ESBD_File_349137_5_Attachment F 946M4 Retail Fuel Card.pdf

Texas Comptroller of Public Accounts

Statewide Procurement Division

Charge Cards

RFP No. 304T-24-946M4

Attachment F

Requirements and Specifications

Line 2: Retail Fuel Card Services

RFP No. 304T-24-946M4 Charge Cards

Attachment F - Requirements and Specifications Retail Fuel Card Services

Table of Contents

F.1 REBATE CALCULATION

F.2 PROGRAM SYSTEM

F.2.1 Technical and Reporting Requirements

F.2.2 Security Requirements

F.2.3 Card Security Control and Restrictions

F.3 SERVICE REQUIREMENTS

F.3.1 Customer Service

F.3.2 Card Specifications

F.3.3 Card Issuance, Renewal and Administration

F.4 TRAINING PROGRAM

F.5 MARKETING PLAN

F.6 IMPLEMENTATION AND TRANSITION

F.6.1 Program Implementation

F.6.2 Contract Transition

F.1 REBATE CALCULATION

A. Contractor shall remit semi-annual payments to each Customer based on the State’s fiscal year in the form of an ancillary credit to the current month’s bill. The credit shall be based on the total spend dollars on fuel, maintenance services and emergency services.

The total spend dollars for a Customer is spend less any returns and credits.

Below is an example of a semi-annual rebate calculation:

Semi-Annual Charge Volume

Rebate Basis Points Total Semi-Annual Rebate Payments from Contractor

$25,000,000 150 $375,000

B. The first day for calculating the rebate for any period of days is defined as the first calendar day after the statement is fully available online in Contractor’s system for customers to review.

C. The Rebate period shall be calculated on a 6 month basis with cycle close dates on September 3rd and March 3rd of each such fiscal year.

D. Customer’s qualifying spend calculations for each fiscal year shall be determined on October 14th and April 14th of the fiscal year (40 days payment posting after the September 3 and March 3 cycle close dates for the fiscal year). Contractor will have 60 days to calculate and distribute the Rebates. Contractor shall deliver the Rebate on or before December 13th and June 13th of each fiscal year. If late, Contractor shall pay interest to each Customer at the rate set forth in the Texas Prompt Payment Act, Government Code 2251.025. If an undisputed Rebate becomes more than 90 days overdue, CPA may terminate the Contract for cause.

E. Each Rebate payment made by Contractor shall be accompanied by a report detailing the calculations used to determine the amount of the payment.

F. Contractor shall provide a method for Customer to verify Rebate calculations.

G. Rebate paid to Customer is net of any Credit Losses and upon contract termination, net of the full outstanding 91 days past due amounts from Customer.

H. Credit Loss amounts are only to be deducted from Customer rebates in the respective fiscal year incurred, and not deducted from a Customer’s total qualifying spend amount.

I. Credit Loss amounts that are recovered by Contractor must be added back to the calculation of the Customer’s next semi-annual rebate payment.

F.2 PROGRAM SYSTEM

F.2.1 Technical and Reporting Requirements

A. Contractor shall provide a secure single point of entry, online, real time, web-based card management tool services (“Program System”) at no charge to the State that provides the ability to reconcile accounts and feed transaction data into Customer’s electronic expense accounting tools, as well as operate on common Internet browsers as may be employed by the State. Program System shall have the ability to transmit transaction data electronically, provide e-receipts for purchases and detect and electronically notify cardholders and Program Administrators of suspected fraudulent or inappropriate transactions.

B. Contractor shall provide all software, including integration tools, necessary to integrate new card information for purchases with existing systems. Software shall interface with current programs used by Customers. All software, software upgrades and software revisions shall be provided at no charge.

C. All data belongs to the State and/or Customers. Upon request, Contractor must provide to CPA or Customer any statement or report on paper format.

D. Program System must have sufficient capacity for cardholders and Program Administrators to efficiently download statements and activity. CPA anticipates approximately 3.4 million transactions in a fiscal year and 23.9 million transactions during the term of the contract, including all renewal terms. Respondent must validate that its Program System has the capacity to meet these requirements without interruption or system breakdown.

E. Program System shall have 24 hours/7 days a week availability with scheduled downtimes only for upgrades and maintenance. All such upgrades must be announced in writing at least 10 working days prior to implementation of any change and limited to early morning hours (12:00 am – 6:30 am Central Time) or evening hours (7:00 pm - 11:59 pm Central Time) and/or non-business days when feasible, not to exceed two hours during any 24 hour period Monday through Friday (excluding Federal and State holidays). Program System downtime in excess of two hours during any 24 hour period during Monday through Friday (excluding Federal and State holidays), during the contract term, may result in the assessment of liquidated damages as set forth in Attachment G - Schedule of Liquidated Damages.

F. Change management of the application must be conducted using separate development servers and incorporate system testing prior to movement of the proposed change to the production environment.

G. In the event of a critical upgrade suddenly issued, Contractor shall notify CPA immediately and provide steps taken to address any loss of major functionality to Customers.

