STATE OF OHIO

DEPARTMENT OF ADMINISTRATIVE SERVICES

GENERAL SERVICES DIVISION

OFFICE OF PROCUREMENT SERVICES

4200 SURFACE ROAD, COLUMBUS, OH 43228-1395

MANDATORY USE CONTRACT FOR: State Printing and Mail Services Disaster Recovery, Disaster Preparedness and Response

CONTRACT No.: ITB021367

CONTRACT ID: 21367

EFFECTIVE DATES: 02/01/2026 to 03/31/2029

SUPPLIER: IWCO Direct

The Department of Administrative Services has accepted bids submitted in response to Invitation to Bid No.

SRC0000034809. The evaluation of the bid response(s) has been completed. The bidder(s) listed herein have been determined to be the lowest responsive and responsible bidder(s) and have been awarded a contract for the items(s) listed.

The respective bid response, including the Instructions to Bidders and Standard Terms and Conditions, special contract terms & conditions, any bid addenda, specifications, pricing schedules and any attachments incorporated by reference and accepted by DAS become a part of this Requirements Contract.

This Requirements Contract is effective beginning and ending on the dates noted above unless, prior to the expiration date, the Contract is renewed, terminated or cancelled in accordance with the Contract Terms and Conditions.

CONTRACT RENEWAL. This Contract may be renewed after the ending date of the Contract solely at the discretion of the Contracting Agency for a period of one month. Any further renewals will be by mutual agreement between the Contractor and the Contracting Agency for any number of times and for any period of time. The cumulative time of all mutual renewals may not exceed 36 months unless the Contracting Agency determines that additional renewal is necessary.

This Requirements Contract is available to the Department of Administrative Services, State Printing and Mail Services, as applicable.

Agencies are eligible to make purchases of the listed supplies and/or services in any amount and at any time as determined by the agency. The State makes no representation or guarantee that agencies will purchase the volume of supplies and/or services as advertised in the Invitation to Bid.

This Requirements Contract and any Amendments thereto are available from the OhioBuys public portal at the following address:

https://ohiobuys.ohio.gov/page.aspx/en/usr/login?ReturnUrl=%2fpage.aspx%2fen%2fbuy%2fhomepage

Signed: _____________________________________________________________________ Kathleen C. Madden, Director Date https://ohiobuys.ohio.gov/page.aspx/en/usr/login?ReturnUrl=%2fpage.aspx%2fen%2fbuy%2fhomepage

1 SPECIFICATIONS AND REQUIREMENTS

1.1 SCOPE The Department of Administrative Services (DAS) Office of Procurement Services, on behalf of the DAS

Office of State Printing and Mail Services (the Agency), establishes this Contract for the supplies and services necessary to provide emergency back-up printing and mail services. The Contract fulfills a vital role in the Agency’s Disaster Recovery Plan for the State’s centralized print and mail services. The Contract allows the Agency to continue to serve its customers if a disaster prevents the Agency from providing these services itself. Any disaster will be determined by the Agency and is generally characterized as a serious situation where the Agency is unable to continue production at its own facilities.

The Contract scope is composed of two main service categories, Disaster Preparedness and Disaster Response.

1.1.1 Disaster Preparedness is the testing of various Agency applications to ensure the Contractor has a production environment prepared in the event that the Agency declares a disaster.

1.1.2 Disaster Response is the transfer of print and mail services to the Contractor’s production environment if the Agency has declared a disaster.

1.1.3 The following services are not included in the scope of the Contract.

1.1.3.1 Hardware procurement.

1.1.3.2 Software procurement.

1.1.3.3 Software customization.

1.1.3.4 Application development.

1.1.3.5 Business process re-engineering.

1.1.3.6 Data conversion.

1.2 GENERAL REQUIREMENTS The Contractor must be capable of all printing, fulfillment, and testing as may become necessary as part of the Agency’s Disaster Recovery Plan.

1.2.1 PRINT PLATFORM COMPATIBILITY The Contractor’s production system must be compatible with the production equipment and processing software as in use at the State of Ohio’s Printing and Mail Services operation. Refer to Exhibit One for the current list of equipment.

1.2.2 PROJECT MANAGEMENT

1.2.2.1 The Contractor must attend a Contract orientation meeting within 10 calendar days of the Contract award.

• The meeting will be held in Columbus, Ohio at a mutually acceptable date and time.

• The Contractor will demonstrate its ability to recover the Agency’s work.

• Any Contractor costs associated with this meeting will not be reimbursed by the Agency.

1.2.2.2 Project Manager The Contractor must identify a Project Manager to serve as the primary point of contact for the Contract. The Project Manager shall possess the necessary knowledge, skills, and abilities to manage application testing, system, application, and software updates, day to day communications, and inventory requirements.

The Project Manager’s responsibilities include:

• Working closely with the Agency to ensure smooth transitions at the beginning and end of the Contract term.

• Coordinating all Contractor work and Contractor personnel performing that work.

• Managing the implementation of reporting and updating procedures.

• Managing the quality control of all project deliverables and providing feedback.

• Proactively proposing options and alternatives for consideration within the scope of the Contract.

• Managing data collection and reporting as required by the Agency.

• Escalating Contract issues, risks, and other concerns.

1.2.2.3 The Project Manager, a designee, or a staffed emergency contact number must be available to the Agency 24 hours a day, seven days a week. If a disaster is declared outside of normal business hours the Agency will use this number to contact the Contractor.

1.2.2.4 The Contractor must designate an auxiliary Project Manager to serve as a back-up to the primary Project Manager.

1.2.2.5 Any change to the Project Manager or the auxiliary Project Manager will be communicated to the

Agency in writing.

