KATHY HOCHUL

Governor

DRU RAI

Chief Information Officer

INVITATION FOR BIDS

COMPETITIVE PROCUREMENT FOR:

IFB C000992 – ALCOHOL PRICE POSTING AND DELINQUENCY MANAGEMENT

Procurement Website: htps://its.ny.gov/competitive-procurement-opportunities

DESIGNATED CONTACT FOR INQUIRIES AND SUBMISSIONS

Designated Contacts Roel Pena, Contract Management Specialist

Dolly Bernard, Contract Management Specialist

ITS ELECTRONIC BID RESPONSE SUBMISSION (EMAIL ONLY)

its.sm.MAT.Contracts@its.ny.gov

IMPORTANT NOTICE: A Restricted Period under the provisions of the State Finance Law relating to procurement lobbying is currently in effect for this Procurement and will remain in effect until State Comptroller approval of the Contracts resulting from this Invitation for Bids (IFB) or any cancellation of this procurement. During the Restricted Period of this Procurement, all communications must solely be directed, in writing, to the Designated Contacts and must be in compliance with the provisions of the State Finance Law relating to procurement lobbying and all other IFB instructions. Suggestions for the procurement must only be made to the Designated Agency Contact. Other communications relating to the Procurement must be directed to the Designated Contact via email its.sm.MAT.Contracts@its.ny.gov.

PROCUREMENT LOBBYING LAW/RESTRICTED PERIOD IS IN EFFECT

FOR THIS SOLICITATION

https://its.ny.gov/competitive-procurement-opportunities mailto:its.sm.MAT.Contracts@its.ny.gov

IFB C000992 Page 2 of 35

SOLICITATION DOCUMENTS

APPENDICES

Appendix A – Standard Clauses for New York State Contracts (June 2023) Appendix C – Standard Clauses for ITS Contracts (April 2025) Appendix C-1 – Insurance Requirements for ITS Contracts (January 2024) Appendix C-2 – Equal Employment and Supplier Diversity Requirements for ITS Contracts (August 2025) Appendix C-AI – Standard Clauses for AI Purchases (April 2025)

ATTACHMENTS

Attachment 1 – Financial Response Form Attachment 2 – Firm Offer Letter and Conflict of Interest Disclosure Attachment 3 – Bidder Eligibility and Minimum Qualifications Form Attachment 4 –Contractor Certification of Covered Agency, ST-220-CA Attachment 5 – FOIL & Litigation Disclosure Attachment 6 – ITS Consultant Confidentiality and Non-Disclosure Agreement Forms Attachment 7 – Bid Checklist Attachment 8 – Bidder Questions and Extraneous Terms Form Attachment 9 – Requirements Verification Traceability Matrix Attachment 10 – Consultant Disclosure A & B Form

EXHIBITS (Project Specific Information) Exhibit 1 – Filing Period Schedules and Deadlines Exhibit 2 – Batch File Format Exhibit 3 – Discount File Format

ADDITIONAL REQUIRED FORMS

ITS Required Forms:

https://its.ny.gov/required-forms-nys-its Supplier Diversity – MWBE & SDVOB Forms:

https://its.ny.gov/procurement - see Appendix C2 for more information Security Policies & Standards:

https://its.ny.gov/policies To access additional forms, visit the ITS website:

https://its.ny.gov/additional-vendor-resources https://its.ny.gov/appendix-standard-clauses-new-york-state-contracts https://its.ny.gov/appendix-c-standard-clauses-its-contracts https://its.ny.gov/appendix-c-1-insurance-requirements-its-contracts http://its.ny.gov/appendix-c-2-equal-employment-and-supplier-diversity-requirements-its-contracts-august-2025 http://its.ny.gov/appendix-c-2-equal-employment-and-supplier-diversity-requirements-its-contracts-august-2025 https://its.ny.gov/appendix-c-2-equal-employment-and-supplier-diversity-requirements-its-contracts https://its.ny.gov/non-disclosure-agreement-forms https://its.ny.gov/required-forms-nys-its https://its.ny.gov/procurement https://its.ny.gov/policies https://its.ny.gov/additional-vendor-resources

