ITS81 RFR Final V4 03.05.24 (3).pdf

Document Sensitivity Level: High during development; Low once published. Template v 3.0.0

COMMONWEALTH OF MASSACHUSETTS

OPERATIONAL SERVICES DIVISION

Request for Response (RFR)

Document Title: IT Project Services and GIS

Agency Document Number: ITS81

COMMBUYS Bid#: - BD-24-1080-OSD03-OSD03-94676

02/08/24 02/22/24

02/28/2024 3/5/2024

Amended changes highlighted in yellow deletions are crossed out

Please Note: This is a single document associated with a complete Bid (also referred to as Solicitation) that can be found on www.COMMBUYS.com. Bidders are responsible for reviewing and complying with all Bid requirements. Bidders may contact the OSD Help Desk at OSDHelpdesk@mass.gov or at 1-888-MA-STATE for technical assistance with COMMBUYS. The Help Desk is staffed from 8:00 AM to 5:00 PM Monday through Friday Eastern time, as applicable, except on federal and state holidays.

Bidders with disabilities or hardships that seek reasonable accommodation, which may include the receipt of RFR information in an alternative format, must communicate such requests in writing to the contact person. Requests for accommodation will be addressed on a case-by-case basis. A Bidder requesting accommodation must submit a written statement which describes the Bidder’s disability and the requested accommodation to the contact person for the RFR. The SST reserves the right to reject unreasonable requests.

https://www.sec.state.ma.us/cis/cishol/holidx.htm https://www.sec.state.ma.us/cis/cishol/holidx.htm

REQUEST FOR RESPONSE IT Project Services and GIS

Revision History

Version Number

Date Author Brief Description

1.0 04/01/2023 G Dawson Initial release

2.0 02/22/2024 G. Dawson RFR amended adding language regarding financial document requirements, fiscal year information and as minimum years in business.

3.0 02/28/2024 G.Dawson Section 3.5, language added to include certificate of good standing. Section 4.1.3 User Approval has corrected hyperlinks

4.0 3/5/2024 G. Dawson Section 5.5.2 Required Environmental Specifications, an updated link for Environmentally Preferable Products and Services Specifications Guide was added

REQUEST FOR RESPONSE ITS81 Project Services

Table of Contents Page 1

Document Sensitivity Level: High during development; Low once published.