H. Loss of major functionality to Customers include, but are not limited to:

1. duplicate transactions

2. file transfer errors

3. file format errors

4. any changes to the import process for file feeds

5. user interface changes

I. Contractor will use commercially reasonable efforts to adapt, re-configure or re-program, as applicable, to correct in a timely fashion any upgrades/maintenance that lead to major functionality impairments to Customers.

J. If Contractor fails or is unable to restore full Program System functionality within two hours during Monday through Friday (excluding Federal and State holidays), Contractor shall:

1. notify CPA immediately;

2. use commercially reasonable efforts to develop in a timely fashion procedures or routines, for use by Customers, which, when employed in the regular operation of, or access to, the Program System, will avoid or substantially diminish the practical adverse effects of the loss of major functionality to the Program System.

K. Failure to do any above mentioned actions may result in the assessment of liquidated damages as set forth in Attachment G - Schedule of Liquidated Damages.), or termination of Contract.

L. The data captured at Point of Sale (POS) shall be the lowest level of data available which includes transaction data, posting data, name of merchant, city and state of merchant, total amount of transaction, reference number and merchant category code.

M. Contractor shall ensure that data files that are corrupted, lost, or destroyed can be recreated.

N. Transactional level historical data must be available to Customers and CPA at all times during the contract term.

O. Program System must be able to assist Customers in meeting federal requirements and documenting transactions governed by applicable Internal Revenue Service (IRS) reporting rules. Examples of federal requirements include but are not limited to compliance with Office of Foreign Assets Control (OFAC) and Export Administration Regulations (EAR) and other federal restricted lists.

P. Program System must be able to produce the following reports, at a minimum:

1. Card Program Management (Customers and CPA):

a. Account listing of Cardholder Accounts by Cardholder Last Name, Customer, Account Number, Anniversary Date (account open date), and 12 month payment history

b. Monthly charge activity report summarizing fuel transactions no later than the tenth (10th) calendar day of the month for the prior month’s fuel card use.

The report shall include, but is not limited to:

i. state entity identification number;

ii. vehicle’s license plate number;

iii. vehicle’s equipment ID number from the Texas fleet system;

iv. fuel product by type (e.g. unleaded, super unleaded);

v. number of transactions;

vi. units (e.g. gallons) purchased;

vii. dollar amount purchased;

viii. dollar amount of exempted federal excise taxes;

ix. net amount purchased;

x. average price per unit, discount amount, and

xi. all other Level Three data.

c. Report of Possible Split Charges by date range, day or department.

d. Monthly Charge Activity Report summarizing non-fuel transactions no later than the tenth (10th) calendar day of the month for the prior month’s non-fuel card use. The report shall include, but is not limited to:

i. vehicle license plate number or another unique identifier as provided by the Customer;

ii. date of transaction;

iii. type of non-fuel item purchased (e.g. state inspection, repairs);

iv. totals for all non-fuel category items;

v. number of transactions;

vi. units purchased;

vii. dollar amount purchased;

viii. net amount purchased;

ix. average price per unit, and

x. all other Level Three data.

e. Taxes charged reports by cardholder, date range and dollar amount.

2. Contract Monitoring (CPA only):

a. Monthly Summary Report, to include at a minimum: number of inactive cardholders, number of active cardholders, number of new cardholders, number of closed accounts, number of terminated cardholders, number of lost and reissued cardholders, active cards (by Customer and by hierarchy levels), number of merchant overrides (by Customer and by hierarchy levels).

i. Account listing of accounts by Customer

ii. Statewide Monthly Charge Activity Reports by Customer. The report shall include, but is not limited to:

iii. Total Spend (Fuel and Non-Fuel Combined Total Spend);

• Total Number of Transactions;

• Total Fuel Spend Amount;

• Total Number of Fuel Transactions;

• Total Fuel Gallons Purchased;

• Total Dollar Amount of Exempted Federal Excise Taxes (for fuel transactions only);

• Average Price per Gallon Paid;

• Total Non-Fuel Spend Amount;

• Total Number of Non-Fuel Transactions;

• Total Open Cards and

• Total Active Cards.

iv. Delinquent Accounts by Customer

b. Contractor’s Program System must have a robust reporting module that provides Customers the ability to design customized on-demand reports and queries in addition to standard reporting features. Contractor shall provide assistance to CPA and Customers in developing customized reports from Contractor’s Program System at no additional cost. Contractor shall make additional ad hoc reports available to CPA and/or Customers within three business days of written request.

c. All reports shall be available to CPA, Texas State Auditor’s Office and Customers at the following frequency intervals:

i. Monthly

ii. Quarterly

iii. Semi-Annually

iv. Annually

v. Date Range Specific

d. Online consolidated monthly invoice statements shall have clear menu navigation, providing Customers with the ability to view, download and print invoices. Customers shall have online access to summary and detailed data for the month represented by the invoice as well as access to earlier months’ invoice reports.

Q. Data must be readable, usable and compatible with any software with the capacity to handle the volume such as flat file format or commonly used software format i.e.

Microsoft Access or Microsoft Excel.

