Information Technology (IT) Supplemental

IT Supplemental Effective Date: November 2025

This supplemental contains additional requirements under Section 2 of the solicitation.

Per the Self-Directed Services Act, up to three (3) contract awards will be issued for the full scope of services. Each awarded vendor will operate under a standardized framework while managing its own participant pool. To ensure a seamless user experience, the DDA will own and host a centralized web portal in coordination with the Office of Enterprise Technology (OET) and Medicaid. Vendors must integrate their systems with this central portal to allow single-click routing to vendor-specific portals and ensure streamlined data exchange. The target contract award date is August 1 (no later than

September 1), allowing for a mandatory 90-day transition period prior to full operational launch.

Internal bracketed instructions and template guidance notes throughout this document have been reviewed and cleaned up.

1.1 Deliverables

1.1.1 Deliverable Details

The Contractor must include the following details in its deliverable's documentation:

A. Staffing: A complete organizational chart (including subcontractors) resumes for all

Key Personnel (as defined in Section 2.4), and a plan for personnel onboarding, training, and managing required certifications.

B. Invoicing: Detailed procedures for submitting invoices for FMS and Counseling

Services, including frequency, required supporting documentation (e.g., Deliverable

Product Acceptance Form—DPAF), and estimated internal processing time.

C. Required Reports and Deadlines: A full list of reports required from the vendors, which must include at minimum those specified in Section 2.3.9 Quality Assurance, Performance Reporting, and System Access, and their respective submission deadlines.

D. General Reporting Standards: To ensure State compliance with Federal §1915(c)

Waiver financial accountability and quality assurance standards, all reports in this section must be submitted in a filterable Excel/CSV format. Data must be derived from the Contractor’s core enrollment system to verify that all vendors are properly credentialed and meet Medicaid qualification requirements.

1.1.2 Deliverable Submission

A. For every deliverable, the Contractor shall request the Contract Monitor confirm receipt of that deliverable by sending an e-mail identifying the deliverable name and date of receipt.

B. For every deliverable, the Contractor, in coordination with the FMS Program

Manager, shall submit to the Contract Monitor, by e-mail, an Agency Deliverable

Product Acceptance Form (DPAF), an example of which is provided on the DoIT web page here: https://procurement.maryland.gov/wp-content/uploads/sites/12/2024/07/Exhibit-3.-Deliverable-Product-Acceptance-Form-

DPAF.docx https://procurement.maryland.gov/wp-content/uploads/sites/12/2024/07/Exhibit-3.-Deliverable-Product-Acceptance-Form-DPAF.docx https://procurement.maryland.gov/wp-content/uploads/sites/12/2024/07/Exhibit-3.-Deliverable-Product-Acceptance-Form-DPAF.docx https://procurement.maryland.gov/wp-content/uploads/sites/12/2024/07/Exhibit-3.-Deliverable-Product-Acceptance-Form-DPAF.docx

C. Unless specified otherwise, written deliverables shall be compatible with Microsoft

Office, Microsoft Project or Microsoft Visio within two (2) versions of the current version. At the Contract Monitor’s discretion, the Contract Monitor may request one hard copy of a written deliverable.

D. A standard deliverable review cycle will be elaborated and agreed-upon between the

State and the Contractor. This review process is entered into when the Contractor completes a deliverable.

E. For any written deliverable, the Contract Monitor/FMS Program Manager may request a draft version of the deliverable, to comply with the minimum deliverable quality criteria listed in Section 1.1.4 Minimum Deliverable Quality. Drafts of each final deliverable, except status reports, are required at least two weeks in advance of when the final deliverables are due (with the exception of deliverables due at the beginning of the project where this lead time is not possible, or where draft delivery date is explicitly specified). Draft versions of a deliverable shall comply with the minimum deliverable quality criteria listed in Section 1.1.4 Minimum Deliverable Quality.

1.1.3 Deliverable Acceptance

A. A final deliverable shall satisfy the scope and requirements of this RFP for that deliverable, including the quality and acceptance criteria for a final deliverable as defined in Section 1.1.5 Deliverable Descriptions/Acceptance Criteria.

B. The Contract Monitor/FMS Program Manager shall review a final deliverable to determine compliance with the acceptance criteria as defined for that deliverable. The

Contract Monitor/FMS Program Manager is responsible for coordinating comments and input from various team members and stakeholders. The Contract Monitor is responsible for providing clear guidance and direction to the Contractor in the event of divergent feedback from various team members.

C. The Contract Monitor will issue to the Contractor a notice of acceptance or rejection of the deliverable in the DPAF (see online sample). Following the return of the DPAF indicating “Accepted” and signed by the Contract Monitor, the Contractor shall submit a proper invoice in accordance with the procedures in Section 3.3. The invoice must be accompanied by a copy of the executed DPAF or payment may be withheld.

D. In the event of rejection, the Contract Monitor will formally communicate in writing any deliverable deficiencies or non-conformities to the Contractor, describing in those deficiencies what shall be corrected prior to acceptance of the deliverable in sufficient detail for the Contractor to address the deficiencies. The Contractor shall correct deficiencies and resubmit the corrected deliverable for acceptance within the agreed-upon time period for correction.

1.1.4 Minimum Deliverable Quality

The Contractor shall subject each deliverable to its internal quality-control process prior to submitting the deliverable to the State.

