ITB018663_Contract.pdf

STATE OF OHIO

DEPARTMENT OF ADMINISTRATIVE SERVICES

GENERAL SERVICES DIVISION

OFFICE OF PROCUREMENT SERVICES

4200 SURFACE ROAD, COLUMBUS, OH 43228-1395

MANDATORY USE CONTRACT FOR: FOOD SERVICE MANAGEMENT FOR THE CORRECTIONS TRAINING

ACADEMY

CONTRACT No.: ITB018663

CONTRACT ID: 18663

EFFECTIVE DATES: 4/1/25 to 3/31/28

SUPPLIER: AVI FOODSYSTEMS INC

The Department of Administrative Services has accepted bids submitted in response to Invitation to Bid No.

SRC0000014918 . The evaluation of the bid response(s) has been completed. The bidder(s) listed herein have been determined to be the lowest responsive and responsible bidder(s) and have been awarded a contract for the items(s) listed. The respective bid response, including the Instructions to Bidders and Standard Terms and Conditions, special contract terms & conditions, any bid addenda, specifications, pricing schedules and any attachments incorporated by reference and accepted by DAS become a part of this Requirements Contract.

This Requirements Contract is effective beginning and ending on the dates noted above unless, prior to the expiration date, the Contract is renewed, terminated or cancelled in accordance with the Contract Terms and Conditions.

CONTRACT RENEWAL. This Contract may be renewed after the ending date of the Contract solely at the discretion of the Contracting Agency for a period of one month. Any further renewals will be by mutual agreement between the Contractor and the Contracting Agency for any number of times and for any period of time. The cumulative time of all mutual renewals may not exceed 36 months unless the Contracting Agency determines that additional renewal is necessary.

This Requirements Contract is available to the Ohio Department of Corrections, as applicable.

Agencies are eligible to make purchases of the listed supplies and/or services in any amount and at any time as determined by the agency. The State makes no representation or guarantee that agencies will purchase the volume of supplies and/or services as advertised in the Invitation to Bid.

This Requirements Contract and any Amendments thereto are available from the OhioBuys public portal at the following address:

https://ohiobuys.ohio.gov/page.aspx/en/usr/login?ReturnUrl=%2fpage.aspx%2fen%2fbuy%2fhomepage

Signed: _____________________________________________________________________

Kathleen C. Madden, Director Date https://ohiobuys.ohio.gov/page.aspx/en/usr/login?ReturnUrl=%2fpage.aspx%2fen%2fbuy%2fhomepage

1 - SPECIFICATIONS AND REQUIREMENTS

1.1 SCOPE: The Ohio Department of Rehabilitation and Correction, Corrections Training Academy (CTA), located at 11781 State Route 762, Orient, Ohio 43146, desires to obtain the services of a food management Contractor to provide the food products, food production, food services personnel, and the management services necessary to manage a full-service cafeteria.

The Contractor must provide meal service that will be invoiced to CTA for students participating in various academic courses. The cafeteria will also provide meal service to administrative and other personnel participating in or supporting the various academic courses on a cash and card basis.

1.2 GENERAL BACKGROUND: CTA provides a variety of daily, Monday through Friday, in-residence student training programs. Students reside at CTA for the duration of a specific instructional course and the cafeteria provides three (3) meals daily; breakfast, lunch, and dinner, excluding dinner on Friday night.

1.3 BIDDER QUALIFICATIONS:

1.3.1 Bidder must provide the following certificates and licenses required to operate a food service business in the State of Ohio: Vendor's License or Seller's Use Tax Account. Bidder must have the ability to obtain a Food Service Operators License for the CTA facility issued by the Ohio Department of Health under the Ohio Administrative Code 3701-21 after award.

1.3.2 Bidder must provide an employee with a valid Serv-Safe Certificate to be on premises at all times the cafeteria is in operation.

1.3.3 Bidders must have a minimum of five years’ experience in commercial food service contracts to qualify for bidding.

1.3.4 Bidders must show proof of having successfully provided food services for at least three companies for at least two consecutive years each.

1.3.5 CTA will have no direct control over the employees of the Contractor. Any provisions for such control must be exercised only through the Contractor or the person assigned as the Contractor's Food Service Manager;

however, the Contractor must comply with reasonable requests of the Superintendent to remove and replace employees objectionable to CTA. The Contractor must obtain screening documentation for each prospective employee through the Ohio Bureau of Criminal Identification and Investigation and forward the documentation to CTA’s Superintendent for review and approval. All food service employees will be required to complete the Ohio Department of Rehabilitation and Correction Contractor Training. Click here for the Contractor Orientation Policy 39-TRN-12. This process must be completed prior to the employees’ start date.

1.3.6 The bid must specify how the management personnel assigned to the CTA will operate organizationally at the local level. Organization charts must be provided and include the following:

1.3.6.1 Overall company management structure.

1.3.6.2 Local Management structure, including outside resource personnel.

1.3.6.3 Minimum staffing levels to be used at the facility. The Contractor must ensure that a manager, supervisor, or designee is available on site at all times during normal service hours.

1.3.7 If documentation required in Section 1.3 is not returned with the bid response, documentation must be provided within five business days of request or the bid may be deemed not responsive.