R. Data must be easily accessible by Customer in the manner, format and time frame required by Customer, e.g. daily file feeds. The file feeds must be available in different file formats, such as Control Data File (CDF), Visa Commercial Format (VCF) or comparable capability and different platforms such as Concur.

S. Contractor must work with Customers to establish file feeds according to Customers’ needs at no additional charge.

T. Lookup tables, data maps, and variable definitions for data must be provided and easily accessible at all times (e.g. via hyperlink).

U. The retail fuel card shall be capable of capturing the following data at the time of fuel purchase:

1. Price per gallon

2. Excise tax detail – should be available by post date

3. Tax exempt calculation – should be available by post date

4. Grade, type of fuel purchased (includes alternative fuels such as CNG, Propane, E-

85, B-20, Biodiesel)

5. Quantity of fuel purchased

6. Date, time and location of purchase

7. Identification number of the card user

8. Miles per gallon and cost per mile

V. At a minimum, 95% of all retail fuel purchases must be transacted and reported as Level

Three (3) Data transactions.

W. Contractor’s Program System must be on a software platform that creates transaction data with the ability for account allocation in a text (ASCII) or MS Excel format.

X. Transaction data should be available for account allocation within 24 hours of transaction posting.

Y. Contractor shall provide the State with access to the complete data upon termination or expiration of the contract meaning a “final download” after all debts are settled. Data provided shall be for the complete fiscal year and is to include current and previous fiscal years.

Z. The reports below must be available to CPA or Customer. The reports must be generated by Customer name and identification code, broken down at various levels within a Customer’s hierarchy levels and by Contractor’s control number. Contractor shall provide a minimum of seven hierarchy levels.

AA. Historically Underutilized Business (HUB) Reporting: Reports that track purchases made from State of Texas certified HUBs so that state agencies and institutions of higher education can comply with Texas Government Code 2161.121-122 and HUB Rules Texas Administrative Code 20.287 (State Agency Reporting Requirements). The HUB report is based on the State of Texas fiscal year and requires monthly, semi-annual and annual reporting on HUBs and HUB subcontracted suppliers.

BB. The HUB reports should provide, at a minimum, a detailed monthly record and summary of the total payments made to Texas certified HUB vendors by state agencies and institutions of higher education. The reports must be provided in the format required by the State of Texas. Contractor must be able to integrate the Texas Vendor Identification Numbers of active certified HUBs with their database for reporting purposes on an as-needed basis as determined by CPA or a Customer (i.e. weekly, monthly, etc.)

CC. 1099 Report Information: In accordance with Section 6050W of the Housing Assistance Tax Act of 2008 entitled Information Reporting for Payments Made in Settlement of Payment Card and Third Party Network Transactions, Contractor shall be responsible for reporting payment card transaction information through a 1099-K Merchant Card and Third Party Payments form to the IRS. Reporting shall be required for all payment card transactions at all dollar thresholds. Contractor shall provide Customers with documentation confirming the completion of the 1099 Report Information. This is an annual report based on the calendar year.

DD. Reports that track purchases of Federal Certified Small and Disadvantaged Businesses.

F.2.2 Security Requirements

A. Contractor must comply with all state and federal laws and regulations regarding confidentiality, privacy and security pertaining to Customer’s confidential information.

Contractor represents and warrants that it will employ safeguards to ensure the confidentiality, integrity and availability of Customer information and shall limit the sharing of information based on need to know. Contractor must adhere to the following security requirements:

B. Customers may require a higher level of security including, but not limited to, personnel and physical security requirements (e.g. a higher level of security clearance may be required for Contractor’s employees with access to sensitive Customer systems, such as additional background checks). If additional security is required, Customer will specify further requirements during implementation.

C. Contractor shall provide a program system for Customers that complies with the applicable statutorily required accessibility standards for the State of Texas, to comply with the State of Texas reporting requirements outlined in 1 Texas Administrative Code Chapter 206 and 1 Texas Administrative Code Chapter 213. Contractor shall respond to all written inquiries from CPA regarding the program system’s compliance with requisite accessibility standards within five business days of receiving the request.

D. Access to Customer Data: Contractor represents and warrants that it will implement, maintain, and use appropriate administrative, technical, and physical safeguards to preserve the confidentiality, integrity, and availability of Customer Data. Contractor will not collect, access, use, disclose, or retain Customer Data other than as necessary to perform the services specified in a contract resulting from this solicitation. Contractor will restrict access to Customer Data to only those personnel who must have the information on a “need to know” basis. Contractor will not use Customer Data, or any information derived from Customer Data, for its own benefit or the benefit of any other person or entity. Contractor will not share Customer Data with its parent company or other affiliate.

E. Location of Customer Data: Contractor shall ensure that Customer Data (i.e., primary and backup) always remains within the continental United States. Contractor shall receive, process, transmit, and store all Customer Data within the continental United States. Contractor’s point of access to Customer Data shall be within the continental United States.

