G4018 Request for Qualifications~8.docx

Federally-Based Contracts Request for Quotation

Dates are subject to change. All times contained in the Request for Quote refer to Eastern Time. All changes will be reflected in Bid Amendments to the Request for Quote posted on Using Agency website.

Request For Quote Issued By:

State of New Jersey Department of the Treasury, Division of Administration 50 West State Street, Trenton, NJ 08625

Date: April 12, 2021 Table of Contents

Attachment 1: Integrity Oversight Monitor Guidelines Attachment 2: Report Template

INFORMATION FOR BIDDERS

NOTICE: The Bidder is advised to thoroughly read all sections and follow all instructions contained in this Request for Quote (RFQ) before preparing and submitting its Quote. See Section 2.0 for Definitions

The Contract will be awarded in the State of New Jersey’s eProcurement system, NJSTART (www.njstart.gov). The Bidder is advised to read through all Quick Reference Guides (QRGs) located on the NJSTART Vendor Support Page for information.

Please be advised that in accordance with P.L. 2018, c. 9, also known as the Diane B, Allen Equal Pay Act, which was signed in to law by Governor Phil Murphy on April 24, 2018, a contractor performing “qualifying services” or “public work” to the State or any agency or instrumentality of the State shall provide the Commissioner of Labor and Workforce Development a report regarding the compensation and hours worked by employees categorized by gender, race, ethnicity, and job category. For more information and report templates see https://nj.gov/labor/equalpay/equalpay.html.

PURPOSE AND INTENT

This RFQ is issued by the Department of the Treasury. The purpose of this RFQ is to solicit Quotes from interested qualified firms who can provide Program and Process Management Monitoring, Financial Auditing and Grant Management and Integrity Monitoring/Anti-Fraud support services for the disbursement of COVID-19 Recovery Funds. For the purposes of this RFQ, COVID-19 Recovery Funds shall not include funds awarded to the State pursuant to Section 5001 of the Coronavirus Aid, Relief and Economic Security Act. Pub. L. 116-136.

The intent of this RFQ is to award a Contract to those responsible Bidders whose Quotes, conforming to this RFQ are most advantageous to the State, price and other factors considered in the following three areas of expertise: (1) Program and Process Management Monitoring; (2) Financial Auditing and Grant Management; and (3) Integrity Monitoring/Anti-fraud service from which each principal department and agency of this State, as well as each independent State authority may select a qualified Contractor selected through this RFQ pursuant to an Engagement Process as defined in Section 1.3 below. The State may award contracts for all or some of the services. The State, however, reserves the right to separately procure individual requirements that are the subject of the Contract during the Contract term, when deemed by the Director of the Division of Purchase and Property (Director) to be in the State’s best interest.

Award of the Contracts will be to those qualified Bidders whose Quotes, conforming to the RFQ, are most advantageous to the State, price and other factors considered. Bidders may be qualified in more than one area of expertise. Quotes will only be accepted from Bidders with an active GSA contract under SINs 541611, 541211, or Ancillary SINs as defined by GSA eBuy.

The State of NJ Standard Terms and Conditions (SSTC) accompanying this RFQ will apply to all Contracts made with the State of New Jersey. These terms are in addition to the terms and conditions set forth in this RFQ and should be read in conjunction with them unless the RFQ specifically indicates otherwise.

BACKGROUND

On March 9, 2020, Governor Murphy issued Executive Order 103 declaring both a Public Health Emergency and State of Emergency in light of the dangers of the Coronavirus disease 2019 (“COVID-19”). On March 13, 2020, the President of the United States declared a national emergency and determined that the COVID-19 pandemic was of sufficient severity and magnitude to warrant a nation-wide emergency declaration under Section 501 of the Robert T. Stafford Disaster Relief and Emergency Assistance Act, 42 U.S.C.§ 5121-5207, (“Stafford Act”) and that declaration was extended to the State of New Jersey on March 25, 2020 pursuant to Section 401 of the Stafford Act. On March 27, 2020, the Coronavirus Aid, Relief, and Economic Security Act, H.R. 748, (“CARES Act”) was enacted to provide economic stimulus in response to the global pandemic caused by COVID-19, (COVID-19 Recovery Funds). The CARES Act, among other things, was enacted to assist State, Local and Tribal governments navigate the impact of the COVID-19 outbreak and cover necessary expenditures related to the public health emergency incurred between March 1, 2020 and December 30, 2020.