1 INTRODUCTION AND BID OVERVIEW

1.1 SUMMARY DESCRIPTION OF PROCUREMENT

1.2 ESTIMATED PROCUREMENT CALENDAR

1.2.1 SUBMISSION OF BID QUESTIONS

1.2.2 BID AMENDMENT DEADLINE

1.2.3 BIDDERS CONFERENCE

1.2.4 LATE BIDS WILL NOT BE CONSIDERED

1.2.5 DEBRIEFING

1.3 ADDITIONAL BID INFORMATION

1.3.1 ANTICIPATED CONTRACT DURATION:

1.3.2 PERFORMANCE AND PAYMENT TIME FRAMES WHICH EXCEED CONTRACT DURATION

1.3.3 ESTIMATED VALUE OF THE CONTRACT

1.3.4 ESTIMATED NUMBER OF AWARDS

1.3.5 ADDING CONTRACTORS AFTER INITIAL CONTRACT AWARD

1.3.6 ACQUISITION METHOD(S):

1.3.7 ENTITIES ELIGIBLE TO USE THE RESULTING CONTRACT

2 ADDITIONAL INFORMATION ON PROCUREMENT SCOPE

3 BIDDER QUALIFICATIONS

3.1 COMPANY EXPERIENCE

3.1.1 BUSINESS BACKGROUND

3.1.2 YEARS IN THE INDUSTRY OF THE BID

3.1.3 COMPANY ORGANIZATIONAL CHART

3.2 EMPLOYEE AND/OR BUSINESS TECHNICAL/BUSINESS EXPERIENCE, CERTIFICATIONS, LICENSES 5

3.2.1 GENERAL QUALIFICATIONS

3.2.2 ADDITIONAL GEOGRAPHIC INFORMATION SYSTEMS (GIS) QUALIFICATIONS

3.3 CONTINUITY OF OPERATIONS PLAN (COOP)

3.4 EMERGENCY RESPONSE CAPABILITIES

3.5 FINANCIAL STABILITY, BANKRUPTCY, LITIGATION, AND CONTRACT DEFAULTS

3.5.1 FINANCIAL STATEMENT

3.5.2 BANKRUPTCY, LITIGATION, AND CONTRACT DEFAULTS

4 ADDITIONAL TERMS AND CONDITIONS

4.1 SAAS, PAAS, AND IAAS (CLOUD SERVICES) AND LIMITED USE SPECIFICATIONS

4.1.1 LIMITED USE SPECIFICATIONS FOR SAAS

4.1.2 SAAS, PAAS, AND IAAS (CLOUD SERVICES) REQUIRED TERMS

4.1.3 USERS APPROVAL

4.2 DATA OWNERSHIP

4.3 DATA PROTECTION

4.4 DATA LOCATION

4.5 SECURITY INCIDENT OR DATA BREACH NOTIFICATION

4.5.1 INCIDENT RESPONSE

4.5.2 SECURITY INCIDENT AND DATA BREACH REPORTING REQUIREMENTS

4.6 PERSONAL DATA BREACH RESPONSIBILITIES

Table of Contents Page 2

4.7 NOTIFICATION OF LEGAL REQUESTS

4.8 TERMINATION AND SUSPENSION OF SERVICE

4.9 BACKGROUND CHECKS

4.10 INTELLECTUAL PROPERTY

4.11 SUBCONTRACTING

4.12 STATEMENT OF WORK

4.13 LICENSE AGREEMENTS

4.14 REQUIREMENT AT STATEWIDE CONTRACT OR ENGAGEMENT TERMINATION OR EXPIRATION 13

4.15 ACCESS TO SECURITY LOGS AND REPORTS

4.16 CONTRACT AUDIT

4.17 DATA CENTER AUDIT

4.18 CHANGE CONTROL AND ADVANCE NOTICE

4.19 SECURITY

4.20 NON-DISCLOSURE AND SEPARATION OF DUTIES

4.21 IMPORT AND EXPORT OF DATA

4.22 RESPONSIBILITIES AND UPTIME GUARANTEE

4.23 SUBCONTRACTOR DISCLOSURE

4.24 RIGHT TO REMOVE INDIVIDUALS

4.25 BUSINESS CONTINUITY AND DISASTER RECOVERY

4.26 COMPLIANCE WITH ACCESSIBILITY STANDARDS

4.27 WEB SERVICES

4.28 ENCRYPTION OF DATA AT REST

4.29 SUBSCRIPTION TERMS

5 COMMODITY, SERVICE, ENVIRONMENTAL, AND COST SPECIFICATIONS

5.1 SERVICE SPECIFICATIONS

5.1.1 GENERAL EXCLUSIONS

5.1.2 CATEGORY 1 – EDM (ENTERPRISE DATA MANAGEMENT) DATA ANALYTICS

5.1.3 CATEGORY 2 – SOFTWARE OPERATIONS AND SUPPORT SERVICES

5.1.4 CATEGORY 3 – USER CENTERED DESIGN AND DEVELOPMENT

5.1.5 CATEGORY 4 – GIS GEOSPATIAL INFORMATION SYSTEMS

5.2 WARRANTIES

5.2.1 ALL CATEGORIES

5.2.2 CATEGORIES SOFTWARE, WEBSITE, AND SYSTEMS DEVELOPMENT AND SYSTEMS

INTEGRATION/NETWORKING ONLY

5.3 GEOGRAPHIC COVERAGE

5.4 ORDERING AND QUOTES

5.5 ENVIRONMENTAL SPECIFICATIONS

5.5.1 ENVIRONMENTAL BENEFIT CLAIMS/LABELING

5.5.2 REQUIRED ENVIRONMENTAL SPECIFICATIONS

5.5.3 DESIRABLE ENVIRONMENTAL SPECIFICATIONS

5.5.4 ENVIRONMENTAL PRACTICES FORM

5.5.5 ENVIRONMENTAL PLAN

5.6 COMPENSATION STRUCTURE/PRICING

5.6.1 FIXED-PRICE FEES

5.6.2 TIME AND MATERIALS / HOURLY RATE WORK

5.6.3 WEB HOSTING CHARGES – GIS ONLY

5.6.4 BUSINESS EXPENSES

5.6.5 PROMPT PAY DISCOUNT

Table of Contents Page 3

6 SUPPLIER DIVERSITY PLAN (SDP)

6.1 PROGRAM BACKGROUND

6.2 FINANCIAL COMMITMENT REQUIREMENTS

6.3 ELIGIBLE SDP PARTNER CERTIFICATION CATEGORIES

6.4 ELIGIBLE TYPES OF BUSINESS-TO-BUSINESS RELATIONSHIPS

6.5 PROGRAM FLEXIBILITY

6.6 SDP PLAN FORM REQUIREMENTS

6.7 EVALUATION OF SDP FORMS

6.8 SDP SPENDING REPORTS AND COMPLIANCE

6.9 SDP SPENDING VERIFICATION

6.10 PROGRAM RESOURCES AND ASSISTANCE

7 EVALUATION CRITERIA

7.1 MANDATORY REQUIREMENTS

7.2 EVALUATION COMPONENTS

7.2.1 SUPPLIER DIVERSITY PLAN (MINIMUM OF 25% WEIGHT OF THE TOTAL AVAILABLE 100%

EVALUATION POINTS)

