Document ID: RFP 415 2700000032 Page: 1

Commonwealth of Kentucky

SOLICITATION

Modification: No Version #:

TITLE: GEAR UP Ky- SAT Platform

Date Issued:

10/01/2026 Record Date:

09/20/2026

Solicitation Closes Date:

10/30/2026 Time:

13:00

Solicitation No:

RFP 415 2700000032

Online Bidding Prohibited: No

For Information Call:

Ashley Smither 502-892-3059

Bid Receiving Location:

Council on Postsecondary Education Kara Couch 100 Airport Road, 2nd Floor

Frankfort KY 40601

Vendor Customer Number:

Vendor Name:

Phone Number:

Fax Number:

Email Address:

Ordering

Address:

City, State, Zip:

Contact Name:

Contact Email:

Contact Phone Number:

Payment

Address:

City, State, Zip:

Contact Name:

Contact Email:

Contact Phone Number:

Ownership Type

__ Sole Proprietorship __ Partnership __ Corporation __ Other_________________________

SIGNATURE OF AUTHORIZED AGENT IS REQUIRED UNLESS RESPONSE

IS SUBMITTED ELECTRONICALLY. FAILURE TO SIGN SHALL RENDER

THE BID INVALID.

Signature X_________________________________________ FEIN#____________________ Date____________

All offers subject to all terms and conditions contained in this solicitation.

Document ID: RFP 415 2700000032 Page: 2

Line Items

Commodity Group: Default

Line CL Description Quantity UOM Unit Cost Line Total or Contract Amnt

1 GEAR UP Ky- SAT Platform

Comm Code Comm Description Manufacturer Model # Manuf Part #

924 EDUCATIONAL/TRAINING SERVICES

Extended Description GUK is seeking a partner to provide a platform for SAT preparation and remediation, practice SAT testing, projected SAT scores, teacher professional development, and data collection for middle and high school students in its eight partner school districts in Kentucky, including the software platform and the trained professionals to provide in-person training opportunities for teachers and students in the upcoming 2026-27 school year. Per the GEAR UP Kentucky (GUK) federally approved grant proposal, GUK will provide these services for 7th grade students in nine participating middle schools (approximately 1250 students) and 11th grade students in 8 participating high schools (approximately 1250 students) and their associated teachers and school administrators.

Shipping Information Council on Postsecondary Education

100 Airport Road, 2nd Floor

Frankfort KY 40601

Billing Information Council on Postsecondary Education

100 Airport Road, 2nd Floor

Frankfort KY 40601

Document ID: RFP 415 2700000032 Page: 3

Submission Checklist

The following items will be required to be submitted with bid:

Item Transmittal Letter Certificate of Authority-Registration with Secretary of State by a Foreign Required Affidavit(s) Proposed Technical Solution. Submit electronically by Closing Date & Time.

Proposed Cost Solution. Submit electronically by Closing Date & Time.

Oral Presentation if required

Revised February 2026

PROPOSAL SUBMISSION CHECKLIST

The vendor MUST include the following with the proposal submission.

If the items highlighted below are not submitted with the proposal submission, the Commonwealth MUST deem the proposal non-responsive and

SHALL NOT consider for award.

All other items MUST be submitted prior to award.

_____ SIGNED AND COMPLETED SOLICITATION –Section(s) 8.00 and 8.10 of this RFP

(not required if submitting electronically)

_____ *PROPOSED SOLUTION (TECHNICAL) UNDER SEALED COVER AND BY

CLOSING DATE --Section(s) 8.00 and 8.10 of this RFP

_____ *PROPOSED SOLUTION (COST) UNDER SEALED COVER AND BY CLOSING

DATE -- Section(s) 8.00 and 8.10 of this RFP

_____ TRANSMITTAL LETTER – Section 8.20 of this RFP

_____ PROOF OF REGISTRATION WITH SECRETARY OF STATE BY A FOREIGN

ENTITY -- Section 8.00 of the Personal Service Contract Terms and Conditions of this

RFP

_____ REQUIRED AFFIDAVIT(S) – Section 8.20 of this RFP

*The Commonwealth defines SEALED as “a closure that must be broken to be opened and that thus reveals tampering” (Merriam-Webster Dictionary, https://www.merriam-webster.com/ dictionary/seal

REQUEST FOR PROPOSAL

FOR

PERSONAL SERVICE CONTRACT

Kentucky Council on Postsecondary Education GEAR UP KY SAT Platform

Document Phase Document Description Page 4

2700000032 Final GEAR UP Ky- SAT Platform Total Pages: 43 https://www.merriam-webster.com/dictionary/seal https://www.merriam-webster.com/dictionary/seal

This document constitutes a Request for Proposals for a Personal Service Contract from qualified individuals and organizations to furnish those services as described herein for the Commonwealth of Kentucky, Council on Postsecondary Education (CPE) and its GEAR UP Kentucky Program.

Offerors are advised that any personal service contract resulting from this RFP must comply with all applicable provisions of KRS 45A and KRS 12.210 prior to becoming effective.

