ITS78 Contract User Guide 02.06.24.docx

ITS78: Statewide Contract for Data, Cybersecurity, and Related Audit, Compliance, and Incident Responses Services UPDATED: February 6, 2024

81-16-00-00 - Information Technology Service Delivery;

43-23-32-00 - Security and protection software;

83-12-00-00 - Information Services.

*The asterisk is required when referencing the contract in the Massachusetts Management Accounting Reporting System (MMARS).

Table of Contents:

Contract User Guide for ITS78

(NOTE: To access hyperlinks below, scroll over desired section and CTL + Click) NOTE: Contract User Guides are updated regularly. Print copies should be compared against the current version posted on mass.gov/osd.

Updated: February 6, 2024 Template version: 7.0 Page 1 of 12 One Ashburton Place, Suite 1608 Boston, MA, 02108-1552 Tel: (617) 720 - 3300 | www.mass.gov/osd | TDD: (617) 727 - 2716 | Twitter: @Mass_OSD | Fax: (617) 727 - 4527

NOTE: Contract User Guides are updated regularly. Print copies should be compared against the current version posted on mass.gov/osd.

Updated: February 6, 2024 Template version: 7.0 Page 4 of 12 One Ashburton Place, Suite 1608 Boston, MA, 02108-1552 Tel: (617) 720 - 3300 | www.mass.gov/osd | TDD: (617) 727 - 2716 | Twitter: @Mass_OSD | Fax: (617) 727 - 4527

· Contract Summary

· Contract Categories

· Benefits and Cost Savings

· Find Bid/Contract Documents

· Who Can Use This Contract

· Subcontractors

· Supplier Diversity Requirements

· Pricing, Quotes and Purchase Options

· Instructions for MMARS Users

· Contract Exclusions and Related Statewide Contracts

· Emergency Services

· Additional Information/FAQ's

· Performance and Payment Time Frames Which Exceed Contract Duration

· Strategic Sourcing Team Members

· VENDOR LIST AND INFORMATION

TIP: To return to the first page throughout this document, use the CTL + Home command.

Contract Summary This is a Statewide Contract for Data, Cybersecurity, and Related Audit, Compliance, and Incident Response Services. Services include a full range of audit, penetration tests, reviews, and validation of compliance with legal, regulatory and policy requirements, and related services in areas such as data breach investigation, remediation, and security of confidential information

Contract Categories and User Scenarios This contract includes 4 categories of service as listed below.

Category 1: Full range of data and cybersecurity audits and compliance reviews and related consulting services, including best practices, gap analysis, scorecards, compliance with internal and external controls (e.g., internal process and procedures, HIPAA, IRS, PII, CJIS), and control validation).

When to Use:

For organizations in the early stages of cybersecurity planning, Category 1 is a good entry point, with awarded vendors providing a baseline cybersecurity readiness assessment. Vendors are available to audit and assess organizations’ practices, infrastructure, and compliance with federal, state, other applicable laws and rules, uncover vulnerabilities and irregularities, and make recommendations for improvement. Category 1 may also be helpful in assessing changes to existing configurations and requirements. Examples of such changes could be infrastructure, vendors, policies and procedures, or legislative.

Category 2: Risk assessments as they relate to internal and external (3rd party) components. Services include risk management strategies, quality assurance audits, cloud security, vendor security, and data security management.*

When to Use:

Category 2 offers risk assessments when organizations implement significant changes to hardware or software infrastructure. Examples include a new application or server, adding cloud services, or introducing a new IT service provider. Awarded vendors review the new environment and report on possible data and security risks.

Category 3: Cybersecurity testing and readiness services including external/internal penetration testing, physical security assessments, social engineering assessments, vulnerability assessments, application testing, network security assessments, endpoint security assessments, tabletop exercises, identity and access management assessments.*

When to Use Category 3:

Vendors awarded to Category 3 provide assistance with assessing the organization's readiness for real-world cyber events, e.g. password cracking, cyber hacking, ransomware, and phishing to ensure security protocols perform as designed. Vendors essentially attempt to “break into” the network environment to identify vulnerabilities and suggest actions to prevent actual breaches.

Category 4: Information Security and Cybersecurity Incident Response services, including emergency incident response services, incident containment, mitigation, remediation, internal and external communications and required notifications, forensic investigations, managed threat detection and response. Contractors are prepared to engage within 24-48 hours, 7 days a week, and implement incident response protocols as negotiated by the buyer.**

When to Use:

When an organization believes that a cyber event may have taken place, vendors in Category 4 are available to assist with response efforts, including crisis management, business continuity, and communications strategy, among others.

* State agencies requiring engagement under this category must coordinate with and gain the approval of the Office of the Commonwealth Chief Information Security Officer (CCISO). This can be done by emailing your request to ERM@mass.gov.