Each deliverable shall meet the following minimum acceptance criteria:

A. Be presented in a format appropriate for the subject matter and depth of discussion.

B. Be organized in a manner that presents a logical flow of the deliverable’s content.

C. Represent factual information reasonably expected to have been known at the time of submittal.

D. In each section of the deliverable, include only information relevant to that section of the deliverable.

E. Contain content and presentation consistent with industry best practices in terms of deliverable completeness, clarity, and quality.

F. Meets the acceptance criteria applicable to that deliverable, including any State policies, functional or non-functional requirements, or industry standards.

G. Contains no structural errors such as poor grammar, misspellings or incorrect punctuation.

H. Must contain the date, author, and page numbers. When applicable for a deliverable, a revision table must be included.

I. A draft written deliverable may contain limited structural errors such as incorrect punctuation and shall represent a significant level of completeness toward the associated final written deliverable. The draft written deliverable shall otherwise comply with minimum deliverable quality criteria above.

1.1.5 Deliverable Descriptions/Acceptance Criteria

In addition to the items identified in the table below, the Contractor may suggest other subtasks, artifacts, or deliverables to improve the quality and success of the assigned tasks.

Deliverables Summary Table* Note: References in the table below are within the RFP.

ID # Deliverable

Description Acceptance Criteria Due Date /

Frequency

2.6.4.1a

Integrated Project

Schedule Microsoft Project schedule demonstrating tasks, task estimates, resource assignments, and dependencies for both Agency and Contractor

Personnel, with tasks no less than 8 hours and no greater than 80 hours.

Initial Delivery:

NTP+ ten (10)

Business Days Updates: Weekly

2.6.4.2 Kick-off Meeting Reference 3.1

Date specified by

FMS Program

Manager/On-going

2.6.4.3

Electronic Visit

Verification (EVV) Reference 2.1.1 &

2.3.2.6

Design, Demo, Develop and Implement Date specified by

FMS Program

Manager/On-going

2.6.4.4 Fiscal Management

Services Reference 2.3.2

Location, local office in Maryland Date specified by

FMS Program

Manager/On-going

2.6.4.5 Employer Agent Reference 2.3.2.1b

Maryland Medicaid Provider Date specified by

FMS Program

Manager/On-going

2.6.4.6 Customer Service

System Reference 2.3.7

1-800 toll free, customer service line Date specified by

FMS Program

Manager/On-going

2.6.4.8 Training Reference 2.3.3

Individual training plan/session, handbook Date specified by

FMS Program

Manager/On-going

2.6.4.9 Data Systems Reference 2.3.4

Maintain a data system Date specified by

FMS Program

Manager/On-going

2.6.4.10 Policy and Procedure

Manual Reference 2.3.5

Written, word or similar format, electronic format Date specified by

FMS Program

Manager/On-going

2.6.4.11

Quality Assurance, Performance

Reporting, and

System Access Reference 2.3.6

Reports, all formats must receive prior approval by FMS Program Managers Date specified by

FMS Program

Manager/On-going

2.6.4.12 Performance Audits Reference 2.3.8

Annual Independent Audit by CPA Date specified by

FMS Program

Manager/On-going

*The deliverables summary table may not list every contractually required deliverable. Offerors and

Contractors should read the RFP thoroughly for all Contract requirements and deliverables. .

1.1.5.1. Deliverable Details

The Contractor must include the following details in its deliverable's documentation:

1. Staffing: A complete organizational chart (including subcontractors), resumes for all Key

Personnel (as defined in Section 2.4 in the RFP), and a plan for personnel onboarding, training, and managing required certifications.

2. Invoicing: Detailed procedures for submitting invoices for FMS and Counseling Services, including required format, frequency, timeframe and required supporting documentation (e.g., Deliverable Product Acceptance Form—DPAF), and estimated internal processing time.

3. Required Reports and Deadlines: A full list of reports required from the vendors, which must include at minimum those specified in Section 2.3.9 Quality Assurance, Performance

Reporting, and System Access, and their respective submission deadlines and required submission methods.

4. General Reporting Standards: To ensure State compliance with Federal §1915(c) Waiver financial accountability and quality assurance standards, all reports in this section must be submitted in a filterable Excel/CSV format. Data must be derived from the Contractor’s core enrollment system to verify that all vendors are properly credentialed and meet Medicaid qualification requirements.

1.1.5.2. Estimated Deliverables Timeline Chart

Note: References in the table below are within the RFP.

Deliverable

Area Specific Deliverable Estimated Timeline/Frequency

Staffing Updated Organizational Chart (Section 2.4) Due Date determined by FMS

Program Manager / Annually and upon changes

Key Personnel Resumes & Certifications Within fifteen (15) days of substitution

Invoicing Draft Invoicing Procedures Manual Within thirty (30) Business Days of Notice to Proceed (NTP)

Monthly FMS/Counseling Service Invoices Monthly, following the month of service (See Section 3.3)

Reporting Quality Assurance & Performance Reports including MBE/VSBE reports (Section

2.3.10)

By the 15th of the month for the previous month's activities

Corrective Action Plan (CAP) (Section

2.3.8) Within ten (10) Business Days of request, or as specified by FMS

Program Manager

Annual Report Due Date designated by the FMS

Program Manager

Security Incident Notification (Section

2.6.8) Within twenty (20) minutes of occurrence

Problem Escalation Procedure (PEP)

(Section 3.5) No later than (10) Business Days after notice of recommended award/within (10) Business Days after the start of each Contract year or after any change.