A contract, based on this RFP, may or may not be awarded. Any contract award from this RFP is invalid until properly approved and executed by the Finance and Administration Cabinet and filed with the Legislative Research Commission, Government Contract Review Committee.

1.00 Purpose and Background

In 2025, the Council on Postsecondary Education was awarded a seven-year GEAR UP state grant by the U.S. Department of Education to help Kentucky students in low-income communities prepare for and successfully transition to and through postsecondary education after high school.

Through the GEAR UP Kentucky (GUK) grant, over 10,000 students across 8 school districts are provided a range of services related to postsecondary preparation, including academic supports to increase college readiness numbers.

The Commonwealth of Kentucky administers a standardized college readiness assessment to all high school juniors each year. In the 2025-26 school year, the SAT assessment was administered.

However, the Kentucky Department of Education is currently soliciting proposals for a vendor to provide this assessment in spring of the 2026-27 school year and it is yet to be determined if the assessment will be the SAT or the ACT assessment. The outcome of that vendor selection will determine if GUK provides the requested platform and training for the SAT or the ACT assessment.

Vendors are asked to address their capacity to support both the SAT and ACT assessments via the platform and training described in this proposal. For purposes of this RFP, responses should be submitted as if the SAT will be offered. However, each vendor responding to this RFP must certify that, should an alternative testing platform be selected by the Kentucky Department of Education, they will work with CPE to implement a platform that will conform to ACT testing guidelines noting any implementation deviations should ACT be chosen instead of the current SAT testing platform.”

In addition to SAT scores being utilized across the state for college admission, assessment results are used as a determinant for scholarship awards and postsecondary readiness indicators. In order to ensure students and teachers with the most current resources regarding SAT preparation, GUK recognizes a need for a software platform that provides practice assessments and test preparation tools for students, as well as professional development for teachers beyond the scope of employed GUK staff.

2.00 Scope of Work

GUK is seeking a partner to provide a platform for SAT preparation and remediation, practice SAT testing, projected SAT scores, teacher professional development, and data collection for middle and high school students in its eight partner school districts in Kentucky, including the software platform and the trained professionals to provide in-person training opportunities

Document Phase Document Description Page 5

2700000032 Final GEAR UP Ky- SAT Platform Total Pages: 43 for teachers and students.. Per the GEAR UP Kentucky (GUK) federally approved grant proposal, GUK will provide these services for participating GUK students in nine participating middle schools (approximately 1250 students) and 11th grade students in 8 participating high schools (approximately 1250 students) and their associated teachers and school administrators.

GUK seeks a vendor who can provide the following:

User-friendly platform to facilitate student assessment and remediation that provides:

1. SAT-aligned practice tests and quizzes for students that result in projected SAT scores.

2. Individualized and group remediation tools for students to improve scores to meet established college readiness benchmarks including, but not limited to:

a. Individualized online remediation practice tools for students (e.g. quizzes, videos, mini lessons, etc) with content recommended to individual students based on missed questions and learning gaps.

b. Instructional tools for teachers such as question banks, sample lesson plans and bell ringers aligned to SAT content areas.

3. Secure data collection on individual and group scores; trackable data analytics that allow teachers to see individual students’ improvement over time.

4. Data dashboards that allow teachers and school administrators to analyze student results across classrooms and grade levels to inform targeted student remediation and classroom instruction.

5. Data and exportable reports aligned to GUK federally required reporting metrics to include at a minimum:

a. Individual student practice assessment participation and performance data available by school and grade level including date and duration of participation.

b. Individual student remediation participation data available by school and grade level including date and duration of participation.

c. Individual student participation in student SAT boot camps by school including date and duration of participation.

d. Individual staff participation in virtual platform training and teacher professional development workshops by school including date and duration.

e. Data on usage of platform by school personnel.

Virtual platform training for school staff and GUK program staff to become familiar with how to use all aspects of the platform.

Design and delivery of professional development workshops for middle and high school teachers focused on using student assessment and remediation data available in the platform to target student remediation and classroom instruction to address student learning gaps. Workshops are to be delivered in-person in each of the eight districts by vendor.

Design and delivery of in-person SAT boot camps to all 11th grade students in all 8 GUK high schools to teach test-taking strategies and help students understand test content, structure and college readiness standards.

The selected partner will:

Document Phase Document Description Page 6

1. Provide access to the platform for all participating GUK students, school staff and program staff in participating middle and high schools (16 total schools).

2. Provide agenda for virtual platform orientation and training to GUK staff for feedback prior to training delivery; work with GUK staff to schedule at least three trainings to be offered to participating schools to allow for maximum participation.

3. Provide curricula for teacher professional development workshops to GUK staff for feedback prior to workshop delivery.

4. Provide curricula for student SAT boot camps to GUK staff for feedback prior to workshop delivery and work with individual high schools to schedule workshops.

4. Provide GUK staff and school personnel access to real-time data dashboards and exportable reports outlining assessment participation, performance and remediation tools utilized

5. Allow GUK staff administrator access to the provided platform to view and export all student scores and records for all participating schools (program-wide reports for all schools in addition to individual school reports).