** State agencies requiring engagement under this category must coordinate with and gain the approval of the Office of the Commonwealth Chief Information Security Officer (CCISO) to ensure that Enterprise systems are not at risk. This can be done by emailing your request to ERM@mass.gov.

Benefits and Cost Savings Statewide contracts are an easy way to obtain benefits for your organization by leveraging the Commonwealth’s buying power, solicitation process, contracting expertise, vendor management and oversight, and the availability of environmentally preferable products.

Find Bid/Contract Documents

· To find all contract-specific documents, including the Contract User Guide, RFR, specifications, price sheets and other attachments, visit COMMBUYS.com and search for ITS78 to find related Master Blanket Purchase Order (MBPO) information.

Who Can Use This Contract Applicable Procurement Law Executive Branch Goods and Services: MGL c. 7, § 22; c. 30, § 51, § 52; 801 CMR 21.00;

Eligible Entities Please see the standard list of Eligible Entities on our Eligible Entities Which May Use Statewide Contracts webpage.

Subcontractors The awarded vendor’s use of subcontractors is subject to the provisions of the Commonwealth’s Terms and Conditions and Standard Contract Form, as well as other applicable terms of this Statewide Contract.

Supplier Diversity Requirements When selecting contractors and placing orders without requesting quotes from multiple vendors, Executive departments shall utilize diverse and small businesses to the extent possible based on contract terms, SDO and departmental policies, laws, and regulations. Additionally, Executive Departments shall make a preference for contractors with higher SDP commitments and/or performance whenever such information is available (or is requested from contractors by the department) and the preference is feasible.

OSD provides up-to-date information on the availability of diverse and small businesses on statewide contracts through the Statewide Contract Index available on the COMMBUYS home page. See the “Programs (SDO and SBPP)” tab for current certification and small business status of contractors on this contract.

When Executive Departments are soliciting multiple quotes the following requirements apply:

· Include SBPP contract language and place it prominently within the RFQ.

· Evaluate bids received from, and award a contract to, an SBPP-participating small business that meets the department’s best value criteria.

· Award to a large business only if there is no SBPP participating business meeting departments’ best value criteria.

· Conduct a clarification/BAFO/negotiation before disqualifying an SBPP-participating business based on price or desirable criteria.

· See the Best Value Evaluation of Responses to Small Procurements: A Guide for Strategic Sourcing Teams for additional guidance.

· Make a preference for contractors with higher SDP commitments and/or performance whenever such information is available (or is requested from contractors by the department) and the preference is feasible.

· Note: Departments may ask the prime Contractor for an additional SDP commitment specifically related to the Department’s purchase or engagement. SDP spending for such a purchase or engagement must be reported by the Contractor using the SDP Reporting Form directly to the Department and may not be included in any other SDP reporting filed by the Contractor.

OSD provides up-to-date information on the availability of diverse and small businesses on statewide contracts through the Statewide Contract Index available on the COMMBUYS home page. See the “Programs (SDO and SBPP)” tab for current certification and small business status of contractors on this contract.

Pricing, Quote and Purchase Options Purchase Options The purchase options identified below are the only acceptable options that may be used on this contract:

· This is a fee for service contract Pricing Options

· Fixed Pricing: All engagements will require a SOW in the form of the “Statement of Work” with deliverable-based payments. In the SOW, Bidders must agree to identify any and all costs or charges that will be billed under the SOW.

· Hourly Pricing: All engagements will require a SOW in the form of the “Statement of Work.” In the SOW, Bidders must agree to identify any and all costs or charges that will be billed under the SOW.

Setting Up a COMMBUYS Account COMMBUYS is the Commonwealth’s electronic Market Center supporting online commerce between government purchasers and businesses. If you do not have one already, contact the OSD Help Desk to set up a COMMBUYS buyer account for your organization: (888)-627-8283 or OSDhelpdesk@mass.gov.

When contacting a vendor on statewide contract, always reference ITS78 to receive contract pricing.

Quick Search in COMMBUYS Log into COMMBUYS, and use the Search box on the COMMBUYS header bar to locate items described on the MBPO or within the vendor catalog line items. Select Contract/Blanket or Catalog from the drop-down menu.

How To Purchase From The Contract

· If soliciting multiple quotes (recommended except in unusual circumstances): Solicit quotes and select and purchase quoted item in COMMBUYS This COMMBUYS functionality provides a mechanism to easily obtain quotes, as specified by the Contract. The buyer would create a Release Requisition, and then convert it to a Bid. After approval by the buyer approving officer, the bid is then sent to selected vendors to request quotes. Buyers must include “ITS78 RFQ” when entering information in the Description field.

For a description of how to complete this purchase in COMMBUYS, visit the Job Aids for Buyers webpage, and select:

· The COMMBUYS Bids section, and choose the How to Request Quotes from Vendors on Statewide Contracts job aid OR the Quick Reference Guide (QRG) section, QRG – How to Post a Bid to Receive Quotes from Vendors on a Statewide Contract.