1.2.2.6 The Bidder must provide proof of its disaster recovery plan and backup facility. (i.e., in the event the Contractor cannot fulfill the contract services due to its own disaster, expiration date of current disaster plan, etc.).

1.2.3 FACILITIES The Contractor must maintain production facilities suitable for the services required by the Contract. The Agency’s facilities will not be available for use by the Contractor.

1.2.3.1 The Bidder must designate facilities and provide documentation of the following:

• Location.

• Electrical back-up power capacity.

• Shipping/Receiving dock(s).

• Location topography including flood risk.

• Location risk assessment for tornados, hurricanes, or other natural disasters.

• Other pertinent information about the proposed site.

1.2.3.2 The facilities must be physically secure.

• The facilities must be inaccessible to the public.

• The facilities must include internal area security to ensure only appropriate and necessary staff members have access to the Agency’s sensitive information.

• The facilities must provide secure processing from the start of production until delivery to the U.S. Postal Service (USPS).

1.2.3.3 The facilities must include:

• On-site, secure, climate-controlled storage suitable for print and mail supplies (paper and envelopes).

• Defined and documented inventory control and security procedures to include limited staff access.

• Sufficient space to store a minimum of three days’ stock for critical applications in the event of a disaster. The availability of 10-15 standard pallet locations is considered sufficient space for the scope of this Contract.

1.2.3.4 The Contractor will fully cooperate with occasional audits, which will include storage verification as well as compliance with Contract requirements.

1.2.4 STAFF The Contractor must provide skilled and experienced staff members for operations and technical support and maintenance capable of providing the services necessary to fulfill the Agency’s requirements.

1.2.4.1 The Contractor’s staff must maintain the security and confidentiality of both the data and any controlled stock materials, i.e. warrant check stock.

1.2.4.2 The Contractor’s staff providing services related to the Contract must be bound by signed confidentiality agreements.

1.2.4.3 The Contractor’s staff with access to the production facility or area must have completed required training to include:

• IRS (Internal Revenue Service) Security Disclosure Training.

• HIPAA (Health Insurance Portability & Accountability Act) training.

• PHI (Protected Health Information) training.

1.2.5 PRODUCTION REQUIREMENTS The Contractor must have the following production capabilities.

1.2.5.1 Printing The Contractor must take the data provided by the Agency or customer agencies and accurately print forms, fonts, logos, signatures, addresses, and other items as required.

• Print shall duplicate current print format, graphics, and fonts.

• Provide MICR printing for checks.

• Print output quality must meet all postal and banking requirements.

• Some examples of the documents to be printed include:

o Financial warrant instruments (checks).

o Remittance advice.

o Professional licensure applications and renewal certificates.

o Medicaid cards.

o Injured workers claim correspondence.

o Motor vehicle registration applications.

o Driver’s license correspondence.

o Benefit correspondence.

o Tax correspondence.

1.2.5.2 Processing The Contractor must accurately collate, fold, insert, meter, and presort the printed materials as required in preparation to be transferred to the USPS.

1.2.5.3 Postal and Distribution The Contractor must accurately prepare mailings for the USPS and deliver these mailings to the USPS within 24 hours of receiving the work. The Contractor must:

• Sort items by presorted Fist Class mail for postal rate savings.

• Utilize all available postal volume discounts.

• Daily deliver to USPS.

Applications printed must be presented to the USPS within their acceptance times on the day they are metered and in accordance with the schedule provided by the Agency.

1.2.5.4 The Contractor is responsible to ensure the continuity of production. It is to proactively employ best business practices to maintain both equipment and processes in support of this Contract.

1.2.5.5 Refer to Exhibit Two for a list of the applications currently run by the Agency, critical applications will be identified for testing and upon disaster declaration.

1.2.5.6 The Agency does not provide mailing data in a mail.dat format.

1.2.6 DATA HANDLING ENVIRONMENT REQUIREMENTS The Contractor must have an established data handling environment capable of receiving the Agency’s information and then, both accurately and securely, directing that information into its production process as required.

1.2.6.1 Part of the data handling environment must include network connectivity by which the Contractor will receive data files directly from the Agency or the Agency’s customer agencies.

1.2.6.2 The environment must accept the data print stream and resource files transmitted by the various customer agencies in their original, “pre-PRISMA,” format. Refer to Exhibit Two for file formats for various applications. Current data print stream types include:

• Semi-composed AFP: composed data (generated by Metavante CSF) with embedded references to mainframe page segments, IBM fonts. This print stream type covers a large portion of the critical printing and includes unemployment warrants (checks).

• AFP Pagedef, Formdef, Line data: print stream data used primarily for internal agency reports, print using standard IBM pagedefs/formdefs. Both traditional and record format Ohio Administrative Knowledge System (OAKS) warrants.

• DJDE line data: Xerox resources, JDL, JDE, FRM, LGO, FNT, IMG, with line data. A very small percentage of work from mainframe (through XPAF).

• AFP Image: State of Ohio payroll warrants, PDFs converted to AFP image by IBM Infoprint Server.

• Fully composed AFP.

• Xerox Metacode.

• Postscript.

• PDF.

1.2.6.3 The Contractor’s data network server(s) must be located at the Contractor’s facilities and be able to accept the various formats as transmitted by the Agency’s various customer agencies. The

Contractor will coordinate any software installation and configuration (i.e. specific language fonts) required for critical applications with the Agency’s customer agency.

• The server must have an operating system/platform suitable to accept files from the Agency.

• The server protocols must be resident and can be updated as they become available from the customer agency (estimated monthly).

• For initial set-up and for testing, the Contractor must have a format integrity that matches that of the Agency for each application.

• The server must have the ability to process all applications noted by the Agency as noted in the specifications and be consistent with the time requirements.

1.2.6.4 The Contractor shall have network and server security procedures in place for data and resources to include secure FTP services.

