_IFB_AGY-21-038-IT.pdf

STATE OF MARYLAND

MARLAND DEPARTMENT OF TRANSPORTATION

MARYLAND TRANSIT AUTHORITY

MDOT MTA

INVITATION FOR BIDS (IFB)

BANK NOTE ACCEPTOR OVERHAUL (LEVEL IV)

Solicitation #: AGY-21-038-IT

ISSUE DATE: February 24, 2021

NOTICE

A Prospective Bidder that has received this document from a source other than eMarylandMarketplace

(eMMA) https://procurement.maryland.gov should register on eMMA. See Section 3.2.

MINORITY BUSINESS ENTERPRISES ARE ENCOURAGED TO

RESPOND TO THIS SOLICITATION.

BANK NOTE ACCEPTOR OVERHAUL (LEVEL IV)

Solicitation #: AGY-21-038-IT

NO BID NOTICE/VENDOR FEEDBACK FORM

To help us improve the quality of State solicitations, and to make our procurement process more responsive and business friendly, please provide comments and suggestions regarding this solicitation.

Please return your comments with your response. If you have chosen not to respond to this solicitation, please email or fax this completed form to the attention of the Procurement Officer (see Key Information Summary Sheet below for contact information).

Title: Bank Note Acceptor Level IV Overhaul and Repair Solicitation No: AGY-21-038-IT

1. If you have chosen not to respond to this solicitation, please indicate the reason(s) below:

� Other commitments preclude our participation at this time

� The subject of the solicitation is not something we ordinarily provide

� We are inexperienced in the work/commodities required

� Specifications are unclear, too restrictive, etc. (Explain in REMARKS section)

� The scope of work is beyond our present capacity

� Doing business with the State is simply too complicated. (Explain in REMARKS section)

� We cannot be competitive. (Explain in REMARKS section)

� Time allotted for completion of the Bid is insufficient

� Start-up time is insufficient

� Bonding/Insurance requirements are restrictive (Explain in REMARKS section)

� Bid requirements (other than specifications) are unreasonable or too risky (Explain in REMARKS section)

� MBE or VSBE requirements (Explain in REMARKS section)

� Prior State of Maryland contract experience was unprofitable or otherwise unsatisfactory.

(Explain in REMARKS section)

� Payment schedule too slow

� Other: __________________________________________________________________

2. If you have submitted a response to this solicitation, but wish to offer suggestions or express concerns, please use the REMARKS section below. (Attach additional pages as needed.)

REMARKS:

Vendor Name: ________________________________ Date: _______________________

Contact Person: _________________________________ Phone (____) _____ - _________________

Address: ______________________________________________________________________

E-mail Address: ________________________________________________________________

BANK NOTE ACCEPTOR OVERHAUL (LEVEL IV)

STATE OF MARYLAND

MARYAND DEPARTMENT OF TRANSPORTATION

MARYLAND TRANSIT AUTHORITY

(MDOT MTA)

KEY INFORMATION SUMMARY SHEET

Invitation for Bids Maintenance

Bank Note Acceptor Level IV Overhaul And Repair

Solicitation Number: AGY-21-038-IT

IFB Issue Date: February 24, 2021

IFB Issuing Office: Maryland Department of Transportation Maryland Transit Authority

(MDOT MTA)

Procurement Officer: Darica Lawson 6 St. Paul Street Baltimore, MD 21202 e-mail:

Office Phone:

dlawson@mdot.maryland.gov 410-767-3763

Bids are to be sent to: Submit Via eMMA https://emma.maryland.gov

Pre-Bid Conference: March 3, 2021 at 10am via Microsoft Teams Please send emails for attendance to Procurement Officer, dlawson@mdot.maryland.gov by 2pm on 3/2

Questions Due Date and Time March 22, 2021 at 2pm

Bid Due (Closing) Date and Time:

March 30,2021 at 2pm Bidders are reminded that a completed Feedback Form is requested if a no-bid decision is made.

Public Bid Opening Date, Time and Location

March 30, 2021 3:00 pm via Microsoft Teams Please send emails for attendance to Procurement Officer, dlawson@mdot.maryland.gov by 2pm on 3/29

MBE Subcontracting Goal: N/A

VSBE Subcontracting Goal: N/A

Contract Type: Firm Fixed Price; Firm Fixed Price with cost adjustment

Contract Duration: 3 years

SBR Designation: No

Federal Funding: No

BANK NOTE ACCEPTOR OVERHAUL (LEVEL IV)

Solicitation #: AGY-21-038-IT mailto:dlawson@mdot.maryland.gov https://emma.maryland.gov/ mailto:dlawson@mdot.maryland.gov

1 Minimum Qualifications

1.1 Bidder Minimum Qualifications

To be considered responsive, the Bidder must document in its Bid that it satisfies the following Minimum Qualifications:

1.1.1 The Bidder must be certified by the Original Equipment Manufacturer (Mars Electronics International) as a certified / qualified repair facility for the MEI BNA57 bank note acceptor.

Required Documentation: As proof of meeting this requirement, the Bidder shall provide with its Bid proof of certification as furnished by Mars Electronics International.

THE REMAINDER OF THIS PAGE IS INTENTIONALLY LEFT BLANK.

