibit B – Attachment 1, Cost Worksheet Exhibit C – Information Technology General Provisions – Cloud Computing Service – GSPD-ITGP (Cloud) (Revised and Effective 11/12/2024) *Submit only if applicable.

SECTION I. GENERAL INFORMATION

A. Description of Services

The State Controller’s Office (SCO) is seeking a contractor to provide QualysGuard vulnerability and compliance management Software-as-a-Service (SaaS)

See the Sample Agreement, Exhibit A, Scope of Work for a complete description of services.

Agreement Term

The term will be for three years with the option to amend add funds as deemed necessary by SCO. The rates on Exhibit B, Attachment 1, Cost Worksheet will not change as a result of any amendment to this agreement. This agreement may be terminated by SCO with 30 days’ written notice to the Contractor.

Contractors are cautioned that no services will begin until the Agreement has been fully executed. If services are performed prior to agreement approval, and the Agreement for any reason is not approved, all previous services performed by the Contractor is considered donated to SCO and no payment shall be made for that work.

Agreement Amount

The Contractor and SCO Representative listed in Exhibit A, SOW, Section D. Contacts, Item 1 are responsible for monitoring the Agreement to not exceed the maximum amount of the Agreement without an executed amendment.

B. Key Action Dates

It must be understood that time is always of the essence, both for the RFQ-ITS submittal and for agreement completion. Bidders are advised of the key action dates and times shown below and are expected to adhere to them.

EVENT DATE

Release of RFQ-ITS December 30, 2024 Written Questions Submittal Deadline January 7, 2025: 5:00 PM Pacific Time (PT) SCO Response to Written Questions January 9, 2025 Final Date for Bid Submission* January 15, 2025: 5:00 PM PT Evaluation of Bids** January 16 -17, 2025 Notice of Intent to Award January 21, 2025 Anticipated Agreement Award Date January 29, 2025 Anticipated Agreement Start Date February 1, 2025

* Dates after the Final Date for Bid Submission are estimates only and may be subject to change. SCO will adhere to the listed dates as strictly as possible but will not be held accountable for changes due to unforeseen circumstances.

** If Target Area Contract Preference Act (TACPA) is claimed, add five additional business days to each event after the Evaluation of Bids date.

C. Written Questions and Answers

1. Bidders may submit questions for clarification of the content of this RFQ-ITS to admcpu@sco.ca.gov.

2. Questions must be received by the date and time specified in Section I. General Information, Item B.

Key Action Dates. Questions and answers will be provided without identifying the submitter. At the sole discretion of SCO, SCO may paraphrase questions for clarity.

3. The subject line of the email should read, RFQ-ITS EINF72324 Questions – Company Name.

4. The Bidder must reference the section and page number about which they are inquiring.

5. Questions not submitted in writing by the date for Written Questions Submittal Deadline specified in

Section I. General Information, Item B. Key Action Dates, will be answered at SCO option.

6. Questions and Answers will be issued via an addendum to this RFQ-ITS and be posted to Cal eProcure by the date specified in Section I. General Information, Item B. Key Action Dates.

D. RFQ-ITS Bid Guidelines

1. Costs incurred for developing bids, in anticipation of award of the Agreement, are entirely the responsibility of the Bidder and shall not be charged to the State of California.

2. It is the Bidder’s responsibility to provide all necessary information for SCO to evaluate the Bid, verify requested information, and determine the Bidder’s ability to perform the services defined in Exhibit A, Scope of Work and Attachment 15, Cost Worksheet.

3. Bidders who are DGS certified California Small Businesses (SB), Micro Business (MB) and/or

Disabled Veteran Business Enterprises (DVBE) must provide and include an SB/DVBE Certification with the Bid. SCO will verify that SB/DVBE certifications are valid at the time the Bid is due. In accordance with California Government Code (GC) Section 14837(d) and California Military and Veterans Code Section 999, all SB and DVBE contractors, subcontractors, and suppliers that bid on or participate in a State agreement, regardless of being an oral or written solicitation, shall perform a Commercially Useful Function (CUF).

4. The Bidder may modify a bid after its submission by withdrawing its original bid and resubmitting a new bid prior to the Final Date for Bid Submission. Contractor modifications in any other manner, oral or written, will not be considered.

5. The Bidder may withdraw its bid by submitting a written withdrawal request to admcpu@sco.ca.gov signed by the Bidder or an authorized agent. A bidder may thereafter submit a new bid prior to the Final Date for Bid Submission. Bids may not be withdrawn without cause after the Final Date for Bid Submission.

6. SCO does not accept alternate agreement language from a prospective contractor. A bid with such language will be considered a counter offer and will not be considered. The State’s Terms and Conditions are not negotiable.

7. Bids should provide straightforward and concise descriptions of the Bidder’s ability to satisfy the requirements of this RFQ-ITS. Omissions, inaccuracies, or misstatements will be cause for rejection of a bid.

8. SCO may modify the RFQ-ITS by issuing an addendum, prior to the Final Date for Bid Submission, which will be posted to Cal eProcure.

9. SCO reserves the right to reject all bids. SCO is not required to award an agreement.

10. This RFQ-ITS and the Contractor’s bid will be made a part of the Agreement file.

11. At SCO option prior to award, bidders may be required to submit additional written clarifying information. Failure to submit the required written information as specified may be grounds for bid rejection.