1.2.7 Reporting The Contractor must provide reports as required for both Disaster Preparedness tests and Disaster Response services. Proposed report formats must be submitted to the State’s Infrastructure Specialist, or other individual as identified by the Agency, for approval within 30 days after the effective date of the contract. Once both parties have agreed to the format of the report, it shall become the standard to follow for the duration of the Contract. Other reports may be required.

The reports will not be considered complete until the State Printing and Mail Services’ Assistant Administrator has formally accepted them and will notify the Contractor via email.

1.2.7.1 A report with the following information (at a minimum) for each application will be due daily from the Contractor upon testing initiation or disaster declaration.

• Printing:

o Job name of printed file (ex: WANO 343).

o Image counts, the total number of impressions by job.

• Fulfillment:

o Pieces mailed by job name.

o Total cost of postage.

o Presort savings.

1.2.7.2 Monthly report of resident resources that include the following information for each application.

• Resource name.

• Date of latest software version.

1.2.7.2 Reports must be provided in the following formats:

• Printing: PRISMA production report daily

• Fulfillment: DFWorks inserting report named Postage Accounting report daily

1.3 DISASTER PREPAREDNESS The testing of various Agency applications to ensure the Contractor has a production environment prepared in case the Agency declares a disaster.

1.3.1 The Contractor must designate a testing point of contact. This can be the Project Manager or another designee.

1.3.2 The Contractor must be prepared to recover the Agency’s work within 24 hours after contract award.

1.3.3 Testing Requirements:

1.3.3.1 Test each application as it is set up, and this test will include test print, data integrity, and fulfillment.

1.3.3.2 Twice yearly testing shall include up to 13 applications per test period for a total of not to exceed 26 applications per year.

1.3.3.3 Comply with testing two times a year (spring and fall, dates to be mutually agreed upon). The testing will also ensure that all requirements of the Contract are demonstrated. The tests will be of a sample up to 3,000 impressions and 1,000 mail pieces of identified applications per test. 100% of the test samples must be delivered to Agency representatives within 48 hours of file transmission to the Contractor for validation that all print and mail fulfillment requirements have been met.

1.3.3.4 The Contractor will provide a testing verification report for each application tested, and upon request. The report is to include the following information:

• Application name.

• Resource, latest revision.

• Date of data transmission used in test.

• Printed material produced and processed correctly.

1.3.3.5 Testing Accuracy: Applications tested must meet a 98.5% accuracy threshold.

1.3.4 COST STRUCTURE The Contract costs for the Disaster Preparedness portion of the work include a monthly subscription fee to reserve the services required for these tests and a fee for each application tested.

1.4 DISASTER RESPONSE Upon formal notification (formal notification details to be established between the Agency and the Contractor, an example is the use of a confidential password) that a disaster has interrupted the Agency’s ability to provide critical services, the Contractor must:

1.4.1 Within two hours of the Agency’s notification that a disaster has been declared:

1.4.1.1 Secure its facilities.

1.4.1.2 Confirm network connectivity and begin receiving data files.

1.4.1.3 Begin acclimating supplies.

1.4.1.4 Confirm, to the Agency, the manager whom the Contractor has designated as the main point of contact.

1.4.2 Provide production services within 24 hours of the Agency’s notification.

1.4.2.1 When necessary, the Agency will provide OAKS warrant stock, roll and cut sheet, and envelopes within 24 hours. This may be facilitated by drop shipments to the Contractor’s facilities.

1.4.2.2 In the event that the Agency cannot provide specific items, the Contractor will use standard paper and envelopes.

1.4.2.3 The Contractor will use its permit and meters to process the mail on behalf of the Agency.

• The Agency will send funds from emergency appropriations to the Contractor for the actual postage within 24 hours of the disaster notification.

• Some large customer agencies have separate postage metering accounts and must be processed using their own funding. The Contractor must coordinate directly with these customer agencies for the transfer of postal funds.

1.4.3 Provide continuous facility and data security.

1.4.4 At the conclusion of the disaster declaration:

1.4.4.1 Within 24 hours of the end of the disaster declaration, return all excess postal funds to the Agency.

1.4.4.2 Provide certification of destruction of any printed or electronically stored unprinted data once the required reports have been compiled and submitted.

1.4.4.3 Coordinate with the Agency to return unused supplies provided per Section 1.4.2.1.

1.4.5 COST STRUCTURE: The Contract costs for the Disaster Response portion of the work include a disaster declaration and plan initiation fee and costs directly related to the type of printing/mailing services that are required.

1.5 Agency Staff Responsibilities

1.5.1 The Agency Administrator, or designee, will make the decision to formally declare that a disaster has interrupted the Agency’s ability to provide critical services.

1.5.2 The Agency Administrator or designee has the authority to modify the application testing schedule, resources, and/or the funding allocated to the testing schedule, and act as a final arbiter on proposed changes.

1.5.3 The State’s Infrastructure Specialist, or designated individual, will provide the following services:

1.5.3.1 Facilitate coordination between State of Ohio Contractors (Contractors for paper and envelopes.

Special paper and envelopes should be available for drop shipment within 24 hours of disaster declaration.)

1.5.3.2 Facilitate communication between different customer State agencies (IT-networking, Integrated Services, Personnel Department, Accounting, Administration, etc.).

1.5.3.3 Escalation of high priority issues as determined by the Agency.

1.5.3.4 Conducting regular and ongoing review of the Agency’s Disaster Recovery Plan to verify that it meets original objectives and requirements and to confirm the role the Contract fulfills to support the plan.

1.5.3.5 Provide acceptance sign-off for testing results and reports.

1.5.3.6 Ensure timely availability of State resources.

1.5.3.7 Make key implementation decisions, as identified by the Contractor’s project manager, within 48 hours of their request.