F. Encryption Standards:

1. Contractor shall encrypt Customer Data in transit and at rest. Data in transit means data is moving via email, in applications, or through browsers and other web connections. Data at rest (including data backups) means data is stored in databases, the cloud, removable media, or mobile devices.

2. Contractor shall utilize encryption standards that are FIPS 140-2 compliant.

3. Minimum cryptographic algorithm used by Contractor must be Advanced

Encryption Standard (AES) 128 or higher (256 AES is preferred).

4. Contractor shall encrypt Customer Data transmitted over a public or private network. Approved data encryption transmission protocols include the following:

(1) SFTP (FTP over SSH), (2) FTPS (FTP over SSL), (3) HTTPS (HTTP over SSL), and (4) virtual private network.

G. Independent Information Security Assessment: If Contractor has access to a Customer Information System or receives, processes, transmits, or stores Customer Data, then Contractor shall provide CPA with a summary report of the most recent information security assessment conducted by an independent third-party (e.g., SSAE-18 SOC 2 Type II, ISO 27002) upon contract award and annually thereafter. CPA, in its sole discretion, may conduct a security assessment of any information system holding Customer Data or connected to a Customer Information System. CPA’s security assessment may consist of a review of the following: (i) independent third-party assessment(s) contracted by Contractor (e.g., SSAE-18 SOC 2 Type II, ISO 27002), and, and (ii) Contractor’s System Security Plan.

H. Media Sanitization: Contractor shall sanitize information system media, both digital and non-digital, in accordance with NIST Special Publication 800-88 (Guidelines for Media Sanitization) when Customer Data in the custody of Contractor is no longer required to be retained by contract with CPA. Contractor must maintain a record documenting each sanitization procedure that, at a minimum, includes the following information: (i) date sanitization completed, (ii) description of the item(s), serial number(s), inventory control number(s), if applicable, and (iii) sanitization method used. No later than sixty (60) calendar days from contract expiration or termination or as otherwise specified in the contract with CPA, Contractor must either (i) complete the sanitization and submit via email to the CPA Contract Manager all sanitization documentation or (ii) submit a written statement via email to the CPA Contract Manager explaining the reason that destruction of Customer Data by Contractor is technically impossible or impractical.

Contractor’s obligations set forth in this clause survive the termination or expiration of the contract as long as Contractor retains Customer Data.

I. Third-Party Service Providers: It is Contractor’s sole responsibility to ensure that its access and the access Contractor grants to its service providers to Customer Data or Customer Information Systems does not result in unauthorized access to Customer Data or Customer Information Systems.

J. Payment Card Industry Standards: Contractor shall implement and maintain certification of Payment Card Industry (PCI) compliance standards. In addition, Contractor represents and warrants that the software used for the processing of credit card payments is in compliance with all applicable PCI standards including, but not limited to, Payment Application Data Security Standards (PA-DSS) and Point to Point Encryption Solution Requirements (P2PE).

K. Security Incident Notification: Contractor shall have policies and procedures for the effective management of Security Incidents that shall be made available to CPA upon written request. Within 24 hours of Contractor’s discovery or reasonable belief and Contractor’s relationship manager knowledge that there has been an event that results in the accidental or deliberate unauthorized access, loss, disclosure, modification, disruption, or destruction of confidential Customer information (“Security Incident”), Contractor shall provide notice to CPA by calling (800) 531-5441 EXT 34357. Until the investigation is complete, Contractor shall submit daily, or as otherwise agreed by CPA, a written report via encrypted email to security.alerts@cpa.texas.gov that includes all event details Contractor is permitted by law or Contractor’s internal policies to be shared with CPA. Contractor shall coordinate all media or other breach notifications with CPA in advance of such notification(s), unless expressly prohibited by law. Subject to review and approval of CPA, Contractor shall provide notice at its own cost that satisfies the requirements of applicable law to individuals whose information was compromised or likely compromised as a result of the Security Incident. If CPA, in its sole discretion, elects to send its own separate notice, then all costs associated with preparing and providing the notice shall be reimbursed to CPA by Contractor. If Contractor does not reimburse such costs within 30 days of CPA’s written request, then CPA shall have the right to collect such costs. CPA reserves the right to conduct an independent investigation of any Security Incident, and should CPA choose to do so, Contractor shall cooperate fully with CPA and assume responsibility at its own expense for making personnel, resources, and systems access available to CPA and CPA’s authorized representative(s).

F.2.3 Card Security Control and Restrictions

A. Contractor shall provide controls that will prevent the use of the payment card for purchasing commodities and services that Customer or CPA designates as restricted.

Contractor must have the ability to restrict payment card services by merchant category codes for those accounts so designated by CPA or Customers. The selection of exclusions will be at Customer’s discretion for SmartBuy Members, and within general guidelines established by CPA and the State of Texas for Institutions of Higher Education and State Agencies.

B. To prevent unauthorized purchases if the card is lost or stolen, the card must have a two-component authorization as requested by Customer. The card itself may count as one of the authorization components. Examples include the following: retail fuel card issued to a vehicle and driver identification number, retail fuel card and a vehicle identification number, driver identification number and a personal identification number (PIN), etc.