7.3 BEST VALUE SELECTION AND NEGOTIATION

8 INSTRUCTIONS FOR SUBMISSION OF RESPONSES

8.1 ELECTRONIC SIGNATURES

8.1.1 ACCEPTABLE FORMS OF SIGNATURE

8.2 LIMITS AND RESTRICTIONS

8.2.1 FILE SIZE LIMITS

8.2.2 DOCUMENT PAGES

8.2.3 FILE FORMAT RESTRICTIONS

8.3 GENERAL QUOTE REQUIREMENTS, PROVISIONS, AND PROHIBITIONS

8.3.1 QUOTE CONTENT

8.3.2 NON-COLLUSION

8.3.3 MULTIPLE QUOTES

8.3.4 MINIMUM QUOTE DURATION

8.3.5 BIDDER’S CONTACT INFORMATION

8.3.6 OWNERSHIP OF SUBMITTED QUOTES

8.3.7 PROHIBITIONS

8.3.8 PUBLIC RECORDS LAW

8.3.9 REASONABLE ACCOMMODATION

9 REQUIREMENTS FOR DOING BUSINESS AFTER CONTRACT AWARD

9.1 REQUIRED FORMS

9.2 USE OF COMMBUYS

9.3 STATEWIDE CONTRACT VENDOR COMMUNICATIONS PROTOCOL

9.3.1 CHANGES TO CONTRACTOR’S INFORMATION

9.3.2 SINGLE POINT OF CONTACT

9.3.3 REPLACEMENT OF CONTRACTOR STAFF

9.4 VENDOR RELATIONSHIP MANAGEMENT

Table of Contents Page 4

9.5 PERFORMANCE MEASURES

9.5.1 MINIMUM AMOUNT OF BUSINESS WITH THIS CONTRACT

9.5.2 CONTINUED QUALIFICATION BASED ON PERFORMANCE

9.5.3 FAILURE TO PERFORM CONTRACTUAL OBLIGATIONS

9.5.4 SUSPENDING CONTRACTORS FOR LACK OF BUSINESS

9.6 REPORTING REQUIREMENTS AND DUE DATES

9.6.1 REPORTING AND PAYMENT DUE DATES

9.6.2 QUARTERLY SALES, SUPPLIER DIVERSITY PROGRAM EXPENDITURE, AND ENVIRONMENTALLY

PREFERABLE PRODUCTS REPORT

9.6.3 STATEWIDE CONTRACT ADMINISTRATION QUARTERLY FEE PAYMENT AND REPORT

9.6.4 AUDIT

9.6.5 OTHER TERMS

9.6.6 AD HOC REPORTS

9.7 PAYMENT RELATED TERMS

9.7.1 BILL PAYMENT

9.7.2 LATE PAYMENT FEES

9.7.3 ELECTRONIC FUNDS TRANSFER (EFT)

9.7.4 CREDITWORTHINESS

9.7.5 TAX EXEMPTION

10 RFR APPENDICES

10.1 APPENDIX 1 – REQUIRED TERMS FOR ALL STATEWIDE RFRS

10.1.1 APPLICABLE PROCUREMENT LAW

10.1.2 GENERAL PROCUREMENT INFORMATION

10.1.3 TERMS AND REQUIREMENTS PERTAINING TO AWARDED STATEWIDE CONTRACTS

10.2 APPENDIX 2– REQUIRED TERMS FOR ALL INFORMATION TECHNOLOGY STATEWIDE

RFRS

10.2.1 ENTERPRISE POLICY AND STANDARDS

10.3 APPENDIX 3 - INSTRUCTIONS FOR VENDORS RESPONDING TO BIDS ELECTRONICALLY

THROUGH COMMBUYS INTRODUCTION

11 GLOSSARY

RFR ITS81 COMMBUYS BID NUMBER - BD-24-1080-OSD03-OSD03-94676 Page 1

1 INTRODUCTION AND BID OVERVIEW

1.1 Summary Description of Procurement

The Commonwealth of Massachusetts and the ITS81 IT Project Services Strategic Sourcing Team (SST) are soliciting Bidders for the acquisition of IT Project Services and GIS Services. The resulting Contract will serve as the primary Statewide Contract used by Executive Agencies of the Commonwealth for the goods and services covered by the Contract. The resulting Contract will replace ITS74 IT Project Services and ITS74GIS IT Project Services Geographic Information Systems. The Contract will also be available for use by other Eligible Entities.

The Commonwealth is looking for vendors with a focus on environmentally preferable practices and products. This contract has categories that have been expanded to specifically call out sought after services, as well as speaking directly to how Software as a Service (SAAS) is handled within the parameters of this contract (RFR Section 4.1).

The expanded categories are:

1. EDM (Enterprise Data Management) Data Analytics

2. Software Operations and Support Services

3. User Centered Design and Development

4. GIS (Geographic Information Systems)

1.2 Estimated Procurement Calendar

Action Date

Announcement of Intent to Procure 11/01/23

Bid Release Date 02/08/2024

Bidders Conference 02/15/24, 1:00PM, this will be a virtual conference via ZOOM

Deadline for submission of written questions through COMMBUYS “Bid Q&A”

02/20/24, 5:00 PM

Official answers for Bid Q&A published (Estimated)

02/26/24

Training for Online Submission – Contractors that have not previously submitted electronic quotes via COMMBUYS are strongly encouraged to attend training

2/14/24 10:00 AM EST

2/28/24 1:00 PM EST

3/12/24 10:00 AM EST

3/26/24 1:00 PM EST

Online Webinar:

This interactive webcast provides instructions on several activities:

Locating and responding to bids;

Using the bid Q&A feature; Creating a quote response; Revising a Quote response. Access the webcast here.

https://urldefense.com/v3/__https:/us02web.zoom.us/w/89358836694?tk=kNePIIK1a6be4IvIe9lIXwVaM5qAhtNR0iTMqTD8cDI.DQYAAAAUzjOj1hZFeUxLRWpINFFJbWJfWDRnUHJ0STN3AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&pwd=Y2dlL3p2WjFrV1Avbytzc2RUMm5Pdz09__;!!CPANwP4y!VeDgdGmnsCERKjfAT_XWrmfOBlwFPi4bxsFG598Gq1jL5Qt8fsQZQvPOSqBBdrarxWWyzqWtHTWb59QN9tlkjA$ https://www.screencast.com/t/GMJLKkilF12

RFR ITS81 COMMBUYS BID NUMBER - BD-24-1080-OSD03-OSD03-94676 Page 2

Bid Amendment Deadline. Bid documents will not be amended after this date.

03/06/2024

Deadline for Quotes/Bid Responses (“Bid Opening Date/Time” in COMMBUYS)

03/27/24, 2:00PM

Late bids will not be considered.

Notification of Apparent Successful Bidder(s) (Estimated)

05/01/2024

Estimated Contract Start Date (actual start date will be the contract effective date, which is the date the contract is executed by the parties)

07/01/2024

*See Appendix 3, "Training for Vendors Responding to Bids On COMMBUYS" for instructions on how to register for live webinar and additional trainings that may be helpful to prospective bidders.

Visit https://attendee.gototraining.com/957t1/catalog/894414649161911296?tz=America/New_York for additional Instructor-Led Training and Webinar dates.

Times are Eastern Time (US), as displayed on the COMMBUYS system clock after logging in. If there is a conflict between the dates in this Procurement Calendar and dates in the Bid’s Header, the dates in the Bid’s Header on COMMBUYS shall prevail. Bidders are responsible for checking the Bid record, including Bid Q & A, on COMMBUYS for Procurement Calendar updates.

1.2.1 Submission of Bid Questions

The “Bid Q & A” function in COMMBUYS allows Bidders to ask written questions and receive written answers regarding this Bid. To locate the Bid Q & A, log into COMMBUYS, locate the Bid, acknowledge receipt of the Bid, and scroll down to the bottom of the Bid Header page. The “Bid Q & A” button allows Bidder’s access to the Bid Q & A page.

All questions must be submitted through the Bid Q & A page. Questions must be asked prior to the Deadline stated in the Estimated Procurement Calendar. The Strategic Sourcing Team (SST) reserves the right not to respond to late questions. Bidders are responsible for verifying that their questions are recorded in COMMBUYS and appear on the Bid Q & A page.

Questions submitted to the SST outside of COMMBUYS will not be answered.

Content entered must be suitable for public viewing. Bidders must not include inappropriate content, including but not limited to, information that could be considered personal, security sensitive, inflammatory, incorrect, or collusory. The SST reserves the right to edit or delete any inappropriate content.

