ITS78 RFR_Version 2~1.docx

COMMONWEALTH OF MASSACHUSETTS

OPERATIONAL SERVICES DIVISION

Request for Response (RFR)

Document Title: STATEWIDE CONTRACT FOR DATA, CYBERSECURITY, AND RELATED AUDIT, COMPLIANCE AND INCIDENT RESPONSES SERVICES

Agency Document Number: ITS78

COMMBUYS Bid#: BD-21-1080-OSD03-SRC01-59288

March 2, 2021

Please Note: This is a single document associated with a complete Bid (also referred to as Solicitation) that can be found on www.COMMBUYS.com. Bidders are responsible for reviewing and complying with all Bid requirements. Bidders may contact the OSD Help Desk at COMMBUYS@mass.gov or at 1-888-MA-STATE for technical assistance with COMMBUYS. The Help Desk is staffed from 8:00 AM to 5:00 PM Monday through Friday Eastern time, as applicable, except on federal and state holidays.

Bidders with disabilities or hardships that seek reasonable accommodation, which may include the receipt of RFR information in an alternative format, must communicate such requests in writing to the contact person. Requests for accommodation will be addressed on a case by case basis. A Bidder requesting accommodation must submit a written statement which describes the Bidder’s disability and the requested accommodation to the contact person for the RFR. The SST reserves the right to reject unreasonable requests.

Revision History

· Section 4.2 updated to include note re: offshore work.

· Section 4.5 updated to include managed services.

· Response Template Section A-1 updated to reflect 2 (two) roles rather than 1 (one)

· Response Template Section A-4(C) updated to specify the list only needs to include sanctions related to the performance of the services sought under this RFR.

· Response Template Part B updated to remove the following sentence “Details on the specific services and performance details should be included under PART C – WORK PLAN”

· Response Template Section B-1 updated to remove references to offshore worked being prohibited. Added in sentence stating that offshore work would require prior approval.

· Response Template Section B-2, B-3, B-4, and B-5 updated to state when PDF attachments would be acceptable.

REQUEST FOR RESPONSE STATEWIDE CONTRACT FOR DATA AND CYBERSECURITY, AND RELATED AUDIT, COMPLIANCE, AND INCIDENT RESPONSES SERVICES

Document Sensitivity Level: High during development; Low once published. Template v 3.0.0

REQUEST FOR RESPONSE STATEWIDE CONTRACT FOR DATA, CYBERSECURITY, AND RELATED AUDIT, COMPLIANCE, AND INCIDENT RESPONSES SERVICES

Table of Contents Page iv Document Sensitivity Level: High during development; Low once published.

INTRODUCTION AND BID OVERVIEW

Summary Description of Procurement The Commonwealth of Massachusetts and the Data and Cybersecurity Strategic Sourcing Team (SST) are soliciting Bidders for the acquisition of services pertaining to data and cybersecurity, excluding PCI-related services. Services shall include a full range of audit, penetration tests, reviews, and validation of compliance with legal, regulatory and policy requirements, and related services in areas such as data breach investigation, remediation, and security of confidential information. The resulting Contract will serve as the primary Statewide Contract used by Executive Agencies of the Commonwealth for the goods and services covered by the Contract. This procurement will replace those services currently offered under PRF56 that are not available under PRF73. The Contract will also be available for use by other Eligible Entities.

The Commonwealth seeks vendors to provide the above services in the following categories, which will be awarded separately:

· Category 1: Full range of data, cybersecurity audits, compliance reviews and related consulting services

· Category 2: Risk assessments as they relate to internal and external (3rd party) components

· Category 3: Cybersecurity testing and readiness services

· Category 4: Information security and cybersecurity incident response services Estimated Procurement Calendar

Training for Online Submission – Contractors that have not previously submitted electronic quotes via COMMBUYS are strongly encouraged to attend training

How to Register for Vendor Training

Dates and Times Available:

Locate and Respond to Bids on COMMBUYS (Live Webinar (Online):

3/10/2021 10AM – 11AM

3/24/2021 1PM – 2PM

4/8/2021 10AM – 11AM

4/22/2021 2PM – 3PM

OSD Training for Vendors

YouTube Video:

How to Find Bids (Solicitations) and Submit Quotes (Respond) https://www.youtube.com/watch?v=IG7XDNk4-U0

Online Webinar:

Locate and Respond to Bids in COMMBUYS

Late bids will not be considered.

Times are Eastern Time (US), as displayed on the COMMBUYS system clock after logging in. If there is a conflict between the dates in this Procurement Calendar and dates in the Bid’s Header, the dates in the Bid’s Header on COMMBUYS shall prevail. Bidders are responsible for checking the Bid record, including Bid Q & A, on COMMBUYS for Procurement Calendar updates.