C. Contractor shall make available to the designated Program Administrator(s) or designee(s) for each Customer the ability to make on-line changes to information on a cardholder’s account. At a minimum, such changes shall include card expenditure limits, transaction limits, purchase restrictions, one-time override on an individual transaction, cardholder name, cardholder billing address or telephone number, termination or non-renewal of a cardholder account, and movement from one hierarchy level to another.

D. Contractor shall provide online alerts and notification of spending activity based on established Customer limits. This includes monitoring spending by cardholders and merchants with real time visibility through the Program System.

E. Contractor shall have the capability to maintain strict controls by creating cards with $0 spending authority, requiring Customer’s Program Administrator to call in for activation of cards and spend limits.

F. Each Customer shall be able to establish predetermined purchase and activity limits and controls including, but not limited to, purchase limits (daily, weekly and monthly) transaction limits (daily, weekly and monthly), single purchase limits and merchant category code restrictions.

G. Cash advances are strictly prohibited for state agencies and institutions of higher education unless written authority is granted by CPA.

H. Contractor shall be responsible for safeguarding all information obtained from the Contract resulting from this RFP. Contractor shall immediately notify CPA and Customer’s Program Administrator(s) of any breach of security which may have resulted in compromised data and shall initiate aggressive action to mitigate any potential consequences. Contractor shall be responsible for, but not limited to, system security, computer software security, network security, and web-based security.

I. Contractor shall ensure that each Customer has access only to the data for that Customer’s transactions and has no access to data of another Customer. Contractor shall provide CPA and State Auditor’s Office with full access to view and generate statewide reports and data for all Customers.

J. Identification and Access Controls for Program System: Contractor shall provide measures to enforce access control to the Program System. Contractor shall limit access using role-based access control (RBAC). RBAC shall define individual access detail for all roles and be based on least privilege and need-to-know. The Program System shall use identification and authorization data to determine user access to information. The Program System shall be able to define and control access between subjects and objects.

The enforcement mechanism (e.g. self/group public controls, access control lists and roles) shall allow Customer’s Program Administrator(s) to specify and control sharing of those objects by other users, or defined groups of users, or both, and shall provide controls to limit access rights to the system. The discretionary access control mechanism shall, either by explicit user action or by default, provide that objects are protected from unauthorized access. These access controls shall be capable of including or excluding access to the granularity of a single user and to limited data for that user. Access permission to an object by users not already possessing access permission shall be assigned only by Customer’s Program Administrators.

K. To ensure access control, the Program System shall, at a minimum:

1. include a mechanism to require users to uniquely identify themselves to the system before beginning to perform any other actions that the system is expected to mediate;

2. have random generation of unique passwords;

3. require passwords to be complex: a minimum of eight characters in length and contain at least three characters from the following list: Uppercase characters (A through Z), Lowercase characters (a through z), Base-10 digits (0 through 9) Non-alphanumeric characters (e.g. !,$,#,%,@);

4. require multi-factor authentication;

5. be able to maintain authentication data that includes information for verifying the claimed identity of individual users (e.g. passwords);

6. protect authentication data so that it cannot be accessed by any unauthorized user;

7. be able to enforce individual accountability by providing the capability to uniquely identify each individual Program System user; and

8. send alerts when attempts are made to guess the authentication data either inadvertently or deliberately.

L. In addition, Contractor shall implement protections for remote access by its employees to cardholders’ personally identifiable information. Contractor shall, at a minimum:

1. implement security controls for the transmission of and remote access to personal information;

2. encrypt all data in transit and at rest on mobile devices;

3. allow remote access only with two-factor authentication where one of the factors is provided by a device separate from the computer gaining access;

4. use a “time-out” function for remote access and mobile devices requiring user re-authentication after 30 minutes of inactivity; and

5. log all computer-readable data extracts from databases holding sensitive information and verify each extract including sensitive data has been erased within 90 days or its use is still required.

M. System Security Reviews and Audits: The Program System will be subject to security reviews, as required by CPA, before and throughout the period of performance. The Contractor shall provide complete information and access to CPA, as required, to facilitate these reviews. Reviews include, but are not limited to the following:

1. SSAE 16 SOC 2 Type II Audit: CPA requires Contractor to obtain SSAE 16 SOC 2 Type II annual audits of their internal controls and provide the report to SPD Statewide Contract Management (SCM).

2. Penetration Tests: CPA requires Contractor to obtain annual penetration tests and provide to SPD Statewide Contract Management (SCM) a summary of the results, including a plan of actions and milestones (POAMs) for remediation.

3. System Audits: To test, verify, and continuously monitor security compliance, CPA reserves the right to perform audits of management, operational and technical controls of Contractor’s systems annually, or as required;

4. Contractor shall comply with changes to security control review, audit, and authorization requirements as they are updated.

N. Ability to Audit System Actions: Contractor shall secure its information systems per an auditable information security framework (e.g. NIST 800-53 rev.4, ISO 27001). The Program System shall be able to create, maintain and protect from modification, unauthorized access, or destruction, an audit trail of accesses to the objects it protects.

