IFB C000975 - Google Analytics Implementation - Solicitation Document.pdf

IFB # C000975

GOOGLE ANALYTICS IMPLEMENTATION

Agency: New York State Office of Information Technology Services

Vendor Sourcing and Management (VSMO)

Contract Number: C000975

Contract term: Two Years

Contract Title: GOOGLE ANALYTICS IMPLEMENTATION

DESIGNATED CONTACT FOR INQUIRIES AND SUBMISSIONS

ITS Agency Designated Contacts for this IFB are the following:

TJ Kennedy, Contract Management Specialist 2, and Nisha Thomas, Contract

Management Specialist 3, via its.sm.MAT.contracts@its.ny.gov

Invitation for Bids (IFB) related questions must be submitted via e-mail “Attachment 3 -

Bidder Questions and Extraneous Terms and Conditions Form” to the designated contact for this IFB in accordance with Section 1.4 Calendar of Events. All Bid

Response Submissions must be submitted via e-mail in accordance with submission requirements outlined in Section 6.

ITS Procurement Website: https://its.ny.gov/competitive-procurement-opportunities

NYS Contract Reporter IFB Advertisement: https://www.nyscr.ny.gov/

IMPORTANT NOTICE: A Restricted Period under the provisions of the State Finance

Law relating to procurement lobbying is currently in effect for this Procurement and will remain in effect until State Comptroller approval of the Contracts resulting from this IFB or any cancellation of this procurement. During the Restricted Period of this

Procurement, ALL communications must solely be directed, in writing, to the following individuals (Designated Contacts) and must be in compliance with the provisions of the

State Finance Law relating to procurement lobbying and all other IFB instructions.

Suggestions for the Procurement must only be made to the Designated Agency

Contact. Other communications relating to the Procurement must be directed to the

Designated Contact via e-mail: its.sm.MAT.contracts@its.ny.gov mailto:its.sm.MAT.contracts@its.ny.gov https://its.ny.gov/competitive-procurement-opportunities https://www.nyscr.ny.gov/ mailto:its.sm.contracts@its.ny.gov