2 STANDARD TERMS AND CONDITIONS

The State of Ohio Standard Terms and Conditions (revised 03/31/25) govern this Contract and are incorporated as if fully rewritten herein.

3 CONTRACT SPECIFIC TERMS AND CONDITIONS

3.1 ORDER OF PRIORITY The order of priority of the Contract will be the following: 1.) Specifications and Requirements; 2) Contract Specific Terms and Conditions; 3) Standard Terms and Conditions.

3.2 AMENDMENT TO CONTRACT TERMS AND CONDITIONS The following Amendments to the Contract Terms and Conditions do hereby become a part hereof. In the event that an amendment conflicts with the Contract Terms and Conditions, the Amendment will prevail.

3.3 FIXED PRICE WITH ECONOMIC ADJUSTMENT The contract price(s) will remain firm for the first six months duration of the contract. Thereafter, the Contractor may submit a request to increase their price(s) to be effective 30 calendar days after acceptance by DAS. No price adjustment will be permitted prior to the effective date of the increase received by the Contractor from its suppliers, or on purchase orders that are already being processed, or on purchase orders that have been filled and are awaiting shipment. If the Contractor receives orders requiring quarterly delivery, the increase will apply to all deliveries made after the effective date of the price increase.

The price increase must be supported by a general price increase in the cost, due to increases in the cost of raw materials, labor, freight, Workers' Compensation and/or Unemployment Insurance, etc. Detailed documentation, to include a comparison list of the contract items and proposed price increases, must be submitted to support the requested increase. Supportive documentation should include, but is not limited to: copies of the old and the current price lists or similar documents which indicate the original base cost of the product to the Contractor and the corresponding increase, and/or copies of correspondence sent by the Contractor's supplier on the supplier's letterhead, which contain the above price information and explains the source of the increase in such areas as raw materials, freight, fuel or labor, etc.

Should there be a decrease in the cost of the finished product due to a general decline in the market or some other factor, the Contractor is responsible to notify DAS immediately. The price decrease adjustment will be incorporated into the contract and will be effective on all purchase orders issued after the effective date of the decrease. If the price decrease is a temporary decrease, such should be noted on the invoice. In the event that the temporary decrease is revoked, the contract pricing will be returned to the pricing in effect prior to the temporary decrease.

For quarterly deliveries, any decrease will be applied to deliveries made after the effective date of the decrease.

Failure to comply with this provision will be considered as a default and will be subject to the “Suspension/Termination” and the “Contract Remedies” sections of the “Standard Contract Terms and Conditions.”

3.4 INSURANCE In addition to the insurance coverages required in the Standard Terms and Conditions, the following are also required:

https://dam.assets.ohio.gov/image/upload/procure.ohio.gov/TCond/Standard_T_C_3-31-25.pdf

3.4.1 CYBER LIABILITY Cyber liability (first and third party) with limits not less than $5,000,000 per claim, $5,000,000 aggregate. Coverage must be sufficiently broad to respond to the duties and obligations as is undertaken by Contractor in this Contract and must include, but not be limited to, claims involving infringement of intellectual property, including but not limited to infringement of copyright, trademark, trade dress, invasion of privacy violations, information theft, damage to or destruction of electronic information, release of private information, alteration of electronic information, extortion and network security. The coverage must provide for breach response costs as well as regulatory fines and penalties and credit monitoring expenses with limits sufficient to respond to these obligations.

3.4.2 PROFESSIONAL LIABILITY Errors and omissions liability, including correction of work, with covered perils including, but not limited to, defamation, invasion of privacy, copyright and trademark infringement, plagiarism, piracy, unfair competition, infliction of emotional distress, misappropriation of ideas, libel and slander. Limits shall not be less than $2,000,000 per occurrence or claim. Coverage shall be sufficiently broad to respond to the duties and obligations undertaken by the Contractor in this agreement and shall cover all applicable contractor personnel or subcontractors who perform professional services related to this agreement.

3.4.3 CRIME INSURANCE (Employee Dishonesty) with a limit not less than $1,000,000 per occurrence or claim.

The policy shall be endorsed to include coverage for third party losses (Client’s Property endorsement), with a loss payable clause in favor of the State of Ohio. In the event the Contractor is a sole proprietor, a fidelity bond or irrevocable letter of credit may be provided in lieu of employee dishonesty insurance.

3.5 DATA SECURITY AND PRIVACY TERMS The Data Security and Privacy Terms are fully rewritten in Exhibit Three.

4 INVITATION TO BID INSTRUCTIONS

Instructions, Terms and Conditions for Bidding that apply to the solicitation.

5 SPECIAL INSTRUCTIONS TO BIDDERS

5.1 EVALUATION Bids will be evaluated in accordance with Article I-15 of the “Instructions to Bidders”. In addition, the State will multiply the unit cost by the estimated usage listed in the item grid and then add each of the totals together to arrive at a total for all items. Failure to bid all items may result in the bidder being deemed not responsive.

5.2 CONTRACT AWARD The Contract will be awarded to the lowest responsive and responsible bidder by low lot total. Low lot total will be determined by multiplying the unit cost by the estimated usage listed in the item grid and then adding each of the totals together to arrive at a total for all items. Failure to bid all items may result in the bidder being deemed not responsive.

5.3 DESCRIPTIVE LITERATURE The Bidder may be required to submit descriptive literature of the supplies or services being offered. If requested, the literature will be used in the evaluation process to determine the lowest responsive and responsible bidder. If not provided as part of the bid response, the Bidder must provide said literature within three business days after request/notification by the Office of Procurement Services to do so.

Failure of the bidder to furnish descriptive literature either as part of their bid response or within the time specified herein may deem the bidder not responsive.