On July 17, 2020, Governor Murphy signed Executive Order 166 (“EO 166”), which, among other things, established the COVID-19 Compliance and Oversight Task Force (the “Taskforce”) and the Governor’s Disaster Recovery Office (GDRO). The purpose of the Taskforce is to advise each principal department and agency of this State, as well as each independent State authority COVID-19 Recovery Program Participants, referred to in this RFQ as “Using Agencies,” that receive or administer COVID-19 Recovery Funds regarding compliance with federal and State law and how to mitigate the risks of waste, fraud, and abuse.

Pursuant to EO 166, the Taskforce has issued guidelines regarding the appointment and responsibilities of COVID-19 Oversight Integrity Monitors (“Integrity Monitors”). Using Agencies may retain and appoint Integrity Monitors to oversee the disbursement of COVID-19 Recovery Funds and the administration of a COVID-19 Recovery Program. See Integrity Oversight Monitor Guidelines at Attachment 1. Integrity Monitors are intended to serve as an important part of the State’s accountability infrastructure while working with Using Agencies in developing measures to prevent, detect, and remediate inefficiency and malfeasance in the expenditure of COVID-19 Recovery Funds.

EO 166 requires Using Agencies to identify an Accountability Officer to serve as central point of contact for tracking COVID-19 funds within each agency or authority and is responsible for working with and serving as a direct point of contact for the GDRO and the Taskforce.

The creation of a pool of qualified Integrity Monitors through the issuance of this RFQ will support monitoring and oversight and ensure that Using Agencies administer COVID-19 Recovery Funds in compliance with program, financial, and administrative requirements set forth in the federal-state grant agreement, the State-Recovery Program Participant sub-grant agreement, and applicable federal and state laws, regulations, and guidelines.

1.2.1 Engagement process

The retention of a Contractor(s) by a Using Agency from the pool established pursuant to this RFQ will follow the below process:

· A Using Agency will designate an agency employee to act as the contract manager for a Contractor Engagement (Agency Contract Manager), which may be the Accountability Officer. The Agency Contract Manager will notify the State Contract Manager, on a form prescribed by Treasury, along with any required supporting documentation, of its request for a Contractor. The Agency Contract Manager will indicate which Contractor services are required.

· The Agency Contract Manager will develop an Engagement Query on an individual basis. The Engagement Query will include a detailed scope of work; specific performance milestones, timelines, and standards and deliverables and liquidated damages for failure to meet any required milestones, timelines or standards or deliverables.

· The Agency Contract Manager, in consultation with the Office of the Attorney General, Division of Law, will structure a liquidated damages provision for the failure to meet any required milestones, timelines, or standards or deliverables, as appropriate.

The Agency Contract Manager will submit its Engagement Query to the State Contract Manager. Upon approval by the State Contract Manager, but prior to the solicitation of any services, the Engagement Query will be sent to OSC for approval pursuant to EO 166. After receiving approval from OSC, the State Contract Manager will send the Engagement Query to all eligible Contractors within the pool.

Interested and eligible Contractors shall respond to the Engagement Query within the timeframe designated by the State Contract Manager, with a detailed proposal that includes a detailed budget, timelines, and plan to perform the scope of work and other requirements of the Engagement Query. Contractors shall identify any potential conflicts of interest that would prevent them from accepting an Engagement.

The State Contract Manager will forward to the Agency Contract Manager all proposals received in response to the Engagement Query. The Agency Contract Manager will review the proposals and select the Contractor whose proposal represents the best value, price and other factors considered. The Agency Contract Manager will memorialize in writing the justification for selecting an Integrity Monitor(s).

Prior to finalizing any Engagement under this contract, the Agency Contract Manager, in consultation with the Accountability Officer, will independently determine whether the intended Contractor has any potential conflicts with the engagement.

· The State Contract Manager, on behalf of the Using Agency, will then issue a Letter of Engagement with a “Not to Exceed” clause to the engaged Contractor and work with the Agency Contract Manager to begin the issuance of Letter of Engagement.

QUESTION AND ANSWER PERIOD

The State will electronically accept questions and inquiries from all potential Bidders.

A. Questions should be directly tied to the RFQ and asked in consecutive order, from beginning to end, following the organization of the RFQ; and

B. Each question should begin by referencing the RFQ page number and section number to which it relates.

A Bidder shall submit questions only to the State designee mona.cartwright@treas.nj.gov in writing. The State will not accept any question in person or by telephone concerning this RFQ.