TABLE OF CONTENTS

1. PROCUREMENT OVERVIEW

1.1 INTRODUCTION

1.2 PROCUREMENT BACKGROUND

1.3 MINIMUM BIDDER QUALIFICATIONS

1.4 CALENDAR OF EVENTS

1.5 DEFINITIONS

2. SCOPE OF WORK

2.2 IMPLEMENTATION

2.2.1 Project Management (Weeks 1-12)

2.2.2 Planning and Kick Off (Weeks 1-2)

2.2.3 GA4 360 Measurement Strategy (Weeks 3-6)

2.2.4 Implementation (Weeks 7-11)

2.2.5 Knowledge Transfer (Week 12)

2.3 MAINTENANCE / SUPPORT

2.4 INFRASTRUCTURE SUPPORT SERVICES

2.5 ROLES AND RESPONSIBILITIES

3. DATA MANAGEMENT OVERVIEW

3.1 CLOUD SERVICE MODEL

3.2 CLOUD DEPLOYMENT MODEL

3.3 DATA CATEGORIZATION

3.4 DATA OWNERSHIP

3.5 DATA LOCATION

3.6 DATA ENCRYPTION

3.7 CONFIDENTIALITY

3.8 DATA SECURITY

4. ITS IFB TERMS AND CONDITIONS

4.1 DATA BREACH – REQUIRED CONTRACTOR ACTIONS

4.2 STATE ACCESS TO DATA

4.3 CONTRACTOR ACCESS TO DATA

4.4 SUSPENSION OF SERVICES

4.5 EXPIRATION OR TERMINATION OF SERVICES

4.6 ACCESS TO SECURITY LOGS AND REPORTS

4.7 CONTRACTOR PERFORMANCE AUDIT

4.8 MODIFICATION TO CLOUD SERVICE DEPLOYMENT MODEL, SERVICE MODEL,

AND/OR INITIAL FUNCTIONALITY WITHIN THE CONTRACT

4.9 BACKGROUND CHECK REQUIREMENTS

4.10 ACCESS TO REGULATED DATA

4.11 CRIMINAL JUSTICE INFORMATION SERVICES DATA

4.12 CHANGE MANAGEMENT

4.13 WORK HOURS

4.14 SERVICE-SPECIFIC TERMS AND CONDITIONS

4.15 CONTRACTOR EXPECTATIONS

5. ADMINISTRATIVE INFORMATION

5.1 ISSUING OFFICE

5.2 METHOD OF AWARD

5.3 PRICE

5.4 BILLING

5.5 METHOD OF PAYMENT

5.6 COMMUNICATIONS FROM NYS TO BIDDERS

6. BID RESPONSE SUBMISSION REQUIREMENTS

6.1 INQUIRIES FROM BIDDERS

6.2 GENERAL REQUIREMENTS FOR BID RESPONSES

6.3 BIDDER REQUIREMENTS FOR BID RESPONSES

6.4 BID RESPONSE PREPARATION, RESPONSE AND LABELING

6.5 ITS BID PROTEST POLICY

6.6 BID PREPARATION COSTS

6.7 MULTIPLE SUBMISSIONS

7. METHOD OF AWARD

8. EVALUATION PROCESS & METHODOLOGY

8.1 BID RESPONSE COMPLETENESS REVIEW

8.2 MINIMUM QUALIFICATIONS EVALUATION

9. CONTRACT CLAUSES

9.1 CONTRACT TERM

9.2 INTEGRATION, MERGER, AND ORDER OF PRECEDENCE

9.3 TERMINATION FOR CONVENIENCE

9.4 ONLINE CONTRACTOR RESPONSIBILITY QUESTIONNAIRE

9.5 CONTRACTOR REQUIREMENTS AND PROCEDURES FOR PARTICIPATION BY

NEW YORK STATE-CERTIFIED MINORITY AND WOMEN-OWNED BUSINESS

ENTERPRISES AND EQUAL EMPLOYMENT OPPORTUNITITES FOR MINORITY

GROUP MEMBERS AND WOMEN

9.6 USE OF SERVICE-DISABLED VETERAN-OWNED BUSINESS (SDVOB)

ENTERPRISES IN CONTRACT PERFORMANCE

9.7 DISPUTE RESOLUTION PROCESS

9.8 ITS RESERVED RIGHTS

9.9 DELIVERABLE ACCEPTANCE PROCESS AND CRITERIA

9.10 RELATIONSHIP OF CONTRACTOR TO ITS

APPENDICES

Appendix A – Standard Clauses for New York State Contracts (June 2023)

Appendix B – Minimum Support Obligations

Appendix C – Standard Clauses for ITS Contracts (April 2025)

Appendix C-1 – Insurance Requirements for ITS Contracts (January 2024)

Appendix C-2 – Equal Employment and Supplier Diversity Requirements for ITS

Contracts (August 2025)

Appendix C-AI – Standard Clauses for AI Purchases (April 2025)

ATTACHMENTS

Attachment 1 – Financial Response Workbook

Attachment 2 – Firm Offer Letter and Conflict of Interest Disclosure

Attachment 3 – Bidder Questions and Extraneous Terms and Conditions Form

Attachment 4 – Contractor Certification of Covered Agency, ST-220-CA

Attachment 5 – FOIL & Litigation Disclosure

Attachment 6 – Compliance with HIPAA and HITECH

Attachment 7 – ITS Consultant Confidentiality and Non-Disclosure Contract

Attachment 8 – Consultant Disclosure Forms A-B

Attachment 9 – NYS ITS Required Forms 6.12.24

Attachment 10 – Minimum Qualifications Form

Attachment 11 – Deliverable Acceptance Form

FOR REFERENCE AND COMPLIANCE

ITS Required Forms: https://its.ny.gov/additional-vendor-resources

MWBE & SDVOB Forms: https://its.ny.gov/procurement

Security Policies & Standards: https://its.ny.gov/policies https://its.ny.gov/appendix-standard-clauses-new-york-state-contracts https://its.ny.gov/appendix-c-standard-clauses-its-contracts https://its.ny.gov/appendix-c-1-insurance-requirements-its-contracts https://its.ny.gov/appendix-c-2-equal-employment-and-supplier-diversity-requirements-its-contracts-august-2025 https://its.ny.gov/appendix-c-2-equal-employment-and-supplier-diversity-requirements-its-contracts-august-2025 https://its.ny.gov/appendix-c-2-equal-employment-and-supplier-diversity-requirements-its-contracts https://its.ny.gov/appendix-c-ai-standard-clauses-ai-purchases https://its.ny.gov/additional-vendor-resources https://its.ny.gov/procurement https://its.ny.gov/policies https://its.ny.gov/policies

1. PROCUREMENT OVERVIEW

1.1 INTRODUCTION

The New York State Office of Information Technology (ITS) is announcing an Invitation for Bids

(IFB) for qualified entities that can provide the Google Analytics products and services described in this solicitation document. ITS is seeking project partner for the implementation and renewal of Google Analytics 360 in order to enhance Customer Experience on public facing websites and applications.

The purpose of this solicitation is to invite any eligible and interested entities that can meet the eligibility criteria to participate in this procurement opportunity by submitting all required attachments and forms listed in this IFB. Bid Responses must be received no later than the Bid

Response Submission Due Date in Section 1.4 Calendar of Events. For additional information and submission requirements, refer to Section 6 Bid Response Submission Requirements.

A contract resulting from this announcement shall not be valid, effective, or binding upon the

State until such contract has been approved by the Office of the New York State Comptroller

(OSC). Purchase orders or other procurement transactions issued under such Contract may also be subject to OSC approval.

1.2 PROCUREMENT BACKGROUND

ITS needs to implement Google Analytics 360 in order to track and assess NYS websites’ performance and accessibility, which is critical to meet the website and digital media accessibility goals and requirements of the State. New York State's "Voice of the Customer"

(VoC) digital accessibility initiative is a cornerstone of the broader New York Experience (NYX) strategy, which seeks to transform public services into inclusive, user-friendly digital experiences. A critical component of VoC is the implementation of Google Analytics 360 plug-in for government, which provides robust data insights into user behavior, helping agencies tailor services to the real-time needs and barriers faced by constituents—including those with disabilities. This initiative emphasizes collecting and analyzing public feedback to inform design and delivery of digital services that reflect the diversity of all New Yorkers. This effort ensures compliance with NYS Policy NYS-P08-005, which sets minimum accessibility requirements for all state-operated websites and applications, by prioritizing accessibility, transparency, and usability.

1.3 MINIMUM BIDDER QUALIFICATIONS

The following qualifications are a mandatory prerequisite to qualify to bid on this solicitation.

a. Bidder must have a minimum of at least three (3) years of continuous experience providing

Google Analytics products and services.

b. Bidder must demonstrate experience and successful implementation of Google Analytics and Tag Manager in at least (3) prior engagements of similar size and scope as those described in this solicitation.

c. Bidder must have and provide current certifications in Google Analytics and Google Tag

Manager.

d. Bidder is an authorized reseller partner for Google Analytics 4 360 (GA4 360) enterprise license software product and of the shared digital service (the “Google Marketing Platform

Services”) provided by Google, LLC (“Google”).

e. Bidder is properly licensed to conduct business in the State of New York or agrees to register before the award of any resulting Contract.