The audit data shall be protected so that read access is limited to those authorized to have access. The Program System shall be able to record the following types of events:

1. use of identification and authentication mechanisms;

2. introduction of objects into a user’s account (e.g. filing dispute, requesting limit increase);

3. deletion of objects;

4. log onto system;

5. log off of system;

6. change of password;

7. all system administrator commands, while logged on as system administrator;

8. switching accounts or running privileged actions from another account (e.g.

Linux/Unix SU, or Windows RUNAS);

9. creation or modification of super-user groups;

10. subset of security administrator commands, while logged on in the security administrator role;

11. subset of security administrator commands, while logged on in the user role;

12. clearing of the audit log file;

13. startup and shutdown of the audit functions;

14. change of file or user permissions or privileges (e.g. use of suid/guid, chown, su);

15. remote access outside of the corporate network communication channels (e.g.

modems, dedicated VPN) and all dial-in access to the system;

16. changes made to an application or database by a batch file;

17. application-critical record changes;

18. changes to database or application records, where the application has been bypassed to produce the change (via a file or other database utility); and

19. all system and data interactions concerning Customer data.

O. The Program System shall also be able to audit any manual action that result in a change to system values or settings.

P. For each recorded event, the audit record shall be able to identify the date and time of the event, user, type of event and success or failure of the event. For identification and authentication events, the origin of request (e.g. terminal or user ID) shall be included in the audit record. For events that introduce an object into a user’s address space and for object deletion events, the audit record shall include the name of the object and the object’s label. Customer’s Program Administrator(s) shall be able to selectively audit the actions of any one or more users based on individual identity and/or object label. The audit system shall send alerts whenever a threshold is reached with respect to an auditing system resource (disk space in audit log volume) or when auditing has been turned off (either inadvertently or deliberately).

Q. Personnel Security: To ensure the security of Customer information, Contractor shall, at a minimum:

1. establish and maintain a training program for its personnel in security awareness and privacy and provide training to all personnel prior to their having access to Customer data in the performance of this contract. A copy of Contractor’s training program shall be provided to the CPA Category Manager within 30 calendar days of contract award.

2. require Contractor personnel who have access to Customer data have, at a minimum, a background investigation that includes a criminal background check;

3. represent and warrant that Contractor has not and Contractor’s employees have not been convicted of a felony criminal offense, or that if such a conviction has occurred Contractor has fully advised CPA as to the facts and circumstances surrounding the conviction. If awarded the contract, Contractor has a continuing duty to amend, supplement, or correct this representation and warranty no later than 10 days after discovering additional information relating to felony criminal convictions of Contractor or any of its employees. Contractor will not allow any employee convicted of a felony criminal offense to perform tasks related to the Contract without such disclosure and express permission from CPA.

4. remove access privileges for Contractor personnel for unauthorized, negligent, or inappropriate and willful actions.

5. Contractor shall provide verification of compliance with the above personnel requirements at the request of CPA.

R. Privacy and Security Safeguards: Contractor shall ensure confidentiality of data.

Contractor shall follow security principles and practices per NIST SP 800-53 rev. 4 to protect Customer information in Contractor’s infrastructure from disclosure to unauthorized persons. This protection shall include, but not be limited to, sensitive information maintained. Contractor shall protect the integrity of Customer data including, but not limited to the following:

1. Contractor shall not publish or disclose in any manner, without CPA’s written consent, the details of any safeguards either designed or developed by Contractor under this Contract or otherwise provided by CPA;

2. To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity and confidentiality of Customer data, Contractor shall afford CPA access to Contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases; and

3. If new or unanticipated threats or hazards are discovered by either CPA or Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party.

S. Physical Security: Contractor shall provide physical security to Customer information including, but not limited, to the following:

1. Customer shall control access to its Customer data housing facilities, equipment, material and documents by employees and visitors via electronic and/or physical methods corresponding to the critical nature of the work being performed, or the sensitive nature of Customer’s information being handled. Electronic and physical methods of security include, but are not limited to guards, intrusion detection devices, surveillance cameras, lighting and fencing.

2. Contractor shall ensure offsite backup and storage of critical program data.

Critical data and information is any data or information that is essential for the restoration of services and operation in the event of a disaster that impacts Contractor’s facilities or operation.

3. For a complete reference of recommended security controls, please refer to NIST P 800-53 rev.4.

F.3 SERVICE REQUIREMENTS

F.3.1 Customer Service

The following minimum staffing requirements may be increased at CPA’s request as needed:

A. Dedicated Account Manager:

1. Contractor shall provide a minimum of one Dedicated Account Manager to handle questions and resolve problems that arise.

2. Account Manager must be accessible by direct toll-free telephone numbers (no extensions), email, located in Texas offices and extremely knowledgeable of all aspects of the State’s card programs. The Account Manager must be available Monday through Friday (excluding Federal and State holidays) from the core hours of 8 am to 5 pm Central Time. Each hour that the Dedicated Account Manager (or Designated alternate when the Dedicated Account Manager is away) is unavailable in excess of four hours in a calendar day, Monday through Friday (excluding Federal and State holidays) during the core hours of 8 am to 5 pm Central Time, may result in the assessment of liquidated damages as set forth in Attachment G - Schedule of Liquidated Damages.