BANK NOTE ACCEPTOR OVERHAUL (LEVEL IV)

2 Contractor Requirements: Scope of Work

2.1 Summary Statement

The Maryland Department of Transportation Maryland Transit Administration (MDOT MTA) is issuing this Invitation for Bids (IFB) in order to procure the services defined in this Section 2, as specified in this IFB, from a contract between the successful bidder(s) and the MDOT MTA: The MEI BNA57 note acceptor is an integral part of the Cubic Transportation System Model 9383-1000 Ticket Vending Machine which is used in the Baltimore Metro and Light Rail Systems to vend tickets to the public. The MEI BNA57 Bank Note Acceptor is to be overhauled within the provisions set forth in this solicitation using only OEM certified parts and OEM trained / certified personnel.

2.1.1 It is the State’s intention to obtain goods and services, as specified in this IFB, from a Contract between the selected Bidder and the State.

2.1.2 The Administration intends to make a single award for the work under this IFB. See IFB Section

4.9 Award Basis for more Contract award information.

2.1.3 A Bidder, either directly or through its subcontractor(s), must be able to provide all goods and services and meet all of the requirements requested in this solicitation and the successful Bidder (the Contractor) shall remain responsible for Contract performance regardless of subcontractor participation in the work.

2.1.4 Maryland State and local entities as defined in Finance and Procurement §13-110(a) and nonprofit entities within the State of Maryland may purchase from the Contractor goods or services covered by the Contract at the same prices chargeable to the State. All such purchases by non-executive branch entities, non-State governments, government agencies or nonprofit entities:

Shall constitute Contracts between the Contractor and that entity;

Shall not constitute purchases by the State or State agencies under the Contract;

Shall not be binding or enforceable against the State; and

May be subject to other terms and conditions agreed to by the Contractor and the purchaser.

2.1.5 All Contract prices, terms, and conditions must be provided to any Maryland local government or nonprofit entity requesting services under the Contract. The Contractor bears the risk of determining whether or not a government, agency or organization with which the Contractor is dealing is a State entity.

2.2 Background and Purpose

a) The Term of contract is 3 years. The vendor must agree to a firm fixed price for labor for the duration of the contract.

b) The vendor must be certified by the Original Equipment Manufacturer (Mars Electronics International) as a certified / qualified vendor / repair facility for the MEI BNA57 bank note acceptor.

c) The equipment will be shipped to the qualifying vendor at a rate of 8 units per month over the term of the contract. It is expected that the vendor will complete work on each group of units and return them to the MDOT MTA at the same corresponding rate, 8 units per month.

BANK NOTE ACCEPTOR OVERHAUL (LEVEL IV)

d) Shipping costs, including insurance protection of the shipped units from the MDOT MTA to the vendors location, will be borne by the vendor and should be included as part of the “overhaul rate per BHU” on the bid submittal work sheet.

e) Return shipping costs, including insurance protection of the shipped units from the vendors location to the MDOT MTA, will be borne by the vendor and should be included as part of the “overhaul rate per BHU” on the bid submittal work sheet.

f) All shipping costs, to and from the vendors location, incurred as a result of a valid Warranty Claim shall be borne by the vendor.

g) Each unit will be dismantled, cleaned, inspected and evaluated for functionality.

h) All bearings, rollers, belts, O rings and axels #5, #6 & #17 and associated parts will be replaced per a LEVEL 4 overhaul. All parts used in overhaul repair must be from OEM, please refer to Appendix 3 for part numbers. All pricing should be prepared using Appendix 3.

i) The vendor will provide and install the most current Bank Note Software Variant in each unit prior to testing.

j) Should any parts be found defective that are not covered by the overhaul, the vendor will prepare an estimate of cost to affect the repairs and submit it to the designated MDOT MTA representative for approval prior to proceeding with the out of scope repairs. The MDOT MTA may elect to defer such recommended repairs in which case the vendor will complete the work that it has been contracted for and return the unit to the MDOT MTA in an “as-is” condition without the burden of warranting the functionality of the unit.

k) The vendor shall commit to maintaining the cost of any additional parts to be within a discounted percentage of the current OEM (MEI) parts list price that will be valid for the duration of the contract.

l) Each Unit will be completely reassembled and fully functionally tested prior to shipment to the

MDOT MTA.

m) Vendor will affix a sticker to each unit that bears the date the work was satisfactorily completed.

n) The vendor shall warranty all repairs for 180 days from the date stated on the sticker affixed to each device.

o) Delivery of the finished units shall be made to:

MDOT Maryland Transit Administration Attention: Chief of Maintenance 6000 Metro Drive Suite 108 Baltimore, Maryland 21215

BANK NOTE ACCEPTOR OVERHAUL (LEVEL IV)

Contractor Requirements: General

2.3 Contract Initiation Requirements

THIS SECTION IS INAPPLICABLE TO THIS IFB.

2.4 End of Contract Transition

2.4.1 The Contractor shall provide transition assistance as requested by the State to facilitate the orderly transfer of services to the State or a follow-on contractor, for a period up to 60 days prior to Contract end date, or the termination thereof. Such transition efforts shall consist, not by way of limitation, of:

a) Provide additional services and support as requested to successfully complete the transition;

b) Maintain the services called for by the Contract at the required level of proficiency;

c) Provide updated System Documentation (see Appendix 1), as appropriate; and

d) Provide current operating procedures (as appropriate).

