ESBD_File_349137_4_Attachment E 946M4 Commercial Charge Card.pdf

Texas Comptroller of Public Accounts

Statewide Procurement Division

Charge Cards

RFP No. 304T-24-946M4

Attachment E

Requirements and Specifications

Line 1: Commercial Charge Card Services

RFP No. 304T-24-946M4 Charge Cards

Attachment E - Requirements and Specifications Commercial Charge Card Services

Table of Contents

E.1 REBATE CALCULATION

E.2 PROGRAM SYSTEM

E.2.1 Technical and Reporting Requirements

E.2.2 Security Requirements

E.2.3 Card Security Control and Restrictions

E.3 SERVICE REQUIREMENTS

E.3.1 Customer Service

E.3.2 Card Specifications

E.3.3 Card Issuance, Renewal and Administration

E.3.4 Account Types

E.4 TRAINING PROGRAM

E.5 MARKETING PLAN

E.6 IMPLEMENTATION AND TRANSITION

E.6.1 Program Implementation

E.6.2 Contract Transition

E.1 REBATE CALCULATION

A. Contractor shall remit semi-annual payments via wire transfer or other approved method to each Customer based on the State’s fiscal year in the form of a Rebate. The rebate shall be based on the total spend dollars as posted for all card programs and timeliness of payment. The total spend dollars for a Customer is spend less any returns, credits, and cash advances.

Below is an example of a semi-annual rebate calculation:

Semi-annual Charge Volume

Average Transaction Size

Rebate Basis Points

Total Semi-Annual Rebate Payments from Contractor

$425,000,000 $200 150 $6,375,000

B. The first day for calculating the rebate for any period of days is defined as the first calendar day after the statement is fully available online in Contractor’s system for customers to review.

C. The Rebate period shall be calculated on a 6 month basis with cycle close dates on September 3rd and March 3rd of each such fiscal year.

D. Customer’s qualifying spend calculations for each fiscal year shall be determined on October 14th and April 14th of the fiscal year (40 days payment posting after the September 3 and March 3 cycle close dates for the fiscal year). Contractor will have 60 days to calculate and distribute the Rebates. Contractor shall deliver the Rebate on or before December 13th and June 13th of each fiscal year. If late, Contractor shall pay interest to each Customer at the rate set forth in the Texas Prompt Payment Act, Government Code 2251.025. If an undisputed Rebate becomes more than 90 days overdue, CPA may terminate the Contract for cause.

E. Each Rebate payment made by Contractor shall be accompanied by a report detailing the calculations used to determine the amount of the payment.

F. Contractor shall provide a method for Customer to verify Rebate calculations.

G. Rebate paid to Customer is net of any Credit Losses and upon contract termination, net of the full outstanding 91 days past due amounts from Customer.

H. Credit Loss amounts are only to be deducted from Customer rebates in the respective fiscal year incurred, and not deducted from a Customer’s total qualifying spend amount.

I. Credit Loss amounts that are recovered by Contractor must be added back to the calculation of the Customer’s next semi-annual rebate payment.

J. CPA will not be asking for a rebate on any IBA spend.

E.2 PROGRAM SYSTEM

E.2.1 Technical and Reporting Requirements A. Contractor shall provide a secure single point of entry, online, real time, web-based card management tool services (“Program System”) at no charge to the State that provides the ability to reconcile accounts and feed transaction data into Customer’s electronic expense accounting tools. Program System shall have the ability to transmit transaction data electronically to travel management companies, provide e-receipts for purchases and detect and electronically notify cardholders and Program Administrators of suspected fraudulent or inappropriate transactions.

B. Contractor shall provide all software, including integration tools, necessary to integrate new card information for purchases with existing systems. Software shall interface with current programs used by Customers. All software, software upgrades and software revisions shall be provided at no charge.

C. All data belongs to the CPA and/or Customers. Upon request, Contractor must provide to CPA or Customer any statement or report on paper format.

D. Program System must have sufficient capacity for cardholders and Program Administrators to efficiently download statements and activity. CPA anticipates approximately 3.9 million transactions in a fiscal year and 27.3 million transactions for the entire contract, including all renewal terms. Respondent must validate that its Program System has the capacity to meet these requirements without interruption or system breakdown.

E. Program System shall have 24 hours/7 days/week availability with scheduled downtimes only for upgrades and maintenance. All such upgrades must be announced in writing at least 10 working days prior to implementation of any change and limited to early morning hours (12:00 am – 6:30 am Central Time) or evening hours (7:00 pm -11:59 pm Central Time) and/or non-business days when feasible, not to exceed 2 hours during any 24 hour period Monday through Friday (excluding Federal and State holidays). Program System downtime in excess of 2 hours during any 24 hour period Monday through Friday (excluding Federal and State holidays), during the contract term, may result in the assessment of liquidated damages as set forth in Attachment G - Schedule of Liquidated Damages.

F. Change management of the application must be conducted using separate development servers and incorporate system testing prior to movement of the proposed change to the production environment.

