7600023167AppendixG.pdf

Office of General Services Procurement Services

Group 76000 - Award 23167 Electronic Poll Book Systems

Appendix G - How to Use This Contract

March 2025 Appendix G

Appendix G - How to Use the Electronic Poll Book Systems Contract

This document provides a NYS County Board of Elections (CBOE)/Authorized User with instructions on how to use the Electronic Poll Book (E-Poll Book) Systems Contract ("Contract").

General procurement information is available at the New York State Office of General Services (OGS) Procurement website. https://ogs.ny.gov/procurement/buyer-information

A CBOE/Authorized User must adhere to the terms and conditions of the Contract and the instructions herein when procuring products under the Contract. Terms and conditions of the Contract were created based on the requirements and specifications of Solicitation 23167. All Contractors will have the same terms and conditions for the duration of the Contract thus providing a fair and level playing field across the E-Poll Book System marketplace.

Contract information, including a list of contractors, contractor information, price lists and Request for Quotes (RFQ) templates can be found on the Contract website. An CBOE/Authorized User may contact the OGS Contract Manager at the email address on the website with any questions, concerns, or clarifications regarding the Contract.

https://ogs.ny.gov/purchase/snt/awardnotes/7600023167can.pdf

A CBOE/Authorized User with operational questions related to an existing New York State Board of Elections (SBOE) approved E-Poll Book System or the SBOE approval process may contact the Elections Operations Unit of the SBOE at Election_Op@elections.ny.gov or 518-473-5086.

SECTION 1 GENERAL INFORMATION

1.1 CONTRACT SCOPE.

This Contract establishes a purchasing vehicle for an individual NYS CBOE/Authorized User to acquire E-Poll Book Systems and related services, accessories, consumables, training and Maintenance. Per NYS Election Law, the SBOE must approve any E-Poll Book System before it can be used by a CBOE in New York State.

1.2 PRODUCTS IN SCOPE.

Products purchased under this Contract must be included on the Contractor’s NYS Contract Price List (Appendix E of the Contract) prior to purchase. Products available under the Contract will fall into one of two categories: E-Poll Book Systems or Related Products.

1.2.1 E-Poll Book Systems.

A Contractor’s E-Poll Book System, as approved by SBOE, is the standard system including Software, Hardware, Maintenance and included accessories (such as batteries, stylus, stands, carrying case).

1.2.2 Related Products.

In addition to the standard system, Contractors may include ancillary or related Products, as approved by SBOE, as optional upgrades meant to enhance the E-Poll Book System.

1.2.3 Services Per New York State Counties.

Training Services and Support Services, as approved by SBOE, may be offered under Related Products. Contractors have indicated if on-site Training Services and/or in-person Support Services are either offered statewide or to individual New York State Counties and the indication is included in the Contractor's Appendix D, Contractor Information, available on the OGS Contract website.

https://ogs.ny.gov/procurement/buyer-information https://ogs.ny.gov/purchase/snt/awardnotes/7600023167can.pdf mailto:Election_Op@elections.ny.gov

Group 76000 - Award 23167 Electronic Poll Book Systems

1.3 CONTRACT TERM

The Centralized Contracts under Award 23167 are for up to five (5) years with one five (5) year extension option. All contracts shall have a coterminous end date, including those contracts awarded during the continuous recruitment period or any periodic recruitment period. Please refer to the Contractor Information Summary page on the Contract website for a Contractor's specific contract period.

SECTION 2 AUTHORIZED USER CONSIDERATIONS.

2.1 GENERAL.

A CBOE/Authorized User may utilize the NYS Contract Price List and work with the Contractor to develop an Authorized User Agreement or Purchase Order for the project. The Authorized User Agreement or Purchase Order will memorialize the responsibilities of the Contractor with respect to a given transaction with a CBOE/Authorized User and may include items such as, but not limited to: a statement of work, a payment schedule, and a list of deliverables based on the CBOE/Authorized User’s requirements. CBOE/Authorized Users should review the terms and conditions of the Contract and the Contractors' NYS Contract Price List for approved and available Products. A CBOE/Authorized User should also consider the following when purchasing from this Contract:

1. Technical/Security Requirements – The SBOE has established an approval process with minimum security standards and redundancy procedures for E-Poll Book Systems. A CBOE/Authorized User may obtain a Contractor's SBOE approval package by submitting a request to the SBOE. CBOE/Authorized User should review the functionality described by the Contractor/SBOE in the approval package and consider their specific needs for any additional technical and/or security requirements beyond those included in the SBOE's evaluation process when developing an RFQ, Authorized User Agreement, and/or Purchase Order.