Submission of Bid Questions The “Bid Q & A” function in COMMBUYS allows Bidders to ask written questions and receive written answers regarding this Bid. To locate the Bid Q & A, log into COMMBUYS, locate the Bid, acknowledge receipt of the Bid, and scroll down to the bottom of the Bid Header page. The “Bid Q & A” button allows Bidders access to the Bid Q & A page.

All questions must be submitted through the Bid Q & A page. Questions must be asked prior to the Deadline stated in the Estimated Procurement Calendar. The Strategic Sourcing Team (SST) reserves the right not to respond to late questions. Bidders are responsible for verifying that their questions are recorded in COMMBUYS and appear on the Bid Q & A page.

Questions submitted to the SST outside of COMMBUYS will not be answered.

Content entered must be suitable for public viewing. Bidders must not include inappropriate content, including but not limited to, information that could be considered personal, security sensitive, inflammatory, incorrect, or collusory. The SST reserves the right to edit or delete any inappropriate content.

All answers are final when posted. Any subsequent revisions to previously provided answers will be dated.

Bid Amendment Deadline The SST reserves the right to make amendments to the Bid after initial publication. It is each Bidder’s responsibility to check COMMBUYS for any amendments, addenda or modifications to this Bid, and any Bid Q & A records related to this Bid. The SST and the Commonwealth accept no responsibility and will provide no accommodation to Bidders who submit a Quote based on an out-of-date Bid or on information received from a source other than COMMBUYS.

At the SST’s discretion, the Bid Amendment Deadline may be extended. Should this occur, the “Deadline for Quotes/Responses” shall be extended as well. As stated above, it is the responsibility of the bidder for checking the Bid record in COMMBUYS for revisions and updates.

Late Bids will not be Considered Bid responses must be received in full by the bid opening date and time shown on COMMBUYS ("Bid Opening Date/Time", i.e., the Deadline for Quotes/Bid Responses). Proposals received after the deadline will be ineligible for consideration and deemed non-responsive. Each bidder/offeror must submit all required bid response forms electronically through COMMBUYS. When submitting a quote electronically through COMMBUYS, please allow sufficient time to complete any online forms and upload documents. If you are in the middle of uploading your proposal when the deadline is reached, the system will stop the process and you will be unable to submit your Quote. It is recommended that Quotes be submitted as far in advance as possible before the deadline to allow time to obtain assistance from the OSD Help Desk if needed.

Debriefing The SST will conduct debriefings for unsuccessful Bidders, if requested within 14 calendar days of notification that your Quote has not been selected for an award. Debriefing guidelines will be provided in advance prior to the debriefing.

Additional Bid Information Anticipated Contract Duration:

The initial term of this Contract is 5 (five) years. In addition, this Contract has 2 (two) year options to renew of up to 1 (one) year each with a maximum possible contract duration of 7 (seven) years.

Performance and payment time frames which exceed Contract duration All term leases, rentals, maintenance or other agreements for services entered into during the duration of this Contract and whose performance and payment time frames extend beyond the duration of this Contract shall remain in effect for performance and payment purposes (limited to the time frame and services established per each written agreement). No written agreement shall extend more than 1 (one) years beyond the final termination date of this Statewide Contract. No new leases, rentals, maintenance or other agreements for services may be executed after the Contract has expired. Any contractor entering into new engagements with eligible entities after contract expiration will be subject to remedial measures, which may include but are not limited to mandatory point deduction for future bid submissions and suspension of other contracts with OSD.

Estimated Value of the Contract The estimated value of purchase(s) resulting from this Bid is unknown. The Commonwealth makes no guarantee that any commodities or services will be purchased from any Contract resulting from this Bid. Any estimates or past procurement volumes referenced in this Bid are included only for the convenience of Bidders and are not to be relied upon as any indication of future purchase levels.

Comparison data with past contracts are not available for the goods/services being solicited in this Bid. However, the SST believes that there is a significant opportunity for business for interested Bidders.

Estimated Number of Awards The target maximum number of Contractors is 40 (forty). The SST may award more or fewer contracts, if it is in the best interests of the Commonwealth to do so.

Contract renewals will be offered at the sole discretion of OSD in consultation with the Commonwealth CISO. At a minimum, offers to renew will be contingent upon satisfactory contractor performance, compliance with reporting requirements, and adequate sales volume.

Adding Contractors after initial Contract Award If, over the life of the Contract, the SST determines that additional Contractors should be added in order to meet the requirements of the Commonwealth, these may first be drawn from qualified companies which responded to this Bid but were not awarded contracts and/or the Bid may be reopened to obtain additional Quotes.