All answers are final when posted. Any subsequent revisions to previously provided answers will be dated.

1.2.2 Bid Amendment Deadline

Although Bidders may submit quotes any time after the Bid Release Date and prior to the Bid Opening Date, Bidders should ensure that their quotes are based upon the final versions of the RFR and its attachments. Final versions of RFR and its attachments are available after the Bid Amendment Deadline date.

The SST reserves the right to make amendments to the Bid after initial publication. It is each Bidder’s responsibility to check COMMBUYS for any amendments, addenda or modifications to this Bid, and any Bid Q & A records related to this Bid. The SST and the Commonwealth accept no responsibility and will provide no accommodation to Bidders who submit a Quote based on an out-of-date Bid or on information received from a https://attendee.gototraining.com/957t1/catalog/894414649161911296?tz=America/New_York

RFR ITS81 COMMBUYS BID NUMBER - BD-24-1080-OSD03-OSD03-94676 Page 3 source other than COMMBUYS. At the SST’s discretion, the Bid Amendment Deadline may be extended. As stated above, it is the Bidder’s responsibility to check the Bid record in COMMBUYS for revisions and updates.

1.2.3 Bidders Conference

The Bidder’s Conference is a physical, web or telephone conference conducted by the SST for the purpose of informing prospective Bidders about general Bid information. All questions related to the scope and technical requirements should be submitted using the Bid Q and A module in COMMBUYS.

Bidder attendance is strongly encouraged. Please refer to the Bidders Conference section of the Header Information for this Bid in COMMBUYS for any updated information, including the location, time, and date of the Bidders’ Conference. The Bidder’s conference is scheduled for 2/15/24 at 1:00 PM EST

1.2.4 Late Bids will not be Considered

Bid responses must be received in full by the bid opening date and time shown on COMMBUYS ("Bid Opening Date/Time", i.e., the Deadline for Quotes/Bid Responses). Proposals received after the deadline will be ineligible for consideration and deemed non-responsive. Each bidder/offeror must submit all required bid response forms electronically through COMMBUYS. When submitting a quote electronically through COMMBUYS, please allow sufficient time to complete any online forms and upload documents. If you are in the middle of uploading your proposal when the deadline is reached, the system will stop the process and you will be unable to submit your Quote. It is recommended that Quotes be submitted as far in advance as possible before the deadline to allow time to obtain assistance from the OSD Help Desk if needed.

1.2.5 Debriefing

The SST will conduct debriefings for unsuccessful Bidders, if requested within 14 calendar days of notification that your Quote has not been selected for an award. Debriefing guidelines will be provided in advance prior to the debriefing.

1.3 Additional Bid Information

1.3.1 Anticipated Contract Duration:

The initial term of this Contract is ten (10) years, with an extend beyond period of three (3) years. This Contract does not have any options to renew.

1.3.2 Performance and payment time frames which exceed Contract duration All term leases, rentals, maintenance, or other agreements for services entered into during the duration of this Contract and whose performance and payment time frames extend beyond the duration of this Contract shall remain in effect for performance and payment purposes (limited to the time frame and services established per each written agreement). No written agreement shall extend more than three years beyond the final termination date of this Statewide Contract. No new leases, rentals, maintenance, or other agreements for services may be executed after the Contract has expired. Any contractor entering new engagements with Eligible Entities after contract expiration will be subject to remedial measures, which may include but are not limited to mandatory point deduction for future bid submissions and suspension of other contracts with OSD.

1.3.3 Estimated Value of the Contract

The estimated value of purchase(s) resulting from this Bid is $470 million dollars. The Commonwealth makes no guarantee that any commodities or services will be purchased from any Contract resulting from this Bid. Any estimates or past procurement volumes referenced in this Bid are included only for the convenience of Bidders and are not to be relied upon as any indication of future purchase levels.

This Estimated Value was derived by reviewing Contractor sales reports to Commonwealth of Massachusetts Eligible Entities for FY 2019 to 2023.

1.3.4 Estimated Number of Awards

The target maximum number of Contractors is 130. A minimum of 50 awards will be targeted to smaller vendors (gross annual income $5 million or less). The SST may award more or fewer contracts, if it is in the best interests of the Commonwealth to do so.

1.3.5 Adding Contractors after Initial Contract Award

If, over the life of the Contract, the SST determines that additional Contractors should be added to meet the requirements of the Commonwealth, these may first be drawn from qualified companies which responded to this Bid but were not awarded contracts and/or the Bid may be reopened to obtain additional Quotes.

RFR ITS81 COMMBUYS BID NUMBER - BD-24-1080-OSD03-OSD03-94676 Page 4

1.3.6 Acquisition Method(s):

Check All Applicable (“X”):

Category

X Fee-For-Service

Outright Purchase

Rental (not to exceed 6 months)

Term Lease

License (only if provided at no charge)

Subscriptions: (only if provided at no charge)

1.3.7 Entities Eligible to Use the Resulting Contract

Any Contract(s) resulting from this Bid will be open for use by the following entities:

• Cities, towns, districts, counties, and other political subdivisions

• Executive, Legislative and Judicial Branches, including all Departments and elected offices therein

• Independent public authorities, commissions, and quasi-public agencies

• Local public libraries, public school districts and charter schools

• Public hospitals owned by the Commonwealth

• Public institutions of higher education

• Public purchasing cooperatives

• Non-profit organizations that are doing business with the Commonwealth;

• Other states and territories with no prior approval by the State Purchasing Agent; and

• Other entities when designated in writing by the State Purchasing Agent.

Each Eligible Entity is responsible for executing its own purchase orders and paying its own invoices for goods and/or services acquired from this Contract. Contractors will be responsible for marketing their goods and/or services to Commonwealth Agencies and other Eligible Entities.

2 ADDITIONAL INFORMATION ON PROCUREMENT SCOPE

There are no limits to project size or dollar amount for engagements under this Statewide Contract. However, Contracting Departments with very large projects may prefer to conduct their own procurements rather than use the Statewide Contract, particularly in cases in which the Statewide Contract does not include all the market leaders specializing in the subject matter of their project. Agencies may request approval from the Purchasing Agent to conduct their own procurements for services available through Statewide Contracts. Bidders will not be limited to doing business in the category or categories that qualified them for an award.