2.4.2 The Contractor shall work toward a prompt and timely transition, proceeding in accordance with the directions of the Contract Monitor. The Contract Monitor may provide the Contractor with additional instructions to meet specific transition requirements prior to the end of the Contract.

2.4.3 The Contractor shall ensure that all necessary knowledge and materials for the tasks completed are transferred to the custody of State personnel or a third party, as directed by the Contract Monitor.

2.4.4 The Contractor shall support end-of-Contract transition efforts with technical and project support to include but not be limited to:

a) The Contractor shall provide a draft Transition-Out Plan 120 Business Days in advance of Contract end date.

The Transition-Out Plan shall address at a minimum the following areas:

1) Any staffing concerns/issues related to the closeout of the Contract;

2) Communications and reporting process between the Contractor, the Administration and the Contract Monitor;

3) Security and system access review and closeout;

4) Any hardware/software inventory or licensing including transfer of any point of contact for required software licenses to the Administration or a designee;

5) Any final training/orientation of the Administration’s staff;

6) Connectivity services provided, activities and approximate timelines required for Transition-Out;

7) Knowledge transfer, to include:

a) A working knowledge of the current system environments;

b) Review with the Administration the procedures and practices that support the business process and current system environments;

c) Working knowledge of all technical and functional matters associated with the solution, its architecture, data file structure, interfaces, any batch

BANK NOTE ACCEPTOR OVERHAUL (LEVEL IV)

programs, and any hardware or software tools utilized in the performance of the Contract;

d) Documentation that lists and describes all hardware and software tools utilized in the performance of the Contract;

8) Plans to complete tasks and any unfinished work items (including open change requests, and known bug/issues); and

9) Any risk factors with the timing and the Transition-Out schedule and transition process. The Contractor shall document any risk factors and suggested solutions.

The Contractor shall ensure all documentation and data including, but not limited to, System Documentation and current operating procedures, is current and complete with a hard and soft copy in a format prescribed by the Contract Monitor.

The Contractor shall provide copies of any current daily and weekly back-ups to the Administration or a third party as directed by the Contract Monitor as of the final date of transition, but no later than the final date of the Contract.

Access to any data or configurations of the furnished product and services shall be available after the expiration of the Contract as described in Section 3.2.5.

2.4.5 Return and Maintenance of State Data

a) Upon termination or the expiration of the Contract Term, the Contractor shall: (a) return to the State all State data in either the form it was provided to the Contractor or in a mutually agreed format along with the schema necessary to read such data; (b) preserve, maintain, and protect all State data until the earlier of a direction by the State to delete such data or the expiration of 90 days (“the retention period”) from the date of termination or expiration of the Contract term; (c) after the retention period, the Contractor shall securely dispose of and permanently delete all State data in all of its forms, such as disk, CD/DVD, backup tape and paper such that it is not recoverable, according to National Institute of Standards and Technology (NIST)-approved methods with certificates of destruction to be provided to the State; and (d) prepare an accurate accounting from which the State may reconcile all outstanding accounts. The final monthly invoice for the services provided hereunder shall include all charges for the 90-day data retention period.

b) During any period of service suspension, the Contractor shall maintain all State data in its then existing form, unless otherwise directed in writing by the Contract Monitor.

c) In addition to the foregoing, the State shall be entitled to any post-termination/expiration assistance generally made available by Contractor with respect to the services.

2.5 Invoicing

2.5.1 General

a) The Contractor shall e-mail the original of each invoice and signed authorization to invoice to the Contract Monitor at e-mail address: SSmith2@mdot.maryland.gov .

b) Each invoice should also be sent to Accounts Payable:

mtaaccountspayable@mta.maryland.gov

All invoices for services shall be verified by the Contractor as accurate at the time of submission.

BANK NOTE ACCEPTOR OVERHAUL (LEVEL IV)

Solicitation #: AGY-21-038-IT mailto:SSmith2@mdot.maryland.gov mailto:mtaaccountspayable@mta.maryland.gov

An invoice not satisfying the requirements of a Proper Invoice (as defined in COMAR 21.06.09) cannot be processed for payment. To be considered a Proper Invoice, invoices must include the following information, without error:

1) Contractor name and address;

2) Remittance address;

3) Federal taxpayer identification (FEIN) number, social security number, as appropriate;

4) Invoice period (i.e. time period during which services covered by invoice were performed);

5) Invoice date;

6) Invoice number;

7) State assigned Contract number;

8) Repair Unit Serial Number

9) State assigned (Blanket) Purchase Order number(s);

10) Goods or services provided;

11) Amount due; and

12) Any additional documentation required by regulation or the Contract;

including a current CPI list .

Invoices that contain both fixed price and time and material items shall clearly identify each item as either fixed price or time and material billing.

The Administration reserves the right to reduce or withhold Contract payment in the event the Contractor does not provide the Administration with all required deliverables within the time frame specified in the Contract or otherwise breaches the terms and conditions of the Contract until such time as the Contractor brings itself into full compliance with the Contract.

Any action on the part of the Administration, or dispute of action by the Contractor, shall be in accordance with the provisions of Md. Code Ann., State Finance and Procurement Article §§ 15-215 through 15-223 and with COMAR 21.10.04.