The cut-off date for electronic questions relating to this RFQ is indicated on the RFQ cover sheet. In the event that questions are posed by Bidders, answers to such questions will be issued by Addendum. Any Addendum to this RFQ will become part of this RFQ and part of any Contract awarded as a result of this RFQ. Addenda to this RFQ, if any, will be posted to the State’s website.

SUBMISSION OF QUOTES

In order to be considered for award, the Quote must be received by the State at the designated time and place.

A Quote must be submitted electronically by email to the following email address by 2:00 PM on the date listed on the cover sheet of this RFQ or electronically through GSA eBuy:

Mona.Cartwright@treas.nj.gov

QUOTES NOT RECEIVED PRIOR TO THE QUOTE OPENING DEADLINE SHALL BE REJECTED. THE DATE AND TIME OF THE QUOTE OPENING IS INDICATED ON THE RFQ COVER SHEET.

IF THE QUOTE OPENING DEADLINE HAS BEEN REVISED, THE NEW QUOTE OPENING DEADLINE SHALL BE SHOWN ON THE POSTED ADDENDUM.

ADDITIONAL INFORMATION

BIDDER Responsibility

The Bidder assumes sole responsibility for the complete effort required in submitting a Quote in response to this RFQ. No special consideration will be given after Quotes are opened because of a Bidder’s failure to be knowledgeable as to all of the requirements of this RFQ.

COST LIABILITY

The State assumes no responsibility and bears no liability for costs incurred by a Bidder in the preparation and submittal of a Quote in response to this RFQ.

CONTENTS OF QUOTE

Quotes can be released to the public pursuant to N.J.A.C. 17:12-1.2(b) and (c), or under the New Jersey Open Public Records Act (OPRA), N.J.S.A. 47:1A-1.1 et seq., or the common law right to know.

After the opening of sealed Quotes, including Quotes submitted electronically, all information submitted by a Bidder in response to a RFQ is considered public information notwithstanding any disclaimers to the contrary submitted by a Bidder. Proprietary, financial, security and confidential information may be exempt from public disclosure by OPRA and/or the common law when the Bidder has a good faith legal/factual basis for such assertion.

When the RFQ contains a negotiation component, the Quote will not be subject to public disclosure until a notice of intent to award a Contract is announced.

As part of its Quote, a Bidder may designate any data or materials it asserts are exempt from public disclosure under OPRA and/or the common law, explaining the basis for such assertion. The location in the Quote of any such designation should be clearly stated in a cover letter.

The State reserves the right to make the determination as to what is proprietary or confidential, and will advise the Bidder accordingly. Any proprietary and/or confidential information in a Quote will be redacted by the State. The State will not honor any attempt by a Bidder to designate its entire Quote and/or prices as proprietary, confidential and/or to claim copyright protection for its entire Quote. Copyright law does not prohibit access to a record which is otherwise available under OPRA. In the event of any challenge to the Bidder’s assertion of confidentiality with which the State does not concur, the Bidder shall be solely responsible for defending its designation, but in doing so, all costs and expenses associated therewith shall be the responsibility of the Bidder. The State assumes no such responsibility or liability.

A Bidder shall not designate any price lists and/or catalogs submitted as exempt from public disclosure as the same must be accessible to State Using Agencies and Cooperative Purchasing Program participants (if the RFQ has been extended to these participants) and thus must be made public to allow all eligible purchasing entities access to the pricing information.

ELECTRONIC SIGNATURES

Bidders submitting Quotes electronically may sign the forms required with the Quote, or required before Contract award, by electronically by typing the name of the authorized signatory in the “Signature” block as an alternative to downloading, physically signing the form, scanning the form, and uploading the form.

DEFINITIONS

CROSSWALK

The following definitions will be part of any Contract awarded or order placed as a result of this RFQ.

When this Contract is awarded in the State of New Jersey’s eProcurement system, NJSTART, the NJSTART terminology listed below will be used

GENERAL DEFINITIONS

Addendum – Written clarification or revision to this RFQ issued by the Using Agency. Bid Amendments, if any, will be issued prior to Quote opening due date.

Bidder – An entity offering a Quote in response to the Using Agency’s RFQ.

Business Day - Any weekday, excluding Saturdays, Sundays, State legal holidays, and State-mandated closings unless otherwise indicated.

