EINF90125_RFQ-ITS.pdf

MALIA M. COHEN

CALIFORNIA STATE CONTROLLER

January 16, 2026

REQUEST FOR QUOTE for INFORMATION TECHNOLOGY (IT) SERVICES (RFQ-ITS) EINF90125

IT Consulting – IT Physical Security Assessment Services

Bidders are invited to review and respond to the State Controller's Office (SCO) Request for Quote for Information Technology (IT) Services (RFQ-ITS) Number EINF90125. To submit a bid for these services, the Bidder must comply with the instructions contained in this document as well as the requirements stated in Standard Agreement, Exhibit A, Scope of Work. By submitting a bid, the bidding firm agrees to the terms and conditions stated in this RFQ-ITS.

Read the attached document carefully. The Bidder is solely responsible for ensuring that the complete bid is received by SCO in accordance with the Bid requirements, prior to the date and time specified in the solicitation. Bids received after the specified deadline will not be considered for review. SCO shall not be responsible for any delays in submittal, to include misdelivery. SCO reserves the right to cancel this RFQ-ITS without cause, at any time prior to award.

Bidders are advised to check the Cal eProcure website for addendums, modifications, and updates to the Bid documents. SCO is not responsible for failure of the prospective bidder to check for any bid document updates, changes, or answers to questions posted on Cal eProcure. Failure to check the website periodically will be at the Bidder’s sole risk.

If a discrepancy occurs between the information in the advertisement appearing on the Department of General Services (DGS), California State Contracts Register (CSCR) on the Cal eProcure website:

https://caleprocure.ca.gov/pages/Events-BS3/event-search.aspx and the information in the herein RFQ-ITS, the information in the attached RFQ-ITS shall take precedence.

Note that all IT agreements entered into with the State of California will include by reference General Provisions Non-Cloud Goods & Services GSPD-403 ITGP (Non-Cloud) that may be viewed and downloaded at internet site https://www.dgs.ca.gov/-/media/Divisions/PD/PTCS/OPPL/Model- Language/IT/ITGeneralProvisions062122.pdf If you do not have internet access, a hard copy can be provided.

In the opinion of SCO, this RFQ-ITS is complete and without need of explanation. However, if you have questions, or should you need any clarifying information, please send an email to SCOBids@sco.ca.gov by the Written Questions Submittal Deadline in Section I, General Information, Item B. Key Action Dates.

Please note that no verbal information given will be binding upon SCO unless such information is issued in writing through an official addendum.

State Controller’s Office RFQ-ITS Number EINF90125

TABLE OF CONTENTS

SECTION I. GENERAL INFORMATION

A. Description of Services B. Key Action Dates C. Written Questions and Answers D. Cost Opening E. RFQ-ITS Bid Guidelines F. RFQ-ITS Bid Content

1. Administrative Requirements

2. Bidder’s Minimum Qualifications

3. Bidder's Desirable Qualifications

4. Key Staff Minimum Qualifications

5. Key Staff Desirable Qualifications

6. Letter of Guarantee

7. Licenses and Certifications

8. Bidder References

9. Key Staff References

G. Background Check H. RFQ-ITS Bid Submission I. Preference and Incentive Programs J. Award and Protest

SECTION II. EVALUATION INFORMATION

A. Evaluation Process B. Evaluation Criteria C. Scoring D. Tie Break Process Attachment 1, Required Attachment Checklist Attachment 2, Bidder Certification Sheet Attachment 3, Contractor Point of Contact Attachment 4, Payee Data Record (STD204) and Payee Data Record Supplement (STD 205)* Attachment 5, Contractor Ceritifcation Clauses (CCC 04/2017) Attachment 6, Bidder Declaration (Written) (GSPD-05-105) Attachment 7, Secretary of State Certification of Status* Attachment 8, Disabled Veteran Business Enterprise (DVBE) Declarations (DGS PD 843)* Attachment 9, Generative Artifiicial Intelligence (GenAI) Disclosure ………………………………...26 Attachment 10, Bidding Preferences and Incentives Attachment 11, Acknowledgement of Agreement Exhibits and Policies Attachment 12, California Civil Rights Laws Certification (DGS OLS 04) Attachment 13, Contractor/Consultant Confidentiality and Non-Disclosure Acknowledgement

(ISO-004b) Attachment 14, Contractor/Consultant Organization Information Security Agreement (ISO-004c)

Attachment 15, Insurance Acknowledgment…………………………………………………………………. 33 Attachment 16, Bidder Reference Form……………………………………………………………………….34 Attachment 17, Key Staff Reference Form……………………………………………………………… Attachment 18, Cost Worksheet…………………………………………………………………………

Standard Agreement (STD 213) Exhibit A – Scope of Work Exhibit A – Attachment 1, Deliverable Expectation Document, (DED), (Sample) Exhibit A – Attachment 2, Deliverable Acceptance Document (DAD), (Sample) Exhibit A – Attachment 3, Work Authorization Form, (Sample) Exhibit A – Attachment 4, Personnel Change Order Request Form (Sample)

Exhibit A – Attachment 5, Personnel Change Key Staff Reference Form (Sample) Exhibit B – Budget Detail and Payment Provisions Exhibit B – Attachment 1, Cost Worksheet Exhibit C – Information Technology - General Provisions - Non-Cloud Goods & Services DGS PD 403- ITGP (Non-Cloud) Exhibit D – Special Terms and Conditions Exhibit E – Information Technology, Data, and Security Provisions Exhibit F – Resumes

*Submit only if applicable.