1.4 FOOD SERVICE REQUIREMENTS:

1.4.1 The Contractor will supervise the food service operations on CTA's premises, the furnishing, preparation, and cleanup of food, food service utensils, and equipment, including any special dietary requirements ordered by CTA. All operational costs for goods and services necessary to provide the required food service operation as described herein for both dine in and carry-out (i.e. Styrofoam trays, cups, and flatware) must be procured and paid for by the Contractor. All costs must be incorporated into either the management fee or the cost per meal, such as labor, the cost of goods, and anticipated profit. Delivery of food and supplies procured by the Contractor must be made to the rear dock of the kitchen area during the Contractor’s hours of operation. This is not a fenced or lockdown area.

https://dam.assets.ohio.gov/image/upload/v1738173845/procure.ohio.gov/pdf/39-TRN-12_1.pdf

1.4.2 Typically, the Contractor must provide meals Monday through Friday. On designated holidays, CTA will not have any classes scheduled; therefore, no cafeteria services will be required. State observed holidays include New Year’s Day, Martin Luther King Junior’s Birthday, Presidents Day, Memorial Day, Juneteenth, Independence Day, Labor Day, Columbus Day, Veteran’s Day, Thanksgiving, and Christmas. The Academy will notify the Contractor at least one week in advance of any closings. The number of days requiring food service at CTA is estimated to be 251 days per year. There is no guarantee of the number of meals to be served or sold. The Contractor must bill for the actual number of meals served, not the estimate.

1.4.3 To accommodate training schedules, CTA may, with 24-hour advance notice, require a box lunch for a specified number of students. Meal requirements for the box lunch can be found in Section 1.5.15.7.

1.4.4 In addition to scheduled daily meals, special event meals for authorized groups as required must be served. CTA may also request a reduced special event meal. CTA will be responsible for providing the Contractor with advanced notice and information to permit the Contractor to schedule such activities. CTA reserves the right to self-cater special events with offender labor. Meal requirements can be found in Section

1.5.13.8 for Special Event Meals and Section 1.5.13.9 for Reduced Special Event Meals.

1.4.5 Standards, Laws, and Regulations the Contractor must conform to:

1.4.5.1 Ohio Department of Health, Columbus laws, local laws, and FDA rules and regulations as they apply to food service operations.

1.4.5.2 Ohio Department of Rehabilitation and Correction Food Service policies and CTA procedures. All policies and procedures will be supplied to the Contractor as needed.

1.4.5.3 U.S. Department of Health, Education and Welfare laws, rules, and regulations as they apply to food service operations.

1.5 RESPONSIBILITIES OF THE CONTRACTOR:

1.5.1 The Contractor must provide sufficiently qualified personnel to prepare, serve, and clean up all meals, in addition to an on-site manager, supervisor, or designee available at all times during normal service hours.

1.5.2 Training students, who meet the Office of Budget and Management guidelines for travel, currently do not pay for their meals. CTA will provide a scanning system by which to track those individuals as they come through the line for their meals. It will be the responsibility of the Contractor to ensure each student’s meal is scanned. The Contractor will invoice CTA for the cost of the student meals based on meal recap reports provided by CTA weekly.

1.5.3 The Contractor must provide a cash and card cafeteria meal for CTA employees, visitors, and others on-site who are interested in purchasing a meal. This cafeteria must operate Monday through Friday except on State observed holidays. The normal hours of the cash and card cafeteria must be the same as when there are students in session. When CTA is open, but there are no students present, the cafeteria must operate the lunch menu. CTA requires an itemized monthly report of revenue generated by cash and card sales.

1.5.4 If a customer wishes to use a credit or debit card to pay for a meal, the Contractor must charge them the agreed upon meal price plus a maximum three percent surcharge. Internet access for credit card machines will be provided.

1.5.5 PERSONNEL

1.5.5.1 Management Personnel/Hourly Personnel: The Contractor will furnish on-site, competently trained, and experienced food service management personnel and staff as required to meet the requirements of the contract. Additionally, a staffing chart must be submitted for the employees assigned to CTA.

1.5.5.2 Management Qualifications: The Superintendent reserves the right of reasonable refusal and dismissal at all times. The Food Service Manager will be responsible for the overall functioning of the on-site employees and for maintaining a current policy and procedure manual, with a copy to be furnished to the CTA Superintendent or designee. The Food Service Manager will participate in meetings with the Ohio Department of Rehabilitation and Correction management regarding food service dietary needs.

1.5.5.3 As required by the Ohio Uniform Food Safety Code, all shift leaders (designated person in charge) must have the Person-In-Charge (PIC) Certification in Food Protection for each shift of risk levels I-IV.

https://drc.ohio.gov/about/resource/policies-and-procedures/12-cta-corrections-training-academy-operations https://odh.ohio.gov/know-our-programs/food-safety-program/food-safety-certification/

1.5.6 FOOD SERVICE TIMES

1.5.6.1 Meals are to be served Monday through Thursday breakfast, lunch, and dinner. Friday’s meal service will include breakfast and lunch. Normal mealtime periods for students will be at the discretion of CTA. However, the approximate times will be: breakfast at 7:00 a.m. until 8:00 a.m., lunch at 11:00 a.m.

until 12:30 p.m. and dinner at 4:30 p.m. until 5:30 p.m.