G. In the event of a critical upgrade suddenly issued, Contractor shall notify CPA immediately and provide steps taken to address any loss of major functionality to Customers.

H. Loss of major functionality to Customers include, but are not limited to:

1. duplicate transactions

2. file transfer errors

3. file format errors

4. any changes to the import process for file feeds

5. user interface changes

I. Contractor shall use commercially reasonable efforts to adapt, re-configure or re-program, as applicable, in order to correct in a timely fashion any upgrades/maintenance that lead to major functionality impairments to Customers.

J. In the event that Contractor fails or is unable to restore full Program System functionality within 2 hours during Monday through Friday (excluding Federal and State holidays), Contractor shall:

1. notify CPA immediately;

2. use commercially reasonable efforts to develop in a timely fashion procedures or routines, for use by Customers, which, when employed in the regular operation of, or access to, the Program System, will avoid or substantially diminish the practical adverse effects of the loss of major functionality to the Program System.

K. Failure to do any above actions may result in the assessment of liquidated damages as set forth in Attachment G - Schedule of Liquidated Damages. Failure to do both may result in termination of Contract.

L. The data captured at Point of Sale (POS) shall be the lowest level of data available which includes transaction data, posting data, name of merchant, city and state of merchant, total amount of transaction, reference number and merchant category code.

M. Contractor shall ensure that data files that are corrupted, lost, or destroyed can be recreated.

N. Transactional level historical data must be available to Customers and CPA at all times during the contract term.

O. Program System must be able to assist Customers in meeting federal requirements and documenting transactions governed by applicable IRS reporting rules. Examples of federal requirements include but are not limited to compliance with Office of Foreign Assets Control (OFAC) and Export Administration Regulations (EAR) and other federal restricted lists.

P. Program System must be able to produce the following reports, at a minimum:

1. Card Program Management (Customers and CPA):

a. Account listing of Individual Billed Accounts by Cardholder Last Name, Customer, Account Number, Anniversary Date, and 12 month payment history

b. Cardholder activity report including current charges and credits, previous balance, new charges and credits and current outstanding balance.

c. Individual Billed Accounts charge activity, identifying expenses by travel establishment category, with current period and year-to-date totals.

d. Report of Possible Split Charges by date range, day or department

e. Taxes charged reports by cardholder, date range and dollar amount.

2. Contract Monitoring (CPA only):

a. Quarterly Program Summary Report, to include at a minimum: number of inactive cardholders, number of active cardholders, number of new cardholders, number of closed accounts, number of terminated cardholders, number of lost and reissued cardholders, active cards (by Customer and by hierarchy levels), number of merchant overrides (by Customer and by hierarchy levels)

b. Account listing of centrally billed accounts by Customer

c. Customer activity report listing: all credits, charges to Central Billed Accounts and balances, charges to Individual Billed Accounts and balances.

d. Retail Spending report by Customer reflecting only retail type charges listed, by Individual Billed Accounts

e. Statewide activity reports by Customer

3. State Travel Management Program Reports (CPA only):

a. Statewide activity reports by Customer

b. Statewide Travel Analysis Report by travel establishment industry (i.e. airline, lodging, car rental, etc.) and location, with the number of transactions and amount of expenditures for each

c. Statewide Travel Analysis Report by Customer and by travel establishment/industry location, with the number of transactions and amount of expenditures for each

d. Statewide and Customer Exception Reports indicating Customers deviations from travel reimbursement policies of the State

e. Quarterly statewide airline analysis by city-pairs

f. Statewide airline spending analysis report by airline carriers

g. Statewide rental car spending analysis report by rental car vendors

h. Statewide rental car spending analysis report by city, state, and country

i. Statewide lodging establishment spending analysis report by lodging establishments

j. Statewide lodging establishment spending analysis report by city, state and country

k. Statewide and Customer Analysis Reports (in detailed or summary format) to include Merchant, Merchant Category Code, Location, Number of Transactions and Expenditures, Cardholder Name and Cardholder Account Number

Q. Contractor’s Program System must have a robust reporting module that provides Customers the ability to design customized on-demand reports and queries in addition to standard reporting features. Contractor must assist CPA and Customers in developing customized reports from Contractor’s Program System at no additional cost. Contractor shall make additional ad hoc reports available to CPA and/or Customers within three business days of written request.

R. All reports shall be available to CPA, Texas State Auditor’s Office and Customers at the following frequency intervals:

1. Monthly

2. Quarterly

3. Semi-Annually

4. Annually

5. Date Range Specific

S. Online consolidated monthly invoice statements shall have clear menu navigation, providing Customers with the ability to view, download and print invoices. Customers shall have online access to summary and detailed data for the month represented by the invoice as well as access to earlier months’ invoice reports.

T. Data must be readable, usable and compatible with any software with the capacity to handle the Contract volume data such as flat file format or commonly used software format i.e. Microsoft Access or Microsoft Excel.

U. Data must be easily accessible by Customer in the manner, format and time frame required by Customer, e.g. daily file feeds. The file feeds must be available in different file formats, such as Control Data File (CDF), Visa Commercial Format (VCF) or comparable capability and different platforms such as Concur.