IFB C000992 Page 3 of 35

TABLE OF CONTENTS

SECTION 1: OVERVIEW

1.1 PURPOSE OF INVITATION FOR BIDS

1.2 CALENDAR OF EVENTS

SECTION 2: PROJECT BACKGROUND

SECTION 3: BIDDER ELIGIBILITY AND MINIMUM QUALIFICATIONS

3.1 ELIGIBILITY

3.2 QUALIFICATIONS

SECTION 4: SCOPE OF WORK and MANDATORY SYSTEM REQUIREMENTS

4.1 PROJECT PLAN AND SCHEDULE

4.1.1 Project Management Services

4.1.2 Project Approach and Resource Plan

4.1.3 Project Schedule

4.2 SYSTEM ARCHITECTURE AND SOFTWARE DESIGN

4.3 MANDATORY SYSTEM REQUIREMENTS

4.3.1 Price Posting Submissions and Management

4.3.2 Price Posting Lookup and Query

4.3.3 Brand Appointment Letter Submission and Management

4.3.4 Limited Availability Submission and Management

4.3.5 Delinquent Credit Management and Submission

4.3.6 E-Wholesale Account Management

4.3.7 E-Wholesale Web Services (API’s)

4.3.8 Agency Administrative Interface

4.4 TRAINING

4.4.1 Training Plan

4.4.2 Training Materials Format

4.4.3 Training Completion

4.4.4 Administrator Training

4.4.5 End User Training

4.5 TESTING

4.5.1 End-to-End System Testing

IFB C000992 Page 4 of 35

4.5.2 User Acceptance Testing (UAT)

4.5.3 Resolution of Critical and Major Defects

4.6 PRODUCTION READINESS

4.6.1 Readiness Document

4.7 IMPLEMENTATION (GO LIVE) OF NEW SYSTEM

4.7.1 Solution Delivery

4.7.2 Production Deployment

4.7.3 Go Live Approval

4.8 POST-GO-LIVE SUPPORT

4.8.1 Defect Resolution Timeframes:

4.8.2 Ongoing Support Services

4.8.3 Hypercare Support Period

4.8.4 Service Level Agreement Reporting

4.9 WARRANTY PERIOD

4.10 SERVICE LEVEL REQUIREMENTS

4.10.1 System Availability

4.10.2 Scheduled Maintenance and Planned Service Interruptions

4.10.3 Batch Processing Activities

4.10.4 System Defects and Repair Service Levels

4.11 SERVICE LEVEL CREDITS

4.12 CUSTOMER SUPPORT

4.12.1 Customer Technical Support (Level 1)

4.13 CUTOVER

4.14 ROLLBACK

SECTION 5: SECURITY REQUIREMENTS

5.1 SECURITY REVIEW

5.1.1 Review Coverage

5.1.2 Vulnerability Scanning and Penetration Testing

5.1.3 Scope of Review

5.1.4 Issues Discovered

5.2 SECURITY ISSUE MANAGEMENT

IFB C000992 Page 5 of 35

5.2.1 Identification

5.2.2 Investigation and Resolution of Security Issues

5.2.3 Remediation

5.3 ASSURANCE

5.3.1 Certification

5.4 PERSONNEL and ORGANIZATION

5.5 SERVICE HOSTING AND SECURITY REQUIREMENTS

5.6 DIGITAL IDENTITY AND AUTHENTICATION

5.7 AUTHORIZATION CONTROLS

5.8 ENCRYPTION OF DATA

5.9 NETWORK SECURITY

5.10 ENDPOINT AND HOST PROTECTION

5.11 PATCH AND VULNERABILITY MANAGEMENT

5.12 PENETRATION TESTING, AUDIT AND LOGGING

SECTION 6: INCIDENT RESPONSE AND MONITORING

6.1 LEAST PRIVILEGE AND SEGREGATION OF DUTIES

6.2 SUPPLY CHAIN SECURITY

SECTION 7: DATA CLASSIFICATION AND PRIVACY

7.1 Classify data

7.2 DATA BREACH – REQUIRED BIDDER ACTIONS

7.3 ACCESS TO DATA

7.4 SUSPENSION OF SERVICES

7.5 EXPIRATION OR TERMINATION OF SERVICES

7.6 ACCESS TO SECURITY LOGS AND REPORTS

7.7 CONTRACTOR PERFORMANCE AUDIT

7.8 BACKGROUND CHECK REQUIREMENTS

7.9 DATA LOCATION

SECTION 8: ADMINISTRATIVE INFORMATION

8.1 BILLING

8.2 METHOD OF PAYMENT

8.3 CONTRACT TERM

IFB C000992 Page 6 of 35

8.4 INQUIRIES FROM BIDDERS AND EXTRANEOUS TERMS

SECTION 9: BID REQUIREMENTS

9.1 ADMINISTRATIVE BID REQUIREMENTS:

9.2 FINANCIAL BID REQUIREMENT

9.3 PREPARATION COSTS

SECTION 10: LATE SUBMISSIONS

SECTION 11: MULTIPLE SUBMISSIONS

SECTION 12: EVALUATION METHODOLOGY

12.1 ADMINISTRATIVE BID COMPLETENESS REVIEW

12.2 FINANCIAL BID EVALUATION

12.3 METHOD OF AWARD

SECTION 13: CONTRACTOR AND SUBCONTRACTOR REQUIREMENTS

SECTION 14: TERMINATION AND DISPUTE RESOLUTION

14.1 TERMINATION FOR CONVENIENCE

14.2 DISPUTE RESOLUTION PROCESS

IFB C000992 Page 7 of 35

SECTION 1: OVERVIEW

1.1 PURPOSE OF INVITATION FOR BIDS

The New York State (NYS) Office of Information Technology Services (ITS) is seeking proposals from qualified entities to provide hosting services for the New York State Liquor Authority’s Division of Alcoholic Beverage Control (SLA/ABC) Wholesale Platform.

SLA/ABC provides an online Wholesale Platform for the filing of wholesale prices for alcoholic beverages and the management of retail payment delinquency processes. The platform provides comprehensive price posting information for the liquor industry users and the public.

Per NYS Alcohol Beverage Control Law (ABC Law), wholesalers and manufacturers are prohibited from selling products on credit to retailers that appear on the delinquent credit list. Wholesalers and manufacturers use the Online Delinquent Management System (ODMS) e-Wholesale Platform to report retailers to the delinquent credit list, remove retailers from the list when appropriate, and verify a retailer’s credit status to determine whether the retailer is eligible for credit or must pay cash on delivery. The existing ODMS e-Wholesale Platform is currently hosted at www.nyslapricepostings.com.

1.2 CALENDAR OF EVENTS

Event Date/Time

1. Solicitation Release Date: Wednesday, August 26, 2026

1. Deadline for Submission of Bidder

Questions:

Wednesday, September 9, 2026 by 2:30pm ET

3. Responses to Bidder Questions Issued:

Wednesday, September 23, 2026

4. Deadline for Bid Submission: Wednesday, October 7, 2026 by 2:30pm ET

SECTION 2: PROJECT BACKGROUND

The SLA requires a hosted Wholesale Platform to manage and streamline critical regulatory processes, including price postings, brand appointment letters, limited availability item submissions, and delinquent credit management. This document specifies the functional, technical, and support requirements for a vendor to provide a comprehensive platform.

The solution must support a diverse user base, including SLA staff, over 50,000 licensed wholesalers, manufacturers, retailers, and members of the public.

In NYS, licensed manufacturers and wholesalers of alcoholic beverages must file both wholesale prices and retail prices every month. In addition, all wholesalers are required to notify SLA/ABC of retailers that are delinquent in payment for alcoholic beverages. Retailers purchasing liquor or wine on credit have 30 days to pay the bill.