5.4 REQUIRED DOCUMENTATION The Bidder must submit required documentation related to the supplies or services being offered. The documentation will be used in the evaluation process to determine the lowest responsive and responsible bidder. If not provided as part of the bid response, the Bidder must provide said literature within three business days after request/notification by the Office of Procurement Services to do so.

Failure of the bidder to furnish documentation either as part of their bid response or within the time specified herein may deem the bidder not responsive.

5.4.1 Per 1.2.2.6 the Bidder must provide proof of its disaster recovery plan/backup facility. (i.e., in the event the

Contractor cannot fulfill the Contract due to its own disaster, expiration date of current disaster plan, etc.).

5.4.2 Per 1.2.3.1 the Bidder must designate facilities and provide documentation of the following:

• Location.

• Electrical back-up power capacity.

• Shipping/Receiving dock(s).

• Location topography including flood risk.

• Location risk assessment for tornados, hurricanes, or other natural disasters.

• Other pertinent information of the proposed site.

https://procure.ohio.gov/pdf/OhioBuys_ITB_Instructions_to_Bidders_030921.pdf

5.4.3 Per Section 1.2.4 the Contractor must provide skilled and experienced staff members for operations and technical support and maintenance capable of providing the services necessary to fulfill the Agency’s requirements. The Bidder must upload both the confidentiality agreement and a listing of the required information privacy training it utilizes.

5.4.4 The Bidder must provide a copy of its USPS mail acceptance agreement in the name of the organization that will process and deliver the mail to the USPS.

5.4.5 The Bidder must provide a minimum of three references for organizations or clients for whom the Bidder has successfully provided services on projects that were similar in their size, scope, nature, and complexity to those required in this solicitation. These references must relate to work that was completed within the past five years.

5.4.6 STATE IT POLICY, STANDARD AND SERVICE REQUIREMENTS

SUPPLEMENT A RESPONSE The Bidder must include a fully completed copy of Supplement A with its bid. The Supplement template can be found in the bid questionnaire. The Bidder must follow the completion instructions contained in the supplement when preparing its response. When responding, the Bidder should note the redaction process described in section 5.4.7. Failure of a Bidder to submit a fully completed Supplement A response with its bid response may cause the bid to be deemed not responsive.

5.4.7 PROPRIETARY INFORMATION As set forth in Ohio Administrative Code 123:5-1-07 and 123:5-1-08, if a

Bidder includes in its Bid information it considers exempt from disclosure in a public records request, it must submit a redacted version of any document containing such information, as further described in this paragraph. Bidders must only redact (black out) the specific language that is exempt from disclosure pursuant to the Ohio Public Records Act. Examples of actions that are not acceptable for the protection of information in a Bid include: (a) redaction of sections in their entirety simply because they may contain some information exempt from disclosure pursuant to the Ohio Public Records Act; (b) inclusion of a blanket confidentiality or copyright notice anywhere in the Bid; and (c) redaction of the costs bid in their entirety. Prices, makes, models, catalog numbers of the items offered, deliveries, and terms of payment will be available for public inspection regardless of any designation to the contrary.

In addition to the redacted document(s), Bidders must submit a list of each redaction with a detailed legal explanation for each redaction to demonstrate that the redacted information is protected under the Ohio Public Records Act. A blanket statement that all redactions are exempt from disclosure pursuant to the Ohio Public Records Act and/or the Uniform Trade Secrets Act is not a sufficient explanation. The redacted version(s) must be submitted as an electronic copy in a searchable PDF format. The redacted version(s) and accompanying explanation, as submitted, will be available for inspection and released in response to public records requests.

By submitting a redacted Bid, the Bidder agrees to indemnify the State, DAS, and the Agency for any court costs, statutory damages, attorney fees, or other award issued against the State, DAS, or the Agency for any violation of the Ohio Public Records Act resulting from the State, DAS, or the Agency providing the Bidder’s redacted version of its Bid in response to a public records request.

By not submitting a redacted version of the Bid information including Supplement A with accompanying explanation, a Bidder consents to the release of the original Bid submission in response to a public records request. If redacted version(s) with the accompanying explanation are not submitted, or if an improperly redacted version or insufficient explanation is submitted, the State will advise the Bidder in writing what portions of the Bid submission are subject to disclosure in response to public records requests.

EXHIBIT ONE

CURRENT EQUIPMENT

Shop

Identifier Printing Equipment

Serial Number

Manufacturer Description

Crawford Technologies software Crawford Technologies

Print file prep software

PRISMA Software Versions 5.4.74 & 6 Canon Printer software

Unit 1 Océ ColorStream 6000 18200 Canon Roll to roll with Hunkeler unwinder and rewinder Unit 2 Océ ColorStream 6000 18221 Canon

Unit 1 Océ ColorStream 6000 18224 Canon Roll to roll with Hunkeler unwinder and rewinder Unit 2 Océ ColorStream 6000 18225 Canon varioPRINT VP6200 Titan 207000069 Canon Cut-sheet MICR Ink varioPRINT VP6200MP Titan 206010089 Canon Cut-sheet MICR Ink varioPRINT 6250 Titan 206010090 Canon Cut-sheet black ink

Shop Identifier

Inserting Equipment Serial

Number Mail Insert System

Provider Description

EC Insite Windows 10 BlueCrest Piece Tracking software DFWorks software 1501004 BlueCrest Postage Accounting software

Mainstream Productivity Series (MPS) roll fed inserter

1221990 BlueCrest MPS with Hunkeler unwinder, high capacity, four pocket

2 MPS roll fed inserter 1342108 BlueCrest

Advanced Productivity Series (APS) roll fed inserter

721516 BlueCrest APS with Hunkeler unwinder, high capacity, four pocket

4 APS roll fed inserter 721515 BlueCrest

5 Rival mail inserting system 207558 BlueCrest Cut-sheet inserter, four pocket

Mailstream Evolution (MSE) inserting system

207562 BlueCrest Cut-sheet inserter, six pocket

7 Rival mail inserting system 207564 BlueCrest Cut-sheet inserter, six pocket

EXHIBIT TWO

APPLICATIONS CURRENTLY PROCESSED

Application name w/description

Agency Form

Reference Dimension

Form Spec

SIM/DUP

Monthly Pages

Monthly Mail

Pieces Frequency

Mail Deadline

Barcode Source Queue

App.