V. Contractor must work with Customers to establish file feeds according to Customers’ needs at no additional charge.

W. Lookup tables, data maps, and variable definitions for data must be provided and easily accessible at all times (e.g. via hyperlink).

X. Contractor’s Program System must be on a software platform that creates transaction data with the ability for account allocation in a text (ASCII) or MS Excel format.

Y. Transaction data should be available for account allocation within 24 hours of transaction posting.

Z. Contractor shall provide CPA or Customer with access to Contract’s complete data upon termination or expiration of the contract meaning a “final download” after all debts are settled. Data provided shall be for the complete fiscal year and is to include current and previous fiscal years.

AA. The reports below must be available to CPA or Customer. The reports must be generated by Customer name and identification code, broken down at various levels within a Customer’s hierarchy levels and by Contractor’s control number. Contractor shall provide a minimum of eight hierarchy levels.

BB. Historically Underutilized Business (HUB) Reporting: Reports that track purchases made from State of Texas certified HUBs so that state agencies and institutions of higher education can comply with Texas Government Code 2161.121-122 and HUB Rules Tex.

Admin. Code 20.16 (Expenditure Data). The HUB report is based on the State of Texas fiscal year and requires monthly, semi-annual and annual reporting on HUBs and HUB subcontracted suppliers.

CC. The HUB reports should provide, at a minimum, a detailed monthly record and a summary of the total payments made to Texas certified HUB vendors by state agencies and institutions of higher education. The reports must be provided in the format required by the State of Texas. Contractor must be able to integrate the Texas Vendor Identification Numbers of active certified HUBs with their database for reporting purposes on an as-needed basis as determined by CPA or a Customer (i.e. weekly, monthly, etc.)

DD. 1099 Report Information: In accordance with Section 6050W of the Housing Assistance Tax Act of 2008 entitled Information Reporting for Payments Made in Settlement of Payment Card and Third Party Network Transactions, Contractor shall be responsible for reporting payment card transaction information through a 1099-K Merchant Card and Third Party Payments form to the IRS. Reporting shall be required for all payment card transactions at all dollar thresholds. Contractor shall provide Customers with documentation confirming the completion of the 1099 Report Information. This is an annual report based on the calendar year.

EE. Reports that track purchases of Federal Certified Small and Disadvantaged Businesses.

E.2.2 Security Requirements A. Contractor must comply with all state and federal laws and regulations regarding confidentiality, privacy and security pertaining to Customer’s confidential information.

Contractor represents and warrants that it will employ safeguards to ensure the confidentiality, integrity and availability of Customer information and shall limit the sharing of information based on need to know. Contractor must adhere to the following security requirements:

B. Customers may require a higher level of security including, but not limited to, personnel and physical security requirements (e.g. a higher level of security clearance may be required for Contractor’s employees with access to sensitive Customer systems, such as additional background checks). If additional security is required, Customer will specify further requirements during implementation.

C. Contractor shall provide a program system for Customers that complies with the applicable statutorily required accessibility standards for the State of Texas, to comply with the State of Texas reporting requirements outlined in 1 Texas Administrative Code Chapter 206 and 1 Texas Administrative Code Chapter 213. Contractor shall respond to all written inquiries from CPA regarding the program system’s compliance with requisite accessibility standards within five (5) business days of receiving such request.

D. Access to Customer Data: Contractor represents and warrants that it will implement, maintain, and use appropriate administrative, technical, and physical safeguards to preserve the confidentiality, integrity, and availability of Customer Data. Contractor will not collect, access, use, disclose, or retain Customer Data other than as necessary to perform the services specified in a contract resulting from this solicitation. Contractor will restrict access to Customer Data to only those personnel who must have the information on a “need to know” basis. Contractor will not use Customer Data, or any information derived from Customer Data, for its own benefit or the benefit of any other person or entity. Contractor will not share Customer Data with its parent company or other affiliate.

E. Location of Customer Data: Contractor shall ensure that Customer Data (i.e., primary and backup) remains, at all times, within the continental United States. Contractor shall receive, process, transmit, and store all Customer Data within the continental United States. Contractor’s point of access to Customer Data shall be within the continental United States.

F. Encryption Standards:

1. Contractor shall encrypt Customer Data in transit and at rest. Data in transit means data is moving via email, in applications, or through browsers and other web connections. Data at rest (including data backups) means data is stored in databases, the cloud, removable media, or mobile devices.

2. Contractor shall utilize encryption standards that are FIPS 140-2 compliant.

3. Minimum cryptographic algorithm used by Contractor must be Advanced

Encryption Standard (AES) 128 or higher (256 AES is preferred).

4. Contractor shall encrypt Customer Data transmitted over a public or private network. Approved data encryption transmission protocols include the following:

(1) SFTP (FTP over SSH), (2) FTPS (FTP over SSL), (3) HTTPS (HTTP over SSL), and (4) virtual private network.