2. Project Plan – The CBOE/Authorized User may request a project scope description from the Contractor which defines all work to be performed by the Contractor to meet the requirements of the Authorized User Agreement or Purchase Order. Such project plan may also include a detailed list of all tasks, resources, delivery timeframes, etc. for each task.

3. Support Plan – The CBOE/Authorized User may request a support plan from the Contractor related to the support and maintenance of the proposed E-Poll Book System, in which definitions of the roles and responsibilities of both the Contractor and the CBOE/Authorized User are outlined. Items in a support plan may include:

I. Designated contact/key personnel - The CBOE/Authorized User may specify requirements for a project manager or point of contact for implementation of the E-Poll Book System or other auxiliary services, such as training.

II. Organizational chart – that includes all support tiers and staffing levels (e.g. Help Desk, application support, database administration, etc.).

III. Escalation procedures – guidelines for the CBOE/Authorized User support staff to follow for contacting Contractor if problems are not resolved in a timely manner.

IV. Reporting – Contractor’s status reporting capabilities for ongoing incidents.

4. Training Plan – The CBOE/Authorized User may specify additional requirements necessary to satisfy any project needs for training on the use of the E-Poll Book System. The CBOE/Authorized User may request a Training Plan from the Contractor to fulfill such requirements which may include experienced trainers; onsite availability; “train-the-trainer” functionality; electronic training materials; etc.

5. Quality Management/Acceptance Testing Plan – The CBOE/Authorized User may wish to include in the RFQ, Authorized User Agreement, and/or Purchase Order any acceptance testing criteria as established by SBOE or

Group 76000 - Award 23167 Electronic Poll Book Systems by the CBOE/Authorized User.

6. Kick-off Meeting/Project Plan Discussion – The CBOE/Authorized User may require a kick-off meeting with the selected Contractor to discuss the project and any required plans.

2.2 PRIMARY SECURITY AND PRIVACY MANDATES.

The information collected and maintained by Authorized Users is protected by a myriad of Federal and State laws and regulations. Access to and use of sensitive and confidential information is limited to authorized government employees and legally designated agents for authorized purposes only. All details should be outlined in the CBOE/Authorized User’s statement of work prior to the engagement of services under this Contract.

In addition to all other existing primary security and privacy mandates that apply to User Data, CBOEs are reminded to consider and address any privacy mandates that exist in the following sections of NYS Election Law: Sections 1-104 (38);

3-103; 3-220, 5-506, 5-508 and Part 6212 and Part 6217.11 of the New York Codes, Rules and Regulations, Title 9, Subtitle V. State Board of Elections when developing an RFQ, Authorized User Agreement, or Purchase Order.

2.2.1 CBOE/Authorized User Security Considerations.

In addition to familiarity with the security requirements set forth in the SBOE's approval of the E-Poll Book Systems, the CBOE/Authorized User should be familiar with the terms set forth in Section 4, E-Poll Book System Specific Terms and Conditions of the Contract.

The below table highlights Contract terms and conditions that apply to the CBOE/Authorized User’s User Data and should be considered in the development of an RFQ, Authorized User Agreement and/or Purchase Order.

CONTRACT SECTION TERM/CONDITION

4.2 Protection of Data, Infrastructure and Software

The Contractor is responsible for providing physical and logical security for all User Data.

All User Data security provisions agreed to by the CBOE/Authorized User and Contractor within an Authorized User Agreement or Purchase Order may not be altered without written agreement by both parties.