12. No oral understanding or agreement shall be binding on either party.

E. RFQ-ITS Bid Content

In order to be responsive to this RFQ-ITS, the following requirements must be met. Failure to respond to and submit these items with the required information may result in disqualification.

This requirement is Mandatory Pass/Fail.

1. Administrative Requirements

a. Completion of all required Attachments listed on Attachment 1, Required Attachment Checklist.

b. On Attachment 2, Bidder Certification Sheet, the Bidder must complete, sign, and return the

Attachment. The Bidder will include any necessary supporting documentation (references, certifications, licenses, insurance acknowledgement, etc.) necessary to validate the Bidder’s qualifications.

Attachment 2 must be signed by an individual authorized to bind the business contractually and must identify the title or position that the individual holds in the business.

2. Licenses and Certifications

a. The Bidder must provide copy of a valid California city or county business license (if applicable);

or, if a corporation located within the State of California, incorporation documents; or letter from the Secretary of State or, if not a California business, an affidavit that the business is in good standing with the state, province, or country in which business is headquartered.

b. Bidders shall obtain, at their expense, all license(s) or permit(s) required by law for accomplishing any work required in connection with this agreement.

c. All licenses must remain valid for the term of the Agreement. In the event that any license or certification expires at any time during the term of this agreement, the Contractor agrees to provide SCO a copy of the renewed license within 30 days following the expiration date. In the event the Contractor fails to keep in effect at all times all required licenses, SCO may, in addition to any other remedies it may have, terminate this agreement upon occurrence of such event.

F. RFQ-ITS Bid Submission

1. Bidders must submit their bids in PDF format attached to an email to admcpu@sco.ca.gov by the date and time specified in Section I. General Information, Item B. Key Action Dates.

2. Bids must include the Bidder’s submission in with the subject line identifying the submission as BID – Company Name.

3. Bids must be consecutively numbered, each required element clearly identified, and in the sequence presented in this RFQ-ITS. Include all necessary supporting documentation (i.e., licenses, certifications, etc.) necessary to validate the Bidder’s qualifications.

4. Email Requirements

a. Bidders must ensure that emails do not exceed a file size of 20 megabytes.

b. Bidders must ensure that emails do not contain scripts, executable files, password protection, or macros, which may make their emails undeliverable.

c. Do not imbed links within the PDF—all documents must be contained within the PDF. SCO cannot access links to external sources. Bids containing links to external sources will be rejected.

d. If email #1, identified as BID, should exceed acceptable file size, the Bidder shall split the email into multiple emails to ensure delivery.

e. Bid submissions that are sent from unrecognized email servers may be blocked by SCO security filters and be flagged as spam, thereby rendering them unsubmitted.

f. Successful email submissions will receive an automatic reply from admcpu@sco.ca.gov.

Automatic replies only confirm receipt of emails and do not assess bidders’ responsiveness to the RFQ-ITS requirements in the email content or in any attachments therein.

g. LATE BID SUBMISSIONS WILL NOT BE ACCEPTED—NO EXCEPTIONS.

5. If the Bid is made under a fictitious name or business title, the actual legal name of the Bidder must be provided.

6. All bids shall include the documents identified on Attachment 1, Required Attachment Checklist. All attachments must include the information stated, and as instructed on each of the attachments (if applicable). Bids not including the proper required attachments shall be deemed nonresponsive. A nonresponsive bid is one that does not meet the Bid requirements.

7. Bids must be submitted for the performance of all services described herein. Any deviation from the work specifications will not be considered and the Bid will be rejected.

8. A bid may be rejected if it is conditional or incomplete, or if it contains any alterations of form or other irregularities of any kind. SCO may reject any or all bids and may waive any immaterial deviation in a bid. SCO waiver of an immaterial deviation shall in no way modify the RFQ-ITS document or excuse the Bidder from full compliance with all requirements if awarded the Agreement.

9. All documents contained in the Bid requiring a signature must bear the original signature of a person authorized to bind the Bidder’s firm contractually. Electronic signatures will be accepted.

10. An error in the Bid may cause the rejection of the Bid; however, SCO may correct obvious calculation errors at its sole option. If corrected, the Bidder will be provided the correction for validation.

G. Participation, Preference and Incentive Programs

The Preference and Incentive Programs listed below may be combined but will not exceed a combined total of 15 percent of the Bid amount or $100,000 per bid, whichever is less. No bid price will be reduced by more than $100,000, and all preference and incentive cost adjustments are for bid evaluation purposes only and do not alter the actual cost offered by the Bidder.

A SB/MB and a DVBE must have current and valid certification through DGS, Office of Small Business and Disabled Veteran Business Enterprise Certification Services (OSDS). Completed certification applications and required support documents must be submitted to OSDS no later than 5:00 PM PT on the Final Date for Bid Submission and OSDS must be able to approve the application as submitted.

For certification and preference approval process information, contact OSDS by telephone at

(916) 375-4940 or access OSDS Internet website at https://www.dgs.ca.gov/PD/About/Page-Content/PD- Branch-Intro-Accordion-List/OSDS/OSDS.

1. Disabled Veteran Business Enterprise Program

The DVBE Participation Program requirements for this solicitation have been waived. However, SCO is committed to achieving legislatively established goals for the participation of DVBEs and seeks to use certified DVBE business whenever possible. Therefore, SCO requests the Bidder’s voluntary participation in reporting any certified DVBEs that will be used in the performance of this agreement.