3 BIDDER QUALIFICATIONS

3.1 Company experience

3.1.1 Business background

Foundational information about the bidder’s organization to provide insight into its history, function and company design.

3.1.2 Years in the industry of the Bid

Bidders must have been in the business of providing IT Project Services and or GIS for at least the two most recent consecutive years prior to the RFR submission deadline (See RFR Section 1.2, Estimated Procurement Calendar).

In the case of companies formed fewer than two years prior to this date via merger, acquisition or some other means, the SST may consider the experience of all companies involved in the merger or acquisition.

3.1.3 Company Organizational Chart

Please provide a high-level overview of your organizational chart representing the organization's structure, highlighting the different jobs, and departments.

https://www.mass.gov/service-details/non-profit-purchasing-programs

RFR ITS81 COMMBUYS BID NUMBER - BD-24-1080-OSD03-OSD03-94676 Page 5

3.2 Employee and/or business technical/business experience, certifications, licenses

3.2.1 General Qualifications

3.2.1.1 Project Experience

Bidders must demonstrate their experience in the categories under which they are bidding by describing two projects that they have completed by or before the issue date of this RFR, and on or after 1/1/2020, either as the prime contractor or a principal subcontractor. Each project description must include a client reference letter relevant to the project being described written on the reference letter template provided in COMMBUYS. The description must include the client’s name, the start and end dates, the approximate dollar value, the purpose of the project, and the outcome. If a project is being completed in phases, bidders may describe a project that is not complete but has one or more completed phases, provided that the completed phases constitute accepted deliverables. In the client’s reference letter the clients must be able to describe the outcome of the completed work.

In describing their project experience, Bidders should be as specific as possible. The Bidder’s role in the project must be clearly identified if more than one company was involved. Also, the Bidder should organize their project description in terms of the phases of their project management methodology.

Bidders must review the category definitions provided in IT Project Services Category Definitions in choosing what categories to bid under and in preparing their project descriptions. In addition, Bidders’ project descriptions must describe projects that meet the definition of "Project" in the first paragraph of RFR Section 5, Commodity, Service, Environmental, and Cost Specifications, except in the case of software support, as defined in item 2 of RFR Section 5.6.2, Time and Materials / Hourly Rate Work. Engagements which the vendor presents as projects in their RFR Response must have a minimum value of $20,000.

Some categories include additional questions as described below and in the category Response Form.

Bidders may not use the same project in response to more than one category. If this occurs, points will only be awarded to one of the projects and its associated reference letter.

If the response for Project 1 or Project 2 exceeds a total of three (3) pages, points will be deducted from the score potentially leading to disqualification.

Bidders must submit their responses using a font size of no less than 12. Responses submitted with a font size of less than 12 will have the font size adjusted to meet the size 12 font requirement and the three (3) page limit rules will apply to the final product.

3.2.2 Additional Geographic Information Systems (GIS) Qualifications

3.2.2.1 Company Qualifications

Company qualifications refer to the types of services offered, the production capacity of the firm, staff qualifications, and the types and strengths of existing business relationships. Bidders must provide an overview of the types of services and capabilities they provide to clients as they pertain to the category to which Bidder is responding (see below). In addition, Bidders must provide a summary of current staff that could perform work under this contract and of their individual qualifications as they pertain to the services sought through this procurement. Any employees that are not salaried but are deployed on a project-by-project basis must be separately presented. Bidders must also describe and document (e.g., current formal agreements and/or attestations of existing or past project work in the past three years) existing relationships (domestic or international) with other companies that extend their capacity for delivering the services being sought in a category.

3.2.2.1.1 General GIS Services

Bidders must briefly describe their GIS-related products and services as they pertain to this category. Bidder must summarize numbers of staff by job category and provide brief summaries of professional qualifications for staff with job responsibilities that include project manager, group lead, functional lead, etc., and higher-level staff that could be involved in completing projects in this category; including professional summaries for ALL staff is not desired. Any employees that are not salaried but are deployed on a project-by-project basis must be identified.

RFR ITS81 COMMBUYS BID NUMBER - BD-24-1080-OSD03-OSD03-94676 Page 6

3.2.2.1.2 Web Map Services or Clients Maintenance and Enhancements Bidders must briefly describe their GIS-related products and services as they pertain to this category. Bidder must list the names and discipline/role (i.e., Developer, Senior Developer, Project Manager) of company/team personnel; this can include individuals available through documented formal business relationships, as described in RFR Section 3.2.2.1, Company Qualifications, above. Bidders must provide brief summaries of each person’s professional experience. In addition, Bidders must include a table that cross-indexes staff and reference projects for the following skill sets:

3.2.2.1.3 Required Bidder Qualifications:

Ability to commit to GeoServer/GeoTools projects

Familiarity with GeoServer administration

Knowledge of WMS and WFS OGC standards

Experience with Leaflet web mapping applications

Experience with Linux environments

Familiarity with Postgres and PostGIS

Familiarity with JQuery and other JavaScript libraries

Familiarity with scripting languages Python, PHP and Perl

3.2.2.1.4 Preferred Bidder Qualifications:

Familiarity with Postgres RDS

Familiarity with vector tiles

Familiarity with GeoServer’s GeoWebCache

Familiarity with Docker

3.2.2.2 Project Experience

Bidders must describe three projects that they have completed by or before the issue date of this RFR, and subsequent to or on 1/1/2020, either as the prime contractor or as the principal subcontractor.

The description must include the client’s name, the client’s geographic jurisdiction or scope, the start and end dates, the approximate dollar value, the project’s purpose, and the outcome. If a project is being completed in phases, bidders may describe a project which is not complete but has one or more completed phases, provided that the completed phases constitute deliverables completed and accepted by the client. In the client’s reference letter, the clients must be able to describe the outcome of the completed work.