Calendar Day – Any day, including Saturdays, Sundays, State legal holidays, and State-mandated closings unless otherwise indicated.

Change Order – An amendment, alteration or modification of the terms of a Contract between the State and the Contractor(s). A Change Order is not effective until it is signed and approved in writing by the Director or Deputy Director, Division of Purchase and Property.

Cooperative Purchasing Program – The Division’s intrastate program that provides procurement-related assistance to New Jersey local governmental entities and boards of education, State and county colleges and other public entities having statutory authority to utilize select State Blanket P.O.s issued by the División pursuant to the provisions of N.J.S.A. 52:25-16 et seq.

Contract – The Contract consists of the State of NJ Standard Terms and Conditions (SSTC), the RFQ, the responsive Quote submitted by a responsible Bidder as accepted by the State, the notice of award, any subsequent written document memorializing the agreement, any modifications to any of these documents approved by the State and any attachments, Bid Amendment or other supporting documents, or post-award documents including Change Orders agreed to by the State and the Contractor, in writing.

Contractor – The Bidder awarded a Contract resulting from this RFQ.

Days After Receipt of Order (ARO) - The number of calendar days ‘After Receipt of Order’ in which the Using Agency will receive the ordered materials and/or services.

Director – Director, Division of Purchase and Property, Department of the Treasury, who by statutory authority is the Chief Contracting Officer for the State of New Jersey.

Discount - The standard price reduction applied by the Bidder / Contractor to all items.

Division – The Division of Purchase and Property.

Evaluation Committee – A committee established or Using Agency staff member assigned by the Director to review and evaluate Quotes submitted in response to this RFQ and recommend a Contract award to the Director.

Firm Fixed Price – A price that is all-inclusive of direct cost and indirect costs, including, but not limited to, direct labor costs, overhead, fee or profit, clerical support, equipment, materials, supplies, managerial (administrative) support, all documents, reports, forms, travel, reproduction and any other costs.

May – Denotes that which is permissible or recommended, not mandatory.

Must – Denotes that which is a mandatory requirement.

No Bid – The Bidder is not submitting a price Quote for an item on a price line.

No Charge – The Bidder will supply an item on a price line free of charge.

Project – The undertakings or services that are the subject of this RFQ.

QRGs – Quick Reference Guides.

Quote – Bidder’s timely response to the RFQ including, but not limited to, technical Quote, price Quote, and any licenses, forms, certifications, or other documentation required by the RFQ.

Request For Quotes (RFQ) – This series of documents, which establish the bidding and contract requirements and solicits Quotes to meet the needs of the Using Agencies as identified herein, and includes the RFQ, State of NJ Standard Terms and Conditions (SSTC), price schedule, attachments, and Bid Amendments.

Shall – Denotes that which is a mandatory requirement.

Should – Denotes that which is permissible or recommended, not mandatory.

Small Business – Pursuant to N.J.A.C. 17:13-1.2, “small business” means a business that meets the requirements and definitions of “small business” and has applied for and been approved by the New Jersey Division of Revenue and Enterprise Services, Small Business Registration and M/WBE Certification Services Unit as (i) independently owned and operated, (ii) incorporated or registered in and has its principal place of business in the State of New Jersey; (iii) has 100 or fewer full-time employees; and has gross revenues falling in one (1) of the three (3) following categories: For goods and services - (A) 0 to $500,000 (Category I); (B) $500,001 to $5,000,000 (Category II); and (C) $5,000,001 to $12,000,000, or the applicable federal revenue standards established at 13 CFR 121.201, whichever is higher (Category III); For construction services: (A) 0 to $3,000,000 (Category IV); (B) gross revenues that do not exceed 50 percent of the applicable annual revenue standards established at 13 CFR 121.201 (Category V); and (C) gross revenues that do not exceed the applicable annual revenue standards established at CFR 121.201, (Category VI).

State – The State of New Jersey.

State Contract Manager (SCM) – The State employee responsible for overall management of the contract as set forth in Section 8.0. The SCM cannot direct or approve a Change Order.

State-Supplied Price Sheet – the bidding document created by the State and attached to this RFQ on which the Bidder submits its Quote pricing as is referenced and described in RFQ Section 4.1.4.

Subtasks – Detailed activities that comprise the actual performance of a task.