Each listed certified DVBE must perform a commercially useful function in the performance of the Agreement as defined in GC Section 14837(d)(4).

2. Disabled Veteran Business Enterprise Incentive

Firms that are DVBEs or are voluntarily utilizing DVBE subcontractors can have an incentive applied based on their level of DVBE participation identified in the Bid, not to exceed five percent. The DVBE Incentive is for bid computation purposes only and is only applied to responsive bids from responsible bidders proposing DVBE participation. Information and instructions on the DVBE Incentive are found at: https://www.dgs.ca.gov/- /media/Divisions/PD/OSDS/Certification/DVBE/DVBEProgramRequirements.pdf?la=en&hash=FBCA2

57A3ED083F3DBB85ECEEB37013CBCF0545C.

A DVBE must perform a Commercially Useful Function in the performance of the Agreement as defined in Military and Veterans Code (MVC) 999 (B).

The incentive shall be applied as follows:

Confirmed DVBE participation of: Incentive Applied 5.0% or more 5% 4.0% to 4.99% 4% 3.0% to 3.99% 3% 2.0% to 2.99% 2% 1.0% to 1.99% 1%

a. The incentive is subject to a minimum of one percent and a maximum of five percent of the available cost. Bids with DVBE participation of more than five percent will be calculated with a five percent incentive.

https://www.dgs.ca.gov/PD/About/Page-Content/PD-Branch-Intro-Accordion-List/OSDS/OSDS https://www.dgs.ca.gov/PD/About/Page-Content/PD-Branch-Intro-Accordion-List/OSDS/OSDS https://www.dgs.ca.gov/-/media/Divisions/PD/OSDS/Certification/DVBE/DVBEProgramRequirements.pdf?la=en&hash=FBCA257A3ED083F3DBB85ECEEB37013CBCF0545C https://www.dgs.ca.gov/-/media/Divisions/PD/OSDS/Certification/DVBE/DVBEProgramRequirements.pdf?la=en&hash=FBCA257A3ED083F3DBB85ECEEB37013CBCF0545C https://www.dgs.ca.gov/-/media/Divisions/PD/OSDS/Certification/DVBE/DVBEProgramRequirements.pdf?la=en&hash=FBCA257A3ED083F3DBB85ECEEB37013CBCF0545C

b. The required list of California certified DVBE subcontractors must be provided on Attachment 5, Bidder Declaration (Written) (GSPD-05-105) and must include the following: 1) subcontractor name, 2) address, 3) phone number, 4) a description of the work to be performed and/or products supplied, 5) and the dollar amount or percentage of the net bid price (as specified in the solicitation) per subcontractor.

c. The DVBE Incentive is computed from the lowest responsive and responsible bid price.

d. Application of the DVBE incentive cannot displace a California Certified Small Business.

e. Contractor understands and agrees that should award of this contract be based in part on their commitment to use the Disabled Veteran Business Enterprise (DVBE) subcontractor(s) identified in their proposal , per Military and Veterans Code 999.5 (e), a DVBE subcontractor may only be replaced by another DVBE subcontractor and must be approved by the Department of General Services (DGS). Changes to the scope of work that impact the DVBE subcontractor(s) identified in the Proposal and approved DVBE substitutions will be documented by agreement amendment.

f. Failure of the Contractor to seek substitution and adhere to the DVBE participation level identified in the Proposal may be cause for agreement termination, recovery of damages under rights under rights and remedies due to the State, and penalties as outlined in M&VC § 999.9, Public Contract Code (PCC) § 10115.10, or PCC § 4110 (applies to public works only).

g. If the awarded contractor has a certified DVBE perform an element of work for the Agreement, within 60 days of expiration of the Agreement, the awarded contractor shall complete and submit to SCO a Prime Contractor’s Certification - DVBE Subcontractor Report (STD 817).

3. Small Business Preference Program

a. Current law encourages state departments to first consider a SB/MB Enterprise for contracting opportunities. SCO is committed to supporting SB/MB participation in state contracting and seeks to use certified SBs/MBs whenever possible.

b. Section 14835, et seq., of the California GC requires that a five percent preference be given to bidders who certify as a SB/MB. The rules and regulations of this law are contained in Title 2, California Code of Regulations, Section 1896, et seq. A copy of the regulation is available upon request.

c. The SB/MB Preference may not exceed $50,000 for any bid. This preference cost adjustment is for bid evaluation purposes only and does not alter the actual cost offered by the Bidder.

4. Non-Small Business Preference Request

a. A five percent bid preference is available to a non-small business claiming 25 percent California certified SB subcontractor participation. If claiming the non-small business subcontractor preference, the Bid must include a list of the SB(s) with which you commit to subcontract in an amount of at least 25 percent of the net bid price with one or more California certified SBs. Each listed certified SB must perform a Commercially Useful Function in the performance of the Agreement as defined in GC Section 14837(d)(4).

b. The required list of California certified SB subcontractors must be provided on Attachment 5, Bidder Declaration (Written) (GSPD-05-105) and must include the following: 1) subcontractor name, 2) address, 3) phone number, 4) a description of the work to be performed and/or products https://www.documents.dgs.ca.gov/dgs/fmc/pdf/std817.pdf supplied, 5) and the dollar amount or percentage of the net bid price (as specified in the solicitation) per subcontractor.

c. In granting the Non-Small Business Preference, no bid price will be reduced by more than

$50,000. This preference cost adjustment is for bid evaluation purposes only and does not alter the actual cost offered by the Bidder.

d. A non-small business is defined as a responsive/responsible bidder that is not certified by the

DGS OSDS as a SB/MB enterprise.