In addition to Bidders completing and submitting Attachment 10 – Minimum Qualifications Form, the State reserves the right to require the submittal of any documentation as it deems necessary in its sole discretion to verify a Bidder’s satisfaction of the minimum qualifications. ITS must be able to verify bidder qualifications via contacting references of prior engagements.

All bidders who satisfy the requirements noted in this section are eligible to submit a bid proposal in response to this discretionary procurement. Bidders must complete and submit the

Attachment 10 – Minimum Qualifications Form to certify and demonstrate how they meet the minimum qualifications to participate in this procurement.

1.4 CALENDAR OF EVENTS

Key Event Date/Time

IFB Publication Date June 8, 2026

Due Date for Bidder Inquiries June 22, 2026, by 2:30 PM EST

ITS Response to Bidder Inquiries Date July 6, 2026

Bid Response Submission Due Date July 20, 2026, by 2:30 PM EST

1.5 DEFINITIONS

Definitions for certain terms in this document, its appendices, and attachments not specifically defined herein can be found in Appendix C – ITS Standard Contract Clauses, where applicable.

1.5.1 - Analytics Service Specific Definitions:

a. "Beta Test" means ITS's use of a Beta Feature(s) for the purpose of testing the usability and functionality of that Beta Feature(s). For purposes of clarification, (i) in no event will ITS be obligated to participate in any Beta Test, and (ii) ITS’s use of a Beta Feature for purposes other than testing the usability and functionality of that Beta Feature will not be deemed a

Beta Test with respect to that Beta Feature.

b. “BigQuery” is a fully managed, serverless data warehouse that enables super-fast SQL queries using the processing power of Google's infrastructure.

c. “Client” shall refer to the NYS Office of ITS.

d. "Customer Data" means the following: (i) with respect to Analytics 360, the data collected through use of an OSCI and then processed by Analytics 360; (ii) with respect to Optimize

360, ITS’s creative content or code for creative content that ITS inputs into Optimize 360 or has inputted on its behalf; (iii) with respect to Surveys 360, Survey Questions and Survey

Response Data, and (iv) with respect to Tag Manager 360, data concerning the volume and frequency of ITS’s code (e.g., HTML) or web beacons (e.g., pixel tag, clear GIF) served via a Tag Container. For purposes of this Contract, data derived from ITS’s use of the Analytics

Service means ITS Data for the applicable service.

e. "Event" means a base unit of measurement that is processed in Google Analytics or the

Analytics 360 service through a GA4 Property, which may include but is not limited to a page view, transaction, call to the Google Analytics system by an OSCI, screen view, custom event or other interactions with GA4 Properties capable of supporting multiple data streams.

f. "GA-OEP Property" or "GA-OEP Properties" means the collection of Google Analytics settings and information associated with the same Google Analytics Property ID to which

Hits or Events, as applicable, are sent from a Property or collection of Properties.

g. “Google Analytics 4 360” or “GA4” or “GA4 360” or “GA360” shall refer to the technology solution offered by Google Marketing as the paid premium version of Google Analytics 4.

This product is designed for large organizations with more complex data needs and higher volumes of website and app traffic. GA4 360 offers expanded features and capabilities beyond the standard GA4, including Tag Manager 360 The software license includes with dedicated support and a service level agreement (SLA) outlined in Appendix B – Minimum

Support Obligations.

h. "Google Analytics 4 Property" or "GA4 Property" means an Analytics 360 Property

(formerly known as an ‘App + Web’ property) that uses an OSCI to send Events to the

Analytics Service through ITS’s account.

i. "Hit" means a base unit of measurement that is sent to the Google Analytics or Analytics

360 service for processing through a UA Property, which may include but is not limited to a page view, a transaction or a call to the Google Analytics system by an OSCI.

j. "Mobile SDK" means a mobile operating system software development kit (together with any fixes, updates and upgrades) made available by Google that developers may use in an application to send Hits or Events to the Analytics Service. For purposes of clarification, a

Mobile SDK is an OSCI.

k. "OEP" means an "Optimize 360 Enabled Property", which is a GA-OEP Property that is enabled for linking to the Optimize 360 service.

l. "Optimize Container" means the code delivered through Optimize 360, through which ITS may serve code required to deliver modified visitor experiences.

m. "OSCI" means an "Officially Supported Client Interface", which is a mechanism made available by or supported by Google that can be used to send Hits or Events, as applicable, to the Analytics 360 service.

n. "Platform Home" means the user interface in Google Marketing Platform through which ITS can access certain platform-level functionality.

o. "Property" means any web page, application, or other property that (i) with respect to

Analytics 360 and Optimize 360, uses an OSCI to send data to the Analytics Service through

ITS’s account and (ii) with respect to Tag Manager 360, any web page, application, or other property for which ITS requests a Tag Container. Properties will be deemed Target

Properties for purposes of the Analytics Service. For purposes of clarification, all applicable obligations relating to Target Properties will apply to Properties.

p. "Publisher" means a third party on whose web property or content Survey Questions may be placed.

q. "Report" means the resulting analysis shown in the customer’s Google Analytics portal.

r. "Roll-Up Event" or "Roll-Up Hit" means an Event or Hit, respectively, that is additionally processed by a Roll-Up Property and stored therein.

s. "Roll-Up Property" means an Analytics 360 account configuration setting by which Event-or Hit-level data, as applicable, from one or more Properties is additionally processed by the

Analytics 360 service without an OSCI and stored together in accordance with such configuration.

t. "Sub-Property" means an Analytics 360 account configuration setting by which Event-level data from one GA4 Property is additionally processed by the Analytics 360 service without an OSCI and stored in accordance with such configuration.

