FINAL SBSP IDFPR Agent ID Card Small Purchase Solicitation document.docx

www.idfpr.com

JB PRITZKER

Governor

MARIO TRETO, JR.

Acting Secretary

GOAL:

IDFPR intends to execute a small purchase procurement for a vendor to provide services for the production, sorting, reporting, and mailing of dispensary agent Identification (ID) Cards to approved individuals registered with IDPFR. Production includes printing driver’s license sized and quality digital photos and other required information on the ID Cards as mandated by the various cannabis related Acts and Rules under IDFPR’s oversight. A sample ID card design can be found on the last page of this solicitation document. These services will be performed starting at the completion of an awarded contract (estimated September 1, 2021) through June 30, 2022. IDFPR may request bidders to submit a sample card prior to the awarding of the contract. Please read the Supplies and/or Services Required section for more details.

SUPPLIES AND/OR SERVICES REQUIRED:

Must satisfy all requirements below to qualify

General Specifications

1. All transmissions containing Identification Card application data or image(s) between the Vendor and agencies shall be exchanged securely using the HTTPS protocol, providing 128-bit encryption using Secure Sockets Layer (SSL) technology. Additionally, all Web service-based communications between systems shall be completed using secure Web services over SSL along with secure authentication tokens.

2. The Vendor shall provide a report containing information pertaining to the daily production and mailing of Identification Cards. This report can be viewed by authorized State of Illinois personnel through their Web browsers. The report shall include all Identification Card numbers, the individual names associated with each Identification Card, the date the Identification Card applicant data was received by Vendor and the date the Identification Card was mailed to the approved individuals. This report can be exported by Vendor to a CSV file (confirmation file). The confirmation file can either be generated on demand or scheduled periodically for automatic generation. It can be made available to the agencies over SFTP (Secure File Transfer Protocol) or email.

3. The Vendor solution shall accept files, as specified in this document, that contain personal information and a digital photograph. IDFPR can provide text file and image files (for digital photographs), the applicant’s names of which would be cross-referenced in the text file. The digital photograph file format can be JPEG, JPEG2 or PNG. The type of digital photograph format shall be mutually agreed upon between IDFPR and the Vendor. These files can be transferred securely by IDFPR to MicroPact SFTP server.

4. To make sure that legibility is maintained during production, the Vendor will ensure that every Identification Card produced does not have any visual or physical defects. This check includes a legibility check for establishing the identity of the cardholders.

5. The Vendor will provide for daily production/pickup days, Monday through Friday, excluding State and Federal holidays, dedicated to this project for printing, sorting and mailing purposes. Establishing 5-day per week for mailing Identification Cards ensures that all files are produced and shipped within 3 business days or less.

6. The Vendor shall modify production as needed due to significant changes in Identification Card volume from month-to-month.

7. The Vendor shall provide all goods and services necessary to produce Identification Cards as specified in this document and any applicable subsequent attachments.

8. The Vendor will provide a system which caters to requirements and design discussed and captured in the requirements and design documents.

Identification Card Specifications The Identification Card will be CR80 ISO Standard Plastic Cards. The Identification Card Elements include the following:

1. IDFPR shall have the final approval and acceptance of the design, layout, and general appearance of Identification Cards. The requirements and design document for Identification Cards for IDFPR shall be provided to IDFPR for review and approval by the contract term start date. This includes the requirements document, card, and cover letter design and design document.

2. Vendor shall use facial image processing capability to make the digital photographs provided by IDFPR compliant to the ISO 19794-5 standard. To do so, Vendor will resize and crop the photograph to maintain the distance between the centers of the pupils as the same, for all photographs in the system. It will also correct rotation of the head of up to +/- 5 degrees in every direction (roll, pitch, and yaw). The image will also be checked to ensure its focus, brightness, lightning, and sharpness are within allowable limits. If an image fails to adhere to the criteria set by the ISO 19794-5 standard after all these corrections, it will be rejected. This will ensure that all photographs are clearly discernable for establishing identity.