SECTION I. GENERAL INFORMATION

A. Description of Services

The State Controller’s Office (SCO) is seeking a contractor to provide information technology (IT) consulting services on the SCO controls, systems, applications, network infrastructure, and architecture specific to physical security. All services provided shall support a physical security assessment aligned with industry standards such as the National Institute of Standards and Technology (NIST) 800-53 Physical and Environmental Protection (PE) family controls. In doing so the Contractor shall evaluate SCO’s existing physical security controls and provide findings and recommendations..

Services will be completed both remotely and onsite. Onsite services shall be performed at SCO facilities (three located in the greater Sacramento area, one in San Francisco, and two in the greater Los Angeles area). All remote services must be performed within the continental United States.

SCO Facility Locations:

300 Capitol Mall, Sacramento, CA 95814 3301 C Street, Sacramento, CA 95816 10600 White Rock Road, Rancho Cordova, CA 95670 888 S. Figueroa Street, Los Angeles, CA 90017 901 Corporate Center Drive, Suite 200, Monterey Park, CA 91754 455 Golden Gate Avenue, Suite 10500, San Francisco, CA, 94102

See the Standard Agreement, Exhibit A, Scope of Work for a complete description of services.

Agreement Term

The term of this agreement will be for one year with SCO reserving the sole right to amend the agreement to add time, modify locations, equipment, and software at its exclusive discretion. The rates on Attachment 18, Cost Worksheet will not change as a result of any amendment to this agreement. This agreement may be terminated by SCO with 30 days’ written notice to the Contractor.

Contractors are cautioned that no work shall begin until the Agreement has been fully executed. If work is performed prior to the Agreement approval, and the Agreement for any reason is not approved, all previous work performed by the Contractor is considered donated to SCO and no payment shall be made for that work.

Agreement Amount

The Contractor and SCO Information Security Office (ISO) Contract Manager (PM) are responsible for monitoring the Agreement cost to ensure it does not exceed the maximum amount of the Agreement without an executed amendment. The Contractor and SCO ISO PM are jointly responsible for continuous monitoring of agreement expenditures. Under no circumstances shall costs exceed the maximum agreement amount without a fully executed written amendment. Any unauthorized expenditures are the sole responsibility of the Contractor and will not be reimbursed by SCO.

B. Key Action Dates

It must be understood that time is always of the essence, both for the RFQ-ITS submittal and for agreement completion. Bidders are advised of the key action dates and times shown below and are expected to adhere to them.

EVENT DATE

Release of RFQ-ITS January 16, 2026

Written Questions Submittal Deadline January 26, 2026: 2:00 PM Pacific Time (PT)

SCO Response to Written Questions January 30, 2026

Final Date for Bid Submission* February 6, 2026: 2:00 PM PT

Evaluation of Bids February 6, 2026 – February 12, 2026

Mandatory Interviews ** February 12-17, 2026

Cost Opening February 18, 2026: 2:00 PM PT via Microsoft Teams

Notice of Intent to Award February 19, 2026

Anticipated Agreement Award Date February 26, 2026

Anticipated Agreement Start Date March 20, 2026

* Dates after the Final Date for Bid Submission are estimates only and may be subject to change. SCO will adhere to the listed dates as strictly as possible but will not be held accountable for changes due to unforeseen circumstances.

** The interview dates are approximate and may be adjusted by SCO as needed without an addendum to this RFQ-ITS. Bidders and key staff should be available during the Key Action Dates identified to participate in interviews. If deemed nonresponsive or unavailable to interview, bidders will receive zero points for this scoring component.

C. Written Questions and Answers

1. Bidders may submit questions for clarification of the content of this RFQ-ITS to SCOBids@sco.ca.gov.

2. Questions must be received by the date and time specified in Section I. General Information, Item B.

Key Action Dates. Questions and answers will be provided without identifying the submitter. At the sole discretion of SCO, SCO may paraphrase questions for clarity.

3. The subject line of the email should read, RFQ-ITS EINF90125 Questions – Company Name.

4. The Bidder must reference the section and page number about which they are inquiring.

5. Questions not submitted in writing by the date for Written Questions Submittal Deadline specified in

Section I. General Information, Item B. Key Action Dates, will be answered at SCO option.

6. Questions and Answers will be issued via an addendum to this RFQ-ITS and be posted to Cal eProcure by the date specified in Section I. General Information, Item B. Key Action Dates.

D. Cost Opening

1. The Cost Opening will occur via Microsoft Teams. All bidders will be sent an invite to attend, utilizing the contacts listed on Attachment 3, Contractor Point of Contact included in the Bid submission.

2. To request an invitation to the Cost Opening for anyone not bidding or listed on Attachment 3, Contractor Point of Contact, please email a request to SCOBids@sco.ca.gov by Final Date for Bid Submission identified in Section I. General Information, Item B. Key Action Dates.

3. Invitations to the Cost Opening will be sent as an email meeting notice with the Microsoft Teams link no later than the morning of the Cost Opening identified in Section I. General Information, Item B. Key Action Dates.

E. RFQ-ITS Bid Guidelines

1. Costs incurred for developing bids, in anticipation of award of the Agreement, are entirely the responsibility of the Bidder and shall not be charged to the State of California.

2. It is the Bidder’s responsibility to provide all necessary information for SCO to evaluate the Bid, verify requested information, and determine the Bidder’s ability to perform the services defined in Agreement, Exhibit A, Scope of Work and Attachment 18, Cost Worksheet.

