ITS78%20Contract%20User%20Guide%204.29.24.pdf

NOTE: Contract User Guides are updated regularly. Print copies should be compared against the current version posted on mass.gov/osd.

Updated: April 29, 2024 Template version: 7.0 Page 1 of 9 One Ashburton Place, Room 1608 Boston, MA, 02108-1552

Tel: (617) 720 - 3300 | www.mass.gov/osd | TDD: (617) 727 - 2716 | Twitter: @Mass_OSD | Fax: (617) 727 - 4527

Contract User Guide for ITS78

ITS78: Statewide Contract for Data, Cybersecurity, and Related Audit, Compliance, and Incident Responses Services

Table of Contents:

(NOTE: To access hyperlinks below, scroll over desired section and CTL + Click)

• Contract Summary

• Contract Categories

• Benefits and Cost Savings

• Find Bid/Contract Documents

• Who Can Use This Contract

• Subcontractors

• Supplier Diversity Requirements

• Pricing, Quotes and Purchase Options

• Instructions for MMARS Users

• Contract Exclusions and Related Statewide

Contracts

• Emergency Services

• Additional Information/FAQ's

• Performance and Payment Time Frames Which

Exceed Contract Duration

• Strategic Sourcing Team Members

• VENDOR LIST AND INFORMATION

TIP: To return to the first page throughout this document, use the CTL + Home command.

UPDATED: April 29, 2024

Contract #: ITS78

MMARS MA #: ITS78*

Initial Contract Term: July 1, 2021 – June 30, 2026

Maximum End Date: Two (2) One (1) year extension(s) to 2028

Current Contract Term: July 1, 2021 – June 30, 2026

Contract Manager: Marge MacEvitt, 617-720-3121, Marge.MacEvitt@mass.gov

This Contract Contains: Prompt Pay Discounts

UNSPSC Codes: 80-11-18-00 - Data, Cybersecurity, and Related Services Category;

81-16-00-00 - Information Technology Service Delivery;

43-23-32-00 - Security and protection software;

83-12-00-00 - Information Services.

*The asterisk is required when referencing the contract in the Massachusetts Management Accounting Reporting System (MMARS).

http://www.mass.gov/osd mailto:Marge.MacEvitt@mass.gov

NOTE: Contract User Guides are updated regularly. Print copies should be compared against the current version posted on mass.gov/osd.

Updated: April 29, 2024 Template version: 7.0 Page 2 of 9 One Ashburton Place, Suite 1608 Boston, MA, 02108-1552

Tel: (617) 720 - 3300 | www.mass.gov/osd | TDD: (617) 727 - 2716 | Twitter: @Mass_OSD | Fax: (617) 727 - 4527

Contract Summary This is a Statewide Contract for Data, Cybersecurity, and Related Audit, Compliance, and Incident Response Services.

Services include a full range of audit, penetration tests, reviews, and validation of compliance with legal, regulatory and policy requirements, and related services in areas such as data breach investigation, remediation, and security of confidential information

Contract Categories and User Scenarios This contract includes 4 categories of service as listed below.

Category 1: Full range of data and cybersecurity audits and compliance reviews and related consulting services, including best practices, gap analysis, scorecards, compliance with internal and external controls (e.g., internal process and procedures, HIPAA, IRS, PII, CJIS), and control validation).

When to Use:

For organizations in the early stages of cybersecurity planning, Category 1 is a good entry point, with awarded vendors providing a baseline cybersecurity readiness assessment. Vendors are available to audit and assess organizations’ practices, infrastructure, and compliance with federal, state, other applicable laws and rules, uncover vulnerabilities and irregularities, and make recommendations for improvement. Category 1 may also be helpful in assessing changes to existing configurations and requirements. Examples of such changes could be infrastructure, vendors, policies and procedures, or legislative.