3. The Dedicated Account Manager shall also be expected to continually promote and increase participation in the Contract with the SmartBuy Members during the contract period.

B. Contractor shall notify CPA, in writing, at least 15 calendar days prior to any change of the Dedicated Account Manager. Failure to provide notice at least 15 calendar days may result in the assessment of liquidated damages as set forth in in Attachment G - Schedule of Liquidated Damages.

C. Customer Service Representatives (CSR):

1. Contractor shall provide a minimum of three Dedicated Customer Service

Representatives (CSRs), accessible by direct toll-free telephone numbers (no extensions), fax and email, to handle questions and customer service matters, with coverage on Monday to Friday (excluding Federal and State holidays) from 7 am to 7 pm Central Time. A minimum of two CSR from the pool of Dedicated CSRs must be available on Monday through Friday (excluding Federal and State holidays) from the core hours of 8 am to 5 pm Central Time.

2. Contractor shall provide a minimum of two Designated CSRs, accessible by direct toll-free telephone numbers (no extensions), fax and email, available on weekends, holidays and Monday through Friday (excluding Federal and State holidays) when Dedicated CSRs are unavailable.

3. Each hour that a Dedicated CSR or Designated alternate is unavailable in excess of two hours during the core hours of 8 am to 5 pm Central Time in a calendar day, Monday through Friday (excluding Federal and State Holidays) may result in the assessment of Liquidated Damages as set forth in Attachment G - Schedule of Liquidated Damages.

4. Each hour that a Designated CSR is unavailable in excess of two hours during a 24 hour period during weekends and holidays may result in the assessment of Liquidated Damages as set forth in Attachment G - Schedule of Liquidated Damages.

5. All CSRs must have on-line access to information to provide immediate response to inquiries concerning the status of cards, delivery information of new or replacement cards, billing/statement questions or issues, contract compliance requirements and general information.

6. Contractor shall address all customer service issues to CPA’s satisfaction within 48 hours. Failure to do so may result in the assessment of liquidated damages as set forth in Attachment G - Schedule of Liquidated Damages. Repeated failure to comply may result in Contract termination for cause.

7. Contractor shall notify CPA, in writing, at least 10 calendar days prior to any change of a Dedicated CSR. Failure to provide notice at least 10 calendar days may result in the assessment of liquidated damages as set forth in Attachment G - Schedule of Liquidated Damages.

D. Technical Help Desk Members:

1. Contractor shall provide a minimum of two Dedicated Technical Help Desk

Members, accessible by direct toll-free numbers (no extensions), with coverage on Monday through Friday (excluding Federal and State holidays) from the core hours of 8 am to 5 pm Central Time. Each hour that a Dedicated Technical Help Desk Member or Designated alternate is unavailable in excess of two hours during the core hours of 8 am to 5 pm Central Time during Monday through Friday (excluding Federal and State holidays may result in the assessment of liquidated damages as set forth in Attachment G - Schedule of Liquidated Damages.

2. Contractor shall also provide one Designated alternate Technical Help Desk Member when the Dedicated Technical Help Desk Members are not available.

3. The Technical Help Desk Members must possess in-depth knowledge of all aspects of Contractor’s Program System as designed and provided for Customers’ use in administering and managing their card programs. E.g. Technical Help Desk Members must be familiar with Customers’ commonly used reports and able to assist Customer’s Program Administrators in manipulating reports as necessary, creating similar reports, etc.

4. Contractor shall notify CPA, in writing, at least 10 calendar days prior to any change of the Dedicated Technical Help Desk members. Failure to provide notice at least 10 calendar days may result in the assessment of liquidated damages as set forth in Attachment G - Schedule of Liquidated Damages.

E. Contractor must maintain a 24 hours/365 days a year toll-free cardholder customer service line. Each hour that the toll-free cardholder customer service line is not available in excess of two hours in a 24 hour period may result in the assessment of liquidated damages as set forth in Attachment G - Schedule of Liquidated Damages.

F. Cardholder file: Contractor must maintain a cardholder file for each Customer’s cardholder which must contain at a minimum the following information for each:

1. Cardholder name, address, number, issue, activation and expiration dates

2. Alpha and numeric accounting code

3. Per transaction limit

4. Daily spending limit

5. Weekly spending limit

6. Monthly spending limit

7. Maximum transactions per day/month

8. Approved merchant category codes

9. Approving authority, official name and title

10. Name of Department, Division, or Section, and

11. Department ID number

G. Contractor shall be liable for charges from unauthorized use of any card. Unauthorized use is defined as any use or purchase that is prohibited by state or local laws, rules, policies, procedures, or any charge that was incurred by someone other than an employee of a Customer who did not have actual, implied or apparent authority to use the card.