Type

OAKSFIN-RTA... Vendor, TANF, & Tax refund checks

DAS/OAKS OAKS Cut 8.5 x 11 Special Warrant

SIM 10,000 10,000 daily Return to Agency

2D CRAW_DUP CSF/AFP

OAKSFIN-ROL... Vendor, TANF, & Tax refund checks

DAS/OAKS OAKS Cut 8.5 x 11 Special Warrant

SIM 200,000 200,000 daily 4 days 2D CRAW_DUP CSF/AFP

OAKSHCM-RTA... Payroll checks

DAS/HRD OAKS Cut 8.5 x 11 Special Warrant

SIM 10,000 10,000 Bi-weekly Return to Agency

2D CRAW_DUP PDF

OAKSHCM-EFT... Payroll notices

DAS/HRD EFT 8.5 x 11 20 # cut sheet

SIM 20,000 10,000 Bi-weekly Payday Friday

2D CRAW_DUP PDF

JFSWA…CHK1

Unemployment checks

JFS OAKS Cut 8.5 x 11 Special Warrant

SIM 5,000 5,000 daily 1 day 2D OJI CSF/AFP

JFSWA… Notices hand collated with CHK1 above

JFS FM11 8.5 x 11 20 # DUP 100 100 varies 1 day 2D OJI CSF/AFP

JFSWA…SPCK

Unemployment checks, RTA

JFS OAKS Cut 8.5 x 11 Special Warrant

SIM 5,000 5,000 daily Return to Agency

2D OJI CSF/AFP

JFSWA…190W UC notices JFS 190W 8.5 x 11 20 # DUP 5,000,000 1,000,000 daily 1 day 2D OJI CSF/AFP

JFSWA…FM11 UC notices, 8(+) pages, 9x12 manila

JFS FM11 8.5 x 11 20 # DUP 100,000 10,000 daily 1 day 2D OJI CSF/AFP

JFSWA-... Ohio Means Jobs letters

JFS FM11 8.5 x 11 20 # SIM 10,000 10,000 daily 1 day 2D

JFS_PDFS_P

rod

CSF/AFP

SRCRG… SOURCE notices JFS 190W 8.5 x 11 20 # DUP 600,000 200,000 daily 1 day 2D JFSPROD CSF/AFP

WQCNxxx... SETS Child support letters

JFS 190W 8.5 x 11 20 # DUP 2,000,000 400,000 daily 1 day 2D JFSPROD CSF/AFP

HATSX… State hearing notices

JFS 190W 8.5 x 11 20 # DUP 50,000 10,000 daily 1 day 2D HATS CSF/AFP

HATSX… State hearing notices, 8(+) pages, 9x12 manila

JFS 190W 8.5 x 11 20 # DUP 50,000 10,000 daily 1 day 2D HATS8 CSF/AFP

RCEX… UC Review Commission notices

JFS 190W 8.5 x 11 20 # DUP 50,000 10,000 daily 1 day 2D RCEX CSF/AFP

RCEX… UC Review Commission notices, 8(+) pages, 9x12 manila

JFS 190W 8.5 x 11 20 # DUP 50,000 10,000 daily 1 day 2D RCEX CSF/AFP

JFSN… SNAPCASH notices JFS 190W 8.5 x 11 20 # DUP 10,000,000 2,000,000 daily 1 day 2D MEDICAID CSF/AFP

APPLICATIONS CURRENTLY PROCESSED (CONT’D)

Agency Form

Reference Dimension

Form Spec

SIM/DUP

Monthly Pages

Monthly Mail

Pieces Frequency

Mail Deadline

Barcode Source Queue

App.

Type

MEDN... Medicaid Notice of Action

MED 190W 8.5 x 11 20 # DUP 10,000,000 2,000,000 daily 1 day 2D MEDICAID CSF/AFP

MEDC… Medicaid ID cards MED 1901card 8.5 x 11

20 # ID

card perf DUP 100,000 100,000 daily

1 day(aux), 1st of Mo

2D MEDICAID CSF/AFP

PRV-MCD800001...

MED/MITS Provider Network

MED FM11 8.5 x 11 20 # DUP 4,000 2,000 daily 1 day Craw 2D

CRAW_DUP CSF/AFP

PAU... MED/MITS Prior Authorization

MED FM11 8.5 x 11 20 # DUP 4,000 2,000 daily 1 day 3 of 9 MITSCUT1 CSF/AFP

TPL... MED/MITS Third Party Letters

MED FM11 8.5 x 11 20 # DUP 4,000 2,000 daily 1 day 3 of 9 MITSCUT1 CSF/AFP

TXS… Tax STARS TAX FM11 8.5 x 11 20 # SIM/DUP 600,000 200,000 daily Notice date 2D TAX_STARS CSF/AFP

FM11... Tax STARS, RTA TAX FM11 8.5 x 11 20 # SIM/DUP 10,000 10,000 daily Return to Agency none TAX_STARS CSF/AFP

FM17…Tax STARS, RTA TAX FM17 8.5 x 14 20 # SIM/DUP 10,000 10,000 daily Return to Agency none TAX_STARS CSF/AFP