1.5.7 UNIFORMS: The Contractor will provide all appropriate uniform attire, as specified by the Ohio Department of Health, and include individualized name tags, a shirt/smock, apron, hat, and gloves.

1.5.8 POLICY AND PROCEDURE: Within 90 days of award of the Contract, the Contractor must develop and provide a policy and procedure manual, with consistently applied principles of selection, training, evaluation of performance, corrective action and inventory control that are compatible with the principles of CTA. Ownership of the policy and procedure manual will remain with CTA at the termination of the Contract.

1.5.9 CLEANING: The routine cleaning and housekeeping of food preparation areas, the kitchen, all equipment associated with food service operation, and dining/sitting areas will be the responsibility of the Contractor.

Cafeteria floors and tables are to be cleaned after each meal. CTA will be responsible for painting. The Contractor will coordinate with the Superintendent’s Office, to clean the movable equipment a minimum of twice per year or as required. Kitchen sanitation will meet all State, Federal, and local Health Department requirements.

1.5.10 PROCUREMENT: The Contractor must have contractual agreements with suppliers to obtain the best price on quality products. The Contractor will procure from the least costly suppliers, except where local purchases are prudent for the purposes of freshness, quality, and availability. The payment of procured products will be the responsibility of the Contractor.

1.5.11 INVENTORY

1.5.11.1 The Contractor must maintain a sufficient supply of food products on site. To avoid any interruption of food service, the Contractor will assure timely on-site usage by rotation of food.

1.5.11.2 The Contractor must maintain a complete inventory of all food, supply items, and equipment in all food service areas, and maintain appropriate records in accordance with an established records retention schedule. The retention records must be developed and adopted by CTA and the Contractor.

1.5.11.3 Prior to the commencement of operations under this contract, the Contractor and CTA will jointly inventory all food and supplies pertaining to CTA's food service facilities. The overall dollar amount as agreed upon by the Contractor and CTA must be paid to the Ohio Department of Rehabilitation and Correction upon receipt of the invoice in the form of a credit memo to be applied to future payment to the Contractor for meals and/or management fee.

1.5.11.4 Equipment Surrender: After the final end date of this contract, the Contractor will surrender all equipment owned by CTA in the same condition as at the time of inception of the contract, less normal wear.

1.5.12 SUPPORT STAFF AND SERVICES

The Contractor must make available the following support staff and services:

1.5.12.1 Staff member on-site with the ability to train Contractor’s employees as needed.

1.5.12.2 District Manager - District supervision of Food Service Manager with on-site visitation as needed, which must be documented in writing to the CTA Superintendent or designee.

1.5.12.3 The Contractor’s Dietitian must be available to consult with CTA for evaluating individual dietetic needs.

1.5.12.4 The Food Service Manager will oversee the operations of the CTA cafeteria and must have the education and experience to successfully manage a full-service cafeteria, including prior experience in a food service management position.

1.5.12.5 CTA will provide inspection forms to be completed on a daily and weekly basis. A staff member must be available to complete the inspection forms to be submitted to CTA as required.

1.5.13 SECURITY

1.5.13.1 The Contractor must provide their own locks on all equipment requiring a secure lock.

1.5.13.2 The Contractor must provide keys of all secured locks to CTA.

1.5.14 MINIMUM FOOD QUALITY REQUIREMENTS

1.5.14.1 All foods will be fresh, frozen, canned, or otherwise shelf stable.

1.5.14.2 Processed meats will be made according to federal and state guidelines.

1.5.14.3 Beef will be USDA Grade Choice, yield grade 2 or 3.

1.5.14.4 Poultry will be US Grade A, USDA Inspected.

1.5.14.5 Pork will be USDA Grade Choice No. 1.

1.5.14.6 Fish will be frozen US Grade A. If fish is to be served, the Contractor will need to have prior approval of CTA.

1.5.14.7 Cheese will be US Grade A.

1.5.14.8 Eggs will be US Grade A.

1.5.14.9 Egg products will be pasteurized.

1.5.14.10 Milk and milk products will be US Grade A Skim.

1.5.14.11 Frozen foods will be US Grade A Fancy.

1.5.14.12 Fruits and vegetables will be US Grade A US No. 1.

1.5.14.13 Grains and grain products will be wholesome, free of contamination and purchased from a reputable supplier.

1.5.14.14 Beverages will include milk (breakfast only), fresh brewed coffee, fresh brewed tea, decaffeinated coffee, decaffeinated tea, a variety of fountain carbonated beverages, and a flavored beverage base. Fruit and vegetable juices must be available at breakfast.

1.5.15 NUTRITIONAL ANALYSIS

1.5.15.1 The nutritional analysis of the approved menu is to be available upon request. Additionally, when there are changes to the menu, the nutrient analysis for the menu change is to be posted.

1.5.15.2 The emphasis of the menu is to be on “Heart Healthy, Healthy Choice” menu items with a de-emphasis on fried foods. The Ohio Department of Rehabilitation and Correction targets the guidelines for the USDA Healthy Americans to meet the Daily Recommended Intake (DRI) of CTA’s students and staff.

It is the sole responsibility of the Contractor to implement the current applicable USDA Dietary Guidelines for Americans.

1.5.15.3 To ensure that the DRIs are met, the Contractor will offer a variety of foods since no single food can provide all the nutrients needed by the body. The variety of foods will ensure that all the essential nutrients are provided.