Disaster

Recovery/Data

Recovery Plan for Electronic Program

Information (Section 2.3.7) Within thirty (30) Business Days of Notice to Proceed (NTP)

Provider

Oversight Vendor Qualification & Registry Report:

A master list of all credentialed non-DDA business vendors (FEIN-based) including legal identity, contact info, and authorized waiver services. Vendor Qualification &

Registry Report (Required for Federal

§1915(c) Waiver Oversight

Quarterly

Compliance

Monitoring Credentialing Audit Log: A comprehensive record of background check dates, CPS clearances, and current Written Service

Agreement dates for all vendors.

Annually

Fiscal

Accountability Vendor Utilization & Payment Summary:

A report linking vendor payments to participants, including the date of last payment and total YTD spend per vendor.

Quarterly

1.2 Contractor-Supplied Hardware, Software, and Materials

A. The Contractor is responsible for the acquisition and operation of all hardware, software and network support related to the services being provided. However, the State has the right to purchase hardware, software, and hosting services from a source other than the Contractor if it is determined to be in the best interest of the State based on value and price.

B. Cloud based applications shall be accessible from various client devices through a thin client interface such as a Web browser or a program interface.

C. For projects that require Contractor supplied materials, the costs for the materials shall be passed through to the State with no mark-up by the Contractor.

D. The Contractor may operate in the production environment upon authorization to operate

(ATO) from the State.

E. The Contractor shall prepare software releases and stage at the DDA for validation in the system test environment. The DDA will provide authorization to proceed. The DDA will have the ability to manage the distribution of these releases to the appropriate sites. To support this requirement, the Contractor shall propose, provide and fully describe their solution for updating all sites with any new software releases.

F. The Offeror shall provide manufacturer or provider’s standard warranty for the item of warranty for a period coinciding with the duration of the Contract. Offeror shall identify the duration of the standard warranty. Any warranty period for goods and services will not commence until acceptance of the products or services by the DDA. Notwithstanding anything to the contrary, all defective items must be replaced at no additional cost to the State.

1.3 Product Requirements

A. Open source software may be proposed; however, operational support for the proposed software must also be proposed. Operational support shall include maintenance and updating of code to address software dependencies, software updates, and security vulnerabilities.

B. Offerors proposing to resell services of another entity must be authorized by such other entity.

C. No international storage or processing for State Data: As described in Section 1.6.5.B 15)

Data Protection and Controls, Offerors are advised that any processing or storage of data outside of the continental U.S. is strictly prohibited.

D. Consistent expiration dates: Licenses/services purchased under the Contract shall expire coterminously with the earliest licenses/services delivered. As appropriate, charges shall be prorated. Offeror consistent expiration dates: A PO for a service already being delivered to the

DDA under the Contract shall terminate on the same calendar day as the prior product/service.

As appropriate, charges shall be pro-rated.

E. Any terms of use or other agreement applicable to the Offeror's proposed services must be contained in the Offeror’s Technical Proposal. The State is not subject to any terms of use or other agreement applicable to the Offeror’s proposed services unless the same are explicitly agreed to by the State during the Proposal evaluation process.

F. The State does not recognize and is not subject to any auto renewal of services provision that may be contained or provided for in any Contractor agreements. In addition to any notices of renewal sent to the DDA, Contractors shall email notices of renewal to the e-mail address designated by the FMS Program Manager.

1.4. Maintenance

A. Maintenance commences at the State acceptance of initial startup activities. Billing for such maintenance and support shall commence after the State acceptance of initial startup activities. If there is an activity that must be complete before maintenance (and associated billing) can begin, the Contractor must clearly indicate this activity when the State ACCEPTS the deliverable.

B. Software maintenance includes all software changes, modifications, updates, patching, bug fixes, vulnerability fixes, and enhancements applicable to all system modules licensed without further charge to all licensed users maintaining a renewable software support contract.

C. Maintenance shall be provided for superseded releases and back releases still in use by the State.

D. For the first year and all subsequent Contract years, the following services shall be provided for the current version and one previous version of any Software provided with the Deliverables, commencing upon State acceptance of initial startup activities:

1) Error Correction. Upon notice by the State of a problem with the Software (which problem can be verified), reasonable efforts to correct or provide a working solution for the problem.

2) Material Defects. Contractor shall notify the State of any material errors or defects in the

Deliverables known or made known to Contractor from any source during the life of the

Contract that could cause the production of inaccurate or otherwise materially incorrect results. The Contractor shall initiate actions as may be commercially necessary or proper to effect corrections of any such errors or defects.

3) Vulnerabilities. Contractor shall notify the State of any vulnerabilities of which it is or becomes aware, that could allow unauthorized access, disclosure, or modification of data, applications, or systems. The Contractor shall fix all vulnerabilities in accordance with the

State’s IT Security Manual in Reference B of the Table in Section 1.2.