5. Target Area Contract Preference Act (TACPA)

Preference will be granted to California-based contractors in accordance with GC Section 4530 whenever the contract for goods and services are in excess of $100,000 and the Contractor meets certain requirements as defined in the California Code (Title 2, Section 1896.30) regarding labor needed to produce the goods or provide the services being procured. Bidders wishing to take advantage of this preference will need to review the following website: Request Target Area Contract Preference and submit the appropriate response with the Bid.

NOTE: Bidders are not required to apply for the TACPA preference. Denial of TACPA preference requests is not a basis for rejection of the Bid. Agreements awarded with applied preferences will be monitored throughout the life of the Agreement for compliance to statutory, regulatory, and contractual requirements. SCO will take appropriate corrective action to apply sanctions as necessary to enforce performance programs

H. Award and Protest

1. Award

a. Award of agreement, if made, will be in accordance with the RFQ-ITS information on evaluation to a responsible bidder whose bid complies with all the requirements of the RFQ-ITS documents and an addenda thereto, except for such immaterial defects as may be waived by the State. Award will be to the Bidder with the lowest cost.

b. Award, if made, will be made within 45 days after the scheduled date for Agreement Award as specified in Section I, General Information, Section B, Key Action Dates; however, a bidder may extend the offer beyond 45 days in the event of a delay of agreement award.

c. Whenever an agreement is awarded under a procedure that provides for competitive bidding, but the Agreement is not to be awarded to the low bidder, the low bidder shall be notified by email five working days prior to the award of the Agreement.

d. Notice of the proposed award shall be posted for five working days prior to awarding the

Agreement in a public place at SCO, 300 Capitol Mall, 15th Floor, Sacramento, CA 95814, and on the Small Business and Disabled Veteran Business Enterprises Advocate and Liaison page on the SCO website under Notice of Intent to Award Contract at: Small Business and Disabled Veteran Business Enterprises Advocate and Liaison.

2. Protest

a. Any bidder’s issues regarding solicitation requirements must be resolved (or attempts to resolve them must have been made) before a protest may be submitted according to the procedure below.

These issues will first be resolved by the contact for the solicitation or if they result in a protest, the https://www.dgs.ca.gov/PD/Services/Page-Content/Procurement-Division-Services-List-Folder/Request-Target-Area-Contract-Preference?search=TACPA https://www.dgs.ca.gov/PD/Services/Page-Content/Procurement-Division-Services-List-Folder/Request-Target-Area-Contract-Preference?search=TACPA https://sco.ca.gov/sco_sb_dvbe_advocate.html https://sco.ca.gov/sco_sb_dvbe_advocate.html protest will be submitted to DGS Procurement Division Deputy Director to hear and resolve issues and whose decision will be final.

b. If a bidder has submitted a bid which it believes to be responsive to the requirements of the RFQ-

ITS and to be the bid that should have been selected according to the evaluation procedures in the solicitation and the bidder believes the State has incorrectly selected another bidder for award, the bidder may submit a protest of the selection as described below. Protests regarding selection of the “successful vendor” will be heard and resolved by the Victim Compensation and Government Claims Board whose decision will be final.

c. All protests of award must be made in writing, signed by an individual authorized to bind the bidder contractually and financially, and contain a statement of the reason(s) for protest; citing the law, rule, regulation or procedure on which the protest is based. The protester must provide facts and evidence to support the claim. Protests must be mailed or delivered to:

Street and Mailing Address:

Deputy Director Procurement Division 707 Third Street, Second Floor South West Sacramento, CA 95605 Facsimile No.: (916) 375-4611

d. All protests to the RFQ-ITS or protests concerning the evaluation, recommendation, or other aspects of the selection process must be received by the DGS Procurement Division Deputy Director as promptly as possible, but not later than the date indicated in the Notice of Intent to Award. Certified or registered mail must be used unless delivered in person, in which case the protester should obtain a receipt of delivery.

e. If any bidder, prior to the award of the Agreement, files a written protest with SCO and the DGS, Office of Legal Services (OLS), 707 Third Street, 7th Floor, Suite 7-330, West Sacramento, CA 95605, on the grounds that the (protesting) Bidder is the lowest responsive responsible bidder, the Agreement shall not be awarded until either the protest has been withdrawn or DGS has decided the matter.

f. Within five days after filing the protest, the protesting bidder shall file with DGS/OLS and SCO, a detailed written statement specifying the grounds for the protest. The written protest must be sent to DGS/OLS, 707 Third Street, 7th Floor, Suite 7-330, West Sacramento, CA 95605. A copy of the detailed written statement must be emailed to SCO at: admcpu@sco.ca.gov, Attention: SCO Contracts and Procurement Office.

SECTION II. EVALUATION INFORMATION

A. Evaluation Process

Bids to this RFQ will first be reviewed for responsiveness to all attachments. The Bid must meet all of the evaluation criteria identified in Section II. Evaluation Information, Item B. Evaluation Criteria. If a bid is missing required information, it may be deemed nonresponsive and subject to disqualification. Further review is subject to SCO discretion.