· If ordering directly from a vendor without seeking multiple quotes Once the Statement of Work (SOW) has been finalized, COMMBUYS users should attach it to their direct release purchase order in COMMBUYS.

· For a description of how to complete this purchase in COMMBUYS, visit the Job Aids for Buyers webpage and select:

· The COMMBUYS Requisitions section and choose the How to Make a Statewide Contract Purchase in COMMBUYS job aid.

· Note: In Step 8, enter the Unit Cost as 1. In Step 11, attach the SOW and purchase order with detailed pricing and quantity information.

· Document items in COMMBUYS that have already been purchased This type of contract allows buyers to document a contract purchase in COMMBUYS that already has taken place through a Request for Payment Authorization (RPA) Release Requisition. It also allows MMARS users to easily keep track of spend. NOTE: MMARS and COMMBUYS do not interface –payment request and invoice should be reported in both MMARS and COMMBUYS separately.

For a description of how to complete this purchase in COMMBUYS, visit the Job Aids for Buyers webpage, and select:

· The COMMBUYS Requisitions section, and choose the How to Record a Contract Purchase Previously Made (RPA Release) job aid.

Obtaining Quotes Contract users should always reference ITS78 when contacting vendors to ensure they are receiving contract pricing. Quotes, not including construction services, should be awarded based on best value.

For a full description of how to complete a quote in COMMBUYS visit the Job Aids for Buyers webpage, and select:

· The COMMBUYS Bids section, and choose the How to Request Quotes from Vendors on Statewide Contracts job aid OR the Quick Reference Guide (QRG) section, QRG – How to Post a Bid to Receive Quotes from Vendors on a Statewide Contract.

Additional Requirements for Executive Departments and other Eligible Entities that use the Commonwealth Network If this SOW will be placed under Category 2, 3, or 4 of ITS78, the Eligible Entity will work with the Executive Office of Technology Services and Security (“EOTSS”) to identify an EOTSS contact who will serve as a point of contact for the project. The EOTSS contact will be named in the Statement of Work and their signature is required on the Statement of Work. The Eligible Entity Project Manager (PM) will coordinate with the EOTSS point of contact throughout the Term of the engagement.

In the event that a point of escalation is required within EOTSS, the Eligible Entity PM will communicate with the EOTSS Chief Information Security Officer, or designee.

Instructions for MMARS Users MMARS users must reference the MA number in the proper field in MMARS when placing orders with any contractor.

Contract Exclusions and Related Statewide Contracts This contract will not include any PCI-related services.

Emergency Services Many statewide contracts are required to provide products or services in cases of statewide emergencies. ML - 801 CMR 21 defines emergency for procurement purposes. Visit the Emergency Response Supplies, Services and Equipment Contact Information for Statewide Contracts list for emergency services related to this contract.

Additional Information/FAQs Other Discounts

· Prompt Pay Discounts: A discount given to the buyer if paid within a certain time period. These discounts may be found in the Master Contract Record, in an attachment labeled Vendor Listing Spreadsheet located in the "Header Information", "Agency Attachments" section. All discounts offered will be taken in cases where the payment issue date is within the specified number of days listed by vendor and in accordance with the Commonwealth’s Bill Paying Policy. Payment days will be measured from the date goods are received and accepted / performance was completed OR the date an invoice is received by the Commonwealth, whichever is later, to the date the payment is issued as an EFT (preferred method) or mailed by the State Treasurer. The date of payment “issue” is the date a payment is considered “paid” not the date a payment is “received” by a Contractor.

Performance and Payment Time Frames Which Exceed Contract Duration All term leases, rentals, maintenance, or other agreements for services entered into during the duration of this Contract and whose performance and payment time frames extend beyond the duration of this Contract shall remain in effect for performance and payment purposes (limited to the time frame and services established per each written agreement). No written agreement shall extend more than 12 months beyond the current contract term of this Statewide Contract as stated on the first page of this contract user guide. No new leases, rentals, maintenance or other agreements for services may be executed after the Contract has expired.

Memorandum of Understanding/Statement of Work All engagements entered into under ITS78 will require a SOW in the form of the “Statement of Work” with deliverable-based payments. Contracting Departments may include additional terms in the SOW. In the SOW, any and all costs or charges that will be billed under the SOW must be clearly identified. Vendors may include options for Fixed Price engagements, Time and Materials engagements, or both. Three SOW templates, one for Fixed Price, one for Time and Materials, and one for both, are found on the Master Contract Record.

Strategic Sourcing Team Members

· Amber Debole, EOHHS

· Jenny Hedderman, CTR

· Stephanie Helm, MassCyberCenter

· John Merto, EOTSS

· Megan Perkins, EOTSS

· Bradford Smith, UMass Vendor List and Information*

MWBE

WBE

Veteran

Solicitation Enabled MBPO***

Solicitation Enabled MBPO***

Solicitation Enabled MBPO***

Solicitation Enabled MBPO***

image1.png