Acquisition Method(s):

Entities Eligible to Use the Resulting Contract Any Contract(s) resulting from this Bid will be open for use by the following entities:

· Cities, towns, districts, counties and other political subdivisions;

· Executive, Legislative and Judicial Branches, including all Departments and elected offices therein;

· Independent public authorities, commissions and quasi-public agencies;

· Local public libraries, public school districts and charter schools;

· Public hospitals owned by the Commonwealth;

· Public institutions of higher education;

· Public purchasing cooperatives;

· Non-profit organizations that are doing business with the Commonwealth;

· Other states and territories with no prior approval by the State Purchasing Agent; and

· Other entities when designated in writing by the State Purchasing Agent.

Each eligible entity is responsible for executing its own purchase orders and paying its own invoices for goods and/or services acquired from this Contract. Contractors will be responsible for marketing their goods and/or services to Commonwealth Agencies and other eligible entities.

ADDITIONAL INFORMATION ON PROCUREMENT SCOPE

Procurement Exclusions This contract will not include any PCI-related services Bidder Qualifications Company experience Business background The ITS78 RFR Data and Cybersecurity Response Template ("Response Template") includes questions concerning the bidder's business background and experience relative to the services sought in this RFR.

Years in the industry of the Bid While longer experience is desirable, bidders must have been in the business of providing Data and Cybersecurity Services for at least the six (6) most recent consecutive months prior to the RFR submission deadline (See RFR Section 1.2, Estimated Procurement Calendar). Experience will be evaluated along with other qualifications.

In the case of companies formed fewer than six (6) months prior to this date via merger, acquisition or some other means, the SST may consider the experience of all companies involved in the merger or acquisition.

Employee and/or business technical/business experience, certifications, licenses Specifications are found in the ITS78 RFR Data and Cybersecurity Response Template ("Response Template") for the Bidder's company and each RFR Category.

Emergency Response Capabilities Bidders bidding under Category 4, Information Security and Cybersecurity Incident Response Services, must be prepared to engage within 24-48 hours, 7 days a week, and implement an Incident Response Protocol as outlined as part of this procurement with more details as negotiated in a Statement of Work (SOW).

Financial stability including bankruptcy, litigation and contract defaults Bankruptcy, litigation, and contract defaults Bidders must provide a list of any outstanding contingencies, such as lawsuits or other claims or charges, against the Bidder related to performance of the services sought under this RFR. Additional requirements in this area are specified in the Response Template.

Requirements for Specific Engagements Bidders must provide audited financial statements if requested to do so by an eligible entity in their bid for specific engagements.

References and reference information and/or requirements Reference letters are desirable but not required. Bidders must provide references if requested to do so by an eligible entity in their bid for specific engagements.

SERVICE, ENVIRONMENTAL, AND COST SPECIFICATIONS

Service Specifications Eligible services Bidders will be qualified separately in the following categories:

· Category 1: Full range of data and cybersecurity audits and compliance reviews and related consulting services including best practices, gap analysis, scorecards, compliance with internal and external controls (e.g., internal process and procedures, HIPAA, IRS, PII, CJIS), and control validation.

· Category 2: Risk assessments as they relate to internal and external (3rd party) components. Services should also include risk management strategies, quality assurance audits, cloud security, vendor security and data security management. State agencies requiring engagement under this category must coordinate with and gain the approval of the Office of the Commonwealth Chief Information Security Officer (CCISO).

· Category 3: Cybersecurity testing and readiness services including external/internal penetration testing, physical security assessments, social engineering assessments, vulnerability assessments, application testing, network security assessments, endpoint security assessments, tabletop exercises, identity and access management assessments. State agencies requiring engagement under this category must coordinate with and gain the approval of the Office of the Commonwealth Chief Information Security Officer (CCISO).

· Category 4: Information Security and Cybersecurity Incident Response services including emergency incident response services, incident containment, mitigation, remediation, internal and external communications and required notifications, forensic investigations, managed threat detection and response. Contractors prequalified under this section must be prepared to engage within 24-48 hours, 7 days a week, and implement an incident response protocol with more details as negotiated in a SOW. State agencies requiring engagement under this category must coordinate with and gain the approval of the Office of the Commonwealth Chief Information Security Officer (CCISO) to ensure that Enterprise systems are not at risk.

It is not expected that bidders will have expertise in all areas requested. Bidders should specify applicable specialties in the Response Template. Please note that other services as determined by the Commonwealth CIO and/or CISO may also be required.

Geographic coverage Vendors agree to provide services for the entire Commonwealth. Offshore work may be permitted under specific circumstances with prior approval from the Commonwealth Chief Information Security Officer.

Ordering and Quotes Responding to Buyer’s quote requests is a requirement of this contract. Contractors choosing not to bid must respond to COMMBUYS quote requests with a “no bid”.