Award of an agreement resulting from this RFQ-ITS will be to the responsive and responsible bidder with the lowest cost after the application of any preference requirements or incentives as applicable.

B. Evaluation Criteria

The overall responsiveness of each bid is based on the complete bid from the Bidder to the RFQ-ITS requirements. The following four subsections and criteria will be reviewed by the SCO evaluation team:

1. Administrative Requirements (Pass/Fail)

Bids will first be reviewed for responsiveness to the Administrative Requirements identified in Section II. Evaluation Information, Item B.1. Scoring, to include all required attachments listed on Attachment 1, Required Attachment Checklist to determine completeness of required documentation and compliance as identified in this RFQ-ITS. If a bid is missing information required in the Administrative Requirements, it may be deemed nonresponsive and will therefore be ineligible for further consideration.

Administrative Requirements will be evaluated on a “pass/fail” basis for all criteria and information. For bids that pass the Administrative Requirements, Technical Requirements identified in Section II.

Evaluation Information, Item C. Scoring and the cost will be evaluated.

2. Cost

Completion of Attachment 15, Cost Worksheet.

Cost Worksheets will be reviewed to verify mathematical accuracy and determine if there are any deviations in the Bid. If a deviation is material, it may be cause for rejection. Immaterial deviations will be processed as if no deviation had occurred. Cost Worksheets shall be evaluated and scored based on the total cost.

3. Participation, Preference, and Incentive Programs (as applicable)

4. Scoring

Each bid will be evaluated in accordance with this section. This agreement will be awarded to the responsive and responsible bid with the lowest cost.

DESCRIPTION Total Points Possible

Points Scored

(By SCO) Administrative Requirements Bid received by date/time specified in Section I, Item B., Key Action Dates Pass/Fail

Bid email received in PDF format Pass/Fail Attachment 1, Required Attachment(s) Checklist and all required/applicable attachments listed on it received Pass/Fail

Cost Bidder’s Cost Participation, Preference and Incentive Programs (as applicable) Small Business Preference 5% DVBE Incentive TBD Non-Small Business Preference 25%

Target Area Contract Preference Act TBD Total Preference and/or Incentive

Total Summary Calculated Cost Cost*

*After application Preference and Incentive

C. Tie Break Process

In the event of a precise tie, if GC Section 14838(f) does not apply to the Bidders, a witnessed coin toss will be conducted by the Procurement Official. If a coin toss is needed, the Procurement Official will schedule and arrange for the coin toss and non-partisan witnesses, subsequently notifying the participating bidders of the outcome of the coin toss.

ATTACHMENT 1

REQUIRED ATTACHMENT CHECKLIST

Bidder’s Name: _____________________________________________________________ (Please print clearly or type)

A complete bid will consist of the required items identified below. Please initial in the “Submitted to SCO” next to each item that you are submitting to SCO. For your bid to be responsive, all required attachments must be returned. Further review is subject to SCO discretion. This checklist must be signed and returned with your bid package.

Requirement Description Submitted to SCO

Attachment 1 Required Attachment Checklist Attachment 2 Bidder Certification Sheet Attachment 3 Contractor Point of Contact

Attachment 4 Payee Data Record (STD 204) and Payee Data Record Supplement

(STD 205)*

Attachment 5 Bidder Declaration (Written) (GSPD-05-105)*

Attachment 6 Disabled Veteran Business Enterprise (DVBE) Declarations (DGS PD 843)*

Attachment 7 Generative Artificial Intelligence (GenAI) Disclosure & Factsheet (STD 1000)

Attachment 8 Target Area Contract Preference Act Preference Request for Goods and Services Solicitations (STD 830)*Bidding Preferences and Incentives

Attachment 9 Bidder’s Summary of Contract Activities and Labor Hours (DGS PD 526)* Attachment 10 Bidding Preferences and Incentives Attachment 11 Acknowledgement of Agreement Exhibits and Policies Attachment 12 California Civil Rights Laws Certification (DGS OLS 04)

Attachment 13 Contractor/Consultant Confidentiality and Non-Disclosure Acknowledgement (ISO-004b)

Attachment 14 Contractor/Consultant Organization Information Security Agreement (ISO-004c)

Attachment 15 Cost Worksheet Additional

Requirement California Certified Small/Micro Business and/or DVBE Certification*

Additional Requirement

Copy of valid California city or county business license (if applicable); or an affidavit that the business is in good standing with the state, province, or country in which business is headquartered.

*Submit only if applicable.

Authorized Signature and Title

Date

ATTACHMENT 2

BIDDER CERTIFICATION SHEET

Complete and return this attachment with the Bid package. An individual who is authorized to bind the bidding firm contractually shall sign the RFQ-ITS Attachment 2, Bidder Certification Sheet. The signature must indicate the title or position that the individual holds in the firm. The Bidder certifies the following:

1. Our all-inclusive cost is submitted as detailed in Attachment 15, Cost Worksheet.

2. All required attachments are included with this certification sheet.

3. The bid provided meets all Administrative and detailed in Section II. Evaluation Information, Item C.

Scoring.

4. The signature affixed hereon and dated certifies compliance with all the requirements of this bid document. The signature below authorizes the verification of this certification. An unsigned bidder certification sheet may be cause for rejection.