Subcontractor – An entity having an arrangement with a Contractor, whereby the Contractor uses the products and/or services of that entity to fulfill some of its obligations under its State Contract, while retaining full responsibility for the performance of all the Contractor's obligations under the Contract, including payment to the Subcontractor. The Subcontractor has no legal relationship with the State, only with the Contractor.

Task – A discrete unit of work to be performed.

Unit Cost – All-inclusive, firm fixed price charged by the Bidder for a single unit identified on a price line.

Using Agency[ies] – A principal department and agency of this State, as well as each independent State authority, authorized to purchase products and/or services under a Blanket P.O. procured by the Division.

Contract SPECIFIC DEFINITIONS/ACRONYMS

Accountability Officer - a senior level official designated by a Using Agency who shall serve as its primary liaison to the GDRO and OSC, and who shall oversee the disbursement of COVID-19 Recovery Funds and the administration of COVID-19 Recovery Programs.

Agency Contract Manager – The State employee responsible for managing the Contractor for the Using Agency. The Agency Contract Manager’s responsibilities are set forth in Section 1.3.

Coronavirus Relief Funds (CRF) – funds awarded to the State pursuant to Section 5001 of the Coronavirus Aid, Relief and Economic Security Act. Pub. L. 116-136 incurred during the period that begins on March 1, 2020 and ends on December 30, 2020 to assist the State with economic recovery from the COVID-19 pandemic.

COVID-19 Recovery Funds – funds, except for CRF, awarded to the State pursuant to the Coronavirus Aid, Relief and Economic Security Act, Pub. L. 116-136 or subsequent federal legislation to assist the State with economic recovery from the COVID-19 pandemic.

COVID-19 Recovery Programs - eligible and planned uses of any funds disbursed by the federal or State government, except for CRF, to help New Jersey residents, businesses, non-profit organizations, government agencies, and other entities respond to or recover from the COVID-19 pandemic.

COVID-19 Recovery Program Participants (Using Agencies) – Using Agencies that receive or administer COVID-19 Recovery Funds or administers a COVID-19 Recovery Program.

Engagement - The retention of a Contractor(s) by a Using Agency from the pool established pursuant to this RFQ.

Engagement Process – The process for selecting a Contractor to provide integrity monitoring services described in Section 1.3.

Engagement Query – A detailed scope of work that includes specific performance milestones, timelines, and standards and deliverables and liquidated damages for failure to meet any required milestones, timelines or standards or deliverables that the Agency Contract Manager will submit to the State Contract Manager. Upon approval by the State Contract Manager, but prior to the solicitation of any services, the Engagement Query shall be sent to OSC for approval pursuant to EO 166. After receiving approval from OSC, the State Contract Manager will send the Engagement Query to all eligible Integrity Monitors within the pool and request for competitive price quotes for all or some of the services listed under this RFQ.

GDRO – The Governor’s Disaster Recovery Office

GSA – United States General Services Administration

Letter of Engagement - A letter sent from the State to begin a specific integrity monitoring project. The Letter of Engagement will include: (1) a detailed scope of work with specific performance milestones, timelines, standards and deliverables appropriate to the specific COVID-19 Recovery Program or expenditure of COVID-19 Funds; (2) a ‘not to exceed” clause; and (3) a liquidated damages provision for failure to meet any required milestones, timelines or standards or deliverables.

OMB – State of New Jersey Office of Management and Budget.

OSC – The Office of the State Comptroller

SME – Subject Matter Expert.

SCOPE OF WORK – REQUIREMENTS OF THE CONTRACTOR

Engagements will be assigned by written Letter of Engagement containing a specific and detailed scope of work, with pricing based on a not to exceed clause pursuant to the selection of a qualified Contractor who through the Engagement Process and whose response to the Engagement Query is most advantageous to the State, price and other factors considered.

GENERAL TASKS

For each Engagement, the Tasks will generally include the following:

Initial and ongoing risk assessments;

Evaluation of project performance;

Evaluation of internal controls associated with the Using Agency’s financial management, cash management, acquisition management, property management, and records management capabilities;

Validation of compliance with sub-grant award and general terms and special conditions;

Review of written documents, such as quarterly financial and performance reports, recent audit results, documented communications with the State, prior monitoring reports, pertinent performance data, and other documents or reports, as appropriate;

Interviews of Using Agency staff, as well as the constituents they serve, to determine whether program objectives are being met in an efficient, effective, and economical manner;

Sample eligibility determinations and denials of applications for funding;

Review of specific files to become familiar with the progression of the disbursement of funds in a particular program, i.e., are actual expenditures consistent with planned expenditure and is the full scope of services listed in the project work plan being accomplished at the same rate of actual and planned expenditures;

Ensuring that the Using Agency is retaining appropriate documentation, based on federal and state regulations and guidance, to support fund disbursement;

Following up with questions regarding specific funding decisions, and review decisions related to emergency situations;

Facilitating the exchange of ideas and promote operational efficiency;

Identifying present and future needs; and Promoting cooperation and communication among Integrity Monitors engaged by other Using Agencies (e.g., to guard against duplication of benefits).