In addition, Bidders’ project descriptions must describe engagements that meet the definition of "Project" in the first paragraph of RFR Section 5, Commodity, Service, Environmental, and Cost Specifications, except in the case of software support, as defined in item 2 of RFR Section 5.6.2, Time and Materials / Hourly Rate Work. Engagements which the vendor presents as projects in their RFR Response must have a minimum value of $2,500.

In describing their project experience, Bidders should be as specific as possible. Besides meeting the requirements stated in the above paragraph, these experience narratives must also include the information requested for the relevant category below. The project description must enable the SST to identify the Bidder’s role in the project if more than one company was involved. Any Bidder responding to this RFR that wants to be considered for more than one GIS category must provide three project descriptions and reference letters relevant to each category. If the project description for any of the three projects presented exceeds two pages, points will be deducted from the score.

3.2.2.2.1 Category General GIS Services

Responders in this category must describe three projects illustrating their experience in providing the services described for this category in RFR Section 5.1.5, Category 4 GIS. Project experience for GIS

RFR ITS81 COMMBUYS BID NUMBER - BD-24-1080-OSD03-OSD03-94676 Page 7 implementation planning should highlight assisting government clients with planning for multiple departments to use a single GIS application or planning for an enterprise GIS supporting multiple departments.

In describing experience with developing or maintaining GIS data, projects that required conformance to a state or federal standard, such as the MassGIS Digital Parcel Standard or the FGDC Thoroughfare, Landmark, and Postal Address Data Standard, are particularly relevant. Relevant data maintenance experience includes routine updates such as annual maintenance of assessor parcel mapping or updates to planimetric mapping or to public works pipe infrastructure.

Project descriptions with application development should include a brief summary of application functionality, identify the software development environment in which the application was developed and give some indication of the overall scale of usage per month (e.g., number of screens or web pages, volume of data being served, level of effort in development, cost and other common consumption metrics).

Project descriptions should also include a brief overview of the application architecture, including database, map server/API and client platform. Applications based on ESRI products or that currently consume web mapping services, and especially MassGIS web mapping services, are particularly relevant.

Finally, Bidders must also describe the experience they have providing hosting services for web mapping applications. Bidders must identify clients and provide URLs and/or instructions for accessing up to three of these applications; ideally, one of these three must be a municipality in the United States with a population of less than 100,000. Bidders must describe where those services are hosted with an emphasis on reliability and security. A complete response to this section of the RFR must include pricing information for providing these hosting services in the following format:

Small Municipalities - # parcels < 5,000 (1)

Medium Municipalities -

#parcels 5,000 – 15,000

(1)

Large Municipalities -

#parcels >15,000 (1)

One time set up fee (2)

Monthly

Hosting Fee (2)

(1) Parcel counts based on version of municipal parcel mapping available through MassGIS’ web site at the time a quote is being provided for hosting a web mapping application.

(2) These are maximum fees; vendors could charge less to, for example, account for lower costs for certain times of day or days of the week.

The fees entered in any cell above must be a single value (i.e., $250; no ranges) and these values will become those charged clients under the ITS81 ITProjServ master service agreement; these fees will be permitted to increase by up to 2% on each 12-month anniversary of the hosting agreement.

3.2.2.2.2 Category Web Map Services or Clients Maintenance and Enhancement Bidders must concisely describe three projects in which client organizations have been provided maintenance or enhancement services for web mapping services or for clients built using a mix of software.

Bidders must identify the staff, including subcontractors, who had a substantive role in each project and briefly summarize their contributions.

3.3 Continuity of Operations Plan (COOP)

In a declared state of emergency where the safety and well-being of citizens are at risk, contractors may be asked to supply the purchasing entity with the commodities and/or services under the Statewide Contract on a priority basis. The Bidder’s Response should indicate whether there is a written Continuity of Operations Plan (COOP) that describes how the company will continue to do business in case of an emergency. In addition, the Bidder should supply a list of emergency contact information including name, position/title, phone, email, and cell phone.

This information will not be considered in the evaluation of the Response.

RFR ITS81 COMMBUYS BID NUMBER - BD-24-1080-OSD03-OSD03-94676 Page 8

3.4 Emergency Response Capabilities

Contractors may be called upon during a declared state of emergency to supply and/or deliver to the Commonwealth, on a priority basis, commodities and/or services which are currently under Statewide Contract.

To accommodate such requests, Contractors may be asked, and must make every effort to service, these requests from regular sources of supply at the rates set forth in any Statewide Contract resulting from this RFR.

3.5 Financial stability, bankruptcy, litigation, and contract defaults

Bidders are required to submit, as a part of this RFR submission, a Certificate of Good Standing from the Commonwealth of Massachusetts’ Secretary of State to show that the Bidder is compliant with their fiscal obligations. No contract will be awarded without the provision of these documents.

3.5.1 Financial statement

Bidders must provide a statement of their total gross reported revenue for FY2022 or the most recent completed fiscal year, for bidders in business for two years please provide for the most recent two active fiscal years as a standard indication of company/organization size.

3.5.2 Bankruptcy, litigation, and contract defaults

Bidders must provide a list of any outstanding contingencies, such as lawsuits or other claims or charges, against the Bidder related to performance of the services sought under this RFR.

4 ADDITIONAL TERMS AND CONDITIONS

4.1 SaaS, PaaS, and IaaS (Cloud Services) and Limited use Specifications

4.1.1 Limited use specifications for SAAS

The ITS81 contract is not intended to offer SaaS as a standalone category. SaaS may ONLY be utilized through the ITS81 contract on a temporary basis, as is needed for the creation or completion of a project that has been procured through the ITS81 contract. Any SaaS purchase/renewal that needs to be performed after project completion needs to be procured using the ITS60 and/or ITS75 statewide contract or their successors.

4.1.2 SaaS, PaaS, and IaaS (Cloud Services) required terms

Vendors offering SaaS, PaaS, or IaaS (“Cloud Services”) shall ensure that the additional terms and conditions in Exhibits 1,2,3 to this RFR for the applicable services are met. When offering Cloud Services as part of their quote, Vendors must advise the software publisher or service provider that, if their quote is selected for award, the Eligible Entity may require that a negotiated version of the Cloud Services terms, as agreed to by the Eligible Entity and the software publisher or service provider, will form a part of the agreement.