The State is generally exempt from federal excise taxes, Maryland sales and use taxes, District of Columbia sales taxes and transportation taxes. The Contractor, however, is not exempt from such sales and use taxes and may be liable for the same.

Invoices for final payment shall be clearly marked as “FINAL” and submitted when all work requirements have been completed and no further charges are to be incurred under the Contract. In no event shall any invoice be submitted later than 60 calendar days from the Contract termination date.

2.5.2 Invoice Submission Schedule

The Contractor shall submit invoices in accordance with the following schedule:

a) For items of work for which there is one-time pricing (see Attachment B –Bid Form) those items shall be billed in the month following the acceptance of the work by the Administration

b) For items of work for which there is annual pricing, see Attachment B–Bid Form, those items shall be billed in equal monthly installments for the applicable Contract year in the month following the performance of the services.

BANK NOTE ACCEPTOR OVERHAUL (LEVEL IV)

2.5.3 Deliverable Invoicing

a) Deliverable invoices shall be accompanied by notice(s) of acceptance issued by the State for all invoices submitted for payment. Payment of invoices will be withheld if a signed DPAF is not submitted (see online example at http://doit.maryland.gov/contracts/Documents/_procurementForms/DeliverableProductAcce ptanceForm-DPAFsample.pdf).

Payment for deliverables will only be made upon completion and acceptance of the deliverables as defined in Section 2.

2.5.4 Time and Materials Invoicing

a) All time and material invoices shall be accompanied by a signed timesheet as described below and notice(s) of acceptance issued by the State: DPAF for each time period invoiced (see online example at http://doit.maryland.gov/contracts/Documents/_procurementForms/DeliverableProductAcce ptanceForm-DPAFsample.pdf)>>. Include for each person covered by the invoice the following, individually listed per person: name, hours worked, hourly labor rate, invoice amount and a copy of each person’s timesheet for the period signed by the Contract Monitor.

Time Sheet Reporting

Within three (3) Business Days after the 15th and last day of the month, the Contractor shall submit a semi-monthly timesheet for the preceding half month providing data for all Contractor Personnel / employees / resources working under the Contract.

At a minimum, each semi-monthly timesheet shall show:

1) Title: “Time Sheet for “xxxxx”;

2) Issuing company name, address, and telephone number;

3) For each Contractor employee /resource:

a) Contractor employee / resource name, and

b) For each period ending date, e.g., “Period Ending: mm/dd/yyyy” (Periods run 1st through 15th, and 16th through last day of the month.):

i) Tasks completed that week and the associated deliverable names and ID#s;

ii) Number of hours worked each day;

iii) Total number of hours worked that Period;

iv) Period variance above or below 40 hours;

v) Annual number of hours planned under the Task Order;

vi) Annual number of hours worked to date; and

vii) Balance of hours remaining;

4) Annual variance to date (Sum of periodic variances); and

5) Signature and date lines for the Contract Monitor.

Time sheets shall be submitted to the Contract Monitor prior to invoicing. The Contract Monitor shall sign the timesheet to indicate authorization to invoice.

2.5.5 For the purposes of the Contract an amount will not be deemed due and payable if:

BANK NOTE ACCEPTOR OVERHAUL (LEVEL IV)

a) The amount invoiced is inconsistent with the Contract;

b) The proper invoice has not been received by the party or office specified in the Contract;

c) The invoice or performance is in dispute or the Contractor has failed to otherwise comply with the provisions of the Contract;

d) The item or services have not been accepted;

e) The quantity of items delivered is less than the quantity ordered;

f) The items or services do not meet the quality requirements of the Contract;

g) If the Contract provides for progress payments, the proper invoice for the progress payment has not been submitted pursuant to the schedule;

h) If the Contract provides for withholding a retainage and the invoice is for the retainage, all stipulated conditions for release of the retainage have not been met; or

i) The Contractor has not submitted satisfactory documentation or other evidence reasonably required by the Procurement Officer or by the Contract concerning performance under the Contract and compliance with its provisions.

2.5.6 Travel Reimbursement

Travel will not be reimbursed under this IFB.

2.6 Liquidated Damages

2.6.1 MBE Liquidated Damages

Inapplicable because there is no MBE goal for this IFB.

2.6.2 Liquidated Damages other than MBE

THIS SECTION IS INAPPLICABLE TO THIS IFB.

2.7 Disaster Recovery and Data

The contractor will not have access to State data

2.8 Insurance Requirements

The Contractor shall maintain, at a minimum, the insurance coverages outlined below, or any minimum requirements established by law if higher, for the duration of the Contract, including option periods, if exercised:

2.8.1 The following type(s) of insurance and minimum amount(s) of coverage are required:

a) Commercial General Liability - of $1,000,000 combined single limit per occurrence for bodily injury, property damage, and personal and advertising injury and $3,000,000 annual aggregate. The minimum limits required herein may be satisfied through any combination of primary and umbrella/excess liability policies.

b) Crime Insurance/Employee Theft Insurance - to cover employee theft with a minimum single loss limit of $1,000,000 per loss, and a minimum single loss retention not to exceed $10,000. The State of Maryland and the Administration should be added as a “loss payee.”

c) Worker’s Compensation - The Contractor shall maintain such insurance as necessary or as required under Workers’ Compensation Acts, the Longshore and Harbor Workers’ Compensation Act, and the Federal Employers’ Liability Act, to not be less than. one million

BANK NOTE ACCEPTOR OVERHAUL (LEVEL IV)

dollars ($1,000,000) per occurrence (unless a state’s law requires a greater amount of coverage). Coverage must be valid in all states where work is performed.

d) Automobile or Commercial Truck Insurance - The Contractor shall maintain Automobile or Commercial Truck Insurance (including owned, leased, hired, and non-owned vehicles) as appropriate with Liability, Collision, and PIP limits no less than those required by the State where the vehicle(s) is registered, but in no case less than those required by the State of Maryland.