Contractors must provide a quote that clearly identifies all commodities, materials, services and/or requirements which may incur costs for the Eligible Entity. All quotes must be for only products and/or services that Contractor is awarded to sell under this Statewide Contract. Furthermore, Contractors may not bill Eligible Entities for costs not identified in the quote, accepted by the SST, and agreed to by the Eligible Entity unless otherwise specified.

Environmental Specifications In 2009, Executive Order 515, establishing an Environmental Purchasing Policy for Executive Departments, was signed. View the Environmentally Preferable Products (EPPs) Procurement Program General Information, Requirements and Guidance for detailed information about the program at https://www.mass.gov/doc/epp-general-information-requirements-and-guidance/download.

Bidder Current Environmental Practices Form Bidders must complete this form, located on the Attachments tab of this RFR, and submit it with their Quote. The form allows Bidders to communicate existing business practices that foster a sustainable approach to conducting their operations and reduce environment or public health impacts. Bidders may receive additional points in the evaluation phase of the RFR for the environmental initiatives they identify, however, bidders must substantiate all answers in order to receive additional points.

Environmental plan Awarded Bidders must agree to work with OSD and the SST to examine the feasibility of implementing an environmental plan throughout the life of the contract. Such a plan may include, but not be limited to, implementing energy initiatives, adopting and implementing sustainability policies or third-party standards and/or certifications, or publicizing their environmental initiatives. The objective of this requirement is to actively encourage suppliers to incorporate sustainable practices throughout their business operations and further market such practices to Contract users. Bidders may include written proposals submitted as an attachment to their Quote detailing a commitment to action contingent upon receipt of a Contract award.

Compensation Structure/Pricing All engagements entered into under ITS78 will require a SOW in the form of the “Statement of Work” with deliverable-based payments. Contracting Departments may include additional terms in the SOW. In the SOW, Bidders must agree to identify any and all costs or charges that will be billed under the SOW. Bidders may include options for Fixed Price engagements, Time and Materials engagements, or both. Where appropriate, Bidders may also include options for managed services.

COMMBUYS Setup

Services

Hourly or Fixed-price fees Unless otherwise specified, Bidders may include options for Fixed Price engagements, Time and Materials engagements, or both. All engagements entered into under ITS78 will require a SOW in the form of the “Statement of Work” with deliverable-based payments. In the SOW, Bidders must agree to identify any and all costs or charges that will be billed under the SOW.

Business Expenses The Bidder’s quoted fixed price or hourly rates when submitting quotes for engagements under this contract must include all standard business expenses (including fringe benefits, overhead, profit, telecommuting, office equipment and supplies) that the Bidder incurs in connection with its performance of IT Services. The exception is “Travel Expenses”. The Bidder may bill for reasonable travel expenses, excluding commuting, only with the prior written approval of the Contracting Department. No administrative or other markup is permitted for travel expenses. The Statement of Work will define compensation for travel, if any.

Prompt Pay Discount All Bidders must agree to offer discounts through participation in the Commonwealth Prompt Payment Discount (PPD) initiative for receiving early and/or on-time payments, unless the Bidder can provide compelling proof that it would be unduly burdensome.

Bidders must submit agreeable terms on the Prompt Payment Discount Form, included on the Bid, unless otherwise specified by the SST. The SST will review, negotiate or reject the offering as deemed in the best interest of the Commonwealth.

The requirement to offer a PPD may be waived by the SST on a case-by-case basis if participation in the program would be unduly burdensome on the Bidder. If a Bidder is claiming that this requirement is a hardship or unduly burdensome, the specific reason must be documented in the Bidder’s Quote.

SUPPLIER DIVERSITY PLAN (SDP)

Massachusetts Executive Order 565 reaffirmed and expanded the Commonwealth’s policy to promote the award of state contracts in a manner that develops and strengthens certified Minority Business Enterprises (MBEs), Women Business Enterprises (WBEs), Minority and Women Nonprofit Organizations (M/WNPOs), Veteran Business Enterprises (VBEs), Service-Disabled Veteran-Owned Business Enterprises (SDVOBEs), Disability-Owned Business Enterprises (DOBEs), and Lesbian, Gay, Bisexual and Transgender Business Enterprises (LGBTBEs).

All bidders are required to make a significant financial commitment to partner with certified M/WBEs, M/WNPOs, VBEs, and/or SDVOBEs, DOBEs and/or LGBTBEs certified or verified by the Supplier Diversity Office (SDO). Bidders must identify a commitment in the form of a specific percentage of sales made under the resulting contract that will be spent with an SDP Partner(s) on a Massachusetts fiscal year basis, using SDP Plan Form #1 – SDP Plan Commitment. This percentage commitment will extend for the life of any resulting contract.