u. "Sub-Property Event" means an Event that is additionally processed by a Sub-Property and stored therein.

v. "Survey Questions" means all questions submitted by ITS via the Surveys 360 service.

w. "Survey Response Count" means the total number of completed surveys submitted by end users in response to Survey Questions.

x. "Survey Response Data" means data submitted by end users in response to Survey

Questions.

y. "Tag Container" means the code delivered through Tag Manager 360, through which ITS may serve multiple code (e.g., HTML) or web beacons (e.g., pixel tag, clear GIF) on one or more Properties.

z. “Google Tag Manager 360” (GTM360) is a software product included with GA4360 defined as the enterprise-level version of Google Tag Manager, which allows ITS to manage website and mobile app tags (i.e. tracking codes) from a centralized interface, without needing to directly modify website code. GTM 360 provides advanced features such as approvals, commenting, and zones, along with dedicated support and a service level agreement (SLA) outlined in Appendix B – Minimum Support Obligations.

aa. "Universal Analytics Property" or "UA Property" means an Analytics 360 Property (also known as a ‘Classic’ property) that uses an OSCI to send Hits to the Analytics Service through ITS’s account.

1.5.2 - Procurement Specific Definitions:

a. “Anything as a Service” (XaaS) shall mean: any information, Analytic Derivatives, formula, algorithms, or other content that ITS may provide to the Contractor pursuant to this Contract.

Data includes, but is not limited to, any of the foregoing that ITS and/or Contractor (i) uploads to the Cloud Service, and/or (ii) creates and/or modifies using the Cloud Solution. See also

Analytic Derivatives.

b. “Analytics Derivatives” shall mean the basic differentiation formulas are identical to those for real functions, and thus which shall obtain the same rules for differentiating powers, sums, products, quotients, and compositions of functions for data analytics.

c. “Appliance” shall mean a hardware device, software or virtual appliance with integrated software, specifically designed to provide a specific computing resource or function, on which the Product may be or is used pursuant to the terms herein.

d. “Contractor” shall mean the corporation awarded a contract pursuant to this IFB.

e. “Proposer”, “Bidder”, “Offeror”, or “Reseller” shall mean any person, partnership, firm, corporation or other authorized entity submitting a Bid Response to the State pursuant to this BID.

f. “Cloud Solution” shall mean any Product or Service sold as an “as a service” offering and has one or more of the following characteristics:

(a) ITS Data is transmitted, acted upon, or stored on equipment not owned by an ITS;

(b) Allows a Contractor access to ITS Data from a location other than ITS’s premises;

(c) Allows ITS access to data not owned by ITS which access may or may not result in the collection of ITS Data.

g. “Community Cloud” shall mean deployment model for this procurement community cloud model pertaining to the community consisting of one or more government entities, enrolled affiliates, or customers with customer data that is subject to specific requirements.

h. “Compliance” shall mean the conformity in fulfilling requirements.

i. “Configuration” shall mean an arrangement of elements in a particular form, figure, or combination which includes minor physical or software setting changes that can be implemented without custom physical modifications or changes to the base code.

Configuration may include Installation.

j. “Contiguous United States” or “CONUS” shall mean the 48 contiguous States, and the

District of Columbia.

k. “Contract” shall mean the writing(s) which contain the Contract of ITS and the Contractor setting forth the total legal obligation between the parties as determined by applicable rules of law, and which will include the terms of this procurement.

l. “Contract Term” shall mean the duration of the resulting contract and will be for two years subsequent to and contingent upon final approval from OSC.

m. “Cloud Manufacturer” and “Manufacturer,” for this procurement, shall mean the following:

Cloud Solution Manufacturer is an organization or Business Entity that: 1. Sells its own

Proprietary Cloud Solution; or 2. Assembles a package of Products or Services into its own

Proprietary Product to create a Cloud Solution. This Product may include the services of one or more organizations or Business Entities that directly produce and/or provide components for a Cloud Solution software package or platform. The Cloud Solution must be branded, supported, and maintained by the entity for the life of the transaction.

n. “Data” shall mean any information, Analytic Derivatives, formula, algorithms, or other content that ITS may provide to the Contractor pursuant to this Contract. Data includes, but is not limited to, any of the foregoing that ITS and/or Contractor (i) uploads to the Cloud

Service, and/or (ii) creates and/or modifies using the Cloud Solution. See also Analytic

Derivatives.

o. “Data Breach” shall mean refers to unauthorized access to Data or equipment which is used to transmit, store, or act upon such Data by any person, including employees, officers, partners or subcontractors of Contractor, who have not been authorized to access such

Data.

p. “Data Categorization” shall mean the process of risk assessment of Data. See also “High

Risk Data”, “Moderate Risk Data” and “Low Risk Data”.

q. “Data Conversion” shall mean the conversion of computer data from one format to another.

r. “Data Centers” shall mean All facilities in which State Data is processed or stored.

s. “Data Mining” shall mean the computational process of discovering patterns in large data sets involving methods at the intersection of artificial intelligence, machine learning, statistics, and database systems. The overall goal of the Data Mining process is to extract information from a data set and transform it into an understandable structure for further use.