1.5.15.4 The following sample menus in Sections 1.5.5 through 1.5.11 outline the expectations of the menu. The weekly menu must be provided to the CTA Superintendent or designee by 7:00am each Monday, or the first day of the week that CTA is open, in the event of a closure.

1.5.15.5 The breakfast menu must include both hot and cold items and various seasonal fresh fruits, cereals, juice, and beverage. Breakfast must consist of:

• Complex carbohydrates such as cereals, bagels, breads, rolls (whole grains as available) and low fat muffins. Hot oatmeal with various toppings such as brown sugar, raisins, dried fruits and nuts.

• Fresh fruits as in season or canned fruits packed in juice.

• Beverages to include milk, 100% fruit juice, coffee, tea, and fountain carbonated beverages.

• Daily hot breakfasts must be served and may consist of French toast, pancakes, waffles, with a breakfast meat such as bacon, Canadian bacon, or sausage.

• A protein source in addition to a breakfast meat, examples may include cottage cheese, yogurt, and eggs (scrambled, hard boiled, poached, egg patties).

• Condiments, including peanut butter.

1.5.15.6 The lunch and dinner meals must consist of:

• Two entrees. One must be a hot dish that includes meat and the other must be vegetarian. The meat entrée must be available at all times. The vegetarian entrée may be served at all times or made available upon request. Vegetarian entrée requests will be made during the mealtime in which the meal is expected to be served.

• May serve an extended dish, no more than two times per week.

• Choice of two vegetables, one must be green. The salad bar is not a substitution for the green vegetable.

• A dessert.

• Fruit, fresh or canned.

• Choice of bread or rolls, one must be whole grain (two servings).

• Butter or margarine.

• Choice of fountain carbonated or non-carbonated beverage, coffee, and water.

• Condiments appropriate to the menu items.

1.5.15.7 Box lunch, when requested, must consist of:

• Sandwich

• Chips

• Fruit

• Cookie

1.5.15.8 The Contractor must provide a salad bar at both the lunch and dinner meals. The cost of the salad bar is to be included in the per meal price for lunch and dinner. The staple items of the salad bar are to include an emphasis on vegetables and fruit. The minimum items offered on the salad bar are to include:

• Lettuce salad mix

• Grated cheese either yellow or white

• Fruit (fresh or canned)

• Tomatoes

• Hard boiled eggs

• Onions

• Carrots

• Cucumbers

• Broccoli

• Radishes

• Croutons

• Celery

• Dill pickles

• Cooked beans (navy, pinto, black)

• Cauliflower

• Soup as seasonally appropriate

• Cottage cheese

• Bacon bits

• Salad dressings, four (three regular & one low fat)

1.5.15.9 The Special Event Meals must consist of:

• Entrée options including brats, burgers, and grilled chicken, with a meatless/vegetarian option available upon request.

• A cold side, such as macaroni or potato salad.

• Hot-dog and Hamburger style buns.

• Assorted toppings, including lettuce, tomato, onion, and condiments.

• Assorted chips.

• A dessert, such as a cookie.

• A fruit

• Soda and bottled water.

1.5.15.10 The Reduced Special Event Meals must consist of:

• Fruit and vegetable trays

• A Danish

• Coffee with available cream and sugar

• Bottled water

1.5.15.11 À la carte offerings must be part of the cash and card cafeteria meals. No à la carte offering will exceed the entire meal cost. At a minimum, the à la carte offering must include: salad bar and single menu item. Additional à la carte items must be prepared on site. These items will be determined between the contractor and the CTA Superintendent or designee.

1.5.16 RECORDS AND MAINTENANCE

1.5.16.1 Student Meals: Contractor will be required to maintain records to account for daily per meal counts for each student. One meal per student is to be paid by CTA. If the student chooses to purchase an additional meal, the cost will be the responsibility of the student, and the Contractor must collect the appropriate amount of money. Subsequent student meals paid via cash or card should be included on the Administration and Visiting Personnel report.

1.5.16.2 Administration and Visiting Personnel: The Contractor will be required to maintain records to account for the daily meal count at each service. The Contractor must collect the appropriate amount of money from each person that partakes in a particular meal service, other than from students obtaining meals to be paid for by CTA. The meal price must not exceed the cost per meal for a student; the difference is only the source of payment.

1.5.16.3 A written report must be made to document all injuries to personnel and guests injured on site at the CTA Cafeteria, in addition to immediate verbal notification made to the CTA staff.

1.6 FACILITIES, EQUIPMENT, UTILITIES:

1.6.1 CTA will provide all presently on-site fixed and movable equipment, electricity, gas, water, heat, and light operations for the food service department. CTA will provide adequate initial inventory of pots, pans, storage containers, and utensils for prep, cooking, and serving. Responsibility for maintaining the inventory of these items will be that of CTA. However, records of inventory count and purchase requisitions will be that of the Contractor. No equipment may be moved into or out of CTA without the approval of the Superintendent or designee. Is it the responsibility of the Contractor, at their expense, to provide disposable serving trays, bowls, plates, to-go containers, silverware, and cups.