6. Provide in-kind match to GUK as required by all statewide grant partners; GUK is a 100% cost-sharing grant and must match all federal grant funds on a 1:1 basis. Matching contributions may be in the form of in-kind contributions such as professional development costs discounted for GUK from market rate, in-kind staff time or travel, additional student or teacher materials or platform add-on tools provided at no or reduced cost, or other expenses that directly and exclusively support services provided under this Agreement for the GEAR UP Kentucky program. Specific amount for cost-sharing should be specified in the cost proposal provided by the vendor. Documentation of matching contributions will be submitted by September 30 each year using GUK-provided templates. All proposals are asked to provide a minimum of 50% match.

Timeline:

2026-27 Implementation Timeline

1. Because the Kentucky Department of Education has not yet finalized the vendor and college readiness assessment that will be administered statewide to 11th-grade students beginning in the 2026-27 school year, the implementation timeline for this project is currently unknown. The selected vendor should be prepared to work collaboratively with GUK to establish an implementation schedule following KDE's final assessment decision. Proposed timelines included elsewhere in this RFP represent anticipated targets only and may be adjusted based on the statewide assessment selection and implementation timeline. For purposes of this RFP, all implementation activities are described assuming continued statewide administration of the SAT, consistent with the assumptions outlined in Section 1.00. Should KDE select an alternative assessment, the selected vendor will work collaboratively with GUK to modify implementation accordingly.

2. The selected vendor shall begin implementation and platform integration following execution of the contract and upon notification from GUK that the statewide assessment decision has been finalized.

3. Specific implementation milestones, including platform deployment, virtual platform training, teacher professional development workshops and student SAT boot camps, will be established collaboratively between GUK and the selected vendor.

4. Vendors should demonstrate the capacity to implement services within an expedited timeline should the statewide assessment decision be delayed.

Standard Annual Implementation Timeline (Subsequent School Years)

Document Phase Document Description Page 7

5. Beginning with the first full implementation year following the statewide assessment decision, GUK anticipates the following annual implementation cycle:

6. The SAT assessment and remediation platform shall be fully operational and available to participating students, teachers and GUK staff at the beginning of each school year and remain accessible throughout the school year.

7. Virtual platform orientation and training for participating school staff and GUK staff shall be completed during August and September of each school year.

8. In-person SAT boot camps for participating 11th-grade students shall be delivered locally in each participating high school between September and February. Workshops shall be scheduled collaboratively with individual high schools and completed no later than March 1 to support student preparation prior to the statewide SAT administration.

9. Teacher professional development workshops shall be delivered throughout the school year and completed no later than the end of each school year.

3.00 Evaluation Criteria

The CPE shall conduct a comprehensive, fair, and impartial evaluation of all proposals. The CPE may reject any proposal that is incomplete or in which there are significant inconsistencies or inaccuracies. The CPE reserves the right to reject all proposals.

The CPE has established a Proposal Evaluation Committee to review, evaluate and verify information submitted by the offeror.

Each vendor is responsible for submitting all relevant, factual and correct information with their offer to enable the evaluator(s) to afford each vendor the maximum score based on the available data submitted by the vendor.

The CPE shall evaluate the proposals by assigning scores as indicated.

Technical Proposal Evaluation

Criteria Maximum Points Possible Mandatory Requirement

Requirements that include the words “Shall”, “Will”, “Must” indicate a mandatory requirement

Mandatory Requirement means a condition set out in the specifications or statement of work that must be met without exception.

PROPOSALS THAT DO NOT MEET

MANDATORY REQUIREMENTS WILL BE

DEEMED NON-RESPONSIVE AND WILL

NOT BE CONSIDERED.

Vendor shall include Transmittal Letter with statements, Certificate of Authority Registration with Secretary of State, Required Affidavits.

Vendor must include a statement in the Transmittal Letter certifying that should an alternative testing platform be selected by the Kentucky Department

Pass/Fail

Document Phase Document Description Page 8 of Education, they will work with CPE to implement a platform that will conform to ACT testing guidelines, noting any implementation deviations should ACT be chosen instead of the current SAT testing platform User-friendly software platform: Describe in detail the software platform including how it works from both the student participant, teacher, and GUK staff user experiences. Include descriptions of student practice assessments, individualized remediation tools, and teaching resources and explain how users access technical support related to platform use questions or performance issues. Platform must meet all requirements listed under section 2, scope of work. Describe how vendor will work with schools to onboard users and local data into the platform. (Max of 200 points)

Data analytics and reporting: Describe in detail available data analytics and reports within the platform, how data reports can be exported from the system, and how data will be kept secure and FERPA compliant, including use of multi-factor authentication requirements for data access by users. (Max of 200 points)

Professional development and training:

Describe the curricula for the in-person professional development that will be provided to teachers, as well as any virtual professional development resources that will be made available to participating district staff. (Max of 125 points)

Student SAT preparation workshops: Describe capacity to provide in-person student SAT boot camps including any workshop materials that will be provided to student participants, how the respondent will work with GUK staff to provide input on workshop curricula and how in-person student SAT bootcamps will be coordinated across the eight GUK school districts and participation data will be collected and provided back to CPE.