Category 2: Risk assessments as they relate to internal and external (3rd party) components. Services include risk management strategies, quality assurance audits, cloud security, vendor security, and data security management.*

When to Use:

Category 2 offers risk assessments when organizations implement significant changes to hardware or software infrastructure. Examples include a new application or server, adding cloud services, or introducing a new IT service provider. Awarded vendors review the new environment and report on possible data and security risks.

Category 3: Cybersecurity testing and readiness services including external/internal penetration testing, physical security assessments, social engineering assessments, vulnerability assessments, application testing, network security assessments, endpoint security assessments, tabletop exercises, identity and access management assessments.*

When to Use Category 3:

Vendors awarded to Category 3 provide assistance with assessing the organization's readiness for real-world cyber events, e.g. password cracking, cyber hacking, ransomware, and phishing to ensure security protocols perform as designed. Vendors essentially attempt to “break into” the network environment to identify vulnerabilities and suggest actions to prevent actual breaches.

Category 4: Information Security and Cybersecurity Incident Response services, including emergency incident response services, incident containment, mitigation, remediation, internal and external communications and required notifications, forensic investigations, managed threat detection and response. Contractors are prepared to engage within 24-48 hours, 7 days a week, and implement incident response protocols as negotiated by the buyer.**

When to Use:

When an organization believes that a cyber event may have taken place, vendors in Category 4 are available to assist with response efforts, including crisis management, business continuity, and communications strategy, among others.

NOTE: Contract User Guides are updated regularly. Print copies should be compared against the current version posted on mass.gov/osd.

Updated: April 29, 2024 Template version: 7.0 Page 3 of 9

Tel: (617) 720 - 3300 | www.mass.gov/osd | TDD: (617) 727 - 2716 | Twitter: @Mass_OSD | Fax: (617) 727 - 4527

* State agencies requiring engagement under this category must coordinate with and gain the approval of the Office of the Commonwealth Chief Information Security Officer (CCISO). This can be done by emailing your request to ERM@mass.gov.

** State agencies requiring engagement under this category must coordinate with and gain the approval of the Office of the Commonwealth Chief Information Security Officer (CCISO) to ensure that Enterprise systems are not at risk. This can be done by emailing your request to ERM@mass.gov.

Benefits and Cost Savings Statewide contracts are an easy way to obtain benefits for your organization by leveraging the Commonwealth’s buying power, solicitation process, contracting expertise, vendor management and oversight, and the availability of environmentally preferable products.

Find Bid/Contract Documents

• To find all contract-specific documents, including the Contract User Guide, RFR, specifications, price sheets and other attachments, visit COMMBUYS.com and search for ITS78 to find related Master Blanket Purchase Order

(MBPO) information.

Who Can Use This Contract

Applicable Procurement Law Executive Branch Goods and Services: MGL c. 7, § 22; c. 30, § 51, § 52; 801 CMR 21.00;

Eligible Entities Please see the standard list of Eligible Entities on our Eligible Entities Which May Use Statewide Contracts webpage.

Subcontractors The awarded vendor’s use of subcontractors is subject to the provisions of the Commonwealth’s Terms and Conditions and Standard Contract Form, as well as other applicable terms of this Statewide Contract.

Supplier Diversity Requirements When selecting contractors and placing orders without requesting quotes from multiple vendors, Executive departments shall utilize diverse and small businesses to the extent possible based on contract terms, SDO and departmental policies, laws, and regulations. Additionally, Executive Departments shall make a preference for contractors with higher SDP commitments and/or performance whenever such information is available (or is requested from contractors by the department) and the preference is feasible.

OSD provides up-to-date information on the availability of diverse and small businesses on statewide contracts through the Statewide Contract Index available on the COMMBUYS home page. See the “Programs (SDO and SBPP)” tab for current certification and small business status of contractors on this contract.