4.3.1 Security Policies and

Procedures

The CBOE/Authorized User may state a requirement in their Authorized User Agreement or Purchase Order that instructs a Contractor to provide verification of compliance with CBOE/Authorized User security requirements.

4.3.2 Security Incidents The Contractor will notify the CBOE/Authorized User of any Security Incidents affecting SBOE or CBOE User Data within the Contractor’s possession. The CBOE and/or SBOE will handle the incident in accordance with the established SBOE Cybersecurity Incident Notification Reporting procedures.

4.4 Data Breach, 4.4.1

Required Contractor Actions

Section 4.4 of the Contract details the required Contractor actions in the event of a Data Breach. A CBOE/Authorized User must also be aware of any mandated reporting responsibilities or actions related to the User Data collected and maintained in relation to an E-Poll Book System that they must follow in the event of a Data Breach and ensure that all details are outlined and addressed in the Authorized User Agreement or Purchase Order.

4.5.1 Data Ownership The CBOE/Authorized User shall own all right, title and interest in User Data.

4.5.2 Authorized User Access

to Data

The CBOE/Authorized User shall have access to its User Data at all times and have the ability to import or export User Data in piecemeal or in its entirety at the CBOE/Authorized Users discretion with no charge to the CBOE/Authorized User. The CBOE/Authorized User can specify in their Authorized User Agreement or Purchase Order that the access to data should be carried out by providing application programmable interface or another efficient electronic tools.

4.5.3 Contractor Access to

Data

The Contractor shall not copy or transfer User Data unless authorized by the CBOE/Authorized User and shall not access User Data for any other purpose than fulfilling the service. Contractors are allowed to perform industry standard back-ups of User Data and the CBOE/Authorized User may request documentation of back-up from

Group 76000 - Award 23167 Electronic Poll Book Systems the Contractor.

4.5.4 Source Code Escrow

for Licensed Product

Section 4.5.4 describes the options available to the CBOE/Authorized User in relation to Source Code Escrow for Licensed Products acquired under this Contract.

4.6 Transferring of Data,

4.6.1 General

The Contractor will not transfer User Data unless directed to do so in writing by the CBOE/Authorized User and all User Data must remain in CONUS.

4.6.2 Transfer of Data at End

of Contract and/or Authorized User Agreement/Purchase Order Term

The CBOE/Authorized User should state in the Authorized User Agreement or Purchase Order the requirements regarding transfer of User Data at the end of the Contract or CBOE/Authorized User Agreement or Purchase Order.

4.6.3 Transfer of Data;

Charges

The Contractor must include pricing for the transfer of User Data in the CBOE/Authorized User Agreement or Purchase Order.

4.8.1 Return of Data The CBOE/Authorized User should state in the Authorized User Agreement or Purchase Order the format in which the User Data should be returned and the required timeframe for the Contractor to remove User Data from its System and backups.

4.8.2 Suspension of Services During any period of suspension or service, the CBOE/Authorized User shall have full access to all User Data at no charge.

4.8.3 Expiration or

Termination of Services

Upon expiration or termination of an Authorized User Agreement or Purchase Order, the CBOE/Authorized User shall have full access to all User Data for a period of 60 calendar days. Unless noted in the Authorized User Agreement or Purchase Order, this period will be covered at no charge.

4.9 Access to Security Logs

and Reports

In the Authorized User Agreement or Purchase Order, the CBOE/Authorized User may request access to security logs and reports in a specified format.

4.10 Application Program

Interface (API) or Self-Service Electronic Portal

The Contractor may offer an API or self-service electronic portal for such purposes of allowing the CBOE/Authorized User to access security logs, reports, and audit information, to import or export User Data, and for such other purposes as agreed to in the Authorized User Agreement or Purchase Order.

2.2.2 Authorized User/Purchase Order Inclusions.

An Authorized User Agreement/Purchase Order may include, as applicable, such factors as, but not limited to:

• Scope/statement of work;

• Manufacturer Part/Stock Numbers;

• Additional security requirements;

• Additional insurance requirements;

• Delivery requirements, including:

o Product delivery date, o Delivery to an inside location, and o Any other unique delivery requirements;

• Hardware and Software environment;

• Systems/Networks to integrate with;

• Installation date; and

• Travel Reimbursement.