In addition, the Contractor shall conduct on-site monitoring visits if it finds:

· Non-compliance with reporting requirements;

· Problems identified in quarterly progress or financial reports;

· A history of unsatisfactory performance;

· Unresponsiveness to requests for information;

· High-risk designation;

· A failure by the Using Agency to follow up on prior monitoring findings;

· Allegations of misuse of funds; and

· Receipt of complaints.

SPECIFIC TASKS BY CATEGORY

Category 1 - PROGRAM AND PROCESS MANAGEMENT AUDITING

The Contractor shall provide all of the following services, as applicable:

a) Development of processes, controls and technologies to support the execution of CARES Act federally funded programs in compliance with Federal and State guidance, including OMB Circulars;

b) Review and improve procedures addressing financial management;

c) Workload analysis; skills gap analysis, organizational effectiveness and workforce recruiting strategies;

d) Consulting services to support account reconciliations;

e) Quality assurance reviews and assessments associated with the payments process to ensure that they are in compliance with Federal and State regulations;

f) Risk analysis and identification of options for risk management for the Federal and State grant payment process;

g) Consulting services to reduce the reconciliation backlog for the Request for Reimbursements process; and

h) Consulting services providing Subject Matter Expert (SME) knowledge of required standards for related monitoring and financial standards under the CARES Act and other federal funding, as applicable.

Category 2 – FINANCIAL AUDITING AND GRANT MANAGEMENT

The Contractor shall provide all the following services, as applicable:

a) Plan, implement, administer, coordinate, monitor and evaluate the specific activities of all assigned financial and administrative functions. Develop and modify policies/procedures/systems in accordance with organizational needs and objectives, as well as applicable government regulations;

b) Provide technical knowledge and expertise to review and make recommendations to streamline grant management and fiscal management processes to ensure accountability of funds and compliance with program regulations;

c) Provide tools to be used by Using Agencies for the assessment of the performance of the financial transaction processes;

d) Monitor all grant management, accounting, budget management, and other business office functions regularly;

e) Provide and\or identify training for staff in the area of detection and prevention of fraud, waste and abuse; and

f) Ensure compliance with all applicable Federal and State accounting and financial reporting requirements.

category 3 - INTEGRITY MONITORING/ANTI-FRAUD

Contractors selected from this pool must be able to provide all the following services, as applicable:

a) Forensic accounting and all specialty accounting services;

b) Continuing risk assessments and loss prevention strategies;

c) Performance and program monitoring and promotion of best practices as applicable to each Letter of Engagement issued under this Contract;

d) Prevention, detection and investigation of fraud and misconduct;

e) Implementation and management of appropriate compliance systems and controls required by State and Federal governing guidelines, regulations and law;

f) Provide data management systems/programs for the purpose of collecting, conducting and reporting required compliance and anti-fraud analytics.

The Contractor shall have the ability to provide integrity monitoring services for professional specialties such as engineering and structural integrity services, etc. either directly or through a subcontractor relationship.

DELIVERABLES AND DUE DATES

deliverables

Using the Integrity Monitor Report Template attached at Attachment 2, for each Engagement, the Contractor shall provide the following to the Using Agency:

1) Draft quarterly reports, which shall be due on the last day of the quarter detailing the specific services rendered during that quarter and any findings of waste, fraud or abuse;

2) Final quarterly reports to the State Treasurer, including any comments from the Using Agency, which shall be shared with the GDRO, the Senate President, Speaker of the General Assembly, the Attorney General and the State Comptroller; and

3) Any additional reporting requirements included in the Letter of Engagement.

Deliverable Due Dates

The Contractor shall comply with the deliverable schedule as set forth in the Letter of Engagement by each Using Agency.