1.6.2 Maintenance and Cleaning: CTA will be responsible for all equipment repairs and replacements. When repairs are required as a result of the willful act or negligent act on the part of the Contractor or its employees, cost of such repairs will be the responsibility of the Contractor as determined by CTA. CTA will be immediately notified of any needed repairs or replacement of equipment. CTA will maintain all food service facilities except for the routine cleaning of the kitchen and dining room areas per the specifications of this Contract. In addition, random unannounced inspections of the food service areas and cafeteria will be conducted by CTA staff. The results will be documented and provided to the Contractor. CTA’s responsibilities include:

1.6.2.1 Cleaning of exhaust hood above stoves, on planned frequency, as prescribed in the preventative maintenance schedule.

1.6.2.2 Cleaning of draperies.

1.6.2.3 Cleaning and maintenance of light fixtures.

1.6.2.4 Cleaning and replacement of windows.

1.6.2.5 Major cleaning of dining room and kitchen floors; following a planned program of stripping the floors;

and application of correct finishes and maintaining the floor surface through periodic buffing. Refinishing of floor surfaces on a scheduled program will take into account the different use conditions, traffic, type of floors and activities in the kitchen and dining room area.

1.6.2.6 Wall cleaning on a scheduled frequency.

1.7 INVOICING:

1.7.1 The Contractor shall prepare a monthly invoice in arrears with appropriate documentation for amounts due to the Contractor for meals served to Academy students. There is no guarantee of the number of meals to be served or sold. The Contractor must bill for the actual number of meals served, not the estimate. The Contractor shall invoice CTA for the cost of the student meals based on a Meal Recap report provided by CTA weekly. Cash and card sales will not be invoiced.

1.7.2 Should any unscheduled or unforeseen CTA closing be caused by electrical, heat or water problems and/or weather conditions, etc., which results in the closing of CTA for more than one day, CTA will advise the Contractor and make the necessary adjustments for the closing until such conditions are normalized and scheduled classes are resumed. No service fees will be charged during such closures.

1.8 OPERATIONAL OBJECTIVES: After award, the Contractor is required to provide their operational objectives for the food service department at CTA. These objectives must include the following:

1.8.1 Provide the employee handbook that would be used at CTA.

1.8.2 Provide a sanitation inspection report that would be routinely used at CTA.

1.8.3 Provide a food temperature and quality check procedure that will assure quality and safe temperature prior to service to all consumers.

1.8.4 Provide a safety program that would guard against accidents and provide treatment when accidents occur.

2 - STANDARD TERMS AND CONDITIONS

State of Ohio Standard Terms and Conditions (revised 03/01/24) will apply to this Contract.

3 - CONTRACT SPECIFIC TERMS AND CONDITIONS

3.1. ORDER OF PRIORITY

The order of priority of the Contract will be the following: 1.) Specifications and Requirements; 2) Contract Specific Terms and Conditions; 3) Standard Terms and Conditions.

3.2. DELIVERY

Services will be performed as set forth in the Contract. The location of performance will be 11781 State Route 762, Orient, Ohio 43146.

3.3. FIXED PRICE WITH ECONOMIC ADJUSTMENT

The contract prices(s) will remain firm for the first 12 months duration of the contract. Thereafter, the Contractor may submit a request to increase their price(s) to be effective 30 calendar days after acceptance by DAS. No price adjustment will be permitted prior to the effective date of the increase received by the Contractor from its suppliers, or on purchase orders that are already being processed, or on purchase orders that have been filled and are awaiting shipment. If the Contractor receives orders requiring quarterly delivery, the increase will apply to all deliveries made after the effective date of the price increase.

https://dam.assets.ohio.gov/image/upload/procure.ohio.gov/TCond/Standard_T_C%203-1-24.pdf

The price increase must be supported by a general price increase in the cost, due to increases in the cost of raw materials, labor, freight, Workers' Compensation and/or Unemployment Insurance, etc. Detailed documentation, to include a comparison list of the contract items and proposed price increases, must be submitted to support the requested increase. Supportive documentation should include, but is not limited to: copies of the old and the current price lists or similar documents which indicate the original base cost of the product to the Contractor and the corresponding increase, and/or copies of correspondence sent by the Contractor's supplier on the supplier's letterhead, which contain the above price information and explains the source of the increase in such areas as raw materials, freight, fuel or labor, etc.

Should there be a decrease in the cost of the finished product due to a general decline in the market or some other factor, the Contractor is responsible to notify DAS immediately. The price decrease adjustment will be incorporated into the contract and will be effective on all purchase orders issued after the effective date of the decrease. If the price decrease is a temporary decrease, such should be noted on the invoice. In the event that the temporary decrease is revoked, the contract pricing will be returned to the pricing in effect prior to the temporary decrease.

For quarterly deliveries, any decrease will be applied to deliveries made after the effective date of the decrease.

Failure to comply with this provision will be considered as a default and will be subject to the “Suspension/Termination” and the “Contract Remedies” sections of the “Standard Contract Terms and Conditions”.