Retailers purchasing beer on credit have between 12 to 26 days to pay the bill, depending http://www.nyslapricepostings.com/

IFB C000992 Page 8 of 35 on the date of delivery within the credit cycle. If a retailer is overdue on payment on the notification date, the retailer must be reported as delinquent.

SECTION 3: BIDDER ELIGIBILITY AND MINIMUM QUALIFICATIONS

To be considered for award, Bidders must satisfy the Bidder Eligibility and Minimum Qualifications set forth below. The Bidder shall certify compliance in Attachment 3

– Bidder Eligibility and Minimum Qualifications Form. Failure to meet the bidder eligibility and minimum qualifications, or to certify compliance in Attachment 3 – Bidder Eligibility and Minimum Qualifications Form, may result in the Bid being deemed non-responsive and eliminated from further consideration.

3.1 ELIGIBILITY

Are properly licensed to conduct business in the State of New York or provide a commitment to become properly licensed to conduct business in the State of New York within 30 calendar days of the date of the award letter, if selected for the award.

3.2 QUALIFICATIONS

a. Must have a minimum of five (5) years of experience – which may be met through the combined experience of the Bidders and its proposed subcontractor(s) across multiple engagements - providing alcoholic beverage pricing and distribution platforms, including software hosting, credit management, and distribution management systems.

b. Must have a minimum of three (3) years of experience - which may be met through the combined experience of the Bidders and its proposed subcontractor(s) across multiple engagements - managing alcoholic beverage pricing and distribution platforms, including software hosting, credit management, and distribution management systems.

SECTION 4: SCOPE OF WORK AND MANDATORY SYSTEM REQUIREMENTS

Contractor shall provide Project Management services throughout the full system implementation of the ODMS e-Wholesale Platform. Contractor shall be responsible for overall system delivery and shall ensure the ODMS e-Wholesale Platform delivered full functionality, high availability, security, and comprehensive support.

All deliverables and documentation specified in this Scope of Work are mandatory requirements for the awarded Contractor. The obligation to submit deliverables is independent of the system's current configuration. The Contractor must provide all required deliverables for the State’s review and formal written approval as a mandatory baseline of this Contract. No prior documentation, historical system approvals, or existing configurations shall be accepted as a substitute for the deliverables required under this Contract. All submissions must be updated, tailored to the specific terms and timelines of this Contract, and formally approved by the State.

4.1 PROJECT PLAN AND SCHEDULE

IFB C000992 Page 9 of 35

4.1.1 Project Management Services

The Contractor’s Project Manager shall work closely with ITS and SLA/ABC Business Leads to manage the scope, schedule, budget, quality, and delivery of the project and product. The PM shall manage the Contractor’s team responsible for overall system delivery.

4.1.2 Project Approach and Resource Plan

The Contractor shall develop a detailed Project Approach document including a Resource Plan describing how work will be approached and coordinated with Testers, Quality Assurance staff, Subject Matter Experts (SME), SLA management, and other stakeholders.

4.1.3 Project Schedule

The Contractor shall develop and maintain a detailed, resource-loaded Project Schedule in Microsoft Project.

4.2 SYSTEM ARCHITECTURE AND SOFTWARE DESIGN

Technical Architecture Documentation: The Contractor shall develop and document the technical and software architecture for the hosted solution to satisfy all business requirements identified in Section 4.3 Mandatory System Requirements.

4.3 MANDATORY SYSTEM REQUIREMENTS

4.3.1 Price Posting Submissions and Management

4.3.1.1 Monthly Price Schedule Capacity

The system shall support the submission of approximately 500,000 monthly Price Schedules, as described in Exhibit 1 – Filing Period Schedules and Deadlines, across the following categories of posting types:

a. Liquor to Retail

b. Wine to Retail

c. Liquor to Wholesale

d. Wine to Wholesale

4.3.1.2 Submission and Certification Formats

The system must accommodate the submission and certification of price schedules and discounts in the following formats:

a. Batch File Submissions: Support for .csv or .txt files in accordance with the List of required and optional fields defined in Exhibit 2

– Batch File Format and Exhibit 3 – Discount File Format.

b. Interactive Submissions: Allowing Wholesalers/Manufacturers to add, edit, and remove price schedules in preparation for certification month-to-month.

c. Price Schedule Amendments: System must accommodate the Amendment of Submitted Price Schedules in accordance with the schedule in Exhibit 1 – Filing Period Schedules and Deadlines, and per the Business Rule outlined in 4.3.1.2 D below.

d. Retail Price Schedule Amendments: Amendments to the

IFB C000992 Page 10 of 35

Submitted Retail Price Schedules shall only allow the price to be lowered to a price point found and tied to a competitor’s submitted schedule for the same month.

4.3.1.3 Profile Data Submission

The system must accommodate the submission of Price Schedule profile data for each posting type, including:

a. Discounts for time of payment

b. Terms of Sale

c. Other general information, including, but not limited to, contact information, memos, remarks, or notes.

4.3.2 Price Posting Lookup and Query

4.3.2.1 System Views

The system shall support the access levels and views:

a. Public View: Flip Book Format only

b. Retailer Price Posting View: Requires login and license verification

c. Search: Search options filterable by Wholesaler/Manufacturer, posting type, and various product information.

d. Wholesaler/Manufacturer Search/View: Restricted to the current month only

e. Agency Administrative View: Access to both current and historical months.

4.3.2.2 Search Functionality

Search options filterab4le by Wholesaler/Manufacturer, posting type, and various product information.

4.3.3 Brand Appointment Letter Submission and Management

4.3.3.1 Brand Appointment Association

The system shall provide upload and search capability for Brand Appointment Letters to associate letters with the applicable Wholesaler/Manufacturer: designating them as an exclusive brand agent.

4.3.3.2 Upload Capacity and Scalability

The system shall support an average of 1,500 Brand Appointment Letter uploads annually and the system shall be implemented to accommodate future growth.