4) Updates. Contractor will provide to the State at no additional charge all new releases and bug fixes (collectively referred to as “Updates”) for any software Deliverable developed or published by the Contractor and made available to its other customers.

E. Activity reporting

1.4.1 Technical Support

A. “Technical Support” means Contractor-provided assistance for the services or Solution furnished under the Contract, after initial end-user support confirms a technical issue that requires additional troubleshooting capabilities; sometimes referenced as Tier II – IV support.

B. Technical Support shall be available during Normal State Business Hours.

C. The State shall be able to contact a Technical Support team member 24 hours per day, 7 days per week, 365 days per year.

D. Contractor Personnel providing technical support shall be familiar with the State’s account

(i.e., calls shall not be sent to a general queue).

E. Contractor shall return calls for service of emergency system issues (see Section 2.6

Service Level Agreement) within one (1) hour.

F. Calls for non-emergency IT service requests will be returned within three (3) hours or immediately the following day if after Normal State Business Hours.

1.4.2 Backup

The Contractor shall:

A. Provide backups of the configuration and data on a regular basis as a Contract option. Contractor shall describe backup services offered, and shall offer pricing for this option in the Financial

Proposal Form (Attachment B);

B. Meet the Recovery Time Objective (RTO) and Recovery Point Objective (RPO) metrics defined in

Section 2.7 Service Level Agreement.

C. Perform backups for all application and configuration data that are necessary to restore the application to full operability on suitable hardware. The backup shall consist of at least:

1. Incremental daily backups, retained for one (1) month,

2. Full weekly backups, retained for three (3) months, and

3. Last weekly backup for each month maintained for two (2) years;

4. Maintain one annual backup for at least 10 years;

5. Send the weekly backup electronically to a facility designated by the State;

6. Encrypt the backups using a shared key;

7. Perform a backup recovery at least semi-annually; and

8. Provide on demand support for the State’s recovery of a backup set.

1.5 Service Level Agreement (SLA)

1.5.1 Definitions

A. A “Problem” is defined as any situation or issue or breach or potential breach related to the system operation and is not an enhancement request that is reported to the Contractor. The Contractor shall utilize a tracking system, e.g., help desk ticket system, to track, update, and report the status of all reported problems.

B. “Problem resolution time” is defined as the period of time from when the issue was reported to the

Contractor to when it is resolved to the satisfaction of the State.

C. Monthly Charges: for purposes of SLA credit calculation, Monthly Charges are defined as the charges set forth in Attachment B, Financial Proposal Form, invoiced during the month of the

Problem for the monthly fixed services, or, in the event of annual billing, 1/12 of the annual invoice amount Financial Proposal Form.

1.5.2 SLA Requirements

The Contractor shall:

A. Be responsible for complying with all performance measurements, shall also ensure compliance by all subcontractors.

B. Meet the Problem response time and resolution requirements as defined in Section 1.5.8.

C. Provide a monthly report to monitor and detail response times and resolution times.

D. Log Problems into the Contractor-supplied tracking tool or other help desk software and assign an initial severity level (i.e., Emergency, High, Normal, or Low as defined in

Section 1.5.8)

E. Respond to and update all Problems, including recording when a Problem is resolved and its resolution. Appropriate DDA personnel shall be notified when a problem is resolved.

F. The DDA shall make the final determination regarding Problem severity.

G. The contractor shall review any problem with DDA to establish the remediation plan and relevant target date.

1.5.3 SLA Effective Date (SLA Activation Date)

The SLAs set forth herein shall be in effect beginning with the commencement of monthly services as of the completion of the implementation.

Beginning on the SLA Activation Date, for any performance measurement not met during the monthly reporting period, the SLA credit for that individual measurement shall be applied to the Monthly

Charges.

1.5.4 Service Level Reporting

A. The Contractor performance will be monitored by DDA.

B. The Contractor shall provide summarized SLA performance and detailed monthly reports evidencing the attained level for each SLA. All monthly reports shall highlight any SLA performance criteria that did not meet the compliance requirement designated in the SLA provided in Section 1.5.7. The Contractor shall provide an explanation of why any SLA was not met. For any problems not resolved the Contractor shall provide an explanation of how and when it will be met in the future The Contractor shall provide detailed monthly reports evidencing the attained level for each SLA.

C. The Contractor shall provide a monthly summary report for SLA performance.

D. Monthly reports shall be delivered via e-mail to the Contract Monitor/FMS Program Manager by the 15th of the following month.

E. If any of the performance measurements are not met during the monthly reporting period, the

Contractor shall be notified of the standard that is not in compliance.

1.5.5 SLA Service Credits

A. Beginning on the SLA Activation Date, for any performance measurement not met during the monthly reporting period, the SLA credit for that individual measurement shall be applied to the Monthly Charges.

B. Service credits will be cumulative for each missed service requirement. The State, at its option for amounts due to the State as service credits, may deduct such from any money payable to the Contractor or may bill the Contractor as a separate item. In the event of a catastrophic failure affecting the entire Solution in addition to all other rights and remedies available to the

State, all affected SLAs shall be credited to the State.

Example: If the Monthly Charges were $100,000 and one SLA were missed, with an applicable 4% credit, the credit to the monthly invoice would be $4,000, and the State would pay a net Monthly Charge of $96,000.