This requirement extends to all bidders regardless of their certification status, and no bidder will be awarded a Contract unless and until the above requirement is met. In planning their SDP commitment, Bidders certified by SDO must note that the commitment cannot be met by making expenditures within their own company or with parent or wholly owned subsidiary companies. Therefore, Bidders may not list themselves or affiliates as SDP Partners. In order to ensure compliance with this section and encourage bidder participation, SDP Plans submitted by bidders will be evaluated by the SST at 10% or more of the total available 100% evaluation points. Note: this does not mean that the bidder must commit 10% of sales. Questions concerning how the SDP works may be directed to the Supplier Diversity Office (SDO) or bidders may view a description of the SDP on the SDO webpage at www.mass.gov/sdo.

EVAULATION CRITERIA

Contractors must submit responses that meet all the submission requirements of the RFR. Only responsive proposals that meet the submission requirements will be evaluated, scored and ranked by the evaluation team according to the evaluation criteria. Additional information may be requested for evaluation purposes.

Any submission which fails to meet the submission requirements of the RFR will be found non-responsive without further evaluation unless the evaluation team, at its discretion, determines that the non-compliance is insubstantial and can be corrected. In these cases, the evaluation team may allow the contractor to make minor corrections to the submission.

Bidder scores will be used to rank Bidders and will determine which Bidders will proceed to subsequent stages of the evaluation and/or enter into negotiations with the Commonwealth to receive a Contract award.

Mandatory Requirements Bidders who do not meet all mandatory requirements may be disqualified. The SST may determine if non-compliance with a mandatory requirement is insignificant, or can be corrected or clarified.

Alternatives Unless otherwise specified, Bidders may submit Quotes proposing alternatives which provide equivalent, better or more cost-effective performance than achievable under the stated Bid specifications. These alternatives may include related commodities or services that may be available to enhance performance during the period of the Contract. The Quote should describe how any alternative achieves substantially equivalent or better performance to that of the Bid specifications.

The SST will determine if a proposed alternative method of performance achieves substantially equivalent or better performance.

Evaluation Components The following components will be some of the criteria considered by the team when evaluating each Quote: The completed ITS78 RFR Data and Cybersecurity Template for the category or categories are mandatory.

Bidders may bid on multiple categories. Bidders will be selected based upon overall qualifications as well as the quality, detail, usability, demonstrated expertise and thoroughness of their responses. Each category will be awarded separately.

Supplier Diversity Plan (minimum of 10% weight of the total available 100% evaluation points) Best Value Selection and Negotiation The SST may select the Quotes(s) which demonstrates the best value overall, including proposed alternatives, that will achieve the goals of the procurement. The SST and a selected Bidder may negotiate a change in any element of Contract performance or cost identified in the original RFR or the selected Bidder’s Quote which results in lower costs or a more cost effective or better value than was presented in the selected Bidder’s original Quote.

INSTRUCTIONS FOR SUBMISSION OF RESPONSES

The Commonwealth will not be responsible for any costs or expenses incurred by Bidders responding to this RFR. Responses must be sent via the “Create Quote” functionality contained in COMMBUYS. Please see RFR Section 1.2 (Estimated Procurement Calendar) for available training on submission of Responses via COMMBUYS. Training is strongly encouraged for bidders that have not recently submitted electronic quotes via COMMBUYS.

Electronic Signatures Quotes submitted via COMMBUYS must be signed electronically by the Bidder or the Bidder’s Agent by accepting the terms and conditions of the bid on the “Terms & Conditions” tab of the Bid in COMMBUYS. By selecting “Save & Continue” on the “Terms and Conditions” tab after accepting the terms and conditions of the bid, the submitter attests that s/he is an agent of the Bidder with authority to sign on the Bidder’s behalf, and that s/he has read and assented to each document’s terms.

Limits and Restrictions File Format Restrictions Bidders must submit file formats readable by MS Word 2000 or later, or by Adobe Acrobat Reader.

All scanned documents must be in .pdf or .gif format and must be scanned in such a way that they can be read on a computer monitor and printed on 81/2” x 11” paper, unless otherwise specified. Forms provided for the Bidder to complete, except for the forms requiring ink signatures, must be completed and submitted in their original formats, NOT scanned and submitted as PDF or other file types.

File Naming Conventions All Bidders must complete and submit the ITS78 RFR Checklist, which is attached as a separate document. Attachments are located on the "Attachments" tab of the bid on COMMBUYS. The ITS78 RFR Checklist specifies the file names that must be used for all documents submitted in response to this RFR, as well as the required file formats.

General Quote Requirements, Provisions, and Prohibitions Quote Content Bid specifications for delivery, shipping, billing and payment will prevail over any proposed Bidder terms entered as part of the Quote, unless otherwise specified in the Bid.