When Executive Departments are soliciting multiple quotes the following requirements apply:

mailto:ERM@mass.gov https://www.mass.gov/doc/how-to-record-a-contract-purchase-previously-made-rpa-release/download http://www.commbuys.com/ https://www.commbuys.com/bso/external/purchaseorder/poSummary.sdo#eligible-entities-which-may-use-statewide-contracts-https://www.mass.gov/doc/qrg-how-to-post-a-bid-to-receive-quotes-from-vendors-on-a-statewide-contract-executive-agencies/download

NOTE: Contract User Guides are updated regularly. Print copies should be compared against the current version posted on mass.gov/osd.

Updated: April 29, 2024 Template version: 7.0 Page 4 of 9

Tel: (617) 720 - 3300 | www.mass.gov/osd | TDD: (617) 727 - 2716 | Twitter: @Mass_OSD | Fax: (617) 727 - 4527

Expected annual value of the RFQ

RFQ process requirements

Less than or equal to $250,000/year

• Notify at least two small businesses capable of providing the product or service of the opportunity, if available.

• Include SBPP contract language and place it prominently within the RFQ.

• Evaluate bids received from, and award a contract to, an SBPP-participating small business that meets the department’s best value criteria.

• Award to a large business only if there is no SBPP participating business meeting departments’ best value criteria.

• Conduct a clarification/BAFO/negotiation before disqualifying an SBPP-participating business based on price or desirable criteria.

• See the Best Value Evaluation of Responses to Small Procurements: A Guide for Strategic Sourcing Teams for additional guidance.

More than $250,000/year

• Notify at least two diverse and/or small businesses capable of providing the product or service of the opportunity, if available.

• Make a preference for contractors with higher SDP commitments and/or performance whenever such information is available (or is requested from contractors by the department) and the preference is feasible.

• Note: Departments may ask the prime Contractor for an additional SDP commitment specifically related to the Department’s purchase or engagement.

SDP spending for such a purchase or engagement must be reported by the Contractor using the SDP Reporting Form directly to the Department and may not be included in any other SDP reporting filed by the Contractor.

OSD provides up-to-date information on the availability of diverse and small businesses on statewide contracts through the Statewide Contract Index available on the COMMBUYS home page. See the “Programs (SDO and SBPP)” tab for current certification and small business status of contractors on this contract.

Pricing, Quote and Purchase Options

Purchase Options The purchase options identified below are the only acceptable options that may be used on this contract:

• This is a fee for service contract

Pricing Options

• Fixed Pricing: All engagements will require a SOW in the form of the “Statement of Work” with deliverable-based payments. In the SOW, Bidders must agree to identify any and all costs or charges that will be billed under the SOW.

• Hourly Pricing: All engagements will require a SOW in the form of the “Statement of Work.” In the SOW, Bidders must agree to identify any and all costs or charges that will be billed under the SOW.

http://www.mass.gov/osd https://www.mass.gov/media/2307721/download https://www.mass.gov/media/2307721/download https://www.mass.gov/info-details/why-use-statewide-contracts

NOTE: Contract User Guides are updated regularly. Print copies should be compared against the current version posted on mass.gov/osd.

Updated: April 29, 2024 Template version: 7.0 Page 5 of 9 One Ashburton Place, Suite 1608 Boston, MA, 02108-1552

Tel: (617) 720 - 3300 | www.mass.gov/osd | TDD: (617) 727 - 2716 | Twitter: @Mass_OSD | Fax: (617) 727 - 4527

Setting Up a COMMBUYS Account

COMMBUYS is the Commonwealth’s electronic Market Center supporting online commerce between government purchasers and businesses. If you do not have one already, contact the OSD Help Desk to set up a COMMBUYS buyer account for your organization: (888)-627-8283 or OSDhelpdesk@mass.gov.

When contacting a vendor on statewide contract, always reference ITS78 to receive contract pricing.

Quick Search in COMMBUYS

Log into COMMBUYS, and use the Search box on the COMMBUYS header bar to locate items described on the MBPO or within the vendor catalog line items. Select Contract/Blanket or Catalog from the drop-down menu.