3. The Vendor shall produce Identification Cards so that the graphics, layout, and quality are consistent between all Identification Cards. Vendor shall produce Identification Cards which are consistent with the current design templates for medical cannabis dispensary agents established by the State of Illinois. A samples of this template may be made available to the agency for approval prior to the contract award. In order to ensure that no variations arise at the time of production, Vendor shall use reliable equipment and consumables that yield the same results each time. All cards and kits shall be visually checked for quality before they are dispatched from the Vendor’s facility. Additional information can be found in Section 1.1.9.

4. The Identification Card will be CR80 ISO Standard Plastic Cards. The services for production of an Identification Card include:

· Bi-directional data transfer

· Identification Card production

· Affixing the Identification Card to the card carrier

· Inserting the Identification Card

· Protective covering and card carrier into an envelope

· Printing and inserting a letter from the agencies and

· Addressing and mailing the Identification Card to the Identification Card consumer

The Identification Cards shall include holograms preventing any possible counterfeit of the card. Security features shall be met using a custom hologram the Vendor created and designed specifically for Illinois' Identification Cards and as approved by IDFPR. The hologram shall not be used by or for any other clients or cards other than the Identification Cards specified within this contract. Features are shown and the personalization and image specifications will be imprinted directly on the card and sealed with an outer protective layer. Barcodes shall be included on the back of the Identification Card. The Illinois State’s seal, as provided by IDFPR, shall be included on each Identification Card.

Physical Specifications Identification Cards are is generally stored in a closed container, such as a wallet, but shall be able to withstand both indoor and outdoor environments. If any card does not last a year from its date of production, and the deterioration is due to production or manufacturing deficiencies as determined by the State of Illinois or Vendor at the time of inspecting the card, then the card shall be replaced by the Vendor at no cost to IDFPR or the card holder.

Identification Card Carrier Specifications The Vendor shall supply the Identification Card carrier, affix the Identification Card to the carrier, and insert both into a standard #10 business envelope along with a protective covering and letter from the agencies. The Identification Card carrier shall be on IDFPR-approved paper stock. The Vendor shall be responsible for printing the Identification Card carrier. The Identification Card carrier shall not exceed one (1) page printed, black text.

Identification Card Attachment Specifications The Vendor shall affix the Identification Card to the carrier with fugitive glue, a special type of heated glue that does not affect the integrity of any of the physical elements of the card yet stays attached in mailing. The letter shall be trifold to cover the face of the card.

Envelope Specifications

1. The Vendor shall preprint the mailing address by reading the barcode on the card to look up the record and dynamically print addresses on the carriers to which they are being affixed. The window envelope shall display the recipient's address on the carrier. The return address shall be printed on the standard #10 business envelope with window and allow for forwarding by the United States Post Office.

2. The Vendor shall use envelopes that are a standard #10 business size with window, white in color, printed in black ink on the face side with a return address and mail to address. The Vendor shall provide samples of preprinted envelopes to be accepted with the approval of the agencies, upon notification of the public notice.

3. The Vendor will supply the envelopes for each mailing.

4. The Vendor will ensure that envelopes used for mailing, postal indicia, and all other printing will meet all United States Postal Service (“USPS”) specifications.

Postage Specifications

1. Identification Cards shall be mailed U.S. First Class Mail. The Vendor will implement mailings in adherence to USPS bulk postage regulations. To adhere to bulk postage regulations from the USPS, incoming files are monitored and cleaned to make sure they are compliant for mailings.

2. The Vendor shall be financially responsible for mailing the Identification Card and Identification Card carrier along with other materials IDFPR deems necessary to the approved individuals. The Vendor shall include First Class mailing expenditures related to the mailing of Identification Cards in the Per Unit Price, see Section 2.4 Vendor’s Pricing for more details.

3. The Vendor shall conform to prevailing USPS regulations and procedures.

4. The Vendor shall negotiate first-class postage rates to ensure the best pricing for mailing the Identification Card and Identification Card carrier. Savings incentives are offered by USPS for pre-sorting by zip codes up to 3, 4 and 5 digits for a certain number of kits. These savings shall be passed along to IDFPR.