REPORTING AND DOCUMENTATION

The Contractor shall provide and submit to the Using Agency and the State Contract Manager all reports and documents as may be necessary to document any services provided including, but not limited to, auditing, compliance, integrity monitoring, oversight and fraud detection and prevention, in accordance with applicable Federal CARES Act, and State requirements.

The Contractor shall retain all records, documents, and communications of any kind (including electronic in disk or print form) that relate in any manner to the award and performance of this contract as required by State and Federal regulations.

The Contractor shall maintain all records related to products, transactions or services under this contract for a minimum period of five (5) years from the date of final payment. Such records shall be made available to the New Jersey Office of the Comptroller, for audit and review, upon request pursuant to N.J.A.C. 17:44-2.2 and disclose to other parties for audit and review. Record retention beyond the five (5) year mark may be necessary and will be directed by the State.

The Contractor shall be responsible for providing protective storage of daily or disaster-related documents and reports used during the provision of services under this RFQ, including but not limited to, audit, compliance, integrity monitoring, oversight and fraud detection and prevention and shall make any documents held available to the State upon request.

Litigation Services

The Contractor shall, at its own cost, fully cooperate with the State and provide all documentation and/or working papers necessary to represent and defend the State and any of its political sub-divisions at its own cost, in any matter before any federal, state or local regulatory agency if any agency files a proceeding against the State or any of its political sub-divisions resulting from the implementation of the contractor(s) recommendations.

Litigation Services shall include a full range of litigation support services applicable to the nature of the Contract, including without limitation, expert witness testimony, strategy development, document discovery, deposition assistance, arbitration consulting, computation of damages, and preparation of trial exhibits.

TRAVEL EXPENSES AND REIMBURSEMENTS

Travel expenses and reimbursements shall be paid to the Contractor in accordance with Circular 20-04-OMB as follows:

The Contractor agrees to adhere to the General Services Administration (GSA) published travel rules and rates including disaster specific amendments in accordance with the Federal Travel Regulations. Reimbursable expenses shall be limited to the following:

1. Coach class air fare purchased at the lowest reasonably available rate and baggage fees, to include consultant deployment and demobilization travel;

1. Meals limited to the maximum current GSA per diem rate (receipts not required but will be supplied funding agencies require same)

1. Lodging limited to the maximum current GSA per diem rate to include GSA approved lodging waivers;

1. Rotation airfare for Contractor employees or approved sub-consultants/subcontractors will be reimbursed based on travel regulations in the above referenced circular policy which limits each individual to a maximum of one (1) extended weekend trip every two (2) weeks, with up to one (1) trip up every quarter being a trip that can extend up to a week in duration; coach class air fare purchased at the lowest reasonably available rate plus baggage fees. Additional rotations or extensions of rotation duration may also be allowed outside of this rotation policy if deemed cost-effective or for client-recognized holidays, as long as they are approved by the State; and

0. e) Mileage for Contractor’s privately owned vehicles at the current New Jersey rate of 35 cents per mile.

SECURITY PLAN

The Contractor shall submit a detailed Security Plan that addresses the Contractor’s approach to meeting each applicable security requirement outlined below, to the State, no later than 30 days after the award of the Contract. The State approval of the Security Plan shall be set forth in writing. In the event that the State reasonably rejects the Security Plan after providing the Contractor an opportunity to cure, the Director may terminate the Contract pursuant to the SSTC.

INFORMATION SECURITY PROGRAM MANAGEMENT

The Contractor shall establish and maintain a framework to provide assurance that information security strategies are aligned with and support the State’s business objectives, are consistent with applicable laws and regulations through adherence to policies and internal controls, and provide assignment of responsibility, in an effort to manage risk. Information security program management shall include, at a minimum, the following:

A. Establishment of a management structure with clear reporting paths and explicit responsibility for information security;

B. Creation, maintenance, and communication of information security policies, standards, procedures, and guidelines to include the control areas listed in sections below;

C. Development and maintenance of relationships with external organizations to stay abreast of current and emerging security issues and for assistance, when applicable; and D. Independent review of the effectiveness of the Contractor’s information security program.

COMPLIANCE

The Contractor shall develop and implement processes to ensure its compliance with all statutory, regulatory, contractual, and internal policy obligations applicable to this Contract. Examples include but are not limited to General Data Protection Regulation (GDPR), Payment Card Industry Data Security Standard (PCI DSS), Health Insurance Portability and Accountability Act of 1996 (HIPAA), IRS-1075. Contractor shall timely update its processes as applicable standards evolve.