2.8.2 The State shall be listed as an additional insured on the faces of the certificates associated with the coverages listed above, including umbrella policies, excluding Workers’ Compensation Insurance and professional liability.

2.8.3 All insurance policies shall be endorsed to include a clause requiring the insurance carrier provide the Procurement Officer, by certified mail, not less than 30 days’ advance notice of any non-renewal, cancellation, or expiration. The Contractor shall notify the Procurement Officer in writing, if policies are cancelled or not renewed within five (5) days of learning of such cancellation or nonrenewal. The Contractor shall provide evidence of replacement insurance coverage to the Procurement Officer at least 15 days prior to the expiration of the insurance policy then in effect.

2.8.4 Any insurance furnished as a condition of the Contract shall be issued by a company authorized to do business in the State.

2.8.5 The recommended awardee must provide current certificate(s) of insurance with the prescribed coverages, limits and requirements set forth in this section within five (5) Business Days from notice of recommended award. During the period of performance for multi-year contracts, the Contractor shall provide certificates of insurance annually, or as otherwise directed by the Contract Monitor.

2.8.6 The Contractor shall require any subcontractors to obtain and maintain comparable levels of coverage and shall provide the Contract Monitor with the same documentation as is required of the Contractor.

2.9 Security Requirements

The following requirements are applicable to the Contract:

2.9.1 Employee Identification

a) Contractor Personnel shall display his or her company ID badge in a visible location at all times while on State premises. Upon request of authorized State personnel, each Contractor Personnel shall provide additional photo identification.

b) Contractor Personnel shall cooperate with State site requirements, including but not limited to, being prepared to be escorted at all times, and providing information for State badge issuance.

c) Contractor shall remove any Contractor Personnel from working on the Contract where the State determines, in its sole discretion, that Contractor Personnel has not adhered to the Security requirements specified herein.

d) The State reserves the right to request that the Contractor submit proof of employment authorization of non-United States Citizens, prior to commencement of work under the Contract.

2.9.2 Security Clearance / Criminal Background Check

BANK NOTE ACCEPTOR OVERHAUL (LEVEL IV)

A security clearance is not required for Contractor Personnel assigned to the Contract.

2.9.3 On-Site Security Requirement(s)

THIS SECTION IS INAPPLICABLE TO THIS IFB.

2.9.4 Information Technology

(a) Contractors shall comply with and adhere to the State IT Security Policy and Standards.

These policies may be revised from time to time and the Contractor shall comply with all such revisions. Updated and revised versions of the State IT Policy and Standards are available online at: www.doit.maryland.gov – keyword: Security Policy.

(b) The Contractor shall not connect any of its own equipment to a State LAN/WAN without prior written approval by the State. The Contractor shall complete any necessary paperwork as directed and coordinated with the Contract Monitor to obtain approval by the State to connect Contractor-owned equipment to a State LAN/WAN.

The Contractor shall:

1) Implement administrative, physical, and technical safeguards to protect State data that are no less rigorous than accepted industry best practices for information security such as those listed below (see Section 3.7.5);

2) Ensure that all such safeguards, including the manner in which State data is collected, accessed, used, stored, processed, disposed of and disclosed, comply with applicable data protection and privacy laws as well as the terms and conditions of the Contract; and

3) The Contractor, and Contractor Personnel, shall (i) abide by all applicable federal, State and local laws, rules and regulations concerning security of Information Systems and Information Technology and (ii) comply with and adhere to the State IT Security Policy and Standards as each may be amended or revised from time to time. Updated and revised versions of the State IT Policy and Standards are available online at: www.doit.maryland.gov – keyword: Security Policy.

2.9.5 Data Protection and Controls

A. Contractor shall ensure a secure environment for all State data and any hardware and software (including but not limited to servers, network and data components) provided or used in connection with the performance of the Contract and shall apply or cause application of appropriate controls so as to maintain such a secure environment (“Security Best Practices”).

Such Security Best Practices shall comply with an accepted industry standard, such as the NIST cybersecurity framework.

B. To ensure appropriate data protection safeguards are in place, the Contractor shall implement and maintain the following controls at all times throughout the Term of the Contract (the Contractor may augment this list with additional controls):

1) Establish separate production, test, and training environments for systems supporting the services provided under the Contract and ensure that production data is not replicated in test or training environment(s) unless it has been previously anonymized or otherwise modified to protect the confidentiality of Sensitive Data elements. The Contractor shall ensure the appropriate separation of production and non-production environments by applying the data protection and control requirements listed in Section 3.7.5.