1. Company Name 2. Telephone

2a. Fax Number

3. Address

Indicate your organization type:

4. Sole Proprietorship 5. Partnership 6. Corporation 7. Limited Liability Co.

(LLC)

Indicate the applicable employee and/or corporation number:

8. Federal Employee ID No. (FEIN) 9. California Corporation No.

10. Indicate applicable license and/or certification information:

11. Bidder’s Name (Print) 12. Title

12. Signature 14. Date

15. Are you certified with the Department of General Services (DGS), Office of Small Business and Disabled Veteran Business Enterprise Services (OSDS) as:

a. California Small Business

Yes No If yes, enter certification number:

b. Disabled Veteran Business Enterprise Yes No

If yes, enter your certification number below:

NOTE: A copy of your certification is required to be included if either of the above items is checked Yes.

Date application was submitted to OSDS, if an application is pending:

COMPLETION INSTRUCTIONS FOR BIDDER CERTIFICATION SHEET

Complete the numbered items on the Bidder Certification Sheet by following the instructions below.

Item Numbers Instructions 1, 2, 2a, 3 Must be completed. These items are self-explanatory.

4 Check if your firm is a sole proprietorship. A sole proprietorship is a form of business in which one person owns all the assets of the business in contrast to a partnership and corporation. The sole proprietor is solely liable for all the debts of the business.

5 Check if your firm is a partnership. A partnership is a voluntary agreement between two or more competent persons to place their money, effects, labor, and skill, or some or all of them in lawful commerce or business, with the understanding that there shall be a proportional sharing of the profits and losses between them. An association of two or more persons to carry on, as co-owners, a business for profit.

6 Check if your firm is a corporation. A corporation is an artificial person or legal entity created by or under the authority of the laws of a state or nation, composed, in some rare instances, of a single person and his successors, being the incumbents of a particular office, but ordinarily consisting of an association of numerous individuals.

7 Check if your firm is a limited liability company (LLC). An LLC is a business entity comprised of one or members owning a certain share of the company. It generally offers liability protection similar to that of a corporation but is taxed differently.

8 Enter your federal employee tax identification number.

9 Enter your corporation number assigned by the California Secretary of State’s Office.

This information is used for checking if a corporation is in good standing and qualified to conduct business in California.

10 Complete, if applicable, by indicating the type of license and/or certification that your firm possesses and that is required for the type of services being procured.

11, 12, 13, 14 Must be completed. These items are self-explanatory.

15 If certified as a California SB, place a check in the "Yes" box, and enter your certification number on the line. If certified as a DVBE, place a check in the "Yes" box and enter your service code on the line. If you are not certified to one or both, place a check in the "No" box. If your certification is pending, enter the date your application was submitted to

OSDS.

ATTACHMENT 3

CONTRACTOR POINT OF CONTACT

Complete and return this attachment with the Bid.

The contact person regarding this RFQ-ITS is:

Name & Title:

Address:

Phone Number: Fax Number:

Cell Phone Number:

(optional)

Email:

If awarded an agreement, the Project Manager for services will be:

Address:

Phone Number: Fax Number:

Cell Phone

If awarded an agreement, direct all Contract inquiries to:

Address:

Phone Number: Fax Number:

Cell Phone

If awarded an agreement, the name of the company officer authorized to sign the Contract is:

Address:

ATTACHMENT 4

PAYEE DATA RECORD (STD 204) AND PAYEE DATA RECORD SUPPLEMENT (STD 205)*

Payee Data Record (STD 204) is required and must be submitted.

https://www.documents.dgs.ca.gov/dgs/fmc/pdf/std204.pdf

Only use Payee Data Record Supplement (STD 205)* to provide a remittance address if different from the mailing address for information returns, or to make subsequent changes to the remittance address https://www.documents.dgs.ca.gov/dgs/fmc/pdf/std205.pdf

ATTACHMENT 5

BIDDER DECLARATION (Written) (GSPD-05-105)

All bidders must complete and sign the Bidder Declaration (Written) (GSPD-05-105) and include it with the Bid. When completing the declaration, bidders must identify all subcontractors proposed for participation in the Agreement. Bidders awarded an agreement are contractually obligated to use the subcontractors for the corresponding work identified unless SCO agrees to a substitution, and it is incorporated by amendment to the Agreement.

https://www.documents.dgs.ca.gov/dgs/fmc/gs/pd/gspd05-105.pdf.

ATTACHMENT 6

DISABLED VETERAN BUSINESS ENTERPRISE (DVBE) DECLARATIONS (DGS PD 843)*

https://www.documents.dgs.ca.gov/dgs/fmc/gs/pd/pd_843.pdf

ATTACHMENT 7

GENERATIVE ARTIFICIAL INTELLIGENCE (GENAI) DISCLOSURE & FACTSHEET (STD 1000)

The State of California seeks to realize the potential benefits of GenAI, through the development and deployment of GenAI tools, while balancing the risks of these new technologies.

Bidders/Offerors must notify the State in writing if their solution or service includes, or makes available, any GenAI technology, including GenAI from third parties or subcontractors. The State has developed a GenAI Disclosure & Factsheet to be completed by the Bidder. Bidders must submit a completed STD 1000 - GenAI Disclosure and Factsheet with their bid to be deemed responsive.