3. Bidders who are DGS certified California Small Businesses (SB), Micro Business (MB) and/or Disabled Veteran Business Enterprises (DVBE) must provide and include a copy of their SB/DVBE certification with the Bid. SCO will verify that SB/DVBE certifications are valid at the time the Bid is due. In accordance with California Government Code (GC) Section 14837(d) and California Military and Veterans Code Section 999, all SB and DVBE contractors, subcontractors, and suppliers that bid on or participate in a State agreement, regardless of being an oral or written solicitation, shall perform a Commercially Useful Function (CUF).

4. The Bidder may modify a bid after its submission by withdrawing its original bid and resubmitting a new bid prior to the Final Date for Bid Submission. Contractor modifications in any other manner, oral or written, will not be considered.

5. The Bidder may withdraw its bid by submitting a written withdrawal request to SCOBids@sco.ca.gov signed by the Bidder or an authorized agent. A bidder may thereafter submit a new bid prior to the Final Date for Bid Submission. Bids may not be withdrawn without cause after the Final Date for Bid Submission.

6. SCO does not accept alternate agreement language from a prospective contractor. A bid with such language will be considered a counter offer and will not be considered. The State’s General Provisions are not negotiable.

7. Bids should provide straightforward and concise descriptions of the Bidder’s ability to satisfy the requirements of this RFQ-ITS. Omissions, inaccuracies, or misstatements will be cause for rejection of a bid.

8. SCO may modify the RFQ-ITS by issuing an addendum, prior to the Final Date for Bid Submission, which will be posted to Cal eProcure.

9. SCO reserves the right to reject all bids. SCO is not required to award an agreement.

10. This RFQ-ITS and the Contractor’s bid will be made a part of the Agreement file.

11. At SCO option prior to award, bidders may be required to submit additional written clarifying information.

Failure to submit the required written information as specified may be grounds for bid rejection.

12. No oral understanding or agreement shall be binding on either party.

F. RFQ-ITS Bid Content

In order to be responsive to this RFQ-ITS, the following requirements must be met. Failure to respond to and submit these items with the required information may result in disqualification.

This requirement is Mandatory Pass/Fail.

1. Administrative Requirements

a. Completion of all required Attachments listed on Attachment 1, Required Attachment Checklist.

b. On Attachment 2, Bidder Certification Sheet, the Bidder must complete, sign, and return the

Attachment. The Bidder will include any necessary supporting documentation (references, certifications, licenses, insurance acknowledgement, etc.) necessary to validate the Bidder’s qualifications.

Attachment 2 must be signed by an individual authorized to bind the business contractually and must identify the title or position that the individual holds in the business.

2. Bidder’s Minimum Qualifications

a. Bidder must provide one key staff who meets the Key Staff Minimum Qualifications listed in RFQ-

ITS Section I General Information, F. RFQ-ITS Bid Content, Item 4.a.

b. Bidder must have performed IT physical security assessment services for at least one corporation or a California State Agency within the last two years.

3. Bidder’s Desirable Qualifications

a. Bidder has performed IT physical security assessment services for corporations or California state agencies beyond the minimum qualification within the last two years. (1 point for each engagement identified in the resume, up to 10 engagements beyond the one engagement for the minimum qualifications within the last two years – 10 points total)

b. Bidder has experience with server and networking topology within the last 10 years. (2 points for each engagement, up to five engagement, identified in the resume within the last ten years – 10 points total)

4. Key Staff Minimum Qualifications

a. Identified key staff must have been employed with bidding firm for at least one year and provide a resume detailing the IT physical security assessment services they have performed, demonstrating a minimum of three years of experience within the last five years conducting IT physical security assessments for government entities.

5. Key Staff Desirable Qualifications

a. Identified key staff has one or more of the following certificates. Provide a copy of each current active certificate.

1) Certified Protection Professional (CPP) (25 points)

2) Physical Security Professional (PSP) (20 points)

3) Industrial Security Professional (ISP) (10 points)

4) Physical Security Certification (PSC) (5 points)

b. Key Staff has performed IT physical security assessment services for government entities beyond the minimum qualification within the last five years. (2 points for each engagement identified in the resume, up to 10 engagements identified in the resume beyond the one engagement for minimum qualifications within the last two years – 20 points total)

6. Letter of Guarantee

Bids must include a Letter of Guarantee that describes the Bidder’s qualifications, expertise, and ability to perform the services identified in the Agreement, Exhibit A, Scope of Work and includes:

a. A signature from an individual who is authorized to bind the Bidder contractually to certify that the

Bidder guarantees their ability to perform the services.

b. A statement expressing the Bidder’s key staff availability to successfully perform the services.

c. A statement expressing the Bidder’s willingness to comply with the terms and conditions of this agreement.

7. Licenses and Certifications

a. The Bidder must provide copies of the licenses and certifications required to meet the Bidder’s and

Key Staff’s minimum and desirable qualifications.

b. The Bidder must provide a copy of a valid California city or county business license (if applicable);

or, if a corporation located within the State of California, incorporation documents; or letter from the Secretary of State or, if not a California business, an affidavit that the business is in good standing with the state, province, or country in which business is headquartered.

c. Bidders shall obtain, at their expense, all license(s) or permit(s) required by law for accomplishing any work required in connection with this agreement.

d. All licenses must remain valid for the term of the Agreement. In the event that any license or certification expires at any time during the term of this agreement, the Contractor agrees to provide SCO a copy of the renewed license within 30 days following the expiration date. In the event the Contractor fails to keep in effect at all times all required licenses, SCO may, in addition to any other remedies it may have, terminate this agreement upon occurrence of such event.