3.4. FDA REGISTRATION

By submitting this Bid, Bidder is certifying, pursuant to the Public Health Security and Bioterrorism Preparedness and Response Act of 2002 (the Bioterrorism Act), that all domestic and foreign facilities used by the Contractor that manufacture, process, pack or hold food for human or animal consumption in the United States are registered with the Food & Drug Administration (FDA). This registration includes owners, operators, or agents in charge of domestic or foreign facilities that manufacture/process, pack, or hold food for human or animal consumption in the United States. All domestic facilities, whether or not food enters interstate commerce, are required to register. Facilities may complete their registration with the FDA online at:

http://www.fda.gov/food/guidanceregulation/foodfacilityregistration/default.htm

3.5 CYBER LIABILITY

Cyber liability (first and third party) with limits not less than $5,000,000 per claim, $5,000,000 aggregate. Coverage must be sufficiently broad to respond to the duties and obligations as is undertaken by Contractor in this Contract and must include, but not be limited to, claims involving infringement of intellectual property, including but not limited to infringement of copyright, trademark, trade dress, invasion of privacy violations, information theft, damage to or destruction of electronic information, release of private information, alteration of electronic information, extortion and network security. The coverage must provide for breach response costs as well as regulatory fines and penalties and credit monitoring expenses with limits sufficient to respond to these obligations.

3.6 DATA SECURITY AND PRIVACY TERMS

These Data Security and Privacy Terms (“Terms”) describe the responsibilities for the Contractor relating to State information security and privacy standards and requirements for all proposed solutions, whether cloud, on-premises, or hybrid based. These Terms applies to all work and services across all environments, and State of Ohio (“State”) and Contractor locations (e.g., cloud (Software as a Service, Platform as a Service, or Infrastructure as a Service), on-premises, or hybrid) along with the computing elements that the Contractor will perform, provide, occupy, or utilize in performing the work, and any Contractor access to State resources in conjunction with the delivery of work.

The Contractor must comply with the State IT Security Policies and Standards and these Terms and must accept the security and privacy requirements outlined in these Terms in their entirety, as they apply to the services being provided to the State. The Contractor will be responsible for maintaining information security in any environments under the Contractor’s management in accordance with State IT Security Policies and Standards.

These Terms apply to the following:

A. Major and minor projects, upgrades, updates, fixes, patches, and other software and systems inclusive of all State elements or elements under the Contractor’s responsibility utilized by the State.

B. Any systems development, integration, operations, and maintenance activities performed by the Contractor.

C. Any authorized change orders, statements of work, renewals, or amendments to the Contract.

D. Contractor locations, equipment, and personnel that access State systems, networks, or State Data directly or indirectly.

E. Any Contractor personnel that have access to State Data.

http://www.fda.gov/food/guidanceregulation/foodfacilityregistration/default.htm

These Terms are in addition to the Contract terms and conditions. In the event of a conflict between the Contract and these Terms, the most stringent standard will prevail.

Definitions

1. Contractor for purposes of these Terms, includes subcontractors or other personnel under the authority or control of the Contractor performing the work or providing the services under this Contract.

2. Personally Identifiable Information means information that can be used directly or in combination with other information to identify a particular individual. It includes:

A. A name, identifying number, symbol, or other identifier assigned to a person, B. Any information that describes anything about a person, C. Any information that indicates actions done by or to a person, D. Any information that indicates that a person possesses certain personal characteristics, E. The definitions of “personal information” in Revised Code chapters 1347.01, 1347.04 through 1347.99, and F. The various other definitions of “personal information” throughout the Ohio Revised Code.

3. Security Event has the meaning set forth in Section 7 of these Terms.

4. Security Incident has the meaning set forth in Section 7 of these Terms.

5. State Data means all data and information provided by, created by, created for, or related to the activities of the State and any information from, to, or related to all persons that conduct business or personal activities with the State, including, but not limited to Sensitive Data.

6. Sensitive Data means any type of data that presents a high or moderate degree of risk if released, disclosed, modified, or deleted without authorization. There is a high degree of risk when unauthorized release or disclosure is contrary to a legally mandated confidentiality requirement. There may be a moderate risk and potentially a high risk in cases of information for which an agency has discretion under the law to release data, particularly when the release must be made only according to agency policy or procedure.

Sensitive Data includes, but is not limited to:

A. Personally Identifiable Information (PII);

B. Family Educational Rights and Privacy Act (20 U.S.C. § 1232g);

C. Federal Tax Information (FTI) under IRS Publication 1075 - Tax Information Security Guidelines for federal, state, and local agencies;

D. Protected Health Information (PHI) under the Health Insurance Portability and Accountability Act (45 CFR

Part 160 and Subparts A, C, and E of Part 164); United States Code 42 U.S.C. 1320d through 1320d-9 (HIPAA); and Code of Federal Regulations for Public Health and Public Welfare: 42 C.F.R. 431.300, 431.302, 431.305, 431.306, 435.945, 45 C.F.R. 164.502(e) and 164.504(e);

E. Criminal Justice Information (CJI) under the Federal Bureau of Investigation’s Criminal Justice Information Services (CJIS) Security Policy available at https://le.fbi.gov/cjis-division/cjis-security-policy-resource-center;

F. Payment Card Industry Data Security Standards;

G. Social Security Administration (SSA) Data which is data received by the State from the Social Security

Administration in accordance with the current Computer Matching and Privacy Protection Act between the State of Ohio and the Social Security Administration; and

H. Other types of information not associated with an individual such as security and infrastructure records, trade secrets, and business bank account information.