Non-Collusion By submitting a Quote, the Bidder certifies that the Quote has been arrived at independently and has been submitted without any communication, collaboration, or without any agreement, understanding or planned common course or action with, any other Bidder of the commodities and/or services described in the RFR.

Multiple Quotes Unless otherwise instructed by the RFR, Bidders may not submit Multiple Quotes in response to a Bid. If a Bidder submits multiple quotes in response to an RFR that does not authorize multiple responses, only the latest dated quote submitted prior to the bid opening date will be evaluated.

Minimum Quote Duration Bidders’ Quotes to this RFR must remain in effect for at least 90 days from the date of Quote submission.

Bidder’s Contact Information It is the Bidder’s responsibility to monitor the email address provided in the Quote for the Bidder’s contact person. The SST may need to contact the Bidder’s contact person with clarification requests or for other reasons. The SST and the Commonwealth assume no responsibility if a Bidder’s designated email address is not current, or if technical problems, including those with the Bidder’s computer, network or internet service provider (ISP), cause e-mail communications between the Bidder and the SST to be lost or rejected by any means including email or spam filtering.

Ownership of Submitted Quotes OSD and the SST shall be under no obligation to return any Quotes or materials submitted by a Bidder in response to this RFR. All materials submitted by Bidders become the property of the Commonwealth of Massachusetts and will not be returned to the Bidder. The Commonwealth reserves the right to use any ideas, concepts, or configurations that are presented in a Bidder’s Quote, whether or not the Quote is selected for Contract award.

Quotes stored on COMMBUYS in the encrypted lockbox are the file of record. Bidders retain access to a read-only copy of this submission via their COMMBUYS account, as long as their account is active.

Prohibitions Bidders are prohibited from communicating directly with any employee of the procuring Department or any member of the SST regarding this RFR except as specified in this RFR, and no other individual Commonwealth employee or representative is authorized to provide any information or respond to any question or inquiry concerning this RFR. Bidders may contact the contact person using the contact information provided in the Header Information this Bid if this RFR is incomplete or information is missing. Bidders experiencing technical problems accessing information or attachments stored on COMMBUYS should contact the OSD Help Desk (see the document cover page for contact information).

Public Records Law All Quotes and information submitted in response to this RFR are subject to the Massachusetts Public Records Law, M.G.L., Chapter 66, Section 10, and to Chapter 4, Section 7, Subsection 26. Any statements in submitted Quotes that are inconsistent with these statutes shall be disregarded.

Reasonable Accommodation Bidders with disabilities or hardships that seek reasonable accommodation, which may include the receipt of RFR information in an alternative format, must communicate such requests in writing to the contact person. Requests for accommodation will be addressed on a case by case basis. A Bidder requesting accommodation must submit a written statement which describes the Bidder’s disability and the requested accommodation to the contact person for the RFR. The SST reserves the right to reject unreasonable requests.

REQUIREMENTS FOR DOING BUSINESS AFTER CONTRACT AWARD

The requirements below are specific to the Statewide Contract, if any, awarded as a result of this Bid. Awarded Bidders (Contractors) must also comply with the requirements stated in Terms and Requirements Pertaining to Awarded Statewide Contracts.

Ink Signatures on Required Forms Original ink signatures are required only after contracts have been awarded only when a Bidder has been notified that they are an apparent successful bidder. DO NOT SUBMIT THESE FORMS UNTIL INSTRUCTED TO DO SO. The Commonwealth of Massachusetts requires Contractors apparent successful bidders to submit original ink-signature versions of the following forms:

· Standard Contract Form (watermarked version attached for reference)

· Commonwealth Terms and Conditions for Information Technology Contracts (signing the Standard Contract Form signifies acceptance of the Commonwealth Terms and Conditions for Information Technology Contracts)

· Contractor Authorized Signatory Listing

· Request for Taxpayer Identification and Verification (Mass. Substitute W9 Form)

· Electronic Funds Transfer Sign Up Form

· Supplier Diversity Program (SDP) Plan Form 2 Use of COMMBUYS Awarded Contractors are required to maintain an active registration in COMMBUYS, and to maintain a current email address for the Contractor's contact person. That email inbox must be monitored for communications, including bids and notifications from COMMBUYS, OSD, and Eligible Entities. The Commonwealth assumes no responsibility if a Contractor’s designated email address is not current, or if technical issues, such as email filtering, computer, network, or ISP problems, cause email communications to be lost or rejected. Awarded contractors must comply with applicable COMMBUYS requirements outlined in Section 9.1.2.3.

Statewide Contract Vendor Communications Protocol All awarded contractors will be expected to comply with the following:

· All Statewide Contract questions must be directed to the Commonwealth Contract Manager

· Make appropriate staff available for periodic meetings with the Commonwealth Contract Manager

· Provide timely responses to requests

· Maintain professionalism and courtesy in dealings with OSD and eligible entities.