FM19… Tax STARS, RTA TAX FM19 8.5 x 14 20 # bottom perf

SIM/DUP 10,000 10,000 daily Return to Agency none TAX_STARS CSF/AFP

FM19… Tax STARS TAX FM17 8.5 x 14 20 # SIM/DUP 600,000 200,000 daily Notice date 2D TAX_STARS CSF/AFP

FIOTS... Ohio Tax Services TAX FM17 8.5 x 14 24 # bottom perf

SIM/DUP 600,000 200,000 daily Notice date 2D TAX CSF/AFP

FIOTS... Ohio Tax Services TAX FM11 8.5 x 11 24 # bottom perf

SIM/DUP 600,000 200,000 daily Notice date 2D TAX CSF/AFP

BWCLT... General correspondence notices

BWC 190W 8.5 x 11 20 # DUP 2,000,000 500,000 daily 1 day 2D BWC CSF/AFP

BWCES... Exam schedule notices

BWC 190W 8.5 x 11 20 # DUP 2,000,000 500,000 daily 1 day 2D BWC CSF/AFP

BWCPR... Provider letters BWC 190W 8.5 x 11 20 # DUP 40,000 20,000 daily 1 day 2D BWC PDF

BWCID... ID cards BWC IDCD 8.5 x 11 cardstoc k 1/2-fold

SIM 10,000 10,000 daily 1 day 2D BWC CSF/AFP

APPLICATIONS CURRENTLY PROCESSED (CONT’D)

Agency Form

Reference Dimension

Form Spec

SIM/DUP

Monthly Pages

Monthly Mail

Pieces Frequency

Mail Deadline

Barcode Source Queue

App.

Type

BWCIV... Invoice Debits BWC FM15 8.5 x 11 20 # bottom perf

DUP 3,000,000 1,000,000 daily 1 day 2D BWC CSF/AFP

BWCIC... Invoice Credits BWC 190W 8.5 x 11 20 # DUP 3,000,000 1,000,000 daily 1 day 2D BWC CSF/AFP

BWCWE…WARRANTEMP,

POD TWG…Employer, MDW, TWG warrants

BWC

DP51/FM1

8.5 x 11

Special Warrant/

20# DUP 50,000 10,000 daily 2 days 2D

BWC

CSF/AFP

BWC-WARRANTS-PTX…

PTX series

BWC

DP51/FM1

8.5 x 11

Special Warrant/

20# DUP 50,000 10,000 daily 2 days

Craw 2D

CRAW_DUP

CSF/AFP

… Indicates that additional characters vary by individual print/mail job

Note: All applications may not be critical for the purpose of the Agency’s Disaster Recovery Plan.

EXHIBIT THREE

DATA SECURITY AND PRIVACY TERMS

These Data Security and Privacy Terms (“Terms”) describe the responsibilities for the Contractor relating to State information security and privacy standards and requirements for all proposed solutions, whether cloud, on-premises, or hybrid based. These Terms apply to all work, services, and personnel across all environments, and State of Ohio (“State”) and Contractor locations (e.g., cloud (Software as a Service, Platform as a Service, or Infrastructure as a Service), on-premises, or hybrid) along with the computing elements that the Contractor will perform, provide, occupy, or utilize in performing the work, and any Contractor access to State resources in conjunction with the delivery of work.

The Contractor must comply with these Terms as they apply to the services being provided to the State. The Contractor is responsible for maintaining information security in any environments under the Contractor’s management in accordance with these Terms.

These Terms are in addition to the Contract terms and conditions. In the event of a conflict between the Contract and these Terms, the most stringent standard will prevail.

Definitions

1. Contract means the contract entered into between the Contractor and the State to which these Terms are attached and/or incorporated.

2. Contract Data means State Data that the Contractor has access to, transmits, processes, possesses, creates or stores in providing services to the State.

3. Contractor means the person or entity with whom the State has entered into the Contract and, for purposes of these Terms, includes subcontractors or other personnel under the authority or control of the Contractor performing the work or providing the services under this Contract.

4. Personally Identifiable Information as defined in the Ohio Revised Code means information that can be used directly or in combination with other information to identify a particular individual. It includes:

A. A name, identifying number, symbol, or other identifier assigned to a person, B. Any information that describes anything about a person, C. Any information that indicates actions done by or to a person, D. Any information that indicates that a person possesses certain personal characteristics.

5. Security Event is any observable occurrence that is relevant to information security within normal operational noise levels and below pre-defined incident thresholds that does not adversely impact or potentially impact Contract Data or information systems.

6. Security Incident means there is successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system.

7. State Data means all data and information provided by, created by, created for, or related to the activities of the State and any information from, to, or related to all persons that conduct business or personal activities with the State, including, but not limited to Confidential Data. All State Data is and will remain the property of the State and, unless specifically provided otherwise in the Contract, Contractor acquires no right, title, or interest in or to State Data.

8. Confidential Data means any type of data that is required to be protected by law or regulation, is intended for confidential use, and may not be copied or removed from the State’s operational control without authorized permission. Confidential Data includes data that, if compromised, may result in loss of life, serious injury, or other harm to an individual or group, or disruption to critical State operations. Confidential Data is included in the definition of Confidential Information in the Contract.

Confidential Data includes, but is not limited to:

A. Personally Identifiable Information (PII);

B. Student information under the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g);

C. Federal Tax Information (FTI) under IRS Publication 1075 - Tax Information Security Guidelines for federal, state, and local agencies;

D. Protected Health Information (PHI) under the Health Insurance Portability and Accountability Act (45

CFR Part 160 and Subparts A, C, and E of Part 164); United States Code 42 U.S.C. 1320d through 1320d-9 (HIPAA); and Code of Federal Regulations for Public Health and Public Welfare: 42 C.F.R.