7. State IT Security Policies and Standards means the policies and standards available at https://das.ohio.gov/technology-and-strategy/information-security-privacy/information-security-governance.

Requirements

1. The Contractor’s Responsibilities Generally

The Contractor is responsible for maintaining the security of information in accordance with the applicable security baseline of the current published version of the National Institute of Standards and Technology (“NIST”) Special Publication (“SP”) 800-53, “Security and Privacy Controls for Federal Information Systems and Organizations,” (“NIST 800-53”) commensurate with the type of State Data involved in the Contract as communicated by the State.

https://le.fbi.gov/cjis-division/cjis-security-policy-resource-center https://le.fbi.gov/cjis-division/cjis-security-policy-resource-center https://das.ohio.gov/technology-and-strategy/information-security-privacy/information-security-governance

If the State is providing the network layer, the Contractor must be responsible for maintaining the security of the information in environment elements that are accessed, utilized, developed, or managed by the Contractor. In either scenario, the Contractor must implement information security policies, standards, and capabilities as set forth in the Contract, adhere to State IT Security Policies and Standards, and use procedures in a manner that does not diminish established State capabilities and standards. All work performed by the Contractor, all deliverables provided by the Contractor, and all environments utilized to perform the Contractor’s work must comply with State IT Security Policies and Standards. The Contractor’s information security and technology responsibilities with respect to the work and services the Contractor is providing to the State include the following, where applicable:

A. Support State IT security policies, standards and procedures development and maintenance activities.

Assist in the implementation of associated security procedures with the State’s review and approval, including physical access requirements, User ID approval procedures, and a Security Incident action and response plan.

B. Support implementation and compliance monitoring as per State IT Security Policies and Standards.

C. Upon identification of a potential issue with maintaining an “as provided” State infrastructure element in accordance with a more stringent State level security policy, the Contractor must identify and communicate the nature of the issue to the State, and, if possible, outline potential remedies for consideration by the State.

2. Protection and Handling of State Data

Contractor shall maintain an Information Security Program (“ISP”) made up of policies, procedures, technical and organizational safeguards, and training designed to protect State Data against unauthorized loss, destruction, alteration, access, or disclosure. To protect State Data, the Contractor must use due diligence to ensure computer and telecommunications systems and services involved in storing, using, or transmitting State Data are secure and to protect State Data from unauthorized disclosure, modification, use or destruction. To accomplish this, the Contractor must adhere to the following requirements regarding State Data in addition to the confidentiality requirements in the Contract:

A. Assume all State Data is both confidential and critical for State operations.

B. Maintain, in confidence, State Data it may obtain, maintain, process, or otherwise receive from or through the State during, and pursuant to, the provisions of the Contract and these Terms.

C. Use and permit its employees, officers, agents, and subcontractors to use any State Data received from the State solely to perform its obligations under the Contract.

D. Not sell, rent, lease, disclose, or permit its employees, officers, agents, and sub-contractors to sell, rent, lease, or disclose, any such State Data to any third party, except as permitted under the Contract or required by applicable law, regulation, or court order.

E. Take all commercially reasonable steps to (a) protect the confidentiality of State Data received from the State and (b) establish and maintain physical, technical, and administrative safeguards to prevent unauthorized access by third parties to State Data received by the Contractor from the State.

F. Apply appropriate risk management techniques to balance the need for security measures against the sensitivity of State Data.

G. Ensure that internal security policies, plans, and procedures address the basic security elements of confidentiality, integrity, and availability of State Data, and periodically review and update these policies, plans, and procedures as needed.

All State Data at rest in systems supporting the Contractor’s services must reside within the contiguous United States with a minimum of two data center facilities at two different and distant geographic locations and be handled in accordance with the requirements of these Terms at all Contractor locations.

If the Contractor will be handling Sensitive Data, the State may require additional documentation such as the Contractor’s information security policies and procedures, contingency plans, or incident response plans, a Privacy Impact Assessment (PIA), FIPS-199 compliance documentation, a NIST-compliant System Security Plan (SSP), and Plans of Action and Milestones (POA&M) documentation.

3. Security Standards and Warranties

All solutions shall operate at the moderate level baseline as defined in the current published version of NIST 800- 53, be consistent with Federal Information Security Management Act, 44 U.S.C. § 3551 et seq. (“FISMA 2014”) requirements, and offer a customizable and extendable capability based on open-standards APIs that enable integration with third party applications.

Contractor’s information security program protects State Data by aligning with NIST 800-53 to implement an industry security and privacy standard including, at a minimum:

A. Security and confidentiality of State Data.

B. Protection against anticipated threats or hazards to the security or integrity of State Data.

C. Protection against the unauthorized access to, disclosure of, or use of State Data.

D. Give access to State Data only to those individual employees, officers, agents, and sub-contractors who need to know such information in connection with the performance of the obligations under the Contract.

E. Cooperate with any attempt by the State to monitor compliance with the foregoing obligations as reasonably requested by the State.

F. Promptly destroy or return to the State, in a format designated by the State, all State Data received from or through the State upon completion of the work under the Contract or upon termination or expiration of the Contract.

G. Maintain appropriate and effective business continuity and disaster recovery plans to ensure resiliency of State Data and business operations.