BANK NOTE ACCEPTOR OVERHAUL (LEVEL IV)

Solicitation #: AGY-21-038-IT http://www.doit.maryland.gov/

2) Apply hardware and software hardening procedures as recommended by Center for Internet Security (CIS) guides https://www.cisecurity.org/, Security Technical Implementation Guides (STIG) http://iase.disa.mil/Pages/index.aspx, or similar industry best practices to reduce the systems’ surface of vulnerability, eliminating as many security risks as possible and documenting what is not feasible or not performed according to best practices. Any hardening practices not implemented shall be documented with a plan of action and milestones including any compensating control. These procedures may include but are not limited to removal of unnecessary software, disabling or removing unnecessary services, removal of unnecessary usernames or logins, and the deactivation of unneeded features in the Contractor’s system configuration files.

3) Ensure that State data is not comingled with non-State data through the proper application of compartmentalization Security Measures.

4) Apply data encryption to protect Sensitive Data at all times, including in transit, at rest, and also when archived for backup purposes. Unless otherwise directed, the Contractor is responsible for the encryption of all Sensitive Data.

5) For all State data the Contractor manages or controls, data encryption shall be applied to such data in transit over untrusted networks.

6) Encryption algorithms which are utilized for encrypting data shall comply with current Federal Information Processing Standards (FIPS), “Security Requirements for Cryptographic Modules”, FIPS PUB 140-2:

http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401vend.htm

7) Enable appropriate logging parameters to monitor user access activities, authorized and failed access attempts, system exceptions, and critical information security events as recommended by the operating system and application manufacturers and information security standards, including Maryland Department of Information Technology’s Information Security Policy.

8) Retain the aforementioned logs and review them at least daily to identify suspicious or questionable activity for investigation and documentation as to their cause and remediation, if required. The Administration shall have the right to inspect these policies and procedures and the Contractor or subcontractor’s performance to confirm the effectiveness of these measures for the services being provided under the Contract.

9) Ensure system and network environments are separated by properly configured and updated firewalls.

10) Restrict network connections between trusted and untrusted networks by physically or logically isolating systems from unsolicited and unauthenticated network traffic.

11) By default “deny all” and only allow access by exception.

12) Review, at least annually, the aforementioned network connections, documenting and confirming the business justification for the use of all service, protocols, and ports allowed, including the rationale or compensating controls implemented for those protocols considered insecure but necessary.

13) Perform regular vulnerability testing of operating system, application, and network devices. Such testing is expected to identify outdated software versions; missing

BANK NOTE ACCEPTOR OVERHAUL (LEVEL IV)

Solicitation #: AGY-21-038-IT http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401vend.htm software patches; device or software misconfigurations; and to validate compliance with or deviations from the security policies applicable to the Contract. Contractor shall evaluate all identified vulnerabilities for potential adverse effect on security and integrity and remediate the vulnerability no later than 30 days following the earlier of vulnerability’s identification or public disclosure, or document why remediation action is unnecessary or unsuitable. The Administration shall have the right to inspect the Contractor’s policies and procedures and the results of vulnerability testing to confirm the effectiveness of these measures for the services being provided under the Contract.

14) Enforce strong user authentication and password control measures to minimize the opportunity for unauthorized access through compromise of the user access controls. At a minimum, the implemented measures should be consistent with the most current Maryland Department of Information Technology’s Information Security Policy (http://doit.maryland.gov/support/Pages/SecurityPolicies.aspx), including specific requirements for password length, complexity, history, and account lockout.

15) Ensure State data is not processed, transferred, or stored outside of the United States (“U.S.”). The Contractor shall provide its services to the State and the State’s end users solely from data centers in the U.S. Unless granted an exception in writing by the State, the Contractor shall not allow Contractor Personnel to store State data on portable devices, including personal computers, except for devices that are used and kept only at its U.S. data centers. The Contractor shall permit its Contractor Personnel to access State data remotely only as required to provide technical support.

16) Ensure Contractor’s Personnel shall not connect any of its own equipment to a State LAN/WAN without prior written approval by the State, which may be revoked at any time for any reason. The Contractor shall complete any necessary paperwork as directed and coordinated with the Contract Monitor to obtain approval by the State to connect Contractor -owned equipment to a State LAN/WAN.

17) Ensure that anti-virus and anti-malware software is installed and maintained on all systems supporting the services provided under the Contract; that the anti-virus and anti-malware software is automatically updated; and that the software is configured to actively scan and detect threats to the system for remediation. The Contractor shall perform routine vulnerability scans and take corrective actions for any findings.

18) Conduct regular external vulnerability testing designed to examine the service provider’s security profile from the Internet without benefit of access to internal systems and networks behind the external security perimeter. Evaluate all identified vulnerabilities on Internet-facing devices for potential adverse effect on the service’s security and integrity and remediate the vulnerability promptly or document why remediation action is unnecessary or unsuitable. The Administration shall have the right to inspect these policies and procedures and the performance of vulnerability testing to confirm the effectiveness of these measures for the services being provided under the Contract.

2.9.6 Security Logs and Reports Access

a) For a SaaS or non-State hosted solution, the Contractor shall provide reports to the State in a mutually agreeable format.

BANK NOTE ACCEPTOR OVERHAUL (LEVEL IV)

Solicitation #: AGY-21-038-IT http://doit.maryland.gov/support/Pages/SecurityPolicies.aspx

b) Reports shall include latency statistics, user access, user access IP address, user access history and security logs for all State files related to the Contract.