G. Independent Information Security Assessment: If Contractor has access to a Customer Information System or receives, processes, transmits, or stores Customer Data, then Contractor shall provide CPA with a summary report of the most recent information security assessment conducted by an independent third-party (e.g., SSAE-18 SOC 2 Type II, ISO 27002) upon contract award and annually thereafter. CPA, in its sole discretion, may conduct a security assessment of any information system holding Customer Data or connected to a Customer Information System. CPA’s security assessment may consist of a review of the following: (i) independent third-party assessment(s) contracted by Contractor (e.g., SSAE-18 SOC 2 Type II, ISO 27002), and, and (ii) Contractor’s System Security Plan.

H. Media Sanitization: Contractor shall sanitize information system media, both digital and non-digital, in accordance with NIST Special Publication 800-88 (Guidelines for Media Sanitization) when Customer Data in the custody of Contractor is no longer required to be retained by contract with CPA. Contractor must maintain a record documenting each sanitization procedure that, at a minimum, includes the following information: (i) date sanitization completed, (ii) description of the item(s), serial number(s), inventory control number(s), if applicable, and (iii) sanitization method used. No later than sixty (60) calendar days from contract expiration or termination or as otherwise specified in the contract with CPA, Contractor must either (i) complete the sanitization and submit via email to the CPA Contract Manager all sanitization documentation or (ii) submit a written statement via email to the CPA Contract Manager explaining the reason that destruction of Customer Data by Contractor is technically impossible or impractical.

Contractor’s obligations set forth in this clause survive the termination or expiration of the contract as long as Contractor retains Customer Data.

I. Third-Party Service Providers: It is Contractor’s sole responsibility to ensure that its access and the access Contractor grants to its service providers to Customer Data or Customer Information Systems does not result in unauthorized access to Customer Data or Customer Information Systems.

J. Payment Card Industry Standards: Contractor shall implement and maintain certification of Payment Card Industry (PCI) compliance standards. In addition, Contractor represents and warrants that the software used for the processing of credit card payments is in compliance with all applicable PCI standards including, but not limited to, Payment Application Data Security Standards (PA-DSS) and Point to Point Encryption Solution Requirements (P2PE).

K. Security Incident Notification: Contractor shall have policies and procedures for the effective management of Security Incidents that shall be made available to CPA upon written request. Within 24 hours of Contractor’s discovery or reasonable belief and Contractor’s relationship manager knowledge that there has been an event that results in the accidental or deliberate unauthorized access, loss, disclosure, modification, disruption, or destruction of confidential Customer information (“Security Incident”), Contractor shall provide notice to CPA by calling (800) 531-5441 EXT 34357. Until the investigation is complete, Contractor shall submit daily, or as otherwise agreed by CPA, a written report via encrypted email to security.alerts@cpa.texas.gov that includes all event details Contractor is permitted by law or Contractor’s internal policies to be shared with CPA. Contractor shall coordinate all media or other breach notifications with CPA in advance of such notification(s), unless expressly prohibited by law. Subject to review and approval of CPA, Contractor shall provide notice at its own cost that satisfies the requirements of applicable law to individuals whose information was compromised or likely compromised as a result of the Security Incident. If CPA, in its sole discretion, elects to send its own separate notice, then all costs associated with preparing and providing the notice shall be reimbursed to CPA by Contractor. If Contractor does not reimburse such costs within 30 days of CPA’s written request, then CPA shall have the right to collect such costs. CPA reserves the right to conduct an independent investigation of any Security Incident, and should CPA choose to do so, Contractor shall cooperate fully with CPA and assume responsibility at its own expense for making personnel, resources, and systems access available to CPA and CPA’s authorized representative(s).

E.2.3 Card Security Control and Restrictions A. Contractor shall provide controls that will prevent the use of the payment card for purchasing commodities and services that Customer or CPA designates as restricted.

Contractor must have the ability to restrict payment card services by merchant category codes for those accounts so designated by CPA or Customers. The selection of exclusions will be at Customer’s discretion for SmartBuy Members, and within general guidelines established by CPA and the State of Texas for Institutions of Higher Education and State Agencies.

B. Contractor shall make available to the designated Program Administrator(s) or designee(s) for each Customer the ability to make on-line changes to information on a cardholder’s account. At a minimum, such changes shall include card expenditure limits, transaction limits, purchase restrictions, one-time override on an individual transaction, cardholder name, cardholder billing address or telephone number, termination or non-renewal of a cardholder account, and movement from one hierarchy level to another.

C. Contractor shall provide online alerts and notification of spending activity based on established Customer limits. This includes monitoring spending by cardholders and merchants with real time visibility through the Program System.

D. Contractor shall have the capability to maintain strict controls by creating cards with $0 spending authority, requiring Customer’s Program Administrator to call in for activation of cards and spend limits.

E. Each Customer shall be able to establish predetermined purchase and activity limits and controls including, but not limited to, purchase limits (daily, weekly and monthly) transaction limits (daily, weekly and monthly), single purchase limits and merchant category code restrictions.