How To Purchase From The Contract

• If soliciting multiple quotes (recommended except in unusual circumstances): Solicit quotes and select and purchase quoted item in COMMBUYS

This COMMBUYS functionality provides a mechanism to easily obtain quotes, as specified by the Contract. The buyer would create a Release Requisition, and then convert it to a Bid. After approval by the buyer approving officer, the bid is then sent to selected vendors to request quotes. Buyers must include “ITS78 RFQ” when entering information in the Description field.

For a description of how to complete this purchase in COMMBUYS, visit the Job Aids for Buyers webpage, and select:

➢ The COMMBUYS Bids section, and choose the How to Request Quotes from Vendors on Statewide Contracts job aid OR the Quick Reference Guide (QRG) section, QRG – How to Post a Bid to Receive Quotes from Vendors on a Statewide Contract.

• If ordering directly from a vendor without seeking multiple quotes

Once the Statement of Work (SOW) has been finalized, COMMBUYS users should attach it to their direct release purchase order in COMMBUYS.

• For a description of how to complete this purchase in COMMBUYS, visit the Job Aids for Buyers webpage and select:

➢ The COMMBUYS Requisitions section and choose the How to Make a Statewide Contract Purchase in COMMBUYS job aid.

➢ Note: In Step 8, enter the Unit Cost as 1. In Step 11, attach the SOW and purchase order with detailed pricing and quantity information.

• Document items in COMMBUYS that have already been purchased

This type of contract allows buyers to document a contract purchase in COMMBUYS that already has taken place through a Request for Payment Authorization (RPA) Release Requisition. It also allows MMARS users to easily keep track of spend. NOTE: MMARS and COMMBUYS do not interface –payment request and invoice should be reported in both MMARS and COMMBUYS separately.

For a description of how to complete this purchase in COMMBUYS, visit the Job Aids for Buyers webpage, and select:

http://www.mass.gov/osd https://www.commbuys.com/bso/external/purchaseorder/poSummary.sdo https://www.commbuys.com/bso/external/purchaseorder/poSummary.sdo https://www.mass.gov/doc/emergency-response-supplies-services-and-equipment-contact-information https://www.mass.gov/doc/qrg-how-to-post-a-bid-to-receive-quotes-from-vendors-on-a-statewide-contract-executive-agencies/download https://www.mass.gov/doc/qrg-how-to-post-a-bid-to-receive-quotes-from-vendors-on-a-statewide-contract-executive-agencies/download https://www.mass.gov/lists/job-aids-for-buyers-using-commbuys https://www.commbuys.com/bso/external/purchaseorder/poSummary.sdo https://www.mass.gov/doc/statewide-contract-index/download

NOTE: Contract User Guides are updated regularly. Print copies should be compared against the current version posted on mass.gov/osd.

Updated: April 29, 2024 Template version: 7.0 Page 6 of 9

Tel: (617) 720 - 3300 | www.mass.gov/osd | TDD: (617) 727 - 2716 | Twitter: @Mass_OSD | Fax: (617) 727 - 4527

➢ The COMMBUYS Requisitions section, and choose the How to Record a Contract Purchase Previously Made (RPA

Release) job aid.

Obtaining Quotes Contract users should always reference ITS78 when contacting vendors to ensure they are receiving contract pricing.

Quotes, not including construction services, should be awarded based on best value.

For a full description of how to complete a quote in COMMBUYS visit the Job Aids for Buyers webpage, and select:

➢ The COMMBUYS Bids section, and choose the How to Request Quotes from Vendors on Statewide Contracts job aid OR the Quick Reference Guide (QRG) section, QRG – How to Post a Bid to Receive Quotes from Vendors on a Statewide Contract.

Additional Requirements for Executive Departments and other Eligible Entities that use the Commonwealth Network If this SOW will be placed under Category 2, 3, or 4 of ITS78, the Eligible Entity will work with the Executive Office of Technology Services and Security (“EOTSS”) to identify an EOTSS contact who will serve as a point of contact for the project. The EOTSS contact will be named in the Statement of Work and their signature is required on the Statement of Work. The Eligible Entity Project Manager (PM) will coordinate with the EOTSS point of contact throughout the Term of the engagement.