Changes to Contractor’s information Changes to the Contractor’s contact information, company name, legal address, payment address, tax identification number, authorized signatories, SDO-certification status, or EFT information must be promptly reported via email to the Commonwealth Contract Manager. In some cases, additional paperwork will be required to effect the change.

Single Point of Contact Designate a Single Point of Contact (Contractor Contract Manager) for communications with the Commonwealth Contract Manager.

Replacement of Contractor Staff Promptly notify the Commonwealth Contract Manager regarding Replacement of Contractor staff.

Performance Measures Vendor’s performance on this contract will be assessed periodically based upon the following measures:

· Timeliness and accuracy of required Quarterly Sales, Supplier Diversity Program expenditures, and Statewide Contract Administration Fee reports

· Responsiveness to Requests for Quotes

· Compliance with contract requirements

· Customer satisfaction and complaints

Vendors exhibiting unsatisfactory performance may be afforded an opportunity to establish a corrective action plan. Failure to meet a corrective action plan may result in suspension from new business and/or termination of the contract.

Reporting Requirements and Due Dates Reporting and Payment Due Dates

Quarterly Sales, Supplier Diversity Program expenditure, and Environmentally Preferable Products report OSD has developed a centralized process for collecting sales, SDP, and EPP data. Sales data is used by OSD to measure progress on contract spend from year-to-year. The reporting assists with forecasting future contract spend, evaluating Vendor performance, and tracking Vendor spend towards environmental products and their SDP commitment. EPP reporting allows the EPP Program to annually quantify benefits and spend on sustainable products. Reporting also assists with the development of new contracts and/or new categories of services under existing contracts. In the event the Commonwealth adopts an alternate reporting system, Vendors will be required to utilize such system, as directed by the OSD Contract Manager.

Completion and submission of the Quarterly Sales and SDP Report is a requirement for all awarded Vendors under this contract each quarter. An Awarded Vendor must submit a Quarterly Sales and SDP Report each quarter regardless of whether or not they have had sales during a quarter.

Vendors are required to submit reports through the Commonwealth’s Vendor Report Management (VRM) System which may be accessed via web portal at https://massosd.gob2g.com. Vendors must maintain records such that they are able to report, for all invoices submitted under the contract, the purchasing entity name, the invoice number, the invoice date, the product/service description, the unit of measure, the price per unit, the quantity, the line total purchase amount, and any environmentally preferable product reporting requirements as applicable.

Statewide Contract Administration Quarterly Fee Payment and Report This Statewide Contract is subject to a 1% Contract Administration Fee, which is created pursuant to MGL c. 7, § 3B and 801 CMR 4.02, and which is incorporated by reference into Statewide Contracts with the Operational Services Division (OSD). The price stated in any Bidder’s Quote price and any Contractor’s Statewide Contract shall be inclusive of this fee and Contractors shall not reflect this fee as a separate line item on customer invoices.

This fee will be based on 1% of the total dollar amounts, adjusted for credits or refunds, paid by Eligible Entities to the Statewide Contractor based on the statewide contract. All “Statewide Contracts” awarded and all purchase orders and purchases made pursuant to this RFR are subject to this fee. Eligible entities are defined in Section 1.3.7, above.

Note that if the 1% Administration Fee is deductible as a business expense for federal income tax purposes, it is also deductible as an expense for Massachusetts tax purposes.

Quarterly Fee Payment For each Reporting Period, as defined above in the Reporting Requirements and Due Dates section, Statewide Contractor shall pay to OSD a fee equal to one percent (1%) of the total payments (adjusted for credits or refunds) received from all Eligible Entities that have purchased from the Statewide Contractor pursuant to this Agreement. All payments must be received by OSD on or before 45 days after the last day of the Reporting Period or a Contractor will be considered in breach of contract.

Quarterly payments will include any periods less than a full calendar quarter if a contract does not start at the first day of a quarter or end on the last day of the quarter.

Payments are to be made through a web-based secure payment center, which is accessible through a link provided to Statewide Contractors by OSD. All Administration Fee payments are to be made directly through the secure payment center. Payments may be made via Automatic Clearing House (ACH) or by using one of the following credit cards: American Express, Discover, MasterCard and/or Visa. Payment of the Administration Fee by check is not permitted unless a contractor makes a written request for an exception and demonstrates, to the satisfaction of OSD’s Contract Manager, that compliance poses a hardship.

There is no charge to contractors to use ACH as OSD covers the nominal fee for using the ACH payment method. OSD will NOT cover the convenience fee for selecting credit card. The contractor is responsible for paying this non-refundable fee. The convenience fee (currently established by Statewide Contract PRF59A) is over and above the 1% Administration Fee and is subject to change during the term of the contract resulting from this bid. Prior to the due date for the Statewide Contractor’s Administration Fee payment and report, the Statewide Contractor will receive an e-mail from OSD that includes all required information to submit payments via the secure payment center.