4.3.4 Limited Availability Submission and Management

4.3.4.1 Submission and Search Capabilities

The system shall provide submission and search capabilities for Limited Availability Submission items per SLA/ABC Business rules. These items are submitted when product circumstances change after the original price posting was submitted.

IFB C000992 Page 11 of 35

4.3.4.2 Monthly Capacity:

The system shall support an average of 50 Limited Availability Submissions per month and the system shall be implemented to accommodate future growth.

4.3.5 Delinquent Credit Management and Submission

4.3.5.1 Delinquency Reporting Capacity

The system must have the ability to process at least 19,000 delinquencies reported by Wholesalers/Manufacturers monthly.

4.3.5.2 Delinquency Release Capacity:

The system must have the ability to process at least 18,000 delinquencies released by Wholesalers/Manufacturers monthly.

4.3.5.3 Retailer Search and Selection

The system shall support the ability for the search and selection of licensed retailers for reporting as delinquent.

4.3.5.4 Delinquent Retailer Data Capture

The system shall support the capture, management, and reporting of the following information related to delinquent retailers:

a. Retailer Premises Information (pre-populated)

b. Date Reported

c. Delivery Date

d. Delivery Amount ($)

e. Reported By (User)

f. Comments

4.3.5.5 Delinquent Account Removal

The system shall allow the Wholesaler/Manufacturer to view their active delinquent accounts and remove accounts individually or by bulk selection. Upon removal of a delinquent account, the system shall capture the following information as part of the delinquent account record:

a. Date Removed

b. Removed By (User)

4.3.5.6 Wholesale/Manufacturer Account View

The system shall allow Wholesalers/Manufacturers to search and view their active or inactive delinquent accounts.

4.3.5.7 Retail License Delinquency Search

The system must allow Wholesalers/Manufacturers to search for retail licenses using a variety of search parameters to ascertain the delinquent status of the license:

a. Search by Premises (Serial number, Address, Premises Name, DBA, etc.)

IFB C000992 Page 12 of 35

b. Search new delinquencies added by Date Range

4.3.6 E-Wholesale Account Management

4.3.6.1 Account Management and Core Functionality

The system must have the following e-Wholesale Account Management functionality:

a. New Account Verification and First Time Account Set Up

b. Primary Administrative User Setup for Retail, Wholesale, and

Manufacturing Licenses

c. Application Login

4.3.6.2 Delegated Administration

The system shall support self-management by the Wholesaler/Manufacturer Primary Administrator, with the following functions available for administering access for their users:

a. Add

b. Edit

c. Remove users

4.3.6.3 Role-Based Access Control

The system shall support provisioning account access for the following roles under their license:

a. Price Schedule Submission, Brand Appointment Submission, and

Limited Availability Submission

b. Price Schedule Certification

c. Delinquent Account View

d. Delinquent Account Management

4.3.7 E-Wholesale Web Services (API’s)

4.3.7.1 The system must have the following e-Wholesale Web

Services (API’s) functionality:

a. Delinquency Status API: The system shall provide a web service

(API’s) for use by Wholesalers/Manufacturers to check retailer delinquent status.

b. Credential Verification: The web service will receive and verify Wholesaler/Manufacturer credentials along with a Retailer Record ID, and must respond with premises information and delinquent status.

4.3.8 Agency Administrative Interface

4.3.8.1 The System shall provide an Agency Administrative Interface, including:

a. Reports: Price Postings and Delinquent Management Reports.

b. Dashboard Administration: A dashboard displaying the Price Posting

Schedule for the entire year, with the ability to override deadlines based on the impact of holidays and weekends.

IFB C000992 Page 13 of 35

c. Schedule Posting Exceptions: Ability to schedule exceptions for individual Wholesaler/ Manufacturer and/or bulk (all Wholesalers/Manufacturers)

d. User Administration

i. Create A User

ii. Password Setup / Reset

iii. User Preference

4.3.8.2 Price Schedule Administration

The system shall provide Price Schedule Administration functionality, including:

a. Override to add, edit, or remove price schedule records.

b. Override to add or remove delinquencies.

4.4 TRAINING

4.4.1 Training Plan

The Contractor shall develop, maintain, and execute a comprehensive Training Plan for all user groups associated with the e-Wholesale platform. The Training Plan shall be submitted to the Agency, and the Contractor must be in receipt of written approval prior to execution.

4.4.2 Training Materials Format

The Contractor shall provide all training materials in an electronic format compatible with Microsoft Office or Adobe Acrobat. The Contractor shall ensure that training materials are updated to reflect final production functionality prior to Go-Live.

4.4.3 Training Completion

4.4.3.1 Training Activities

All training activities shall be completed prior to Production Go-Live unless otherwise approved in writing by the Agency.

4.4.3.2 Training Acceptance Criteria

Training shall be considered complete when:

a. All training sessions required have been delivered.

b. All training materials have been submitted and approved by the

Agency

c. Agency personnel confirm operational readiness; and

d. Any identified training gaps have been remediated.

4.4.4 Administrator Training

4.4.4.1 Instructor-Led Sessions

a. The Contractor shall conduct live instructor-led virtual training sessions for Agency

b. administrators and operations staff.

c. These sessions shall be recorded and made accessible for a minimum of twelve (12)

d. months after Go-Live.

IFB C000992 Page 14 of 35

4.4.4.2 Tracking and Reporting

The Contractor shall provide tracking and completion reporting for all Agency personnel training sessions.

4.4.5 End User Training

4.4.5.1 Tutorial Production

The Contractor must produce and deliver self-paced online training classes and user manuals for use by wholesalers, manufacturers, and retailers.

4.4.5.2 Portal Delivery

The Contractor must deliver tutorials through the online portal.

4.5 TESTING

4.5.1 End-to-End System Testing

The Contractor shall conduct rigorous End-to-End System Testing to ensure the entire system architecture functions cohesively and meets all business requirements.

4.5.2 User Acceptance Testing (UAT)

The Contractor must actively support the SLA/ABC and ITS teams throughout the planning, execution, and closure of UAT to prevent schedule delays.