Failure to disclose GenAI to the State and submit the STD 1000 - GenAI Disclosure and Factsheet will result in disqualification of the Bidder and may void any resulting contract. The State reserves its right to seek any and all relief it may be entitled to as a result of such non-disclosure.

Upon receipt of a Bidder STD 1000 - GenAI Disclosure and Factsheet the state reserves the right to incorporate GenAI Special Provisions into the final contract or reject bids/offers that present an unacceptable level of risk to the state.

https://www.documents.dgs.ca.gov/dgs/fmc/pdf/std1000.pdf https://www.documents.dgs.ca.gov/dgs/fmc/pdf/std204.pdf https://www.documents.dgs.ca.gov/dgs/fmc/pdf/std205.pdf https://www.documents.dgs.ca.gov/dgs/fmc/gs/pd/gspd05-105.pdf https://www.documents.dgs.ca.gov/dgs/fmc/gs/pd/pd_843.pdf https://www.documents.dgs.ca.gov/dgs/fmc/pdf/std1000.pdf

ATTACHMENT 8

TARGET AREA CONTRACT PREFERENCE ACT

PREFERENCE REQUEST FOR GOODS AND SERVICES SOLICITATIONS (STD 830)*

https://www.documents.dgs.ca.gov/dgs/fmc/pdf/std830.pdf

ATTACHMENT 9

BIDDER’S SUMMARY OF CONTRACT ACTIVITIES AND LABOR HOURS (DGS PD 526)*

https://www.documents.dgs.ca.gov/dgs/fmc/gs/pd/gspd0526.pdf

NOTE: The fill and print forms are available at the links provided. Please email admcpu@sco.ca.gov if you are unable to access the links provided. Attachments 4, 5, and 7, must be submitted with the Bid.

https://www.documents.dgs.ca.gov/dgs/fmc/pdf/std830.pdf https://www.documents.dgs.ca.gov/dgs/fmc/gs/pd/gspd0526.pdf

ATTACHMENT 10

BIDDING PREFERENCES AND INCENTIVES

THE BIDDER MUST CHECK THE APPROPRIATE BOX FOR ALL SECTIONS BELOW AND SUBMIT WITH

THEIR BID.

1. SMALL BUSINESS PREFERENCE AND INCENTIVE:

☐ I am a DGS certified Small Business and claim the Small Business Preference. My DGS Small Business certification number is: _______________Expiration Date:__________

☐ I am not a DGS certified Small Business, but 25 percent or more of the revenue from the award will go to DGS certified Small Business subcontractors performing a Commercially Useful Function and therefore I am claiming the incentive.

Bidder must complete and submit Attachment 5: Bidder Declaration (Written) (GSPD- 05-105), indicating the percentage of the revenue that will be received by each DGS certified Small Business subcontractor.

☐ I am not claiming the DGS Small Business Preference or Incentive.

2. DVBE INCENTIVE:

☐ I am a DGS certified DVBE. A copy of my DGS PD 843 form is attached.

☐ I am not a DGS certified DVBE, but a percentage of the revenue will be going to DGS certified DVBE Subcontractors performing a Commercially Useful Function, and therefore I am claiming the DVBE incentive.

Bidder must submit a complete Attachment 5: Bidder Declaration (Written) (GSPD-05- 105), indicating the percentage of the revenue that will be received by each DGS certified DVBE subcontractor. Bidder must also submit an Attachment 6, DVBE Declarations (DGS PD 843), for each DVBE subcontractor, signed by the DVBE owner/manager.

☐ I am not claiming the DVBE Incentive.

3. TARGET AREA CONTRACT PREFERENCE ACT (TACPA):

☐ I am claiming the TACPA bidding preference.

Bidder must submit Attachment XX Target Area Contract Preference Act (TACPA) STD 830 and Attachment XX Bidder’s Summary of Contract Activities and Labor Hours (DGS

PD 526).

☐ I am not claiming the TACPA bidding preference.

Name of Bidder:

Signature and Date:

ATTACHMENT 11

ACKNOWLEDGEMENT OF AGREEMENT EXHIBITS AND POLICIES

Complete and return a signed copy of this attachment with the Bid.

Exhibit Name Exhibit A – Scope of Work Exhibit B – Budget Detail and Payment Provisions Exhibit B – Attachment 1, Cost Worksheet.

Note: Attachment 15, Cost Worksheet to be inserted upon agreement award Exhibit C – Information Technology General Provisions – Cloud Computing Services – GSPD-ITGP (Cloud) (Revised and Effective 11/12/2024) https://www.dgs.ca.gov/~/media/Divisions/PD/Acquisitions/Solicitation-Document-Attachments/GSPDITGP- CloudRevised-and-Effective-111224.docx

The Bidder acknowledges their ability to meet the following as required in Sample Agreement, Exhibit A, Scope of Work:

I certify that we have received, reviewed, and accepted all requirements in this RFQ-ITS, Sample Agreement and Exhibits.