In the event that a point of escalation is required within EOTSS, the Eligible Entity PM will communicate with the EOTSS Chief Information Security Officer, or designee.

Instructions for MMARS Users MMARS users must reference the MA number in the proper field in MMARS when placing orders with any contractor.

Contract Exclusions and Related Statewide Contracts This contract will not include any PCI-related services.

Emergency Services Many statewide contracts are required to provide products or services in cases of statewide emergencies. ML - 801 CMR

21 defines emergency for procurement purposes. Visit the Emergency Response Supplies, Services and Equipment

Contact Information for Statewide Contracts list for emergency services related to this contract.

Additional Information/FAQs

Other Discounts

• Prompt Pay Discounts: A discount given to the buyer if paid within a certain time period. These discounts may be found in the Master Contract Record, in an attachment labeled Vendor Listing Spreadsheet located in the

"Header Information", "Agency Attachments" section. All discounts offered will be taken in cases where the payment issue date is within the specified number of days listed by vendor and in accordance with the

Commonwealth’s Bill Paying Policy. Payment days will be measured from the date goods are received and accepted / performance was completed OR the date an invoice is received by the Commonwealth, whichever is http://www.mass.gov/osd https://www.mass.gov/doc/statewide-contract-index/download https://www.mass.gov/doc/statewide-contract-index/download mailto:marge.macevitt@mass.gov mailto:marge.macevitt@mass.gov mailto:ERM@mass.gov mailto:ERM@mass.gov https://www.mass.gov/regulations/801-CMR-21-procurement-of-commodities-or-services-including-human-and-social-services https://www.mass.gov/regulations/801-CMR-21-procurement-of-commodities-or-services-including-human-and-social-services https://www.mass.gov/lists/job-aids-for-buyers-using-commbuys https://www.mass.gov/lists/job-aids-for-buyers-using-commbuys mailto:OSDhelpdesk@mass.gov?docId=PO-21-1080-OSD03-SRC01-22392&releaseNbr=0&external=true&parentUrl=close

NOTE: Contract User Guides are updated regularly. Print copies should be compared against the current version posted on mass.gov/osd.

Updated: April 29, 2024 Template version: 7.0 Page 7 of 9 One Ashburton Place, Suite 1608 Boston, MA, 02108-1552

Tel: (617) 720 - 3300 | www.mass.gov/osd | TDD: (617) 727 - 2716 | Twitter: @Mass_OSD | Fax: (617) 727 - 4527 later, to the date the payment is issued as an EFT (preferred method) or mailed by the State Treasurer. The date of payment “issue” is the date a payment is considered “paid” not the date a payment is “received” by a

Contractor.

Performance and Payment Time Frames Which Exceed Contract Duration All term leases, rentals, maintenance, or other agreements for services entered into during the duration of this Contract and whose performance and payment time frames extend beyond the duration of this Contract shall remain in effect for performance and payment purposes (limited to the time frame and services established per each written agreement). No written agreement shall extend more than 12 months beyond the current contract term of this Statewide Contract as stated on the first page of this contract user guide. No new leases, rentals, maintenance or other agreements for services may be executed after the Contract has expired.

Memorandum of Understanding/Statement of Work

All engagements entered into under ITS78 will require a SOW in the form of the “Statement of Work” with deliverable-based payments. Contracting Departments may include additional terms in the SOW. In the SOW, any and all costs or charges that will be billed under the SOW must be clearly identified. Vendors may include options for Fixed Price engagements, Time and Materials engagements, or both. Three SOW templates, one for Fixed Price, one for Time and

Materials, and one for both, are found on the Master Contract Record.

https://www.mass.gov/lists/job-aids-for-buyers-using-commbuys?docId=PO-21-1080-OSD03-SRC01-22392&releaseNbr=0&external=true&parentUrl=close

NOTE: Contract User Guides are updated regularly. Print copies should be compared against the current version posted on mass.gov/osd.