C. The parties agree that any assessment of service credits shall be construed and treated by the parties not as imposing a penalty upon the Contractor, but as compensation to the State for the

Contractor’s failure to satisfy its service level obligations.

1.5.6 Root Cause Analysis

The State has the right, at its sole discretion, to direct the Contractor to perform and deliver a root cause analysis in connection with any SLA measurement that yields an SLA credit. Such root cause analysis shall be provided within 30 days of the request.

In addition, for each ‘Emergency’ or ‘High’ priority Problem, the affected parties will perform a root cause analysis and institute a process of problem management to prevent recurrence of the issue.

1.5.5.1 Timely Payment Expectations and Penalties

A. Timely Payment Requirement - The Contractor shall process and disburse payments for all services and goods within the timeframes established in the Service Level Measurements

Table. For the purpose of this Contract, timely payment is defined as the successful disbursement of funds to the employee or provider within the specified number of business days following the receipt of a Proper Invoice or approved timesheet.

B. Impact of non-compliance -The State considers the timely payment of employees and providers to be a critical component of Participant health, safety, and welfare. Failure to meet these payment timelines constitutes a material breach of performance standards.

C. Assessment of Service Credits - In the event that the Contractor fails to meet the payment timelines defined in the Service Level Measurements Table, the State will assess Service

Credits as defined in the SLA Service Credits section of this RFP. These Service Credits are intended to compensate the State for the administrative burden caused by payment delays and the potential risk to Participant services. The State reserves the right to escalate recurring payment failures to the FMS Program Manager for immediate Corrective Action Plan (CAP) requirements, regardless of whether Service Credits have already been assessed.

D. Employee Reimbursement - The Contractor shall be liable for any bank fees, overdraft charges, or financial damages incurred by an employee due to the Contractor’s failure to process payroll in accordance with the established pay schedule. The Contractor shall reimburse such fees directly to the affected employee(s) within ten (10) business days of being notified of the financial damage.

1.5.7 Service Level Measurements Table (System performance)

The Contractor shall comply with the service level measurements in the following table:

No

Service Requirement

Problem Category Users /

Operations

Effected

Measurement SLA expected action time

SLA Credit if below

100% compliance

1 EMERGENCY

response time Users or internal

System functionalities are impaired. To include Claimants and Employers

Response Time for Emergency

Priority

Problems.

< 15 minutes 5% (New)

2 EMERGENCY

resolution time Major portions of the System are inaccessible

Systems or users are unable to work, or to perform some portion of their job.

Resolution

Time for each

Emergency

Priority

Problem

(defined in

2.6.8)

Within 2 hours 5% (New)

3 HIGH response time Users or internal

System functionalities are impaired. To include Claimants and Employers /

Major portions of the System are inaccessible.

Systems or users are unable to work, or to perform some portion of their job.

Response Time for High

Priority

Problems.

< 15 minutes 4%

4 NORMAL response time Affects any user /

Specific non-critical features are not operating as specified.

Systems or users are unable to perform a small portion of their job but are able to complete most tasks.

Response Time for Normal or

Low-Priority

Problems

< 2 hours 4%

5 HIGH resolution time Affects the majority of users to include public facing users

Claimants &

EmployersAffect s high profile users (i.e.

executive management)

Resolution

Time for each

High-Priority

Problem

< 4 hours 4%

6 NORMAL resolution time Affects any user Resolution

Time for

Normal Priority

Problems

< 24 hours 4%

7 LOW resolution time Affects a number of users Resolution

Time for Low-

Priority

Problems

< 72 hours 4%

8 High priority (non-payment) Affects a number of users Resolution

Time for each

High-Priority

Problem related to non-payment of employee.

0-8 hours

(during business hours)

5%

(Increased

Credit)

9 Normal priority (non-payment) Affects any user Resolution

Time for

Normal Priority

Problems related to non-payment of employee.

Within 24 hours

(Tightene d Time)

5%

(Increased

Credit)

10 Low priority (non-payment) Affects a number of users Resolution

Time for Low-

Priority

Problems related to non-payment of employee.

Within 3 working days

(Tightene d Time)

4%

11 Remote assistance

Remote assistance will be provided in-line with the above timescales dependent on the priority of the support request.

See above 4%

12 Scheduled Downtime/

Maintenance Affects any user Scheduled maintenance and downtime shall only occur during non-business hours*. The

Contractor shall provide 14 calendar days' notice prior to any scheduled downtime.

< 6 hours each month

4%

13 Service Availability Affects any user Over the life of the contract, all application functionality and accessibility shall be maintained at

99.5% uptime performance levels. The

Contractor shall minimize or eliminate unscheduled network downtime to

0.5% or less.

same day 4% *must maintain at ≥99.5% complian ce

14 Disaster Recovery Affects any user Contractor shall provide recovery and continuity of operations within 4 hours of a

System/networ k failover in accordance with Section

3.5 Disaster

Recovery and

Data.

4 hours 4%

15 NOTIFICATION of

Security Incident

Notification to the FMS

PROGRAM

MANAGER of a Security

Incident within

20 minutes of occurrence

20 min 4%

16 REPORTING

Security Incident

The Contractor shall provide to the FMS

PROGRAM

MANAGER

the Security incident reporting requirement in

1 hour

(includes preliminary investigation and what the findings were), and in accordance with Section

3.7. Within 72

hours of concluding the full investigation, a findings report must be submitted to the

FMS

PROGRAM

MANAGER.