2.2.3 Product Acceptance.

Any E-Poll Book System is subject to SBOE and/or CBOE/Authorized User acceptance. Acceptance shall be in accordance with SBOE or CBOE policy. The SBOE or CBOE/Authorized User may publish such acceptance policy which may include the E-Poll Book System being subject to audit by the SBOE or CBOE/Authorized User. If no acceptance policy has been outlined by the SBOE or CBOE/Authorized User, acceptance shall be in accordance with Appendix B, Section 61, Product Acceptance.

2.2.4 Product Audit.

Group 76000 - Award 23167 Electronic Poll Book Systems

The SBOE or CBOE/Authorized User reserve the right to audit any E-Poll Book System sold under a Contract at any time to ensure compliance with all functional, security and challenge report requirements as approved by the SBOE.

2.2.5 Network Security Compliance.

In accordance with Election Law Section 1-104, subsection 38, the SBOE shall approve and certify that the network or system to which the E-Poll Book System is connected is compliant with the minimum security standards.

CBOE/Authorized Users should be familiar with SBOE minimum security standards.

CBOE/Authorized Users shall not implement any E-Poll Book System until approval of compliance has been obtained from the SBOE.

CBOE/Authorized User will notify Contractor of its approved connectivity strategy prior to implementation and work with Contractor to ensure that minimum security standards are met.

SECTION 3 HOW TO PURCHASE FROM E-POLL BOOK SYSTEM CONTRACT

3.1 PURCHASES UTILIZING A REQUEST FOR QUOTES.

To encourage competition and foster better pricing, it is highly recommended that CBOE/Authorized Users procure E-Poll Book Systems and Related Products via a Request for Quotes (RFQ).

3.1.1 Request For Quote And Financial Templates.

An RFQ template along with a financial template are available on the Contract website. CBOE/Authorized Users are not required to use these templates and can utilize another RFQ format as long as that format includes core information from the templates and references Group 76000, Award 23167, Electronic Poll Book System Contract.

3.1.2 Request For Quote - Process Overview.

The following is an overview of the sequence of events that will typically occur during the RFQ Process.

1. Develop your RFQ

2. Release your RFQ

3. Conduct a Question and Answer Period (optional)

4. Collect RFQ Responses

5. Evaluate RFQ Responses

6. Make a final determination

7. Notify Awardee and Non-Awardee(s)

8. Develop an Authorized User Agreement/Purchase Order

3.1.3 Projected Spend and Securing Future Discounts.

OGS recommends that the CBOE/Authorized User include language that requires the Contractor to hold pricing for SBOE-approved products that the CBOE/Authorized User may intend to re-purchase within in the next 6 to 12 months.

CBOE/Authorized Users should refrain from overstating their volume needs and make accurate predictions as to realistic purchase estimates.

Sample Language: “[Authorized User] will purchase some, all or more of the quantities of the products and services detailed in the Financial Response (see Excel spreadsheet) over a twelve (12) month period from date of award, but not necessarily at one time. [Authorized User] requires that the prices be held for twelve (12) months from the date of award.”

Group 76000 - Award 23167 Electronic Poll Book Systems

3.1.4 Evaluation of Quotes.

The RFQ must be evaluated based on the CBOE/Authorized User’s pre-defined methodology. This evaluation must include a review for acceptability of any additional terms and conditions the Contractor may have submitted with its quote.

Evaluation tools cannot be altered after quotes are received.

3.1.5 Notification of Quote Results and Debriefings.

The CBOE/Authorized User should notify the non-awardees of RFQ results in a timely manner after notifying the awardee.

CBOE/Authorized Users are strongly encouraged to provide an opportunity for debriefing. The opportunity for a Contractor to request a debriefing must be included in the RFQ.

3.1.6 Negotiation with Tentative Awardee.

Once the tentative award has been made in accordance with the method of award specified in the RFQ, the CBOE/Authorized User may enter negotiations to obtain the best price possible, or to obtain additional savings based on the released RFQ. Negotiations shall not include factors that would have altered the evaluation of the RFQ response.