Updated: April 29, 2024 Template version: 7.0 Page 8 of 9 One Ashburton Place, Room 1608 Boston, MA, 02108-1552

Tel: (617) 720 - 3300 | www.mass.gov/osd | TDD: (617) 727 - 2716 | Twitter: @Mass_OSD | Fax: (617) 727 - 4527

Contract User Guide for ITS78

Strategic Sourcing Team Members

• Amber Debole, EOHHS

• Jenny Hedderman, CTR

• Stephanie Helm, MassCyberCenter

• John Merto, EOTSS

• Megan Perkins, EOTSS

• Bradford Smith, UMass

• Amanda Ferdinand, OSD (Inactive)

• Marge MacEvitt, OSD

NOTE: Contract User Guides are updated regularly. Print copies should be compared against the current version posted on mass.gov/osd.

Updated: April 29, 2024 Template version: 7.0 Page 9 of 9 One Ashburton Place, Room 1608 Boston, MA, 02108-1552

Tel: (617) 720 - 3300 | www.mass.gov/osd | TDD: (617) 727 - 2716 | Twitter: @Mass_OSD | Fax: (617) 727 - 4527

Contract User Guide for ITS78

Vendor List and Information*

Vendor Master Blanket Purchase Order # Contact Person

Phone # Email Categories PPD MBE

MWBE

WBE

Veteran Master Contract Record ** PO-21-1080-OSD03-SRC01-22392 Marge MacEvitt 617-720-3121 Marge.MacEvitt@mass.gov All Categories. Includes

Vendor Listing Spreadsheet for all Vendors with vendor contact, Category, PPD, SBPP and Diversity status for each vendor.

N/A N/A

Solicitation Enabled MBPO***

PO-21-1080-OSD03-SRC01-22404 Marge MacEvitt 617-720-3121 Marge.MacEvitt@mass.gov Category 1 - Full range of data, cybersecurity audits, compliance reviews and related consulting services

PO-21-1080-OSD03-SRC01-22403 Marge MacEvitt 617-720-3121 Marge.MacEvitt@mass.gov Category 2 - Risk assessments as they relate to internal and external (3rd party) components

PO-21-1080-OSD03-SRC01-22402 Marge MacEvitt 617-720-3121 Marge.MacEvitt@mass.gov Category 3 - Cybersecurity testing and readiness services

PO-21-1080-OSD03-SRC01-22401 Marge MacEvitt 617-720-3121 Marge.MacEvitt@mass.gov Category 4 - Information security and cybersecurity incident response services https://www.commbuys.com/bso/external/purchaseorder/poSummary.sdo?docId=PO-21-1080-OSD03-SRC01-22392&releaseNbr=0&external=true&parentUrl=close mailto:Marge.MacEvitt@mass.gov https://www.commbuys.com/bso/external/purchaseorder/poSummary.sdo?docId=PO-21-1080-OSD03-SRC01-22404&releaseNbr=0&external=true&parentUrl=closee mailto:Marge.MacEvitt@mass.gov https://www.commbuys.com/bso/external/purchaseorder/poSummary.sdo?docId=PO-21-1080-OSD03-SRC01-22403&releaseNbr=0&external=true&parentUrl=close mailto:Marge.MacEvitt@mass.gov https://www.commbuys.com/bso/external/purchaseorder/poSummary.sdo?docId=PO-21-1080-OSD03-SRC01-22402&releaseNbr=0&external=true&parentUrl=close mailto:Marge.MacEvitt@mass.gov https://www.commbuys.com/bso/external/purchaseorder/poSummary.sdo?docId=PO-21-1080-OSD03-SRC01-22401&releaseNbr=0&external=true&parentUrl=close mailto:Marge.MacEvitt@mass.gov