8. Bidder References

The Bidder must provide three references, which can attest to the Bidder’s experience providing services similar to those identified in this RFQ-ITS. References must be able to provide an objective assessment of the Contractor’s performance.

a. References must be provided on Attachment 16, Bidder Reference Form.

b. References must have contracted with the Bidder within the past two years for IT physical security assessment services.

c. Of the three required references, must include at least one large corporation or California state agency other than SCO. Bidders cannot list the State Controller's Office as a reference.

d. At least one reference must be from experience used to meet the Bidder’s Minimum Qualifications.

e. The Bidder must not use the same reference more than once.

f. A key staff reference may also be a reference for the Bidder.

g. References will be contacted to validate ratings. SCO will make up to three attempts via phone/email to validate references. Failure to reach a listed reference will result in the ratings being scored zero and the Bid may be deemed non-compliant and disqualified in its entirety. References will be scored based on the accumulative average score provided by the three references listed on Attachment 15, Bidder Reference Form.

9. Key Staff References

The Bidder must provide three references per identified key staff, which can attest to the key staff’s experience, providing services similar to those identified in this RFQ-ITS for all key staff that will be providing services during the term of this agreement. References must be able to provide an objective assessment of the key staff’s performance.

a. References must be provided on Attachment 17, Key Staff Reference Form.

b. References must have contracted with the key staff within the past two years for IT physical security

c. Of the three required references, must include at least one large corporation or California state agency other than SCO. Key staff cannot list the State Controller's Office as a reference.

d. At least one reference must be from experience used to meet the Key Staff Minimum Qualifications.

e. The key staff must not use the same reference more than once.

f. A bidder reference may also be a reference for key staff.

g. References will be contacted to validate ratings. SCO will make up to three attempts via phone/email to validate references. Failure to reach a listed reference will result in the ratings being scored zero and the Bid may be deemed non-compliant and disqualified in its entirety. References will be scored based on the accumulative average score provided by the references on Attachment 16, Key Staff Reference Form.

G. Background Check

1. The resulting agreement requires that the Bidder’s key staff, who have access to SCO work areas and facilities or the work areas of SCO customers on behalf of SCO, to pass a Live Scan background check. This requirement includes any subcontractors that have access to confidential and sensitive information/resources.

2. Upon notice of agreement award, SCO will provide the Contractor all necessary forms and locations for each proposed key staff to complete the background check process. SCO will be responsible for payment of background check fees.

If key staff are located in the Sacramento area, they must be fingerprinted at SCO.

If key staff are located outside the Sacramento area, but in Northern California, they may go to a

Live Scan location of their choosing.

If key staff are located in Southern California, they must go to a local law enforcement agency or other entity licensed to roll fingerprints to request completion of a standard FBI applicant fingerprint card (FD-258) provided by SCO and mail [i.e., United States Postal Service (USPS)] the completed forms and FD-258 back to SCO.

3. Background checks must be completed and passed prior to beginning work on the Agreement. If a

Contractor’s proposed key staff does not pass the Live Scan background check process, the Contractor must replace the key staff with a new candidate within seven business days that meets or exceeds all requirements stated in Section F. RFQ-ITS Bid Content, items 2 through 5. Replacement key staff is subject to SCO approval.

4. At SCO discretion, SCO may deny award of the Agreement subject to failed background checks.

Contractors, the key staff, and subcontractors will be held to the same background check standards as SCO employees.

5. The Contractor shall ensure that each key staff under the Agreement and any subcontractor staff are made aware of, understand, and comply with the provisions of SCO Live Scan background checks. Any additional or replacement key staff added to the Agreement will be subject to the same terms.

H. RFQ-ITS Bid Submission

1. Bidders must submit their bids in portable document format (PDF) attached to an email to

SCOBids@sco.ca.gov by the date and time specified in Section I. General Information, Item B. Key Action Dates. All bids must be submitted in at least two separate emails. Subject line must include the RFQ-ITS number, title, and be marked Bid or Cost:

a. Bid

Email #1 must include the Bidder’s submission in PDF format with the subject line identifying the submission as BID – Company Name.

Bids must be formatted for 8 1/2” x 11” paper with all pages consecutively numbered, each required element clearly identified, and in the sequence presented in this RFQ-ITS. Include all necessary supporting documentation (i.e., licenses, certifications, etc.) necessary to validate the Bidder’s qualifications.

b. Attachment 18, Cost Worksheet

Email #2 must include the Bidder’s cost in PDF format with the subject line identifying the submission as COST—DO NOT OPEN – Company Name. The Cost email shall remain unopened and separate from the sealed bid email until the Public Cost Opening.

2. Email Requirements

a. Bidders must ensure that emails do not exceed a file size of 20 megabytes.

b. Bidders must ensure that emails do not contain scripts, executable files, password protections, or macros, which may make their emails undeliverable.

c. Do not imbed links within the PDF—all documents must be contained within the PDF. SCO cannot access links to external sources. Bids containing links to external sources will be rejected.

d. If email #1, identified as BID, should exceed acceptable file size, the Bidder shall split the email into multiple emails to ensure delivery.

e. Bid submissions that are sent from unrecognized email servers may be blocked by SCO security filters and be flagged as spam, thereby rendering them unsubmitted.

f. Successful email submissions will receive an automatic reply from SCOBids@sco.ca.gov.