5. The Vendor shall notify IDFPR about increases in postage costs which may affect the cost of mailing within 30 days of receiving notice from USPS. The Vendor and IDFPR shall negotiate any impact on mailing costs which may lead to a revision of the contract pricing terms.

6. The Vendor will also provide original postage statements (invoices) from the USPS on production run mailings.

Statistical Reports Specifications The Vendor shall provide Web-based electronic reporting using an Internet browser. These reports include the following:

1. Reports of the statistics of the Identification Card production process will receive production related statistical data from the Visual Card Production ERP using secure Web services. Personal Information received will be encrypted and stored in the Vendor data base. This data will be used for reporting by Vendor’s Report Manager framework component to generate daily, weekly, and monthly activity.

2. Reports shall include Identification Card status by identification number, applicant name, applicant category, date of issue, date of postage, date of expiration, address, and endorsements.

3. The Vendor Card Production Systems log and record every mailing that goes out of the facilities. This data shall be sent securely to Vendor and then securely stored and reported. Vendor shall provide reports for each mailing. For a period with multiple mailings to display postage invoices.

Quality Specifications

1. The Vendor guarantees the information printed on an approved individual’s Identification Card accurately reflects the information submitted by the approved individual.

2. The Vendor shall check for visual defects in every card that is produced through an operator. The operator is responsible for collecting finished card/carriers at the end of the personalization equipment. This quality check guarantees defect free Identification Cards produced over the term of the contract. Examples of defects include, but are not limited to:

· The material used in the manufacturing of the Identification Card,

· De-lamination on the Identification Card,

· Blurred or missing graphics,

· Blurred or missing text,

· Images printed on the Identification Card upside down or on the wrong side, and

· Personalization information not matching the photo.

3. The Vendor shall correct, at no additional charge to IDFPR, all defects. The Vendor shall use Visual ERP logs and track each batch denoting the number of good and rejected cards completed and will be able to use this information in our invoices to reflect all defect repairs as the result of errors.

4. The Vendor shall establish management controls for dealing with damaged, flawed, or unused Identification Cards. The personalization bureau shall maintain logs to track the status of each Identification Card. This includes cards that are sent for destruction in addition to destruction logs in the grinding area that show that the cards have been destroyed under dual control. Remakes due to personalization defects shall be approved by the Vendor’s highest level of authority so as to eliminate the possibility of duplicates. All management controls and disposal methods shall be approved by IDFPR.

5. Upon written notification from IDFPR regarding any quality issue with the Identification Card or production process, The Vendor shall 1) Record a complaint once it is received. 2) Vendor Quality Control (QC) personnel shall begin investigation of the issue after notification and if a sample receipt is present. 3) The QC personnel shall facilitate development of a corrective action plan with defect confirmation. 4) Immediate action for containment of non-conforming product shall be determined. 5) The Sales Representative shall review the problem and determine customer resolution. For any quality issue, the Vendor will investigate and respond to IDFPR within one (1) business day. A report shall include any other possible Identification Cards/consumers that may be impacted by the defect/flaw.

6. The Vendor shall maintain a sufficient supply of the cardstock, as per the stock type specified in 1.1.2, within agreed upon safety levels to protect against a shortage, at the Vendor’s expense. Any unused stock shall be inventoried, transferred, and shipped to IDFPR at a location to be specified within 30 days of the end of the contract.

Format Modifications Specifications At any time during the term of this contract, it may become necessary to modify any of the security features, text, or attributes located on the Identification Card and within the scope of the original intent of this contract. Upon request from IDFPR, the Vendor shall modify all text, attributes located on the Identification Card and all security features shown in the samples provided, other than the hologram and the bar codes. The hologram and bar codes will be provided in the samples for approval. Any change after an approval cycle to redesign the cards shall result in the Vendor incurring the additional costs.

a. The Vendor shall implement modification requests within (15) calendar days of a request from IDFPR. IDFPR shall reimburse the Vendor for any purchased materials required by this contract that are not used due to modifications.

b. If the requested modifications represent a cost increase directly to card production, the Vendor and IDFPR will amend the contract to accommodate the increased cost and functionality after mutually agreeing to the increases.