H. Maintain a privacy policy that includes, at a minimum, processes for the State to obtain individual privacy consent for the use of PII, at the determination of the State, and to respond to individuals’ requests to access, correct, and delete their PII unless otherwise expressly agreed to in the Contract. All PII, including PII that has been de-identified, is considered State Data and Confidential Information under this Contract.

Contractor must scan all source code for vulnerabilities, including before and after any source code changes are made, and must promptly remediate any and all vulnerabilities and provide the State with patches to address the vulnerabilities at no cost to the State. Contractor must follow best practices for application code review and the most current version of the Open Source Foundation for Application Security (OWASP) top 10.

In addition to the warranties provided and pursuant to the terms of the warranties section of the Contract (i.e., notification, correction, and indemnification), Contractor warrants that its software and/or service are free from any and all defects in materials, workmanship, and design. Contractor warrants that the software is free from any and all viruses, malware, and other harmful or malicious code.

4. Permitted Disclosure to Third Parties

Disclosure of State Data is permitted as set forth in the Contract. Additionally, disclosure of State Data is also permitted when required by applicable law, regulation, court order or subpoena. If the Contractor or any of its representatives are ordered or requested to disclose any information provided by the State, whether Sensitive Data or otherwise, pursuant to court or administrative order, subpoena, summons, or other legal process or otherwise believes that disclosure is required by any law, ordinance, rule or regulation, the Contractor must notify the State within 24 hours of receipt of the order or request in order for the State to seek a protective order or take other appropriate action, as desired. The Contractor must also cooperate in the State’s efforts to obtain a protective order or other reasonable assurance that confidential treatment will be accorded the information provided by the State.

If, in the absence of a protective order, the Contractor is compelled as a matter of law to disclose the information provided by the State, the Contractor may disclose to the party compelling disclosure only the part of such information as is required by law to be disclosed (in which case, prior to such disclosure, the Contractor must advise and consult with the State and its counsel as to the scope of such disclosure and the nature of wording of such disclosure) and must use commercially reasonable efforts to obtain confidential treatment for the information disclosed.

The Contractor may disclose Confidential Information to the following people, subject to the requirements of the Contract and these Terms:

A. To State or Federal auditors or regulators.

B. To service providers and agents of either party as permitted by law, provided that such service providers and agents are subject to binding confidentiality obligations.

C. To the professional advisors of either party, provided that such advisors are obligated to maintain the confidentiality of the information they receive.

5. Auditing

A. The Contractor must obtain an annual audit of the services being provided under this Contract that meets the American Institute of Certified Public Accountants (AICPA) Statements on Standards for Attestation Engagements (SSAE) No. 18, Service Organization Control 1 Type 2 and Service Organization Control 2 Type 2. The audit must cover all operations pertaining to the services covered by this Contract. The audit will be at the sole expense of the Contractor and the results must be provided to the State within 30 days of Contractor’s receipt of its audit results each year.

B. The State may, at any time in its sole discretion, elect to perform a Security and Data Protection Audit.

This includes a thorough review of Contractor controls, security and privacy functions and procedures, data storage and encryption methods, and backup and restoration processes. The State may utilize a third-party contractor to perform such activities to demonstrate that all security, privacy, and encryption requirements are met. The State will provide its request in writing and will work with the Contractor to schedule time to conduct the audit.

C. At no cost to the State, the Contractor must immediately remedy any issues, material weaknesses, or other items identified in each audit as they pertain to the services provided under this Contract.

6. Background Investigations of Contractor Personnel

Any person who (a) has been convicted at any time of any criminal offense involving dishonesty, a breach of trust, money laundering, or who has entered into a pre-trial diversion or similar program in connection with a prosecution for such offense, (b) is named by the Office of Foreign Asset Control (OFAC) as a Specially Designated National, or (c) has been convicted of a felony may not perform certain services under the Contract.

The Contractor must conduct background investigations on Contractor personnel that may have access to State Data. The State may conduct background investigations on Contractor personnel that have or may have access to Sensitive Data, critical infrastructure systems, or when required by law, rule, or regulation. The State will conduct initial background investigations on Contractor personnel who will have access to FTI and/or CJI that must be favorably adjudicated before being permitted to access the FTI and/or CJI, and ongoing background investigations every five years thereafter for personnel who already have access to FTI and/or CJI.

If any Contractor personnel refuses to have a background investigation completed or has an unfavorably adjudicated background investigation completed, the State may terminate that personnel’s access to the State Data.

7. Security Incidents

A. Definitions. A security incident threatens the confidentiality, integrity, or availability of State information resources. A “Security Incident” means there is a successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system.

A “Security Event” is any observable occurrence that is relevant to information security within normal operational noise levels and below pre-defined incident thresholds.

Security Incidents may fall into one or more of, but are not limited to, the following categories:

i. Loss or Theft

ii. Denial of Service (DoS)

iii. Improper Usage or Access

iv. Information Spillage

v. Malicious Code

vi. Phishing Messages

vii. Scans/Probes/Attempted Access

viii. Social Engineering

ix. Unauthorized Access

Security Events may fall into one or more of, but are not limited to, the following:

i. unsuccessful log-on attempts,

ii. unsuccessful denial of service attacks,

iii. unsuccessful phishing attacks, and

iv. unsuccessful network attacks such as pings, probes of firewalls, and port scans.

B. Security Incident Response…