Automatic replies only confirm receipt of emails and do not assess bidders’ responsiveness to the RFQ-ITS requirements in the email content or in any attachments therein.

g. LATE BID SUBMISSIONS WILL NOT BE ACCEPTED—NO EXCEPTIONS.

3. Bids shall provide straightforward and concise descriptions of the Bidder’s ability to satisfy the requirements of this RFQ-ITS. The Bid must be complete and accurate. Omissions, inaccuracies, or misstatements will be sufficient causes for rejection of the Bid.

4. If the Bid is made under a fictitious name or business title, the actual legal name of the Bidder must be provided.

5. All bids shall include the documents identified on Attachment 1, Required Attachment Checklist. All attachments must include the information stated, and as instructed on each of the attachments (if applicable). Bids not including the proper required attachments shall be deemed nonresponsive. A nonresponsive bid is one that does not meet the Bid requirements.

6. Bids must be submitted for the performance of all services described herein. Any deviation from the work specifications will not be considered and the Bid will be rejected.

7. A bid may be rejected if it is conditional or incomplete, or if it contains any alterations of form or other irregularities of any kind. SCO may reject any or all bids and may waive any immaterial deviation in a bid. SCO waiver of an immaterial deviation shall in no way modify the RFQ-ITS document or excuse the Bidder from full compliance with all requirements if awarded the Agreement.

8. All documents contained in the Bid requiring a signature must bear the original signature of a person authorized to bind the Bidder’s firm contractually. Due to COVID-19, electronic signatures will be accepted.

9. An error in the Bid may cause the rejection of the Bid; however, SCO may correct obvious calculation errors at its sole option. If corrected, the Bidder will be provided the correction for validation.

I. Preference and Incentive Programs

The Preference and Incentive Programs listed below may be combined but will not exceed a combined total of 15 percent of the Bid amount or $100,000 per bid, whichever is less. No bid price will be reduced by more than $100,000, and all preference and incentive cost adjustments are for bid evaluation purposes only and do not alter the actual cost offered by the Bidder.

A SB/MB and a DVBE must have current and valid certification through DGS, Office of Small Business and Disabled Veteran Business Enterprise Certification Services (OSDS). Completed certification applications and required support documents must be submitted to OSDS no later than 5:00 PM PT on the Final Date for Bid Submission and OSDS must be able to approve the application as submitted.

For certification and preference approval process information, contact OSDS by telephone at

(916) 375-4940 or access OSDS Internet website at. https://www.dgs.ca.gov/PD/Services/Page- Content/Procurement-Division-Services-List-Folder/Certify-or-Re-apply-as-Small-Business-Disabled- Veteran-Business-Enterprise?search=Apply%20for%20SB%20Certification

1. Disabled Veteran Business Enterprise Program

The DVBE Participation Program requirements for this solicitation have been waived. However, SCO is committed to achieving legislatively established goals for the participation of DVBEs and seeks to use certified DVBE business whenever possible.

2. Disabled Veteran Business Enterprise Incentive

Certified DVBE firms can have a five percent incentive applied to their bid. The DVBE Incentive is for bid computation purposes only and is only applied to responsive bids from responsible DVBE certified bidders.

a. The DVBE Incentive is computed from the lowest responsive and responsible bid price.

b. The Bidder must submit Attachment 7, Disabled Veterans Business Enterprise (DVBE) Declarations

(DGS PD 843), signed by the DVBE owner/manager.

3. Small Business (SB) Preference Program

a. Current law encourages state departments to first consider a California certified SB/MB Enterprise for contracting opportunities. SCO is committed to supporting SB/MB participation in state contracting and seeks to use certified SBs/MBs whenever possible.

b. California Government Code (GC) Section 14835, et seq. requires that a five percent preference be given to proposers who certify as a SB/MB. The rules and regulations of this law are contained in Title 2, California Code of Regulations, Section 1896, et seq. A copy of the regulation is available upon request.

c. The SB preference provides certified SBs and MBs a calculation preference in the amount of five percent of the highest scored, responsible, and responsive proposal submitted by a proposing firm who is not a certified small business. The SB preference is used as a calculation for determining the highest score and does not affect the actual price proposed.

J. Award and Protest

1. Whenever an agreement is awarded under a procedure that provides for competitive bidding, but the Agreement is not to be awarded to the low bidder, the low bidder shall be notified by email five working days prior to the award of the Agreement.

2. Notice of the award shall be posted for five working days prior to awarding the Agreement on the public website at https://caleprocure.ca.gov/pages/index.aspx, and on the Small Business and Disabled Veteran Business Enterprises Advocate and Liaison page on SCO Website under Notice of Intent to Award Agreement at: https://www.sco.ca.gov/sco_sb_dvbe_advocate.html.

3. Any bidder’s issues regarding solicitation requirements must be resolved (or attempts to resolve them must have been made) before a protest may be submitted according to the procedure below. These issues will first be resolved by the contact for the solicitation or if they result in a protest, the protest will be submitted to DGS Procurement Division Deputy Director to hear and resolve issues and whose decision will be final.

4. If a bidder has submitted a bid which it believes to be responsive to the requirements of the RFQ-ITS and to be the bid that should have been selected according to the evaluation procedures in the solicitation and the bidder believes the State has incorrectly selected another bidder for award, the bidder may submit a protest of the selection as described below. Protests regarding selection of the “successful vendor” will be heard and resolved by the Victim Compensation and Government Claims Board whose decision will be final.