4.1.3 Users Approval

Executive Departments and other Commonwealth network users must request approval from the Executive Office of Technology Services and Security (“EOTSS”) to use ITS81 for specific purchases:

1. on-premises software: no approval required

2. software as a service (SaaS) and related services: no approval required, provided that all purchases comply with the following guidance:

i. Purchasing Entities must review to determine whether product is available from existing enterprise agreement. EOTSS maintains a number of enterprise agreements (e.g. Microsoft, Adobe, etc.) and offers products to Commonwealth purchasers at a discounted rate.

ii. SaaS meets or exceeds the standards set forth in the Enterprise Information Security Policies and Standards and Accessibility Standards Enterprise information security policies and standards, and accessibility contract language for it solutions

iii. SaaS provider has agreed to the terms in the EOTSS Cloud Terms document and/or provided responses to each item in detail and purchaser has confirmed that such responses meet its needs

3. infrastructure-as-a-service (IaaS), platform as a service (PaaS), and related services: EOTSS’ approval is required. Prior to issuing an RFQ, submit a description of the intended purchase including https://www.mass.gov/handbook/enterprise-information-security-policies-and-standards https://www.mass.gov/info-details/accessibility-contract-language-for-it-solutions https://massgov.sharepoint.com/sites/TSS-Contract-Mgmt/SitePages/Templates.aspx

RFR ITS81 COMMBUYS BID NUMBER - BD-24-1080-OSD03-OSD03-94676 Page 9 the specifications, functionality, number of users, and anticipated costs to EOTSS, please reference the contract user guide.

4.2 DATA OWNERSHIP

The Eligible Entity will own all rights, title and interest in its data. The Contractor shall not access Eligible Entity user accounts or Eligible Entity data, except (1) in the course of data center operations, (2) in response to service or technical issues, (3) as required by the express terms of RFR ITS81, (4) as required by the express terms of an agreement between the Eligible Entity and Contractor placed under, and subject to, RFR ITS81 (an “RFR ITS81 Order”), or (5) at the Eligible Entity’s written request.

Contractor shall not collect, access, or use user-specific Eligible Entity Data except as strictly necessary to provide Service to the Eligible Entity. No information regarding an Eligible Entity’s use of the Service may be disclosed, provided, rented, or sold to any third party for any reason unless required by law or regulation or by an order of a court of competent jurisdiction. This obligation shall survive and extend beyond the term of RFR ITS81.

4.3 DATA PROTECTION

Protection of personal privacy and data shall be an integral part of the business activities of the Contractor to ensure there is no inappropriate or unauthorized use of Eligible Entity information at any time. To this end, the Contractor shall safeguard the confidentiality, integrity and availability of Eligible Entity information and comply with the following conditions:

a) The Contractor shall implement and maintain appropriate administrative, technical, and organizational security measures to safeguard against unauthorized access, disclosure or theft of Personal Data and Non- Public Data. Such security measures shall be in accordance with recognized industry practice and not less stringent than the measures the Contractor applies to its own Personal Data and Non-Public Data of similar kind.

b) All data obtained by the Contractor in the performance of an RFR ITS81 Order shall become and remain the property of the Eligible Entity.

c) All Personal Data shall be encrypted at rest and in transit with controlled access. Unless otherwise stipulated, the Contractor is responsible for encryption of the Personal Data. Any stipulation of responsibilities will identify specific roles and responsibilities and shall be included in the service level agreement (SLA), or otherwise made a part of the RFR ITS81 Order.

d) Unless otherwise stipulated, the Contractor shall encrypt all Non-Public Data at rest and in transit. The Eligible Entity shall identify data it deems as Non-Public Data to the Contractor. The level of protection and encryption for all Non-Public Data shall be identified in the SLA.

e) At no time shall any data or processes — that either belong to or are intended for the use of an Eligible Entity or its officers, agents, or employees — be copied, disclosed, or retained by the Contractor or any party related to the Contractor for subsequent use in any transaction that does not include the Eligible Entity.

f) The Contractor shall not use any information collected in connection with the Services issued from an RFR ITS81 Order for any purpose other than fulfilling the Services.

4.4 DATA LOCATION

The Contractor shall provide its services to the Eligible Entity and its end users solely from data centers in the United States. Storage of Eligible Entity data at rest shall be located solely in data centers in the United States. The Contractor shall not allow its personnel or contractors to store Eligible Entity data on portable devices, including personal computers, except for devices that are used and kept only at its United States data centers. The Contractor shall permit its personnel and contractors to access Eligible Entity data remotely only as required to provide technical support. The Contractor may provide technical user support on a 24/7 basis using a Follow the Sun model, unless otherwise prohibited in an RFR ITS81 Order.

RFR ITS81 COMMBUYS BID NUMBER - BD-24-1080-OSD03-OSD03-94676 Page 10

4.5 SECURITY INCIDENT OR DATA BREACH NOTIFICATION

4.5.1 Incident Response

Contractor may need to communicate with outside parties regarding a security incident, which may include contacting law enforcement, fielding media inquiries and seeking external expertise as mutually agreed upon, defined by law or contained in the RFR ITS81 Order. Discussing security incidents with the Eligible Entity should be handled on an urgent as-needed basis, as part of Contractor’s communication and mitigation processes as mutually agreed upon, defined by law or contained in RFR ITS81.

4.5.2 Security Incident and Data Breach Reporting Requirements If Contractor knows or has reason to know of a security incident or data breach that may affect the security of Eligible Entity data, Contractor shall notify such Eligible Entity as soon as practicable from the date of the security incident or data breach, and in no event more than three (3) days, and shall cooperate with the Eligible Entity to meet any requirements under applicable state or Federal law.

In the event of a security incident or data breach, Contractor will take commercially reasonable steps to mitigate the effects, to resolve the security incident or data breach in a timely manner, and to put measures in place to prevent the reoccurrence of similar security incidents or breaches in the future.