(Max of 125 points)

Program implementation timeline and organizational capacity: Describe ability and organizational capacity to successfully implement all components of the Scope of Work within the

Document Phase Document Description Page 9 required timeline. The proposal should include an implementation plan outlining key milestones, staffing resources, onboarding processes for participating schools, platform deployment, training delivery, professional development workshops, student boot camps, and ongoing support. Vendors should also describe experience implementing similar projects at comparable scale, project management structures, contingency plans to address delays or challenges, and evidence of sufficient and experienced staffing and operational capacity to ensure all services are delivered on schedule across all participating districts. (Max of 75 points) Experience and evidence of impact: List all relative experience, including any history of working with GEAR UP or other college access and success programs and/or Kentucky schools.

Include detail description of data that demonstrates previous success/impact on student postsecondary readiness/college admission benchmark scores.

(Max of 75 points)

Maximum Points Possible 800

Cost Proposal Evaluation

Proposed Cost – Must be submitted separately and on the required cost proposal form. Attachment A.

Vendor should include a per-participant cost where possible.

Proposed Cost Sharing - Must include vendor commitment to provide cost sharing as described in section 2 scope of work, including a proposed amount of cost sharing and the nature of the contributions.

Maximum Points Possible 200

Oral Demonstration/Presentation Evaluation, if required

Document Phase Document Description Page 10

Oral Demonstration/Presentation

The Commonwealth reserves the right to require Oral Presentations/Demonstrations to verify or expand on the Technical or Cost Proposals. Oral Presentations/Demonstrations may be conducted through videoconferencing or by conference call, if it is in the best interest of the Commonwealth to do so.

This is the opportunity for the vendor to present and demonstrate the solution and to answer questions or to clarify the understanding of the evaluation committee in accordance with the requirements of this RFP. The Commonwealth reserves the right to reject any or all proposals in whole or in part based on the oral presentations/demonstrations.

If required, the top 2 highest ranking vendors may be invited. Scheduling will be at the discretion of the Commonwealth. The Commonwealth reserves the right not to require oral presentations/demonstrations

Maximum Points Possible 100

Total Proposal Evaluation

Technical Proposal 800

Cost Proposal 200

Oral Demonstrations/Presentations, if required 100

MAXIMUM POINTS POSSIBLE

1,100

4.00 Schedule of RFP Activities

The following schedule presents the major activities associated with the RFP distribution, written questions and proposal submission. The Commonwealth reserves the right at its sole discretion to change the Schedule of Activities, including the associated dates and times.

Release of RFP Thursday, October 1, 2026

Written Questions due by: Thursday, October 15, 2026

Anticipated Commonwealth Response to Written Questions Thursday, October 22, 2026

Offeror’s Conference None

Anticipated Commonwealth Response to Vendor Conference Written Questions

None

Document Phase Document Description Page 11

Proposals Due by: 1pm EST Friday, October 30, 2026

*NOTE: ALL TIME REFERENCES ARE TO THE EASTERN TIME ZONE.

section 4 – Commonwealth office of technology (cot) requirements

4.1 Hosting

The Commonwealth is seeking a vendor who can provide a solution per the RFP requirements. The Vendor can use servers stood up by COT to house the solution or the vendor may propose a cloud-hosted solution. If the vendor is proposing a cloud solution, the Commonwealth prefers the proposed cloud solution to be hosted on an established Commonwealth Office of Technology (COT) managed cloud tenant. If a COT managed cloud tenant is not proposed, the vendor shall propose a commercial Federal Risk and Authorization Management Program (FedRAMP) - certified or HITRUST/HIPAA Cloud platforms. The proposed solution must accommodate COT oversight that includes an isolated tenant, cloud network access (peering connection) and monitoring solutions.

The Commonwealth reserves the right to host any proposed solution, at any time, if deemed in the best interest of the Commonwealth.

If vendor is using any type of Artificial Intelligence (AI) please indicate this in the RFP response.

Vendor shall comply with Section 10.31 regarding Artificial Intelligence

4.2 Commonwealth Information Technology Policies and Standards A. The vendor and any subcontractors shall be required to adhere to applicable

Commonwealth policies and standards.

B. The Commonwealth posts changes to COT Standards and Policies on its Commonwealth Office of Technology - Home - Commonwealth Office of Technology (Kentucky) website. Vendors and subcontractors shall ensure their solution(s) shall work in concert with all posted changes. Vendors or subcontractors that cannot comply with changes must, within thirty (30) days of the posted change, request written relief with the justification for such relief. The Commonwealth may: 1) deny the request, 2) approve an exception to the policy/standard, or 3) consider scope changes to the contract to accommodate required changes. Vendors or subcontractors that do not provide the response within the thirty (30) day period shall be required to comply within ninety (90) days of the change.