The Contractor shall support Agency-led UAT activities by:

a. Providing UAT environments

b. Providing test data

c. Supporting defect resolution

d. Providing testing support personnel and

e. Tracking defects through resolution.

4.5.3 Resolution of Critical and Major Defects

The Contractor must resolve all Severity 1 (Critical) and Severity 2 (High) during any testing phase to the formal, written satisfaction of SLA/ABC.

4.6 PRODUCTION READINESS

4.6.1 Readiness Document

The Contractor shall draft, deliver and obtain Agency sign-off on a comprehensive Go-Live Readiness Document. This document must summarize the current system implementation status and provide Agency leadership with the critical, verified information required to make an informed “Go/No-Go decision.”

To satisfy this requirement, the Contactor must provide written verification, evidence, and sign off that each criterion has been fully satisfied, providing supporting evidence, test results, or system configurations where applicable:

a. Infrastructure Performance and Validation: Confirmation that all infrastructure is tested and performing as designed.

IFB C000992 Page 15 of 35

b. Software Development Completion: Confirmation that all software functionality has been provided.

c. Testing Execution and Defect Resolution: Testing per Section 4.5 has been completed, and critical/high defects are addressed.

d. Training and Operational Readiness: Requirements in Section 4.4 have been addressed.

e. Go-Live Runbook and Schedule: A step-by-step plan that covers all tasks needed to move into production.

f. Rollback and Recovery Plan: Defined and ready to be executed.

g. Post-implementation Support Plan: Defined and ready to be executed.

4.7 IMPLEMENTATION (GO LIVE) OF NEW SYSTEM

4.7.1 Solution Delivery

The Contractor shall deliver a fully functional, hosted ODMS e-Wholesale Platform that meets the business needs and all requirements set forth in this solicitation and resulting Contract.

4.7.2 Production Deployment

The Contractor shall deploy the approved system to the production environment.

4.7.3 Go Live Approval

The Contractor shall not transition the system to active production use (“Go-Live”) without prior, explicit written approval from the Agency. The Agency reserves the sole right to grant, delay, or withhold Go-Live approval.

4.8 POST-GO-LIVE SUPPORT

4.8.1 Defect Resolution Timeframes:

See Section 4.11.1 – System Availability

4.8.2 Ongoing Support Services

The Contractor shall provide ongoing operational, maintenance, monitoring, and support services following Go-Live.

4.8.3 Hypercare Support Period

The Contractor shall provide a post-Go-Live Hypercare Support period of no less than thirty (30) calendar days from go-live. During Hypercare, the Contractor shall:

a. Provide enhanced monitoring.

b. Provide daily operational reviews.

c. Conduct daily issue review meetings with the Agency.

d. Provide accelerated issue resolution.

4.8.4 Service Level Agreement Reporting

The Contractor shall provide quarterly SLA (Service Level Agreement) reporting, including:

IFB C000992 Page 16 of 35

a. Availability of metrics, Capacity metrics, and Security metrics

b. Response and Resolution Times

4.9 WARRANTY PERIOD

The Contractor shall provide an eighteen (18) month warranty period commencing upon completion of the Hypercare Support period. During the warranty period, at no additional cost to the Agency, the Contractor shall correct software defects, resolve configuration issues, correct integration failures, address performance deficiencies, address security issues, and provide root cause analysis. The warranty must be included with the system build cost.

4.10 SERVICE LEVEL REQUIREMENTS

4.10.1 System Availability

The Contractor shall ensure that the system is fully operational and available twenty-four (24) hours per day, seven (7) days per week, and fifty-two (52) weeks per year (24x7x52).

Any unscheduled system outage shall be classified as a Severity 1 event. The Contractor must respond to and resolve all unscheduled outages in accordance with the Repair Service Levels specified in Section 4.10.4.1 - Repair Service Levels.. Failure to meet these availability standards or resolve outages within the designated timeframes shall subject the Contractor to Service Credits as detailed in Section

4.10.4.1 – Repair Service Levels.

4.10.2 Scheduled Maintenance and Planned Service Interruptions The Contractor may perform regularly scheduled maintenance activities that impact system availability. The Contractor shall provide the Agency with advance notice of scheduled maintenance, including the anticipated date, time, duration, and expected impact of such activities. Scheduled maintenance shall be mutually agreed upon by the Contractor and the Agency.

4.10.3 Batch Processing Activities

The Contractor shall identify any batch processing activities that may impact system availability. The Contractor shall provide the Agency with advance notice of the schedule, anticipated duration, and expected impact of such activities

4.10.4 System Defects and Repair Service Levels

The Contractor shall address system defects, errors, and outages in accordance with the repair service levels identified in Section 4.10.4.1 – Repair Service Levels and Section 4.10.4.2 – Defect Severity Index.

4.10.4.1 Repair Service Levels

Support Level / Metric

Maximum Response Time

Maximum Resolution Time

Minimum Monthly Performance Standard

Monthly Service Credit / Penalty

IFB C000992 Page 17 of 35

(Evaluated Independently)

(Independent & Cumulative)

System Availability (Overall Uptime) N/A N/A 95.0% Uptime per calendar month.

3% flat deduction if overall monthly system availability falls below 95.0%.

Severity 1 (Critical) (e.g., Unscheduled System Outages)

4 hours from initial notification.

24 hours from initial notification (unless an alternate timeframe is agreed to in writing by ITS and the Contractor).

• 95.0% Response Time Compliance

AND

• 95.0% Resolution Time Compliance.

These credits are independent and cumulative:

• 3% deduction if Response Time compliance falls below 95.0%.

• 3% deduction if Resolution Time compliance falls below 95.0%.

Severity 2 (High) 8 hours from initial notification.

24 hours from initial notification (unless an alternate timeframe is agreed to in writing by ITS and the Contractor).

• 95.0% Response Time Compliance

AND

• 95.0% Resolution Time Compliance.