Aside from the raw analysis step, it involves database and data management aspects, data pre-processing, model and inference considerations, interestingness metrics, complexity considerations, post-processing of discovered structures, visualization, and online updating.

t. “Database” shall mean a single collection of Data stored in one place that can be used by personnel to make decisions and assist in analysis.

u. “Device” shall mean a piece of electronic equipment (such as a laptop, server, hard drive, USB drive) adapted for a particular purpose. See also “Equipment”.

v. “IFB” or “BID” shall mean this solicitation document.

w. “Emergency” shall mean an urgent and unexpected requirement where health and public safety or the conservation of public resources is at risk.

x. “Encryption” shall mean technique used to protect the confidentiality of information. The process transforms ("encrypts") readable information into unintelligible text through an algorithm and associated cryptographic key(s).

y. “Equipment” shall mean an all-inclusive term which refers either to individual Machines or to a complete Data Processing System or Subsystem, including its Hardware and Operating

Software (if any). See also “Device, “Appliance,” and “Hardware,” “Machine.”

z. “Federal Information Security Management Act (FISMA)” shall mean the Federal Information

Security Management Act of 2014 ("FISMA", 44 U.S.C. § 355441, et seq.). FISMA requires each federal agency to document and report major security incidents and data breaches to the data and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source.

aa. “Hardware” shall mean IT Equipment and is contrasted with Software. See also

“Equipment.”

bb. “High Risk Data” shall mean data as defined in FIPS PUB 199, Standards for Security

Categorization of Federal Information and Information Systems (“High Impact Data”).

cc. “ITS” shall mean NYS Office of ITS.

dd. “Information Technology (IT)” shall include, but is not limited to, all electronic technology systems and services, automated information handling, System design and analysis, conversion of data, computer programming, information storage and retrieval, telecommunications which include voice, video, and data communications, requisite System controls, simulation, electronic commerce, and all related interactions between people and

Machines.

ee. “Licensed Software” shall mean Software transferred upon the terms and conditions set forth in the Contract. “Licensed Software” includes error corrections, upgrades, enhancements or new releases, and any deliverables due under a maintenance or service contract (e.g., patches, fixes, PTFs, programs, code or data conversion, or custom programming).

ff. “Licensee(s)” shall mean ITS who acquires Products and Services from Contractor by issuing a Purchase Order in accordance with the terms and conditions of the Contract;

provided that, for purposes of compliance with an individual license, the term “Licensee(s)” shall refer separately to the ITS Staff individual(s) who took receipt of and who is executing the Product, and who shall be solely responsible for performance and liabilities incurred. In the case of acquisitions by State Agencies, the Licensee shall be the State of New York.

gg. “Licensor” shall mean a contractor who transfers rights in proprietary Product to an ITS in accordance with the rights and obligations specified in the Contract.

hh. “Low Risk Data” shall be data as defined in FIPS PUB 199, Standards for Security

Categorization of Federal Information and Information Systems (“Low Impact Data”).

ii. "Lowest Price" shall mean the basis for awarding all commodity contracts among responsive and responsible bidders.

jj. “Machine” shall mean an individual unit of a Data processing system or subsystem, separately identified by a type and/or model number, comprised of but not limited to mechanical, electro-mechanical, and electronic parts, microcode, and special features installed thereon and including any necessary Software, e.g., central processing unit, memory module, tape unit, card reader, etc. See also “Equipment”.

kk. “Maintenance” shall mean the upkeep of Google Analytics products that keeps the Google

Analytics products operating in accordance with the Manufacturer’s specification.

ll. “Moderate Risk Data” shall be defined in FIPS PUB 199, Standards for Security

Categorization of Federal Information and Information Systems (“Moderate Impact Data”).

mm. The “State” shall mean The People of the State of New York, which shall also mean the New

York State Office of Information Technology Services.

nn. “Storage” shall mean specific to technology, a computer memory that retains data for some period of time. Storage can be categorized in many ways such as primary, secondary, read-only, random access and/or magnetic storage.

oo. “Subcontractor” means a subcontractor, consultant, third-party service provider or agent engaged by a party in connection with its use or provision of Services.

pp. “System” shall mean the complete collection of Hardware, Software and Services as described in this BID, integrated and functioning together, and performing in accordance with this Contract.

qq. “Terms of License” shall mean the terms and conditions set forth in the Contract that are in effect and applicable to a Purchase Order at the time of order placement.

rr. “Usage” shall mean the quantity of an inventory item consumed over a period of time expressed in units of quantity or of value in dollars.

2. SCOPE OF WORK

The selected Contractor shall provide the Services identified in this Scope of Work in accordance with the requirements of this solicitation and the resulting Contract.

2.1 LICENSING

The Contractor shall provide Google Analytics 4 360 (GA4 360) enterprise license software to accommodate the volume of up to 375,000,000 monthly events, including subscriptions, access rights, and associated licensing necessary for the products and services required under this solicitation. Licensing shall be provided for two (2) years, invoiced annually for

Year 1 and Year 2.

2.2 IMPLEMENTATION

The implementation timeline will follow the 12-week schedule outlined below. However, the engagement is expected to achieve project goals as quickly as possible.

2.2.1 Project Management (Weeks 1-12)

The Contractor will provide robust project management support throughout the implementation timeline, ensuring proactive communication, risk mitigation, and issue resolution. Measurable outputs include:

a. Weekly Project Status Reports: Document weekly progress against the project plan, identify accomplishments, upcoming activities, identified risks and mitigation status, and any action items. This shall include Meeting Minutes and an Action Item Tracker, updated and distributed after each project meeting which clearly outlines decisions made, discussions and assigned action items with due dates.

b. Issue Log & Proposed Solutions: A log of all implementation project issues, including their impact and proposed solutions. Alignment with ITS priorities and plans, including known platform availability dependencies, will be documented.

2.2.2 Planning and Kick Off (Weeks 1-2)

a. Project Planning Activities (Week 1)

The Contractor will prepare for a comprehensive kickoff meeting with the Client and

Client partner(s), as applicable. This phase will focus on establishing a clear understanding of project parameters and ensuring all necessary inputs are gathered.