Document Phase Document Description Page 12 https://technology.ky.gov/Pages/index.aspx https://technology.ky.gov/Pages/index.aspx

4.3 Compliance with Kentucky Information Technology Standards (KITS) A. The Kentucky Information Technology Standards (KITS) reflect a set of principles for information, technology, applications, and organization. These standards provide guidelines, policies, directional statements and sets of standards for information technology. It defines, for the Commonwealth, functional and information needs so that technology choices can be made based on business objectives and service delivery. The vendor shall stay knowledgeable and shall provide a solution that works in concert with these standards for all related work resulting from this RFP.

https://technology.ky.gov/about-the-agency/Pages/kits.aspx

B. The vendor and any subcontractors may be required to submit a technology roadmap for any offered solution. Additional roadmaps will be submitted upon request of the Commonwealth. If required, the roadmap shall include, but is not limited to, planned, scheduled and projected product lifecycle dates and historical release/patch or maintenance dates for the technology. In addition, any guidance on projected release/revision/patch/maintenance schedules would be preferred.

4.4 Compliance with Industry Accepted Reporting Standards Based on Trust Service Principles and Criteria The vendor must employ comprehensive risk and threat management controls based on defined industry standards for service organizations such as ISO AICPA TSP section 100, Trust Services Principles and Criteria. The vendor must annually assert compliance and engage a third-party certification registrar to examine such assertions and controls to provide a Report, such as ISO 9000, ISO 14001, AT101 SOC 2 type 2, on Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, and Privacy, which contains an opinion on whether the operating controls effectively support the assertions. All such reports, including publicly available reports (i.e. AT 101 SOC 3) shall be made available to the Commonwealth for review.

4.5 System Vulnerability and Security Assessments

The Commonwealth reserves the right to conduct, in collaboration with the vendor, non-invasive vulnerability and security assessments of the software and infrastructure used to provide services prior to implementation and periodically thereafter. Upon completion of these assessments, the Commonwealth will communicate any findings to the vendor for action. Any cost relating to the alleviation of the findings will be the responsibility of the vendor. Mitigations will be subject to re-evaluation after completion. In cases where direct mitigation cannot be achieved, the vendor shall communicate this and work closely with the Commonwealth to identify acceptable compensating controls that will reduce risk to an acceptable and agreed upon level. An accredited third-party source may be selected by the vendor to address findings, provided they will acknowledge all cost and provide valid documentation of mitigation strategies in an agreed upon timeframe.

4.6 Privacy Assessments

The Commonwealth reserves the right to conduct privacy assessments of the collection, use, maintenance and sharing of Commonwealth data by any vendor services, software, and infrastructure used to provide services prior to implementation and periodically

Document Phase Document Description Page 13 https://technology.ky.gov/about-the-agency/Pages/kits.aspx thereafter. Upon completion of this assessment, the Commonwealth will communicate any findings to the vendor for action. Any cost relating to the alleviation of the findings will be the responsibility of the vendor. Mitigations will be subject to re-evaluation after completion. In cases where direct mitigation cannot be achieved, the vendor shall communicate this and work closely with the Commonwealth to identify acceptable compensating controls or privacy practices that will reduce risk to an acceptable and agreed upon level. An accredited third-party source may be selected by the vendor to address findings, provided they will acknowledge all cost and provide valid documentation of mitigation strategies in an agreed upon timeframe.

4.7 Privacy, Confidentiality and Ownership of Information

The Commonwealth is the designated owner of all Commonwealth data and shall approve all access to that data. The vendor shall not have ownership of Commonwealth data at any time. The vendor shall not profit from or share Commonwealth data.

The vendor shall be in compliance with privacy policies established by governmental agencies or by state or federal law. Privacy notice statements may be developed and amended from time to time by the Commonwealth and will be appropriately displayed on the Commonwealth portal (Ky.gov). The vendor should provide sufficient security to protect the Commonwealth and COT data in network transit, storage, and cache.

All Commonwealth data, including backups and archives, must be maintained at all times within the contiguous United States. All Commonwealth data, classified as sensitive or higher, as defined in Enterprise Standards, must be encrypted in-transit from vendor’s network and at rest while stored on vendor’s laptops or other portable media devices.

4.8 EU GDPR Compliance

The Commonwealth of Kentucky requires all vendor contracts to comply to the extent applicable with the European Union’s General Data Privacy Regulation [Regulation (EU) 2016/679] (the “GDPR”) when the Commonwealth is a “controller” or “processor” of “personal data” from an individual “data subject” located in the European Union, as those terms are defined in the GDPR. The vendor acknowledges and agrees that it is acting as a “processor” of “personal data” for the Commonwealth under this Agreement and that all applicable requirements of the GDPR are incorporated by reference as material terms of this Agreement. The vendor represents and warrants that (1) it is aware of and understands its compliance obligations as a “processor” under GDPR; (2) it has adopted a GDPR compliant data privacy compliance policy/program, a summary of which has been provided to the Commonwealth; (3) it will process “personal data” only in accordance with the Commonwealth’s instructions; and (4) with regard to its obligations under this Agreement, it shall comply with all applicable requirements of the GDPR. Additionally, the vendor may be found liable to the Commonwealth for damages arising from any violation of applicable requirements of GDPR by the vendor in its performance of the services hereunder.