5. All protests of award must be made in writing, signed by an individual authorized to bind the bidder contractually and financially, and contain a statement of the reason(s) for protest; citing the law, rule, regulation or procedure on which the protest is based. The protester must provide facts and evidence to support the claim. Protests must be mailed or delivered to:

Street and Mailing Address:

Deputy Director Procurement Division 707 Third Street, Second Floor South West Sacramento, CA 95605 Facsimile No.: (916) 375-4611

All protests to the RFQ-ITS or protests concerning the evaluation, recommendation, or other aspects of the selection process must be received by the DGS Procurement Division Deputy Director as promptly as possible, but not later than the date indicated in the Notice of Intent to Award. Certified or registered mail must be used unless delivered in person; in which case the protester should obtain a receipt of delivery.

SECTION II. EVALUATION INFORMATION

A. Evaluation Process

Each bid will be checked for the presence of required information in conformance with the submission requirements of this RFQ-ITS. SCO evaluation team will evaluate each bid to determine its responsiveness to the requirements. The Bid must meet all of the evaluation criteria identified in Section II. Evaluation Information, Item B. Evaluation Criteria. If a bid is missing required information, it may be deemed non-responsive and subject to disqualification. Further review is subject to SCO discretion.

Award of an agreement resulting from this RFQ-ITS will be to the responsive, responsible bidder with the highest score after the application of any preference requirements or incentives as applicable.

B. Evaluation Criteria

The overall responsiveness of each bid is based on the complete bid from the Bidder to the RFQ-ITS requirements. The following four subsections and criteria will be reviewed by the SCO evaluation team:

1. Administrative Requirements (Pass/Fail)

Bids will first be reviewed for responsiveness to the Administrative Requirements identified in Section II. Evaluation Information, Item C. Scoring, to include all required attachments listed on Attachment 1, Required Attachment Checklist. If a bid is missing information required in the Administrative Requirements, it may be deemed nonresponsive and will therefore be ineligible for further consideration.

2. Minimum Requirements (Pass/Fail)

a. Bidder Minimum Qualifications (Pass/Fail)

b. Key Staff Minimum Qualifications (Pass/Fail)

3. Technical Requirements

a. Bidder Desirable Qualifications (20 points)

b. Key Staff Desirable Qualifications (80 points)

c. Bidder References (30 points)

d. Key Staff References (30 points)

e. Interview (90 points)

4. Interviews

a. Interviews will be conducted with the Bidders who satisfy the administrative and technical requirements of this RFQ-ITS.

b. All proposed Key Staff will be required to appear and participate in a virtual team interview via Microsoft Teams. Proposers will be notified in advance of the specific date and time for the interview.

c. Interview questions may include the following areas:

The Proposer’s understanding of the scope of work, emphasizing its understanding of the SCO’s objectives and the major activities that must be performed to complete the work, including examples from previous agreements that validate the ability to perform the work.

The Proposer’s activities that will be performed to complete the required work.

The Proposer’s expectations for contract members and stakeholders outside its own team.

The Proposer’s Key Staff qualifications and abilities.

Table 1 - Interview Score Example:

A B C D

Q# Assigned Rating Value Maximum Possible Score

Score (B X C = D)

1 100% 50 100% x 30 = 50

2 100% 50 100% x 30 = 50

3 100% 50 100% x 30 = 50

4 100% 40 100% x 40 = 40

5 100% 60 100% x 60 = 60

Total Interview Score (Sum all Scores) 250

*Standard rounding rules apply.

Table 2 - Interview Rating Values and Criteria:

Rating Values

Rating Criteria

100% Excellent: All components are addressed with the highest degree of confidence.

75% Good: The response addressed almost all of the components with an above average degree of confidence.

50% Fair: The response addressed most of the components with an average degree of confidence.

25% Poor: The response minimally addressed the components with a below average degree of confidence.

0 No Value: The response failed to address the topic with no degree of confidence.

2) All costs for developing a proposal and attending interviews are entirely the responsibility of the

Proposer and shall not be chargeable to the SCO.

5. Cost (Maximum 250 Points)

Completion of Attachment 18, Cost Worksheet

The Evaluation Team will review the Cost Worksheets to verify mathematical accuracy and determine if there are any deviations in the Bid. If a deviation is material, it may be cause for rejection. Immaterial deviations will be processed as if no deviation had occurred. Cost Worksheets shall be evaluated and scored based on the total cost. The Bidder with the lowest cost will be awarded the maximum number of points available (250 points), which is 50% of the total points available.

Bidder’s cost score will be based on a proportional number of points as it relates to the total costs associated with the lowest responsive bid multiplied by the maximum number of cost points.

The following formula shall be used to determine cost points:

Lowest Bidder’s Cost ($600,000) X maximum cost points (250 points) divided by other Bidder’s cost = cost points awarded to the other Bidder.

LOWEST COST ($600,000) X 250 COST POINTS AVAILABLE

OTHER COST

COST POINTS AWARDED TO OTHER BIDDER

Table 1. Sample Cost Assessment

Bidder Cost Calculation

POINTS

AWARDED

A $675,000 $600,000 (Bidder B) X 250 (weight) / $675,000 (Bidder A) 222.2

B $600,000 $600,000 (Bidder B) X 250 (weight) / $600,000 (Bidder B) 250

C $650,000 $600,000 (Bidder B) X 250 (weight) / $650,000 (Bidder C) 230.8

6. Participation, Preference, and Incentive Programs, as applicable

C. Scoring

Each bid will be evaluated in accordance with this section. This agreement will be awarded based on the highest score as follows:

Description

Total Points Possible

Points Scored (Scored by SCO)