Disaster Recovery Specifications

1. The Vendor shall make disaster recovery arrangements to ensure Identification Cards are produced and mailed within thirty (30) business days of receipt of the secure IDFPR card production file(s). The Vendor's servers will be hosted in Verizon/Terremark's FedRAMP certified geo- redundant data centers in Iron Mountain, Virginia and Dallas, Texas or within an equivalent secure hosting solution. The Vendor’s global load balancers are responsible for distributing network traffic to the servers. In addition to distributing network traffic, the load balancers monitor the server's load, performance, and availability. When a Vendor server becomes unavailable, it will direct the network to the surviving servers until the down server is restored. It also provides persistent session to the users' browser to successfully maintain that session. This ensures that business continuity is maintained even if an entire site is down due to a major disaster, since the second site continues to function.

2. The Vendor’s card production environments and office environments are backed up off-site to servers in New Jersey. Customer data is not backed up for security purposes. If a disaster occurs, customer data is securely re-imported into secondary production systems from Vendor based on the last record produced by Vendor's production facility. There are two options for activating a secondary production site in the event of a disaster.

· One option is to leverage the secure facilities and equipment of the Vendor's third-party partner. In this scenario, the Vendor securely transports all the necessary supplies to this facility, brings card production systems back online, restores data from backup locations and Vendor, and begins operations within three (3) business days of the disaster.

· The second option requires the Vendor to setup a disaster recovery location at a secure facility that belongs to IDFPR. In this alternative, the Vendor transports and sets up all the necessary systems and equipment at such a location within 3 business days of the disaster. Therefore, should the Vendor's primary site become inoperable, provisions for the following levels of disaster are provided for:

Level 1 Loss: Permanent loss of production capability at the primary production site.

Level 2 Loss: Any loss of production capability at the primary production site for a period greater than 15 days, but not deemed perm anent.

Level 3 Loss: Any loss of components or software failure where production capability is interrupted but can be repaired/replaced within a time frame, which would allow production to resume within three (3) days. Product repairs made at Level 3 are done in the form of a minor product builds (bug fixes} that are built on the most recent product version. Each individual hot fix verifies that the reported issue is addressed successfully. Vendor has a regular process for rolling up all accumulated hot fixes into a patch kit, which is then subjected to a full Quality Assurance cycle prior to release.

3. The Vendor shall, upon request, make available to the State for inspection, a disaster recovery plan which details how the Vendor will meet the production schedule should unforeseen events threaten routine processes involved in the production and mailing of the Identification Card.

4. The Vendor shall, upon request, make available for inspection the last testing of Vendor's existing disaster recovery plan to IDFPR and inspection of any future testing of the disaster recovery plan during the life of the contract.

Security Specifications

1. The Vendor shall provide security measures that protect the hologram, seal of the State of Illinois, photographic images, personalization information, and electronic files. All files shall be securely transferred to secure areas. These files shall only be accessible by authorized individuals in secure areas. All secure collateral is individually audited and remains in a highly secure vault where inventory is tracked for each unit. Everything that enters the production bureau is audited piecewise under dual control.

2. The Vendor affirms that all designs, artwork, graphics, proofs, or prototypes supplied by IDFPR or prepared by the Vendor pursuant to this contract, shall be the property of IDFPR.

3. The Vendor affirms that all items specified in section 1.1.13 will be delivered to IDFPR via guaranteed overnight delivery service at Vendor's expense, retained by Vendor, or destroyed, as directed by IDFPR in writing . This prevents any non -personalized card stock from being unaccounted for. These measures ensure security over the card stock prior to and during the production run regardless of the location of the pre-personalized stock or personalized Identification Card.