A. Within ten (10) days after award, the Contractor shall provide the State with contact information for the individual or individuals responsible for maintaining a control framework that captures statutory, regulatory, contractual, and policy requirements relevant to the organization’s programs of work and information systems;

B. Throughout the solution development process, Contractor shall implement processes to ensure security assessments of information systems are conducted for all significant development and/or acquisitions, prior to information systems being placed into production; and C. The Contractor shall also conduct periodic reviews of its information systems on a defined frequency for compliance with statutory, regulatory, and contractual requirements. The Contractor shall document the results of any such reviews.

PERSONNEL SECURITY

The Contractor shall implement processes to ensure all personnel having access to relevant State information have the appropriate background, skills, and training to perform their job responsibilities in a competent, professional, and secure manner. Workforce security controls shall include, at a minimum:

A. Position descriptions that include appropriate language regarding each role’s security requirements;

B. To the extent permitted by law, employment screening checks are conducted and successfully passed for all personnel prior to beginning work or being granted access to information assets;

C. Rules of behavior are established and procedures are implemented to ensure personnel are aware of and understand usage policies applicable to information and information systems;

D. Access reviews are conducted upon personnel transfers and promotions to ensure access levels are appropriate;

E. Contractor disables system access for terminated personnel and collects all organization owned assets prior to the individual’s departure; and F. Procedures are implemented that ensure all personnel are aware of their duty to protect information assets and their responsibility to immediately report any suspected information security incidents.

SECURITY AWARENESS AND TRAINING

The Contractor shall provide periodic and on-going information security awareness and training to ensure personnel are aware of information security risks and threats, understand their responsibilities, and are aware of the statutory, regulatory, contractual, and policy requirements that are intended to protect information systems and State Confidential Information from a loss of confidentiality, integrity, availability and privacy. Security awareness and training shall include, at a minimum:

· Personnel are provided with security awareness training upon hire and at least annually, thereafter;

· Security awareness training records are maintained as part of the personnel record;

· Role-based security training is provided to personnel with respect to their duties or responsibilities (e.g. network and systems administrators require specific security training in accordance with their job functions); and

· Individuals are provided with timely information regarding emerging threats, best practices, and new policies, laws, and regulations related to information security.

Risk Management

The Contractor shall establish requirements for the identification, assessment, and treatment of information security risks to operations, information, and/or information systems. Risk management requirements shall include, at a minimum:

A. An approach that categorizes systems and information based on their criticality and sensitivity;

B. An approach that ensures risks are identified, documented and assigned to appropriate personnel for assessment and treatment;

C. Risk assessments shall be conducted throughout the lifecycles of information systems to identify, quantify, and prioritize risks against operational and control objectives and to design, implement, and exercise controls that provide reasonable assurance that security objectives will be met; and D. A plan under which risks are mitigated to an acceptable level and remediation actions are prioritized based on risk criteria and timelines for remediation are established. Risk treatment may also include the acceptance or transfer of risk.

Privacy

· Data Ownership. The State is the data owner. Contractor shall not obtain any right, title, or interest in any of the data furnished by the State, or information derived from or based on State data.

· Data usage, storage, and protection of PII and State Confidential Information, as defined in Section 5.8 are subject to all applicable international, federal and state statutory and regulatory requirements, as amended from time to time, including, without limitation, those for HIPAA, Tax Information Security Guidelines for Federal, State, and Local Agencies (IRS Publication 1075), New Jersey State tax confidentiality statute, the New Jersey Privacy Notice found at NJ.gov, N.J.S.A. § 54:50-8, New Jersey Identity Theft Prevention Act, N.J.S.A. § 56:11-44 et. seq., the federal Drivers’ Privacy Protection Act of 1994, Pub.L.103-322, and the confidentiality requirements of N.J.S.A. § 39:2-3.4. Contractor shall also conform to PCI DSS, where applicable.

· Security: Contractor agrees to take appropriate administrative, technical and physical safeguards reasonably designed to protect the security, privacy, confidentiality, and integrity of user information. Contractor shall ensure that PII and other State Confidential Information is secured and encrypted during transmission or at rest.

· Data Transmission: The Contractor shall only transmit or exchange State of New Jersey data with other parties when expressly requested in writing and permitted by and in accordance with requirements of the Contract or the State of New Jersey.