Tangible outputs from this phase include the following items:

i. Client Goal Report & Constraint Analysis: A detailed summary of the Client's and

Contractor’s stated goals, objectives, specific needs, identified constraints, and available resources, as communicated in writing by the Client. This document will serve as the foundational understanding for the project.

ii. Client Input Requirements Checklist: A detailed list of all deliverables, information, and access required from the Client to successfully commence and execute the engagement. This ensures timely provision of necessary client-side resources.

iii. Roles & Responsibilities Matrix: A clear matrix outlining the specific roles and responsibilities of each team member from both the Contractor and Client organizations, ensuring accountability and clarity.

iv. Project Plan & Communication Cadence: A preliminary project plan outlining key phases, estimated timelines, and proposed schedule for weekly status updates and formal meetings.

b. Project Kick-Off Meeting(s) (Week 2)

The Contractor will facilitate a formal kickoff meeting(s) with the Client and relevant stakeholders to solidify project alignment and set expectations. Tangible outputs from this phase include the following items:

i. Final Scope of Services Document: A deliverable expectations document that clearly defines and confirms the agreed-upon scope of work to achieve ITS goals and objectives.

ii. Background & Existing Documentation Summary: A summary of all relevant background information and existing documentation to review highlights.

iii. Project Plan & Milestone Schedule: finalize the project plan, including detailed timelines, key milestones, and associated deliverables, with clear acceptance criteria for each milestone. Agree on frequency, format, and attendees for project meetings.

Note: ITS will assist in scheduling the kickoff, identify meeting attendees and project stakeholders for inclusion in the kickoff and ongoing meetings, as well as participate in planning activities.

2.2.3 GA4 360 Measurement Strategy (Weeks 3-6)

Foundational GA4 Implementation support, using NYS current GA4 data to assess business objectives and bring the account set up to best practice implementation through technical corrective action. The documentation created will be a foundation for ongoing improvement.

a. Discovery: Conduct stakeholder interviews and obtain clear understanding of the project objectives, any internal terminology or pre-existing KPIs, and all measurement objectives as necessary to successfully deploy GA4 360.

b. Measurement Framework Report: This document supports analytics work and is a core competency that enables data-driven decision-making. This governing document for measuring activities including: goals, objectives, KPIs, metrics, and segmentation.

c. Solution Design Document: This technical solution design will accomplish the objectives outlined in the measurement analysis. Contractor provides technical documentation to use as an ongoing, updatable reference. Limited to the scope outlined in this document.

2.2.4 Implementation (Weeks 7-11)

This phase involves the foundational configuration and technical implementation of GA4

360 and Google Tag Manager 360 (GTM360) to support the defined measurement strategy.

a. Foundational GA4 360 Configuration:

i. Work Product: Configuration of GA4 360 properties, including the enablement of and access to the out-of-the-box enhanced measurement features at the property level.

ii. Outcome: GA4 360 property configured with enhanced measurement enabled, ready for data collection.

b. Google Tag Manager 360 (GTM360) Setup and Configuration:

i. Work Product: Full implementation and configuration of GTM360 to support the measurement strategy, including the setup of necessary tags, triggers, and variables for out-of-the-box event tracking.

ii. Outcome: GTM360 container deployed and configured to accurately capture defined events and user interactions.

c. Data Integration with BigQuery:

i. Work Product: Successful connection of the GA4 360 property to BigQuery, enabling raw data export. Consultation and guidance on Google Cloud Platform account setup related to this integration.

ii. Outcome: GA4 360 data successfully flowing into BigQuery, with the GCP account configured appropriately.

d. Validation and Reporting:

i. Product: A comprehensive report detailing the validation findings of the implemented tracking, confirming data accuracy and completeness against the measurement strategy. Documentation of the new GTM360 setup.

ii. Outcome: Client acceptance of the validation report and GTM360 setup documentation, confirming successful implementation.

2.2.5 Knowledge Transfer (Week 12)

Contractor shall provide consultant-led knowledge transfer sessions and a implementation close out meeting to demonstrate completion of all deliverables and successful implementation of GA4 360. Contractor will submit Implementation Project

Close Out Report, including lessons learned and engagement specific details of note, for final acceptance by ITS during knowledge transfer sessions. ITS acceptance of the

Project Close Out Report shall signify formal conclusion of the implementation phase.

Contractor must connect and confirm GA4 property to BigQuery (Google’s data analytics platform) and consult on Google Cloud Platform account setup. Confirmation that GA4 property has been successfully connected to BigQuery, along with documentation and recommendations for GCP account setup, including best practices for data export and management within GCP.

2.3 MAINTENANCE / SUPPORT

2.3.1 Minimum Support Obligations

The Minimum Support Obligations (MSOs) are requirements outlined in Appendix B, except as otherwise described herein. MSOs for GA360 are mandated support, training, and implementation services that certified Sales Partners must provide to resale clients at no additional cost to the customer. These include but are not limited to: initial setup guidance, ongoing technical support, and escalation of complex issues to Google.

2.3.2 Key Aspects of GA360 Minimum Support Obligations:

• Installation Support: Partners provide initial and ongoing implementation assistance for GA4 360 properties.

• Ongoing/Reactive Support: Partners are required to provide technical assistance, responding to client support tickets in accordance with established

Campaign Manager guidelines.

• Escalation Process: If a partner cannot resolve an issue, they are obligated to escalate it to Google's engineering team.

• Service Requirement: These services are mandated in conjunction with the resale of Google Marketing Platform services.

2.4 INFRASTRUCTURE SUPPORT SERVICES

The Contractor must provide all infrastructure support services provided in the regular course of business by the Cloud Manufacturer. No infrastructure support services are being procured and if provided, must be provided at no additional cost.