2.9.7 Security Plan

a) The Contractor shall protect State data according to a written security policy (“Security Plan”) no less rigorous than that of the State, and shall supply a copy of such policy to the State for validation, with any appropriate updates, on an annual basis.

The Security Plan shall detail the steps and processes employed by the Contractor as well as the features and characteristics which will ensure compliance with the security requirements of the Contract.

The Security Plan shall address compliance with the PCI DSS for payment card processing).

If any Security Plan information, including procedures, are different based on a Task Order, Contractor shall furnish such differences to the respective TO Manager.

2.9.8 PCI Compliance

A. Contractor shall at all times comply, and ensure compliance with, all applicable Payment Card Industry ("PCI") Data Security Standards (“DSS”), including any and all changes thereto. Contractor shall provide the Administration with documented evidence of current compliance to PCI DSS within 30 days following a request from the Administration.

B. The Contractor shall annually furnish to the State evidence of the PCI Security Standards Council’s (SSC) acceptance or attestation of the Contractor’s conformance to the relevant PCI DSS requirements by a third party certified to perform compliance assessments.

C. The Contractor shall ensure that the scope of the annual SOC 2 Type II Report specified under Section 3.9 includes testing to confirm the PCI assessment results.

2.9.9 Security Incident Response

A. The Contractor shall notify the Administration in accordance with Section 3.7.9A-D when any Contractor system that may access, process, or store State data or State systems experiences a Security Incident or a Data Breach as follows:

1) notify the Administration within twenty-four (24) hours of the discovery of a Security Incident by providing notice via written or electronic correspondence to the Contract Monitor, MDOT MTA chief information officer and MDOT MTA chief information security officer;

2) notify the Administration within two (2) hours if there is a threat to Contractor’s solution as it pertains to the use, disclosure, and security of State data; and

3) provide written notice to the Administration within one (1) Business Day after Contractor’s discovery of unauthorized use or disclosure of State data and thereafter all information the State (or Administration) requests concerning such unauthorized use or disclosure.

B. Contractor’s notice shall identify:

1) the nature of the unauthorized use or disclosure;

2) the State data used or disclosed,

3) who made the unauthorized use or received the unauthorized disclosure;

4) what the Contractor has done or shall do to mitigate any deleterious effect of the unauthorized use or disclosure; and

BANK NOTE ACCEPTOR OVERHAUL (LEVEL IV)

5) what corrective action the Contractor has taken or shall take to prevent future similar unauthorized use or disclosure.

6) The Contractor shall provide such other information, including a written report, as reasonably requested by the State.

C. The Contractor may need to communicate with outside parties regarding a Security Incident, which may include contacting law enforcement, fielding media inquiries and seeking external expertise as mutually agreed upon, defined by law or contained in the Contract. Discussing Security Incidents with the State should be handled on an urgent as-needed basis, as part of Contractor communication and mitigation processes as mutually agreed upon, defined by law or contained in the Contract.

D. The Contractor shall comply with all applicable laws that require the notification of individuals in the event of unauthorized release of State data or other event requiring notification, and, where notification is required, assume responsibility for informing all such individuals in accordance with applicable law and to indemnify and hold harmless the State (or Administration) and its officials and employees from and against any claims, damages, and actions related to the event requiring notification.

2.9.10 Data Breach Responsibilities

A. If the Contractor reasonably believes or has actual knowledge of a Data Breach, the Contractor shall, unless otherwise directed:

1) Notify the appropriate State-identified contact within 24 hours by telephone in accordance with the agreed upon security plan or security procedures unless a shorter time is required by applicable law;

2) Cooperate with the State to investigate and resolve the data breach;

3) Promptly implement commercially reasonable remedial measures to remedy the Data Breach; and

4) Document responsive actions taken related to the Data Breach, including any post-incident review of events and actions taken to make changes in business practices in providing the services.

B. If a Data Breach is a direct result of the Contractor’s breach of its Contract obligation to encrypt State data or otherwise prevent its release, the Contractor shall bear the costs associated with (1) the investigation and resolution of the data breach; (2) notifications to individuals, regulators or others required by State law; (3) a credit monitoring service required by State or federal law; (4) a website or a toll-free number and call center for affected individuals required by State law; and (5) complete all corrective actions as reasonably determined by Contractor based on root cause; all [(1) through (5)] subject to the Contract’s limitation of liability.

2.9.11 Additional security requirements may be established in a Task Order and/or a Work Order.

2.9.12 The State shall, at its discretion, have the right to review and assess the Contractor’s compliance to the security requirements and standards defined in the Contract.

2.9.13 Provisions in Sections 2.9 – 2.9.10 shall survive expiration or termination of the Contract.

Additionally, the Contractor shall flow down the provisions of Sections 2.9.4 -- 2.9.10 (or the substance thereof) in all subcontracts.

BANK NOTE ACCEPTOR OVERHAUL (LEVEL IV)

2.10 Problem Escalation Procedure

2.10.1 The Contractor must provide and maintain a Problem Escalation Procedure (PEP) for both routine and emergency situations. The PEP must state how the Contractor will address problem situations as they occur during the performance of the Contract, especially problems that are not resolved to the satisfaction of the State within appropriate timeframes.

2.10.2 The Contractor shall provide contact information to the Contract Monitor, as well as to other State personnel as directed should the Contract Monitor not be available.