431.300, 431.302, 431.305, 431.306, 435.945, 45 C.F.R. 164.502(e) and 164.504(e);

E. Criminal Justice Information (CJI) under the Federal Bureau of Investigation’s Criminal Justice Information Services (CJIS) Security Policy available at https://le.fbi.gov/cjis-division/cjis-security-policy-resource-center;

F. Payment Card Industry Data Security Standards (PCI DSS);

G. Social Security Administration (SSA) Data which is data received by the State from the Social Security

Administration in accordance with the current Computer Matching and Privacy Protection Act between the State of Ohio and the Social Security Administration; and

H. Other types of information not associated with an individual such as security and infrastructure records, trade secrets, and business bank account information.

9. State IT Security Policies and Standards means the policies and standards available at https://das.ohio.gov/technology-and-strategy/information-security-privacy/information-security-governance.

Requirements

1. The Contractor’s Responsibilities Generally

At a minimum, the Contractor must maintain the security of Contract Data in accordance with the moderate level security baseline of the current published version of the National Institute of Standards and Technology Special Publication 800-53, “Security and Privacy Controls for Federal Information Systems and Organizations,” (NIST 800-53). In the alternative, the Contractor may maintain the security of Contract Data in accordance with International Organization for Standardization 27001 (ISO 27001) if the Contractor implements the additional necessary controls to achieve compliance with the requirements of NIST 800-53. Hereinafter, references in these Terms to “NIST 800-53" means both of the frameworks defined in this paragraph.

The Contractor must implement the information security policies, standards, and capabilities set forth in the Contract, support the State’s adherence to the State IT Security Policies and Standards, and use procedures in a manner that does not diminish established State capabilities and standards.

If the Contractor accesses the State’s facilities or networks, or provides products, solutions, or services that will be implemented or integrated in the State’s controlled environment, the Contractor must ensure its products, solutions, or services comply with State IT Security Polices and Standards, as appropriate (available at the link provided above in the definition of State IT Security Policies and Standards).

The Contractor’s information security and technology responsibilities with respect to the work and services the Contractor is providing to the State include the following, where applicable:

A. Assist in the implementation of associated security procedures with the State’s review and approval, including physical access requirements, User ID approval procedures, and a Security Incident action and response plan.

B. Support implementation and compliance monitoring as per the State IT Security Policies and Standards.

C. Upon identification of a potential issue with maintaining an “as provided” State infrastructure element in accordance with a more stringent State level security policy, the Contractor must identify and communicate the nature of the issue to the State, and, if possible, outline potential remedies for consideration by the State.

https://le.fbi.gov/cjis-division/cjis-security-policy-resource-center https://le.fbi.gov/cjis-division/cjis-security-policy-resource-center https://das.ohio.gov/technology-and-strategy/information-security-privacy/information-security-governance https://das.ohio.gov/technology-and-strategy/information-security-privacy/information-security-governance

2. Protection and Handling of Contract Data

The Contractor must maintain an information security program made up of policies, procedures, technical and organizational safeguards, and training designed to protect Contract Data against unauthorized loss, destruction, alteration, access, or disclosure. To protect Contract Data, the Contractor must use due diligence to ensure that computer and telecommunications systems and services involved in storing, using, or transmitting Contract Data are secure and prevent Contract Data from unauthorized disclosure, modification, use, or destruction. To accomplish this, the Contractor must adhere to the following requirements regarding Contract Data in addition to the confidentiality requirements in the Contract:

A. Assume all Contract Data is both confidential and critical for State operations.

B. Maintain, in confidence, Contract Data it may obtain, maintain, process, or otherwise receive from or through the State during the term of the Contract and pursuant to the provisions of the Contract and these Terms.

C. Use and permit its employees, officers, agents, and subcontractors to use any Contract Data received from the State solely to perform its obligations under the Contract.

D. Not sell, rent, lease, disclose, or permit its employees, officers, agents, and subcontractors to sell, rent, lease, or disclose, any Contract Data to any third party, except as permitted under the Contract or required by applicable law, regulation, or court order.

E. Take all commercially reasonable steps to (a) protect the confidentiality of Contract Data received from the State and (b) establish and maintain physical, technical, and administrative safeguards to prevent unauthorized access by third parties to Contract Data received by the Contractor from the State.

F. Apply appropriate risk management techniques to balance the need for security measures against the sensitivity of Contract Data.

G. Ensure that the Contractor’s internal security policies, plans, and procedures address the basic security elements of confidentiality, integrity, and availability of Contract Data, and periodically review and update these policies, plans, and procedures as needed.

All Contract Data at rest in systems supporting the Contractor’s services must reside within the contiguous United States with a minimum of two data center facilities at two different and distant geographic locations, ensuring physical and environmental protection controls are implemented as defined in State IT Security Policy 2100-15, and be handled in accordance with the requirements of these Terms at all Contractor locations. All Contract Data that is not classified as public by the State must be encrypted at rest and while in transit utilizing industry standards that meet Federal Information Processing Standards (FIPS) validated algorithms and comply with State IT Security Policy IT-14, Securing Confidential Data.

If the Contractor will be accessing, processing, transmitting, possessing, creating, or storing Confidential Data, the State may require additional documentation from the Contractor and/or input to complete State documentation.

3. Security Standards and Warranties

All solutions shall operate at the moderate level baseline as defined in the current published version of NIST 800-53, be consistent with Federal Information Security Management Act, 44 U.S.C. § 3551 et seq. (FISMA 2014) requirements and offer a customizable and extendable capability based on open-standards APIs that enable integration with third party applications.

The Contractor’s information security program must be designed to protect Contract Data…