4.6 PERSONAL DATA BREACH RESPONSIBILITIES

This section only applies when a Data Breach occurs with respect to Personal Data within the possession or control of the Contractor.

a) The Contractor, unless stipulated otherwise, shall immediately notify the appropriate Eligible Entity identified contact by telephone in accordance with the agreed upon security plan or security procedures if it reasonably believes there has been a security incident.

b) The Contractor, unless stipulated otherwise, shall promptly notify the appropriate Eligible Entity identified contact within 24 hours or sooner by telephone, unless shorter time is required by applicable law or the RFR ITS81 Order, if it has confirmed that there is, or reasonably believes that there has been a Data Breach. The Contractor shall (1) cooperate with the Eligible Entity as reasonably requested by the Eligible Entity to investigate and resolve the Data Breach, (2) promptly implement necessary remedial measures, if necessary, and (3) document responsive actions taken related to the Data Breach, including any post-incident review of events and actions taken to make changes in business practices in providing the services, if necessary.

c) Unless otherwise stipulated, if a data breach is a direct result of Contractor’s breach of its contractual obligation to encrypt personal data or otherwise prevent its release as reasonably determined by the Eligible Entity, the Contractor shall bear the costs associated with (1) the investigation and resolution of the data breach; (2) notifications to individuals, regulators or others required by federal and state laws or as otherwise agreed to; (3) a credit monitoring service required by state (or federal) law or as otherwise agreed to; (4) a website or a toll-free number and call center for affected individuals required by federal and state laws — all not to exceed the average per record per person cost calculated for data breaches in the United States in the most recent Cost of Data Breach Study: Global Analysis published by the Ponemon Institute at the time of the data breach; and (5) complete all corrective actions as reasonably determined by Contractor based on root cause.

4.7 NOTIFICATION OF LEGAL REQUESTS

The Contractor shall contact the Eligible Entity immediately upon receipt of any electronic discovery, litigation holds, discovery searches, public records requests, and expert testimonies related to the Eligible Entity’s data under RFR ITS81, or which in any way might reasonably require access to the data of the Eligible Entity. The Contractor shall not respond to subpoenas, service of process and other legal requests related to the Eligible Entity without first notifying and obtaining the approval of the Eligible Entity, unless prohibited by law from providing such notice.

4.8 TERMINATION AND SUSPENSION OF SERVICE

a. In the event of a termination of RFR ITS81 or applicable RFR ITS81 Order, the Contractor shall implement an orderly return of Eligible Entity’s data in a CSV or another mutually agreeable format at a time agreed to by the parties or allow the Eligible Entity to extract its data and the subsequent secure disposal of Eligible Entity’s data.

RFR ITS81 COMMBUYS BID NUMBER - BD-24-1080-OSD03-OSD03-94676 Page 11

b. During any period of service suspension, the Contractor shall not take any action to intentionally erase or otherwise dispose of any of the Eligible Entity’s data.

c. In the event of termination of any services under an RFR ITS81 Order or RFR ITS81 in its entirety, the Contractor shall not erase Eligible Entity’s data for a period of ninety (90) days after the effective date of termination, unless otherwise agreed to by the Eligible Entity in writing. The contractor shall impose no fees for access and retrieval of Eligible Entity data during this ninety (90) day period. After such period, the Contractor shall have no obligation to maintain or provide any Eligible Entity’s data and shall thereafter, unless legally prohibited, delete all Eligible Entity’s data in its systems or otherwise in its possession or under its control.

d. The Eligible Entity shall be entitled to any post termination assistance generally made available with respect to the services unless a unique data retrieval arrangement has been established as part of an SLA.

e. Upon termination of the Services or RFR ITS81 in its entirety, the Contractor shall securely dispose of all Eligible Entity’s data in all its forms, such as disk, CD/ DVD, backup tape and paper, unless stipulated otherwise by the Eligible Entity. Data shall be permanently deleted and shall not be recoverable, according to National Institute of Standards and Technology (NIST)-approved methods. Certificates of destruction shall be provided to the Eligible Entity.

4.9 BACKGROUND CHECKS

Upon the request of the Eligible Entity, the Contractor shall conduct criminal background checks and not utilize any staff, including subcontractors, to fulfill the obligations of RFR ITS81 who have been convicted of any crime of dishonesty, including but not limited to criminal fraud, or otherwise convicted of any felony or misdemeanor offense for which incarceration for up to 1 year is an authorized penalty. The Contractor shall promote and maintain an awareness of the importance of securing the Eligible Entity’s information among the Contractor’s employees and agents. If any of the stated personnel providing services under an RFR ITS81 Order is not acceptable to the Eligible Entity in its sole opinion as a result of the background or criminal history investigation, the Eligible Entity, in its sole option shall have the right to either (1) request immediate replacement of the person, or (2) immediately terminate the RFR ITS81 Order and any related service agreement.

ITS81 Contractors must absorb the cost of background checks, even if the Contracting Department has special requirements (e.g., a childcare agency may have specific requirements pertaining to child abuse or neglect). ITS81 Contractors should expect that Contracting Departments will require publicly available CORI checks for any Resources who will be on-site at Contracting Department locations or who will have access to information systems operated within the Commonwealth’s MAGNet (Massachusetts Access to Government Network). ITS81 Contractors may use the companies they normally use for background checks, provided that the information is at least as detailed and complete as that provided by publicly available CORI checks. Contracting Departments may waive this requirement. Checks that have been done previously may be used provided that they are not more than six months old.

CORI checks are done by the Criminal History System Board, located at 200 Arlington Street, Chelsea MA 02150.

To request publicly available CORI, go to Mass.gov, which includes instructions and forms for requesting publicly available CORI.

The following categories of crimes will disqualify a Resource from providing services to Contracting Departments

• Data Security/Privacy Violation of any state or federal law or regulation pertaining to data security and/or privacy, including, without limitation and for example, the Fair Information Practices Act, M.G.L. ch. 66A, and the privacy and security provisions of the Federal Health Information Portability and Accountability Act (“HIPAA”).

• Wiretaps Violation of the state wiretap law, M.G.L. ch. 272, sec. 99, or its federal counterpart, 18 U.S.C. sec. 2511.

• Computer Crimes…