4.9 Data Quality

Document Phase Document Description Page 14

The vendor shall provide proposed levels of data quality per the following dimensions.

Data Quality is the degree to which data is valid, accurate, complete, unique, timely, consistent with all requirements and business rules, and relevant for a given use. The vendor shall provide data quality definitions and metrics for any data elements. Data has to be of the appropriate quality to address the needs of the Commonwealth of Kentucky.

The following dimensions can be used to assess data quality:

# Validity – The data values are in an acceptable format.

# Accuracy – The data attribute is accurate.

# Completeness – There are no null values in a data field.

# Uniqueness – There are no duplicate values in a data field.

# Timeliness – The data attribute represents information that is not out-of-date.

# Consistency – The data attribute is consistent with a business rule that may be based on that attribute itself, or on multiple attributes.

# Adherence to business rules – The data attribute or a combination of data attributes adheres to specified business rules.

4.10License Agreements Any proposed software agreements, i.e. license agreement, subscription agreement, end-user license agreement, etc. shall include the following language, or similar, and must be submitted to the Commonwealth Office of Technology (COT) for review and approval prior to the award of the contract:

“Governing Law shall be the Commonwealth of Kentucky, Franklin County. All terms of the vendor/subvendor agreement/EULA shall be read as applicable only to the extent permitted by Kentucky law and no term in violation of the Kentucky law, inclusive of Kentucky Procurement Law, shall be given effect.”

Any third-party software licenses and cloud resources necessary for the proposed solution may be procured via the Commonwealth’s existing contracts.

4.11Software Version Requirements All commercially supported and Commonwealth approved software components such as Operating system (OS), Database software, Application software, Web Server software, Middle Tier software, and other ancillary software must be kept current. In the event that a patch interferes with the solution, the vendor must present a plan for compliance to the Commonwealth outlining the constraints and an appropriate plan of action to bring the solution in to compliance to allow this patch to be applied in the shortest timeframe possible, not to exceed three (3) months, unless otherwise negotiated with the Commonwealth.

4.12No Surreptitious Code Warranty

Document Phase Document Description Page 15

The vendor represents and warrants that no copy of licensed software provided to the Commonwealth contains or will contain any Self-Help Code or any Unauthorized Code as defined below. This warranty is referred to in this contract as the "No Surreptitious Code Warranty”.

As used in this contract, "Self-Help Code" means any back door, time bomb, drop-dead device, or other software routine designed to disable a computer program automatically with the passage of time or under the positive control of a person other than the licensee of the software. Self-Help Code does not include Software routines in a computer program, if any, designed to permit an owner of the computer program (or other person acting by authority of the owner) to obtain access to a licensee's computer system(s) (e.g.

remote access) for purposes of maintenance or technical support.

As used in this contract, "Unauthorized Code" means any malware designed to permit unauthorized access to disable, erase, or otherwise harm software, equipment, or data; or to perform any other such actions. The term Unauthorized Code does not include Self- Help Code.

In addition, vendor will use up-to-date commercial virus detection software to detect and remove any viruses from any software prior to delivering it to the Commonwealth.

The vendor shall defend the Commonwealth against any claim and indemnify the Commonwealth against any loss or expense arising out of any breach of the No Surreptitious Code Warranty.

4.13Network Connection Requirements A. Vendor shall work with COT to establish any network connections. If a secure site-to-site connection is required, the vendor shall employ a secure site-to-site connection procured by the Agency from COT.

B. Vendor shall, at COT’s discretion, provide appropriate access to enable the Commonwealth to perform additional security measures, such as decryption of the network traffic if required for inspection. If the proposed solution does not have the ability to meet this requirement, the vendor must provide an alternative such as audit reporting of this function.

C. Vendor should provide notifications to the Commonwealth Service Desk for unplanned outages within fifteen (15) minutes.

D. Vendor shall notify COT Change Management, through the Commonwealth Services Desk, a minimum of two (2) business days prior to any planned outage.

Document Phase Document Description Page 16

E. Vendor, in conjunction with the agency, shall provide a Business Impact Assessment (BIA) to appropriately classify all data before production/go-live.

F. Vendor shall include a Web Application Firewall when application houses any data classified as sensitive or higher as defined in KITS standards.

G. Vendor shall provide Recovery Time Objective (RTO) and Recovery Point Objective (RPO) services. Vendor shall provide those services to achieve those SLAs.

4.14OS Requirements A. Non-On Prem Solutions

1. No Commonwealth data shall be co-mingled with another entity, without the prior approval of the Commonwealth.

2. Vendor shall provide a solution to move data to the Commonwealth, if required by the Commonwealth.

a. At the end of the contract, the vendor shall provide all agency data in a useable standard data format (such as asci, csv, etc.) that can be converted to a subsequent system. The vendor shall cooperate to this end with the agency and/or a vendor of the agency’s choice, in a timely and efficient manner.

b. Vendor shall address the destruction of Commonwealth data as defined in CIO-092 and provide a certification of the complete and permanent deletion the Commonwealth data.