2.10.3 The Contractor shall provide the PEP no later than ten (10) Business Days after notice of recommended award or after the date of the Notice to Proceed, whichever is earlier. The PEP, including any revisions thereto, must also be provided within ten (10) Business Days after the start of each Contract year and within ten (10) Business Days after any change in circumstance which changes the PEP. The PEP shall detail how problems with work under the Contract will be escalated in order to resolve any issues in a timely manner. The PEP shall include:

a) The process for establishing the existence of a problem;

b) Names, titles, and contact information for progressively higher levels of personnel in the Contractor’s organization who would become involved in resolving a problem;

c) For each individual listed in the Contractor’s PEP, the maximum amount of time a problem will remain unresolved with that individual before the problem escalates to the next contact person listed in the Contractor’s PEP;

d) Expedited escalation procedures and any circumstances that would trigger expediting them;

e) The method of providing feedback on resolution progress, including the frequency of feedback to be provided to the State;

f) Contact information for persons responsible for resolving issues after normal business hours (e.g., evenings, weekends, holidays) and on an emergency basis; and

g) A process for updating and notifying the Contract Monitor of any changes to the PEP.

2.10.4 Nothing in this section shall be construed to limit any rights of the Contract Monitor or the State which may be allowed by the Contract or applicable law.

2.11 SOC 2 Type 2 Audit Report

A SOC 2 Type 2 Report is not a Contractor requirement for this Contract.

2.12 Minority Business Enterprise (MBE) Reports

If this solicitation includes an MBE Goal (see Section 4.26), the Contractor shall:

a) Submit the following reports by the 10th of each month to the Contract Monitor and the Administration’s MBE Liaison Officer:

1) A Prime Contractor Paid/Unpaid MBE Invoice Report (Attachment D-4A) listing any unpaid invoices, over 45 days old, received from any certified MBE subcontractor, the amount of each invoice and the reason payment has not been made; and

2) (If Applicable) An MBE Prime Contractor Report (Attachment D-4B) identifying an MBE prime’s self-performing work to be counted towards the MBE participation goals.

BANK NOTE ACCEPTOR OVERHAUL (LEVEL IV)

b) Include in its agreements with its certified MBE subcontractors a requirement that those subcontractors submit an MBE Subcontractor Paid/Unpaid Invoice Report (Attachment D-

5) by the 10th of each month to the Contract Monitor and the Administration’s MBE Liaison Officer that identifies the Contract and lists all payments to the MBE subcontractor received from the Contractor in the preceding reporting period month, as well as any outstanding invoices, and the amounts of those invoices.

c) Maintain such records as are necessary to confirm compliance with its MBE participation obligations. These records must indicate the identity of certified minority and non-minority subcontractors employed on the Contract, type of work performed by each, and actual dollar value of work performed. Subcontract agreements documenting the work performed by all MBE participants must be retained by the Contractor and furnished to the Procurement Officer on request.

d) Consent to provide such documentation as reasonably requested and to provide right-of-entry at reasonable times for purposes of the State’s representatives verifying compliance with the MBE participation obligations. Contractor must retain all records concerning MBE participation and make them available for State inspection for three years after final completion of the Contract.

e) Upon completion of the Contract and before final payment and release of retainage, submit a final report in affidavit form and under penalty of perjury, of all payments made to, or withheld from MBE subcontractors.

2.13 Veteran Small Business Enterprise (VSBE) Reports

If this solicitation includes a VSBE Goal (see Section 4.27), the Contractor shall:

2.14 Work Orders

a) Additional will be provided via a Work Order process. Work shall not begin in advance of a fully executed Work Order. A Work Order may be issued for fixed price.

b) Work Order Requests (See sample at http://doit.maryland.gov/contracts/Documents/_procurementForms/WorkOrderSample.pdf) for the provision of services or resources that are within the scope of this IFB will be issued to the Contractor. The Work Order Request will include:

1) Technical requirements and description of the service or resources needed;

2) Performance objectives and/or deliverables, as applicable;

3) Due date and time for submitting a response to the request; and

4) Required place(s) where work must be performed.

c) The Contractor shall e-mail a response to the Contract Monitor within the specified time and include at a minimum:

1) A response that details the Contractor’s understanding of the work;

2) A price to complete the Work Order Request using the format provided using the format provided (see online sample).

3) A description of proposed resources required to perform the requested tasks, with labor categories listed in accordance with Attachment B.

BANK NOTE ACCEPTOR OVERHAUL (LEVEL IV)

Solicitation #: AGY-21-038-IT http://doit.maryland.gov/contracts/Documents/_procurementForms/WorkOrderSample.pdf

4) An explanation of how tasks shall be completed. This description shall include proposed subcontractors and related tasks.

5) Contractor’s expectations for State-furnished information, work site, and/or access to equipment, facilities, or personnel

6) The proposed personnel resources, including any subcontractor personnel, to complete the task.

d) For a T&M Work Order, the Contract Monitor will review the response and will confirm the proposed labor rates are consistent with this IFB. For a fixed price Work Order, the Contract Monitor will review the response and will confirm the proposed prices are acceptable.

e) The Contract Monitor may contact the Contractor to obtain additional information, clarification or revision to the Work Order, and will provide the Work Order to the Procurement Officer for a determination of compliance with the Contract and a determination whether a change order is appropriate.