1 hour 4%

17 Participant

Enrollment Time

(New)

New Participant onboarding and service initiation.

Completion of the Participant enrollment process (See

2.3.5.P)

Within 5

Business

Days

5% (New)

18 Employee

Onboarding/Clearanc e Time (New)

New employee clearance and readiness for payment processing.

Processing of a new employee’s paperwork and notification of hire status (See

2.3.6.6.A.2)

Within 4

Business

Days

5% (New)

19 Customer Service

Escalation Resolution

(New)

Affects

Participants, employees, or providers after initial customer service contact.

Resolution identified by the Contractor within two (2) business days of an initial escalation complaint (See

2.3.1.YY)

Within 2

Business

Days

5% (New)

The State shall have the unilateral right to reallocate percentages among the various SLAs annually on the anniversary of the Contract, provided that such reallocation will not exceed the cap identified in

Section 1.5.5.

1.5.8 Problem Response Definitions and Times

The Contractor shall meet the Problem Response Time and Problem Resolution Time requirements.

Service

Priority Response

Time Resolution

Time Response

Availability Work Outage Users Affected

Emergency Less than minutes

Within 2 hours of first report 24 hours per day, seven days per week

Major portions of the System are inaccessible Systems or users are unable to work, or to perform some portion of their job.

Users or internal

System functionalities are impaired. To include Claimants and Employers

High Less than minutes

Within 4 hours after first report 24 hours per day, seven days per week

Major portions of the System are inaccessible Systems or users are unable to work, or to perform some portion of their job.

Affects the majority of users to include public facing users

Claimants &

Employers Affects high profile users (i.e.

executive management) Normal Within 2 hours Within 1 day

(24 hours) after first report. If the outage is not resolved a resolution plan

Mon-Fri, 7AM-7PM

Specific non-critical features are not operating as specified Systems or users are unable to

Affects a number of users

Service

Priority Response

Time Resolution

Time Response

Availability Work Outage Users Affected must be in place.

perform a small portion of their job but are able to complete most tasks.

Low Within 2 hours Within 3 days

(72 hours) after first report. If the outage is not resolved a resolution plan must be in place.

Mon-Fri, 7AM-7PM

Lower priority features that can be done manually are not operating as specified.

Often a request for service with ample lead time.

Affects a number of users

1.6 Required Project Policies, Guidelines and Methodologies

The Contractor must comply with all applicable laws, regulations, policies, standards and guidelines affecting Information Technology projects, which may be created or changed periodically. These include, but are not limited to:

Reference Regulations, Policies, Guidelines and Methodologies

A The State of Maryland System Development Life Cycle (SDLC) methodology https://doit.maryland.gov/MITDP-Oversight/Pages/SDLC.aspx

B The State of Maryland Information Technology Security Policy and Standards at:

https://doit.maryland.gov/policies/Pages/default.aspx

C The State of Maryland Information Technology Non-Visual Standards at:

https://doit.maryland.gov/policies/Pages/nva.asp

D The State of Maryland Information Technology Project Oversight at:

https://doit.maryland.gov/MITDP-Oversight/Pages/MITDP-oversight.aspx

E

The Contractor shall follow project management methodologies consistent with the most recent edition of the Project Management Institute’s Project Management

Body of Knowledge Guide.

https://doit.maryland.gov/MITDP-Oversight/Pages/SDLC.aspx https://doit.maryland.gov/policies/Pages/default.aspx https://doit.maryland.gov/policies/Pages/nva.asp https://doit.maryland.gov/MITDP-Oversight/Pages/MITDP-oversight.aspx

Reference Regulations, Policies, Guidelines and Methodologies

F

Hardware and Software hardening procedures by Center for Internet Security

(CIS) guides https://www.cisecurity.org/ or Security Requirements Guides (SRG) http://www.nist.gov

G

Federal Information Processing Standards (FIPS), “Security Requirements for

Cryptographic Modules”, FIPS PUB 140-3:

https://csrc.nist.gov/publications/detail/fips/140/3/final https://csrc.nist.gov/Projects/cryptographic-module-validation-program/fips-140-

3-standards

H Purchasing and Recycling Electronic Products https://dgs.maryland.gov/Pages/GreenPurchasing/Resources/Electronics.aspx

1.7 Disaster Recovery and Data

1.7.1 Redundancy, Data Backup and Disaster Recovery

a) Unless specified otherwise, throughout the Contract term, the Contractor shall maintain or cause to be maintained disaster avoidance procedures designed to safeguard State data and other confidential information, Contractor’s processing capability and the availability of hosted services. Any force majeure provisions of the Contract do not limit the Contractor’s obligations under this provision.

b) The Contractor shall have robust contingency and disaster recovery (DR) plans in place to ensure that the services provided under the Contract will be maintained in the event of disruption to the Contractor/subcontractor’s operations (including, but not limited to, disruption to information technology systems), however caused.

1) The Contractor shall furnish a DR site.