B. Infrastructure as a Service

1. Vendor shall work with the agency and COT to establish all administrative personnel engagements.

2. Vendor shall meet certification requirements for classification of data being stored.

3. Vendor shall, at COT’s request, provide appropriate access to enable the

Commonwealth to perform additional security measures in compliance with Commonwealth Enterprise Policies, Standards, and/or any Federal or State requirements.

4. Vendor shall provide an Exit Strategy, to move all data to the Commonwealth Data Center, if required by the Commonwealth.

At the end of the contract, the vendor shall provide all agency data in a form that can be converted to any subsequent system of the agency’s choice. The vendor shall cooperate to this end with the vendor of the agency’s choice, in a timely and efficient manner.

4.15Project Governance Vendor shall work with the agency and appropriate COT offices, when needed, in the cases of data governance, security aspects, hosting, integration, etc., provided that such work does not expand the scope of the services as described in this RFP absent a corresponding change order agreed to by the parties reflecting such expansion.

4.16 Monitoring Requirements for On Premise and Cloud (SaaS)

Document Phase Document Description Page 17

Vendor shall work with the agency and COT to establish a monitoring solution. Vendors shall provide a view into their environment either by providing a COT and agency approved comprehensive dashboard or allow COT to install their KITS compliant infrastructure and application monitoring solution; to include but not limited to performance and availability. For a Cloud solution, Vendor is expected to provide a monitoring solution.

4.17 Application and Service Requirements

Current Enterprise Applications and Services

1. COT provides a number of Enterprise Shared Services to State agencies.

Vendor shall use published IT Applications and Services provided on KITS for:

Enterprise Service Bus, Enterprise Content Management, Data Warehousing, Data Analytics and Reporting, Business Intelligence, Web Services, GIS, unless explicitly approved by COT.

2. Vendor provided dedicated application components (i.e., Application Servers, Databases, etc.) shall comply with KITS or if the technology is not included in KITS, the technology must be accepted by the Commonwealth for inclusion in KITS or granted a written exception to KITS according to COT Information Technology Standards Policy currently CIO-051.

3. Vendor applications must describe in detail all available features and functionality accessible via APIs.

4. All business applications must support the ability to use modern authentication for authentication and authorization. Modern authentication technologies would include SAML 2.0, WSFED, OAuth, or OpenID Connect.

4.18 Project Management Requirements

The COT Division of Governance and Strategy (COT-DGS) is responsible for overseeing large and complex technology projects throughout the Commonwealth. The vendor shall adhere to Project Management standards and reporting requirements established by COT- DGS, which are posted at https://technology.ky.gov/services-and-support/Pages/About-the-Project-Management-Branch.aspx. These include, but are not limited to, having a documented project schedule, risk management, issue management and reporting project status to the CIO monthly in the format defined by COT-DGS. In addition to the project management standards required by COT-DGS, agency specific requirements may be defined in this RFP.

4.19 Applicable Security Control Framework Compliance

The vendor must have an awareness and understanding of the NIST Special Publication 800-53 Security Control Framework and employ safeguards that meet or exceed the moderate level controls as defined within the standard. The vendor must provide sufficient safeguards to provide reasonable protections around the Commonwealth’s data to ensure that the confidentiality, integrity, and availability is maintained at an appropriate level. These include but are not limited to:

# Access Control The vendor must employ policy and process that provide for stringent control to limit physical and logical access to systems that house Commonwealth data, on a

Document Phase Document Description Page 18

2700000032 Final GEAR UP Ky- SAT Platform Total Pages: 43 https://technology.ky.gov/services-and-support/Pages/About-the-Project-Management-Branch.aspx https://technology.ky.gov/services-and-support/Pages/About-the-Project-Management-Branch.aspx need to know basis, provide clear separation of duties, and adheres to least privilege principles.

# Awareness and Training The vendor must provide the appropriate role specific training for staff to ensure that there is awareness and understanding of roles and responsibilities as they relate to the protections around the Commonwealth’s data.

# Audit and Accountability There must be sufficient auditing capability to ensure that actions are tracked and there is individual accountability for all actions taken by vendor staff.

# Configuration Management The vendor must work within established baselines that provide minimal functionality needed to ensure service delivery without exposing unnecessary risk. The vendor must also employ structured change control processes that provide a level of coordination with the client agreed upon in a Service Level Agreement (SLA).

# Contingency Planning The vendor must employ contingent planning policy and procedures that ensure service delivery based on agreed SLA levels while maintaining all Commonwealth data within the continental Unites States.

# Identification and Authorization The vendor must employ appropriate identity and access management policies and procedures to ensure that access is appropriately authorized and managed at a level to ensure that access is provisioned and de-provisioned in a timely and efficient manner.