ADMINISTRATIVE REQUIREMENTS

Bid received by date/time specified in Key Action Dates Pass/Fail

Bid email received in PDF format Pass/Fail

Cost email received, separate from Bid, in PDF Format Pass/Fail

Attachment 1, Required Attachment(s) Checklist and all required/applicable attachments listed on it

Pass/Fail

Bidder Reference Forms (Three, at least one from a California state agency, other two from large corporations, if not a California state agency)

Pass/Fail

Key Staff Reference Forms (Three per identified key staff, at least one from a California state agency, other two from large corporations, if not a California state agency)

Pass/Fail

Key Staff Resumes (One per identified key staff) Pass/Fail

TECHNICAL REQUIREMENTS

Bidder Minimum Qualifications

Bidder must provide one key staff upon award of agreement

Pass/Fail

Bidder must have performed IT physical security assessment services for at least one corporation or California state agency within the last two years.

Pass/Fail

Key Staff Minimum Qualifications

Identified Key Staff must be with the current company for at least one year and provide resumes which describe in detail the IT physical security assessment services they have performed for a minimum of three years’ experience within the last five years in IT physical security assessments for government entities.

Pass/Fail

Bidder Desirable Qualifications – 20 Points Maximum

Bidder has performed IT physical security assessment services for corporations or California state agencies beyond the minimum qualification within the last two years.

1 point for each engagement, up to 10 engagements identified in the resume beyond the one engagement for minimum qualifications within the last two years.

10 Point Maximum

Bidder has experience with server and networking topology within the last 10 years

2 points for each engagement identified in the resume up to five engagements identified in the resume within the last ten years.

10 Point Maximum

Total Bidder Desirable Qualifications Points (20 Points Maximum)

Key Staff Desirable Qualifications – 80 Points Maximum

Key Staff has the following current certifications:

Certified Protection Professional (CPP) 25

Physical Security Professional (PSP) 20

Industrial Security Professional (ISP) 10

Physical Security Certification (PSC) 5

Key Staff has performed IT physical security assessment services for government entities beyond the minimum qualification within the last five years.

2 points for each engagement up to 10 engagements identified in the resume beyond the one engagement for minimum qualifications within the last two years.

20 Point Maximum

Total Key Staff Desirable Qualifications Points (80 Points Maximum)

Bidder References – 30 Points Maximum The Bidder must provide three references, which can attest to the Bidder’s experience providing services similar to those identified in this RFQ-ITS. References must be able to provide an objective assessment of the Contractor’s performance.

a. References must be provided on Attachment

15, Bidder Reference Form.

b. References must have contracted with the Bidder within the past two years for IT physical security assessment services.

c. Of the three required references, must include at least one corporation or California state agency other than SCO.

Bidders cannot list the State Controller's Office as a reference.

d. At least one reference must be from experience used to meet the Bidder’s Minimum Qualifications.

e. The Bidder must not use the same reference more than once.

f. A key staff reference may also be a reference for the Bidder.

10 points for each reference up to three.

30 maximum points possible.

References that do not substantiate the Bidder’s experience providing services similar to those identified in this RFQ- ITS and/or the Bidder received an accumulative average *rating of 1* earns 0 points.

References that substantiate the Bidder’s experience providing services similar to those identified in this RFQ-ITS and/or the Bidder

*rating of 2* earns 5 points.

References that substantiate the Bidder’s experience providing services similar to those identified in this RFQ-ITS and/or the Bidder

*rating of 3* earns 10 points.

Total Bidder Reference Points (30 Maximum)

Key Staff References – 30 Points Maximum The Bidder must provide three references per identified key staff, which can attest to the key staff’s experience providing services similar to those identified in this RFQ-ITS for all key staff that will be providing services during the term of this agreement.

References must be able to provide an objective assessment of the key staff’s performance.

a. References must be provided on

Attachment 16, Key Staff Reference Form.

b. References must have contracted with the key staff within the past two years for IT physical security assessment services.

c. Of the three required references, must include at least one corporation or California state agency, other than SCO. Key staff cannot list the State Controller's Office as a reference.

d. At least one reference must be from experience used to meet the Key Staff Minimum Qualifications.

e. The key staff must not use the same reference more than once.

f. A bidder reference may also be a reference for key staff.

10 points for each reference up to three per identified key staff.

If more than one key staff identified, points will be average of key staff reference scores.

30 maximum points possible.

References that do not substantiate the Key Staff’s experience providing services similar to those identified in this RFQ-ITS and/or the Key Staff received an accumulative average *rating of 1* earns 0 points.

References that substantiate the Key Staff’s experience providing services similar to those identified in this RFQ- ITS and/or the Key Staff

*rating of 2* earns 5 points.

References that substantiate the Key Staff’s experience providing services similar to those identified in this RFQ- ITS and/or the Key Staff

*rating of 3* earns 10 points.

Total Key Staff Reference Points (30 Maximum)

Interviews – 90 Points Maximum The Bidder and their Key Staff will be required to appear—via Microsoft Teams—for a virtual interview with SCO. Bidders and key staff will be notified in advance of the specific date, time, and requirements. All proposed key staff must attend the interview. Only bidders that pass all administrative requirements and meet the minimum qualifications will have key staff scheduled for interviews.

Interview Rating Values and Criteria

Rating Values

Rating Criteria

100%

Excellent: The question is fully addressed with the highest degree of confidence.

75%

Good: Most of the components of the question are addressed with an above-average degree of confidence.

50%

Fair: Some of the components of the question are addressed with an average degree of confidence.

25% Poor: Components of the question are minimally addressed with a below-average degree of confidence.