F. Cash advances are strictly prohibited for state agencies and institutions of higher education unless written authority is granted by CPA.

G. Contractor shall be responsible for safeguarding all information obtained from the Contract resulting from this RFP. Contractor shall immediately notify CPA and Customer’s Program Administrator(s) of any breach of security which may have resulted in compromised data and shall initiate aggressive action to mitigate any potential consequences. Contractor shall be responsible for, but not limited to, system security, computer software security, network security, and web-based security.

H. Contractor shall ensure that each Customer has access only to the data for that Customer’s transactions and has no access to data of another Customer. Contractor shall provide CPA and State Auditor’s Office with full access to view and generate statewide reports and data for all Customers.

I. Identification and Access Controls for Program System: Contractor shall provide measures to enforce access control to the Program System. Contractor shall limit access using role-based access control (RBAC). RBAC shall define individual access detail for all roles and be based on least privilege and need-to-know. The Program System shall use identification and authorization data to determine user access to information. The Program System shall be able to define and control access between subjects and objects.

The enforcement mechanism (e.g. self/group public controls, access control lists and roles) shall allow Customer’s Program Administrator(s) to specify and control sharing of those objects by other users, or defined groups of users, or both, and shall provide controls to limit access rights to the system. The discretionary access control mechanism shall, either by explicit user action or by default, provide that objects are protected from unauthorized access. These access controls shall be capable of including or excluding access to the granularity of a single user and to limited data for that user. Access permission to an object by users not already possessing access permission shall be assigned only by Customer’s Program Administrators.

J. To ensure access control, the Program System shall, at a minimum:

1. include a mechanism to require users to uniquely identify themselves to the system before beginning to perform any other actions that the system is expected to mediate;

2. have random generation of unique passwords;

3. require passwords to be complex: a minimum of eight characters in length and contain at least three characters from the following list: Uppercase characters (A through Z), Lowercase characters (a through z), Base-10 digits (0 through 9), Non-alphanumeric characters (e.g !,$,#,%,@);

4. require multi-factor authentication;

5. be able to maintain authentication data that includes information for verifying the claimed identity of individual users (e.g. passwords);

6. protect authentication data so that it cannot be accessed by any unauthorized user;

7. be able to enforce individual accountability by providing the capability to uniquely identify each individual Program System user; and

8. send alerts when attempts are made to guess the authentication data either inadvertently or deliberately.

K. In addition, Contractor shall implement protections for remote access by its employees to cardholders’ personally identifiable information. Contractor shall, at a minimum:

1. implement National Institute of Standards and Technology (NIST) Publication

800-53 rev.4 security controls requiring authenticated, virtual private network (VPN) connection;

2. implement security controls for the transmission of and remote access to personal information;

3. encrypt all data in transit and at rest on mobile devices;

4. allow remote access only with two-factor authentication where one of the factors is provided by a device separate from the computer gaining access;

5. use a “time-out” function for remote access and mobile devices requiring user re-authentication after 30 minutes of inactivity; and

6. log all computer-readable data extracts from databases holding sensitive information and verify each extract including sensitive data has been erased within 90 days or its use is still required.

L. System Security Reviews and Audits: The Program System will be subject to security reviews, as required by CPA, before and throughout the period of performance. The Contractor shall provide complete information and access to CPA, as required, to facilitate these reviews. Reviews include, but are not limited to the following:

1. SSAE 16 SOC 2 Type II Audit: CPA requires Contractor to obtain SSAE 16 SOC 2 Type II annual audits of their internal controls and provide the report to SPD Statewide Contract Management (SCM).

2. Penetration Tests: CPA requires Contractor to obtain annual penetration tests and provide to SPD Statewide Contract Management (SCM) a summary of the results, including a plan of actions and milestones (POAMs) for remediation.

3. System Audits: To test, verify, and continuously monitor security compliance, CPA reserves the right to perform audits of management, operational and technical controls of Contractor’s systems annually, or as required.

4. Contractor shall comply with changes to security control review, audit and authorization requirements as they are updated.

M. Ability to Audit Program System Actions: Contractor shall secure its information systems per an auditable information security framework (e.g. NIST 800-53 rev.4, ISO 27001).

The Program System shall be able to create, maintain and protect from modification, unauthorized access, or destruction, an audit trail of accesses to the objects it protects.

The audit data shall be protected so that read-access to it is limited to those who are authorized to have access. The Program System shall be able to record the following types of events:

1. use of identification and authentication mechanisms;

2. introduction of objects into a user’s account (e.g. filing dispute, requesting limit increase);

3. deletion of objects;

4. log onto system;

5. log off of system;

6. change of password;

7. all system administrator commands, while logged on as system administrator;

8. switching accounts or running privileged actions from another account (e.g.