3.1.7 Bid Protests and Disputes.

Should a protest be submitted by a Contractor regarding an RFQ, the protest will be considered and decided by the CBOE/Authorized User. Disputes under an Authorized User Agreement will also be handled by the CBOE/Authorized User.

3.2 ORDERING.

CBOE/Authorized Users are not required to release an RFQ to purchase under this Contract. Not-to-exceed pricing on the NYS Contract Price List has been established with the Contractor for use by CBOE/Authorized Users and has been posted on the OGS website. After selecting Products and finalizing an order with the Contractor, the CBOE/Authorized User may issue a Purchase Order to the Contractor.

3.3 INVOICING.

All invoices shall at a minimum, include the items listed below and any additional information identified in the Purchase Order and Authorized User Agreement:

• E-Poll Book Systems Contract Number

• Contractor Name

• NYS Vendor ID

• Manufacturer Part Number

• Product Name

• Product Description

• Quantity

• Net NYS Price for each Product

• Specific designation of special price(s) which may be better than the Net NYS Price

• Invoice Total

3.4 PRODUCT PRICING.

All Contractor NYS Price Lists are posted on the Contract website. CBOE/Authorized Users should compare all Products and pricing and select the Product that best meets the CBOE/Authorized User’s needs. When reviewing quotes and invoices, CBOE/Authorized Users should ensure Contractor pricing is at or below the Net NYS Price as reflected on the Contractor’s price list on the OGS website.

Group 76000 - Award 23167 Electronic Poll Book Systems

3.5 PRODUCT DELIVERY.

Contractors must deliver the units ordered by the CBOE/Authorized User within thirty (30) calendar days after receipt of a Purchase Order by the Contractor, unless otherwise agreed to by the CBOE/Authorized User and the Contractor. The thirty (30) days will start at the time of receipt of a Purchase Order and will conclude with delivery to the CBOE/Authorized User. This timeframe will include all work to be done by a Contractor.

3.6 AT-RISK WORK PROHIBITED.

CBOE/Authorized Users are cautioned that at-risk work is strictly prohibited. No work is to be undertaken by the Contractor prior to receipt of the executed Authorized User Agreement or Purchase Order).

3.7 PROCUREMENT RECORD AND NEW YORK STATE PROCUREMENT COUNCIL GUIDELINES.

The CBOE/Authorized User is reminded that it must adhere to the procedures of this Contract, its own internal procurement policies and procedures and all federal, State and/or local statutes, when applicable.

The following link to the New York State Procurement Council Guidelines provides additional procurement information and examples of documentation that should be created and maintained by the CBOE/Authorized User as part of a procurement record:

https://ogs.ny.gov/system/files/documents/2018/08/psnys-procurement-guidelines.pdf

3.8 OFFICE OF THE STATE COMPTROLLER.

For purchases available from this Contract, the CBOE/Authorized User may issue a Purchase Order/Authorized User Agreement directly to the Contractor without prior approval by the Office of the State Comptroller (OSC).

However, CBOE/Authorized Users are reminded that the Office of the State Comptroller retains the right to post-audit any procurement, including those executed from this Contract. CBOE/Authorized Users are reminded to follow all procurement guidelines.

3.9 End Point Device Security Requirements for State Agency Authorized Users

In accordance with Section 165 of NYS Finance Law, State Agency Authorized Users must ensure all “end point device” purchases are consistent with any relevant standards, guidelines, or guidance developed as part of the National Institute of Standards and Technology (NIST) Cybersecurity Framework.

Suggestions for verifying NIST compliance: NIST standard compliance should be in the Manufacturer's/service providers specs for a product. The AU should reference the requirements as part of their RFQ or engagement with the Contractor and require the Contractor to demonstrate they are offering a product that meets the standard or an explanation of why there is no applicable NIST standard as part of the bid or engagement response.

https://ogs.ny.gov/system/files/documents/2018/08/psnys-procurement-guidelines.pdf

1.3 CONTRACT TERM