0% No Value: Response fails to address the components of the question.

Each bidder and their key staff’s interview score will be calculated by multiplying the maximum possible score for each interview question by the assigned rating value percentage, then added to obtain a subtotal score. See example calculation below.

Interview Score Example

A B C D

Q# Assigned

Rating Value

Max Possible

Score

Score (B x C = D)

1 100% 10 100% x 10 =

2 100% 10 100% x 10 =

3 100% 10 100% x 10 =

4 100% 10 100% x 10 =

5 100% 10 100% x 10 =

6 100% 10 100% x 10 =

7 100% 10 100% x 10 =

8 100% 10 100% x 10 =

9 100% 10 100% x 10 =

Total Interview Score (Sum all Scores):

Total Interview Points (90 Maximum)

Total Technical Requirements Points (250 Maximum)

RFQ-ITS EINF90125

COST – 250 POINTS MAXIMUM

Attachment 18, Cost Worksheet Each bidder’s cost score will be calculated based on the ratio of the lowest cost bid to the Bidder’s cost, multiplied by the maximum number of cost points available.

Total Cost Points (250 Maximum)

PARTICIPATION, PREFERENCE AND INCENTIVE PROGRAMS, AS APPLICABLE

DVBE Incentive TBD upon evaluation TBD Small Business Preference TBD upon evaluation TBD

Total Incentive Points TBD

Total Points Summary Maximum Points

Possible

Points Scored (Scored by SCO)

Bidder Desirable Qualifications 20 Key Staff Desirable Qualifications 80 Bidder References 30 Key Staff References 30 Interviews 90 Cost 250

Total Maximum Points before applying Preference/Incentives 500 Preference and Incentive Points TBD TBD

Total Points Scored TBD

D. Tie Break Process

In the event of a precise tie, if GC Section 14838(f) does not apply to the Bidders, a witnessed coin toss will be conducted by the Procurement Official. If a coin toss is needed, the Procurement Official will schedule and arrange for the coin toss and non-partisan witnesses, subsequently notifying the participating bidders of the outcome of the coin toss.

ATTACHMENT 1

REQUIRED ATTACHMENT CHECKLIST

Bidder’s Name: _____________________________________________________________ (Please print clearly or type)

A complete bid will consist of the required items identified below. Please initial in the “Submitted to SCO” next to each item that you are submitting to SCO. For your bid to be responsive, all required attachments must be returned. Further review is subject to SCO discretion. This checklist must be signed and returned with your bid package.

Requirement Description Submitted to SCO Attachment 1 Required Attachment Checklist Attachment 2 Bidder Certification Sheet Attachment 3 Contractor Point of Contact

Attachment 4 Payee Data Record (STD 204) and Payee Data Record Supplement

(STD 205)*

Attachment 5 Contractor Certification Clauses (CCC 04/2017) Attachment 6 Bidder Declaration (Written) (GSPD-05-105) Attachment 7 Secretary of State Certification of Status* Attachment 8 Disabled Veteran Business Enterprise (DVBE) Declarations (DGS PD 843)*

Attachment 9 Generative Artificial Intelligence (GenAI) Disclosure & Factsheet (STD 1000)

Attachment 10 Bidding Preferences and Incentives Attachment 11 Acknowledgement of Agreement Exhibits and Policies Attachment 12 California Civil Rights Laws Certification (DGS OLS 04)

Attachment 13 Contractor/Consultant Confidentiality and Non-Disclosure Acknowledgement (ISO-004b)

Attachment 14 Contractor/Consultant Organization Information Security Agreement (ISO-004c)

Attachment 15 Insurance Acknowledgement Attachment 16 Bidder Reference Form (Three) Attachment 17 Key Staff Reference Form (Three for each identified key staff) Attachment 18 Cost Worksheet (Submit in a separate email)

Additional Document

Letter of Guarantee

* Submit only if applicable.

Authorized Signature and Title Date

ATTACHMENT 2

BIDDER CERTIFICATION SHEET

Complete and return this Attachment with the Bid package. An individual who is authorized to bind the bidding firm contractually shall sign the RFQ-ITS Attachment 2, Bidder Certification Sheet. The signature must indicate the title or position that the individual holds in the firm. The Bidder certifies the following:

1. Our all-inclusive cost is submitted as detailed in Attachment 18, Cost Worksheet and all required attachments are included with this certification sheet.

2. Bidder provided at least one and no more than one key staff.

3. Bidder has performed IT physical security assessment services for at least one corporation or California state agency within the last two years.

4. Key Staff has been with the current company for at least one year and has performed IT physical security assessment services for a minimum of three years’ experience within the last five years for government entities.

5. The signature affixed hereon and dated certifies compliance with all the requirements of this bid document.

The signature below authorizes the verification of this certification. An unsigned bidder certification sheet may be cause for rejection.

1. Company Name 2. Telephone Number 2a. Fax Number

3. Address

Indicate your organization type:

4. Sole Proprietorship 5. Partnership 6. Corporation

Indicate the applicable employee and/or corporation number:

7. Federal Employee ID No. (FEIN)

8. California Corporation No.

9. Indicate applicable license and/or certification information:

10. Bidder’s Name (Print) 11. Title

12. Signature 13. Date

14. Are you certified with the Department of General Services (DGS), Office of Small Business and Disabled

Veteran Business Enterprise Services (OSDS) as:

a. California Small Business

Yes No If yes, enter certification number:

b. Disabled Veteran Business Enterprise Yes No If yes, enter your…