Linux/Unix SU, or Windows RUNAS);

9. creation or modification of super-user groups;

10. subset of security administrator commands, while logged on in the security administrator role;

11. subset of security administrator commands, while logged on in the user role;

12. clearing of the audit log file;

13. startup and shutdown of the audit functions;

14. change of file or user permissions or privileges (e.g. use of suid/guid, chown, su);

15. remote access outside of the corporate network communication channels (e.g.

modems, dedicated VPN) and all dial-in access to the system;

16. changes made to an application or database by a batch file;

17. application-critical record changes;

18. changes to database or application records, where the application has been bypassed to produce the change (via a file or other database utility); and

19. all system and data interactions concerning Customer data.

N. The Program System shall also be able to audit any manual action that result in a change to system values or settings.

O. For each recorded event, the audit record shall be able to identify the date and time of the event, user, type of event and success or failure of the event at a minimum. For identification and authentication events, the origin of request (e.g. terminal or user ID) shall be included in the audit record. For events that introduce an object into a user’s address space and for object deletion events, the audit record shall include the name of the object and the object’s label. Customer’s Program Administrator(s) shall be able to selectively audit the actions of any one or more users based on individual identity and/or object label. The audit system shall send alerts whenever a threshold is reached with respect to an auditing system resource (disk space in audit log volume) or when auditing has been turned off (either inadvertently or deliberately).

P. Personnel Security: To ensure the security of Customer information, Contractor shall, at a minimum:

1. establish and maintain a training program for its personnel in security awareness and privacy and provide training to all personnel prior to their having access to Customer data in the performance of this contract. A copy of Contractor’s training program shall be provided to the CPA Contract Manager within 30 calendar days of contract award.

2. require Contractor personnel who have access to Customer data pass a background investigation that includes a criminal background check.

3. represent and warrant that Contractor has not and Contractor’s employees have not been convicted of a felony criminal offense, or that if such a conviction has occurred Contractor has fully advised CPA as to the facts and circumstances surrounding the conviction. If awarded the contract, Contractor has a continuing duty to amend, supplement, or correct this representation and warranty no later than 10 days after discovering additional information relating to felony criminal convictions of Contractor or any of its employees. Contractor will not allow any employee convicted of a felony criminal offense to perform tasks related to the Contract without such disclosure and express permission from CPA.

4. remove access privileges for Contractor personnel for unauthorized, negligent, or inappropriate and willful actions.

5. Contractor shall provide verification of compliance with the above personnel requirements at the request of CPA.

Q. Privacy and Security Safeguards: Contractor shall ensure confidentiality of data.

Contractor shall follow security principles and practices per NIST SP 800-53 rev. 4 to protect Customer information in Contractor’s infrastructure from disclosure to unauthorized persons. This protection shall include, but not be limited to, sensitive information maintained. Contractor shall protect the integrity of Customer data including, but not limited to the following:

1. Contractor shall not publish or disclose in any manner, without CPA’s written consent, the details of any safeguards either designed or developed by Contractor under this Contract or otherwise provided by CPA;

2. To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity and confidentiality of Customer data, Contractor shall afford CPA access to Contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases; and

3. If new or unanticipated threats or hazards are discovered by either CPA or Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party.

R. Physical Security: Contractor shall provide physical security to Customer information including, but not limited, to the following:

1. Customer shall control access to Customer data housing facilities, equipment, material and documents by employees and visitors via electronic and/or physical methods corresponding to the critical nature of the work being performed, or the sensitive nature of Customer’s information being handled. Electronic and physical methods of security include, but are not limited to guards, intrusion detection devices, surveillance cameras, lighting and fencing.

2. Contractor shall ensure offsite backup and storage of critical program data.

Critical data and information is any data or information that is essential for the restoration of services and operation in the event of a disaster that impacts Contractor’s facilities or operation.

3. For a complete reference of recommended security controls, please refer to NIST SP 800-53 rev.4.

E.3 SERVICE REQUIREMENTS

E.3.1 Customer Service The following minimum staffing requirements may be increased at CPA’s request as needed:

A. Dedicated Account Managers:

1. Contractor shall provide a minimum of three Dedicated Account Managers to handle questions and resolve problems that arise.

2. Account Managers shall be accessible by direct toll-free telephone numbers (no extensions), fax and email, located in Texas offices and extremely knowledgeable of all aspects of the State’s card programs for procurement and travel purchases.

A minimum of two Account Managers from the pool of Dedicated Account Managers must be available Monday to Friday (excluding Federal and State holidays) from the core hours of 8 am to 5 pm Central Time. Each hour that a Dedicated Account Manager is unavailable in excess of two hours in a calendar day, Monday to Friday (excluding Federal and State holidays) during the core hours of 8 am to 5 pm Central Time, may result in the assessment of liquidated damages as set forth in Attachment G - Schedule of Liquidated Damages.

3. The Dedicated Account Managers shall also be expected to continually promote and increase participation in the Contract with the SmartBuy Members during the contract period.

4. Contractor shall notify CPA, in writing, at least 15 calendar days prior to any change of a Dedicated Account Manager. Failure to provide notice at least 15 calendar days may result in the assessment of liquidated damages as set forth in Attachment G - Schedule of Liquidated Damages.