2) The DR site shall be at least 100 miles from the primary operations site and have the capacity to take over complete production volume in case the primary site becomes unresponsive.

c) The contingency and DR plans must be designed to ensure that services under the Contract are restored after a disruption within 24 hours from notification, with a recovery point objective of one hour or less prior to the outage in order to avoid unacceptable consequences due to the unavailability of services.

d) The Contractor shall test the contingency/DR plans at least twice annually to identify any changes that need to be made to the plan(s) to ensure a minimum interruption of service.

Coordination shall be made with the State to ensure limited system downtime when testing is conducted. At least one annual test shall include backup media restoration and failover/fallback operations at the DR location. The Contractor shall send the Contract

Monitor a notice of completion following completion of DR testing.

https://www.cisecurity.org/ http://www.nist.gov/ https://csrc.nist.gov/publications/detail/fips/140/3/final https://csrc.nist.gov/Projects/cryptographic-module-validation-program/fips-140-3-standards https://csrc.nist.gov/Projects/cryptographic-module-validation-program/fips-140-3-standards https://dgs.maryland.gov/Pages/GreenPurchasing/Resources/Electronics.aspx

e) Such contingency and DR plans shall be available for the State to inspect and practically test at any reasonable time, and subject to regular updating, revising, and testing throughout the term of the Contract.

1.7.2 Data Export/Import

a) The Contractor shall, at no additional cost or charge to the State, in an industry standard/non-proprietary format:

1) perform a full or partial import/export of State data within 24 hours of a request; or

2) provide to the State the ability to import/export data at will and provide the State with any access and instructions which are needed for the State to import or export data.

b) Any import or export shall be in a secure format per the Security Requirements.

1.7.3 Data Ownership and Access

As set forth in the Contract, data, databases and derived data products created, collected, manipulated, or directly purchased as part of the solicitation are the property of the State. The purchasing State agency is considered the custodian of all State data. The use, access, and distribution of all data shall comply with the requirements of the Data Use Agreement (Attachment Y).

The Contractor may not access State data other than as necessary to perform the services under this

Contract.

The Contractor shall limit access to and use of State data to Contractor Personnel whose responsibilities require such access or use and shall train such Contractor Personnel on the confidentiality obligations set forth herein.

At no time shall any data or processes – that either belong to or are intended for the use of the State or its officers, agents or employees – be copied, disclosed or retained by the Contractor or any party related to the Contractor for subsequent use in any transaction that does not include the State.

The Contractor shall not use any information collected in connection with the services furnished under the Contract for any purpose other than fulfilling such services.

Provisions in Sections 1.8.1 - 1.8.3 shall survive expiration or termination of the Contract.

Additionally, the Contractor shall flow down the provisions of Sections 1.8.1 - 1.8.3 (or the substance thereof) in all subcontracts.

1.10 Security Requirements

The following requirements are applicable to the Contract:

1. Employee Identification

a. Contractor Personnel shall display his or her company ID badge in a visible location at all times while on State premises. Upon request of authorized State personnel, each

Contractor Personnel shall provide more photo identification.

b. Contractor Personnel shall cooperate with State site requirements, including but not limited to, being prepared to be escorted at all times, and providing information for

State badge issuance.

c. Contractor shall remove any Contractor Personnel from working on the Contract where the State determines, in its sole discretion, that Contractor Personnel has not adhered to the Security requirements specified herein.

d. The State reserves the right to request that the Contractor submit proof of employment authorization of non-United States Citizens, prior to commencement of work under the

Contract.

2. Security Clearance / Criminal Background Check

The State reserves the right to refuse any individual Contractor Personnel to work on State premises, based upon certain specified criminal convictions, as specified by the State.

A. A criminal background check for each for any Contractor Personnel providing

Contract services shall be completed prior to each Contractor Personnel providing any services under the Contract within four (4) months of Contract award.

B. The Contractor shall obtain at its own expense a Criminal Justice Information System

(CJIS) State and federal criminal background check, including fingerprinting, for all

Contractor Personnel. This check may be performed by a public or private entity.

C. The Contractor shall provide the Contract Monitor with certification of completion of the required criminal background check described in this RFP for each required

Contractor Personnel prior to assignment, and that the Contractor Personnel have successfully passed this check.

D. Persons with a criminal record may not perform services under the Contract unless prior written approval is obtained from the Contract Monitor. The Contract Monitor reserves the right to reject any individual based upon the results of the background check. Decisions of the Contract Monitor as to acceptability of a candidate are final.

E. A particular on-site location covered by the Contract may require more restrictive conditions regarding the nature of prior criminal convictions that would result in

Contractor Personnel not being permitted to work on those premises. Upon receipt of a location’s more restrictive conditions regarding criminal convictions, the Contractor shall provide an updated certification regarding the Contractor Personnel working at or assigned to those premises.

3. On-Site Security Requirement(s)

A. For the conditions noted below, Contractor Personnel may be barred from entrance or leaving any site until such time that the State’s conditions and queries are satisfied.

B. Contractor Personnel may be subject to random security checks when entering and leaving State secured areas. The State reserves the right to require Contractor

Personnel to be accompanied while on secured premises.

C. Further, Contractor Personnel shall not violate Md. Code Ann., Criminal Law Art.

Section 9-410 through 9-417 and such other security policies of the agency that control the facility to which the Contractor Personnel seeks access. The failure of any of the

Contractor Personnel to comply with any provision of the Contract is sufficient grounds for the State to immediately terminate the Contract for default.