# Incident Response The vendor must employ policy and procedures to ensure that an appropriate response to all identified security incidents are addressed in a timely manner and are reported to the appropriate parties in an agreed upon SLA timeframe. The vendor must also ensure that all staff are sufficient trained to ensure that they can identify situations that are classified as security incidents.

# Maintenance The vendor must employ policy and procedures that ensure that all maintenance activities are conducted only by authorized maintenance staff leveraging only authorized maintenance tools.

# Media Protection The vendor must employ policy and procedure to ensure that sufficient protections exist to protect Commonwealth data on all storage media throughout the media lifecycle and maintain documentation from media creation through destruction.

# Physical and Environmental Controls The vendor must employ physical and environmental policies and procedures that ensure that the service and delivery infrastructure are located in a physically secure and environmentally protected environment to ensure the confidentiality, integrity, and availability of Commonwealth data.

# Personnel Security

Document Phase Document Description Page 19

The vendor must employ policies and procedures to ensure that all staff that have access to systems that house, transmit, or process Commonwealth data have been appropriately vetted and have been through a background check at the time of hire and periodically thereafter.

# System and Communications Protections The vendor must employ physical and logical protection that protect system communications and communication media from unauthorized access and to ensure adequate physical protections from damage.

4.20 IRS Publication 1075 -Exhibit 7 Safeguarding Contract Language

Publication 1075 (Rev. 11-2021) (irs.gov)

I. PERFORMANCE

In performance of this contract, the Contractor agrees to comply with and assume responsibility for compliance by officers or employees with the following requirements:

(1) All work will be performed under the supervision of the contractor.

(2) The contractor and contractor’s officers or employees to be authorized access to FTI must meet background check requirements defined in IRS Publication 1075. The contractor will maintain a list of officers or employees authorized access to FTI. Such list will be provided to the agency and, upon request, to the IRS.

(3) FTI in hardcopy or electronic format shall be used only for the purpose of carrying out the provisions of this contract. FTI in any format shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of this contract. Inspection or disclosure of FTI to anyone other than the contractor or the contractor’s officers or employees authorized is prohibited.

(4) FTI will be accounted for upon receipt and properly stored before, during, and after processing. In addition, any related output and products require the same level of protection as required for the source material.

(5) The contractor will certify that FTI processed during the performance of this contract will be completely purged from all physical and electronic data storage with no output to be retained by the contractor at the time the work is completed. If immediate purging of physical and electronic data storage is not possible, the contractor will certify that any FTI in physical or electronic storage will remain safeguarded to prevent unauthorized disclosures.

(6) Any spoilage or any intermediate hard copy printout that may result during the processing of FTI will be given to the agency. When this is not possible, the contractor will be responsible for the destruction of the spoilage or any intermediate hard copy printouts and will provide the agency with a statement containing the date of destruction, description of material destroyed, and the destruction method.

Document Phase Document Description Page 20 https://www.irs.gov/pub/irs-pdf/p1075.pdf

(7) All computer systems receiving, processing, storing, or transmitting FTI must meet the requirements in IRS Publication 1075. To meet functional and assurance requirements, the security features of the environment must provide for the managerial, operational, and technical controls. All security features must be available and activated to protect against unauthorized use of and access to FTI.

(8) No work involving FTI furnished under this contract will be subcontracted without the prior written approval of the IRS.

(9) Contractor will ensure that the terms of FTI safeguards described herein are included, without modification, in any approved subcontract for work involving FTI.

(10) To the extent the terms, provisions, duties, requirements, and obligations of this contract apply to performing services with FTI, the contractor shall assume toward the subcontractor all obligations, duties and responsibilities that the agency under this contract assumes toward the contractor, and the subcontractor shall assume toward the contractor all the same obligations, duties and responsibilities which the contractor assumes toward the agency under this contract.

(11) In addition to the subcontractor’s obligations and duties under an approved subcontract, the terms and conditions of this contract apply to the subcontractor, and the subcontractor is bound and obligated to the contractor hereunder by the same terms and conditions by which the contractor is bound and obligated to the agency under this contract.

(12) For purposes of this contract, the term “contractor” includes any officer or employee of the contractor with access to or who uses FTI, and the term “subcontractor” includes any officer or employee of the subcontractor with access to or who uses FTI.

(13) The agency will have the right to void the contract if the contractor fails to meet the terms of FTI safeguards described herein.

II. CRIMINAL/CIVIL SANCTIONS

(1) Each officer or employee of a contractor to whom FTI is or may be disclosed shall be notified in writing that FTI disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any FTI for a purpose not authorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution.

(2) Each officer or employee of a contractor to whom FTI is or may be accessible shall be notified in writing that FTI accessible to such officer or employee may be accessed only for a purpose and to the extent authorized herein, and that access/inspection of FTI without an official need-to-know for a purpose not authorized herein constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution.

(3) Each officer or employee of a contractor to whom FTI is or may be disclosed shall be notified in writing that any such unauthorized access, inspection or disclosure of

Document Phase Document Description Page 21

FTI may also result in an award of civil damages against the officer or employee in an amount equal…