2.5 ROLES AND RESPONSIBILITIES

1. Contractor will provide the Services defined herein as reasonably requested by ITS.

2. ITS will make appropriate personnel available to assist Contractor in the performance of

Contractor’s responsibilities.

3. ITS will arrange for and provide secure building access and adequate office space, meeting rooms, training facilities, and utilities for services Contractor will perform at

Client’s facilities.

4. ITS will ensure that all licenses, consents, and rights to allow Contractor to use or license any third-party materials, including software, firmware, hardware, or other products, are in place with applicable vendors for those products and services upon which Contractor is relying to provide the services described herein.

5. ITS is responsible for the identification and implementation of any applicable laws, rules, and regulations that affect the Client’s existing systems that Contractor will have access to during the Term. Client is responsible for ensuring that the systems and programs meet the requirements of those laws, rules, and regulations.

3. DATA MANAGEMENT OVERVIEW

3.1 CLOUD SERVICE MODEL

This is considered a SaaS (Software as a Service) model.

3.2 CLOUD DEPLOYMENT MODEL

The cloud deployment model is Community Cloud.

3.3 DATA CATEGORIZATION

a) Cloud Data Risk Level classification has been determined as a low risk.

b) The insurance requirements of this Contract are set forth in Appendix C-1.

c) Applicable statutory/policy requirements are as follows:

P03-002 - Information Security Policy

P08-001 - Enterprise Plan to Procure Policy

P08-005 - Accessibility of Web-Based Information and Application

S13-002 - Information Classification Standard

S13-003 - Sanitation/Secure Disposal

S13-005 - Cyber Incident Response Standard

S14-002 - Information Classification Standard

S14-003 - Information Security Controls

S14-006 - Authentication Tokens Standard

S14-007 - NYS Encryption Standard

S14-010 - Remote Access

NIST Federal Information Processing Standard (FIPS) Publication 140-2

NIST Federal Information Processing Standards (FIPS) Publication 199 – Standards for

Security Categorization of Federal Information and Information Systems

NIST Special Publication 800-53 - Security and Privacy Controls for Federal Information

Systems and Organizations.

NIST Special Publication 800-57, Part 1 - Recommendation for Key Management – Part

1: General

NIST Special Publication 800-088r1 - Guidelines for Media Sanitization

NIST Special Publication 800-111 - Guide To Storage Encryption Technologies For End

User Devices

NIST Special Publication 800-122 - Guide to Protecting the Confidentiality of Personally

Identifiable Information (PII)

NIST Special Publication 800-131A - Transitions: Recommendation for Transitioning the

Use of Cryptographic Algorithms and Key Lengths

New York State Information Security Controls Standard

New York State Risk Management Standard

Health Insurance Portability and Accountability Act of 1996

3.4 DATA OWNERSHIP

The State shall own all right, title and interest in Data.

3.5 DATA LOCATION

All Data must remain in the Contiguous United States of America (CONUS).

3.6 DATA ENCRYPTION

Contractor shall use appropriate means to preserve and protect State Data. This includes, but is not limited to, use of stable storage media, regular data backups and archiving, password protection of volumes, and data encryption. Data needs to be Encrypted when in

Transit. All Data transmitted between ITS and the Contractor must comply with NYS ITS

Standard NYS-S14-007 Encryption Standard (http://its.ny.gov/document/encryption-standard).

3.7 CONFIDENTIALITY

ITS Data is Confidential Information of ITS.

3.8 DATA SECURITY

The Contractor shall provide all standard security provided in the regular course of business by the Cloud Manufacturer. No additional security is being procured and if provided, must be provided at no additional cost.

4. ITS IFB TERMS AND CONDITIONS

4.1 DATA BREACH – REQUIRED CONTRACTOR ACTIONS

Unless otherwise provided by law, in the event of a Data Breach, the Contractor must:

a) Notify the ITS Chief Information Security Office (“CISO”) and any potentially affected

State(s), or their designated contact person(s), by telephone as soon as possible, but in no event more than 24 hours from the time the Contractor confirms the Data Breach;

b) Consult with and receive authorization from the State as to the content of any notice to affected parties prior to notifying any affected parties to whom notice of the Data Breach is required, either by statute or by the State;

c) Coordinate all communication regarding the Data Breach with the CISO and State

(including possible communications with third parties);

d) Cooperate with the State, CISO and any Contractor working on behalf of the State or

CISO in attempting (i) to determine the scope and cause of the breach; and (ii) to prevent the future recurrence of such security breaches; and

e) Take such corrective actions that the Contractor deems necessary to contain the Data

Breach. Contractor must provide Written notice to the State as to all such corrective actions taken by the Contractor to remedy the Data Breach. Unless otherwise agreed to in the Contract, if Contractor is unable to complete the corrective action within the required timeframe, the remedies provided in this Contract, must apply, and:

i) the State may contract with a third party to provide the required services until corrective actions and services resume in a manner acceptable to the State, or until the State has completed a new procurement for a replacement service system; and

ii) the Contractor will be responsible for the reasonable cost of these services during this period.

Nothing referenced herein can in any way (a) impair the State or OAG to bring an action against Contractor to enforce the provisions of the New York State Information Security

Breach Notification Act (ISBNA) or (b) limit Contractor’s liability for any violations of the ISBNA or any other applicable statutes, rules or regulations.

4.2 STATE ACCESS TO DATA

The State must have access to its data at all times, through the term of the Contract, plus

180 days thereafter. The State must have the ability to import or export data in piecemeal or in its entirety at the State’s discretion at no charge to the State. This includes the ability for the State to import or export data to/from other Contractors.