Authorized Signature Date

Name of Contractor Firm

Name and Title (Please Print) https://www.dgs.ca.gov/%7E/media/Divisions/PD/Acquisitions/Solicitation-Document-Attachments/GSPDITGP-CloudRevised-and-Effective-111224.docx https://www.dgs.ca.gov/%7E/media/Divisions/PD/Acquisitions/Solicitation-Document-Attachments/GSPDITGP-CloudRevised-and-Effective-111224.docx

ATTACHMENT 12

CALIFORNIA CIVIL RIGHTS LAWS CERTIFICATION (DGS OLS 04)

Pursuant to Public Contract Code Section 2010, if a bidder or proposer executes or renews agreement contract over $100,000 on or after January 1, 2017, the Bidder or proposer hereby certifies compliance with the following:

1. CALIFORNIA CIVIL RIGHTS LAWS: For contracts over $100,000 executed or renewed after January 1, 2017, the Contractor certifies compliance with the Unruh Civil Rights Act (Section 51 of the Civil Code) and the Fair Employment and Housing Act (§12960 of the GC); and

2. EMPLOYER DISCRIMINATORY POLICIES: For contracts over $100,000 executed or renewed after

January 1, 2017, if a contractor has an internal policy against a sovereign nation or peoples recognized by the United States government, the Contractor certifies that such policies are not used in violation of the Unruh Civil Rights Act (Section 51 of the Civil Code) or the Fair Employment and Housing Act (Section 12960 of the GC).

CERTIFICATION

I, the official named below, certify under penalty of perjury under the laws of the State of California that the foregoing is true and correct.

Proposer/Bidder Firm Name (Printed)

Federal ID Number

By (Authorized Signature)

Printed Name and Title of Person Signing

Date Executed Executed in the County and State of

ATTACHMENT 13

CONTRACTOR/CONSULTANT CONFIDENTIALITY AND NON-DISCLOSURE

ACKNOWLEDGEMENT (ISO-004b)

State Controller’s Office

ATTACHMENT 14

CONTRACTOR/CONSULTANT ORGANIZATION INFORMATION SECURITY AGREEMENT

(ISO-004c)

State Controller’s Office

ATTACHMENT 14

CONTRACTOR/CONSULTANT ORGANIZATION INFORMATION SECURITY AGREEMENT

(ISO-004c)

State Controller’s Office

ATTACHMENT 15

COST WORKSHEET

The amounts of services listed below are only estimates. SCO does not expressly or by implication agree that any amount of work will be guaranteed and reserves the right to omit portions of the work as may be deemed necessary. However, the actual costs bid below by the Bidder shall be binding by the Contractor for the term of the Agreement. Any amendments to the Agreement will adhere to these amounts.

Cost includes all labor, supplies, equipment, travel, per diem, parking fees, vehicle, taxes, insurance, licenses, permit fees, additional fees, and any other associated cost necessary to provide the contracted services. SCO will not pay for any costs not included in the Total Agreement Amount.

The Bidder must provide a line-item cost for each item identified.

Year One Term: 2/1/2025 to 1/31/2026

Software Services Description Item # Quantity Extended Cost Qualys Express Suite:

• Includes unlimited user accounts

• 24x7 email and telephone Customer Support

• Free certification and training

• Approved scanning vendor for PCI

• Unlimited Scheduled and On-Demand security scans

• Unlimited network discovery maps

• Remediation workflow management

• Interactive and Template based reporting

(Patch, Exec, Scorecard, etc.)

Q-ESUITE 1 $

Qualys Web Application Scanning

• Automated custom web application scanning for SQL injection and XSS vulnerabilities.

Q-X-WAS 100 $

Qualys Malware Detection Service for Sites Q-MDS S 100 $

Qualys Scanner Appliance - Annual

• Daily vulnerability signature updates & maintenance

• Warranty for life of term

Q-SAE 1 $

Qualys VMDR Bundle; Vulnerability Management, Detection, and Response, includes the following Qualys Modules:

• Cloud Agent VM, includes VM scanning Internal & External. Qualys PCI is bundled at no additional cost with External IPs only.

• Threat Protection

• Continuous Monitoring

• Patch Detection

• Cloud Agent SCA - includes authenticated scanning

• Standard API - Application Programming Interface

• Virtual Scanner (Unlimited)

• CertView Internal & External

• Global IT Asset Inventory

• Cloud Inventory

• Container Inventory

• Secure Enterprise Mobility (Inventory)

Q-S-VMDR 3,000 $

Qualys Policy Compliance - Includes Policy Compliance Agent Q-S-POL 3,000 $

Qualys Patch Management (PM) – Annual Term for Windows Agent Q-S-PM 3,000 $

Qualys Endpoint Detection Response with Anti-Malware Q-S-EDR-AM 3,000 $

Qualys CyberSecurity Asset Management Includes ServiceNow

CMDB

Q-S-CSAM 3,000 $

Qualys Security Assessment Express Package for 10 Users Q-X-SAQ 10 $

Qualys Security Assessment Questionnaire Express Add-On Q-X-SAQADDON 40 $

Year One Cost: $

Year Two Term: 2/1/2026 to 1/31/2027

Software Services Description Item # Quantity Extended Cost Qualys Express Suite:

• Includes unlimited user accounts

• 24x7 email and telephone Customer Support

• Free certification and training

• Approved scanning vendor for PCI

• Unlimited Scheduled and On-Demand security scans

• Unlimited network discovery maps

• Remediation workflow management

• Interactive and Template based reporting

(Patch, Exec, Scorecard, etc.)

Q-ESUITE 1 $

Qualys Web Application Scanning

• Automated custom web application scanning for SQL injection and XSS vulnerabilities.

Q-X-WAS 100 $

Qualys Malware Detection Service for Sites Q-MDS S 100 $

Qualys Scanner Appliance - Annual

• Daily vulnerability…