H. Customer shall be liable for the use of cards by authorized users provided that:

1. Use is within the daily, weekly, monthly and single purchase limits established for the specific card.

2. User is an authorized Customer’s employee.

3. Allowed commodities and services are purchased.

4. Use is in compliance with Customer’s published card procedures.

F.3.2 Card Specifications A. Contractor must establish one dedicated prefix (first 4 or 5 digits) for all cards.

B. Contractor shall provide a card designed specifically for the State of Texas. CPA will have final authority on the basic design, and such design shall be provided at no charge to the State.

Each state agency payment card shall, at a minimum, contain on the front of the card:

1. The state seal (provided by CPA) and the following phrases embossed: “State of

Texas”, “FOR OFFICIAL USE ONLY”;

2. Description of the vehicle (make and model) or name of the cardholder (first name and last name, no nick names) on the 1st line;

3. Vehicle Identification Number (VIN), inventory number, and/or license plate number (whole or partial numbers) or name of the cardholder (first name and last name, no nicknames) on the 2nd line, Customer’s Identification Number and Entity Name (provided by CPA) on the 2nd line;

4. Account Number printed on the 3rd line. Account numbers shall not be sequential for any Customer; and

5. The words “Tax Exempt” as appropriate. CPA will provide instructions during implementation.

6. Institutions of higher education and SmartBuy Members shall have the option of fully customizable cards, at no additional charge. These Customers that desire a custom card design will provide Contractor with the camera ready artwork. The design is subject to approval by CPA, prior to submission to Contractor.

C. Each payment card shall, at a minimum, contain on the back of the card, Contractor’s 24 hours per day and 7 days a week customer service assistance number for cardholders.

D. No reference to Automatic Teller Machines (ATMs) may be included on the card.

F.3.3 Card Issuance, Renewal and Administration

A. Contractor shall provide a web-based application and card distribution process. Each Customer’s designated Program Administrator(s) will authorize and approve issuance of cards for the entity.

B. In the application process, applicants should have the ability to add multiple phone numbers.

C. Contractor shall provide procedures for rush applications (“Rush Procedures”) for account applications to use in circumstances when time is critical.

D. Contractor shall issue cards within five business days upon receipt of application unless a different schedule is approved in writing by CPA. Cards shall be issued only to those Customer employees who have properly completed an application which bears the signature of a designated authorized employee, as designated by Customer. Contractor must provide the embossed cards as Customer directs to Customer’s designated Program Administrator(s) or to the employee’s place of business. All cards must be issued for a minimum two year period.

E. Each retail fuel card may be assigned to an individual, a fleet vehicle or an organizational unit/cost center in accordance with the needs of Customer. Where cards are assigned to a fleet vehicle, a unique identifier may be used, typically the vehicle’s license plate number.

F. Contractor must provide emergency replacement of reported lost or stolen cards within 48 hours after notification of the loss, and non-emergency replacement of such a card in no more than five calendar days.

G. Contractor shall provide Customers the capability for immediate cancellation of cards.

Cancellation of cards shall be requested only by individuals designated by Customer via either written, fax or email communication to Contractor or through Contractor’s Program System. All verbal cancellations shall be verified in writing. Upon proper cancellation request, Customer is not liable for any charges incurred for such cancelled card.

H. Customers may order cards to be delivered anywhere in the state of Texas. Customer and Contractor shall coordinate the delivery of all cards, individually or grouped in one package. Contractor shall deliver all card(s) F.O.B. destination, freight prepaid and with tracking information.

F.4 TRAINING PROGRAM

Contractor shall establish and keep available a comprehensive training program to inform Customers of the card features and controls, including associated software and web-based applications, as well as how Respondent will satisfy the requirements as specified in Section F.2 Program System.

Contractor must provide on demand training.

Annual User Conferences: Respondent shall offer annual user conferences to Customers, at a minimum, in Austin, Houston and Dallas to highlight industry best practices and innovations.

This shall be at no cost to CPA or Customers.

F.5 MARKETING PLAN

Contractor shall establish a marketing plan detailing how respondent plans to increase usage under the Contract for new and existing Customers.

F.6 IMPLEMENTATION AND TRANSITION

F.6.1 Program Implementation

A. Contractor shall provide a detailed and comprehensive implementation plan with specific timelines. This shall include, at a minimum, the following:

1. the process for converting the existing card programs and training;

2. the process for converting all active card Customers;

3. how it will implement the required custom data file feeds and various software integration platforms as required by Customers;

4. sample Customer transition schedule including, but not limited to, a detailed list of necessary Customer actions (e.g., submittal of program forms, operating system specifications, communication plan, customer requirements collection, training, new card distribution) as well as the required time frames to ensure implementation stays on schedule.

F.6.2 Contract Transition

A. If the State replaces Contractor, Contractor will use “best efforts” and assist CPA to ensure that an efficient and effective transition takes place. Contractor shall provide such transition assistance at no charge to CPA and any Customer.

B. In the event the awarded Contract expires or is terminated for any reason before the end of the contract period, Contractor shall extend card services for a period up to 180 days or until such time as services of a new contractor are in effect and implemented, as determined by…