4.3 CONTRACTOR ACCESS TO DATA

The Contractor must not copy or transfer Data unless authorized in writing by the State. In such an event the Data must be copied and/or transferred in accordance with the provisions of this Section. Contractor must not access any data for any purpose other than fulfilling the service. Contractor is prohibited from data mining, cross tabulating, monitoring State’s Data usage and/or access, or performing any other data analytics other than those required within the Contract. At no time must any data or processes (e.g., workflow, applications, etc.), which either are owned or used by the State be copied, disclosed, or retained by the Contractor or any party related to the Contractor. Contractors are allowed to perform industry standard back-ups of data. Documentation of back-up must be provided to the State upon request.

Contractor must comply with any and all security requirements within the Contract.

4.4 SUSPENSION OF SERVICES

During any period of suspension of service, the State must have full access to all data at no charge. The Contractor must not take any action to erase and/or withhold any State data, except as directed by the State.

4.5 EXPIRATION OR TERMINATION OF SERVICES

Upon expiration or termination of the Contract, the State must have full access to all data for a period of 90 calendar days. During this period, the Contractor must not take any action to erase and/or withhold any data, except as directed by the State. The State must have the right to specify a period more than 90 calendar days in the Contract.

4.6 ACCESS TO SECURITY LOGS AND REPORTS

The Contractor must provide all standard access to security logs and reports provided in the regular course of business by the Cloud Manufacturer. No additional security logs and reports are being procured and if provided, must be provided at no additional cost.

4.7 CONTRACTOR PERFORMANCE AUDIT

The Contractor must provide all standard contract performance audit information provided in the regular course of business by the Cloud Manufacturer. No additional contract performance audits are being procured and if provided, must be provided at no additional cost to the State.

4.8 MODIFICATION TO CLOUD SERVICE DEPLOYMENT MODEL, SERVICE MODEL,

AND/OR INITIAL FUNCTIONALITY WITHIN THE CONTRACT

As Cloud services can be flexible and dynamic, delivery mechanisms may be subject to change. This may result in changes to the deployment model, service model, functionality, or

SKU. The NYS OGS, ITS and State Agencies require notification of any such changes to ensure security and business needs are met. Any changes to the deployment model, service model, functionality, or SKU (e.g., PaaS to IaaS) must be approved and accepted by ITS at the sole discretion of ITS.

In addition, notification must be provided to the State for review and acceptance, prior to implementation. Any changes to the Contract will require the State to re-assess the risk mitigation methodologies and strategies and revise the Contract as needed.

4.9 BACKGROUND CHECK REQUIREMENTS

If the Contractor will have access to State Data, Data Centers, or as otherwise determined by the State to be necessary, all Contractor Staff must, prior to the commencement of any services pursuant to this IFB, whether on or off-site, comply with all State onboarding and security clearance requirements, including training and signing certifications or Contracts, required for access to NYS Confidential Information or data or required for access to NYS

Facilities or Data Centers, the preceding described, collectively, as "onboarding." This includes requirements related to the access to regulated data, including any requirements of the State's public safety agencies, or those related to the Federal Bureau of Investigation

Criminal Justice Information Services (CJIS) Security Policy

(https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center).

Contractor agrees that its Contractor Staff performing services on-site at NYS Facilities or

Data Centers or those with logical access to NYS Confidential Information or data (i.e., log-in access) must be required to undergo the same security clearances as those required of

ITS employees. If not physically or virtually escorted, each Contractor Staff designated to work under the Contract with ITS must submit identifying information to the State and be fingerprinted. ITS must arrange for the scheduling of fingerprinting. Such fingerprints must be submitted to the NYS Division of Criminal Justice Services for a state criminal history record check and, at ITS' discretion, to the Federal Bureau of Investigation for a national criminal history record check.

Contractor also agrees that its Contractor Staff performing services on-site at NYS Facilities or Data Centers may be required to comply with those health checks which NYS requires of its own employees working on-site including for example providing proof of vaccination against, and/or testing for, infectious disease such as COVID-19.

All expenses, including travel and lodging, associated with the onboarding and security clearance process including fingerprinting of Contractor Staff, which are the responsibility of the Contractor and are not reimbursable. ITS must make all suitability determinations on

Contractor Staff. For purposes of this Section, a “suitability determination” is a determination that there are reasonable grounds to believe that an individual will likely be able to perform the Contract requirements without undue risk to the interests of the State. Failure of a security clearance or non-compliance with this Section will disqualify any Contractor Staff from performing any services on the Contract. If any Contractor Staff are removed from providing services under the Contract, they may be subject to all onboarding and security clearance requirements if they are returned to performing services under the Contract.

All Contractor Staff must, at the termination of their providing services to ITS under this IFB, comply with all State off-boarding and security procedures, including return to ITS of any physical or logical access badges or other credentials that were issued by the State and required for their access to NYS Confidential Information or Data or NYS Facilities or Data

Centers.

4.10 ACCESS TO REGULATED DATA

The Contractor agrees to comply with the requirements listed in this IFB for those Applicable

Statutory Requirements as indicated in this document and associated appendices and attachments.

4.11 CRIMINAL JUSTICE INFORMATION SERVICES DATA

The Contractor agrees to comply with all requirements in the most recent approved version

Criminal Justice Information Services (CJIS) Security Policy, available at https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center/view and the terms of the CJIS Security Addendum below. As of the date of this IFB publication, the most recent approved version of the CJIS Security Policy is Version 6.0, dated December 27, 2024.

4.12 CHANGE MANAGEMENT

Either party may initiate a request for a Change Order (“CO” or “Change Order”) using a mutually agreeable Change Order form.