B. Customer Service Representatives (CSR):

1. Contractor shall provide a minimum of six Dedicated Customer Service

Representatives (CSRs), accessible by direct toll-free telephone numbers (no extensions), fax and email, to handle questions and customer service matters, with coverage Monday to Friday (excluding Federal and State holidays) from 7 am to 7 pm Central Time. A minimum of three CSRs from the pool of Dedicated CSRs must be available Monday to Friday (excluding Federal and State holidays) from the core hours of 8 am to 5 pm Central Time.

2. Contractor shall provide a minimum of four Designated CSRs, accessible by direct toll-free telephone numbers (no extensions), fax and email, available on weekends, holidays and Monday to Friday (excluding Federal and State holidays) when Dedicated CSRs are unavailable.

3. Each hour that a Dedicated CSR or Designated alternate is unavailable in excess of two hours during the core hours of 8 am to 5 pm Central Time in a calendar day, Monday to Friday (excluding Federal and State Holidays) may result in the assessment of Liquidated Damages as set forth in Attachment G - Schedule of Liquidated Damages.

4. Each hour that a Designated CSR is unavailable in excess of two hours during a 24 hour period during weekends and holidays may result in the assessment of Liquidated Damages as set forth in Attachment G - Schedule of Liquidated Damages.

5. All CSRs shall have online access to information and provide immediate response to inquiries concerning the status of cards, delivery information of new or replacement cards, billing/statement questions or issues, contract compliance requirements and general information.

6. Contractor shall address all customer service issues within 48 hours. Failure to do so may result in the assessment of liquidated damages as set forth in Attachment G - Schedule of Liquidated Damages. Repeated failure to comply may result in Contract termination.

7. Contractor shall notify CPA, in writing, at least 10 calendar days prior to any change of a Dedicated CSR. Failure to provide notice at least 10 calendar days may result in the assessment of liquidated damages as set forth in Attachment G - Schedule of Liquidated Damages.

C. Technical Help Desk Members:

1. Contractor shall provide a minimum of two Dedicated Technical Help Desk Members, accessible by direct toll-free numbers (no extensions), with coverage on weekdays from 7 am to 7 pm Central Time. A minimum of one Dedicated Technical Help Desk Member from the pool of Dedicated Technical Help Desk Members will be available Monday through Friday (excluding Federal and State holidays) from the core hours of 8 am to 5 pm Central Time. Each hour that a Dedicated Technical Help Desk Member is unavailable in excess of two hours during the core hours of 8am to 5pm Central Time during a calendar day may result in the assessment of liquidated damages as set forth in Attachment G - Schedule of Liquidated Damages.

2. Contractor shall also provide one Designated alternate Technical Help Desk Member when the Dedicated Technical Help Desk Members are not available.

3. The Technical Help Desk Members shall be extremely knowledgeable of all aspects of Contractor’s Program System as designed and provided for Customers’ use in administering and managing their card programs for procurement and/or travel purchases. E.g. Technical Help Desk Members must be familiar with Customers’ commonly used reports and able to assist Customer’s Program Administrators in manipulating reports as necessary, creating similar reports, etc.

4. Contractor shall notify CPA, in writing, at least 10 calendar days prior to any change of a Dedicated Technical Help Desk Member. Failure to provide notice at least 10 calendar days may result in the assessment of liquidated damages as set forth in Attachment G - Schedule of Liquidated Damages.

D. Contractor shall maintain a 24 hours/365 days a year toll-free cardholder customer service line. Each hour that the toll-free cardholder customer service line is not available in excess of two hours in a 24 hour period may result in the assessment of liquidated damages as set forth in Attachment G - Schedule of Liquidated Damages.

E. Cardholder file: Contractor shall maintain a cardholder file for each Customer’s cardholder which must contain at a minimum the following information for each:

1. Cardholder name, address, number, issue, activation and expiration dates

2. Alpha and numeric accounting code

3. Per transaction limit

4. Daily spending limit

5. Weekly spending limit

6. Monthly spending limit

7. Maximum transactions per day/month

8. Approved merchant category codes

9. Approving authority, official name and title

10. Name of Department, Division, or Section, and

11. Department ID number

F. Contractor shall be liable for charges from unauthorized use of any card. Unauthorized use is defined as any use or purchase that is prohibited by state or local laws, rules, policies, procedures, or any charge that was incurred by someone other than an employee of a Customer who did not have actual, implied or apparent authority to use the card.

G. Customer shall be liable for the use of cards by authorized users provided that:

1. Use is within the daily, weekly, monthly and single purchase limits established for the specific card.

2. User is an authorized Customer’s employee.

3. Allowed commodities and services are purchased.

4. Use is in compliance with Customer’s published card procedures.

H. Travel Specific Customer Support Requirements

1. Contractor shall establish a process for reconciling Customer records of tickets and cancellations with billings.

2. Contractor shall process airline ticket refunds within 5 business days of notification.

3. Contractor shall establish a process for electronic reconciliation of data to travel agency data. The electronic reconciliation data must be provided to state agencies and travel agencies upon request in mutually agreed upon format and timeline.