1.10.1. Information Technology Security

A. Contractors shall comply with and adhere to the State IT Security Manual, Policies and Standards. These policies may be revised from time to time, and the Contractor shall comply with all such revisions. Updated and revised versions of the State IT

Policy and Standards are available online at: Policies, Standards, and Guidelines.

B. The Contractor shall not connect any of its own equipment to a State LAN/WAN without prior written approval by the State as directed and coordinated with the

Contract Monitor.

The Contractor shall:

1) For IT Security Policies and Standards that are no covered by the State IT Security

Manual, the Contract shall Implement administrative, physical, and technical safeguards to protect State data that are no less rigorous than accepted industry best practices for information security such as those listed below (see Section 1.6.5)

2) Ensure that all such safeguards, including the manner in which State data is collected, accessed, used, stored, processed, disposed of and disclosed, comply with applicable data protection and privacy laws as well as the terms and conditions of the Contract;

and

3) Ensure compliance with all applicable federal, State, and local laws, rules and regulations concerning security of Information Systems and Information Technology.

A. Contractor shall ensure a secure environment for all State data and any hardware and software (including but not limited to servers, network and data components) provided or used in connection with the performance of the Contract according to a written security policy (“Security Plan”) no less rigorous than that of the State and using best practices that comply with an accepted industry standard, such as the NIST cybersecurity framework.

1) The Security Plan shall detail the steps and processes employed by the Contractor as well as the features and characteristics which will ensure compliance with the security requirements of the Contract. Such Security Plan shall be provided to the

State for its review with solicitation response. If awarded a contract, the Security

Plan shall be provided on an annual basis or whenever updates are made.

2) The Contractor shall supply a copy of such policy to the State for validation, with any appropriate updates, on an annual basis.

https://doit.maryland.gov/policies/Pages/default.aspx

3) If any Security Plan information, including procedures, are different based on a

Task Order, Contractor shall furnish such differences to the respective TO

Manager.

B. To ensure appropriate data protection safeguards are in place, the Contractor shall implement and maintain the following controls during the Contract Term (the Contractor may augment this list with additional controls):

1) Establish separate production, test, and training environments for systems supporting the services provided under the Contract and ensure that production data is not utilized in test or training environment(s).

2) Apply hardware and software hardening procedures as recommended by Center for Internet Security (CIS) guides, Security Technical Implementation Guides

(STIG), or similar industry best practices to reduce the systems’ surface of vulnerability, eliminating as many security risks as possible and documenting what is not feasible or not performed according to best practices. Any hardening practices not implemented shall be documented with a plan of action and milestones including any compensating control. These procedures may include but are not limited to removal of unnecessary software, disabling or removing unnecessary services, removal of unnecessary usernames or logins, and the deactivation of unneeded features in the Contractor’s system configuration files.

3) Ensure that State data is not commingled with non-State data through the proper application of compartmentalization Security Measures.

4) Apply data encryption to protect Sensitive Data at all times, including in transit, at rest, and also when archived for backup purposes. Unless otherwise directed, the Contractor is responsible for the encryption of all Sensitive Data.

5) Apply data encryption to all Contractor managed or controlled State data when the data is in transit over untrusted network segments.

6) Utilize encryption algorithms for encrypting data that comply with current

Federal Information Processing Standards (FIPS), “Security Requirements for

Cryptographic Modules.”

7) Enable appropriate logging parameters to monitor user access activities, authorized and failed access attempts, system exceptions, and critical information security events as recommended by the operating system and application manufacturers and information security standards, including the

Maryland Department of Information Technology’s Information Security

Manual.

8) Retain the aforementioned logs and review them at least daily to identify suspicious or questionable activity for investigation and documentation as to their cause and remediation, if required. The State shall have the right to inspect the logs and the Contractor or subcontractor’s performance to confirm the effectiveness of these measures for the services being provided under the

Contract.

9) Ensure system and network environments are separated by properly configured and updated layer seven firewalls.

10) Restrict network connections between trusted and untrusted networks by physically or logically isolating systems from unsolicited and unauthenticated network traffic.

11) By default, “deny all” and only allow access by exception.

12) Review, at least annually and after changes, the aforementioned network connections, documenting and confirming the business justification for the use of all service, protocols, and ports allowed, including the rationale or compensating controls implemented for those protocols considered insecure but necessary.

13) Perform regular internal and external vulnerability testing of operating system, applications, and all network devices utilized in this Contract. Such testing is expected to identify outdated software versions; missing software patches;

device or software misconfigurations; and to validate compliance with or deviations from the security policies applicable to the Contract. Contractor shall evaluate all identified vulnerabilities for potential adverse effect on security and integrity and remediate the vulnerability no later than 30 days following the earlier of vulnerability’s identification or public disclosure, or document why remediation action is unnecessary or unsuitable. The State shall have the right to conduct vulnerability testing and inspect the results of similar Contractor performed vulnerability testing to confirm the effectiveness of these measures for the services being provided under the Contract.

14) Enforce strong user authentication and password control measures to minimize the opportunity for unauthorized access through compromise of the user access controls. At a minimum, the implemented measures should be consistent with the most current Maryland Department of Information Technology’s Information

Security Policies,…