4. The Vendor shall provide a safe and secure method of transporting the Identification Card mailing to the nearest USPS facility. The Vendor agrees that all presorted mailings shall be locked into cages and delivered directly to the sorting facilities under dual control. Once the Vendor produces the cards and makes them ready to mail, all card mail packs are securely stored in the mail cage awaiting pickup from Vendor’s card production partner Joyce Letter Shop (JLS). JLS is a secure and authorized mail partner of the USPS that has onsite postal employees at its facility. The cage has limited access and requires two people to enter for dual control of product. Prior to mail pickup, the card packs are removed from the mail cage under dual control and exit the secure production facility via the secure goods trap. The card packs are then moved to the secure mail dock under dual control and placed in a secure holding cage awaiting mail pickup. JLS accepts the card packs from Vendor’s production facility and then securely transports the mail to its pre-sorting facilities.

5. The Vendor shall follow PCI Physical Security regulations at its production facility. The PCI documentation on security requirements on card production is available for a reference at:

https://www.pcisecuritystandards.org/pci_security/standards_overview

6. IDFPR shall have the ability to inspect the facility where the Identification Cards are printed and mailed. IDFPR shall set an appointment at least 24 hours prior to a planned inspection. Such advanced written notice shall include the scope and purpose of the inspection and shall be conducted at IDFPR’s expense. IDFPR shall share the results of any such inspection with the Vendor and the Vendor shall have the opportunity to comment on the report and make corrections; however, the Vendor shall not be required to make any changes that are contrary to its corporate security policies. If the parties are unable to come to an agreement on requested changes, the agencies may choose to cancel the contract. Additionally, periodic, unannounced, or random security checks by IDFPR personnel shall be permitted at any time.

7. It is the responsibility of the Vendor to ensure supplies have sufficient security to eliminate loss or theft of items displaying any State/Identification Card information. Along with the strict security measures described above, the Vendor serializes the inventory card stock with an inventory control number that can be tracked in VENDOR's system. This prevents any non-personalized card stock from being unaccounted for. IDFPR has the right to inspect the security measures implemented by Vendor.

Performance Monitoring

1. The Vendor is responsible for the performance of the contract and shall use its internal monitoring procedures and processes such as project management, monitoring and control of schedules and budgets, roles and responsibilities matrices, quality assurance and controls, defect management and tracking to ensure compliance.

2. IDFPR has the right to monitor and track Vendor’s performance over the course of the contract including any warranty terms. The information gathered may be used in administration of the contract, including payment.

3. The Vendor shall develop a performance scorecard with conditions, milestones, requirements, or timetables that shall be met before additional steps may be taken or payment is due. The scorecard may additionally record matters related to price, service, quality, and other factors deemed important.

Secure Transmissions of Data

1. Vendor shall collaborate with IDFPR’s Licensing and Enforcement System (ILES) to ensure accurate and secure transmissions of data to perform the required services of this solicitation.

If a Bidder has a question regarding the requirements, please submit a clarification question to the APO prior to the bid deadline.

Please complete the YES or NO columns per REQUIREMENT listed in the table below.

Do you agree to satisfy all requirements listed above?

If you mark YES for all requirements, please complete the PRICING section to calculate your TOTAL BID COST.

PRICING:

A contract will be awarded to the Vendor that meets all the requirements and provides the lowest TOTAL BID COST on the pricing table calculations below. All production costs will be rolled into a COST PER CARD. The total value of this contract is estimated. The term of the awarded contract will start at the completion of an awarded contract and expire on June 30, 2022.

INVOICING:

The Vendor shall submit monthly invoices to IDFPR detailing the number of ID cards produced and mailed for each of the ID card types.

DUE DATE: 08/09/2021 1:00PM Central Time

VENDOR CONTACT INFORMATION:

Please complete the contact information below and return to the IDFPR Agency Purchasing Officer or upload the completed bid to BidBuy Bid# B-24051

Vendor Name:

Vendor Contact:

Vendor Email/Phone:

Vendor Signature:

SAMPLE ID CARD DESIGN

Front

Back

100 West Randolph Street, 9th Floor Chicago, Illinois 60601 ∙ (888) 473-4858 ∙ TTY (866) 325-4949 320 West Washington Street, 3rd Floor Springfield, Illinois 62786 ∙ (888) 473-4858 ∙ TTY (866) 325-4949 image1.jpeg image2.png image3.png