These credits are independent and cumulative:

• 2% deduction if Response Time compliance falls below 95.0%.

• 2% deduction if Resolution Time compliance falls below 95.0%.

Severity 3 (Medium)

1 Business Day from initial notification.

5 Business Days from initial notification.

• 85.0% Response Time Compliance

AND

• 85.0% Resolution Time Compliance.

These credits are independent and cumulative:

• 2% deduction if Response Time compliance falls below 85.0%.

• 2% deduction if Resolution Time

85.0%.

IFB C000992 Page 18 of 35

Severity 4 (Low)

2 Business Days from initial notification.

5 Business Days from initial notification.

• 85.0% Response Time Compliance

AND

• 85.0% Resolution Time Compliance.

These credits are independent and cumulative:

• 2% deduction if Response Time compliance falls below 85.0%.

• 2% deduction if Resolution Time

85.0%.

4.10.4.2 Defect Severity Index

Severity 1/Critical

This level of defect prevents the customer from proceeding with the core functionality of the system where no workaround is available. The customer requires an immediate solution.

A core functionality returns completely invalid results or does not work at all.

This defect indicates complete shut-down of the process, nothing can proceed further. Examples include:

System crash Massive performance degradation Data corruption or data loss Security violation

Severity 2/High

This level of severity is the same as “Severity 1”, except that a workaround exists, and the customer could wait for the defect to be fixed with the next scheduled build.

It is a highly severe defect and collapses the system, however, certain parts of the system remain functional.

Severity 3/Medium

There is impact on the non-critical features, but only in a few cases.

The core system is still functional.

Severity 4/Low

The impact on the agency is minor. Any user interface defect not complicating the functionality often gets this severity grade.

It won't cause any major break-down of the system.

Examples include Minor problem, misspelling, UI layout.

4.11 SERVICE LEVEL CREDITS

The Contractor’s failure to satisfy performance standards or requirements set forth herein may result in a credit or chargeback in accordance with Section 4.11 – SERVICE

LEVEL REQUIREMENTS:

IFB C000992 Page 19 of 35

a. The chargeback shall be paid to ITS in the form of a credit to ITS against the

Contractor’s invoice submitted to ITS immediately following the month in which the Contractor failed to satisfy the standard or requirement.

b. The Contractor shall not be penalized for failure to meet the outlined service level requirements during the occurrence of a force majeure event, for delays due to adverse events beyond the Contractor’s control (with ITS’ concurrence), or if work ceases at the direction of civil authorities.

c. In the event a force majeure or other event as described in this section interrupts work or prevents work from being performed, the Contractor will be responsible for meeting standards or requirements immediately upon cessation of the event.

4.12 CUSTOMER SUPPORT

4.12.1 Customer Technical Support (Level 1)

4.12.1.1 Support Portal

The vendor shall provide a support portal as part of the hosting service. Contact Channels Support must be accessible via E-mail and contact form

4.12.1.3 Scope of Level 1 Support

The Contractor shall provide all Level 1 technical support inquiries, including:

a. Price Posting support, Delinquent Credit support, User Account

Management and Administration support Limited Availability support, Brand Appointment Letter support, e- Wholesale Web Services (API’s) support, technical support questions, and problems with site functionality

4.12.1.4 Scope of Level 1 Support

The Contractor shall provide all Level 1 Ticket Management. The Contractor shall assign ticket numbers and log all support activity until the ticket is resolved.

4.12.1.5 Reporting

The Contractor shall provide monthly support statistics and be able to provide upon request and extract of all support tickets as requested by the

SLA.

4.12.1.6 Customer Technical Support (Level 2)

4.12.1.7 Escalation

The Contractor shall forward all tickets requiring Level 2 input to the SLA e- Wholesale mailbox (wholesale@sla.ny.gov) for input and resolution.

4.12.1.8 Status Updates

The Contractor shall update the ticket status accordingly after forwarding.

mailto:wholesale@sla.ny.gov

IFB C000992 Page 20 of 35

4.12.1.9 Level 2 Incidents

Incidents requiring Level 2 support include:

a. Logging and forwarding all requests granted to open price posting modules in response to requests from Wholesalers/Manufacturers.

b. Referring all Delinquent Credit disputes to the SLA for mitigation

c. Referring all requests for legal clarifications of the ABC Law or

Rules.

In accordance with the SLA’s directive, all confirmations for service deliveries will be exclusively communicated via email.

4.13 CUTOVER

a. The Contractor shall coordinate all production deployment activities with the

Agency.

b. The Contractor shall execute all approved migration and deployment activities.

c. The Contractor shall validate system functionality immediately following deployment.

d. The Contractor shall provide real-time deployment status updates.

e. The Contractor shall maintain dedicated Go-Live support resources.

f. The Contractor shall execute rollback procedures if critical failures occur.

4.14 ROLLBACK

a. The Contractor shall maintain documented rollback procedures capable of restoring

b. the previous production Agency in the event of critical deployment failure.

c. The Contractor shall ensure rollback procedures are fully tested and validated prior to Go-Live.

d. The Contractor shall include comprehensive data recovery procedures.

e. The Contractor shall include estimated recovery timelines and recovery time objectives within the rollback procedures.

f. The Contractor shall identify decision-making authorities and escalation paths for rollback execution.

SECTION 5: SECURITY REQUIREMENTS

5.1 SECURITY REVIEW

5.1.1 Review Coverage

Security review shall cover all aspects of the Software delivered, including third-party modules, units, integration points, components, and libraries. The review coverage will include all aspects of the application layer that are externally facing or part of the service infrastructure will be assessed.

5.1.2 Vulnerability Scanning and Penetration Testing

The Contractor agrees that, before any Software is released to the State or Authorized User, the Bidder will perform application vulnerability scanning and penetration testing. The Contractor shall provide to the State written

IFB C000992 Page 21 of 35 documentation of the results of any scans and tests, along with a mitigation plan.