Statewide Contractor Administration Fee Quarterly Reporting Electronically submitting your payment, which is comprised of the 1% administration fee of the total payments received by the Contractor from all Eligible Entities for the Quarter, will serve as the Statewide Contractor Administration Fee Report.

Each Statewide Contractor shall submit one Statewide Contractor Administration Fee Report for each Statewide Contract for each Reporting Period. The electronic submission of the payment shall serve as submission of the Statewide Contractor Administration Fee Report. Contractors with 0$/non-payment reports must still report using the web-based secure payment center to satisfy the Administration Fee Report requirement of the Statewide Contract.

Audit During the term of this Agreement and for a period of six years thereafter, the Operational Services Division, its auditors, the Office of the Inspector General, the Office of the Attorney General, or other authorized representatives shall be afforded access at reasonable times to Contractor's accounting records, including sales information on any system, reports or files, in order to audit all records relating to goods sold or services performed pursuant to this Agreement. If such an audit indicates that Contractor has materially underreported Sales, then the Vendor shall be responsible for payment of the costs associated with the audit.

Other Terms Contractors are responsible for compliance with all other contract reporting requirements including, but not limited to, contract detailed spend, Supplier Diversity Program (SDP) and other contract reports, as required by this contract.

All amounts payable by the Contractor to OSD under this Agreement that are not received by the due date specified shall bear simple interest from the date due until paid. The Late Payment Interest Rate is set by the Office of the State Comptroller on an annual basis and can be found by selecting the fiscal year in question on the Comptroller’s Fiscal Year Updates webpage.

In the event of the Contractor’s breach of this policy including, but not limited to, non-reporting, non-payment, late reporting/payment, under-reporting/payment, the Commonwealth reserves the right to pursue any and all recourse and penalties available including, but not limited to, contract suspension and contract termination. The Commonwealth is allowed to suspend, terminate or debar pursuant to Massachusetts General Laws Chapter 29, Section 29F, as amended, and pursuant to Section 4 of the Commonwealth Terms and Conditions of Information Technology Contracts. In addition, in the event the Contractor fails to make any payment when due, the Contractor shall be liable to the Commonwealth for all expenses, court costs, and attorneys' fees (including inside counsel) incurred in enforcing the terms and conditions of this Agreement.

Ad hoc reports The Commonwealth Contract Manager may request additional reports from time to time. The Contractor must comply with these requests to the extent that the information requested is available.

Payment Related Terms Bill Payment All invoices issued pursuant to this contract are payable in accordance with the Comptroller’s Bill Payment Policy: http://www.mass.gov/osc/docs/policies-procedures/accounts-payable/po-ap-commonwealth-bill-paying.doc Late Payment Fees Late Payment fees may be assessed only as authorized by the Office of the Comptroller: http://www.mass.gov/osc/docs/ctrinfo/comptroller-regulations/815/cumulative-lpi-rates.doc Electronic Funds Transfer (EFT) All Awarded Contractors must agree to participate in the Commonwealth Electronic Funds Transfer (EFT) program for receiving payments. Additional information about EFT is available on the Comptroller’s VendorWeb site located at: https://massfinance.state.ma.us/VendorWeb/vendor.asp Upon notification of award, Contractors are required to enroll in EFT by completing and submitting the “Authorization for Electronic Funds Payment Form” to the SST for review, approval and forwarding to the Office of the Comptroller, unless already enrolled in EFT. This Form shall be supplied to the vendor upon contract award. This form, and all information contained on this form, shall not be considered a public record and shall not be subject to public disclosure through a public records request.

Creditworthiness No public entity utilizing this contract shall be required, as a condition of purchase, to undergo any creditworthiness review or application process.

Tax Exemption Payment vouchers or invoices submitted to Massachusetts government entities must not include sales tax.

RFR APPENDICES

Appendix 1: Required Terms for all Statewide RFRs Appendix 2: Electronic Quote Submission Instructions Appendix 3: Required Specifications for Information Technology APPENDIX 1 – Required Terms for all Statewide RFRs Applicable Procurement Law Executive Branch Goods and Services are procured per MGL c. 7, § 22; c. 30, § 51, § 52; 801 CMR 21.00 General Procurement Information Alterations Bidders may not alter (manually or electronically) the Bid language or any Bid component files, except as directed in the RFR. Modifications to the body of the Bid, specifications, terms and conditions, or which change the intent of this Bid are prohibited and may disqualify a Quote.

COMMBUYS Market Center COMMBUYS is the official source of information for this Bid and is publicly accessible at no charge at www.commbuys.com.