4. In the event a request for information is made to Contractor for travel data maintained regarding the Contract, Contractor shall refer requestor to CPA for response. Contractor shall provide all information maintained regarding the Contract upon request by CPA, in accordance with all applicable federal, state and local laws.

5. Except for insurance coverage, no other benefits shall be provided by Contractor directly to any cardholder. In lieu of a travel or other reward program to individual cardholders, Contractor shall increase the amount of the Rebate.

E.3.2 Card Specifications A. Contractor must establish one dedicated prefix (first 4 or 5 digits) for CBA and CLIBA cards and no more than 10 digits as a prefix for IBAs issued under the Contract and must advise CPA whenever a new prefix is added.

B. Contractor shall provide a card designed specifically for the State of Texas. CPA will have final authority on the basic design, and design shall be provided at no charge to the State.

Each state agency payment card shall, at a minimum, contain on the front of the card:

1. The state seal (provided by CPA) and the following phrases embossed: “State of Texas”, “FOR OFFICIAL USE ONLY”;

2. Name of cardholder (first name and last name, no nick names) on the first line;

3. Customer’s Identification Number and Entity Name (provided by CPA) on the second line;

4. Account Number printed on the third line. Account numbers shall not be sequential for any Customer; and

5. The words “Tax Exempt” as appropriate. CPA will provide instructions during implementation.

6. Institutions of higher education and SmartBuy Members shall have the option of fully customized cards, at no additional charge. Customers that desire a custom card design will provide Contractor with camera-ready artwork. The design is subject to approval by CPA, prior to submission to Contractor.

C. Each payment card shall, at a minimum, contain on the back of the card, Contractor’s 24 hours a day and 7 days a week customer service assistance number.

D. No reference to Automatic Teller Machines (ATMs) may be included on the card.

E.3.3 Card Issuance, Renewal and Administration A. Contractor shall provide web-based application and card distribution process. Each

Customer’s designated Program Administrator(s) will authorize and approve issuance of cards for the entity.

B. Commercial Card applicants must have the ability to add multiple phone numbers.

C. Contractor shall provide procedures for rush applications (“Rush Procedures”) for account applications to use in circumstances when time is critical.

D. Contractor shall issue cards within five business days upon receipt of application unless a different schedule is approved in writing by CPA. Cards shall be issued only to those Customer employees who have properly completed an application which bears the signature of a designated authorized employee, as designated by Customer. Contractor must provide the embossed cards as Customer directs to Customer’s designated Program Administrator(s) or to the employee’s residence or place of business (for IBAs). All cards must be issued for a minimum two year period.

E. Contractor shall, upon request by Customer, issue central billed cards which bear the name of Customer to which it is issued that can be used by any authorized representative of that Customer. Charges billed will be the responsibility of that Customer.

F. Each Customer designates a Program Administrator or Administrators and designee(s) who shall be the only person(s) authorized to approve and request issuance of and receive or determine the method of delivery for cards for said entity.

G. Contractor shall provide emergency replacement of reported lost or stolen cards within 48 hours after notification of the loss, and non-emergency replacement of such a card in no more than five calendar days.

H. Contractor shall provide Customers with the capability for immediate cancellation of cards. Cancellation of cards shall be accomplished only by individuals designated by Customer via either written, fax or email communication to Contractor or through Contractor’s Program System. All verbal cancellations shall be verified in writing. Upon proper cancellation request, Customer is not liable for any charges incurred for such cancelled card.

I. Customers may order cards to be delivered anywhere in the state of Texas. Customer and Contractor shall coordinate the delivery of all cards, individually or grouped in one package. Contractor shall deliver all card(s) F.O.B. destination, freight prepaid and with tracking information.

J. Contractor shall provide cards that may be issued and paid in foreign currency.

E.3.4 Account Types A. Central Billed Accounts (CBA)

1. Contractor shall establish centralized accounts assigned to Customers for “ghost”/central billing of eligible expenses.

2. Contractor shall establish cards which bill to Customer, issued in the name of Customer’s employee, for state business travel.

3. Contractor shall provide cards which bill to Customer with declining balance controls.

4. Customer must ensure electronic payment transmittals contain all addenda information. Additionally, remittance information must be included with the ACH electronic payment transaction using ACH addenda records. Either CCD+ or CTX formats may be used.

B. Individual Billed Accounts (IBA) for Travel Only Respondent must include IBAs in its Proposal. A Proposal without IBAs will be deemed non-responsive.

1. As state agencies are prohibited by the Texas Constitution from purchasing food directly, Contractor must provide individual billed accounts (IBAs) issued to eligible Customer employees, without regard to salary, for state business travel, expenses including food and incidental expenses. The minimum criterion used by a Customer to determine eligible employees is that the employee is expected to spend at least $1000 per fiscal year for state business travel.

2. At the beginning of the contract, Customer may choose to provide Contractor with a list of Customer employees with IBA’s from the previous Contractor, provided that Customer certifies that the list only includes IBAs without any past due…