The Contractor agrees that vulnerabilities identified by the vulnerability scanning and penetration testing shall be mitigated within a reasonable period of time to avoid any risk to the State.

5.1.3 Scope of Review

At a minimum, the review shall cover the most common software vulnerabilities.

The review shall include vulnerability scanning, penetration testing, and static analysis of the source code. This will be a combination of vulnerability scanning and pen testing, not static source code analysis.

5.1.4 Issues Discovered

Overall application security ratings, including the aggregate number of flaws found, will be reported to both the State and the Bidder. Detailed reports on specific vulnerability instances within the application will be provided only to the Bidder. Discovered vulnerabilities and/or flaws will be documented, with best efforts made to outline the required remediation for each area.

5.2 SECURITY ISSUE MANAGEMENT

5.2.1 Identification

The Contractor should track all security issues uncovered during the security review and the entire development life cycle, whether a requirement, design, implementation, testing, deployment, or operational issue. The risk associated with each security issue will be evaluated and documented. Security issues encountered during application deployment will be documented. These include vulnerabilities in both the software and the assessed architecture.

5.2.2 Investigation and Resolution of Security Issues

If security issues are discovered or reasonably suspected, the Contractor shall conduct an investigation to determine their nature. The issue shall be considered "novel" if it is not covered by the security requirements and is outside the reasonable scope of security testing. If novel, Bidder and State agree to scope the effort required to resolve the novel security issue(s), and to negotiate in good faith to achieve an agreement to perform the required work to address them. If not novel, the Contractor shall use all commercially reasonable efforts consistent with sound software development practices, considering the severity of the risk, to resolve all security issues not considered novel as quickly as possible.

5.2.3 Remediation

Security issues identified before the Software is released to the State shall be fixed by the Contractor before release. Security issues discovered after release shall be handled in accordance with the terms of the Contract. Steps and/or guidance for remediation will be outlined in the report delivered to NYS.

5.3 ASSURANCE

5.3.1 Certification

With execution of the Contract, the Contractor will provide to the State a copy of the Contractor’s secure coding best practices policy. Upon delivery of the Software

IFB C000992 Page 22 of 35 to the State, the Contractor shall certify to the State in writing that the Contractor complied with the policy in the performance of its obligations under the Contract, as well as certify that all security activities have been performed, and all identified security issues have been documented and resolved. Any exceptions to the certification status shall be fully documented at the time of delivery.

5.4 PERSONNEL AND ORGANIZATION

The Contractor will assign responsibility for security to a single senior technical resource, to be known as the project Security Architect. The Security Architect will certify the security of each deliverable.

The Contractor will be responsible for verifying that all members of the development team have been trained in secure programming techniques. The Contractor agrees to perform an appropriate background investigation of all development team members.

5.5 SERVICE HOSTING AND SECURITY REQUIREMENTS

The Procurement, the Bidder’s Proposal, and the contract award that results from this RFP are subject to and incorporate the following terms and conditions:

a. Security for the State's Data hosted by the Contractor or its subcontractors, if any, is the responsibility of the Contractor and will not require customization by ITS.

b. Prior to and as a condition for the Solution to be approved and accepted by ITS

(“Go Live”), the Contractor will provide a Cloud Controls Matrix and a Consensus Assessment Initiative Questionnaire (CAIQ) for ITS review. Thereafter, on an annual basis, on the anniversary of the Contract Award, Bidder will provide a current Cloud Controls Matrix and CAIQ for ITS review. The form is available on the Cloud Security Alliance website:

https://cloudsecurityalliance.org/research/cloud-controls-matrix/). The completion of this requirement is at the Bidder’s expense with no additional cost to ITS.

c. Prior to and as a condition for the Solution to be approved and accepted by ITS (“Go Live”), the Contractor will provide, at the Contractor’s expense, an independent third-party audit of all data center(s) used to perform the services under the resulting Contract showing no deficiencies. Thereafter, on an annual basis, at the Contractor’s expense. A full version of the audit report will be provided to ITS, within 30 days of the anniversary date of the Contract. A Service Organization Control (SOC) 2 Type 2 audit report or approved equivalent sets the minimum level of a third-party audit. Any deficiencies identified in the audit report or where the Contractor is found to be noncompliant with Contract safeguards must be remedied within 90 days of the issue date of the audit report, with proof of remediation provided to ITS. The completion of this requirement is at the Contractor’s expense with no additional cost to ITS.

d. All data center(s) used to perform the services under the resulting Contract data must be Tier 3 compliant to an industry standard.

e. The hosted services provided pursuant to this contract shall comply with the standards set forth by FedRAMP (https://www.fedramp.gov) for hosted services, https://www.fedramp.gov/

IFB C000992 Page 23 of 35 and other applicable federal and/or New York State laws, regulations, and requirements.

f. All requirements are applicable to the Development, Testing, and Live Production Environments. Development and testing environments may be a scaled version of production if appropriate to the testing and development being performed.

g. The Production environment must be logically separate from the other environments.

h. The technical and professional activities required for establishing, managing, and maintaining the environment are the responsibilities of the Contractor.

i. The Contractor must document its security policy, practices, and procedures related to the hosting services provided to ITS and make such information available to ITS upon request. The Contractor must have documented security monitoring, incident reporting, and handling.

j. Remediation plans following a security incident shall be provided to and approved by ITS.

k. Security incidents affecting State Data must be reported to ITS within two hours of the Contractor’s knowledge of such incident.

l. The Contractor agrees that it shall perform the hosting services in a manner consistent with the following requirements:

i. Host all State data and maintain and implement procedures to logically segregate and secure State data from the Contractor’s data and data belonging to the Contractor’s other customers, including other governmental entities.

ii. Establish and maintain appropriate environmental, safety, and facility procedures, data security procedures, and other safeguards against the destruction, corruption, or alteration of the hosting Services and any State data, and to prevent unauthorized access, alteration, or interference by third parties of the same.

iii. Utilize industry best practices and technology (including appropriate firewall protection, intrusion prevention tools, and intrusion detection tools) to protect, safeguard, and secure the System and State Data against unauthorized access, use, and disclosure. The Contractor shall constantly monitor for any attempted unauthorized access to, or use or disclosure of, any of such materials and shall immediately take all necessary and appropriate action in the event any such attempt is discovered, promptly notifying ITS of any material or significant breach of security with respect to any such materials.

iv. When software vulnerabilities are revealed and addressed by a vendor patch.

5.6 DIGITAL IDENTITY AND AUTHENTICATION

The provided service should meet or exceed the Identity Assurance and Authenticator Assurance requirements as defined by the Authorized User. Information on Identity and Authenticator Assurance requirements can be found in the NYS Digital Identity Policy (NYS-P20-001) and NYS Digital Identity Standards (NYS-S20-001) at the following web address: https://its.ny.gov/policies.

https://its.ny.gov/policies

IFB C000992 Page 24 of 35

Additionally, Authentication tokens should meet or exceed the requirements laid out in the NYS Authentication Token Standards (NYS-S14-006)

5.7 AUTHORIZATION CONTROLS

Enforce strict access checks in every service/API. Use short-lived tokens (OAuth2 JWT with expiration) and validate scopes. Implement account lockout on repeated failed logins.

Review and audit user accounts periodically.

5.8 ENCRYPTION OF DATA

Data must be encrypted in transit and at rest. Data encryption must meet or exceed the NYS Encryption Standard, NYS-S14-007, or its successor standard.

5.9 NETWORK SECURITY

Place services in a Virtual Private Cloud (VPC) with subnets (public DMZ for web tier, private for application tier, database tier). Restrict inbound traffic by security groups/firewalls: only allow HTTP/S to the web tier, and only application traffic to the backend. Deploy a Web Application Firewall (WAF) in front of web endpoints to block common web attacks (SQLi, XSS, bots). Use network ACLs to segment the DMZ from internal networks. Monitor and log all network flows (e.g. VPC Flow Logs).

5.10 ENDPOINT AND HOST PROTECTION

On application servers, use hardened OS images (CIS Benchmarks). Enable anti-malware/EDR (endpoint detection & response) on all servers. Limit administrative access (SSH/RDP) via jump hosts or bastion in DMZ and restrict to VPN or admin networks. Use disk encryption on server storage volumes.

5.11 PATCH AND VULNERABILITY MANAGEMENT

a. The Contractor must maintain a formal patching policy. Patches must be applied in

b. a manner that maintains compliance with the NYS Patch Management Standard

(NYS-S15-001).

c. The Contractor agrees that, before any Software is released to the State or

d. Authorized User, the Bidder will perform application vulnerability scanning and penetration testing as described in NYS Vulnerability Management Standard(S14- S15-001). The Contractor shall provide to the State written documentation of the results of any scans and tests along with a mitigation plan. The Contractor agrees that vulnerabilities identified by the vulnerability scanning and penetration testing shall be mitigated in the timeframes noted in the NYS Vulnerability Management Standard(S14-S15-001) to avoid any risk to the State.

5.12 PENETRATION TESTING, AUDIT AND LOGGING

Require annual (or before go-live) third-party penetration tests covering the web app, API, and network. Address all findings with risk-based mitigation techniques that meet the timelines outlined in the NYS Vulnerability Management Standard (S14-S15- 001). Provide the agency with access to security audit information upon the request of the Agency. Include SAST/DAST report reviews as part of acceptance. Logging must be

IFB C000992 Page 25 of 35 implemented to be in compliance with the NYS Security Logging Standard (NYS-S14- 005).

SECTION 6: INCIDENT RESPONSE AND MONITORING

The Contractor must document its security policy, practices, and procedures and make such information is available to ITS upon request. The Contractor must have documented security monitoring, incident reporting, and handling procedures approved by ITS as part of the final agreed-upon Support and Maintenance Plan.

6.1 LEAST PRIVILEGE AND SEGREGATION OF DUTIES

Ensure any service accounts or compute instances run with minimal privileges. For example, application servers should only communicate with the DB using a read/write account specifically limited to needed schemas. No single admin should have both development and production privileges without oversight. Maintain separate environments (dev/test/prod) with strict change control. Implement dual-control for critical operations (e.g. separate deploy and config-change roles).

6.2 SUPPLY CHAIN SECURITY

If using third-party components or libraries, verify their provenance (signed code, vetted libraries). Vet any Contractors or partners that will have system access. Require vendors to use secure development practices. (NIST SP 800-161 covers supply chain risk management; at minimum, it requires vendor attestations that they scan builds for malware and run dependency checks).

SECTION 7: DATA CLASSIFICATION AND PRIVACY

7.1 CLASSIFY DATA

Although no HIPAA data is expected, any PII (e.g. vendor reps) must be protected by privacy laws. Implement data minimization. If EU/UK customers are involved, comply with GDPR (data encryption, breach notification). If any payment data is processed (unlikely here), ensure PCI DSS controls (encryption, network segmentation, logging). CIS controls explicitly support compliance with PCI, HIPAA, GDPR, etc. (e.g. “Public” vs “Internal Business Use” vs “Confidential”).

7.2 DATA BREACH – REQUIRED BIDDER ACTIONS

Unless otherwise provided by law, in the event of a Data Breach, the Contractor must:

a. Notify the ITS Chief Information Security Office (“CISO”) and any potentially affected State(s), or their designated contact person(s), by telephone as soon as possible, but in no event more than 24 hours from the time the Bidder confirms the Data Breach;

b. Consult with and receive authorization from the State as to the content of any notice to affected parties prior to notifying any affected parties to whom notice of the Data Breach is required, either by statute or by the State;

c. Coordinate all communication regarding the Data Breach with the CISO and State (including possible communications with third parties);

IFB C000992 Page 26 of 35

d. Cooperate with the State, CISO and any Contractor working on behalf of the State or CISO in attempting (a) to determine the scope and cause of the breach; and (b) to…